December 2003 - cypherpunks-legacy

Software manpower exports and the power of governments
by Arun Mehta 17 Dec '03

17 Dec '03

At 13:23 16/08/96 -0700, James A. Donald wrote: >At 10:49 PM 8/14/96 +0600, Arun Mehta wrote: >> I was trying to explain how incomes and prices happened to be >> lower in India, > >That was not an explanation, that was mystic word salad. > >It would be an explanation if wealth mysteriously rained >from the sky, rather than was produced by men. Huh? And why are we so grumpy today? >In fact what gets sent to the Indian campus is largely legacy >work, which is in large part precisely the work that requires >the closest contact with the customer, contact with actual >working conditions, and the like. Not necessarily: as an example of legacy work, consider the conversion of Cobol to 4GL. When you have a working program to emulate, you can do that without too much customer contact. It's in new software (where maybe the customer is herself not clear what she actually needs) that close contact is essential. Take another example: you have some old software, and you need to add a bell or whistle. Sure, you may need to run the modified software on site for testing, but often that too can be done from a remote terminal. And even if you do have to travel for the purpose, it still works out cheaper, since manpower costs are low in the 3rd world. >This seems to be a general practice, not just an Informix practice, for >in an article on "India's silicon valley" I read that the work done in >India was largely done on existing legacy apps, often in obsolete >languages and operating systems. Um, maybe you misread: why would an American company pay to have software written, that only runs on obsolete machines? Now, converting that software to run on a modern machine, that's altogether different -- you have to be able to read Cobol or Autocoder or whatever, but what you actually write would be based on modern tools. >This is of course the work that places the least amount of the >companies intellectual assets in India, and thus the work that >gives the Indian government the least power over Informix and its >activities. Informix could abandon the Indian campus and all >the intellectual assets on which it was working, and all the >physical assets located there, at any moment and not suffer any >serious loss or inconvenience. A sensible business decision: long-distance security is hard to achieve. But I doubt that it has anything to do with the power that the Indian government has (or hasn't) over Informix? >It is overwhelmingly clear that the question is simply who has the >power? Those who wish to hire peoples services in order to produce >wealth, or those who can command peoples services because they have >guns? Are you suggesting that Indian programmers come to work with like a chain gang, with armed government guard? You really must talk to some programmers from India, ask them if the government commands them this way, but do have some oxygen handy, or they might die laughing... >That is what makes most people in some places poor and most people >in some places affluent. Look, governments in the 3rd world are often stupid and corrupt -- no doubt that contributes to poverty, but that isn't the only reason. I'm sure one of the reasons is cultural: modern industrial societies require a high degree of training, discipline, whatever. Western societies needed centuries of misery to learn these, we're trying to do it faster, and hopefully be a bit more humane in the process. >> Could you please be more precise? In what way does the "power of >> the Indian government" intrude? >Presumably the same kind of reasons as caused foreign companies >to flee India the first time around. Other that Coke and IBM, which we already discussed, can you name one other? In the last years, lots of companies have opened shop here, including Coke and IBM. And even these two didn't flee: a new law was passed, they didn't want to comply, so they left or were asked to leave. In the case of Coke, I can understand the government not wanting to spend precious foreign exchange on sugared water in a country where there is a serious shortage of drinking water. Tim made the perfectly valid point that such decisions cost the country in reputation, but the Indian government doesn't mind loss of reputation in matters it firmly believes in, as in the current CTBT discussion. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

2 1

Re: National Socio-Economic Security Need for Encryption Technology Re: National Socio-Economic Security Need for Encryption Technology
by Bart Croughs 17 Dec '03

