December 2003 - cypherpunks-legacy

ADMIN: Problems with the list goto the owner, not the list!
by Hugh Daniel 17 Dec '03

17 Dec '03

In the future please send all messages of the form ~something is wrong with the list~ to owner-cypherpunks(a)toad.com and NOT the list its self. We already have enough off topic and puerile traffic cluttering up the list. If you think you see a _very_ major problem then please do email me directly. Now please get back to building the better world we sometimes still talk about building... ||ugh Daniel Majordomo Owner & Potty Trainer hugh(a)toad.com

2 1

Code Review Guidelines (draft)
by Adam Shostack 17 Dec '03

17 Dec '03

A few weeks back, I posted a request for source code review guidelines. I got about 50 me-toos, but no guidelines. So I wrote some I think are decent. They're still in draft format. I'd appreciate feedback & commentary on them. http://www.homeport.org/~adam/review.html Adam PS: Someone did pay me to do this, but doesn't want their name associated with it, because there are shoulds and musts in it. I have their permission to post the anonymized document. -- "It is seldom that liberty of any kind is lost all at once." -Hume

5 8

The POUCH
by JOHN E. HOLT 17 Dec '03

17 Dec '03

The Pouch uses a 64 x 64 block product cipher, a 1024 bit random initialization vector and the CBC technique. Most experts agree that such an implementation is highly resistant to all forms of cryptographic attack. Hellman and Dilfie rely on knowing the algorithm for their known plain text attacks An unpublished algorithm forces them into reverse engineering the computer programs to learn the algorithm. The POUCH has many roadblocks built in to prevent this. I refer to Cummings, Cryptography and Data Security pages 150 and 98 in this regard. John Holt

