December 2003 - cypherpunks-legacy

Re: Free Speech and List Topics
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> More disturbing to me recently has been the steady increase in subscribers > to this list who don't seem to value free speech very highly, who write of > their own nation's censorship as valiant efforts to protect citizen-units > from foreign devils, and, even more shockingly, from supposed defenders of > electronic freedom who are now talking about the need for limits on > anonymity. I too have noticed this, but we must remember that although we are the people who see the tyranny of censorship etc. all to clearly we are in a very small minority, the majority of people do not support censorship because they have made a reasoned judgement, the either support it because they are too lazy to do anytthing, too shit scared of the government if they do, or they just do not take the time to understand the issues and so support the common view, there is also the case that many people "go with the majority", because they do not want to appear different, and the media has so demonized free speech and liberty advocated that to associate yourself with them now is equivalent to telling people you are a rampant sexually deprived paedophile in an anorak. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az4= =riHc -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: DON'T Nuke Singapore Back into the Stone Age
by Hallam-Baker 17 Dec '03

17 Dec '03

Timothy C. May wrote: > The point is to make clear to them that the Usenet and similar Web sites > are global in nature, not subject to censorship without a very high local > cost. If discussions of Lee Kwan Yew's dynasty are considered illegal, then > Singaporans will have to choose not to carry the various newsgroups into > which *I* post such messages! If the govt. of Singapore wish to keep their people in ignorance of their corruption it is going to be harder than banning a few newsgroups. I would expect the opposition to be scanning USEnet and like fora for email addresses ending with .sg and spamming appropriately. The irony of censorship is that its rarely effective and almost always superfluous. The people of singapore are aware that their government is corrupt. They vote it back in because they expect the alternative to be at least as corrupt. Its much like the US where there is a choice between the rightwing authoritarian Republican Party and the authoritarian, rightwing Democrats. > (This was done by many of us during the Karla Homulka and Teale trial in > Canada a couple of years ago: Canada imposed press restrictions on > discussion of the trial and the grisly evidence...and then was chagrinned > to find that the global Net did not adhere to their notions of what should > and could be discussed. They even seized copies of "Wired" at the border, > very much akin to Singapore's stone age policies.) There is a big difference between the Canada situation and the Singapore situation. In Canada the restrictions are temporary and stem from making the right to a fair trial a higher priority than the right to free speech. It is a conflict of two competing individual liberties. No observer of the OJ Simpson trial could state that the media coverage did not affect the outcome. The arguments that Mill advances for freedom of speech in On Liberty do not apply in the context of a temporary judicial injunction, they are utilitarian (suprise) and applying his general principle of "interests" would favour the temporary restriction. The situation in Sigapore is simply a corrupt government trying to supress legitimate democratic discussion. The intention is not to protect an individuals right to a fair trial, the intention is to restrict argument permanently. It is important that in an international forum people don't start imagining that their local customs are universally accepted as superior. The difference between Canadian and US law is a minor one and relates to different interpretations of a common principle. There is a vast gulf between the Singapore position and that of either the US or Canada. This is not simply a difference of local interpretation. Phill

1 0

Re: Free Speech and List Topics
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"tcmay(a)got.net" 2-SEP-1996 05:36:20.36 >No self-respecting Cypherpunk thinks the Antitrust Act and related acts are >worthy of enforcement. >(Think of how the technology we support will tend to allow new avenues for >price collusion, interlocking directorates, new forms of business combines, >unreadable secure communications with foreign competitors, and so on, all >things the Antitrust regulators are already growing worried about.) There's a difference between thinking something shouldn't be enforced (e.g., drug laws for adults) and thinking that other things - such as privacy and free speech - are more important than fully effective enforcement of something (anti-terrorism measures, AntiTrust Act, etcetera). I don't think that transparent houses, as Perry put it, should be required to prevent murders - but I don't approve of murders either. It's a problem with means, not ends. -Allen

1 0

Secure anonymouse server protocol: comments please
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