17 Dec '03

Scott McGuire wrote: > Bart Croughs wrote: > >>You haven't answered this question yet. I don't claim that the U.S. is >>worse off when US capital moves abroad. I only ask: how can you proof >>that the US isn't worse off when US capital moves abroad? >I recall you were interested in how the Austrians would answer this. I >think that they would object to the question because of their aversion to >aggregates. Some individuals are better off and some worse off. The >Austrians would deny that you can sum the results for individuals and get >a result for the economy as a whole. This is because of Austrian >subjectivity. >Assume that I move a programming job to India, and make the required >capital investments. >I am presumably better off (otherwise I wouldn't have moved the capital). >The worker I fire here in the US is worse off. >(Other effects you have mentioned go here). >Now, considering only me and the laid off worker, is this change overall >good or bad? To answer this, you would have to compare the value of my >gain to the value of the workers loss. But you can't. Value is >subjective. And, it only gets harder when you try to take into account >the other people affected. You are absolutely right here. I should have asked: 'how can you prove that *US workers* aren't worse off' instead of 'how can you prove that *the US* isn't worse off'. I abbreviated my question because I had repeated it already so often. My misstake. You seem to be saying that the US workers are worse off when American capital is invested abroad (something that most of the other posters have denied), but that American consumers and investors are better off, and that it's impossible to say what the overall effects on the standard of living of American citizens will be because you can't add and substract values of different people. This sounds reasonable (and indeed very Austrian), and you could be right, though I think there exists a proof that the overall effects on the standard of living of American citizens of investing abroad is positive. See one of my recent posts on the subject. Bart Croughs

1 0

IE3.0 128-bit
by David.K.Merriman＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Aug 17 08:59:05 1996 Just got off of MS IE3 download page. To retrieve the 128-bit version, they've got a perl script asking for a remote address and a host address via a pair of cookies. Unfortunately, it chokes *every single time* it's invoked on my system, and shows me a 1-800 number (terminally busy) to call. Has anyone either managed to download it, or gotten through to the 1-800 number? I'd _really_ like a copy of the 128-bit version. I'm a U.S. citizen, live here in Amarillo, TX. Anyone from MicroSloth reading this *might* want to let a Responsible Person know about the perl script hiccups.... Dave Merriman, Densa's mole in Mensa - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- PGP Email welcome, encouraged, and PREFERRED. Visit my web site at http://www.shellback.com/p/merriman for my PGP key and fingerprint "What is the sound of one hand clapping in a forest with no one there to hear it?" I use Pronto Secure (tm) PGP-fluent Email software for Windows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMhUZZcVrTvyYOzAZAQHqygQAiEe7RmKjZcZ44Ok7Gz6GI1CCebBcdWsc 1lk2AvHJNOsI1ifq+oXbz1IuSbYJFwBOAUgJmwdXh4OMq8TIyX7mJKpR+imlysFC kk1kMtVsdPNbtaLap5LLOMMnw13NxjC4ysae1rKZ/j/8SLXEvmscoDwzO+wtyOyn kYgcgh6n8NQ= =5P41 -----END PGP SIGNATURE-----

1 0

Re: IE3.0 128-bit
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: merriman(a)amaonline.com, cypherpunks(a)toad.com, webmaster(a)microsoft.com Date: Sat Aug 17 09:15:34 1996 My results were have been the same using ie30b2, but Netscape would attampt to download or ask me what app to run the .pl file with. Lou Zirko > To: cypherpunks(a)toad.com > Date: Sat Aug 17 08:59:05 1996 > Just got off of MS IE3 download page. To retrieve the 128-bit version, > they've got a perl script asking for a remote address and a host > address > via a pair of cookies. Unfortunately, it chokes *every single time* > it's > invoked on my system, and shows me a 1-800 number (terminally busy) to > call. > > Has anyone either managed to download it, or gotten through to the > 1-800 > number? I'd _really_ like a copy of the 128-bit version. I'm a U.S. > citizen, live here in Amarillo, TX. > > Anyone from MicroSloth reading this *might* want to let a Responsible > Person know about the perl script hiccups.... > > Dave Merriman, Densa's mole in Mensa > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > PGP Email welcome, encouraged, and PREFERRED. Visit my web > site at http://www.shellback.com/p/merriman > for my PGP key and fingerprint > "What is the sound of one hand clapping in a forest > with no one there to hear it?" > I use Pronto Secure (tm) PGP-fluent Email software for Windows Lou Zirko (502)383-2175 Zystems lzirko(a)c2.org "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 iQEVAwUBMhXUEctPRTNbb5z9AQHbeQf/ZOFzjDVZzgWKBhKvsVFzbyA3ayNNyJqG NuSNQ+W1TAiETioARwuCvSaokah7RBmoMOtPetGtUJBDkaw0KsKiGnByP/95a+73 +J49pubnhx7sM0PqiUNcdnE25gyHKwzSC82M31yOmsGst1FfPoklryoCdCUc2AOT A0HJpjRaIY/CdMx1WtnO8u1Pnl47GyazfkCOqpXnD6fcONvQOawadNJFUL8ehvKF vrvTn8rwo7W/71ijoFqphBJYIxnZpM34eJRz2mX8KE6VXlXCBWzCeVzoJD4zk5Yo DYqYmhmhKRubl9I9jbzG2VR6yCAPeYdYrtjWPNWgs56Yd5swlUCKpA== =WlX/ -----END PGP SIGNATURE-----