6 5

Re: Sen. Leahy's "impeccable cyberspace credentials"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 18:52:40 -0700 (PDT) From: Declan McCullagh <declan(a)eff.org> To: Jonah Seiger <jseiger(a)cdt.org> Cc: shabbir(a)vtw.org, fight-censorship(a)vorlon.mit.edu, brock(a)well.com, telstar(a)wired.com Subject: Re: INFO: Democratic convention chats online! Be there! (8/25/96) Jonah, I had expected some negative feedback from CDT, but I should say I was surprised by the tenor of your response. Unfortunately, you don't address the substance of my criticisms of Leahy: how can you defend Leahy's avowed support for Digital Telephony and the copyright legislation? How do his actions make him a "forceful" and "consistent advocate" with "impeccable cyberspace credentials?" (Hint: They don't. He isn't.) You write that: "Of course we are not going to agree with our friends on every issue." But I disagree with your underlying assumption; if a senator is our "friend," they won't do what Leahy does. Being familiar with technology does not a Net-advocate make -- take Al Gore, for instance, who net-surfs in an Old Executive Office building cluster... If I'm wearing any hat at all right now, it's my cypherpunk one. And that prompts me to say that we'll have more freedom online not by relying on the legislative process, but by deploying pro-freedom technology like anonymous remailers and PGP. We can't rely on an ossified Beltway Bureaucracy to preserve our freedoms. (In fact, we need to shrink the size of the Federal bureaucracy drastically to make it less susceptible to special-interest lobbying and to reduce its ability to encroach upon our civil liberties.) We've argued about this before, of course. I recognize that we have core philosophical disagreements. You want to work the legislative process and compromise, while I believe that some rights can't be negotiated away. I recall you supported White's "Harmful to Minors" CDA compromise that would have created a new and unprecedented category of speech crimes online. (The ACLU's Barry Steinhardt wrote on this list last fall that "no true civil liberties organization" would support such language.) You joined Leahy in supporting the Bennett bill, which would have permitted Equifax to create a national medical database with few privacy safeguards. Not to mention your defense of Leahy's pet Digital Telephony project... You write: "But none of them [members of Congress] are gong to continue reaching out a hand to us if we bark and bite when we don't get 100% of our way." I'm confused by this. Does it mean we shouldn't slam Leahy when he fucks with the Net? More disturbingly, the incorrect and misleading label of "impeccable cyberspace credentials" makes it more difficult to criticize Leahy when he does something (like DT funding or copyright) that harms netizens. I suppose you'd like to champion Leahy as a "Friend of the Net." But I'd rather not ignore his attempts to pass legislation that would hinder the development of the Net and intrude on our privacy. I reiterate my earlier statement: "Leahy is in no way a true friend of the Net; I don't know of any Beltway politican who is." -Declan On Mon, 26 Aug 1996, Jonah Seiger wrote: > Declan: > > What are you thinking?! > > In a world where we have very few real friends, I simply don't understand > what you are trying to accomplish. It's fine (and healthy) to raise > concerns about the particular positions a member of Congress takes (hell, I > don't agree with everything Leahy does), but to simply dismiss Leahy as a > 'no friend of the Net' is naive and counterproductive. > > Look at the record. Leahy is hands down the strongest supporter of the Net > in Congress. Period. No other Member (including our small but growing > handful of other friends like Burns, White, Wyden, Cox, Eshoo, etc) has > been a more forceful or consistent advocate for your causes for as long as > Leahy has. What exactly do you want? Perhaps we should elect you to > Congress and see how well you can do. > > Of course we are not going to agree with our friends on every issue. If > Leahy takes a position you don't like, I'd suggest you talk to his office. > I have found in my experience that Leahy's staff (and him personally) will > take the time to listen when presented with a well presented argument. > > I'm also confused about another thing: which hat were you wearing when you > wrote this? If it is your "advocate" hat I think it must covering your > eyes. If it's your "journalist" hat, you need to do a bit better job of > checking your facts in the future. > > Go a head and reject the "Beltway politicians". It's fashionable, sure, but > what does it really accomplish? Some of them are dangerous. Others are > sympathetic. The fact is that short of armed rebellion they are going to be > here for a while. > I shudder to think of the wrath our opponents could wage if we all threw up > our hands packed up our bags and left town. > > Face the facts. Members of Congress have a lot of constituencies to deal > with, and we are a small and relatively powerless faction. We can do a lot > to change the outcomes of policy debates (if I didn't believe that I > wouldn't be doing what I do everyday), but we have to be realistic, > recognize where we fit in to the process and who are friends are. One > thing's for sure - we have A LOT more enemies than we have friends. > > Most members of Congress don't really understand us or our issues. Many > are willing to learn, and some have been real champions for our causes. > But none of them are gong to continue reaching out a hand to us if we bark > and bite when we don't get 100% of our way. Zealots rarely win (though it > sure is fun to throw bombs). > > Sorry for the public thrashing, but this kind of attitude REALLY gets under > my skin. > > Flames welcome (though response is not guaranteed <g>), > > Jonah // declan(a)eff.org // I do not represent the EFF // declan(a)well.com //

1 0

Scan the Web for Live News, Sports, & Music (Talking E-mail)
by RealAudio Talking E-mail 17 Dec '03

17 Dec '03

-------------------------------------- | Make this e-mail talk! | | Load this URL into your Web browser: | | http://www.realaudio.com/tmh.ram | -------------------------------------- Dear RealAudio Customer, Since you downloaded our free RealAudio Player a while back, you have heard some pretty amazing things on the Web. Now you can hear even more with RealAudio Player Plus, an enhanced version of the RealAudio Player. RealAudio Player Plus has a scan feature that lets you scan the Web for live music, radio, sports, and news. It also has Preset Buttons, like a car radio, that take you straight to your favorite RealAudio sites. Please visit our Web site to find out more: http://www.realaudio.com/tmhplus/index.html We hope you enjoy RealAudio Player Plus, Rob Glaser Bruce Jacobsen Chairman & CEO, President & COO, Progressive Networks Progressive Networks

