December 2003 - cypherpunks-legacy

Royalties
by pclow 17 Dec '03

17 Dec '03

Dear C'punks I understand from a previous post that if I were to commercialised PGP in a package, I have to pay some royalties(?) to the owners(?) of IDEA. My apologies to the list for repeating the question which is, who do I pay to and how much. Thanks.

3 5

Sameer should sue the SPA
by Matthew Ghio 17 Dec '03

17 Dec '03

Let's see, what can Sameer sue the SPA for... 1) Filing a frivilous lawsuit, of course. 2) Extortion. "Sign this or we'll sue." 3) Libel and Defamation. "SPA's false statements about Mr. Parekh have harmed his reputation as a software publisher, and cost him profits..." 4) Conspiracy to violate the ECPA by demanding logs and records which may contain private/confidential information. (Dunno about this one, but it's worth a shot.) 5) Anything else? How much $ in damages do you think he can get? Also, SPA is going after C2 because one of their customers allegedly had a link to a pirate site - but they have (apparently) not gone after the pirate site itself! Could someone explain to me how there can be a finding of contributory copyright infringement, when there is no direct copyright infringement? Fonovisa v. Cherry Auction is an often-cited case here. In this case, a lawsuit was brought against the swap meet operators only after action had been taken against the vendors of the illegally copied material. It does not seem logical that c2 could be liable for contributory infringement when no actual infringement has (yet) been shown to exist.

4 3

Re: COMMUNITY CONNEXION SUED IN FRIVOLOUS LAWSUIT
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:03 PM 10/14/96 -0700, Steven L Baur <steve(a)miranova.com> wrote: > http://www.spa.org/piracy/CODE.htm > ... > 8. Do not sponsor, endorse, or advertise access to infringing > software. I wonder how a "Hack Netscape" or "Hack Microsoft" contest fits in with this, to name two major public services run by C2...... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Oregon DMV database online once again...
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

The Oregon DMV database will once again be searchable on the web, in a few days, at http://www.notek.com/or-dmv. Suggestions on what sorts of privacy-related propaganda should be on the page are welcome (and encouraged: currently there's really nothing there...) Also, looking for a volunteer to write a quick press release we can send to Oregon media, regarding the reasons behind the page, etc. (I suck at such things, and would prefer if someone else with a talent for writing on cypherpunk-type topics would do it.) A few details, for those who want to know: the actual databases are stored on a 486DX/33 (the only machine I could spare for the task..) running linux 2.0.13 with 8 megs o' RAM. The search isn't quite as speedy as Genocide2600's (the previous home of the Web-Searchable dmv database), but it's reasonably fast. The license database is indexed on last name, the plates database is currently indexed on plate number, but when I can find more harddrive space, it will also be indexed (and thus searchable) by last name, which is a bit of an expansion on Genocide 2600. Anyway, all that's really left is a few hours of work tidying up the cgi/database server code and finishing the actual web page, which I should get to tomorrow or possibly the next day. I'll post a notice when the page is officially up, but in the meantime, please let me know what type of privacy propaganda/tools/info (if any) would be appropriate. Thanks... //cerridwyn//

1 0

AS2805.65 standard?
by Min-Ming Chin 17 Dec '03

17 Dec '03

Hi, there, Anyone heard of the Australian security standard AS2805.65? Beats me...

