December 2003 - cypherpunks-legacy

Microsoft Explorer security hole (fwd)
by Ben Holiday 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 01:35:07 GMT Subject: Microsoft Explorer security hole (fwd) On Sun, 25 Aug 1996 13:55:30 -0600 (MDT), Carl Nation <carl(a)iserver.com> wrote: To our Resellers/Customers, Our sysadmin received this security alert, and we thought we should pass it along... ------- Forwarded Message Date: Wed, 21 Aug 1996 13:12:59 -0400 From: felten(a)CS.Princeton.EDU (Ed Felten) Subject: Internet Explorer Security Problem We have discovered a security flaw in the current version (3.0) of Microsoft's Internet Explorer browser running under Windows 95. An attacker could exploit the flaw to run any DOS command on the machine of an Explorer user who visits the attacker's page. For example, the attacker could read, modify, or delete the victim's files, or insert a virus or backdoor entrance into the victim's machine. We have verified our discovery by creating a Web page that deletes a file on the machine of any Explorer user who visits the page. The core of the attack is a technique for delivering a document to the victim's browser while bypassing the security checks that would normally be applied to the document. If the document is, for example, a Microsoft Word template, it could contain a macro that executes any DOS command. Normally, before Explorer downloads a dangerous file like a Word document, it displays a dialog box warning that the file might contain a virus or other dangerous content, and asking the user whether to abort the download or to proceed with the download anyway. This gives the user a chance to avoid the risk of a malicious document. However, our technique allows an attacker to deliver a document without triggering the dialog box. Microsoft has been notified and they are working on fixing the problem. Until a remedy is widely available, we will not disclose further details about the flaw. For more information, contact Ed Felten at felten(a)cs.princeton.edu or 609-258-5906. Dirk Balfanz and Ed Felten Dept. of Computer Science, Princeton University http://www.cs.princeton.edu/sip/ ------- End of Forwarded Message

2 1

CLE_nup
by jya＠pipeline.com 17 Dec '03

17 Dec '03

8-26-96. FiTi: "Cleaning up the global economy. Policymakers must ponder the effects of money laundering." Is money laundering - as opposed to the crimes which produce it - necessarily such a bad thing? As Vito Tanzi notes in his IMF paper, the fact that money launderers are not fussy about economic fundamentals can help governments continue to pursue lax fiscal and monetary policies if they are equally unfussy about the origin of capital inflows. A pact with the devil, perhaps. But for many countries it may seem more attractive than signing up to a global financial market equivalent of Neighbourhood Watch. + Money Laundering and the International Financial System, IMF working paper, May 1996. ----- http://jya.com/clenup.txt (7 kb) CLE_nup

1 0

RSA/Security Dynamics filings are on the web
by John Gilmore 17 Dec '03

17 Dec '03

The RSA/SDTI merger may be the only chance we ever get to see RSA's financial info. Previously it was a privately held company, which didn't report its finances publicly; now it'll be reported as part of SDI (a much bigger company), so its finances will be hidden in their larger business. You can also see what RSA and SDTI are saying about the RSA/Cylink/Schlafly lawsuits, the origins of VeriSign, how Addison Fisher bankrolled RSA and owned 55% of it, etc. Look on the SEC's EDGAR system, which contains copies of reports that the government requires publicly traded companies to file. Go to http://www.sec.gov/cgi-bin/srch-edgar?security+dynamics+technologies and view the various forms. The most fun is probably the big one, the 1.5MB S-4 form from the merger itself. These documents will require a tolerance for legalese, but there are lots of gems in there for the patient. John Gilmore

1 0

Re: Cypherpunk voting - ITAR or CDA
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:37 AM 8/25/96 -0400, Vincent Cate wrote: >So it seems Dole is the better vote. Is this important enough to many >cypherpunks to actually determine their vote? Every time I think about voting for Dole, I read something in the papers that convinces me it is a bad idea. The most recent is that he wants to raise the intensity of the disastrous, failed war on drugs. You know the war. The one that has forced suppliers to enforce their contracts with violence because the courts won't help them. The one that eliminated the concept of responsible use which has worked so well with alcohol. The one that has eliminated reputation from the drug market, leading to overdoses and poisonings. The one that is responsible for most of the wire taps authorized in the USA. The one that has turned the USA into the prison capitol of the world. Don't get me started. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1

Re: Spamming (Good or Bad?)
by James C. Sewell 17 Dec '03

17 Dec '03

At 03:47 AM 8/24/96 -0500, William H. Geiger III wrote: > >No I have to dissagree. Who I send mail to or whom I receive mail from is >no-ones business. I for one have no intention of "signing up" or >"regestering" with any mail server. I most certainally want to be the one to >decide what mail I receive or do not receive, not someone elses idea of what >I should receive. Upon reflection I can say you are right, UNLESS we can put this "signup" thing on the end-user's machine so he can set it in his own privacy and no one else can pilfer it. The ultimate solution is AI mail clients, but that's too far off to wait for, I feel. Jim Sewell - jims(a)tansoft.com Tantalus Incorporated - Key West, FL

