December 2003 - cypherpunks-legacy

Remailer fot NT
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Thu May 09 09:28:20 1996 Does anyone know of a remailer that runs undet NT. If not, any source that might be ripe for a port. Lou Z. Lou Zirko (502)383-2175 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMZIBJBKvccEAmlQ9AQGs5Af+I8BfY640aj/e483mDzbdHOioEaPrQmZ1 R8rA7H0Kg29VU4/4f+Y5J66ZshMVr4ojOYzj8/H7mrsCjsZPx7MjBqiIH1pbUouG ky0NvGLw+HeBRWZz1OSElDUYE+QMHnMr2CxYnaepS/91erJmpt0xE5/oXVohEQOq q/ARLWAYw4FJ6n7cgDDfkcxp5scHthLsAzMCbuHxfsvzAm/1LdU/QFvUWG2+BNv3 4Hx2TWasGWaSfX/+zZGuXHA123JW2frE98o+nRORcM5y7kCOaXPP69xp+aAJsGdh wf7M/ekRhBjfJgdOLtgID+zKBJbZEHA3kGgCmHdz1ynoWiXnMcTlcw== =bWV8 -----END PGP SIGNATURE-----

1 0

Looking for someone to speak on JAVA security issues (fwd)
by TQDB 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 09 May 1996 03:25:29 -0700 From: The Dark Tangent <dtangent(a)defcon.org> To: dc-stuff(a)fc.net Subject: Looking for someone to speak on JAVA security issues If you or someone you know has seen a Java security expert who would speak at DEF CON, please have them contact me! -- Hey! All my mail is sniffed! Don't forget to PGP important stuff. PGP Key (2.3a & 2.6) on key servers or mail me. Voice (AT&T) 0-700-TANGENT DEF CON mailing list, mail: majordomo(a)fc.net with "subscribe dc-announce" in the body. DEF CON FTP: ftp.fc.net /pub/defcon http://www.defcon.org

1 0

hks newsgroup
by Kent Briggs 17 Dec '03

17 Dec '03

hks.lists.cypherpunks has shown no new articles in the past three weeks. I've resubscribed to the mailing list but have seen no mention of the newsgroup's status. What happened to hks and is it ever coming back up? Kent

1 0

re: Dempster-Shafer...(re: Transitive
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:18 AM 5/9/96, watson(a)tds.com wrote: >tcmay's approach is elegant, and it's refreshing to find a practical use >for AI approaches. I think it needs one more step, though. If we learn >to quantify our trust in a key, we still need to know what the threshold >should be for a given application. Maybe I can get by with a 0.05 Bel >for posting to cypherpunks, but maybe I want a 0.95 for a monetary >transaction. Seems to need a comprehensive risk management approach, [was the rest accidentally cut off?] Anyway, I agree that a more comprehensive system is needed. But even attaching belief estimates to keys, for example, goes a long way in letting others than do some transitive calculations. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Applicable Models for Trust Calculations (Re: Dempster-Shafer Theory and Belief Networks (Re: Transitive trust))
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 09:51 PM 5/7/96 -0700, Timothy C. May wrote: >In particular, one form of belief representation seems especially relevant: >Dempster-Shafer theory. Two quick things: (more in my forthcoming thesis) 1. It is very instructive to consider systems for considering trust and belief (and Dempster-Shafer is a rather nice one). However, these systems (my own decision analysis discussion to a degree, but less so with respect to information gathering) and Dempster-Shafer in particular require the events to be independent: "Further, Dempster-Shafer theory provides rules for combining probabilities and thus for propagating measures through the system. This fourth point is possibly the most attractive, but it is also one of the most controversial since the propagation method is an extension of the multiplication rule for independent events. Since many of the applications involve events that are surely dependent, that rule is, by classical statistical criteria, inapplicable. The tendency to assume that events are independent unless proven otherwise has stimulated a large proportion of the criticism of probability approaches; as it stands, Dempster-Shafer theory suffers the same ill" [Shapiro (ed.) Encyclopedia of Aritificial Intelligence. /Reasoning, Default./ p 846.] The very term "Web of Trust" makes one pause with respect to independent events. 2. Just as a comment, it seems there are different meaning of "transitiviy" in related but different disciplines, for instance in value and utility functions, one requires transitivity, but in a way different from what Hal discusses: "For any three possible set os of consequences, X1, X2, and X3, if X1 > X2 and X2 > X3 then the preference is transitive such that X1 > X3." [deNeufville, R. Applied Systems Analysis: Engineering Planning and Technology Management, 1990, p 313.] This refers to a single person's preferences (rather than 3 individuals in a "network.") _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Mandatory Voluntary Self-Ratings
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:17 AM 05/9/96 -0400, Joseph M. Reagle Jr. <reagle(a)MIT.EDU> wrote: >> I've figured out where my differences between myself and others >lay. The _only_ system and service that I am aware of that is distributing >PICS labels is RSAC. (http://www.rsac.org) They are what one could call an >objective and non-arbitrary content rating system rather than an >"appropriateness" system. "Appropriateness" systems will be valuable 3rd >party systems when the vigilantes and fundamentalists wish to create label >bureaus. For self labeling, if many people (main stream people) are going to >use that system within their browser, it will have to have mind share. If >it's going to have mind share, I think it would be advantegeous to it to be >a descriptive label rather than "appropriate." Hence, much of the concerns >I'm hearing aren't so worrisome to me. SurfWatch is offering self-rating via a web page at their site. It spits back the appropriate 'meta' tags to embed in an html document. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZFQ+MVrTvyYOzAZAQFM+gP/edsvNSSkeiyZVBuJyWYCK82J7O1zG5O8 jI5cGj22R/qSPAhhpZj6pLFxvoKnuUc7P+8QzAao1ccxihZpy5ZW3fzM/+pyn6dW B126/l4R+SRCrDiPV+5HeXyBTXAiWYMjRAuv2nZtHVIiLjQrjziwrug4H/4U26GP NEbKT8Uqwno= =UAbu -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

