December 2003 - cypherpunks-legacy

Steganography
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been some discussion on steganography in the past few days. I've been thinking about the subject so here is a list of my random thoughts: 1. Steganography "standard": Current steganography software relies almost totally on security through obscurity. The problem with such an approach is that there is no standard way to extract data from .gif or .jpg files. If two people want to communicate using stego, they have to have some secure channel through which they could negotiate a protocol that could extract information from data files. This brings up the same Catch-22 situation that exists with conventional cryptography. My idea is that there should be some common, well-known way to de-stego data files. This really doesn't weaken the security of any stego software because if strong crypto that doesn't append any headers on to the message is used in conjunction with stego software, then the output of a stego program would just appear to be random garbage. There would be no way for the feds to prove that the random data was encrypted. I don't know much about graphic and sound file formats, but I think that in most cases the least-significant bit of a graphics or sound file should be pretty random anyway. 2. Recognizing stegoed data: Another problem with stegonography is that while many programs use some kind of identifying header so the recipient can tell whether the file contains hidden information or not, this also allows a snooper to determine the same thing. I think that the ability for the recipient to identify whether the data is stegoed or not is important. So I came up with the idea of using a MAC keyed with the session key used to encrypt the hidden data for checking if the picture contains stegoed data. With this approach, an attacker would not be able to verify if a file contained hidden data or not since the session key would be encrypted with the recipient's public key. 3. Message pools: With steganography more widespread, the use of message pools becomes a lot more interesting. People could communicate anonymously using one of the alt.binaries.* groups with everyone else reading the group completely oblivious to this fact. The posts would be pictures that would decode normally, but only the recipient would be able to decrypt the hidden data. Since the binaries newsgroups are among the most popular on the Usenet, reading one of the binaries newsgroups would draw less suspicion then reading alt.anonymous.messages. I don't know how reliable some of the binaries groups are since many NNTP servers don't carry them or expire the articles early, but since cross-posting seems to be fairly common on those newsgroups anyway, a cross-posted file with stegoed data would have a good chance of reaching the recipient. - -- Mark PGP encrypted mail prefered Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMe6OdLZc+sv5siulAQHMOAP/Yv6SLWY/CCXzXj/91q0hh2M3oVjMr7a6 RBEKCaExosbjJojoTlM9epyzO/gC4jrAj+3IIeciPLHyJPgF2CJmW3NU4bRHPls5 d2kEUPCIc/mLVcbieEC4OO7QlYeFY0vIBn+y1CO3V0kLN20N6Y3845p4a7BY6Wa+ u7dE12QbZLc= =8xQ7 -----END PGP SIGNATURE-----

1 0

Mac Crypto/ internet commerce workshop , sept 5-6, cupertino..
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

The Mac Crypto / Internet commerce workshop,( gathering, conference) will happen...YES (if more like machack than anything else.) The dates will be Sept 5/6, Here in Cupertino, CA at Apple. In addition I will also host the Aug (late) or Sept Cypher-punks meeting one of those nights too. My goals are: 1) to provide a vehicle to educate any and all Apple employees and Developers who are responsible for apple's future on the internet about what is going on in the Internet commerce world. 2) To provide a forum where developers can work together to create internet commerce producs for the Macintosh platform. I am responding to the copious feedback that I have recieved from developers both at WWDC and MacHack, through the various mailing lists that I run (Mac-crypto, net-thinkers etc) and through personal contacts. >>>>>>>> I am looking for folks to talk, papers etc.. <<<<<<<<< The (real) prelminary agenda goes something like: (day one) Introductions and overviews: 1) Introduction to crypto technology, what is it who are the players. 2) Introduction to electronic commerce (Finacial cryptograpy), e-cash, e-checks, digital bearer bonds, etc. 3) How to use this technology today, where is the oppertunities. 4) What needs to be done on the Mac, oppertnunites. (day two) Tech stuff. 1) Random number generation on the Mac, (the key to strong crypto) 2) Password management and the Mac (How to get something better than the Powertalk keychain) 3) Optimizing crypto on the PPC. 4) How to write a OT network server that will give you the performance required for transacting business. remember this is a totatly grass-roots thing, but we are gathering momentum. Look at how effective Internet-config is on the Mac. The conference will materialize more in August, consider this an official anouncement. So book your air tickets, while they are cheap.. (bring a parachute?) be there, aloha! Vinnie Moscaritolo Developer Tech Support http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

