December 2003 - cypherpunks-legacy

Re: ISODE Consortium X.509 Certification system
by Carl Ellison 17 Dec '03

17 Dec '03

Bill, thanks for forwarding this to me. It really bothers me whenever I see someone mouthing plattitudes about certificates, like: >The ITU-T, through X.509, recommend strong authentication based on public >key cryptosystems as the basis for providing secure services. The ISODE >Consortium uses X.509 as the core of its security strategy. >X.509 provides a flexible, scaleable and manageable algorithm-independent >authentication infrastructure, which can be used as the basis for a wide >range of security services such as message encryption and access control. Fact is, identity certification (which is what X.509 gives) is neither necessary nor sufficient for providing secure services -- and there's nothing magic about X.509. There are marketeers, however, who want the world to believe that the generation and use of X.509 certs will somehow give you security -- so they can sell machinery or a service which makes those certs. - Carl P.S. My USENIX paper giving the case against certification authorities is on-line now at <ftp://ftp.clark.net/pub/cme/usenix.ps> = <http://www.clark.net/pub/cme/usenix.ps> +------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP 2.6.2: 61 E2 DE 7F CB 9D 79 84 E9 C8 04 8B A6 32 21 A2 | +-Officer, officer, arrest that man. He's whistling a dirty song.--+

