December 2003 - cypherpunks-legacy

Re: "Contempt" charges likely to increase
by jim bell 17 Dec '03

17 Dec '03

At 07:59 PM 4/12/96 -0400, Black Unicorn wrote: >On Fri, 12 Apr 1996, E. ALLEN SMITH wrote: >> >I might add that the Cayman Islands are full of trust companies with >> >provisions which forbid the disclosure of data to a client who is >> >coerced. A law on the books refuses to recognize "consent" orders made >> >under judicial compulsion. This would give the appearance of total >> >unavailability of evidence and suggest the futility of contempt >> >charges. Yet courts have still, and with no small measure of success, >> >imposed sanctions on witnesses so protected. >> >> What measure of success? Getting the data, or locking up the witness? >> -Allen > >Getting the data. If the IRS or a private plaintiff wants it bad enough, >they can usually get their hands on it, or at least find out where it is. > >The government of the United States doesn't play "fair" when they want >something. But if the government of the United States does play "fair," then why can we not play "fair" and kill their agents who violate what we feel is our rights? After all, the government is merely the representative of the people (at least in theory!) and it 'must' follow the rules (laws, Constitution, etc). To whatever extent it exceeds those limits, and to whatever extent the public can't get justice to prevent those violations, why would the public be obligated to accept them? To believe otherwise is to believe that the government has some sort of special dispensation to violate the law. I don't believe this; it wouldn't surprise me to hear that you do, however. Which is it? Jim Bell

2 1

Web of Trust Keyring
by Black Unicorn 17 Dec '03

17 Dec '03

Does anyone have a pointer to the Web of Trust Keyring? --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

2 1

Re: Bank transactions on Internet
by stevenw＠best.com 17 Dec '03

17 Dec '03

On FPGAs: > And it is rather unlikely that one could make a high clock speed >high performance hardware based key cracker work without traditional >high speed logic debugging tools such as a fast logic analyzer (if we >are talking 5-10 ns clock especially) and a 1 ghz or so digital scope. >These kinds of gear, though sometimes available after hours to engineers >working for more liberal companies or schools, cost many thousands >of dollars and are not garden variety items available to any hacker. Probably not necessary. Simulators do just fine. And the FPGAs themselves top out at 50 to 80 MHz. > And finally, depending on the technology of the part being >used, there may be a significant cost in the order of at least hundreds >if not thousands of dollars for a specialized programmer capable of >programming ("burning") the FPGA with the interconnect patterns generated >by the software. These tend to either be specialized to one kind of >part and maybe modestly cheap (hundreds of dollars) or universal and >several thousands of dollars (such as DataIO gear). Easy to access. They are everywhere. The EPROMs are about $6 each and are serial. You could build a programmer at home. > And at least in my experiance (I may be unusually stupid and >careless and clumsy or may not be) even if the parts are a few times >reprogrammable (as CMOS FPGAs often are these days) one can assume >that one will fry, or break the pins off, or reprogram one time too >many the FPGA or FPGA's before one gets the design working. This >means that it would be realistic to assume several parts would be >consumed by the prototyping effort, they may not be cheap and this >adds up too. While there are OTP FPGAs out there (typocally Altera), many are in-circuit programmable *any* number of times since they use SRAM internally not EPROM cells to program the configuration. The latest twist on FPGAs is to add more RAM internally and have them reprogram themselves on the fly, hundreds of thousands of times a second. This cuts the logic requirements down for desidhns that don't need all of the logic all of the time. > So whilst someone working with these parts as part of their job >or schooling might well have access to all the required resources on an >informal basis and be able to build a key cracker in evenings or >weekends for little more than the cost of the chip and a PC board to >hold it, it should be realistically noted that the actual cost of >equiping a lab from scratch with the required resources is more on the >order of tens to hundreds of thousands of dollars rather than $400. True, but $400 is probably not far low. > I must hasten to add that high density FPGAs have many many >legitimate uses in prototyping logic and producing products in small >volumes too small to justify the tooling costs of doing mask programmed >gate arrays (which tend to be significantly faster and easier to design, >but cost $5-100K NRE to set up custom masks for fabrication). The >current generation of them make it possible to build logic systems in >one small chip that a few years ago would have been large PC boards >full of PALs and other logic. My employer uses FPGAs in all new designs for production. They are *very* common for products that sell into the thousands per year. Mask-programmed gate arrays have the major disadvantage of very long lead times, usually a more pressing requirement than saving $30 per board over several thousand boards. Companies now make boards that contain just FPGAs wired in a grid. They are sold as general-purpose logic engines with software to implement circuits as hardware simulations. I'm sure that these would do just fine, though they are costly. ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 02:51 PM 4/12/96 -0700, Alan Olsen wrote: >At 11:34 AM 4/12/96 -0500, Doug Hughes wrote: >> >>On Apr 12 at 8:07 >>jim bell wrote: >>> >>>Are you sure they're not referring to 8 bits of data and a parity bit? In >>>any case, please give the address to the list so that it can be checked out. >> >>Come on, give it up already and admit you were wrong. At least 8 different >>people have cited examples of machines that supported non 8bit bytes. Your >>pride is getting the best of you. > >Jim is unwilling to admit his errors, even in things he has little or no >training in. (I remember him claiming at one point that he was not a >programmer or did any coding for that matter. Why he continues to persist >in such things I will not speculate on...) What I meant was the most honest answer I could give: I am not a professional programmer. I have programmed, in APL, Fortran, Algol, PL/1, Pascal, and I can read BASIC's well enough, but not recently.