1 0

cryptocd grabbing material
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Tue Aug 27 09:01:57 1996 If anyone out there knows of anything I should (and am allowed to) put on the cryptocd (check www.rpini.com/crypto/cryptocd.html) let me know. If anyone out there knows of anything I MUSTN'T put on the cryptocd (due to copyright, law or whatsnot), let me know also. Thanks, Remo Pini - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMiKdZhFhy5sz+bTpAQEg9gf9EY+SvhGMW1iKB+2U0JVNs3zDqGPNkYpJ zM9WW2oxTtTWn4znjMTXWEVAbGzmdZCkmgHsN3tFWwkWxIYxXrfFcInPNqCzxcXG DZHcQ2nNkH1MOnQ0Wzp9l9riz8TBCzbZNtJsPoVKMup6qAGLV6ninCrAKBGaQJmY 1KR3yez3OVq04SkRXUjXKQRjwtKH2OWmZfzSormEwphHvjgE0nPJhLB9gnVDevTw lSY3YP2NBPtIlaJbxohkvro8Mm+FGIk2vVoOY6cXwFcpZWONtyiwZPiYQzFfcOzw yjbIzGU8qU5MH58MeS/wZuTVzHhtmRl7lCLYS2xPH73ZpgvUh3ZDsw== =LGSU -----END PGP SIGNATURE-----

1 0

Re: Spamming
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 26 Aug 1996 13:26:04 -0500, John Deters wrote: >>What do cypherpunks think about the following practice or law (I realize >>that it may be impossible to implement): each email message should carry >>a little digicash check for, say, 20 cents. Mail reading programs should >>reject (send back unread) all messages not carrying these digital >>checks, unless the senders are in the "friends list". The MUAs should >>ask users whether they want to "cash" the digital check or not. > >I do not believe it is possible to have a secure executable that exists on >an uncontrolled user's machine. "Tamperproof" encryption chips still >require communications in and out from the user's program. A determined >attacker could continue to use the pieces of their code that talk to the >encryption chip. >Never underestimate the allure of "free money" when you're planning to >give >it away. Methinks you don't understand e-cash. It's not executable, and uses public key crypto to prevent "minting". It uses records to prevent replays. In other words, it'd be like Ed McMahon including a quarter in the envelope. You'd only be able to use it once.... / If you think education is expensive, try ignorance. / Home: Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp / Autoresponder: send email w/subject of "send resume" or "send PGPKEY" / Work: cadams(a)acucobol.com | V.M. (619)515-4894 | (619)689-6579 / Member in good standing of the GNU whirled hors d'oeuvre

1 0

File System Encryption
by drifter＠c2.net 17 Dec '03

17 Dec '03

I'm aware of the three main disk encryption programs SFS, SECDRV, and SECDEV, but I need to find a solution that works with Windows 95 32bit or Windows NT 4.0. I'm currently using SFS 1.17 and Secure Drive under Win-95, but am unable to continue to work in dos compatability mode due to severe performance hits. I am open to commercial products that have passed peer review, but know of none. If anyone could suggest a solution (outside of switching OS's), I would be *most* gratefull. Please respond to the list, as I am a subscriber under another account. The Drifter