2 1

Re: Bubba Bottoming out on Cocaine Paranoia?
by attila 17 Dec '03

17 Dec '03

In <v03007808ae5dadc0f80f(a)[207.79.65.35]>, on 09/12/96 at 08:16 AM, Chip Mefford <cmefford(a)avwashington.com> said: = > 2. the rewrite of history to reflect not only the = > politically correct views, but to reflect history as = > the elite wish to see it --even to the point of rewriting = > quotations of Thomas Jefferson to suit their purpose. = > = Can you give a clear example of this?? = Just asking the most blatant one was the rewording of Jefferson's words for the equality of all men about two years ago. As we know, Jefferson was all for freedom, and had a "God bless you, you're a slave" attitude, but he was clearly not for the equalization. when that one came out of washington, several papers had a hard time with it, but I have seen it since. I have been collecting Jefferson quotes for years; frankly, I always considered the Dems were off base: Jefferson was the Republican --leaving Hamilton and his Federalists as pawns pawns of the Illuminati as advocates of the independent Federal Bank (the worst of the Rothschilds (Maurice, I think) who made the statements regarding control of the government by control of the money was in his prime around 1800). I am not a dedicated Jeffersonian scholar, but he has been the corner stone of my (now long blown) faith in our government. I would a complete set of Jefferson's works --if, and only, if I could find a good edition published over a 100 years ago. secondly, Jefferson is now interpreted as being the great enfranchiser, which is not even close to his view. Jefferson's writings clearly emphasize that the electorate should be comprised of the landed and merchant class; secondly, it was Jefferson's statement that the electorate, and therefore the juries should be composed "...of a well educated and informed citizenry." Jefferson was interested in an electorate which was of substance and possessing of a stake in America. One of the clear principles of Jeffersonian thought was that jury, beyond the requirement of guilt beyond a reasonable doubt, was to _vote its conscience_. Jefferson was responsible for including the constitutional language which makes this possible, even today, despite instructions from judges who could care less about the intent of the constitution and are treating the accused as nothing more than cattle on the way to the abattoir --if they are not guilty this time they will be next time, so why waste further time --sometimes known as "collateral damage." = > Why has it gone this far? because Joe-Six-Pack will sell = > all his freedom in return for the promised security. who is = > the Judas goat? the captive press. = > = Actually, being a "Joe six pack" my own damn self, I'd have to say = that this is simply not the case. It is Joe six pack who makes up the = body of the NRA and most other freedom watch dog organizations. = Just for yer information, the pendulem has been swinging very much = the other way, with 36 or 37 states recently following Floridas lead = on concealed weapons carries. Not only that, but even NPR has even = admitted that it has been effective. Agreed on the restoration of concealed weapons rights which had been regulated out of existence. Granted, Joe-Six-Pack may not be the perfect analogy, but I refer to America's working class, blue collar and the grunts of the white collars as Joe-Six-Pack --maybe I should say Joe-Couch-Potato. the class" referenced is a collection of many levels --what they have in common is they work and then confrom to the current norm of 7.2 hrs/day in front of the tube which becomes their entire source of information --THEY will sell out from ignorance. If you refer to Joe-Six-Pack as the the classic Southern red neck, any attempt to limit their freedom, particularly the right to a pickup truck with a gun rack, and their handguns --that's a very different situation. and that extends to small town westerners, like myself, and to the plains. I grew up on a farm, went to Harvard, joined the spooks for six years of a bloodpath, bounced around the world in different fields, and I am back in a very small community in the high desert: 100 families. Noone around here questions my bad attitude --the admissions requirements are at least 5 kids and 2000 rounds. However, I think Joe-Six-Pack, in this constrained social set, for the vast majority would sell out on freedom of cryptography. they do not understand it, particularly against the onslaught of the pinko-liberal captive media. Our job is to educate them --and not with defiant rhetoric (such as mine). As for concealed weapons permits, bank robberies should certainly drop --all it would take is one cowboy (and I'll volunteer) and anything other than a large coordinated operation is in serious trouble. One unsuspected, mean and surly patron with a .357 who seriously knows how and when to use same is very effective. On the other hand, I do not recommend carrying an assault rifle on a sling over your shoulder to visit the bank.... The simple (I think) point I was trying to make was: the vast majority of our U.S. citizens would acquiesce to the deployment of federal troops in return for security, rather than being armed, Posse Comitas not withstanding, to wipe crime off the streets. The point could even be made: the troops might as well be doing something useful rather than sitting around their bases; we do have a rather large standing army --unfortunately, they would become poorly trained and poorly disciplined --and could easily be part of the massive corruption in our cities (and every other government over many people). Frankly, we should all vote in a _free_ cyberspace; forget the current system of choosing party loyalists and presidential electors. The application of a military mentality on the streets is not my idea of law and order --they could kill off the majority of the crime by legalizing all drugs and dispensing them in clinics. Britain reduced their second story (burglary) crime rate by over 60%; they did find they had a great many more addicts than the thought, however. A second benefit is that it takes some of the mystery and challenge out of drugs --however, be prepared for the alcohol problem, although that effect would be significantly less than the current social cost of having 10% of the male black population in lockdown. no, my bottome line is the Bubba has sunk to bottom with paranoia, both he and the elite money interests which jerk all of the politicial habituites who depend on their soft money for their campaings and who wish to participate at the trough of influence and greed (ever see someone retired after many years in Washington without a bundle). --attila -- one of the few things we all share: the utter, corrosive contempt for our elected officials.

2 1

Getting the word "GAK" into common usage
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Thu Sep 12 11:20:55 1996 cypherpunks: As most of you know, I have been trying to bring "our" word, "GAK" into common usage, as opposed to the "key-escrow" Newspeak proposed by some (unnamed) big-government bureaucrat, and unfortunately adopted in most discussions of cryptography policy, (especially those outside this forum) in spite of the true English meaning of the word "escrow." There is a resource called "Infomania," which you can learn about by sending a blank message with the subject "help" to <infobot(a)infomania.com>. The service provides, via email, services that are normally only available to people who have real internet acess (ie, "WHOIS,") but there is also a heavy bias toward humor. Sending it the subject "GEEK," for example, returns the current version of the Code of the Geeks. Sending the subject CHEF with some dry, boring text (such as this message) in the message body returns you a truly hilarious transmogrification. :) Anyway, I have been in contact with Jason Fesler, who administers the site for Infomania [a firm which produces film separations for commercial grade printers and which provides this free service] about putting in a new command, "GAK," which will return to senders whatever the current U.S. govt. "key-escrow" Newspeak bigbrother anti-privacy proposal(s) is/are. (ie. clipper1, clipper2, son of clipper etc.). He has agreed that if we can supply a script or url or gopher page or something of that sort to interface it to, and a person to maintain it whenever the policy changes yet again (the hard part) he will do it. I would, of course, expect a bit of cypherpunkly commentary to accompany the text. Perhaps this information already exists (likely it does) on some page, and if you know where and think it is stable and well-updated, please email me privately, and I will try to put the owner of the site in touch with Jason. I am Bccing him with this message. Thanks for your help. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "As govt.s grow arithmetically, corruption grows exponentially." -- Ray's Law of official corruption. Defeat the Duopoly! Stop the Browne out. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMjgqXW1lp8bpvW01AQF49wP8Ci8D9blF898dNaFsKesX311qT2MO88zr xM11xZ0g1Ui4ahv3yB4jo6qqv4Z9InjNpiOk6wxcsXUPPtn6UNCBOTdos/DCk/SO SSOupiLA48gBHfoCIMN2f/+hGGM4BcuYC5wQ9rgJrTeiY8nQX18hJxKDxujn7z0A pbvTrSRQozY= =rA5a -----END PGP SIGNATURE-----

