December 2003 - cypherpunks-legacy

Re: Spamming (Good or Bad?)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:55 PM 8/21/96, Asgaard wrote: >On Tue, 20 Aug 1996, Timothy C. May wrote: > >> There are technological fixes which I would favor over attempts to ban >> unwanted messages. > >In the meantime, before these technological fixes are easily implemented, >what is the proper way to handle unwanted commercial mail? > >1) delete immediately > >2) reply with 'Fuck off, morons!' > >3) as in 2) plus an attachment of some 1Mb file > >4) as in 3) plus a CC to the postmaster of the sending site Well, this actually just happened to me. I got a long message from the "Computer Currents" folks, for Yet Another Net Newsletter, "Inside Currents," saying they had added my name to their list and that if I wished to be removed I should a) paste a certain reply form into a section at the end of the message, b) readdress the reply to a person handling unsubscribes, c) blah blah blah. Instead, I just hit "Reply" and sent the message back to them. I wasn't sure if the message would go out to the original list or not, nor did I care. I didn't ask to be subscribed to their list, I wasn't interested in learning their indiosyncratic procedure for removing one's name, and they should have set up their distribution list so as not to allow recipients to post to the entire list (it is, after all, not a mailing list intended for postings by recipients). Well, my message and dozens of similar reply messages from others went out to the "Inside Currents" list, provoking an avalanche of even more replies, bounces, etc. "Computer Currents" is now feeling intense heat over this episode. (My latest message, sent two days ago, was entitled "Fuck "Computer Currents,"" and included my "How to Make a Pipe Bomb" sig. It hasn't come back to me, so maybe CC figured out how to turn off their spammish features.) (Hey, "spammish" is a nice word. Hackers can say, "Yeah, I took Spammish in high school.") --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Spamming (Good or Bad?)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:04 PM 8/21/96, Gary Howland wrote: >I always send a quick one liner - "Please send me more information". >Often I'll ask a stupid question too ("Does your software work in >France?"). If more people did this, then they'd have to choose their >victims a bit more carefully in the future (assuming of course they're >trying to sell something). As I said in my last message, I don't even do this--I just bounce it back to them. I see no need to "ask questions" (such as "Does it work in France?") to, perhaps, "establish legitimacy." If they sent it to me, I can send it back. Simple. And if their software is set up in a brain-damaged way, so that my bouncing it back to them also sends it out to their list, so much the better...at least in terms of helping to anger their potential customers. --Tim May (By the way, some of you younger folks may not remember all the creative ways people used to have to deal with unwanted junk mail. For "return postage provided" replies, they would often attach the return forms to large packages of stuff (sometimes even organic, stinky stuff) and let the junk mailer eat the postage charges at his end. Or they'd fill out the "get free stuff" forms with the addresses of local officials.) We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

RISKS: Microsoft Explorer security hole
by stevenw＠best.com 17 Dec '03

17 Dec '03

---------------------------------------------------------------------- Date: Wed, 21 Aug 1996 13:12:59 -0400 From: felten(a)CS.Princeton.EDU (Ed Felten) Subject: Internet Explorer Security Problem We have discovered a security flaw in the current version (3.0) of Microsoft's Internet Explorer browser running under Windows 95. An attacker could exploit the flaw to run any DOS command on the machine of an Explorer user who visits the attacker's page. For example, the attacker could read, modify, or delete the victim's files, or insert a virus or backdoor entrance into the victim's machine. We have verified our discovery by creating a Web page that deletes a file on the machine of any Explorer user who visits the page. The core of the attack is a technique for delivering a document to the victim's browser while bypassing the security checks that would normally be applied to the document. If the document is, for example, a Microsoft Word template, it could contain a macro that executes any DOS command. Normally, before Explorer downloads a dangerous file like a Word document, it displays a dialog box warning that the file might contain a virus or other dangerous content, and asking the user whether to abort the download or to proceed with the download anyway. This gives the user a chance to avoid the risk of a malicious document. However, our technique allows an attacker to deliver a document without triggering the dialog box. Microsoft has been notified and they are working on fixing the problem. Until a remedy is widely available, we will not disclose further details about the flaw. For more information, contact Ed Felten at felten(a)cs.princeton.edu or 609-258-5906. Dirk Balfanz and Ed Felten Dept. of Computer Science, Princeton University http://www.cs.princeton.edu/sip/ ------------------------------ ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

