December 2003 - cypherpunks-legacy

AFDA Web Site
by AFDA2＠aol.com 17 Dec '03

17 Dec '03

MEMORANDUM SUBJECT: AFDA Web site, located at: http://www.afda.org In September, the Web site for the Association of Federal Defense Attorneys (AFDA) will become password-protected for members only. Those of you who have paid your membership dues for 1996 will be receiving an email message containing a User ID and Password, which will be good through December 31, 1997 -- almost a year and a half of unlimited usage for the small membership fee that allows the association to continue financing the cost of maintaining and upgrading the web site. Once the member password system goes into effect in September, the online Library will be stocked with research memos in many areas of federal criminal litigation (including topics in white collar / corporate criminal litigation), along with sample briefs and an expanded collection of court opinions and government agency documents, all of which can be downloaded to your hard drive. At present, the library has all criminal law-related Supreme Court opinions, key U.S. Sentencing Commission documents (including the 1995 guidelines), and over 60 operations memoranda of the Bureau of Prisons. In addition, the online Newsletter will be expanded to add a separate section for white collar / corporate criminal defense. Please note that upon installing the member-password system, the Message Board on the web site will provide members with a private resource for discussing strategies and issues with other colleagues, without feeling exposed to the general web population. We hope you will take advantage of this opportunity and put the message board to good use. Any of you who have not yet joined the association may do so easily by clicking the "Join AFDA" bar at the top of the home page and completing the membership form. Please feel free to complete the "Feedback" form on the web site so that we can continue to receive your comments and suggestions, a number of which have already been incorporated into the site. Please remember that this web site exists to serve the educational needs of the federal criminal defense bar, so the association counts on you to join and give us your views on how the site can continue to serve specific needs and interests of the defense bar. All email inquiries should be addressed to: AFDA2(a)AOL.com Best regards to all, and thanks again for your support. Marc S. Sanders (System Operator / Webmaster)

1 0

Re: File System Encryption
by The Drifter 17 Dec '03

17 Dec '03

On Wed, 28 Aug 1996 02:55:20 +0400, Wayne Clerke <wclerke(a)emirates.net.ae> wrote: >Tried secdev? Edgar Swank (author of secdrv) recently posted >that secdev (note, not secdrv) does, in fact, uses 32 bit disk >access with win95. Win95 reports that the secure device is in >compatibility mode, but the host disk (and therefore the secure >volume file) is being accessed in 32 bit (disk) mode. Not sure >what issues there are with '32 bit FILE access' mode here. > >Sounds worth a try though. Please post the results if >you try this. > I have actually had Secure File System, Secure Drive, and Secure Device all installed with mounted volumes at the same time under Win95. However, 32bit file access is not the problem. When you load a TSR in Win95, the operating system forces you into 16bit DOS compatability mode. I'm not a kernal guru so I can't explain all the specifics, but it basically makes 95 act as Win-3.11 and looses multithreading (as it were) and creates serious memory paging problems if you have >32mb installed. Thanks for the reply though .. and if you need assitance with getting SECDEV working under 95, just drop me a note. Drifter

1 0

(Fwd) Re: The POUCH
by Omegaman 17 Dec '03

17 Dec '03

After reading Mr. Holt's announcement and the subsequent replies on the list I decided to send him a polite off-list reply. In it I briefly reiterated the argument that knowing how a lock mechanism work does not make the lock insecure; furthermore, it makes it more secure. I then stated, in all caps, that not knowing the algorhythm is inherently insecure. I stated that he should not be surprised when encryption activists bristle at the knowingly (or otherwise) techniques which pander to a crypto-ignorant populace. I requested no reply and completed with a few quotes from the "Snake Oil" chapter of the PGP documention. I told him to ask himself if he felt that the marketing techniques he was using fit the profile contained therein. While not the friendliest of e-mails, I was certainly civil and sincerely hoped to prod Mr. Holt to consider these issues and assess his approach. His reply was so rediculous that I decided to post it to the list with my own reply attached. Chuckle at will. ------- Forwarded Message Follows ------- From: Self <Single-user mode> To: "JOHN E. HOLT" <76473.1732(a)CompuServe.COM> Subject: Re: The POUCH Reply-to: omega(a)bigeasy.com Date: Tue, 27 Aug 1996 20:54:21 > You write me using a software package that was ripped off from RSA > that you got free from a bulletin board. What level of trust is that? You really know nothing at all about encryption. At least I KNOW what I'm getting. I know what the RSA algorhythm is. I know it has been tested and studied. Whether or not it was "ripped off" depends on whether or not you're related to RSA data security in some way. It's a copyright issue and has nothing whatsoever to do with the technology itself. All the algorhythms used in the PGP package were written by others; what does that have to do with anything? What does the price of the software have to do with anything? If I spent money on it does that make it any more secure? I would gladly spend money on secure encryption technology. I, for one, would like to be comfortable that it's money well-spent. Your defenses are those of one who has nothing to defend. Crying "libel" and making empty statements such as the above are actions that divert attention from the truth; that your product is most likely worthless crap. Furthermore, you really don't know for yourself whether or not this is true. Happy selling. me ------------------------------------------------------------------ Omegaman <omega(a)bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send E-mail with the "get key" in the "Subject:" field to get my public key -------------------------------------------------------------------

