December 2003 - cypherpunks-legacy

Re: Past one terabit/second on fiber
by jim bell 17 Dec '03

17 Dec '03

At 11:10 AM 5/15/96 -0400, brian dodds wrote: >On Tue, 14 May 1996, jim bell wrote: > >> But with >> fiber transmission probably less than 1/100th the cost of older coaxial >> transmission systems, per connection, it is unclear why they're even >> continuing to meter LD phone calls. > >especially when 1Tb fiber is in practice - our phone calls will take only >nanoseconds! :) Reminds me of an old joke: "This computer's so fast it does an infinite loop in 5 seconds!" >anything included in that as to why they used a dfb laser for channel 16? >or is it something obvious i'm missing? They probably just wanted to establish that it could be done, to show that this wasn't dependant on high-cost laser systems. External cavity lasers raise cost and size substantially, but in a laboratory setting they're the most convenient to use. >i notice they're still using the encyclopedia/second benchmark.. It's an old habit, I suppose. It's hard to explain "one trillion", at least to non-tech types. A good modern replacement might be to say, "200 CDROM's per second", except that even today most people don't know how much storage a CDROM represents. "16 million one-way phone calls" is also helpful as a benchmark. Jim Bell jimbell(a)pacifier.com

2 1

Java & signed applets
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

This has some mention of signed applets et al, so I thought it was applicable. -Allen From: IN%"rre(a)weber.ucsd.edu" 11-MAY-1996 23:06:27.24 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Sat, 11 May 1996 15:59:13 -0400 (EDT) From: "Home Page Press, Inc." <staff(a)hpp.com> To: staff(a)hpp.com Subject: JAVA BLACK WIDOWS - SUN DECLARES WAR JAVA BLACK WIDOWS - SUN DECLARES WAR Sun Microsystems' has declared war on Black Widow Java applets on the Web. This is the message from Sun in response to an extensive Online Business Consultant (OBC/May 96) investigation into Java security. OBC's investigation and report was prompted after renowned academics, scientists and hackers announced Java applets downloaded from the WWW presented grave security risks for users. Java Black Widow applets are hostile, malicious traps set by cyberthugs out to snare surfing prey, using Java as their technology. OBC received a deluge of letters asking for facts after OBC announced a group of scientists from Princeton University, Drew Dean, Edward Felten and Dan Wallach, published a paper declaring "The Java system in its current form cannot easily be made secure." The paper can be retrieved at http://www.cs.princeton.edu/sip/pub/secure96.html. Further probing by OBC found that innocent surfers on the Web who download Java applets into Netscape's Navigator and Sun's HotJava browser, risk having "hostile" applets interfere with their computers (consuming RAM and CPU cycles). It was also discovered applets could connect to a third party on the Internet and, without the PC owner's knowledge, upload sensitive information from the user's computer. Even the most sophisticated firewalls can be penetrated . . . "because the attack is launched from behind the firewall," said the Princeton scientists. One reader said, "I had no idea that it was possible to stumble on Web sites that could launch an attack on a browser." Another said, "If this is allowed to get out of hand it will drive people away from the Web. Sun must allay fears." The response to the Home Page Press hostile applet survey led to the analogy of Black Widow; that the Web was a dangerous place where "black widows" lurked to snare innocent surfers. As a result the Princeton group and OBC recommended users should "switch off" Java support in their Netscape Navigator browsers. OBC felt that Sun and Netscape had still to come clean on the security issues. But according to Netscape's Product Manager, Platform, Steve Thomas, "Netscape wishes to make it clear that all known security problems with the Navigator Java and JavaScript environment are fixed in Navigator version 2.02." However, to date, Netscape has not answered OBC's direct questions regarding a patch for its earlier versions of Navigator that supported Java . . . the equivalent of a product recall in the 3D world. Netscape admits that flaws in its browsers from version 2.00 upwards were related to the Java security problems, but these browsers are still in use and can be bought from stores such as CompUSA and Cosco. A floor manager at CompUSA, who asked not to be named, said "its news to him that we are selling defective software. The Navigator walks off our floor at $34 a pop." OBC advised Netscape the defective software was still selling at software outlets around the world and asked Netscape what action was going to be taken in this regard. Netscape has come under fire recently for its policy of not releasing patches to software defects; but rather forcing users to download new versions. Users report this task to be a huge waste of time and resources because each download consists of several Mbytes. As such defective