1 0

Re: Husband/Wife jailed for saying Clinton Sucks
by William Knowles 17 Dec '03

17 Dec '03

On Wed, 21 Aug 1996, jim bell wrote: > Frankly, I'd rather have a president who didn't feel the need to be > protected by thugs. Makes it easier to implement 'Assassination Politics' if you have to. :) William Knowles erehwon(a)c2.net -- William Knowles <erehwon(a)c2.net> PGP mail welcome & prefered / KeyID 1024/2C34BCF9 PGP Fingerprint 55 0C 78 3C C9 C4 44 DE 5A 3C B4 60 9C 00 FB BD Finger for public key -- Vote for Harry Browne in November -- http://www.HarryBrowne96.org

1 0

Re: Republican and Democratic party platforms on technology
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:59 PM 8/21/96, Declan McCullagh wrote: >While the Republicans certainly are no fast friends of online liberties -- >recall Dole cosponsored an "anti-cyberporn" bill worse than the CDA -- >they've been moving in the right direction on crypto. This plank shows that >as a party, they're starting to take online privacy seriously. I think we all know just how long such a taking online privacy seriously committment would last...about two or three briefings from the FBI, CIA, NSA, and DIA. Maybe Dole would get the infamous "If you only knew what we know" briefing, maybe he already has had it (and is just cynically supporting "online privacy" because it's a way to contrast himself with Clinton). Sure, the rhetoric might be slightly different under a Dole presidency. The focus would be on "halting the spread of abortion information on the Net" and "plotting by Communists using unbreakable cryptography." >(Contrast both parties with the Libertarians, which have a sterling >commitment to online civil liberties, reflected in the platform approved at >their convention last month.) I certainly plan to vote for Harry Browne, their candidate, even if voting only encourages the process. I first read Browne's stuff back in 1973, and, a few years later, his wonderful and "Zen Calvinist" (my term) book, "How I Found Freedom in an Unfree World," which I still recommend to people. As far as I'm concerned, Browne is the strongest candidate ever fielded by the Libertarian Party. Not that it will matter. Ralph Nader will probably get more votes than Browne. The answer lies in technology, not the ballot box. --Tim May -- [This Bible excerpt awaiting review under the U.S. Communications Decency Act of 1996] And then Lot said, "I have some mighty fine young virgin daughters. Why don't you boys just come on in and fuck them right here in my house - I'll just watch!"....Later, up in the mountains, the younger daughter said: "Dad's getting old. I say we should fuck him before he's too old to fuck." So the two daughters got him drunk and screwed him all that night. Sure enough, Dad got them pregnant, and had an incestuous bastard son....Onan really hated the idea of doing his brother's wife and getting her pregnant while his brother got all the credit, so he pulled out before he came....Remember, it's not a good idea to have sex with your sister, your brother, your parents, your pet dog, or the farm animals, unless of course God tells you to. [excerpts from the Old Testament, Modern Vernacular Translation, TCM, 1996]

1 0

Husband/Wife jailed for saying Clinton SucksHusband/Wife jailed for say
by John C. Randolph 17 Dec '03

17 Dec '03

> Frankly, I'd rather have a president who didn't feel the need to be > protected by thugs. Well, wouldn't that require a president who had a clear conscience? I don't think we've had one of those since Eisenhower! -jcr

5 4

Re: Husband/Wife jailed for saying Clinton Sucks
by jim bell 17 Dec '03

17 Dec '03

At 10:55 PM 8/21/96 -0400, Brian Davis wrote: >> >> Makes me wonder whether visiting one of these appearances with a "Clinton >> Doll" and a bunch of pins, and visibly inserting those pins into the doll >> (while uttering various strange incantations), would constitute a "threat." >> >> Frankly, I'd rather have a president who didn't feel the need to be >> protected by thugs. > >That's because you like dead Presidents. > $50's and $100's are great! (I also like old fat dead philosophers, as well.) Jim Bell jimbell(a)pacifier.com

