December 2003 - cypherpunks-legacy

Netscape-US for foreign students at Stanford, elsewhere?
by Richard Charles Graves 17 Dec '03

17 Dec '03

The US version of Netscape 3.0 has been installed in /usr/pubsw for all supported platforms, including Linux. /usr/pubsw can be mounted anonymously via AFS. Is this true at other major universities? Is anyone interested in prosecuting us? Nobody has ever complained about the PGP binary's being available for years. -rich speaking only for his evil twin skippy

1 0

Hackers invade DOJ web si
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> CNN online (http://www.cnn.com) is reporting a "breakin" by "hackers" In> to the DOJ web site. They don't elaborate exactly how thy did it. They broke in and posted obscene messages and pornographic pictures... P.J. pjn(a)nworks.com ... Captian's log, stardate 25970-point-5. I am nailed to the hull. ___ Blue Wave/QWK v2.20 [NR]

1 0

Securing Internet mail at the MTA level
by C Matthew Curtin 17 Dec '03

17 Dec '03

Hi, Recently, I've been looking into securing email at the MTA level, and would like to get your thoughts on implementation possibilities and related issues. The problems that I'm trying to solve are: 1. Host authentication 2. Data privacy In order for the widespread encryption to work, several things need to occur: 1. Phase-in of the new stuff 2. Backward compatibility (ability to continue to work in the clear) for a period of years 3. A single worldwide mechanism, defined by an RFC, and freely available, except, perhaps, in the case of commercial MTAs. (i.e., the use of RSA seems appropriate for host and session key management, and is free via RSAREF in the US, free outside of the US, but not free for commercial use. This seems acceptable to me.) Two types of approaches are possible: 1. Adding to the SMTP protocol itself, allowing for MTAs to identify crypto-capable peers, and then performing authentication and session encryption where possible. 2. Waiting for a cryptographic transport layer network protocol (such as what is being proposed in draft-ietf-tls-ssh-00), allowing SMTP to remain untouched, and only requiring MTAs to add support for the new network protocol. I like the second approach better, because it allows more problems to be solved with one move, and it would be easier to add crypto functionality to our common network utilities by simply making them aware of the new transport layer protocol. The first approach would require redefinitions of RFCs for each of the services, and lots of redundant work. I mentioned my interest in an SSH-capable MTA to Tatu Ylonen <ylo(a)ssh.fi>, and he as also expressed interest. The word from him on the status of the SSH Internet Draft is that a reference implementation should be available early next month. I'm considering using that reference implementation to add SSH capability to an MTA, perhaps sendmail. My questions are: 1. Which of the two approaches seems to make the most sense to you? 2. Is there another approach that could work better? 3. Is there interest in adding SSH functionality to sendmail in the near future (either by the draft spec, or once the RFC has been published)? Please feel free to pass this around, if you deem appropriate. I'm interested in lots of feedback before deciding if and how to go ahead with the project. Thanks. -- C Matthew Curtin MEGASOFT, LLC Director, Security Architecture I speak only for myself. Don't whine to anyone but me about anything I say. Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet cmcurtin(a)research.megasoft.com http://research.megasoft.com/people/cmcurtin/

4 3

No Subject
by Alan Horowitz 17 Dec '03

17 Dec '03

On Aug 18, 96 11:12:16 am, Joel M Snyder, Now Overwhelmed Again wrote: > Back to the original topic: email-to-snail-mail. That's not hard, > technologically. The problem as I see it is billing. If I were to offer > such a service, I'd want to keep my cost to the consumer low, on the order > of $0.75 to $1.00 per message, with marginal charges for additional pages. > I might possibly barely be able to find some slave labor to make a profit > at doing it, IF I HAD THE VOLUME (which I probably wouldn't), but the > overhead of setting up a billing arrangement with every TDH who wants to do > it would eat the profits up instantly. > > It's difficult to conceive of a setup which a technomad would use in > sufficient volumes to be cost-effective. How about the sender provides a Digicash e-cash payment for the appropriate amount with each message, kind of like a electronic postage stamp? A script on the receiving side could automatically check the payment amount, bouncing the message back to sender with an "insufficient payment" message if necessary. Or you could use a web page to submit messages and payments. Either way no one needs to worry about billing, account tracking, etc. Payment/billing is taken care of immediately. Of course, there is some overhead with the fees on e-cash, but it probably would be more cost effective than other methods. P.S. I have an alpha version of a program which may be of interest to technomads: it automatically executes scripts received by email from a remote machine and then mails back the results. The scripts (shell scripts, perl scripts, or whatever) are encrypted and signed with PGP before being sent to provide security and prevent unauthorized users from executing scripts on your machine. The program runs on unix systems, and submissions can be from anything that runs PGP and is able to send email. See: http://www.bmen.tulane.edu/~carpente/emscrypt/emscrypt.html for more info. --Matt -- mcarpent(a)mailhost.tcs.tulane.edu PGP mail preferred, finger for public key.