2 1

PANIX.COM down: denial of service attack
by #6 17 Dec '03

17 Dec '03

WSJ 9/12/96 Paraphrasing: Panix has been under attack for the last week by someone flooding their server with bogus "requests for information" [see below] ... The attack(s): * "Have rendered almost defenseless the small NY company" * "...began late Friday afternoon ... were still continung yesterday" * have targeted "computers that control WWW pages, store e-mail, and still others that link Internet addresses to Panix subscribers." "The hacker [sic] has been sending up to 150 requests a second to Panix's computers, seeking to establish a connection ... the requests, presumably generated by a malicious computer program, contain fake Internet addresses, which the computer must sort out before they can discard them. The computers have choked under the deluge." "As to who might be targeting Panix, the firm's Mr. Rosen speculated it could be someone upset by the fact that the site hosts, free, the Web site for Voters Telecommunication Watch...."

1 0

Re: Child Porn as Thoughtcrime
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Rick Smith wrote: > : ...the "little girls in leotards" case was only a few years ago, etc.) > > Don't know about that one. Is it illegal for little girls to be > photographed in leotards now? "Nutcracker" is X rated? Move over, > Bambi. But this proves precisely Tim's original point, that child pornography is a thoughtcrime. Here's a working definition of child pornography at the end of the millenium: it's a picture of a child, in the hands of a pedophile. Pictures of girls in leotarfds are not child pornography per se, but if you think evil thoughts while watching them, then they become child pornography. What got Stephen Knox in trouble was leaving so much evidence that he was thinking those evil thoughts.