RE: Responding to Pre-dawn Unannounced Ninja Raids
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

At 4:13 AM on 96/07/18 Timothy C. May wrote: >It's a mark of what has gone wrong with this country that >ordinary citizens actually fear the midnight raids, the no-knock >searches, the "threat suppression" by ninjas. I recommend an article sub-titled: Fourteen ways of looking at a blackshirt. I've excerpted particularily relevant pieces below. Eternal Fascism by Umberto Eco New York Review of Books (June 22, 1995) In spite of some fuziness regarding the difference between various historical forms of fascism, I think it is possible to outline a list of features that are typical of what I would like to call Ur-Fascism, or Eternal Fascism. These features cannot be organized into a system; any of them contradict each other, and are also typical of other kinds of despotism or fanaticism. But it is enough that one of them to be present to allow fascism to coagulate around it. [...] 3. Irrationalism also depends on the cult of action for action's sake. Action being beuatiful in itself, it must be taken before, or without, reflection. Thinking is a form of emasculation. [...] 4. The critical spirit makes distinctions, and to distinguish is a sign of modernism. In modern culture the scientific community praises disagreement as a way to improve knowledge. For Ur-Fascism, disagreement is treason. 5. Besides, disagreement is a sign of diversity. Ur-Fascism grows up and seeks consensus by exploiting and exacerbating the natural fear of difference. The first appeal of a fascist or prematurely fascist movement is an appeal against the intruders. Thus Ur-Fascism is racist by definition. 6. Ur-Fascism derive from individual or social frustration. [...] 11. In such a perspective everybody is educated to become a hero. In every mythology the hero is an exceptional being, but in Ur-Fascist ideology heroism is the norm. This cult of heroism is strictly linked with the cult of death. It is not by chance that a motto of the Spanish Falangists was Viva la Muerte ("Long Live Death!"). In nonfascist societies, the lay public is told that death is unpleasant but must be faced with dignity; believers are told that it is the painful way to reach a supernatural hapiness. By contrast, the Ur-Fascist hero craves heroic death, advertised as the best reward for a heroic life. The Ur-Fascist hero is impatient to die. In his impatience, he more frequently sends other people to death. [...] Franklin Roosevelt's words of November 4, 1938, are worth recalling: "If American democracy ceases to move forward as a living force, seeking day and night by *peaceful means* (emphasis mine) to better the lot of our citizens, fascism will grow in strength in our land." Freedom and liberation are an unending task. ---------------------- If you set out to defeat an enemy because you despise what they do or say, make sure that you are different - not just stronger. Ciao, James