1 0

Edited Edupage, 20 August 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

> From: IN%"educom(a)educom.unc.edu" 21-AUG-1996 02:46:51.91 >To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" >CC: >Subj: Edupage, 20 August 1996 [...] >***************************************************************** >Edupage, 20 August 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >***************************************************************** [...] I am willing to bet that the new domain name organization(s) will also have to implement a policy similar to the below, although some may be more lax on one side or the other. (It occurs to me that ibm.org should not be confusable with ibm.com by any "reasonable person" - or at least any reasonable person with any business making assumptions by what they see on the Net.) >NETWORK SOLUTIONS SEEKS DOMAIN DISPUTE SOLUTIONS >Network Solutions Inc., which August 9 announced another round of revisions >to its Domain Name Dispute Policy, is imposing additional requirements on >the trademark holder who challenges a domain name registrant with trademark >violation. The trademark registration must be identical to the domain name, >and trademark holders must provide NSI a certified copy of its trademark >registration, as well as a copy of a written notification addressed to the >domain registrant of the trademark holder's prior claim. In an attempt to >avoid being named in any more lawsuits, the new NSI policy implements an >interpleader-like procedure, where NSI turns over control of any disputed >domain name to the court and will carry out all court orders without being >named a party to the suit. The new guidelines go into effect Sept. 9, and >text of the revised policy can be found at < http://rs.internic.net >. (BNA >Daily Report for Executives 19 Aug 96 A7) Hopefully, the below is a bit too pessimistic... it appears quite possible to institute more just charges (as per how much the person is burdening the Net) without a crash. (Did AOL's size have anything to do with the length of the shutdown, as opposed to its effects?) >GROWING PAINS ON THE NET >The inadvertent shutdown of America Online a few weeks ago was only the >beginning, say some industry observers, who predict that outages at >overburdened Internet providers will become more common in the future. >"Maybe for the first time in the history of the Internet, the demand is >exceeding the supply that technology can deliver," says the CEO of Advanced >Network & Services. Because flat-rate pricing is the dominant Internet >service provider business model, there is no financial incentive to conserve >the resource, warns the executive VP of Nynex Science & Technology. He >predicts that the Internet eventually will collapse under its own weight, >but will reemerge with "a lot more tollbooths on that highway than there are >now." (Business Week 26 Aug 96 p62) [...] >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by Information Technology Services at the >University of North Carolina at Chapel Hill. >*************************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >George Gershwin (if your name is George Gershwin; otherwise, substitute >your own name). ... To cancel, send a message to: listproc(a)educom.unc.edu >with the message: unsubscribe edupage. (If you have subscription >problems, send mail to manager(a)educom.unc.edu.)

