December 2003 - cypherpunks-legacy

Re: libelous action
by C Matthew Curtin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "JOHN" == JOHN E HOLT <76473.1732(a)CompuServe.COM> writes: JOHN> Dear Mr. Curtin JOHN> Your statements about myself and my product, The JOHN> POUCH are defamatory. Since they have been made in writing and JOHN> shown to and seen by other parties on the Internet, they JOHN> constitute libel. Please admit to all parties that you have no JOHN> personal knowledge of my product capabilities or my personal JOHN> character or reputation. Failure to do so at once will result JOHN> in legal action against you personally and Megasoft. As my signature said, I speak only for myself. I am not a representative of Megasoft in any official capacity. That which I have posted does not represent the views of Megasoft, its employees, its shareholders, its customers, its business partners, its landlord, its employees' mothers, and is in no way representative of any person living or dead, other than myself. I have no knowledge of JOHN E HOLT <76473.1732(a)CompuServe.COM>. The only knowledge I have of THE POUCH is its web site, found at http://www.flagler.com/security.html On 18 August 1996, I posted to the Cypherpunks mailing list, a note regarding THE POUCH, which included this paragraph: If it is any good, there's no way for us to know. But your marketing of the product has every indication that it's nothing more than smoke and mirrors. To coin a phrase, "pseudocrypto." I, speaking only on behalf of myself, stand by this statement. I do not apologize for my comments. If you, Mr. Holt, feel that this is a personal attack against you, I regret that you've misunderstood the tone and nature of my post. My statement is hardly libelous; I simply observed that if your product is truly secure, there is no means by which security experts can verify such claims. Study of computer security has shown that obscurity (using unpublished algorithms, for example) is not "security." By perpetuating confusion between the two terms, nonexpert users of crypographic software are hard pressed to make good decisions about what they use, and the risks of the software they're using. Hiding the internals of such software, claiming that it is "highly resistant to all known forms of cryptographic attack," is, in my opinion, irresponsible marketing. It is my hope that future marketing endeavors of THE POUCH will be more open and straightforward in its approach to security, providing evidence of a crystal-box architecture, whose security can be more objectively determined by potential customers. Hiding a paper from me by putting it somewhere in New York City is obscurity. If you hide a paper from me by putting it in a safe, and then give me the safe, and the technical documentation of the safe's locking mechanism, and I still can't get the paper, then *that* is security. (And, by the way, I think you'll find insisting that I somehow retract my statements, rather than prove me wrong by showing the quality of your product, will likely further add to the suspicion that the security of THE POUCH cannot be proven.) - -- C Mattew Curtin cmcurtin(a)ee.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Have you encrypted your data today? iQCVAwUBMiJEYRhyYuO2QvP9AQFPmwQAgimf3IhoX4wMPPNk7JY9nlFDJG2K/gO3 Xnd7ygPYAhz4BRaEl6SAaOOWiKjBA1l5EI5GhZdTL0WIWdKQv5MJROElzTVcY7nx Tq1wysgTRTLjt7XQS2FyIa1S7OSvyhJttAslbJjpl+PqCwT18bhr3Oh9Cp2g1LRq sNxdtB1BtQQ= =I28g -----END PGP SIGNATURE-----

3 2

Re: libelous action
by Ross Wright 17 Dec '03

17 Dec '03

Sirs: If I was John E. Holt, I would take a different public relations tack. I would seek positive input, not a negative reaction to criticism. Or I would ignore the critique altogether. Ross Wright On Or About: 26 Aug 96, 22:29, Perry E. Metzger wrote: > demonstrate that. If Mr. Holt would like to sue me, he's invited to. > I'm sure he'll be at least as likely to follow up as Karl Denninger > or "Dr." Fred C. Cohen. > > Perry > > C Matthew Curtin writes: > > JOHN> Dear Mr. Curtin > > JOHN> Your statements about myself and my product, The > > JOHN> POUCH are defamatory. Since they have been made in writing > > and JOHN> shown to and seen by other parties on the Internet, they > > JOHN> constitute libel. Please admit to all parties that you have > > no JOHN> personal knowledge of my product capabilities or my > > personal JOHN> character or reputation. Failure to do so at once > > will result JOHN> in legal action against you personally and > > Megasoft. > [...] > > I, speaking only on behalf of myself, stand by this statement. I > > do not apologize for my comments. If you, Mr. Holt, feel that this > > is a personal attack against you, I regret that you've > > misunderstood the tone and nature of my post. My statement is > > hardly libelous; I simply observed that if your product is truly > > secure, there is no means by which security experts can verify > > such claims. >