1 0

Re: New Infowarfare Panel
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:14 PM 7/18/96, David Sternlight wrote: >At 8:30 PM -0700 7/17/96, Timothy C. May wrote: > >>Winn Schwartau is running conferences, is talking about the imminent danger >>of the nation's computer networks being knocked out (paraphrasing his >>latest "Wired" item: "imagine your ATM network being knocked out and people >>being unable to gain access to their money"). >> >>Schwartau is predicting/advocating a "fifth branch" of the military to deal >>with the this threat. A cyberforce, as it were. >> >>Color me skeptical, but I see this all as a lot of hype and fear-mongering. >>Folks in the Pentagon, FBI, and NSA probably see it as a way to get more >>funding, Folks in the consulting business probably see it as a way to crank >>up the seminar prices and increase the number and frequency of "Information >>Warfare" workshops and seminars. > >Haven't there been some worked examples of information warfare that make >this fear and the need to deal with it legitimate? I'm certainly not saying "information warfare" is impossible--for example, I did some work in the late 70s for DARPA on knocking out satellites with particle beam weapons. Specifically, I rebutted MIT Professor Kosta Tsipas' claim that directed energy weapons in orbit would require tens (or more) of Space Shuttle trips _per shot_. I showed the DARPA people how it could be done with 5 orders of magnitude less energy, and speculated that "ticklings" of satellites could be done with commercially available ion implanters--they got real concerned and I was not invited to the classified sessions where they discussed this threat model, as I lacked a clearance. However, the current wave of publicity about "information warfare" seems to focus on _possible_ scenarios, with Hollywoodesque overtones. (And I just learned that "infowar consultant" Schwartau is indeed "working on a movie." Not to ascribe impure motives to him--who's to say what's impure?--but it still sounds like hype to me.) >As I recall my background reading in the public press, wasn't the etiology >that we figured out how to do some pretty nasty things (the Gulf war was >one presenting occasion) to enemies' info infrastructures to threaten their >entire social system. Then, as I understand it, someone smart said >something like "If we can do this to them, then someone can do this to us." >and we were off to the races. Sure, we dropped conductive fibers on their power lines, we blew their dishes out with Special Ops sniper fire, and we did a lot of other such things. Could this destroy the nation's "infrastructure"? Hey, there have been scenarios for disrupting Wall Street, for all sorts of things. Bombs in power plants, knocking over high tension lines, etc. Some things never change. But destroying or even seriously damagaing the U.S. infrastructure would be _very_ hard to do. Sure, the government should think about such things. Utilities companies routinely plan for efforts to disrupt service. (I live a mile or two from where "Earth Action Now!" knocked over a power line about the time treehugger activist Judi Bari was partly blown up while apparently transporting a homemade bomb down here to Santa Cruz.) >It's the military and counterintel community's job to think like this and >act to protect us. I don't think imputing selfish motives is dispositive. I noted that there is a recent wave of hype: books, conferences, calls for action, even movie deals (:-}). Given that there is no real evidence that these mysterious "HERF guns" have ever been used, nor is there evidence that they would do much beyond knocking out the PCs in the office they were aimed at, this is why I said "color me skeptical." By the way, I was interviewed for the BBC programme "The I-Bomb," had discussions a while back with someone working on HERF guns, and have been in touch with Schwartau on this latest round (he contacted me). I'm still skeptical. "Extraordinary claims require extraordinary proof." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: ABC News on internet telephony
by Deranged Mutant 17 Dec '03

17 Dec '03

On 18 Jul 96 at 9:41, Clay Olbon II wrote: > There was a pretty long piece on the evening news on using the internet for > long distance and how much money can be saved. Even had several demos of > intercontinental phone calls. The disappointing aspect was they didn't > mention PGPfone (although if they had, I'm sure child pornographers and > terrorists would have been mentioned as well :-) PGPfone isn't marketed very well. Other Internet phone software is advertised in magazines, promotions with ISPs, etc. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

RE: overseas PGPfone and Netscape
by Jean-Paul Kroepfli 17 Dec '03

17 Dec '03

Ian Goldberg wrote: >Could various people with various architectures post MD5 or SHA1 hashes >of the files they downloaded? (i) very good idea (ii) Do you know where I can find a MSWin or MSDOS executable of SHA? Jean-Paul ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- Jean-Paul et Micheline Kroepfli (our son: Nicolas and daughter: Celine) eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr Also Compuserve and MSNetwork Phone: +33 81 55 52 59 (F) PostMail: F-25640 Breconchaux (France) or: +41 21 843 27 36 (CH) or: CP 138, CH-1337 Vallorbe Fax: +33 81 55 52 62 (Switzerland) Zephyr(r) : InterNet Communication and Commerce, Security and Cryptography consulting PGP Fingerprint : 19 FB 67 EA 20 70 53 89 AF B2 5C 7F 02 1F CA 8F "The InterNet is the most open standard since air for breathing"