3 2

Re: PreRFD: comp.org.cypherpunks
by qut＠netcom.com 17 Dec '03

17 Dec '03

ON ! ! if it is _robo_moderated, there would not be timing issues. Exactly the same problem of one machine that can recieve and make the posts, one script, one moderator in charge of the whole thing, which experience indicates they eventually abuse their resonsibility by keeping it after they lose interest in managing the group. ! igor ! ! Skip, OBC wrote: ! > ! > ! Jim McCoy wrote: ! > ! > qut(a)netcom.com (Skip) writes: ! > ! > > My suggestion number #1: ! > ! > > No moderation. ! > ! > ! > ! > Suggestion 1 on how to diminish the feeble S/N ratio on cypherpunks: ! > ! > ! > ! > make it a newsgroup ! > ! > Suggestion 2: ! > ! > make it an unmoderated newsgroup ! > ! ! > ! How about making it a robomoderated newsgroup with only one enforced ! > ! rule, forbidding any crossposting? ! > ! > If moderation, then why not moderator(s) who simply send out cancel ! > messages to everthing that is crossposted? Traditional moderated ! > newsgroups are technically inferior because all posts go through netnews ! > chokepoints and then depends on the moderator(s) who's inevitable ! > position has been the irresponsible one of keeping the position long ! > after they lose interest with the high volumes. Even if their was such ! > a person, there is still are chokepoint problem which is stupid to ! > engage in. ! > ! > In any case, creation of comp.org.cypherpunks in no way means gatewaying ! > or shutting down cypherpunks(a)toad.com . ! > ! > ! > -- ! > Love, ! > Skip, OBC ! > ! ! ! ! - Igor. !

1 0

ALERT: Show Congress you want privacy during Crypto Action Week! (8/20/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

