December 2003 - cypherpunks-legacy

Re: [hrdware] anti-Tempest video settings
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:20 AM 5/10/96, Jean-Francois Avon wrote: >Hi again. > >Is there anybody that have any idea about a color setting that would >make it more difficult to detect by a Tempest attack? >(I assume that Tempest cannot discriminate between various color guns >and signals in the monitor... Maybe I am completely wrong...) .... I imagine that a color combination that cancels for an antenna in one location will not cancel for another location. Many monitors have separated wires for the separate colors. A color combination that cancels for one antenna polarization may not cancel for the other.

1 0

VIRUS ALERT: Java virus that affects Netscape 2.0 & 2.01.
by gcg＠pb.net 17 Dec '03

17 Dec '03

> >WHO IS AFFECTED BY THIS ALERT? >------------------------------ > >Users of Netscape Navigator 2.0 or 2.01. To determine what version of >Netscape you are running, do the following: > > 1. Open Netscape Navigator. > 2. Pull down the Help menu. > 3. Click on About Netscape. > 4. Check to see if you have version 2.0 or 2.01. If so, read on. > If not, then you can not be affected by this alert. > >WHAT IS THE PROBLEM? >-------------------- > >There have been reports lately of a hostile Java applet (a Black Widow >Java applet called JAVA) that is downloaded and executed automatically >when certain sites are visited with Netscape versions 2.0 or 2.01. Java >applets are small applications that are automatically started when you >access certain web pages. This particular Java applet is a malicious >program that can destroy data, interfere with your network, and possibly >even upload sensitive material to a third party. > >WHAT SHOULD YOU DO? >------------------- > >Upgrade to Netscape Navigator 2.02. > > >WHAT SHOULD YOU DO IF YOU CAN'T DOWNLOAD VERSION 2.02 RIGHT NOW? >---------------------------------------------------------------- > >You can temporarily protect your PC or Macintosh by disabling the Java >functionality. However, this should only be a short-term fix as many >legitimate web sites make use of Java applets. To disable the use of >Java applets, do the following: > > 1. Open Netscape Navigator. > 2. Pull down the Options menu. > 3. Click on Security Preferences. > 4. Under General, place a "X" in the Disable Java and the > Disable Java Script boxes in the Java window. Click on OK. > >After upgrading to the latest version of Netscape Navigator (version >2.02), re-enable the Java applets by doing the following: > > 1. Open Netscape Navigator. > 2. Pull down the Options menu. > 3. Click on Security Preferences. > 4. Under General, remove the "X" in the Disable Java and the > Disable Java Script boxes in the Java window. Click on OK. > >

6 5

Re: Floating Point and Financial Software
by minow＠apple.com 17 Dec '03

17 Dec '03

A 64-bit floating point number (i.e., C double) should be suitable for financial software under the following conditions: -- Money must be represented in integral units (cents, not dollars and cents). -- The maximum value to be computed must be less than about 10^17. This includes intermediate values. -- Addition, subtraction, and multiplication by an integer are the only operators. Under the above conditions, there should be no loss of precision. However, when division is required (as in currency conversion or interest rate computation), one must be careful to control round-off error. For example, a mortage payment schedule might be computed using true (non-exact) floating-point arithmetic, with the last or first payment adjusted to cover any residual error. (You might want to re-read Donn Parker's book on computer crime, paying special attention to the "salami" method of embezzelment by accumulating round-off errors in a private account.) Note that not all financial computation needs to be done with "to the penny" accuracy: even our own dearly beloved IRS allows (indeed, encourages) us to compute our tax declaration using a whole-dollar round-off method. Martin Minow minow(a)apple.com

2 1

Innocence & harmless weapons
by Jim Choate 17 Dec '03

17 Dec '03

Hi Sandy et al., Whose side of the truth? To be honest I was surprised by your simplistic responce. Jim Choate Forwarded message: > From cypherpunks-errors(a)toad.com Thu May 23 16:01:31 1996 > Message-Id: <2.2.32.19960523200615.0072a288(a)popmail.crl.com> > X-Sender: sandfort(a)popmail.crl.com > X-Mailer: Windows Eudora Pro Version 2.2 (32) > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Thu, 23 May 1996 13:06:15 -0700 > To: jim bell <jimbell(a)pacifier.com> > From: Sandy Sandfort <sandfort(a)crl.com> > Subject: Re: (Fwd) Re: TCM: mafia as a paradigm for cyberspace > Cc: cypherpunks(a)toad.com > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > At 12:11 PM 5/23/96 -0800, jim bell wrote: > > >Tell ya what: name a weapon that CANNOT be used to harm an > >innocent person. Go ahead, I'm waiting. > > The Truth? > > > S a n d y > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >

3 2

Re: CLI_pr3
by jya＠pipeline.com 17 Dec '03

17 Dec '03

On May 23, 1996 10:41:13, 'tcmay(a)got.net (Timothy C. May)' wrote: >Of course, this appears to be implying that _domestic_ data will be subject >to Clipper 3 restrictions, else this statement is meaningless. > >So, will my stored-value cards that I "charge up" in California and carry >in my wallet to Zurich be GAKked? If not, Morris's statement is >meaningless. If so, domestic data is intended to be GAKked. > >(But we knew this, didn't we?) Several news reports in the last few days seem to be aiming at raising the alarm about crypto, perhaps in response to the various crypto bills, administration reformulations, and studies such as that headed by Herb Lin. The recycling of the news of DoD break-ins supposedly due to heavy military reliance on the Internet; the drumbeat of conferences, press releases and planted stories on international money laundering, the hazards of E-money to the stability of the banking system, spreading "Russian" criminality, and the role of high-technology in each; global Chinese arms dealers and copyright pirates; thousands of Japanese spies needed to combat "Asian" threats. These scares might well be orchestrated in support of Clipper 3 -- to the mutual benefit of international governments and commerce as stated by the IWGCP report. The Clipper 3 report, as John Gilmore and others have noted, aims at an international clampdown on non-GAKed crypto. For this to work, all the major crypto players must agree to act at the same time so that no one gets an advantage by offering non-GAKed products. But is it not probable that there will be a holdout nation(s), like the Swiss in war and bank secrecy, to offer crypto that is non-GAKed? Or will a holdout be starved? Or is it more likely that the genuine alternative to multilateral governmental regulation is going to be small- scale, non-corporate, private parties, insusceptible to large-sacle governmental-market coercion, willing to offer risky, covert services, perhaps as lucrative as prohibited armaments? In such a case, for example, would not a highly skilled cryptographer, let us call her Mathilda Blaze, be able to sell covert crypto (on the side, encrypted transactions, anonymity assured) for far greater reward than a not-very- secure pittance and pension at a downsizing ATT, or NSA, or Russia, China, Israel, France, UK, NL, JP ... ? To be sure, if we knew what they knew, we would understand why the House has just increased the intelligence budget to $30bn, $2bn more than 1996 (WaPo 5-23-96). Maybe all the major crypto nations (gov-and-com), are minting E-money to pay their best techies to protect their secrets. If so, may the best algorithmist take 'em all to the cleaners -- just remember to share with the hackers spooking the spooks-and-crooks of gov-com intel-insec, and causing "Yo, man's" of recognition and admiration of those peering for pennies at ELINT and NetSec screens.

1 0

Re: [SCARE]: "If you only knew what we know..."
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:37 PM 5/23/96 -0700, sameer(a)c2.org wrote: > > Paraphrasing the "Wired" item, "No person who has ever received "The > Briefing" has ever again argued forcefully for the rights of citizens to > use strong cryptography." I assume that since Senator Leahy is a co-sponsor of the Burns bill, "The Briefing's" effects are not long lasting. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: [SCARE]: "If you only knew what we know..."
by jim bell 17 Dec '03