1 0

Re: (NOISE) Re: Free Pronto Secure Offer
by Black Unicorn 17 Dec '03

17 Dec '03

On Tue, 27 Aug 1996, Michael T. Babcock wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > To: unicorn(a)schloss.li, cypherpunks(a)toad.com > Date: Tue Aug 27 17:33:42 1996 > > So would I, however, the assumption that "cypherpunk crypto review > > services" are to be had for nothing is the height of arrogance. > > They've already got a lot of us reviewing it... sorry, it's not arrogance > - -- they were right. Read what I said carefully please. I said the assumption that they are for free is arrogance. Perhaps your services are worth less, that's not really my concern. They may have a wonderful product, but expecting and taking for granted free review by the entire list is still arrogance. > > If you were sincere, you'd thank them with cash. Afterall, you seem > > to suggest that you have a good deal of liquidity eh? > > Actually, they lose $99 each time they give us a free copy of the software > ... Uh, no. Assume a Scoobie Doo Mystery Machine Van is free with your one cent donation to Burger King, or $1.49 with no donation. Query: How much is a Scoobie Doo Mystery Machine Van worth? Query 2: How much has Burger King "lost" if you donate a cent and take the van? Replace "one cent donation to Burger King" with "opportunity cost of reviewing and writing a review of the software." Replace "Scoobie Doo Mystery Machine Van" with "copy of crypto product." Determine the cost of producing one software package. Subtract the opportunity cost of the reviewer from software package. production cost (or market cost if you prefer). Now, revist your statement above. > in case you're not as good in accounting as you think you are in > crypto. Uh, perhaps you better direct your keen and unblurred accounting acumen inward. > I have no idea what your rep. is ... but I know one thing, they're > offering an exchange of valuable software (market value: $99) for valuable > services (crypto-rebel review) The relevance of "market value" in the above paragraph is left as an exercise for the reader, as is the nature of the term "valuable software." > > Uh, the kiss ass paragraphs were the reviewers comments, not your code. > > I aggreed with the reviewers comments, they're mine too ... I've sent many > long E-mails to people I do computer service for endorsing Pronto Secure. Ok, and how much did it cost you in opportunity cost to write a few kiss ass paragraphs about the software? (Hint, it's almost certainly less than $99, and if not, the crypto company is taking you for a ride). > I have lined up 6 people who wish to purchase it. And thousands in this country have bought pet rocks. So? > This is for real pal. Thankfully, I am not your pal. I don't care if it is real or if it is not. The point is that certain marketing and review tactics make a crypto product, regardless of its merit, look like a pile of dung. Offering free copies to write reviews where that offer contains phrases like "a $99 value) is one such tactic. > If you don't like it, get out of the ring. A little dissention upsetting for you? If you don't like it, get off the list. > Some of us want our PGP to be nice and easy like E-mail used to be. I'm not sure why my comments are so clearly, to you, a value judgement about Pronto Secure itself. My comments were directed toward their marketing efforts and tactics. I have since come to believe that the marketing department there has got it on the money now, and understands the way those kind of offers go over with some individuals on the list. I suggest you consider reviewing my original message. Looks to me like you just replied to a reply to a reply. > Message Copyright 1996, Michael T. Babcock > http://www.cyberbeach.net/~mbabcock -- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li

1 0

RE: Discussion: The Digital Commerce Clause [Long] [Was: Re: The Commerce Clause and the Crypto Issue]
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Black Unicorn > >I believe the answer to preserving the purity of digital commerce is to >form it in such a way so as to make regulation impossible, because in my >view the constitution no longer provides citizens with the protection or >freedom to progress. I feel the same way about privacy. All the >constitutional arguments in the world mean little today. A systematic >approach which makes violations of personal rights impossible whether >constitutional or not is the answer. >..................................................... > > >I, like others on the list, have often misunderstood your references to court >cases and other legal stuff as indicators that you were being pessimistic, >discouraging, and presenting obstacles to free-thinking, imaginative ideas. > >The way in which you expressed yourself left out your true inclinations on >the subjects, and it would only be someone who had read a large number of >your posts who would realize what side of the issues you are really on. > >I agree very much with what you say in the above paragraph about the >constitutional arguments [by jove, I think he's got it :>)] So many times >people (especially libertarian types) will present their protests in >reference to constitutional issues. Yet there are some contradictions within >the Constitution, or areas which sound that way, and which are therefore too >easily misconstrued by present thinkers (judges, lawyers, etc.). > >So often the document is referred to like a magic mantra which is going to >take away the ills and boogeymen by waving it in front of their faces. But >the document is not so well read, understood, nor respected by those in >public office. It isn't used as a guide to move towards more self-reliance >rather than less. I have heard from one political potentiate that his >opponent (already in office) had not ever even read it. > >You can't depend upon adherence to the Constitution to create the reality >you're after (although, like a dart-shoot, you can always try and it does, >after all, supply the basics for the established legal procedures and it's >possible to set the fear of it upon government types by setting their feet to >its fire - if you can pay for it). > >(This gives me a sense of deja-vu: I think you and I had a long argument >about this on the list, once.) > > .. >Blanc > > >

2 1

Re: Microsoft Explorer security hole (fwd) MSoft's reply...
by bf578＠scn.org 17 Dec '03