3 3

Nymrod is shutting down
by John Perry 17 Dec '03

17 Dec '03

The following message is a courtesy copy of an article that has been posted as well. -----BEGIN PGP SIGNED MESSAGE----- The nymserver located at nymrod.jpunix.com is shutting down due to abuse. The type-I/type-II MiddleMan remailers are unaffected. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMhjnFVOTpEThrthvAQFcQAP+LYtkT16wJGmmzbYymzRJv1IRdVotwvrY 4hUKn5y+TyCTWoyHQlUR3//L0nRPzViqm1GBeT4Tw88kmEvmRSguCYTxuNV3gr6t n8gOP/MKoYTZ1tdxYRMDd+LN2I4j2phUF90sItiLT04/JD65CwRNblD0bFWSbGr7 X8YiOIVkxTQ= =VA6N -----END PGP SIGNATURE-----

1 0

Re: US Taxes on X-Pats (getting off topic)
by Stephen Cobb 17 Dec '03

17 Dec '03

At 11:24 PM 8/18/96 -0400, you wrote: >As I understand the proposal, the immigrant-benefits thing would be for >immigrants admitted AFTER the act was, uh, enacted. So, no ex-post-facto >problems. > > I know this is getting way off topic...but what I am not clear about is this: 1. Americans living and working in London used to be eligible for certain benefits from the British social security system, into which they are required to pay. There is a reciprocal arrangement between the US and UK on soc sec benefits and payments. The new US law seems to alter that, which could affect the US citizen living in London, as in, "sorry mate, you can't come in here with that knife wound, not without your cheque book you can't." 2. Making legal immigrants living in the US pay soc sec "taxes" without being eligible for benefits sounds pretty unfair, even "unamerican." Maybe someone who knows more about the law in these matters can clarify. Stephen

2 1

[fnord] Re: Discordians a-gogo (aggoo)
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:00 AM 8/19/96 -0400, Simon Spero wrote: >On Mon, 19 Aug 1996, WinSock Remailer wrote: >> >> DISCORDIAN SOCIETY SUPER SECRET CRYPTOGRAPHIC CYPHER CODE > >BTW, have you ever looked really closely at a Terisa systems business >card. Really closely? HAve you seen the Fnord? If you do not see the fnord, then it cannot eat you. ObDiscordian: Have you noticed that there are five levels of priority in Eudora? --- |"Computers are Voodoo -- You just have to know where to stick the pins."| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

2 1

Re: Hackers invade DOJ web site
by Nick West 17 Dec '03

17 Dec '03

At 06:46 PM 8/18/96 -0700, you wrote: >> CNN online (http://www.cnn.com) is reporting a "breakin" by "hackers" >> to the DOJ web site. They don't elaborate exactly how thy did it. > >Did anyone save a copy of the altered web page? I would like to see >what the crackers did. > >Thanks. > > They showed a the page on CNN Headline News yesterday. They might show it sometime again today, stay tuned. Nick West nick(a)multipro.com Member of the National Wild Turkey Federation and The Libertarian Party of Tennessee http://members.tripod.com/~NWest/index.html PGP Fingerprint= F9 F7 92 D9 D3 0B 56 3E FA 2A 78 59 27 32 7D 6F Public key available on request.

3 2

[NOISE] Re: Indonesia detains democracy activist after post to mailing list (fwd)
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Declan wrote: [...] > Back to Indonesia -- my column should have said the Indonesian military is > *trying* to ban the mailing list from the country. They haven't succeeded > yet. Time will tell. > > I have more information on Indonesia at http://www2.eff.org/~declan/global/ >-- > right now, use the www2 address since not all directories seem to be > updating on the mirror servers properly right now. For those who are curious, Indonesia is an interesting test case among the Pacific Rim counties because the current iron-fisted ruler is beginning to get a bit long in the tooth and no one has any idea what it going to happen when he finally croaks. Indonesia has had almost no political opposition since a rather violent anti-Communist crackdown/coup in the 60s. All media access was rigorously controlled and the possibilities the Internet and similar computer networking technologies offer (ObCryptoAnarchy ref...) are just now becoming apparent to those who are in charge. How this plays out will have interesting reprecussions in other such countries where politicial discourse is a new phenomenon and where the Internet is just now being seen as a threat to the current order. jim, former exchange student to Indonesia who hopes the transition is less bloddy than Indonesia's last change of government...

1 0

Re: "Utilization Review"
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 12:22 AM 8/19/96 -0400, Black Unicorn wrote: >I listened with horror this evening to a radio program which >discussed the state of medical record privacy today. Unfortunatly, it is still true that whoever pays the piper calls the tune. The best way to ensure medical record privacy is to eliminate medical insurance. Perhaps, within our current social order, medical savings plans are the best option on the table. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1