1 0

Re: Nonsense, absolute nonsense... [Fwd: HipCrime and Spam]
by Admin 17 Dec '03

17 Dec '03

At 09:34 PM 9/11/96 -0400, you wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >On Wed, 11 Sep 1996, Admin wrote: > >> >This is an absurd and inaccurate analogy. The mailBot simply pushes >> >*mailto:* tags that people have willingly placed on their public websites. >> >They invite the mail so a more accurate analogy would be that City Hall puts >> >up a public suggestion box and invites comments. The bot then puts one, and >> >only one, unsigned anonymous suggestion into the box. It then goes on to the > >You're sending out messages, inviting people to visit your web site, but >you're using anonymous remailers because... you don't want people to know >who you are? Perhaps he's sending out through the remailers...because he can. Its open to the public. Or perhaps he's trying to get the word out about remailers also, or perhaps no one but he knows why, and why is unimportant. You can always make your remailers a private, pay per use club. Then you could control all the *whys* *whens* and *hows*. >Then why invite them to your site (or even have a site)? It's >like if I sent out postcards to people with no return address saying, >"Please stop by 1313 Mockingbird Lane for snacks and refreshments. Signed, >A Friend". (Note, this is not my real address.) >Only in this case the >postcards don't have any stamps so the people who receive them have to pay >the postage. Which is precisely what you're doing: Sending someone e-mail >costs them time and it often costs them money. These people have invited the email, and the associated expense, by placing a public email-to: button on their public www page. A more acurate analogy, and to the point, would be if a business sends you a postage pre-paid business reply card, that is blank, and invites your comments on the card. They can hardly complain of the expense when people actually send it in, even if they don't like the comments. >Sending it through an >anonymous remailer accomplishes four things: 1) People can't complain to >you to stop sending them mail. Seems anyone who followed the link can complain to the appropriate source. >2) It costs us, the International Secret >Cabal of Anonymous Remailer Operators, time and money for no good reason, >because you are sending anonymous mail and not making yourself anonymous. Didn't see any disclaimers on the remailers requiring a *good reason* to use them. Who would be this Judge of Sufficiently Good Reason? Perhaps you can write an AI piece that can auto-detect good reason from *no good reason*... >3) You're pissing off a bunch of people, and the only ones they can take >their frustrations out on or complain to is us. What is the ratio of *pissed off people* to not pissed off people. Likely less than 0.5% based on how many messages the Cpunks claim went out in a day. >4) It's giving us a bad >rap, man, and that's the *last* thing the remailer net needs now. The saying goes...There is Heat in the Kitchen... > >I could care less about your little applet, or what you have to say; in >the words of Thomas Jefferson, "it neither breaks my leg nor picks my >pocket." Until, that is, you start sending it through my remailer, and >*then* you start picking my pocket. >The remailers of the world don't exist >to provide non-anonymous anonymous advertising, which you could do just as >well on your own sending forged e-mail headers from netcom. Now now... forgery is a no-no. And someone always has the freedom to give up their anonymity whenever they choose. > >Andy Dustman / Computational Center for Molecular Structure and Design / UGA >===== For PGP public key: finger andy(a)neptune.chem.uga.edu | pgp -fka ===== >Sure, the Telecomm Act will create jobs: 100,000 new thought-cops on the net >http://charon.chem.uga.edu/~andy mailto:andy@CCMSD.chem.uga.edu <}+++< <>________________Lowest_Priced_Long_Distance__________________<> ||Long Distance 9.9¢/min |Helping hardworking people || ||9.9¢ Anytime, Anywhere in US! |like yourself pay the || ||Free sign-up, 6 second billing |lowest possible price for || ||http://www.superhot.com/phone |high quality LD service. || <>-----------------------1_303_692_5190------------------------<>

2 1

Re: PANIX.COM down: denial of service attack
by Duncan Frissell 17 Dec '03

17 Dec '03

At 09:09 AM 9/12/96 -0700, #6 wrote: >WSJ 9/12/96 > >Paraphrasing: > >Panix has been under attack for the last week by someone flooding >their server with bogus "requests for information" [see below] ... Even though service has suffered, Panix is still useable. Until I read the MOTDs on Tuesday, I thought it was just normal flakiness. DCF