1 0

GAK Naive or Shrewd?
by John Young 17 Dec '03

17 Dec '03

Ern Hua's letter is ultimate. ----- The New York Times, October 15, 1996. Is Clinton's Encryption Policy Naive or Shrewd? To the Editor: There is something strange going on with the Clinton Administration's policy on data-scrambling software and Secretary of Commerce Mickey Kantor's defense of it (letter, Oct. 11). If the Administration really wanted to prevent encryption software from falling into hostile hands, it would try to pass a law limiting the type of encryption that can be sold domestically, not just exported. The cumbersome system the Administration proposes may be a measure of its computer naivete. People who are familiar with computer encryption know that strong encryption can be readily had here in the United States over the Internet or telephone lines from dial-up computer bulletin boards. Not long ago I downloaded a copy "Pretty Good Privacy," a system similar to the Rivest-Shamir-Adelman "strong" public-key method. Anyone with a computer, a modem and a phone line could do the same. Or the Government may not be naive at all but merely Machiavelian. Suppose the code breakers at the National Security Agency had managed to develop efficient solutions to "strong" methods. Would it be in the Government's interest to keep that fact a secret and to create a distracting furor by pushing another, weaker (and exportable) encryption system it knows has not a chance being adopted? Then encryption usrs would be lulled into using compromised systems while the National Security Agency decrypts their mail. Warren Wetmore,Hazel Crest, Ill., Oct. 11,1996 ----- To the Editor: Mickey Kantor's Oct. 11 letter is unconvincing. Instead of trying to prohibit strong cryptography, governments should encourage its use. It is the best tool for defending our privacy on the information highway. Jeffrey Shallit, Kitchener, Canada, Oct. 11,1996 The writer is an associate professor of computer science at the University of Waterloo. ----- To the Editor: Mickey Kantor (letter, Oct. 11) says that your Oct. 4 editorial ignores the trend -- especially in Europe -- to require use of key-recovery products and bar the import of stronger encryption products. This ignores that no one wants mandated key recovery. Some important uses of encryption, like secure telephone conversations, do not need key recovery for any reason other than law enforcement intercepts. Mr. Kantor's point on other nations' barring imports is absurd. Since when do we tailor our export limits to the import limits of other nations? The "trend" Mr. Kantor refers to is artificially created by the United States through lobbying efforts. Mr. Kantor uses the word "trend" as if other nations were independently pursuing the key-recovery path, when, in fact, only a few are considering such a move. Some, like Japan, have opposed such a direction. Others, like Sweden, have considered such a move secretly because such a policy cannot withstand democratic scrutiny. Mr. Kantor's letter is a blatant attempt by the Administration to get what it wants for law enforcement and national security agencies without any concern for the nature of the technology or the economic effect of such policies. Ernest Hua, Sunnyvale, Calif., Oct. 11, 1996 The writer is a software engineer. -----

1 0

PINmail in the SCMP
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: somebody Date: Tue, 15 Oct 1996 15:13:07 +0800 To: rah(a)shipwright.com Subject: PINmail in the SCMP MIME-version: 1.0 (Created by TFS) Front page of the Technology Post section of the 15/10/96 edition of the South China Morning Post, next to a cheesy photo of the two men quoted in the article looking (peering?) through venetian blinds. Headline: Anonymous e-mail site launched. Byline: Keala Francis Highlights: "Hong Kong advertising agency Momentum has created an anonymous e-mail service for Internet users around the world." penet closed down "because it was perceived to be condoning child pornography. [Director] Tobin said PINmail (http://www.PINmail.com) was designed as an offshore address only for legitimate businesses, but the compay could not necessarily control its users." Tobin: "If there is proof of illegal activities, I would give up a name." "Momentum created and owns shares in AsiaFocus International, which owns PINmail." Access via Netscape 3.0. IExplorer due before December. (Uses CGI and Javascript in a way that is incompatible with IE3.0.) Daley (Momentum GM): "There are really no disadvantages to having your e-mail sit on a server rather than your PC." "PINmail can also allow you to maintain an anonymous address." "Momentum has set up three server sites in Hong Kong, California and Amsterdam to enable easier and more efficient access." PINmail = USD19.95/yr. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Camelot PRNG
by inssdl＠dstn21.dct.ac.uk 17 Dec '03

17 Dec '03

In the UK, the National Lottery is run by a company called Camelot (in case anyone didn't know) A while back, they introduced a new option, in that if you checked a certain box on your ticket, 6 numbers would be 'chosen' for you, presumably 'randomly' Does anyone have any info on how this system works? i.e. The PRNG used? Whether the PRNG is in the shop terminal or at the central computer @ Camelot? et cetera. (I am looking at the problems of PRSG for my Masters dissertation - hence the interest) Please reply either to the cypherpunks list or to my e-mail address if you think this doesn't have any crypto-relevance. Thanks in advance... ********************************************************************** David Lucas PGDip Software Engineering @@ BEng(Hons) Civil Engineering Postgraduate Software Engineer, University of Abertay Dundee, SCOTLAND @ E-mail: inssdl(a)dstn21.dct.ac.uk @ 2+2 = 5 for large values of two @ If you're not living on the edge, then you're taking up too much space Organisations can't have opinions, only people can and these are mine. Dave's Doorstep is back!!! - http://river.tay.ac.uk/~inssdl/index.html **********************************************************************