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 12:00 AM 4/10/96 -0700, Bill Stewart wrote: >At 09:33 PM 4/8/96 -0400, Jack Mott wrote: >>This may be a bit of a no brainer, but everything I have read sorta >>skips over this point. a bit is 1 or 0. 8 bits make up a byte (0-255). > >Be careful writing code - sometimes a byte is -128 to 127 instead of 0 to 255. >Also, there are machines (mostly old kinky ones) that use bytes of sizes >other than 8 bits. No, Bill, a "byte" has ALWAYS been 8-bits. One of the main reasons the term "byte" was invented was because the term "word" (as in, "word length") varied for different computers, especially in the 1960's. (In fact, many computers of that era used word lengths other than 8, 16, 32, 64 bits, as surprising as this may sound to the current crop of PC and Mac afficionados.) This made it inconvenient to talk about memory capacities unless you were referring to the same machine. The solution was to invent a new term, "byte," which conviently had about the same size as an ASCII character and was always 8 bits.

7 6

Re: PEP Announcement (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 2:28 PM 4/10/96, Black Unicorn wrote: > This showed up in my mailbox: <snip> > PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate > Eudora and MacPGP are now available in the latest Button Circle release >at: > ><ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch9 >6.sit > .hqx> I'm using it. I actually went out and bought OneClick to do so, mostly because I wanted to mess around with scripts for other things and OneClick looks pretty painless to use. PEP works pretty much as advertised, except that the finger operations take too long for my ISP to execute sometimes, and evidently the finger events in Eudora aren't robust enough to wait for the operations to complete, so a "wait" has to run. The work-around is to manually do the finger instensive "get cypherpunks remailer names" and "get remailer-keys" operations with eudora, copy the results, and then run the scripts. Anyway, I bashed on it, and PGP, a bit, and now there's a palette when I use Eudora which I can click to do chained remails, which I was never really able to do before. It also does signs, which are fine, and encrypts, which are also fine, but the decrypts come up in the PGP window, which is crypto-correct, I suppose, but I like the dump-it-into-it's-own-mail-window result of the original OSA scripts which come with MacPGP. This is useful if you actually want to reply to an encrypted mail message. One of the other things that is nice about the original MacPGP scripts is that they automatically verify signatures on decryption, and, at the same time, they also automagically add any attached keys to your keyring, pending certification, etc. Anyway, if you have OneClick already, then PEP is a way cool thing to have. Here. I'll sign this message with it. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMWwYUvgyLN8bw6ZVAQEUKgP/eXQsCS/AaAj07s9PAX07j5WcXCXDGvpF RxDSLqJNA3wOcU3QKrDc/T0HfzQELM/RbjOvDy7XPWUwxEN/SUTfRzAekYtJ6RbM 2w3CDYtNsdXyv4yyrgNF1eIjs+IecYYrCBeXJcvHn6fRwEbVBr+yFgXIprjfeEZ9 of/IGHDE0Qc= =bshY -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: No matter where you go, there they are.
by David Lesher 17 Dec '03

