December 2003 - cypherpunks-legacy

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

For the real SSL devotees here are the first three transmissions. Client Hello 16.8 1025->443 seq 00000001 ack 00000001 PSH ACK wind 4096 data 30 80 1C 01 00 02 00 03 00 00 00 10 02 00 80 69 AE 0E F0 FA 2E 01 63 BC 59 AF 0F 1C C1 B1 7B 16.8 443->1025 seq 00000001 ack 0000001F PSH ACK wind 5640 data 590 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 2A 30 82 01 93 02 05 26 FB 85 54 3F 30 0D 06 09 big snip of server hello (of the certificate) CC 1F BC A8 9C D7 47 41 D2 33 27 (cert has ended) 02 00 80 4A E7 13 36 E4 4B F9 BF 79 D2 75 2E 23 48 18 A5 16.9 1025->443 seq 0000001F ack 0000024F PSH ACK wind 4096 data 333 Client Master Key should be here, but instead we get 81 4B 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 30 G E T sp / sp H T T P / 1 . 0 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 2C 20 71 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 82 4C - SSL RECORD 04 - Server Hello 00 - Session ID Hit (no prior session) 01 - Certificate Type 00 - Server Version MSB 02 - Server Verson LSB (ie server version of SSL is 2) 02 2E - Certificate length (mainly snipped) 00 03 - Cipher specs length 00 10 - Connection ID length I think the probability is that the unusual circumstance that causes what seems clear to me as an error is that the cert is signed by a CA other than Verisign. Essentially, however, I do not think it is right for a program to display a locked key regardless of any other issues if the data being transferred is not encrypted.

1 0

Re: Stego Virus
by Robb＠SpeakOut.org 17 Dec '03

17 Dec '03

For a virus (a program) embedded in a .gif file to affect you, it would have to unsteg and then run. Just dont run it it you unsteg it. Robb Hill National Association for Home Care 228 7th Street SE Washington DC 20003 202-547-7424 202-547-9312 fax robb(a)speakout.org

1 0

see you guys later
by robbhill＠southwestpaper.com 17 Dec '03

17 Dec '03

This list used to focus on privacy issues, crypto protocols, algorithms, national crypto policy, etc. I saw the Netscape cracks announced here, I saw squeamish ossifrage here, now I see nothing of the sort. Now I see that people are discussing heckling the pres., black helicopters???. I have heard Phil Zimmerman frequently call Paul Zimmerman. See you guys later. Robb Hill National Association for Home Care 228 7th Street SE Washington DC 20003 202-547-7424 202-547-9312 fax robb(a)speakout.org

2 1

Anti-Racist Laws Stifle Political Liberty
by qut＠netcom.com 17 Dec '03

17 Dec '03

llurch(a)stanford.edu (Rich Graves) writes: > Incidentally, [don't college speech codes] belong in the past > tense? Stanford hardly lifted a finger to defend the Grey > Amendment, which was designed and widely regarded to be the most > carefully tailored speech code around. I don't know of any > universities that have tried to enact a speech code since. The > attempt would be futile. (Background: Grey applied only to > "fighting words" directed at individuals. It was fine, under the > [overturned] Stanford policy [which I voted against], to create a > "hostile environment" by screaming hostile verbiage at nobody in > particular; but you couldn't say the same thing to someone's face.) The mere lack of enforcement of an unjust law does not justify the continued extancy of that law. That very "dead letter" law can be fired up at any time to harass critics of the university's anti-racist administration. Some examples of dangerous dead letter laws: * Abortion Most people presume that abortion is legal in the USA, wrong. Most states make abortion very illegal, our whole abortion freedom as currently exists rests entirely on a few federal court decisions. If the previous Supreme Court decisions are overturned, most states will suddenly start enforcing their fascist anti-abortion laws. * Hate Crime Denmark used to be presumed by racists to be the only country in Europe where racism was legal. Denmark's anti-racist laws were not enforced in ages. Yet, the anti-racist laws sprung into action to persecute Gerhard Lauck, an American Nazi who desired to move to Denmark on the account of a provocateur that his organization would not be harrassed in Denmark. Mr. Lauck was deported to Germany where he was sentenced to four years in prison to the outrage of professional anti-racists of the "moderation" of his punishment for merely speaking in pro-Nazi terms in Germany, where politics that challenge the ruling order is strictly illegal. * Racism In Other Countries Racist politics are explicitly illegal in every "white country" in the world except, so far, the USA. The mere lack of enforcement in many of the countries such as South Africa, Canada, Denmark, Russian Federation, Malaysia, Australia, etc., does not exonerate that country from the charge of censorship as political intrigue. * "We Will Take Power" A lot of fake anti-censorship activists insist they are for free speech in the sense of allowing such political purposes as "we don't like your policies and we want you to change," but desiring to make illegal such political goals as "we don't like your power and we're going to try to take it away from you." Yet there is no purpose, no purpose whatsoever in political speech, if there is no threat allowed to the ruling order expressed in idealogical terms and organizational forms. Thomas Jefferson, Thomas Paine and all the nationalist founders of the American nation would approve of radicals organizing and expressing their goals of seizing power legally, or if denied the means of a republic for succession, illegally. * Unfree Nations Germany is an example of a nation that prohibits any type of Nazi political party. Therefore, Germany is not a free country, not an honest republic, in fact, less free even than Wilhelmian Germany in allowing radical parties to challenge the power structure. -- I marvel at the resilience of the white people. Their best characteristic is their desire to learn. No other people has such an obsession with the intellect.