1 0

Re: "address verification databases"? (was: Netscape download...)
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

So... I just have to know someone's name and phone number in the US? Ryan ---------- Previous Message ---------- To: tcmay cc: cypherpunks From: jsw @ netscape.com (Jeff Weinstein) @ smtp Date: 07/18/96 12:47:22 AM Subject: Re: "address verification databases"? (was: Netscape download...) Timothy C. May wrote: > > At 9:45 PM 7/17/96, Jeff Weinstein wrote: > > > Because we have not yet been able to obtain the address verification > >databases that we need for Canada. There is someone working on > >tracking this down right now. When we get the proper database we > >will add access to canada. > > > > --Jeff > > Jeff, can you tell us anything more about what these "address verification > databases" are? > > For example, are they derived from government sources? Census data? (Naw, > can't be, for at least two obvious reasons). Voting records? (Naw.) Credit > card purchases? (??) Our database was obtained from American Business Information. They make those CDROMs with 11 million business names and addresses, and other such products. There is a link to their web page from our US download page. > While I can imagine various commercial firms have indicators that a "T. > Christopher May" once lived in Rio Del Mar (the name of a town I lived in, > though not an official "Postal Service" address), I really find it odd > that, for example, there would be any database that could "parse" the > informal information people provide (absent a well-defined set of addresses > and precise spellings). > > In case I'm not making myself clear, there are no "official" addresses of > persons in the U.S! Not even the tax system requires registration of all > persons and specific addresses. This has come up in several "voter's > rights" cases, where persons with no fixed address were nevertheless able > to vote. If I, T.C. May, say my address is Moonbeam Trailer Park, who's to > say it's not? Maybe it's where I'm staying with a girlfriend, maybe it's > where I get my mail, maybe it's my spiritual home. And yet just which > "address verification database" could possibly confirm that I live in (or > get my mail at the Moonbeam Trailer Park at this exact moment? Absent any > laws clearly defining what one's official name is, official phone number > is, official zip code is, official address is, etc., just about anything we > choose to put down on the Web form is kosher. Our verification software does not check that the person whose name is entered in the form lives at the address entered in the form. We do verify some parts of the information entered. Things like is the state code one of the 50 states, does the zip code match the state, etc. (NOTE - these may not be the exact checks implemented currently. I have not examined the code myself, but these are the types of checks being done.) > At least the MIT system was based on ISP domain names, crude as this is, > and not on putative names and residential or business addresses. We also screen out based on domain names. > Anyway, I don't know if Netscape is rejecting the information I'm providing > them, as I've been unable to get through in roughly 30 connect attempts. We will be increasing capacity soon. The demand is very high. It costs us real dollars to buy hardware and T3 lines to allow people to download the software for free. > But I'm still curious about what these "address verification databases." > Sounds ominous to me. I'm sorry that my choice of words disturbed you. I hope my explanation will allay at least some of your fears. There are many people here (including Jim Barksdale) who are very concerned about maintaining personal privacy. Certainly if we could we would make the US versions of our software available in the same way that we currently make the export versions available. At least people now have the choice of obtaining the US version over the internet. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Re: Opiated file systems
by Deranged Mutant 17 Dec '03