=========================================================================== ___ _____ _____ _____ ___ / __| _ \ \ / / _ \_ _/ _ \ JOIN THOUSANDS OF OTHER NET.AMERICANS AS | (__| /\ V /| _/ | || (_) | THEY WORK FOR BETTER PRIVACY AND ENCRYPTION \___|_|_\ |_| |_| |_| \___/ September 3-10, 1996 ___ ___ _____ ___ ___ _ _ __ _____ ___ _ __ / _ \ / __|_ _|_ _/ _ \| \| | \ \ / / __| __| |/ / | _ | (__ | | | | (_) | .` | \ \/\/ /| _|| _|| ' < |_| |_|\___| |_| |___\___/|_|\_| \_/\_/ |___|___|_|\_\ SENATE PRO-CRYPTO PRO-CODE BILL COULD BE VOTED OUT OF COMMITTEE YOUR HELP IS NEEDED TO PREPARE CONGRESS FOR THE DEBATE! http://www.crypto.com/caw/ Reproduce this where appropriate until September 15, 1996 --------------------------------------------------------------------------- Table of Contents News from the frontlines What you must do Concluding the meeting Tips on how to conduct your visit Angles on encryption Questions about encryption you might be asked Participating Organizations / More Information --------------------------------------------------------------------------- NEWS FROM THE FRONTLINES Congress as a whole is beginning to focus on encryption - bills moving through both House and Senate would improve availability of privacy and security for the Net. With three hearings in the Senate and one scheduled in House Judiciary Committee for early September - pro-encryption bills have a chance of passing, or at least helping to lay the groundwork for the next Congress. Recently in a live chat from the Republican Convention in San Diego, Senator Conrad Burns (R-MT) said he believed he had enough votes to pass Pro-CODE out of the Senate Sub-Committee and Committee. This is the farthest encryption activists will have come in the crypto fight in years. We need your help to make the case to Congress that encryption is important to privacy and security online, as well as the future potential of the Internet to create jobs and promote US competitiveness. Here's what you can do: -sign the petition at http://www.crypto.com/petition/ -make an appointment with your legislator's local office With the directions below, visit your Congressperson - urge them to support the two bills: Pro-CODE "Promotion of Commerce Online in the Digital Era" (S.1726) & SAFE "Security and Freedom Through Encryption" (HR 3011). Now is the time to tell your member of Congress that government restrictions on encryption are unacceptable to the future of the Internet. In recent months, the FBI and the White House have been using local sheriffs to lobby members of Congress on this issue. If you don't tell your member of Congress our side of the story, they won't hear it from anyone. --------------------------------------------------------------------------- WHAT YOU MUST DO Here's what you need to do: 1. Make an appointment with your Senators'/Representative's local office. It's probably best to make an appointment with the local office manager. It's great if you can get an appointment with your legislator, but don't worry if your legislator cannot be there. If you don't know who your Representative and two Senators are, simply call the local League of Women Voters office and ask! You might also try using the Zipper at http://www.voxpop.org:80/zipper/ 2. Sign the petition at http://www.crypto.com/petition/ A petition has been setup to help show Congress that encryption policy must be driven by the market's concerns. 3. Setting up the meeting When making the appointment, you should say that the topic is privacy and encryption on the Internet. Ensure they know you are a constituent. If possible, take a friend who owns a small Internet business (web design, ISP, whatever) who also lives in the district. It's crucial that you do not wait to get someone to go before making the appointment. Make the appointment, then go looking for someone to go with you. 4. Carry the following message as a theme through your meeting. Encryption is important to privacy - the Internet is vulnerable and the future of American competitiveness is at stake. Encryption is NOT a terrorist weapon any more than a hammer is a terrorist weapon. While there are difficult national security issues, these should not be the driving force of this debate. The future of the Internet should not be held hostage by a cold-war era world view. 5. Send us mail at vtw(a)vtw.org when you've made your appointment. Check back at http://www.crypto.com/caw/ for progress and tips on Crypto Action Week! --------------------------------------------------------------------------- CONCLUDING THE MEETING There are a few things you should remember as you finish your meeting. If talking to a member, find out if we can count on his/her support for the PRO-CODE/SAFE bill. If talking to a staffer, make it their mission to find out the answer to this question. As you leave the meeting, run, don't walk, to the nearest card shop and buy a thank you card. Write a thank you and address it immediately. Stick it in the nearest mailbox. Send us mail at vtw(a)vtw.org, letting us know how it went. ---------------------------------------------------------------------------- TIPS ON HOW TO CONDUCT YOUR VISIT Always be polite. Never threaten. Never lose your cool. Many staffers have no idea what encryption is. Moreover, they might have never used the Internet. You should view this as an opportunity: you will get the chance to define the debate and educate them. You may even want to bring a laptop with a modem and take the member/staff on a breif Internet tour. (Be careful about what you show them.) Remember we're all taxpayers, so the phrase "I'm a taxpayer" is meaningless. Be brief. If you're going in a group, plan out the topics each person will hit. Appoint someone to act as a spokesperson for the group, so there can be a central contact. Remember the first law of Real Estate: LOCATION LOCATION LOCATION. It's crucial that everyone at the meeting be a potential vote for the legislator. Remind yourself that your legislator probably hasn't yet made a decision on this issue yet; you're there to educate as much as anything. Go as *individuals* or *business owners* who have a stake in the debate on encryption issue. --------------------------------------------------------------------------- ANGLES ON ENCRYPTION Internet business angle: When speaking from the point of view of an Internet Service Provider or Web design firm, you have available several arguments, such as: "The popularity of the Net has created a gold rush which has benefitted my business and the local voters I employ. Concerns about security on the net could dampen that excitement, and diminish the potential for industry" "Many types of services that I would like to offer online cannot be done without strong security. The current level of security is too weak to engender public trust, and will diminish the types of business people will put on the net." Clipper angle: If someone brings up the issue of Clipper and the idea that government should be trusted to hold your private encryption key, you have several options available to you: "It's not clear that the Administration can be trusted to hold any information secret, after incidents like the FBI Filegate scandal." "Handing over one's encryption keys to the gov't is just like giving the local police station a copy of your house key, just in case they need to search your apartment. Of course they would promise never to use it unless authorized." --------------------------------------------------------------------------- QUESTIONS ABOUT ENCRYPTION YOU MIGHT BE ASKED There are a number of questions you will probably be asked by the staff or member that you should be prepared to answer. Here's a few of them and some answers you should feel comfortable with. WHAT IS ENCRYPTION? Encryption is a method of scrambling information with one or more "keys" so that only the sender and receiver can read it, and an eavesdropper cannot. Your bank card PIN, telephone conversations, love letters, health records, and business correspondence are all things that might need to be encrypted. WON'T TERRORISTS AND CRIMINALS USE ENCRYPTION? Perhaps. But criminals and terrorists already have access to strong encryption from overseas, and are unlikely to use encryption technologies which they know are breakable by the US government. Would you send sensitive information using a code that you knew your adversaries could break? Criminals and terrorists will, for better or worse, have access to strong encryption regardless of U.S. efforts to restrict its availability. Meanwhile, current U.S. policy leaves sensative personal and business communications vulnerable and actually creates opportunities for crimes like industrial espionage. WHAT IS 40 BIT ENCRYPTION? Quite often the strength of an encryption system is measured by the size of the key. Forty bits is about the same as a five or six letter word, such as "apple". The US government has stated that American companies that wish to sell products with encryption can only implement encryption whose keys are forty bits long. At one time it was quite difficult to attack and recover messages that were encrypted with 40 bit encryption. Because of advances in computer power and research, it has become much easier to do this. As recently as last year, a graduate student in France broke 40-bit encryption using University resources he had available in his spare time. DON'T EXPORT RESTRICTIONS PREVENT ENCRYPTION PRODUCTS FROM GOING ABROAD? No. The idea that export restrictions actually keep encryption out of the hands of non-U.S. citizens implies that all encryption products come from the U.S. This is simply untrue, and the plethora of products available from non-U.S. sources now shows how absurd it is to continue to keep such regulations intact. DO EXPORT RESTRICTIONS HURT U.S. COMPANIES IN THE GLOBAL MARKETPLACE? Yes. American hardware and software companies compete globally with products from around the world. For many companies, a majority of their business comes from international sales. In the crowded marketplace of this fast- paced business, developing a product with a single feature that outshines a competitor's product can often be deciding factor in a consumer's mind. Yet, American hardware and software businesses are at a disadvantage, as many competing non-U.S. products can offer stronger encryption than they can. This places American products at a distinct competitive disadvantage. DO EXPORT RESTRICTIONS LIMIT AMERICANS' CHOICE OF SECURITY PRODUCTS? Yes. Although it is possible to sell two versions of a product, one with strong encryption for sale domestically and one with weak encryption for sale abroad, most companies find this schizophrenic product development approach to be too burdensome and risky. The result is that companies that produce hardware and software products that require security tend to omit such features entirely, or weaken them so that the same product can be used for export as for domestic use. The end result of this is that Americans end up with products that are becoming increasingly incapable of protecting their privacy, hampered by regulations that can longer accomplish their goal. --------------------------------------------------------------------------- PARTICIPATING ORGANIZATIONS / MORE INFORMATION For more information on the encryption issue, check these important organizations' WWW sites: Center for Democracy and Technology (CDT): http://www.cdt.org Electronic Frontier Foundation (EFF): http://www.eff.org Electronic Privacy Information Center (EPIC): http://www.epic.org Voters Telecommunications Watch (VTW): http://www.vtw.org Wired Ventures Ltd.: http://www.hotwired.com Also check these great educational sites: Encryption Policy Resource Page (http://www.crypto.com) Internet Privacy Coalition (http://www.privacy.org) ========================================================================