1 0

Re: Sen. Leahy's "impeccable cyberspace credentials"
by jim bell 17 Dec '03

17 Dec '03

At 09:50 AM 8/26/96 -0700, Declan McCullagh wrote: >---------- Forwarded message ---------- >Date: Mon, 26 Aug 1996 12:23:57 -0400 >From: Jonah Seiger <jseiger(a)cdt.org> >To: Declan McCullagh <declan(a)eff.org> >Cc: shabbir(a)vtw.org, fight-censorship(a)vorlon.mit.edu, brock(a)well.com, > telstar(a)wired.com >Subject: Re: INFO: Democratic convention chats online! Be there! (8/25/96) >Declan: >In a world where we have very few real friends, I simply don't understand >what you are trying to accomplish. It's fine (and healthy) to raise >concerns about the particular positions a member of Congress takes (hell, I >don't agree with everything Leahy does), but to simply dismiss Leahy as a >'no friend of the Net' is naive and counterproductive. > >Look at the record. Leahy is hands down the strongest supporter of the Net >in Congress. Period. No other Member (including our small but growing >handful of other friends like Burns, White, Wyden, Cox, Eshoo, etc) has >been a more forceful or consistent advocate for your causes for as long as >Leahy has. What exactly do you want? Perhaps we should elect you to >Congress and see how well you can do. Leahy's crypto bill sucked, bigtime. The portion of the bill criminalizing the use of encryption that had the effect of thwarting a government investigation is classic, "foot in the door" creeping government manipulation. I was particularly disgusted to notice that a number of the traditional net-freedom organizations rushed to announce that they were in favor of that bill, without even a few days of analysis, and did not retract or even restrict that support when a more careful study (specifically, that of Peter Junger) showed how seriously flawed it was. Indeed, I never saw another analysis that purported to defend Leahy's bill, despite the fact that it would have been the responsibility of any organization which claimed support of it to prepare one. I believe that it is particularly suspicious that these bills come into existance without even cursory "vetting" on the Internet. Both the Leahy bill and even the Burns crypto bill popped into public view without any indication of how they were written, or any public input on their intent and scope. Perhaps this "take it or leave it" practice is old hat to politicians, but frankly I'm disgusted at politicians' presumption that they can prepare a law with no identifiable input from the public. I am similarly disgusted at any organization (even if, ostensibly, acting in support of "net freedom") that assisted in the development of the Leahy crypto bill (and to some extent, even the Burns bill) because they clearly failed to solicit the kind of public input that such bills should automatically get. And in a sense, "the Net" doesn't NEED "strong supporters": what we need are politicians who are willing to LEAVE US ALONE! It should come as no surprise that the call you frequently see among net-freedom- supporters for new legislation is that which repeals existing restrictive laws, such as ITAR and censorship laws. Jim Bell jimbell(a)pacifier.com

4 3

pgpcrack v0.99b
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've finally gotten around to adding secret key cracking support to pgpcrack. There also have been a few minor code changes to speed things up a bit. The source and cooresponding signature are located at http://www.voicenet.com/~markm/pgpcrack.html. Bug reports and suggestions are, as always, welcome. - -- Mark PGP encrypted mail prefered. Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMiJ0WCzIPc7jvyFpAQGaKAgAg5x5U26uy1JJYv2lVKSHItFYOuTVa+qL EBL39NsscrZCuPSYmmm75AgjBJFR4giQ9mDA4QYvxg7Es1O7guX9oq5NHGowLGHH uJblF2pA6T+faQto3oJ0sVLJ4EyekRW0tZWz+TjIUO/c9ijWnciXJuIZ8YAJJRHO 2la92IFiy9d6hab2p7lvQn6MOB0mHjioS1iWvOTaqHpkpjRQm5GSbWA7Hx913LeE sAZM4FkI+KyujaatbuDjpemZ9R04BOmE4aDHuDY3TYAThWUz9sFpQuB8a0fe6Gwi GupMq1dsovbmtO7AOKeoo7l4va/0l6Pmji5/5cInKHftNbE+1sHaTg== =nxzL -----END PGP SIGNATURE-----