Navigators don't get patched. OBC also interviewed Sun's JavaSoft security guru, Ms. Marianne Mueller, who said "we are taking security very seriously and working on it very hard." Mueller said the tenet that Java had to be re-written from scratch or scrapped "is an oversimplification of the challenge of running executable content safely on the web. Security is hard and subtle, and trying to build a secure "sandbox" [paradigm] for running untrusted downloaded applets on the web is hard." Ms. Mueller says Sun, together with their JavaSoft (Sun's Java division) partners, have proposed a "sandbox model" for security in which "we define a set of policies that restrict what applets can and cannot do---these are the boundaries of the sandbox. We implement boundary checks---when an applet tries to cross the boundary, we check whether or not it's allowed to. If it's allowed to, then the applet is allowed on its way. If not, the system throws a security exception. "The 'deciding whether or not to allow the boundary to be crossed' is the research area that I believe the Princeton people are working on," said Mueller. "One way to allow applets additional flexibility is if the applet is signed (for example, has a digital signature so that the identity of the applet's distributor can be verified via a Certificate Authority) then allow the applet more flexibility. "There are two approaches: One approach is to let the signed applet do anything. A second approach is to do something more complex and more subtle, and only allow the applet particular specified capabilities. Expressing and granting capabilities can be done in a variety of ways. "Denial of service is traditionally considered one of the hardest security problems, from a practical point of view. As [Java's creator] James Gosling says, it's hard to tell the difference between an MPEG decompressor and a hostile applet that consumes too many resources! But recognizing the difficulty of the problem is not the same as 'passing the buck.' We are working on ways to better monitor and control the use (or abuse) of resources by Java classes. We could try to enforce some resource limits, for example. These are things we are investigating. "In addition, we could put mechanisms in place so that user interface people (like people who do Web browsers) could add 'applet monitors' so that browser users could at least see what is running in their browser, and kill off stray applets. This kind of user interface friendliness (letting a user kill of an applet) is only useful if the applet hasn't already grabbed all the resources, of course." The experts don't believe that the problem of black widows and hostile applets is going to go away in a hurry. In fact it may get worse. The hackers believe that when Microsoft releases Internet Explorer 3.00 with support for Java, Visual Basic scripting and the added power of its ActiveX technology, the security problem will become worse. "There is opportunity for abuse, and it will become an enormous problem," said Stephen Cobb, Director of Special Projects for the National Computer Security Association (NCSA). "For example, OLE technology from Microsoft [ActiveX] has even deeper access to a computer than Java does." JavaSoft's security guru Mueller agreed on the abuse issue: "It's going to be a process of education for people to understand the difference between a rude applet, and a serious security bug, and a theoretical security bug, and an inconsequential security-related bug. In the case of hostile applets, people will learn about nasty/rude applet pages, and those pages won't be visited. I understand that new users of the Web often feel they don't know where they're going when they point and click, but people do get a good feel for how it works, pretty quickly, and I actually think most users of the Web can deal with the knowledge that not every page on the web is necessarily one they'd want to visit. Security on the web in some sense isn't all that different from security in ordinary life. At some level, common sense does come into play. "Many people feel that Java is a good tool for building more secure applications. I like to say that Java raises the bar for security on the Internet. We're trying to do something that is not necessarily easy, but that doesn't mean it isn't worth trying to do. In fact it may be worth trying to do because it isn't easy. People are interested in seeing the software industry evolve towards more robust software---that's the feedback I get from folks on the Net." # # # The report above may be reprinted with credit provided as follows: Home Page Press, Inc., http://www.hpp.com and Online Business Consultant Please refer to the HPP Web site for additional information about Java and OBC. =========================================================== ............Home Page Press, Inc. http://www.hpp.com home of Go.Fetch ........Free TEXT version - Online Business Today email: obt.text(a)hpp.com ....Free PDF version - Online Business Today email: obt.pdf(a)hpp.com OBC / Online Business Consultant, $595/year email: obc(a)hpp.com