1 0

Fear of Flying -- from HotWired
by declan＠well.com 17 Dec '03

17 Dec '03

http://www.hotwired.com/netizen/96/37/special3a.html 12 September 96 HotWired, The Netizen Fear of Flying by Declan McCullagh (declan(a)well.com) Washington, DC, 11 September John Gilmore, co-founder of the Electronic Frontier Foundation, knows firsthand how drastically airports in the United States are altering their policies in response to the nation's perceived vulnerability to terrorists. When Gilmore opened his laptop for inspection by airport personnel at San Francisco International last month - as requested - but refused to turn the machine on, the cops were called. When he then refused to show identification to airport police, "they put the handcuffs on me and hauled me off," he told The Netizen. The cops took Gilmore to a back-room office. "They tried to ask me questions. I said I wanted to speak to my lawyer. They kept asking me questions anyway," he says. Airport police arrested Gilmore even though, according to the FAA, "there is currently no prohibition against allowing someone on an aircraft" without identification. Gilmore's arrest came after President Clinton tightened airport security in response to the TWA Flight 800 disaster and the Atlanta Olympic Games bombing. Now the anti-terrorism drumbeat in the nation's capital is starting again, and it's louder and more ominous than ever. It reached a fevered pitch Monday, when Clinton called for an increase of more than one billion dollars to be spent on anti-terrorism measures, especially airport security. Clinton based his request on the unsurprising recommendations of a commission created by executive order in August, staffed by spooks and headed by Vice President Gore. The group's proposal includes a plan allowing the CIA and FBI to "develop a system" to screen passengers who fit certain profiles as potential terrorists. David Sobel, a lawyer with the Electronic Privacy Information Center, called the White House proposal "a realization of Big Brother concerns people have about computer technology." The proposal would allow the FBI and CIA to couple their databases with those of the airlines. "There are going to be massive databases that will track our actions and activities. If you think of increased capabilities to collect information, it's even scarier," Sobel said. A former US senator agrees. At a Cato Institute terrorism conference yesterday, Malcolm Wallop said: "In the year and a half since the terrorism debate began, all the legislation considered would do little or nothing to stop or deter terrorism. These measures do more to crack down on Americans than terrorists. "A bloody nose does not warrant an exponential expansion of federal government authority," argued Wallop, now the chairman of the Frontiers of Freedom Institute. Over lunch at the conference yesterday afternoon, former CIA director James Woolsey responded with some seemingly gratuitous anti-Net rhetoric. Terrorists may use biological weapons like anthrax, he said. "Anthrax is colorless, odorless, and has a 90 percent lethality. One gram has 100 million lethal doses." Then Woolsey delivered the zinger: "The knowledge of how to make anthrax is widely available, including on the Internet." Not content to let bad enough alone, Woolsey added that the government can't allow netizens to use data-scrambling software like Pretty Good Privacy that the spooks can't break. He said the threat of terrorism will "require us to have a key escrow system" where keys "for complex algorithms [will] be placed in such a way that the government" will have access to them. "You can accommodate industry a lot, but the principle is: you got to get to the key," Woolsey said. (FBI director Louis Freeh made similar, though less straightforward, comments during Senate hearings in July.) Before Congress adjourns for the fall recess, the House must decide whether to approve a "digital telephony" domestic wiretapping slush fund into which the NSA and CIA can pour cash. Senators will then likely add provisions for warrantless wiretaps to the anti-terrorism bill that the House sent to them in August. The fundamental problem here is, of course, the politics of terrorism. Legislators routinely grandstand atop national tragedies, using victims and their families as backdrops. Justice Department lobbyists then swarm onto Capitol Hill and demand reduced civil liberties in the name of fighting terrorism. Societies can, and should, safeguard against systematic threats. Random acts of violence, on the other hand, are trickier to forestall - and terrorist acts are anything but predictable. Luckily for the EFF's Gilmore, he was cited only for the crime of "delaying/obstructing a peace officer" and was released after being handcuffed to a bench and then dumped in a holding cell for a few hours. He got off easy. But if Congress decides to sacrifice freedom for security, the country will ultimately enjoy neither. ###

1 0

(Correction) Child Porn as Thoughtcrime
by Rick Smith 17 Dec '03

17 Dec '03

I wrote: : I've read in several places that the Jock Sturges case was thrown out : Nobody has dragged me away in shackles for : owning "Radiant Images." Correction -- That's "Radiant Identities." Rick.

1 0

Re: PANIX.COM down: denial of service attack
by Duncan Frissell 17 Dec '03

17 Dec '03

Here are the gory details from the first MOTD last Saturday: The attacker is forging random source addresses on his packets, so there is no way to find his/her location. There is also no way to screen out those packets with a simple router filter. This is probably the most deadly type of denial-of-service attack possible. There is no easy or quick way of dealing with it. If it continues into Saturday we will start working on kernel modifications to try to absorb the damage (since there's absolutely no way to avoid it). This however will not be an easy job and it could take days to get done (and get done right). For those who are IP hackers, the problem is that we're being flooded with SYNs from random IP addresses on our smtp ports. We are getting on average 150 packets per second (50 per host). We are not the only site being attacked in this way. I know of one other site that is being attacked in an identical manner right now, and I know of three others that have been attacked in the last two weeks. I hope that this means that the attacker is merely playing malicious games, and will soon tire of molesting our site. If that is the case, mail will come back up as soon as the attack ends. But if the attacker is really interested in damaging Panix specifically, the attack may *never* stop and service won't be restored until we can write kernel modifications. Since then the packet streams have hit almost all the ports for news, www, telnet, etc. DCF

3 4