www.cdnow.com accepts ecash
by bryce＠digicash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Cool. Get your fresh CD's via WWW and UPS. Pay with Mark Twain ecash. This is the first thing (excepting, of course, BAP, cyberbuck gambling, and pornography) that I actually want to buy with ecash. And I spend time crawling www.cdnow.com even when I don't want to spend money, just to read the words and look at the pictures. http://www.cdnow.com/ This has been a public service announcement. CDNow is not paying me. (Although, of course, they are welcome to send me some free CD's in return for my kind words...) Bryce Disclaimer: NO. I'm not speaking for anyone else. Not even the company mentioned in the From: line. PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMZIn9EjbHy8sKZitAQELPAL9G6lYkqhbTdYrt0YFe4VjF9jyyjxznCi2 SY3f86o2XvD86AMUQkVT31GhQAmGC6TN2cJ0pQDRpHfh5Qk+IZFgd3iyEEZqzrmc UztgRNEhaIFgYXjV33gzRE5sk+fnpQaL =H96X -----END PGP SIGNATURE-----

1 0

RE: self-ratings vs. market ratings
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Vladimir Z. Nuri > >you are free to assume any connotation you like. but in my view >they are pretty much interchangeable. they are both "meta >information"-- information about other things or information. ............................................................... The fact that I, like others, am "free to assume" any connotation means that there easily can exist confusion surrounding the definitions of these terms, and that this can then create controversy in discussions over what anyone means when they make references to them. Those who intend to apply these concepts must determine what they think they are doing (rating content, or establishing someone's reputation?) and must communicate it to others clearly so as to be definitely understood, else risk further compounding of confusion. The word & the concept of "reputation" has been in use for much longer than "rating". In the most recent applications of the term "rating", the idea has evolved to include such things as electronic web page content. It refers to a deliberate, conscious intent to establish a measure, an estimate, or evaluation, of something that an individual or group presents (information) or provides (service). The rating is intentionally applied and is intended to be used for communicating to those who are seeking this specific kind of information, where a reputation evolves "on its own", so to speak, as a coincidence of being generally known. "Reputation" is more a passive reference to the past, where "rating" is actively in regard of a present condition (with future expectations). [These are just comments I have on this subject; I myself don't pay much attention to ratings, as my own measures of things & people tend to be quite different from most, and therefore not very useful for my purposes. So that's all I have to say about it, "Vlad".] .. Blanc >