17 Dec '03

On 16 Jul 96 at 19:21, Mark M. wrote: > > A problem with a c'punk-style encrypted fs with source code and wide > > distribution is, of course, that attackers will KNOW that there is a > > duress key. > > I don't see how this would effect the security of such a filesystem. There > is absolutely nothing that an attacker can do to get the real key. An attacker > would just ignore all computers that have duress key capability. 1. Confiscate computer (along with physical drive) with duress-capable encrypted file system; 2. back up the encrypted sectors; 3. reverse-engineer file system driver to figure out how the duress-key works, if there are multiple keys, where data is stored; 4. make sure you've rubber-hosed or subpeoned all passphrases or keys; 4a. if the system destroys data, you've got backups ("Very funny kiddo; now give us the real key...") 4b. even if there are two filesystems, the attacker will want access to both, just to make sure... Duress keys rely on a form of security through obscurity. They make sense for real-time situations where the attacker has to rush in, gain access quickly, and leave real fast (ie, bank robberies). If the attacker has plenty of time, he can prepare for that possibility. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

3 2

Re: Gorelick testifies before Senate, unveils new executive order
by jim bell 17 Dec '03

17 Dec '03

At 03:04 AM 7/18/96 -0700, David Sternlight wrote: >Serious studies have shown that the kinds of protections to make the >systems we depend on robust against determined and malicious attackers (say >a terrorist government, or one bent on doing a lot of damage in retaliation >for one of our policies they don't like) "Policies"? There you go again. A "policy," at least in regard to the US government, is not merely opinion, but is action. Action which may (legitimately) anger people. Action which may not genuinely be in the interests of American people, although you'd never get those government thugs to admit it. If somebody overseas doesn't like a US government "policy," maybe the best thing to do is to determine whether it's actually beneficial to the ordinary American citizen, or whether its benefits can be achieved simply by changing government behavior. So what's the best way to avoid "terrorism"? Maybe the fastest, more efficent, and overall best way to avoid it is to get the US government to stop doing things that foment it, rather than trying to protect against it after the fact. , have costs beyond the capability >of individual private sector actors. Your friendly neighborhood ISP, for >instance, probably can't affort the iron belt and steel suspenders needed >to make his system and its connectivity sabotage-proof, and so on. Even >cheap but clever solutions involving encryption in such systems require >standards and common practices across many institutions. None of which require government actions to achieve. If anything, what is required is that governments STOP doing things which discourage such implementations of encryption. Government is the problem, not the solution. >In such a case, where public benefits from government action greatly exceed >public (taxpayer) costs, This is the classic Sternlight misrepresentation. Chances are excellent that this public benefit you speak of is almost totally a benefit to government employees, not ordinary citizens. Government's "solutions" are predictably skewed to maintain government budgets, not actually designed to solve the underlying problem. Jim Bell jimbell(a)pacifier.com