6 7

Re: libelous action
by C Matthew Curtin 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "JOHN" == JOHN E HOLT <76473.1732(a)CompuServe.COM> writes: JOHN> Dear Mr. Curtin JOHN> Your statements about myself and my product, The JOHN> POUCH are defamatory. Since they have been made in writing and JOHN> shown to and seen by other parties on the Internet, they JOHN> constitute libel. Please admit to all parties that you have no JOHN> personal knowledge of my product capabilities or my personal JOHN> character or reputation. Failure to do so at once will result JOHN> in legal action against you personally and Megasoft. As my signature said, I speak only for myself. I am not a representative of Megasoft in any official capacity. That which I have posted does not represent the views of Megasoft, its employees, its shareholders, its customers, its business partners, its landlord, its employees' mothers, and is in no way representative of any person living or dead, other than myself. I have no knowledge of JOHN E HOLT <76473.1732(a)CompuServe.COM>. The only knowledge I have of THE POUCH is its web site, found at http://www.flagler.com/security.html On 18 August 1996, I posted to the Cypherpunks mailing list, a note regarding THE POUCH, which included this paragraph: If it is any good, there's no way for us to know. But your marketing of the product has every indication that it's nothing more than smoke and mirrors. To coin a phrase, "pseudocrypto." I, speaking only on behalf of myself, stand by this statement. I do not apologize for my comments. If you, Mr. Holt, feel that this is a personal attack against you, I regret that you've misunderstood the tone and nature of my post. My statement is hardly libelous; I simply observed that if your product is truly secure, there is no means by which security experts can verify such claims. Study of computer security has shown that obscurity (using unpublished algorithms, for example) is not "security." By perpetuating confusion between the two terms, nonexpert users of crypographic software are hard pressed to make good decisions about what they use, and the risks of the software they're using. Hiding the internals of such software, claiming that it is "highly resistant to all known forms of cryptographic attack," is, in my opinion, irresponsible marketing. It is my hope that future marketing endeavors of THE POUCH will be more open and straightforward in its approach to security, providing evidence of a crystal-box architecture, whose security can be more objectively determined by potential customers. Hiding a paper from me by putting it somewhere in New York City is obscurity. If you hide a paper from me by putting it in a safe, and then give me the safe, and the technical documentation of the safe's locking mechanism, and I still can't get the paper, then *that* is security. (And, by the way, I think you'll find insisting that I somehow retract my statements, rather than prove me wrong by showing the quality of your product, will likely further add to the suspicion that the security of THE POUCH cannot be proven.) - -- C Mattew Curtin cmcurtin(a)ee.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Have you encrypted your data today? iQCVAwUBMiJEYRhyYuO2QvP9AQFPmwQAgimf3IhoX4wMPPNk7JY9nlFDJG2K/gO3 Xnd7ygPYAhz4BRaEl6SAaOOWiKjBA1l5EI5GhZdTL0WIWdKQv5MJROElzTVcY7nx Tq1wysgTRTLjt7XQS2FyIa1S7OSvyhJttAslbJjpl+PqCwT18bhr3Oh9Cp2g1LRq sNxdtB1BtQQ= =I28g -----END PGP SIGNATURE-----

3 2

Re: libelous action
by Ross Wright 17 Dec '03

17 Dec '03

Sirs: If I was John E. Holt, I would take a different public relations tack. I would seek positive input, not a negative reaction to criticism. Or I would ignore the critique altogether. Ross Wright On Or About: 26 Aug 96, 22:29, Perry E. Metzger wrote: > demonstrate that. If Mr. Holt would like to sue me, he's invited to. > I'm sure he'll be at least as likely to follow up as Karl Denninger > or "Dr." Fred C. Cohen. > > Perry > > C Matthew Curtin writes: > > JOHN> Dear Mr. Curtin > > JOHN> Your statements about myself and my product, The > > JOHN> POUCH are defamatory. Since they have been made in writing > > and JOHN> shown to and seen by other parties on the Internet, they > > JOHN> constitute libel. Please admit to all parties that you have > > no JOHN> personal knowledge of my product capabilities or my > > personal JOHN> character or reputation. Failure to do so at once > > will result JOHN> in legal action against you personally and > > Megasoft. > [...] > > I, speaking only on behalf of myself, stand by this statement. I > > do not apologize for my comments. If you, Mr. Holt, feel that this > > is a personal attack against you, I regret that you've > > misunderstood the tone and nature of my post. My statement is > > hardly libelous; I simply observed that if your product is truly > > secure, there is no means by which security experts can verify > > such claims. >

1 0