1 0

Runtime info flow in Java
by Christian Wettergren 17 Dec '03

17 Dec '03

Hi! I'm presenting my licentiate research proposal next week, and I thought that some of you might find it interesting. I'd like to find others that are working with similar projects, to have some people to discuss with. The actual proposal is available at http://www.it.kth.se/~cwe/phd/licprop.ps I've included an abstract below. Comments are most welcome. Regards, Christian Wettergren KTH/Teleinformatics. Licentiate Thesis Proposal Seminar ================================== Title: "Runtime Information Flow Analysis and Security" Candidate: Christian Wettergren Time: Wednesday, 15th May, 15:00--16:00 Place: Room Telegrafen, Dept. of Teleinformatics, KTH, Electrum Bldg., lift B, 5th floor, Kistagangen 16, 16440 Kista, Sweden Committee: Gerald Maguire, KTH/Teleinformatics Sead Muftic, SU/DSV Enn Tuygu, KTH/Teleinformatics Abstract: Today's computer security systems are fragile and brittle. I believe this statement to be consistent with practical experiences. One can for example observe the regularity of alerts from CERT. Many of the problems are caused by data-driven bugs in application programs. It is important to find a security paradigm that is more stable for the communicative and networked world of tomorrow. I propose a new way of doing information flow analysis of programs. This information flow analysis is done in runtime, and will provide detailed information about influences of the process to the access control decision process. The information flow is based on sets of subjects instead of preallocated security classes, thus decoupling the flow analysis from the access control. The runtime analysis is performed by special code that is run along with the original program. It shadows the computation and keeps track of the information flows within the program. A special compiler emits this shadow code. I will implement such a compiler for the Java language. Issues about the compiler and the shadow code will be discussed in the thesis. The thesis will also investigate the behaviour of the shadow code for programs with different communication patterns. For more information contact Christian Wettergren, +46 (0)8-751 14 91, cwe(a)it.kth.se. You can also retrieve the licentiate thesis proposal from http://www.it.kth.se/~cwe/phd/licprop.ps.

1 0

Re: Mandatory Voluntary Self-Ratings
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Couple quick things: At 11:46 AM 5/9/96 -0700, you wrote: >I don't like the use of the term "objective" here. (I object!!) No, it isn't the best term, there is some bias which can be an issue with dealing with this at the international level, but I think there are solutions to that... >a judgement like "child approved" is more subjective than "sex: moderate", >but they are both value judgements. It doesn't even say "sex: moderate", but "(s 3)", and then the parent can consult a chart that is a summary of the questions that directly ask about the content: VIOLENCE ALL (0) HARMLESS CONFLICT; SOME DAMAGE TO OBJECTS 1 CREATURES INJURED OR KILLED; DAMAGE TO OBJECTS; FIGHTING 2 HUMANS INJURED OR KILLED WITH SMALL AMOUNT OF BLOOD 3 HUMANS INJURED OR KILLED, BLOOD AND GORE 4 HUMANS INJURED OR KILLED, BLOOD AND GORE WANTON AND GRATUITOUS VIOLENCE TORTURE; RAPE So we can argue about "objective," but this is _atleast_ very "non-arbitrary" and the process (if people are non-malicious) is deterministic. >now, it seems that the author might as well put the tags in his material >himself instead of going through this submission process. This is a significant issue. >also, above we have the claim it is "fully automated". what??? it >sounded to me like the page designer has to submit a special form >to this service and then go and grab the tags to manually put in his own >page? this is "fully automated"??? Try it for your own page and see! >also, JR, you say the system does not determine "appropriateness". >but in my view it does indirectly. an author can "falsify" his submission >to say that his page has no sex or violence. (who is to say he is >wrong? the internet ratings police?) this will implicitly determine >the "appropriateness" of his page for people who screen their >browswers based on the keywords that were affected. People who misuse the system can be fined. (By using the system one also has to "AGREE"). However, the status of this contract is up at grabs IMHO since they relied on trade mark to enforce their system (the pic on a box). Now, gifs and the like (banners) may still be of issue, but the real meat here is a system (s 3 l 2 v 0), there is no IP protection for this, and if there aren't signatures, this can be a serious problem. >creator, as it should be. (in my view ratings and the content should >be made as independent from each other as possible in the sense >that ratings are not tied up in the content itself) I see it as an author provided a value added service to his content same as anyone else. _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0