1 0

Re: telco's vs x-phones
by John Brothers 17 Dec '03

17 Dec '03

I think you both have good points here. I will redo the math. At 09:19 AM 8/21/96 -0700, Brian D Williams <talon57(a)well.com> wrote: >In a reply to Vipul Ved Prakash, Jim Bell wrote: >Siecore plain vanilla 36 fiber singlemode list $ 1.82 a foot, $5.46 >a yard. Jim said $10/meter, so about 50% of his estimate. > >>Each fiber pair should be able to handle approximately 1 million >>conversations at current data rates, or a total of 18 million >>conversations for that 18-pair cable, or 9.5 trillion >>conversation-minutes. > >At current data rates (OC-48 Sonet) 32,256 voice channels per >fiber, 580,608 total for the fiber. Ok.. I think we're talking apples and oranges. Jim uses the term conversation, which I assume is a 3 minute duration of time. Your OC-48 handles almost precisely 1 million conversations per day. (32k DS0 x 24 * 60 * 20) So I can see where he could come up with 18 million conversations. I have no idea what a conversation-minute is. Perhaps another measure would be the total number of conversations per year. 18 million/day * 365 = 6.5 billion conversations per year. So I believe he is off by a factor of 1000+ at this point, but then the fiber is half the cost he thought it was, so its really only 500+. >>Multiply this cost by 10 for right of way, trenching, repeaters, >>and other auxiliary hardware, or $100 per meter. This is probably >>just a ballpark estimate, but... > >Off by a factor of at least 10 not counting switching equipment. So, assume that he's a long haul carrier, and doesn't have to buy any switching equipment. Still, based on $500/meter, that means that this network cost about 2.5 billion to build. So if the system was running at full capacity, 24/7/365, the LD will have to charge $0.50/conversation, or $0.15/minute to make 2.5 billion per year. Even reaching 10% of that capacity is unlikely at $5/conversation. Which, clearly, isn't happening. I assume that either I have made a mistake in my calculations, or the costs of laying fiber has been grossly overestimated... Or, that since no-one is going around and buying up 5000km right of ways, Sprint, MCI, AT&T and co. can lay fiber much more cheaply. If we assume $50/meter, it will cost 250 million, and they will have to charge $0.015/minute to break even at 100% capacity, or $0.15/minute at 10% capacity - and we know Sprint charges less than that, but if they can get more than 10% of the capacity --- although it is doubtful. My best assumption at this point is that we don't have to make back the entire cost of the fiber per year to make a profit. if we only have to earn 20% of its value to make a 10% profit, it would bring the price down to $0.075/minute, and if we were to get OC-768 systems invented, we could reduce that to $0.005/minute, which is approaching the values that Jim derived. So, I hate to say it, but it looks like long distance is more expensive than Jim (or I) thought. But, in a few years (say, 5) it will approach ridiculously cheap. We can expect at that point that either a) All (or most) long distance will be over the Internet b) Internet phone will vanish as regular long distance becomes a flat fee like local service. --- John Brothers Do you have a right not to be offended?

1 0