1 0

Re: proxy servers in Singapore
by Scott Schryvers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:10 PM 8/16/96 -0400, you wrote: >Did anyone else catch the AP wire story >(it ran here in the SF Chronicle on Thursday) >about the Singapore government cracking >down on "undesirable" (e.g., sex smut, anti-govt. >postings etc.) content on web sites, usenet etc. >Their basically forcing, by law, Singapore ISPs to use >proxy servers that contain the information >that the govt. deems fit. > >Scary if you ask me. But then they have a govt. >that acts like it's the management of Disneyland. > >"Have a nice ride!" >-B >===================================================== >Brendon Macaraeg >http://www.itp.tsoa.nyu.edu/~brendonm >Finger macaragb(a)acf2.nyu.edu for my PGP Public Key > > "Disneyland with the death penalty" To quote William Gibson. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMhXI9P+hzPlzwZAdAQFgNAgA0qjtwaCv+O8+Ye0OtCmxAzW0LBsXfRtK 1nZmbUqh5NIDHSviQrDDGEX1/Oajai1cpiCZtt3MbhlWUXWgzcbxOX2ZZDUA/4xc 4/TCBeRZ5lRfSnUeV0NhmLnrX4hgVuwMS+x0Z5LnkK0hg39GByMoiqM7MFJHKBQ3 PXTqSnGnNv+dDG1ZcClZff2JIAiNLHcxx8MOk60E9kLAPVYv2XAkID3FmuuHRS2G 6zPDe6Jlgs2tmCP8u5fQEnfaGYqQiUvfg8bqJt2x5BeMGJfY7Nbj0SureFZ7lQs6 /soG82FQkdUykewoOk+lnTJ3S3UY6am3GNwCFzPuMhfpuMizBzEF8g== =RFbe -----END PGP SIGNATURE----- PGP encrypted mail preferred. E-Mail me for my key. Scott J. Schryvers <schryver(a)radiks.net>

2 1

Re: Unix passwd-cracker online?
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