17 Dec '03

Actually I think its thier lack of foreseeing how a produbt can and will be used. Problems throughout thier line of products show this off. Most of thier products are a creation of Microsoft anyway, they've stolen, borrowed, purchased or purchased the company to obtain their products, then added features upon features so they can market the hell out of it to become #1 in market share. Many cases they've taken a reliable product and made it less than reliable. I don't understand why people continue to support Microsoft they way they do! Ponder the thought of Microsoft buying up every web server/broswer company in the first year or two of the WEB? Would it have made it where it is today? Ponder the thought of Micorosft having ultimate control over the IETF >In my experience, one of Microsoft's main problems when it comes to security >has been its developers and program/product managers don't think like "bad >guys" when it comes to design and subsequent exploits and holes. >Unfortunately, the user is the ultimate loser. > >Joel > >BTW - The paranoid side of me wouldn't be surprised to see PC >"espionage-enabled" viruses and trojans within the next few years. Their >main purpose would be to either disable or patch various security features >for later attacks, or directly snatch information off of hard drives and >send it out over the Net. I know of a few lab projects of a similar nature, >that were very easy to implement. > BTW: When is this list/listserver going to convert the reply-to fields to point to cypherpunks(a)toad.com? -- ------------------------------------------ There are no facts, only interpretations. I always wanted to be somebody,

3 2

Nando.Net on Observer, Julf
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Good luck. Overall a positive article, although I've noted one definite goof. I wonder if it would be possible to sue this FBI idiot as well as The Observer? -Allen > Avis > FINN REJECTS INTERNET CHILD PORN CLAIMS __________________________________________________________________________ > Copyright &copy 1996 Nando.net > Copyright &copy 1996 Reuter Information Service > HELSINKI (Aug 26, 1996 10:53 a.m. EDT) - On the eve of a major > conference on child sex abuse, a Finnish Internet specialist on Monday > angrily dismissed allegations in a British newspaper that his system > handled up to 90 percent of child pornography on the Net. [...] > The newspaper reported the charges, by a U.S. policeman and FBI > adviser, in the run-up to an international conference in Stockholm on > the commercial sexual exploitation of children starting on Tuesday. > Finnish police also said they had found no evidence in areas they can > investigate that Helsingius's system is now being used to forward > child pornography on a large scale. > "We are working very closely with the authorities and the child > protection agencies -- I am always encouraging people to report any > incidence of child pornography they see on the Internet to police, so > that they can investigate and act," Helsingius told Reuters by > telephone. > The Observer quoted Toby Tyler, a Federal Bureau of Investigation > adviser on child abuse and pornography, as saying 75-90 percent of the > child pornography he saw on the Internet was forwarded through > Helsingius' system. > Internet remailers are computers which receive and forward messages > with a pseudonym or anonymous source. > There are about five in the world, and they exist to enable anonymous > discussion of sensitive subjects -- for instance by victims of child > abuse, potential suicides or people in politically repressed > societies. Five? Someone's miscounted... > Helsingius said one key reason his system would not be used for > pornorgaphy was that it has built-in capacity limitations which make > it impossible to send large pictures through it -- only small amounts > of text. > "Also the groups where pictures are carried...are not supported in my > server," he said. > It could be possible to compress and chop up picture material for use > through the server but this would involve using "tens or hundreds of > separate messages," he said. > Kai Malmberg, a Helsinki police specialist in Internet affairs, said > he had in the past found child pornography remailed through the server > but it had stopped since police started investigating. > "I've found really no evidence of the Finnish remailer being used for > child pornography," he said. "But we can't -- we don't want to -- > check people's mail. That would be like going into the post office and > opening all the letters. > "I believe that he's quite sincere in trying to protect his server for > people to discuss sensitive issues," he said. > Asked if his system could be used to carry child pornography through > individual e-mail messages, Helsingius said this was possible but not > on a large scale as it does not support e-mail systems which > simultaneously send to many recipients. > But he said it was possible for Internet experts to imitate his > remailer address to make it seem as if messages were coming through > his system. > "In a prevous case roughly a year ago we could find a couple of cases > of child porn," he said. "It was actually posted in the UK to the UK > -- it didn't come to Finland at all but it was being made to look like > it came from my server. Anyone can alter the origination information." > He said all the allegations about his remailer seemed to stem from > Tyler, yet he had been unable to contact him. Tyler was travelling to > the Stockholm conference on Monday and unavailable for comment. > "The fact that he's claiming 90 percent of the child porn goes through > my remailer is pretty far from the truth. There might be the > occasional instance and we are actively working against that," > Helsingius said. > "My reputation has been tarnished all over Europe. We will take legal > action, but we are not quite sure in what country." [...] > Copyright &copy 1996 Nando.net

