December 2003 - cypherpunks-legacy

Re: SEVERE undercapacity, we need more remailer servers FAST
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:29 PM 5/15/96 -0400, Black Unicorn <unicorn(a)schloss.li> wrote: >I would really like to see a remailer that is somehow blinded. >I don't know enough about how mail paths are generatered, but is it >impossible to conceal the origin of remailer postings? One reason for remailers is that concealing message origin is difficult and unreliable, and making smtp servers that include all the information they can find about the origin of a message into the message is easy, so it's tough to lie about where you are. Remailers solve that by removing the header information from messages they receive and shipping out the message body with new headers, so anyone who traces all the "Received:" headers gets pointed to the remailer. >Postings made to remailernym(a)alpha.c2.org would be spit out somewhere but >without accountability? alpha.c2.org keeps encrypted reply blocks that it can't decrypt; it sends messages to some other remailer that can decrypt them, and only sends messages encrypted. That means that anybody who does succeed in stealing or subpoenaing alpha's user information has to go to each of the other remailers it uses for delivery as well - and alpha doesn't have any keys to steal. >I'd consider running a remailer, but after listening to the response to >the anonymous poster a while back, it sounds like there are few if any >simple options which do not require major time and effort to setup and >run. Setting up a remailer is easy, if you've got a Unix machine, and I'd guess that the Winsock Remailer is probably easy for Windows. If you don't support mail-to-news yourself, and you block mail to other mail-to-news gateways, you cut out lots of flame potential, which keeps the work of running it fairly low. (My remailer is based on ghio2, which has traps to detect high-volume spam, which has shut it down a couple of times. Cleaning them up is annoying.) You do need to stay on remailer-operators(a)c2.org to get notices of individuals who are being spammed or harassed so you can block mail to them, but that's typically 5-10 minutes/week. If you've got a Unix machine, you can also do a web-based remailer easily (users fill out a form with their mail, which goes to a CGI script.) If you're willing to use somebody else's script, e.g. replay.com, you can just put up the web page anywhere and won't need Unix, and they can handle most of the spam-blocking. This isn't very secure unless you're using SSL or other secure HTTP protocol, which I don't think any of the current web-remailers do. Some folks have put advertising on their remailer pages, which starts to be one economic model that can encourage people to run them, if you can find advertisers who _want_ the image this gives them. (This is fine for c2.org and maybe Digicash banks or tax-haven consultants, some political ranters, and maybe phone-sex or other services that don't have to worry about lowered reputations if somebody uses the remailer to spam the alt.sex newsgroups with phone-sex ads :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Zimmermann v. ViaCrypt???
by Mark Voorhees 17 Dec '03

17 Dec '03

Read http://infolawalert.com/stories/051796a.html for a story on how Phil Zimmermann is trying to retrieve all the rights to PGP from ViaCrypt in order to jump start his new venture, PGP, Inc. He's taking a sell out or get sued approach with ViaCrypt, which until recently has not had much success marketing PGP. Mark PS--Apologies in advance if this has been posted before.

1 0

Re: S-Tools 4 now available [for MS only?]
by attila 17 Dec '03

17 Dec '03

Addressed to: Matts Kallioniemi <matts(a)pi.se> roy(a)sendai.cybrspc.mn.org (Roy M. Silvernail) cypherpunks(a)toad.com ** Reply to note from Matts Kallioniemi <matts(a)pi.se> 05/16/96 10:21pm +0200 = Date: Thu, 16 May 1996 22:21:20 +0200 = To: roy(a)sendai.cybrspc.mn.org (Roy M. Silvernail), cypherpunks(a)toad.com = From: Matts Kallioniemi <matts(a)pi.se> = = Subject: Re: S-Tools 4 now available roy is a microsofter --of course, is it written for microsquish and their compiler/api fad of the month? is source code available, or is the code non-portable outside the limited interpreters and compilers of MS? 32 bit is obsolete --64 bits is the standard. after all there are other systems except MS. I have a simple policy regarding MS --I just don't! -- "Bill Gates is greedy because he has amassed a fortune of US$ 15,000,000,000 ($15 billion) but the US Government is a helpful Village because it takes US$ 1,400,000,000,000 ($1.4 trillion) from us each year and does good things with it." --Hillary Clinton

1 0

Re: "Too cheap to meter"
by Deranged Mutant 17 Dec '03

17 Dec '03

On 17 May 96 at 18:54, Timothy C. May wrote: [..] > Alan's irony is well-placed. The most egregious repetition of the "too > cheap to meter" nonsense is George Gilder's "dark fiber" vision...a vision > of "infinite bandwidth" to all users. > > Guess what? If Gilder's "dark fiber" is ever built, there are a lot of > folks who will "fill it" rather quickly. Canter and Siegel were just the > beginning. "Too cheap to meter" goes away pretty quickly. Remember not-so-many-years-ago when 640k PCs were awsome and a 40MB HD was unfillable? A better phrase is "if you build it, they will fill it (eventually)". Rob. --- No-frills sig. Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: SEVERE undercapacity, we need more remailer servers FAST
by jim bell 17 Dec '03