1 0

Re: FLY_not
by wa6ube＠ix.netcom.com 17 Dec '03

17 Dec '03

John Young writes: > >On 10/14/96 09:30:38 you wrote: > > 10-13-96. CoWo: > > "Encryption confusion" > > Reminded of the secret Clipper algorithm, I sought > details from IBM. I asked a spokeswoman why the company > hadn't just put out a nice, snappy white paper > explaining its new approach to key recovery. "We spent > three months trying to do that, quite literally," the > spokeswoman said. "It's pretty confusing stuff, and > whenever we get it on paper, we aren't happy with it." > > 10-12-96. InWe: > > "IBM Coalition May Not Fly" [Thanks, WR] > > "The relaxation on encryption is in many ways an > extortion of industry," said Bob Gargus, president of > the Atalla. "If this starts to happen for export, how > many companies will be able to support two standards? I > think every American should be worried." But Greg Simon, > domestic policy adviser to Vice President Al Gore, said, > "We're not looking for an answer that's universally > popular. We're looking for a solution that's balanced > and fair." > ----remainder snipped----- -----BEGIN PGP SIGNED MESSAGE----- I am curious, if there is this "coalition" of companies that have joined IBM on this new Key Recovery Plan, Has anyone yet found out who the other members of this coalition -----BEGIN PGP SIGNATURE----- Version: 4.0 Personal Edition iQCVAwUBMmOndMDUh3vt7LRPAQEsnQP8Cs9yUdETZjTdZPar236cavjWRspQI/vU 9W7DKgUu0QeknOVmmmfbhQSRx8o6W/NcelVG67hXzIE8Zui5LPBefOpOIr6qHOqc ySzLUXS7l0lq5a7Radc/+WoXM/WoHZXYHX6eU7HsJ7dosn7vZiMG2p75+06BBKA6 MCO5n68h2BU= =jy/0 -----END PGP SIGNATURE----- Patricia Gibbons <wa6ube(a)ix.netcom.com>

2 1

AW: binding cryptography
by Eric Verheul 17 Dec '03

17 Dec '03

On dinsdag 15 oktober 1996 14:09, Roy M. Silvernail[SMTP:roy@sendai.scytale.com] wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In list.cypherpunks, everheul(a)NGI.NL writes: > >> BTW, some people on the cypherpunks list seem to think that you can't = >> fraude with a *voluntary* system. However, that is possible: when you do = >> not comply with the *agreed* rules of conduct then the phrase "fraude" = >> is appropriate. >If the system is *voluntary* and I do not *agree* to participate, then I >*cannot* be breaking any "rules". That is correct. Sorry that the BTW-statement is so evident. Some people did not understand that if you *do* agree, then you *can* be breaking any rules... >>> Can you imagine what would happen if governments would (help to) set up = >> a system that has no safeguards at all, i.e. that could give criminals = >> all the anonimity and confidentiality they need? Governments can't = >> probably prevent criminals and the like to use encryption to stay out of = >> sight of law enforcement agencies, but they should not facilitate them = >> either. In the next few years all kinds of "standard" commerical = >> software will come on the market with all kinds of standard security in = >> it. I don't want criminals to be happy with Custom of The Shelf products = >> for security, let them work for their security. > >Which they will, and presumably already do. Therefore, your proposal >does not and cannot hamper criminals. Therefore, your proposal only >hampers law abiding citizen-units' access to uncompromised crypto. I do not agree. For instance, the encryption possibilities of wordperfect, and MS-word are weak; my mail-system (ms-exchange) does not have any encryption at all. The security of these important Custom of The Shelf products can and will be enhanced.. >No institution can expect compliance from a sector of society that, >by definition, does not agree to or follow the social contract. >Therefore, any and all such attempts to do so must be for the purpose of >controlling those citizen-units that do abide the social contract. To >claim otherwise is absurd. The point is that public available systems should *aid* not them in their criminal activities, let them search for alternatives. Compare it with the legislation we have here on the sell of guns. You sort of say: hey, that does not help cause criminals will get it somewhere. I say, that is true, but it will make their lifes more difficult, or maybe I should say less easy. > >> The bottom line is that law-abiding citizens = >> always have to give up some of their freedom to stop criminals (that is = >> why you have to have registration plates on your car, a lock on your = >> car, bicycle, house etc.). That is a fact of life; one I hate. > >Registration plates do not "stop criminals". Locks do not "stop >criminals" (although they might slow a criminal down). Neither will >compromised crypto "stop criminals". But all the above impinge on my >liberty. Am I to give up yet another freedom? Our system slows down criminals too, or maybe I'd better say does not speed them up. Locking my house and my car, certainly limits my freedom too because it gives me the risc of losing the key (happened a few times). Finding the middle of losing freedom by law-abiding citizens on the one hand and stopping criminals on the other hand is an important issue in any democracy. We believe our system gives a solution in which every democratic country on his own implement to their middle, without losing connectivity with countries that think otherwise.

1 0