The following is a very sketchy plan for a secure protocol for an anonymous server which allows replies without storing a recipient database in the clear. To send a message: The sender first exchanges keys with the sever (public key cryptography assumed), the server now has the users key and the user the servers. The user sends the server: The recipient for the message the message itself a password previously agreed The users ID on the server The server decrypts to get the above back in plaintext, then it encrypts the ID & the users address with a random session key and stores it in the database. notice nothing is stored in the clear the server now encrypts the session key with the senders public key, and fowards it to the sender of the original message. now finally the server sends the message onto the intended recipient in plaintext (who must also have exchanged keys with the server) along with the ID of the sender encrypted with the servers public key. the recipient responds with his reply, and the ID of the sender still encrypted in the servers Public key The server stores this When the user (the original sender) wants to pick up his mail after a couple of days he sends the server his ID encrypted with the servers public key, the server compares this with all of the encrypted IDs in the database and when it finds a match it fowards the corresponding mail to the original sender of the first message. Thats all folks. This system has 1 huge fault, we can encrypt a uses ID with the servers public key to see what his ID in the encrypted database is and therefore identify him, maybe we need two seperate server public keys, and when IDs come in encrypted with key1 (the one it releases) it decrypts with secretkey1 then encrypts with publickey2 (the one it keeps secret) or maybe we can just hash and sign the IDs in the database? as I said it`s very sketchy, I made most of this up as I wrote it so if you must tear it to pieces please do so constructively, it could be the route to a secure system.... Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Http://www.fatmans.demon.co.uk/crypt/ "Don`t forget to mount a scratch monkey" -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAjH9j+cAAAEEAMBvREiQR0ot9dFCO0TiSCSunAYLv2g1Bc6I3bz8FzKXNH53 6mieJf/W4rD+CxJpT0q9RQaaoRtkHJLwbjfK2il3D7mEahMAyqvF/xRJNqkXfhM3 sRJM0Jh43l+W0M5vwokbEbk25/bxWWGspTsLD3YHbzKnG6pOcL5OPIRbv66xAAUR tCdQYXVsIEJyYWRsZXkgPHBhdWxAZmF0bWFucy5kZW1vbi5jby51az4= =riHc -----END PGP PUBLIC KEY BLOCK-----

1 0

(no subject)
by Fran Frisina 17 Dec '03

17 Dec '03

desubscribe

1 0

Re: FLT 800: From the Rumor Mill...But It Makes Sense.. (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 11:59 PM 9/1/96 -0700, James A. Donald wrote: >At 09:04 PM 9/1/96 -0400, Alan Horowitz wrote: >> The Aegis ship in the Gulf wzs not in an exercise. It was in a war zone. >> >> If my memory serves, the Iranian jetliner had its squawker turned off, or >> broken. > >Your memory does not serve: The computers record of the events was: > >Computer tells crew: Civilian jetliner on radar. > >Crew expecting an attack by jetfighters, tell computer to shoot it down. > >Computer does not put up a bunch of dialogs saying: "Hey, I think this >is a CIVILIAN airliner, did you get that CIVILIAN airliner, are you quite >sure you want it shot down? Instead it just shoots it down. Suggestion for future improvement... C:>DEL AIRLINER.COM Are you sure? (Y/N) _ Jim Bell jimbell(a)pacifier.com

1 0

The Esther Dyson Flap
by Chuck Thompson 17 Dec '03

17 Dec '03

I don't quite understand the position taken by Mr. Assange and Mr. Unicorn regarding recent statements attributed to Ms. Dyson. I would appreciate some additional insight. It appears as though they are both critical of statements (taken out of context according to Dyson) because of her position with the EFF. It appears that they both believe that she has no right to her opinion if it is contradictory to the policy of the EFF. If such an EFF policy exists, and if Dyson is of a different opinion, the fact that she holds office in an organization with which she is not in total agreement should not count against her. In fact, it is to her credit that she has the courage to speak her mind, considering that hers is an elected position. She has something to lose by speaking her mind publicly. Mr. Unicorn remains anonymous, thereby mitigating repercussions which might otherwise accrue to him as a result of the expression of his opinion. I agree with Mr. Unicorn that the EFF should state its position unequivocally. I do not agree that officers or staff of EFF should not be allowed to disagree with that position, if in fact they do. In the case of Ms. Dyson, how can we know whether she agrees or disagrees with a non-existant policy? She has, evidently, spoken her mind. Isn't that what freedom of speech allows? Imagine, if you will, where we would be right now if all elected representatives were censured for disagreeing with stated government policy. That ability is what makes this country great - and, what you both seem to be saying you stand for. Is your position solid only if everyone agrees with you and you them? Whatever happened to "defending to the death your right to say it"? Pouncing on someone, without knowing all the facts, who is vulnerable because of their position smacks of dirty politics - it is distasteful. Why not ask for the facts from the source? Then state your opinions or make your threats about not contributing financially. In keeping with the message, you have the right to take a cheap shot. I'd just like some insight into your thinking. Regards, Chuck Thompson