17 Dec '03

At 02:29 PM 5/15/96 -0700, jamesd(a)echeque.com wrote: >At 10:58 AM 5/15/96 -0700, Hal wrote: >> The problem that I think the Scientology postings raise is that the >> remailers cannot really be used to post copyrighted material. > >The major battle the net has faced is with the church of scientology. >In this battle the net is clearly in the right, and the church clearly >in the wrong, regardless of what copyright law says. The copyright issue is probably irrelevant to the Scientology dispute, anyway. The material on which the copyright is claimed almost certainly wasn't marked, appropriately, as it would have had to be for the copyright to be valid. While current law no longer requires the "circle-C" notation long used for this purpose, the material involved is far more than old enough to have been subject to this requirement, and once a copyright is lost (or not claimed) I believe it couldn't be regained. The threat to remailers is one of the many reasons the Leahy bill sucked, and that would have made it worse by imposing criminal sanctions on this kind of thing. Ironically, with the way remailers are used, it would actually have been possible for some copyright holder to fabricate a violation of copyright law by posting his own material through remailers, and then sue the final remailer, or have its owner prosecuted. I'm glad the people around here finally saw the light. Jim Bell jimbell(a)pacifier.com

1 0

HUGE denial of service attack against any ecash customer!!!
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- (Again Cc:'d to ecash-feedback, hoping for a security prize. I wonder who's keeping track... Also Cc:'d to cypherpunks, for fun...) So I had some more free time... (Dave cringes when I say that.) Here's a cute one: Give me an account number, and I can prevent it from being used until an arbitrary time in the future (of my choosing). How? Simple. Send a deposit message with 0 coins (well, any message will work, I think, but this is one of the simplest messages there is) with a timestamp of some future time. Messages stamped prior to that (such as everything coming from the actual user for that account, until the time comes) will be politely discarded. (Actually, I think the last reply to a withdrawal request is continually resent, but I'm not exactly sure of this.) In any case, the actual user will be unable to withdraw money from his mint until the time sent in the denial-of-service message. (Unless he forward-dates his computer's clock, or something...) I've tested this against myself and Sameer (with his cooperation, of course). Anyone else want to be locked out for an hour? (Actually, I could pretty effectively lock out _everyone_ for an arbitrarily long time, it seems...) - Ian "Right. I want the sources to the client and the server released. Now." :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZpj3kZRiTErSPb1AQF0SAQAmOEZJTg0v3utWFodDXZ4iv4xa7I+QbNQ Nlsbkug8dtkdf+Jboe+vBtrs5IWSSff8bWntGwfODckct26NwzpVM9bUIXohVoRQ jOkRT9a8m/X00jUAoFOTq5O5Rz87a3Uw8MGFugP5Y4DCk+UqnTA70cuozyOCgb8m 8oke89V9Q0E= =ARMe -----END PGP SIGNATURE-----

1 0

RE: Why does the state still stand:
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 15 May 96 at 18:42, Black Unicorn wrote: > Potential, but you can manage risk with things like dead drops from > trusted parties to forwarding agents to offshore drops to.... I can just visualize a trusted party dropping discretely a bright yellow Caterpillar D-12 in a dead letter box... ROTFL! Sorry, but I couldn't resist. I just *love* silly humor... > Realization means that their is a changing of hands or of forms of > assets. Income tax and taxes on currency now are dependent on such > transactions. Someone already noted the problems with just taxing > possession on a given date of e.g., inventory. To tax efficiently > you have to tax an event of transfer. Why? is it because of the nature of a transfer, it lend itself more to reporting and detecting? Or is it simply because of the legal system structure? > Give me context. It's possible to kill the president too. That > doesn't mean it will become the basis of government. I think that Mr. Bell defined the context quite well and thoroughly. And, as he said, the president is unlikely to be the target of choice because it is not the most efficient one. Who cares about the president? Who is he without the govt machine? > That's that anonymous transactions are for. If anonymous transactions are feasible, so will be the AP scheme... AP can be, in a way, characterized as a weapon because it behaves like one. And no weapon in the history of humanity remained unused. > I forwarded two large segments of the work to the list, yes. If > you, or anyone else on the list, would like copies, let me know. Theses were the first two that constitued part 1 of 4. I wondered if you posted the other parts. If so, tell me so I can get to the archives. Regards. JFA DePompadour, Societe d'Importation Ltee Limoges porcelain, Silverware and mouth blown crystal glasses JFA Technologies, R&D consultants. Physists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 Unsollicited commercial e-mail will be proofread at US165 $/h Any sender of such material will be considered as to have ac- cepted the above mentionned terms.