I've given this some thought before, and there are some optimizations required... First of all, assuming you have one plaintext password for every crypt()'d combo and salt (I think there are actually a bunch of possible plaintexts for each encryption, but I'll assume that we'll save the one that looks most like an english somethingorother as any of them should work.) If you just sort them, you only need to store the 8 char plaintext, which helps with the storage, and halves it approximatly (a little more, actually.) Now...Still too much sotrage for one system, but if we had a network of machines around the Internet, with multi-gig tape changers (i've seen 40GB changer things a discount places for $1000) I figure DNS could server as a way of reaching the system that has the range you want..say we have maxhines named xJG*a.crackcrypt.com, with a leading letter on each hostname, followed by enough characters to represent how much of a range that system holds. I don't have a back of the envelop handy, and it's too early in the morning...so I'll do the calc later. But, for a small fee, anything can be arranged :) Ryan The real problem becomes regeneration when someone's tape goes corrupt.... ---------- Previous Message ---------- To: al177820 cc: cypherpunks From: wmono @ Direct.CA (William Ono) @ smtp Date: 08/17/96 01:27:53 AM Subject: Re: Unix passwd-cracker online? On Fri, 16 Aug 1996, Carlos L. Mariscal may have written: > person has obtained a specific password by entering the desired > adresses'passord on a submnit form in a Web page. [deletia] > never have it if there really is such, but this came to my mind when i read > the posts on the plate-numbers-in-Oregon polemica. I would appreciate Somehow I have a hard time believing this to be true. I run crack, a password searching program that uses a dictionary as its base, on my /etc/passwd regularly to locate any users with easily guessed entries. With ultra fast crypt (UFC), the fastest crypt() replacement I can find, I can run through about 9700 passwords per second on this P6-150. Now, this is a back-of-the-envelope calculation: Assuming that the password can be one to eight characters of the following: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*() we find that we have a set of 72 characters. That gives us 72^8 + 72^7 + 72^6 + 72^5 + 72^4 + 72^3 + 72^2 + 72^1 or 732376025552520 possible combinations. At 9700 encryptions per second, it would take my system 2401 years to brute force -one- password to completion. That means that, most likely, if this 'locate password on demand' system existed, it would not work in real time, or in any time during any person's life. Moore's Law might shorten this timeframe considerably, but still not to any reasonable time frame. Continuing with my back-of-the-envelope estimate, we have the length of a crypt()'d password as being 13 characters. The password in plaintext has to follow, with a length of 8 characters. At a size of 732376025552520 * 21 characters, we would have a database of 15379896536602920 bytes, or 22565249 650mb CD-ROMs. That's for the passwords of one salt, without any formatting. Even if we could achieve a 95% compression rate on this data (it is text, after all) we would end up with 237528 CD-ROMs. Most likely my set of characters will be found to be incorrect, but anything that includes even a-z, A-Z, and 0-9 in one to eight character combinations most likely will not be a favourable crack target. Sorry, I don't think this is feasable, or possible. (Please do correct my calculations if errors are detected, especially if the corrected numbers make this possible.. it's getting late at night, and my mind is fogging up, so these calculations/estimates/wild guesses may be off more than usual. It does sound like an interesting project to undertake, if it were possible, but not on my equipment!) -- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! William Ono <wmono(a)direct.ca> PGP Key: F3F716BD fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint PGP-encrypted mail welcome! "640k ought to be enough for everybody."

1 0

Re: Unix passwd-cracker online?
by ScottMorris 17 Dec '03

17 Dec '03

At 01:27 AM 8/17/96 -0700, you wrote: >On Fri, 16 Aug 1996, Carlos L. Mariscal may have written: > >> person has obtained a specific password by entering the desired >> adresses'passord on a submnit form in a Web page. >[deletia] >> never have it if there really is such, but this came to my mind when i read >> the posts on the plate-numbers-in-Oregon polemica. I would appreciate > >Somehow I have a hard time believing this to be true. I run crack, a >password searching program that uses a dictionary as its base, on my >/etc/passwd regularly to locate any users with easily guessed entries. >With ultra fast crypt (UFC), the fastest crypt() replacement I can find, I >can run through about 9700 passwords per second on this P6-150. >[snip] You of course are assuming they are using a Unix box. I commonly offload the etc/passwd file to my pc (p-100) and run Crackerjack against the file. With a single username a 5 meg wordlist will run in about 30 seconds (mileage will vary). The concept is certainly interesting and is another case for good passwords. Of course you need to get the password file first which is another story for another group. >Sorry, I don't think this is feasable, or possible. While I believe this is possible feasable is another story. >(Please do correct my calculations if errors are detected, especially if >the corrected numbers make this possible.. it's getting late at night, and >my mind is fogging up, so these calculations/estimates/wild guesses may be >off more than usual. It does sound like an interesting project to >undertake, if it were possible, but not on my equipment!) > > >-- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! >William Ono <wmono(a)direct.ca> PGP Key: F3F716BD > fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint >PGP-encrypted mail welcome! "640k ought to be enough ----- Scott L. Morris Systems Security Consultant smorri59(a)icubed.net Data Forensics Finger smorri59(a)ally.ios.com for my pgp public key.

2 1

No Subject
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 09:08 PM 8/16/96 +0800, rednax wrote: >Speaking of NT, I downloaded the full version of msie 3.0 the other day but >when I tried installing it, an error message came up saying that it requires >a Win95 or WinNT4.0 build of 1381 or higher. I am currently running NT 4.0b >that has a build of 1314, does anyone know of where is the upgrade or >service packs(if available)? I have tried looking around microsoft.com, but >they neither provided any detail nor did they provide an e-mail. Build 1381 is the final release of NT 4.0, not a beta version. Build 1381 was released to OEMs about a week and a half ago. It should reach a retail outlet near you before September. There is no free upgrade from the beta version of NT 4.0 to the final version. You may want to purchase a copy from Microsoft, or sit in IRC for a while and wait for someone to hand it to you. --- Jeremy L. Mineweaser | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$ gt4436c(a)prism.gatech.edu | L+>++ E-(---) W++ N+ !o-- K+>++ w+(++++) O- M-- | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+() *ai*vr*vx*crypto* | tv(+) b++>+++ DI+(++) D+ G++ e>+++ h-() r-@ !y-