1 0

Alternative Journalism
by enquirer＠alpha.c2.org 17 Dec '03

17 Dec '03

THE CYPHERPUNK ENQUIRER PRESENTS: "Adventures in Alternative Journalism" The Analysis Piece Alice stared at the two strange creatures. She was completely dumbfounded. "So let me see if I've got this right. You make really good wheels. But if the Queen of Hearts had wheels, her subjects who occasionally raid your borders would be able to get away faster, and you wouldn't catch as many of them. Is that right, Tweedledumb?" "I'm Tweedledumber. He's Tweedledumb. Yes, that's right. We have a technological lead over the Cards, and we have to maintain it." "So you won't sell them wheels?" "Well, it's more complex than that. A large part of our population is engaged in making wheels, and we make a lot of money selling them to the Cards. So we made a compromise. We only sell them SQUARE wheels." "But of course," Tweedledumb chimed in, "it's very expensive to make both square and round wheels. So most of our people only make square wheels, so they can sell them to both us and the Cards. Of course, our people are allowed to buy round wheels, IF they can find them." "AND," stated Tweedledumber, "since the wheel is patented here, we get to collect a hefty licensing fee for every wheel sold." "But the Cards DO have wheels!" Alice could see over the fence, and the Cards were happily zipping around all over the place. "And so do a lot of people over here. What happened?" "Well, we couldn't stop the Cards from building their OWN wheels ... " "And people like buying the Card wheels because they're faster than our wheels, and they're cheaper, because they don't have to pay us the licensing fee ..." "You see, we have a licensing treaty with the Cards for most things, so if they make something we have a patent on, they have to pay us, but the wheel can't be exported, so it can't EXIST over there, so our patents don't apply ... " "But I don't understand! You said you needed to catch people, but now you can hardly catch anyone!" Alice was totally astounded at what she was hearing. "It's only a stopgap measure anyway." Tweedledumber clasp his hands behind his back and started pacing. "We need to get an agreement with the Queen of Hearts that both of our people will only use, oh, say, pentagonal and maybe hexagonical wheels. That way, everyone can get around faster, but we'll still be able to catch them." "But who's WE?" "Anybody with a TLA on their shirt. WE get round wheels." "What's a TLA?" Alice almost felt relieved when she saw the familiar grin materialize. The rest of the Cheshire Cat soon followed. "A TLA, my dear, is a Three Letter Anachronism. When people start referring to you by your initials, you've overstayed your welcome. If everyone starts calling ME TCC, I'll know it's time to find another job." The caterpillar spoke up from its perch on the toadstool. "Wrong, tuna breath. TLA's are the only thing standing between society and total chaos." Alice turned to face the caterpillar, who responded by blowing a lungful of hookah smoke in her face. "THESE two goons only deal with the dangers of the Queen of Hearts and her soldiers, I have to worry about the domestic situation. So we came up with a solution. There are certain unscrupulous locals who engage in terrible things, terrorism, drug dealing, child molestation, money laundering ... we have to be able to catch them. If they had wheels, they could outrun us. But if we had ACCESS to those wheels when we needed it ... by the way, speaking of drug dealers, we know about that mushroom, and the pills. You might want to think really hard about playing ball with us, the Queen of Hearts is rather fond of cutting off dope addict's heads." "Access to wheels? Does that have anything to do with those ropes hanging off the back of those carts?" "Yup. We pull on that rope, the wheels fall off. And since we may have to stop a LOT of people at one time, we could have a riot, or another Butthole Surfers concert, we figure that we should be able to stop about ten percent of the population at once, a little less in the rural areas ... well, they've gotta be REALLY LONG ROPES ... and there have to be A WHOLE LOT of them ... course, the ones with the ropes we let have octagonal wheels ... " "But can't just anybody pull the rope? You'll have wheels falling off all over the place." "Price you have to pay for a safe society. Besides, we have trusted third parties holding to to the other end." "How will you get people to use it, when they can get regular wheels from the Cards?" "How else? We could pass a law. But it's easier just to threaten all the wheel dealers - put the rope on or we shut you down. Spread the word that only criminals don't use ropes - what are you afraid of? Got something to hide? Eventually we'll have to outlaw the round wheel, of course, but for the time being, some creative social engineering should do the trick." The caterpillar took another long drag on the hookah. "Good shit. Dole was right about this stuff." "But can't people get real wheels for free?" "Sure, we've pulled off enough they're lying around all over the place. But then you need an axle, bearings, steering - most people still just go down and buy the whole package. We get them, we're in - guy up in Seattle makes something like 90% of all carts sold here, you should see the shit we've got on HIM! No problemo. And those idiots at Netscape - we've got them doing a complete background check on anybody who wants a round wheel - come back in five days, and maybe you can have it." "So, Alice, are you learning anything?" Alice liked the Cheshire Cat, but it did have very sharp teeth, and very long claws, and it did have the habit of appearing out of nothing. Alice felt that it should be treated with respect. "Not really, your cattiness. It doesn't make any sense at all!" "It isn't supposed to. You have to look at it the right way. From their perspective, it makes perfect sense." "I'm confused." "Don't worry about it. It gets worse before it gets better. Come on, we're going to a party. Tim May and John Gilmore are throwing a Mad Tea Party." "Are they really mad?" "May's crazy as a loon. You'll like him. Gilmore, he's just still pissed at Shimamura for that stunt in the hot tub ... "

1 0