2 1

Re: Why does the state still stand:
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:44 PM 5/16/96 -0400, E. ALLEN SMITH wrote: >From: IN%"frantz(a)netcom.com" 15-MAY-1996 22:39:50.97 > >>You could require daily payment and forgo the escrow agent. (Assuming you >>are willing to risk a day's pay as an experiment in reputation.) Note that > > This could work for fixed payments. But what about things like >profit-sharing? I think building trust in this kind of thing is a big problem. There are so many ways you can get ripped off. Failure to distribute. Fake costs in the accounting. Off record sales of the product. Phantom partners who do nothing but funnel profits to someone. etc. etc. etc. A fully anonymous audit may be what is needed, unless you are able to build enough trust in an individual nym that you won't get ripped off. Anyone got a protocol for fully anonymous auditing? ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

NYT on Netscape Flaw
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, May 18, 1996, pp. 31, 43. New Netscape Software Flaw Is Discovered By John Markoff Computer science researchers at Princeton University said yesterday that they had discovered a new and potentially serious flaw in the Netscape Communicatlons Corporation's Navigator software, the leading program used to browse the World Wide Web of the Internet. The flaw, which was found in recent versions of the Netscape software that support Sun Microsystems' Java programming language, could allow people to write destructive or malicious programs and potentially destroy or steal data or otherwise tamper with a computer that was connected to the Internet and used the Navigator program. Netscape executives said that the researchers had been in touch with them about the problem on Thursday and that the software company was in the process of producing a new version of the Navigator program that would protect against potential attacks. This is the third flaw in the Navigator program discovered in recent months by the Princeton group. Netscape has been under tremendous scrutiny over the security of its popular software since the fall, when a group of researchers at the University of California at Berkeley discovered a flaw in the Netscape security system. In the most recent case, Thomas Cargill, an independent software consultant working with the Princeton group, discovered a problem in the way Netscape has used the Java language in its Navigator program. The group disclosed a similar flaw in March in the Netscape Navigator that would permit a Java program to run illicitly on a computer that was running the Netscape program and perform damaging operations. "Netscape has fixed a series of problems, and the overall security of their system has improved, but there is still some reason for concern," said Prof. Edward Felton, the leader of the Princeton group, which includes two graduate students, Drew Dean and Dean Wallach. Programs that are known as viruses and worms are a serious threat to computer networks because they can move from machine to machine quickly, carrying out destructive applications. Sun Microsystems' Java language has been designed to limit what a virus can do once it is transferred across the Internet. But the security mechanisms only work if the virus's code can be restricted in a safety "box" constructed out of software. Netscape's executives acknowledged yesterday that the Princeton University team had on both occasions been able to find doors that let program code out of the safety box. "We're trying to create a sandbox which has rooms where only certain things happen," said Jeff Trehaft, Netscape's director of security. "What happened is that the Princeton team found a door and it turned out that there weren't adequate protections surrounding the door." The company said it was in the process of posting on the Internet a new version of the most recent test version of its next-generation Internet program, version 3.0 beta. The program contains a special fix to prevent the new attack. He said Netscape had not yet posted a fix for the most recent commercial release of its software, version 2.02, but was instead encouraging customers to use the 3.0 beta software. Since the Berkeley researchers discovered the first security flaw the company has offered a $1,000 "bugs bounty" to programmers who are able to locate security flaws. [End]

1 0

RE: Edited Edupage, 9 May 1996
by Blanc Weber 17 Dec '03

17 Dec '03

Just had to say this, on two statements from Doug Hughes: >1. You don't understand at all. It's not about being people down, it's about bringing them 'UP'. >2. ...making sure everybody has a good education is of paramount importance to any society. ...................................................................... These sentiments are noble and on the face of them sound agreeably empathetic with Mankind. But what would be required to bring people "up" (in spite of themselves) and compose them into someone's idea of a good citizen in a great society, would be to own them and thus to have the right to turn them and shape them into what they "ought to be", so that they may function on the same level as "everybody else". Alternatively they could be set free (from tyrants & such - and we all know who they are) to attend to the project of constructing a life, to seek after creative solutions to the problems of existence on their own chosen level of effort & ambition. Which is what this American society was supposed to be about, I've read. (Other countries have their own well-known methods of solving this "problem".) .. Blanc I hope I'm not the only one here who thinks so.

1 0