1 0

Re: MUD anyone?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I second many of the comments about the difficulties in coding a reasonably plausible game or MUD for exploring list ideas. Just about four years ago exactly, at the first meeting of what was to become the Cypherpunks group, we "played" the "Crypto Anarchy Game." Based solely on paper tokens, like Monopoly, the idea was to introduce people to concepts like digital money, anonymous remailers, information markets, and so on. Sealed envelopes represented remailed messages, with "mixing" done by hand. Lots of imperfections, lots of stalls and dead ends, lots of confusion. Protocols were imperfectly enforced, messages got lost (literally "dropped on the floor"), and the game eventually ended in laughter, confusion, and silliness. But it was deemed useful by most present, as it made more real the abstractions talked about in the morning session. Coding nearly any of the core cryptographic concepts for use in an online game, even without a real crypto core (e.g., using other trust mechanisms) is likely to be almost as big a job as actually coding the concepts for real-world use. Could be very educational, and a useful dry run for later real-world reification of concepts, but by no means easy. I'm not trying to discourage anyone. Go for it! But it's a _big_ project. And as Jim Bell noted, there are all sorts of costs which are not properly accounted for. I would not, for example, expect anything interesting to emerge out of the simulation of "assassination politics" in such a game, as the costs, dangers, moral issues, and whatnot are not properly accounted-for in such a MUD-type simulation. (No more so than in a fantasy role-playing game, where characters die routinely...) And as a last note, we had a couple of "hits" bought anonymously back then, during the game, in '92. (Hint: One doesn't need a Bell-style infrastructure for bidding on the death of politicians to raise the money for a hit....many interested parties would surely pay the $5000 (or less, say some) to buy a hit if the risks were lowered. And to paraphrase Bell, "I know a way to lower the risks.") --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A _REALLY_ Interesting Bet [2]
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Jim Gillogly <jim(a)ACM.ORG> wrote: <snip> >Idea Futures is dead, and the torch has passed to Foresight Exchange (FX), >which is at http://www.ideosphere.com/ideosphere/ . You can bet on a number >of political issues (US and other), though not (yet) for real money. IMO, a good cypherpunk goal would be to get that "yet" in, with Chaum's Digicash, before the election. Perhaps Mr. Cate has some ideas in this regard...;) When talking to lawyers one finds the justification for the prohibition to be something like, "it would demean the process." IMNSHO, the nest has already been soiled, and the only effect would be to kill the unwanted phonecalls around suppertime, as I said before. The media would eventually flock to the more-accurate poll, even if it involved the dreaded crass freemarket capitalism of people willingly gambling. <snip> >This doesn't track the polls, which typically ask who the potential voter >would vote for rather than who they think will win the election. Indeed. Also, a prominent candidate (this time) told devotees (last time) to give wrong answers to pollsters when called. While it's still possible, this behavior is much less likely with real money (though with his kinda dough, distortions would be possible for him -- & profitable for others). >Other issues: > >Percentage of popular vote to Dem candidate: 47 >" " Rep " : 44 >" " Other " : 12 > >Note that there may be an opportunity for arbitrage when numbers don't add >up to 100; Last time there was supposedly an arbitrage opportunity between odds in Moscow and those in London [Now THAT'S my kind of bet;) -- I can't lose] according to a W$J article on the subject from years ago. 20 minutes on Alta Vista this morning reveals nothing like this available, Ladbroke's links are hardly there, and I don't know the names of any other bookies in London, or any at all in Moscow. The closest thing was a (braindead) "George" magazine article and a few sites lamenting the lack of possible Presidential gambling. AV didn't even reveal the confusing US university site where some gambling is (or was) going on. Perhaps English c-punks can help us on the odds for all candidates, including the longshots. I think publicity from freeing up this information might be more favorable than publicity about things like porn or Assasination Politics, and the process of setting up a site that reveals the odds in semi-realtime from London/Moscow should not be too difficult, especially if actual gambling is not conducted on the site.