2 1

ADMIN: Problems with the list goto the owner, not the list!
by Hugh Daniel 17 Dec '03

17 Dec '03

In the future please send all messages of the form ~something is wrong with the list~ to owner-cypherpunks(a)toad.com and NOT the list its self. We already have enough off topic and puerile traffic cluttering up the list. If you think you see a _very_ major problem then please do email me directly. Now please get back to building the better world we sometimes still talk about building... ||ugh Daniel Majordomo Owner & Potty Trainer hugh(a)toad.com

2 1

Re: Sen. Leahy's "impeccable cyberspace credentials"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 18:52:40 -0700 (PDT) From: Declan McCullagh <declan(a)eff.org> To: Jonah Seiger <jseiger(a)cdt.org> Cc: shabbir(a)vtw.org, fight-censorship(a)vorlon.mit.edu, brock(a)well.com, telstar(a)wired.com Subject: Re: INFO: Democratic convention chats online! Be there! (8/25/96) Jonah, I had expected some negative feedback from CDT, but I should say I was surprised by the tenor of your response. Unfortunately, you don't address the substance of my criticisms of Leahy: how can you defend Leahy's avowed support for Digital Telephony and the copyright legislation? How do his actions make him a "forceful" and "consistent advocate" with "impeccable cyberspace credentials?" (Hint: They don't. He isn't.) You write that: "Of course we are not going to agree with our friends on every issue." But I disagree with your underlying assumption; if a senator is our "friend," they won't do what Leahy does. Being familiar with technology does not a Net-advocate make -- take Al Gore, for instance, who net-surfs in an Old Executive Office building cluster... If I'm wearing any hat at all right now, it's my cypherpunk one. And that prompts me to say that we'll have more freedom online not by relying on the legislative process, but by deploying pro-freedom technology like anonymous remailers and PGP. We can't rely on an ossified Beltway Bureaucracy to preserve our freedoms. (In fact, we need to shrink the size of the Federal bureaucracy drastically to make it less susceptible to special-interest lobbying and to reduce its ability to encroach upon our civil liberties.) We've argued about this before, of course. I recognize that we have core philosophical disagreements. You want to work the legislative process and compromise, while I believe that some rights can't be negotiated away. I recall you supported White's "Harmful to Minors" CDA compromise that would have created a new and unprecedented category of speech crimes online. (The ACLU's Barry Steinhardt wrote on this list last fall that "no true civil liberties organization" would support such language.) You joined Leahy in supporting the Bennett bill, which would have permitted Equifax to create a national medical database with few privacy safeguards. Not to mention your defense of Leahy's pet Digital Telephony project... You write: "But none of them [members of Congress] are gong to continue reaching out a hand to us if we bark and bite when we don't get 100% of our way." I'm confused by this. Does it mean we shouldn't slam Leahy when he fucks with the Net? More disturbingly, the incorrect and misleading label of "impeccable cyberspace credentials" makes it more difficult to criticize Leahy when he does something (like DT funding or copyright) that harms netizens. I suppose you'd like to champion Leahy as a "Friend of the Net." But I'd rather not ignore his attempts to pass legislation that would hinder the development of the Net and intrude on our privacy. I reiterate my earlier statement: "Leahy is in no way a true friend of the Net; I don't know of any Beltway politican who is." -Declan On Mon, 26 Aug 1996, Jonah Seiger wrote: > Declan: > > What are you thinking?! > > In a world where we have very few real friends, I simply don't understand > what you are trying to accomplish. It's fine (and healthy) to raise > concerns about the particular positions a member of Congress takes (hell, I > don't agree with everything Leahy does), but to simply dismiss Leahy as a > 'no friend of the Net' is naive and counterproductive. > > Look at the record. Leahy is hands down the strongest supporter of the Net > in Congress. Period. No other Member (including our small but growing > handful of other friends like Burns, White, Wyden, Cox, Eshoo, etc) has > been a more forceful or consistent advocate for your causes for as long as > Leahy has. What exactly do you want? Perhaps we should elect you to > Congress and see how well you can do. > > Of course we are not going to agree with our friends on every issue. If > Leahy takes a position you don't like, I'd suggest you talk to his office. > I have found in my experience that Leahy's staff (and him personally) will > take the time to listen when presented with a well presented argument. > > I'm also confused about another thing: which hat were you wearing when you > wrote this? If it is your "advocate" hat I think it must covering your > eyes. If it's your "journalist" hat, you need to do a bit better job of > checking your facts in the future. > > Go a head and reject the "Beltway politicians". It's fashionable, sure, but > what does it really accomplish? Some of them are dangerous. Others are > sympathetic. The fact is that short of armed rebellion they are going to be > here for a while. > I shudder to think of the wrath our opponents could wage if we all threw up > our hands packed up our bags and left town. > > Face the facts. Members of Congress have a lot of constituencies to deal > with, and we are a small and relatively powerless faction. We can do a lot > to change the outcomes of policy debates (if I didn't believe that I > wouldn't be doing what I do everyday), but we have to be realistic, > recognize where we fit in to the process and who are friends are. One > thing's for sure - we have A LOT more enemies than we have friends. > > Most members of Congress don't really understand us or our issues. Many > are willing to learn, and some have been real champions for our causes. > But none of them are gong to continue reaching out a hand to us if we bark > and bite when we don't get 100% of our way. Zealots rarely win (though it > sure is fun to throw bombs). > > Sorry for the public thrashing, but this kind of attitude REALLY gets under > my skin. > > Flames welcome (though response is not guaranteed <g>), > > Jonah // declan(a)eff.org // I do not represent the EFF // declan(a)well.com //