1 0

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

On Mon, 26 Aug 1996, Geoffrey Gussis wrote: > Overall, I am quite surprised that there isn't a whistleblowing > clearinghouse on the Internet; a site sponsored by a non-profit that lists > email addresses and secure forms for sending anonymized email to those > areas of the public and private sector that deal with whistleblowing. As > the Internet is a great medium for information dissemination, and offers > significant privacy advantages, I really expected to find much more. http://www.greatworld.com/ Used to have a whole pile of web accessable databases dealing with political corruption, crooked cops, government waste, and a database of alleged child molesters... I beleive the site had to be shut down due to massive abuse, though. The sponsor of the site was/is a guy named Tony Gatlin, his phone number was/is 615-859-3710. The company he worked for was/is called Self Test Software (selftestsoftware.com) but the company web page is defunct now as well. I'm guessing a massive libel suit led to his untimely dissapearance from the net, but i could be wrong.. I'd say that he could probably contribute a paragraph or two on the problems facing people who try to engage in "whistle-blowing" on the net, and could give a few good reasons why you aren't finding more services dealing with this sort of thing. Anonymity is great, if you really have something to say, but unfortunately for many people anonymity is nothing but a tool to injure others with impunity. "Peaceful confrontation, meet war machine." -Slayer "This time, I'm voting with a bullet." -Corrosion of Conformity

1 0

Net Politics
by jseiger＠cdt.org 17 Dec '03

17 Dec '03

At 6:52 PM 8/26/96, Declan McCullagh wrote: >Jonah, > >I had expected some negative feedback from CDT, but I should say I was >surprised by the tenor of your response. I am going to try and resist the tasty-looking flame bait you have dangled in front of me here because we both have more important things to deal with, and because Seth Finkelstein summed up this argument perfectly: "One more round of 'work within the system' vs 'up against the wall!'," he said. This is an important debate that unfortunately seems to be dividing the net.community when we most need to be united. All of us working on net-policy issues share a common vision and goals - promoting the free flow of information, preserving and enhancing First Amendment values and protecting individual privacy. There are, for better or worse, many different views on the best way to accomplish those objectives, and the debate over who has the right tactics seems to frequently escalate in to religious war. Meanwhile, our opponents are well organized, determined, and do a much better job of keeping their internal strategic differences to themselves. Perhaps this is part of the reason they keep kicking our butts all over town. Jonah ** THE FIGHT FOR FREE SPEECH ONLINE CONTINUES TO THE SUPREME COURT ** It's not too late to be a part of history -- Join the Lawsuit <http://www.cdt.org/ciec> -- <ciec-info(a)cdt.org> -- Jonah Seiger, Policy Analyst Center for Democracy and Technology <jseiger(a)cdt.org> 1634 Eye Street NW, Suite 1100 Washington, DC 20006 PGP Key via finger (v) +1.202.637.9800 http://www.cdt.org/ (f) +1.202.637.0968 http://www.cdt.org/homes/jseiger/

1 0

Re: Hackers invade DOJ web site
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:35 PM 8/20/96 -0700, some anonym remailer user wrote: >All webservers (except maybe Spinner?) are riddled with buffer overrun >bugs and other similar security holes. If you run a webserver, you >should basically assume that anyone who really wants a shell on your >machine can get one. Grab your favorite webserver and grep for >sprintf. Fred Cohen put out an 80-line-C GET-only HTTP server which is short enough to verify that it doesn't have security bugs like memory leaks, etc. It's not blazingly fast, and all it does is server pages, but it's clean. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

Re:Edited Edupage, 18 Aug 1996 [SATELLITES]
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:35 AM 8/21/96 -0800, mccoy(a)communities.com (Jim McCoy) wrote: >You want to avoid moving parts like the plague in orbit. They eventually >wear out or fail and once that happens you have a very expensive piece of >junk in orbit. Solid-state storage is the _only_ way to go if you want to >avoid things like neding to pressurize the drive (eliminating any cost >advantage over solid-state.) Why do you need to pressurize the drive? Most hard disk drives for the last N years have been airtight sealed containers, haven't they? (Removables are different, of course.) I'd worry far more about the stresses of launch bothering the drives. > Its not like you can go up to swap a dead drive > out you know... You do obviously want RAID and/or mirrored drives. > Solid-state Most government space computer equipment has expensive RAD-hardended RAM; it's much cheaper and probably more effective to just use conventional RAM with ECC and shield it a bit. At least at one time, the most powerful computer on the Space Shuttle was the Compaq 386/25 laptop that one of the astronauts brought along for some non-mission-critical work; most of the built-in computers were 1 MIPS or less. >The big problem is that no one has data that is worth protecting enough to >make such a venture pay off. Yup. Ego would be a good motivation, if you know somebody with enough spare cash :-) While it would be nice to have satellites around all the time, even one or two smallsats could provide services on a several-times-daily basis which would be enough to do private email. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