2 1

"Undocumented Features"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:21 AM 8/29/96, Adamsc wrote: >>> >looks like the DoJ have been looking around at the mirrors.. maybe to >>> >legally hassle people about them.... > >>> Or, just maybe, some DoJ employees wanted to see what folks on the outside >>> were doing to tweek their bosses:-)? Reminds me of the *thousands* of hits >>> the "Intel Secrets Page"(http://www.x86.org/) has gotten from users at >>> intel.com > >Out of curiosity, has anyone used a decompiler to check if any of the >undocumented stuff is getting used in shipping programs? This has only marginal relevance to the list, but I'll mention in case it helps a crypto coder out there: be wary of _ever_ using undocumented features of a processor, compiler, or other system. Why? Because "undocumented features" are not promises made by the vendor, and may vanish in the next release (or, worse, change behavior in strange and hard-to-detect ways). We witnessed this several times at Intel with the x86 line. Various customers discovered "undocumented features," made the mistake of exploiting them, and then came crying to us when iterations of the processor (what we call "steppings") took out the "features" or altered their behavior. (And for a while there was even a rift between the Intel versions and the NEC versions, which copied some Intel processors and copied the undocumented features....when Intel was no longer supporting them, the two processor families diverged, causing chaos.) So, beware. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Announce: NCSA HTTPd 1.6b1 and XMosaic 2.6s_b1
by acain＠ncsa.uiuc.edu 17 Dec '03

17 Dec '03

Hiya! This is to announce the availability of NCSA HTTPd version 1.6b1. It is accompanied by a version of XMosaic (2.6s_b1) which can be used for testing the security features. To participate in the beta testing effort, please see http://hoohoo.ncsa.uiuc.edu/beta-1.6/ What's New: ---------- The main difference between 1.6b1 and 1.5.2 is the addition of support for the following security protocols: -- Secure-HTTP (version 1.1) -- SSL versions 2.0 and 3.0 XMosaic 2.6s_b1 supports these protocols as well. Motivation: ---------- We recognize that there are many fine web servers availble on the Internet, some even for free. In releasing NCSA HTTPd 1.6b1, we are niether trying to 'outdo' other server development efforts, nor are we expecting to provide a server which will meet all possible needs. Rather, we wish to follow through on our commitment to making novel features available for experimentation and testing. The capability of performing digital signature-based authentication (via S-HTTP in 1.6b1) is an example of a feature we see lacking in the Web today. Obtaining HTTPd 1.6b1: ----------------------- Currently, HTTPd 1.6b1 is available in binary form to registered, domestic users. An exportable version will be available eventually, and we will announce its availability by the same means. To register for beta testing 1.6b1, please go to the URL given above, and select the "register here" link after reading the page. The documentation (under construction) for this release is available at http://hoohoo.ncsa.uiuc.edu/docs-1.6/ The HyperNews page (good for bug reports, questions, discussion) is at http://union.ncsa.uiuc.edu/HyperNews/get/www/ncsa-httpd/1.6/beta.html Administrative requests may be directed to httpd-beta(a)ncsa.uiuc.edu. Thanks, Adam Cain acain(a)ncsa.uiuc.edu

1 0

RE: Desubscribe
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

perry(a)piermont.com wrote: >MrAdvent(a)aol.com writes: >> I would like you to desubscribe me from you mailing list > >I refuse. > >.pm Lets face it. It's not a lack of volition, it is a lack of ability. Perry couldn't desubscribe MrAdvent(a)aol.com even if he wanted to. I can't unsubscribe myself even when I follow the instructions. When I send an e-mail, the header contains two equivalent addresses: jbugden(a)smtplink.alis.ca and jbugden(a)alis.com. Unfortunately, there is some logic in majordomo that is not symmetric so that while I can subscribe as jbugden(a)alis.com, I can not unsubscribe since majordomo notices jbugden(a)smtplink.alis.ca in the header and treats the attempt to unsubscribe as a forgery. So get used to it MrAdvent. After a few months you may even enjoy the ramblings of the many too pale souls swimming in this communal cesspool. You can unsubscribe any time you like, but you can never leave. James

2 1

Re: MSIE cryptography
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:20 PM 8/29/96 +0000, John Hemming - CEO MarketNet wrote: >Essentially, however, I do not think it is right for a program to display a >locked key regardless of any other issues if the data being transferred >is not encrypted. I fully agree. I wonder if the FTC is interested. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

1 0