17 Dec '03

At 12:07 PM 5/23/96 -0700, Timothy C. May wrote: > >"If you only knew what we know..." > >("...you wouldn't support encryption, you wouldn't push for privacy >legislation, you would order all citizen-units to have tatooed ID numbers >on their arms...") > >Though I normally avoid "Wired," I did pick up the latest issue to skim >through. A couple of good things, actually, including a nice summary of the >state of crypto laws, etc. (I don't recall the author, as I didn't buy the >issue.) > >A great discussion of the Deepest and Darket Secret in Washington, the >special "If you only knew what we know..." briefing given to legislators, >staffers, etc. to convince them of the Evils of Cryptography. There is a clue here. If that briefing is so effective, why don't they give it to the entire country? We "all" know (at least around CP) of a number of sorta-bad things that might occur as a consequence of allowing good cryptography. (none of which, on balance, even come close to justifying banning or restricting good crypto, or justify GAK, etc.) However, very few of them require more than a little imagination to invent on our own, and given communication most of them will be thought of and disseminated without being revealed by the government. So it's a bit difficult to imagine why they'd avoid discussing those issues in public. The clue, I think, is that this briefing is given to "legislators, staffers, etc". Presumably, whatever arguments they use in this briefing are quite selective and tailored to appeal to government types. They're telling these people of a argument against good encryption that works for government-types but NOT ordinary civilians. It isn't that they don't want the average civilian to know of these arguments, they simply don't want the populace to know what subset of these consequences the government is really concerned about. Okay, what kind of thing would terrify government-types but not most civilians? >Paraphrasing the "Wired" item, "No person who has ever received "The >Briefing" has ever again argued forcefully for the rights of citizens to >use strong cryptography." >I surmise that either Sen. Burns has not yet been given The Briefing, or he >is for some reason more resistant than most other burrowcrats to the scare >tactics used in The Briefing. >I sure would like to know what's in this briefing. >--Tim May It probably starts like this: "See, there's this guy named Jim Bell...." B^) Seriously, though, I can't see how it could be anything other than the typical Crypto-Anarchy-type scenarios, but presented as if they are a Bad Thing as opposed to being a Good Thing. This would fit all the criteria: They appear to be extremely bad from the standpoint of the government-types, are not particularly convincing to the citizens, and the government wouldn't want the public to know what they're most concerned with. It might start'em thinking. Jim Bell jimbell(a)pacifier.com

1 0

Re: GAK3
by frantz＠netcom.com 17 Dec '03

17 Dec '03

"That's a very powerful thing. Suppose the king of England, or the French government, for example, says that you must use our way of assigning identity, and if you do not use our way to assign identity you don't get to play. By doing this they get complete control over the system. Good points and bad points, but if they can make it stick, it's a very powerful position to be in. Indeed it's the position of the king or the sovereign. The identity by fiat." ... [Discussion of Microsoft/Visa proprietary, patented and non-disclosed CA system elided] "So if you allow this sort of a vertically-integrated system to come into place, whoever controls that vertically-integrated system will have control not only over the liquidity--that is, issuing you money--they will end up with a monopoly over the control of the content. Having a monopoly over the content, of course, gives them the power to tax, and the power to get revenues as a percentage of those sales transactions. "So we conclude by asking these questions: If identity no longer comes from your bank, but from your PC operating system, what role does your bank have in granting you liquidity? And if your identity comes from your PC operating system, why can't the PC operating system grant you liquidity? And, indeed, granting you liquidity is known as extending credit. And extending credit is, and has been, historically the function of banks and banks alone. "The point of this discourse into identity and liquidity is to get you to think a little bit about the power of the way that these different systems go together using the bionomic model. If we indeed live with historical, pyramidal kinds of structures, we step right into an economic world where there is, by default, the accident of handing someone else the ability to provide us taxation. If we, on the other hand, maintain autonomies--small self-organizing groups with a language that allows us to communicate from group to group--along with that economic freedom comes a social freedom." - Bill Melton, CEO-CyberCash Inc. Quoted in: http://www.upside.com/news/archive/speech/melton/melton.html ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Floating Point and Financial Software
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:40 PM 5/23/96, Paul S. Penrod wrote: >But there is a simpler method to avoid the problem entirely. There is >suffcient horsepower in uP's these days to support "long hand" division >and multiplication. Granted it takes some extra grey matter to write the >routines, but once done, you can vary the amount of precision to whatever >you desire and not have to worry about accuracy. I've been skipping most of the "floatingpointpunks" messags, but will note that several languages I personally use (however infrequently) have "bignum" support and support full-precision calculations. These include: LISP and Scheme, Smalltalk, and Mathematica. If performance is not an issue, the bignum packages available in C and C++ ought to be sufficient for any financial needs. And Hal Finney is working on a bignum package for Java. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Matt says he didn't get "The Briefing"
by Perry E. Metzger 17 Dec '03

17 Dec '03

The claim was that Matt Blaze got "the briefing". I asked him about this, and this is what he said to me (forwarded with permission). I don't think I actually got "the briefing". They invited the seven authors of the key length report down to DC to talk with a bunch of policy types, but they never showed us the bodies (or the files on us, or whatever it is they show the people who they really want to impress). Perry

1 0