1 0

Re: "world communications being monitored"
by Wayne H. Allen 17 Dec '03

17 Dec '03

At 08:44 PM 8/16/96 -0700, Vladimir Z. Nuri wrote: > >------- Forwarded Message >From: "Mat Guthrie" <matguthrie(a)enterprise.net> >To: mmlist-l(a)newciv.org >Date: Wed, 14 Aug 1996 20:14:39 +0000 >Subject: All Int' Communications Are Monitored > > >- - -> SearchNet's snetnews Mailing List > >Hi there all, > >I heard an amazing news report on the radio today, that confirmed >what I've heard and suspected for a long time - all international >communications *are* continually being monitored!! No, what this guy heard was a book report. I don't know how well a writer Mr. Hager is but if he doesn't have proper documentation then he confirms nothing. > >The report was on "The World at One" news report on BBC Radio 4 - >about as respected, reliable and informative a source as any >mainstream media is ever likely to be. The feature spoke about a >book that's come out in New Zealand called "Secret Power" by Nicky >Hager, that has been endorsed by the former (?) Prime Minister of New >Zealand himself. It supposedly goes into great detail about an >international agreement called "Echelon" of which the US, UK, >France, New Zealand, Australia and several other nations are all >participants. According to Nicky Hager - who was interviewed on the >program - a system of monitoring stations have been set up in various >countries in the world that continually monitor ALL fax, email, >telephone and satellite communications etc, "sniffing" for keywords >using super computers. When these key words are identified the >information is automatically logged and according to Hager, sent >directly to the US intelligence services. > >Now whilst many of us have undoubtedly come across this sort of >information before and undoubtedly many of us have probably scoffed >at such ascertions as merely impossible and blatantly paranoid, >something very significant sets this report apart. Before the book >was published, Hager went with his manuscript to the New Zealand >Prime Minister who had been responsible for signing NZ up to the >agreement (I got the impression that he is no longer in power). If anyone cares to look up the political history of the western Pacific rim, it would seem very suspicious that N.Z and Australia would have any intelligence commitment with France at all. >Anyway, the PM was so shocked by the revelations that the book >contained, that he has written the forward to the book. Supposedly he >says that he had no idea of the true nature of the agreement and the >powers which it bestowed on the intelligence services and is >obviously trying to distance himself from the storm that's beginning >to brew up about it. Maybe he's just covering his arse or maybe he >was just another puppet head of government who wasn't properly >informed about what was really taking place in his own country, but >either way, the fact that he has got involved with the book adds >considerable credibility to it's claims. If the PM has no credibility (his saying he knew nothing) how does his input add credibility to the book? Those of you who have often >said that such wide-scale monitoring is "obviously impossible" might >be wise to re-evaluate your positions! > Those of us in-the-know won't be reevaluating anything. Save your money and wait for the book to get into the local library. Better to spend your money on David's book on Enigma. Wayne H.Allen whallen(a)capitalnet.com Pgp key at www.capitalnet.com/~whallen

1 0

Re: Imprisoned Capital
by James A. Donald 17 Dec '03

17 Dec '03

[In response the argument that attempts to imprison capital will cause capital flight] At 10:50 PM 8/16/96 +-200, Bart Croughs wrote: > This is a good point when you talk about governments that will > prevent *all* capital from flowing out. But a government could > prevent the outflow of capital of it's own citizens, and still > allow capital of foreigners to leave the country. As long as > foreign capital isn't imprisoned, foreign capital could be > attracted. Been tried. Does not work. 1. If foreign capital is allowed to freely enter and leave, internal players find ways to sneak their capital out. This forces the government to start regulating and supervising foreign businessmen in ways that at best terrify them (such controls look very much like creeping confiscation), and at worst cause them huge harm with no real benefits to anyone. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0