[noise] Re: Cypherpunk voting - ITAR or CDA
by Alan Olsen 17 Dec '03

17 Dec '03

Jim Ray wrote: >If the Republican candidate had been Forbes, there might have been a "don't >let the great be the enemy of the good" argument against voting >Libertarian. If Forbes was the current Republican canidate, the nation would be spending itself into debt dealing with all of the therapy bills resulting from their childrens minds being irreversably damaged from looking at the Forbe's smile on the news every night. Forbes looks to me like H.P. Lovecraft tried to design a cannidate. What Eldrich bargains has he made to get to any sort of public acceptance with a smile like that? > As it stands now, Dole is, at best, arguably the "lesser of 2 >evils," which still comes out evil in my book. As the designated partisan >Libertarian on the list, I urge all cypherpunks to vote their consciences >and pick Harry Browne and Jo Jorgensen. The mere fact that the media is >[grudgingly] covering us suggests we are finally doing something right, and >Harry is winning many Internet polls despite much fawning, hopeful coverage >for the big-eared billionaire hypocrite stealth-candidate, who has no >position but certainly would enjoy having the TLAs investigate his enemies. I have seen little to no coverage of the Libretarians this (or any) year. And even less coverage than usual now that they have a canidate who is even worth voting for. (I guess I won't vote for Pat Paulsen after all...) As for the Perotbots... Maybe someone should tell them what "perot" means in French. >I fully accept that it is likely Dole or Clinton will win, but I think it >will fill an important cypherpunk goal if the Libertarian Party candidates >get a vote large enough to be the margin of victory, and I will be very >proud of my vote, no matter who wins this election. Vote your consciences >for your own sake, and the sake of the children who will inherit the debt >of the irresponsible statists in power now. And if Dole wins and dies in office, they could just pickle him and no one would notice. It would not be the first time we had a dill-dole running the country. --- | "Remember: You can't have BSDM without BSD. - alan(a)ctrl-alt-del.com "| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Microsoft Explorer security hole (fwd) MSoft's reply...
by bf578＠scn.org 17 Dec '03

17 Dec '03

Date: Thu, 22 Aug 1996 15:49:33 -0700 From: Thomas Reardon <thomasre(a)MICROSOFT.com> Subject: Re: Internet Explorer security problem (Felten, RISKS-18.36) >We have discovered a security flaw in the current version (3.0) of >Microsoft's Internet Explorer browser running under Windows 95. An >attacker could exploit the flaw to run any DOS command on the machine >of an Explorer user who visits the attacker's page. We now post the virus warning dialog on local files (file: urls). We have always posted it on remote files (http: urls). Note that the root of the problem is not Java or the browser, but in macro-enabled applications. IE3 has a mechanism to warn users about safety of documents when used with common macro-enabled applications. We are have updated Microsoft Word such that by default it will not run macros embedded in documents. -Thomas > > > >---------- Forwarded message ---------- >Date: Mon, 26 Aug 1996 01:35:07 GMT >Subject: Microsoft Explorer security hole (fwd) > >On Sun, 25 Aug 1996 13:55:30 -0600 (MDT), Carl Nation ><carl(a)iserver.com> wrote: > >To our Resellers/Customers, > >Our sysadmin received this security alert, and we thought we should >pass it along... > >------- Forwarded Message > >Date: Wed, 21 Aug 1996 13:12:59 -0400 >From: felten(a)CS.Princeton.EDU (Ed Felten) >Subject: Internet Explorer Security Problem > >We have discovered a security flaw in the current version (3.0) of >Microsoft's Internet Explorer browser running under Windows 95. An >attacker could exploit the flaw to run any DOS command on the machine of >an Explorer user who visits the attacker's page. For example, the >attacker could read, modify, or delete the victim's files, or insert a >virus or backdoor entrance into the victim's machine. We have verified >our discovery by creating a Web page that deletes a file on the machine of >any Explorer user who visits the page. > >The core of the attack is a technique for delivering a document to the >victim's browser while bypassing the security checks that would >normally be applied to the document. If the document is, for example, a >Microsoft Word template, it could contain a macro that executes any DOS >command. > >Normally, before Explorer downloads a dangerous file like a Word >document, it displays a dialog box warning that the file might contain a >virus or other dangerous content, and asking the user whether to abort the >download or to proceed with the download anyway. This gives the user a >chance to avoid the risk of a malicious document. However, our technique >allows an attacker to deliver a document without triggering the dialog >box. > >Microsoft has been notified and they are working on fixing the >problem. Until a remedy is widely available, we will not disclose further >details about the flaw. > >For more information, contact Ed Felten at felten(a)cs.princeton.edu or >609-258-5906. > >Dirk Balfanz and Ed Felten >Dept. of Computer Science, Princeton University >http://www.cs.princeton.edu/sip/ > >------- End of Forwarded Message > > > > > -- ------------------------------------------ There are no facts, only interpretations. I always wanted to be somebody,

1 0