3 2

Securing CDROM from piracy
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

We have developed a multimedia resource that will be cut on a CD-ROM for retailling. Since we don't have our own distributers newtwork we will be collobarating with another firm for distribution. Is there any way of making sure that the guy doesnt pull a fast on on us? Can we ensure that he cannot duplicate the thing and start selling it without sharing the profit. Or alternatively is there any protocol we could follow that will ensure a fair game? Vipul -- .od8888bo. \|/ .d%::::88::888b. (@ @) .d888::::::::8:888%. ------------------oOO-(_)-OOo----------------- 88888:::::::88888::%. You walk across with your flowers in your hand d888888:::88;888888::b Trying to tell me no one understands 888888888:888888888888 Trade in your hours for a hand full of dimes Y8888888::::::888888%P Gonna make it baby in our prime. '8888888:::::::8888:%' ---------------------------------------------- '88888888:::888888%' Vipul Ved Prakash Fax : +91-11-3328849 '8888888::88888%' Positive Ideas. Internet : vipul(a)pobox.com '"Y88%B8P"' ----------------------------------------------

4 3

Re: crosspost re remailers
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:30 PM 5/14/96 -0700, Rich Graves wrote: > > I'd have thought that a remailer going down > > because of political/legal pressure would raise more of a ruckus. At 11:02 AM 5/15/96 -0700, Bill Frantz wrote: > I thought the statement that remailers are supposed to be ephemeral > and common was the answer. Exactly so: Some nyms are valuable, most are valueless by design. All remailers should be valueless by design. The penet.fi remailer design is unsatisfactory precisely because it penet.fi is valuable, hence a target. If it gets shut down a lot of people lose their nyms, causing much inconvenience. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

RE: Why does the state still stand:
by blanc 17 Dec '03

17 Dec '03

From: Hal [on the idea of companies operating fully anonymously] It might be interesting to make a list of all the problems people can think of why this idea won't work, paired with proposed solutions and workarounds - sort of a mini FAQ for this important (some might say ultimate) cypherpunk model. ..................................................................... I think this is a much needed discussion - in particular as it comes at a time when Uni is is "somewhat disconcerted" at the defeatist attitude of some cypherpunks and since TCMay is getting ready to read us the Cypherpunks Bill of Rights regarding the subsidizatoin of other's people's cyber existence (heh). 3 problems which immediately come to mind: . What if someone, hired on one occasion but fired at another, decides in anger to "turn coat" and report everyone to the IRS (or other fine government agency)? . What if a company does not pay as expected - other than adopting Assassination Politics, what method could an employee use towards getting their expected remuneration for work done? . Wouldn't everyone need to have two jobs (or source of regularly accepted cash), in order to be able to pay for services where suppliers do not accept virtual cash transactions? (TCM has mentioned before about the need to pay for some things in tiny quantities - like quarters for a phone call, etc.) .. Blanc

4 3

crosspost re remailers
by hkhenson＠netcom.com 17 Dec '03

17 Dec '03

Sorry to send this in blind. Over a year ago I switched from watching the "mutitions" R&D works to being an observer/participant on a small "test war." Once in a while, I send in a report. If you have comments which you want me to see, email them. Thanks, Keith Henson ******* Subject: Re: <<< Repost the NOTS everywhere! >>> Newsgroups: alt.religion.scientology,comp.org.eff.talk,alt.censorship References: <4ml2cv$c52(a)utopia.hacktic.nl> <4mrsf0$esn(a)news.bridge.net> <4ms9na$l24(a)Networking.Stanford.EDU> <4msu79$jdi(a)news.bridge.net> <henriDr5rpD.CqD(a)netcom.com> <4nae9i$bf7(a)news2.texas.net> Organization: NETCOM On-line Communication Services (408 261-4700 guest) Distribution: inet Hoyos (hoyos(a)millenium.texas.net) wrote: : henry (henri(a)netcom.com) wrote: : : >What I find disturbing is certain people who were visibly outraged by : : >Steven Fishman's "outings" are supportive of the remailer abuse, _as_well_ : : remailer ABUSE? how is it remailer ABUSE to use them for their : : intended purposes. : Remailers exist to destroy copyrights? I always thought they were around : to ensure a certain amount of anonymity, not to permit people to destroy : copyrights and get away with it. Hoyos, you *can't* destroy copyright, period. Trade secrets are another matter, and I suppose you can make a case that the ability of a certain powerful cult to extract money or labor from the gulible has been reduced. I know some of the people who wrote the first cypherpunk remailers. They have been watching the uses to which the remailers have been put. The long drawn out battle between the CoS and the Net has been of as much interest to them as the performance of large guns at the front was to Krup. I can't speak for all of them--actually, I can't speak for *any* of them, but the ones who have said anything about the recent uses of the remailers do not seem unhappy. There may be some discussion related to this on the cypherpunks mailing list. But if you sign up, be prepaired for a flood. Keith Henson Crossposted to cypherpunks