1 0

Scan the Web for Live News, Sports, & Music (Talking E-mail)
by RealAudio Talking E-mail 17 Dec '03

17 Dec '03

-------------------------------------- | Make this e-mail talk! | | Load this URL into your Web browser: | | http://www.realaudio.com/tmh.ram | -------------------------------------- Dear RealAudio Customer, Since you downloaded our free RealAudio Player a while back, you have heard some pretty amazing things on the Web. Now you can hear even more with RealAudio Player Plus, an enhanced version of the RealAudio Player. RealAudio Player Plus has a scan feature that lets you scan the Web for live music, radio, sports, and news. It also has Preset Buttons, like a car radio, that take you straight to your favorite RealAudio sites. Please visit our Web site to find out more: http://www.realaudio.com/tmhplus/index.html We hope you enjoy RealAudio Player Plus, Rob Glaser Bruce Jacobsen Chairman & CEO, President & COO, Progressive Networks Progressive Networks

1 0

Re: Sen. Leahy's "impeccable cyberspace credentials"
by James A. Donald 17 Dec '03

17 Dec '03

At 09:50 AM 8/26/96 -0700, Declan McCullagh wrote: > Go a head and reject the "Beltway politicians". It's fashionable, sure, but > what does it really accomplish? Some of them are dangerous. Others are > sympathetic. Not true, some of them are merely less dangerous and harmful than others. As to whether Leahy is one of the less dangerous and harmful ones, that is seriously questionable. > The fact is that short of armed rebellion they are going to be > here for a while.I shudder to think of the wrath our opponents > could wage if we all threw up our hands packed up our bags and left town. Bad cop, good cop. You cooperate with the "good" cop, you go to jail. You tell them both to go to hell, then maybe you will not go to jail, and if you do go to jail, at least you will have the satisfaction of screaming injustice all the way: Re read what our "good" cop has been up to: > > Worse yet, as recently as this month Leahy has > > been clamoring to fund the invasive wiretapping legislation ("Digital > > Telephony") he shepherded through Congress two years ago. > > > > Equally distressingly, Leahy demonstrated his "impeccable cyberspace > > credentials" by cosponsoring the Senate online copyright bill -- aka the > > Hollywood Media Mafia's wet dream. (Yes, these are the same rapacious > > folks who are demanding that the Boy Scouts and summer camps pay cash to > > sing "God Bless America" and "Puff the Magic Dragon.") Opposed by the > > American Library Association, EFF, and teachers' organizations, Leahy's > > bill would slam fair use rights online and could make it a crime to > > browse the Net without a license. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

cryptocd grabbing material
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Aug 27 09:01:57 1996 If anyone out there knows of anything I should (and am allowed to) put on the cryptocd (check www.rpini.com/crypto/cryptocd.html) let me know. If anyone out there knows of anything I MUSTN'T put on the cryptocd (due to copyright, law or whatsnot), let me know also. Thanks, Remo Pini - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMiKdZhFhy5sz+bTpAQEg9gf9EY+SvhGMW1iKB+2U0JVNs3zDqGPNkYpJ zM9WW2oxTtTWn4znjMTXWEVAbGzmdZCkmgHsN3tFWwkWxIYxXrfFcInPNqCzxcXG DZHcQ2nNkH1MOnQ0Wzp9l9riz8TBCzbZNtJsPoVKMup6qAGLV6ninCrAKBGaQJmY 1KR3yez3OVq04SkRXUjXKQRjwtKH2OWmZfzSormEwphHvjgE0nPJhLB9gnVDevTw lSY3YP2NBPtIlaJbxohkvro8Mm+FGIk2vVoOY6cXwFcpZWONtyiwZPiYQzFfcOzw yjbIzGU8qU5MH58MeS/wZuTVzHhtmRl7lCLYS2xPH73ZpgvUh3ZDsw== =LGSU -----END PGP SIGNATURE-----

1 0