17 Dec '03

I asked a friend charged with spending money in this area. Here's his reactions, and those of someone he consulted: ================== ..There is a business case flaw in the proposal. The scheme as laid out only provides a high confidence factor on the users location (+- 10M), NOT on the actual identity of the user. Thus it would have to be coupled with some other form of I&A. The business question then arises, is the confidence delta provided by this scheme consistent with the cost delta? My first take is that the answer is no. =================== Re spoofing the system. If you think about the geometry of the problem, the delay to be induced for each satellite is a time varying function of the satellite's position, the reference site, and the target. It will vary from positive to negative values for many satellite passes. It can be precomputed, but the precomputed adjustment will be in error by some amount due to the orbital perturbations mentioned in the original article. The most common prediction error is the in-track postion, which inconveniently for the predictor has the greatest effect on one's ability to calculate the right delays. Anyone with access to a decent orbital prediction code and access to the statistics on orbital perturbations should be able to calculate the expected delay prediction error as a result of the orbital uncertainties. If the delay prediction errors are detectable, then it seems the system is secure after all, allthough other reservations on operational suitability might still apply. Note that the sensitivity is a function of the distance between the reference site and the target. If you could collect your reference signal across the street from the target, it would make spoofing a lot easier. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: washington post notices archives
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:39 PM 4/11/96, Andrew K. Bressen wrote: >we here at HKS.net have today received a cease and desist >letter from the washington post regarding editorial copy >of theirs that was evidently posted to c'punks and then >abosrbed into our c'punk archives. > >Once the archives are restored (RSN) we'll probably manually edit out >the messages from the archive. We're trying to get the post to give us Several relevant points for lists like ours: 1. Expect more and more of these sorts of copyright "cease and desist" (or, as I like to say, "decease and cyst") orders, as newspapers and magazines use search engines to find their stuff. Expect some "automated searches" to be done routinely, even offered as services by third parties. ("Find infringing copies...make $1000 a week in your spare time.") 2. What does removal of infringing articles mean for follow-ups? If I reference a WSJ or NYT article that someone has quoted or forwarded, is my follow-up expunged also? 3. And what of the "Cypherpunks Archives on CD-ROM"? Too late to simply remove a single article...does the entire production run go into the landfill? (I haven't heard much about the "enthusiasm du jour" of the "Cypherpunks CD-ROM," but this always been a concern, that legal issues would have to be resolved, including the getting of releases from several hundred or more parties.) 4. Suppose the HKS archives were actually offshore, in the Cayman Islands or in some place that doesn't recognize copyright law in the same way most Western or Berne Convention countries do? 5. Suppose access to such archives is done via Web remailers, and the location is not easily determinable? (To be sure, lots of hits means traffic analysis will reveal the location....the same general problem with "reply-blocks," of course.) It sounds like the Washington Post is discovering the brave new world. Expect an article or two on this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

PEP Announcement (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This showed up in my mailbox: --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information ---------- Forwarded message ---------- Date: Wed, 10 Apr 1996 00:03:29 -0400 From: Amos Elberg <aelberg(a)wesleyan.edu> To: unicorn(a)schloss.li Subject: PEP Announcement Uni, can you forward this to the c-punks for me? --------- PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate Eudora and MacPGP are now available in the latest Button Circle release at: <ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch96… .hqx> PEP is designed to provide features similar to the UNiX premail program on the Macintosh. It handles encryption, decryption, signing, verifying, anon.penet.fi remailing and cypherpunk remailing. PEP uses OneClick to place a button bar in Eudora, from which the user can select privacy functions. Buttons pop-up menus of encryption targets, signature keys and cypherpunk remailers. Q: What do I do about the rest of MacPGP's interface? A: PEP is not designed to replace MacPGP, just to provide easier access to it from within Eudora. For a full featured MacPGP GUI replacement with added features, try Raif Naffah's MacPGPControl application. Q: Isn't the name 'PEP' pretentious and derivative? A: Yes, I think so too. I couldn't think of a better one. Suggestions are welcome. Q: I have a lot more questions. Where are the answers? A: In the documentation. If you have any more questions, please direct them to <mailto:aelberg@wesleyan.edu> ------------------------------------------------------------------------------ Amos B. Elberg | #include disclaimer.h Amos will code for Wesleyan University | food. E-mail me for a resumé. Please. 341 S. Main St. Apt. 3N |---------------------------------------- Middletown, CT 06459 | Help keep the net safe from the Will Code for Food! | aesthetically challenged. Please, Public keys available from the usual | oppose ASCII art. keyservers, or by request. |---------------------------------------- PGP fingerprint = 08 B8 87 04 6B 21 08 5D B0 62 F7 94 7B 42 0F 10 --- end forwarded text

1 0

Re: Edited Edupage, 4 April 1996
by Michael C. Peponis 17 Dec '03

17 Dec '03

On 12 Apr 96 ,E. ALLEN SMITH wrote: > From: IN%"educom(a)elanor.oit.unc.edu" 5-APR-1996 01:25:00.85 > >IBM'S INTELLIGENT MINER DIGS OUT THE GOOD STUFF > >IBM plans to offer companies "data mining" software and services, allowing > >them to make better use of disparate pieces of information stored in their > >computer systems. The Intelligent Miner software will be available on IBM's > >RS/6000 servers by the fall, and on other platforms by year end. The > >company also plans to develop Intelligent Decision Server software for local > >area network-based information analysis. (Investor's Business Daily 3 Apr > >96 A9) > > Anyone have any _specific_ ideas on how their Intelligent Miner system > works? It would appear to be relevant to the identity-spoofing discussions. > -Allen Not really, it's a tool used in Data Warehousing/Decission Support Systems. Here is what it is in a nut shell. A company creates a Data Warehouse, defining it's data universe in terms of business rules and practices. Data Mining is the process by which users try to make sence of all the data. They call it "intelligent" because it supports natural language queries, ie the end user does not need to know SQL or the table layouts to retrieve the information they want. Very sketchy explination, but there are entire volumes written on the subject, and it's new technology so the exact definition varies depending on who you ask. I have been developing systems like this for the past year, and I still can't give people a cut and dry answer as to what the hell it is. Regards, Michael C. Peponis Public Key Avalible Via Key Servers, or Finger

1 0