7 10

Re: (Fwd) New Anonymous Remailer
by David E. Smith 17 Dec '03

17 Dec '03

> > Do we se a problem here? No? Then read on... > > > You may be familiar with anon.penet.fi, which give you an > > anonymous account. > > > Our service allows YOU to choose what the return address will be! > > > Please write for more info. > > Well, well, well. Let's see: > Yes, we are familiar with anon.penet.fi... And all of the better > options available. Heh... it gets better. I very foolishly sent off for more info; among their requirements: you pay $5 a month for the service; you can't receive mail, only send it (which anyone can spoof for free!); you can't send to anyone in the domain of *.whitehouse.gov. Would somebody please just mailbomb or spam these hosers into oblivion, please? dave ---- David Smith Box 324 Cape Girardeau MO USA 63702 http://www.prairienet.org/~dsmith dsmith(a)prairienet.org Reality is only for those lacking in true imagination... Send mail w/'send pgp-key' in subject for PGP public key

2 1

distributed keys
by Matt Smith 17 Dec '03

17 Dec '03

Has anyone heard of an algorithm for managing keys automatically in a distributed system? For instance, if some low level security were to be implemented in a a networking stack where authentication was to be implemented, you would want to have each node have it's own signature so that signature checking can take place when one node connects to another node. The trick is then getting every node's keys distributed to every other node. Here are some ideas that I had, but neither is very desireable: - Manual distribution. User configures every node's key into every node. Configuration becomes a major hassle and mistakes are a pain to debug. An advantagous side effect is the user can configure which machines can talk to which machines if they're feeling particularly facist. - At connection time, each node determines whether or not it has the other node's key. If not, a symmetric key is generated via DH and public keys are exchanged. The problem comes in if someone is spoofing the machine to begin with. Then you'll have the wrong public key. Chicken, egg. Egg, chicken. - Having a certifying node which every other node has the public key to and who has everyone else's public key. Requests are made of this server. The trick is making this server secure and forcing the user to devote resources to this endeavour. Thoughts? -- Matt Smith - msmith(a)unislc.slc.unisys.com "Nothing travels faster than light, with the possible exception of bad news, which follows its own rules." - Douglas Adams, "Mostly Harmless" Disclaimer: I came up with these ideas, so they're MINE!

3 2

Re: Why does the state still stand:
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 15-MAY-1996 18:59:01.44 >For these a company running at a constant net operating loss could be >formed to purchase cars for resale (funny how no one ever buys them) and >manage property (which no one seems to ever lease). But won't such a company run into tax problems? In other words, the IRS is going to look with some suspicion on a company that keeps showing no profits (and thus no taxes) but keeps going anyway. They're going to think that the owners are making a profit anyway but concealing it - which is the case. I'm not sure how to handle this one, other than not owning major property (rental et al). -Allen

2 1

[NOISE] Re: Edited Edupage, 9 May 1996
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Doug Hughes writes: > "Jean-Francois Avon" <jf_avon(a)citenet.net> wrote: [... regarding the unfortunate poor who Mr. Avon hates...] > >You got to choose to do what is needed to live a better life. And > >most of them ain't doing what it takes. > > Are you saying those poor people in rural West Virgina only live > there because they are not trying hard enough to get out? Yes he is. They are poor and it is all their fault. [flame-bait approaching...] There are two kinds of libertarians, those who hate the poor and those who don't. I always seem to meet the former, I am beginning to suspect the latter don't exist. [...] > >> Education is one > >> thing (perhaps the only thing) that deserves to be subsidized in > >> this country. > >I think that it should not be subsidized. > >If you feel like subsidising education, then by all means, do it. > >But why should you stick a gun in my back to do the same? What if I > >do not want to do the same as you? > > > Then you will be living in a country with lower education standards, > increasing illiteracy, and a pretty pitiful base with a declining > socio-economic structure. Are you arguing that people are not equal > and those with more money should of necessity get better education? Yes, he is. It is times like this that I must count myself among the pitchfork and torch wielding mob, if only because I have been cursed with a small amount of compassion for those who were not as lucky as I. BTW Mr. Avon, the reason we, the unruly mob of collectivists, socialists, and [insert libertarian/anarchist buzzword here] should stick a gun in your back and make you cough up money for education is because we can. If you don't want to do so, they why don't _you_ move? Are your feet cast in concrete blocks? Welcome to the real world. jim

3 2