1 0

Re: Pronto making a comment
by Michael T. Babcock 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: liberty(a)gate.net, cypherpunks(a)toad.com Date: Wed Aug 28 00:17:58 1996 > >-----BEGIN PGP SIGNATURE----- > >Version: 2.6.3i > >Charset: ascii > >Comment: http://www.cyberbeach.net/~mbabcock/PGP/ > > How did you get Pronto to do a comment? > JMR I added a "comment=" in my config.txt ;) ... the old fashionned way. Message Copyright 1996, Michael T. Babcock http://www.cyberbeach.net/~mbabcock Send a message with the subject "Send public key" to receive an automatic reply with my public key. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: ascii Comment: http://www.cyberbeach.net/~mbabcock/PGP/ iQC1AgUBMiPIe9tTCwP6TF2xAQFk4wT/Z4gZo5FW3QbiMKEjcXylL0Q449x2ZvaC pJ+3i/ExfxoDgxgsRTo7b2/Rz0JWn5x8K1TnAABfoRrnDe/wtoBEGekzxh9U69MQ RT0m0leok3ep91QKE2WFdWPXw1WHmOduXD+rCPB4cjQ0yENYdHGMnPzTaLG/Y5t3 8q/sq0G4DA7xGbOqJkwa+ALmhaNMt+VTQIfX02RZC0lIJYhcdLs+mQ== =zMc7 -----END PGP SIGNATURE-----

1 0

The Dangers of Complying with "Registration" Laws
by tcmay＠got.net 17 Dec '03

17 Dec '03

Several years ago, California decided that certain rifles which had previously been sold openly and without restriction were now to be classified as "assault rifles," and owners were to fill out forms and register them. (I don't recall if a fee was involved.) (Some of you readers may, of course, think that such guns are in fact more dangerous than, say, shotguns. This is not so, but this is also beside my point. My point is not to argue that a Colt AR-15 with various cosmetic features (such as "flash suppressor") should not be registered. Indeed, I take it as a given that such registration is in violation of the Second Amendment. Rather, my point is about the dangers of complying with such registration laws.) It turns out that the suckers who voluntarily registered the so-called assault rifles they owned were subjected to _additional_ and _unwarranted_ delays in later purchases. The article below refers to some cases. Not surprisingly, the act of voluntarily registering an "assault rifle" placed one on a computerized list of suspicious citizen-units. (I'm glad I had the presence of mind not to register my Colt AR-15, bought in 1975, and having the "evil features" which the criminals in Congress declared to be evil. Had I done so, I might have been unable to buy the various guns I've bought recently.) Although guns are not the same as crypto, and comparisons of crypto to firearms are flawed, the lesson is that one should NEVER VOLUNTEER! No doubt in 1999, when citizen-units are ordered to voluntarily register their copies of assualt cryptography tools, those who step forward like lambs to the slaughter will find themselves on lists of subversive citizen-units. Yet more of a reason for Stego-PGP. This article appeared in rec.guns: In article <4vssg2$3dh(a)xring.cs.umd.edu>, wd6cmu(a)netcom.com (Eric Williams) wrote: > In a previous post, John C. Woo (jwoo(a)rezn8.com) wrote: > : Eric Williams wrote: > : # I read somewhere (I can look it up if someone cares) that the DOJ is > : # holding up paperwork on purchases by people who have registered their > : # "assault rifle" with the state. Has anyone experienced this? > > : This is starting to sound like a conspiracy. > : I DO happen to own a registered AR-15 here > : in sunny California. > > : I would be interested to know where you discovered > : this tasty tidbit. > > It came from an paper by David Kopel, "Why gun waiting periods threaten > public safety." (Journal on Firearms and Public Policy, V1 #4, summer > '92) He writes: > > About 10% of California's 300,000 "assault weapon" owners have registered > their weapons, as required by law. The group that complied with the > retroactive registration law surely qualifies as a highly law-abiding > set of people. Yet this group of highly law-abiding gun-owners, when > they attempt to buy a new rifle or pistol following California's 15-day > waiting period, find that the California Department of Justice has put a > 1 to 4 month hold on their applications because they are registered > "assault weapon" owners. > > As a cite, he references LA Daily News, March 4, 1991, a letter > to the editor by William Davis under the title "Gun Law Backfires". > The letter was from a law enforcement officer and licensed federal > firearms dealer whose application was put on hold. > -- > Eric Williams | wd6cmu(a)netcom.com | WD6CMU(a)WD6CMU.#NOCAL.CA.USA.NOAM > > "The information superhighway is a revolution that in years to come will > transcend newspapers, radio, and television as an information source. > Therefore, I think this is the time to put some restrictions on it." > -- Sen. James Exon (D-Neb.) We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0