1 0

Any cypherpunk solutions to this problem?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

To the degree that he's correct, how can such problems be solved while increasing privacy, security, etcetera? What sort of decentralized replacements for the current DNS system can be used, preferably with prevention of removal of DN for political reasons? -Allen From: IN%"rre(a)weber.ucsd.edu" 27-AUG-1996 06:03:35.07 [Maybe the next Internet myth to bust up is this stuff about the Internet being decentralized. "Designed to survive a nuclear attack", etc etc. I'm afraid it doesn't work like that. The net has little redundancy, the backbones are in the hands of a small number of large companies, and all of the detailed mechanics of getting your packets to their destination are fragile and prone to propagating errors. The high levels of service to which we've grown accustomed are due to the hard work of specific people, not to the intrinsic properties of the machinery. The net works because those people are able to do the right thing. The conditions that *let* them do the right thing may disappear next month, or the month after that. So let's forget the technological determinism and lose our complacency about the future, and instead have a little gratitude to the hackers who make it work and a little political concern for the architectural choices that are coming right up on the horizon.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Mon, 26 Aug 1996 14:15:06 -0700 (PDT) From: risks(a)csl.sri.com RISKS-LIST: Risks-Forum Digest Monday 26 August 1996 Volume 18 : Issue 38 ---------------------------------------------------------------------- Date: Sat, 24 Aug 1996 08:53:31 -0700 From: stevenw(a)best.com (Steven Weller) Subject: DNS failure [from Matthew Dillon] The following describes DNS meltdown at my ISP the other day: all DNS services were unavailable, despite multiple servers being online. Lack of DNS assured that other working services were unavailable to everyone who didn't have IP addresses written down. Here is a technical explanation of the DNS failure, for those of you interested. First, a synopsis of how DNS works... every site on the net serves their own DNS records. Some sites serve other people's DNS records. For example, BEST serves the DNS records for best.com, best.net, and most of our customer's custom domains. No site serves more then a small fraction of the DNS records on the internet from their own database. The way DNS works is that when a domain name needs to be resolved, our DNS server (anyone's DNS server) first goes to the NIC to ask where to go to resolve the domain name. The NIC itself cannot resolve domains, it can only tell our DNS server where to go to resolve a domain. Our DNS server then goes to the specified remote site to resolve the domain name belonging to that site. The remote site replies with the answer which our DNS server (a) caches for future reference, and (b) returns to the original requester. The caching is important, because otherwise a DNS server would have to re-query the remote DNS server every time someone wanted to resolve a domain. DNS records propagate through caches. It is simply not possible to run a DNS system with caching turned off, it would create an impossible load on the internet. Around 4:00 a.m. yesterday, some unknown site's cache got corrupted. The corruption propagated to many (hundreds) of other sites on the internet and eventually propagated to us. This corruption hit a bug in the DNS server program that wound up corrupting the program, causing DNS to loose major records. Restarting the server in this case does not solve the problem because, due to the caching on remote sites, the corrupted record repropagates almost instantly. BEST was hit by this problem very hard due to the large number of custom domains we serve... so many DNS requests come into BEST and are made by BEST that our servers would hit the corruption out on the internet within 10 seconds of starting up. Worse, this particular corruption tended to destroy the root records (stored in memory), called SOA records, for the domains served locally. This destroyed the mail system causing mail messages to bounce rather then to simply be delayed, because the DNS server was saying 'site X does not exist' rather then timing out. It's worst possible corruption that can occur in a DNS system. -- It turns out that the last two BIND releases contain a bug that, when a corrupted record of the type that started propagating at 4:00 a.m. is received, results in the destruction of other **unassociated** records stored in memory. The particular release of BIND that we were using had been running perfectly for several *months* before this incident. It was not something recently installed. There are two fixes to the problem: (1) One can lock out those sites where the corrupted records come from, and (2) One can revert to an older release. (1) is not a good solution because, due to the nature of DNS, corruption can propagate to many sites and it would be impossible to keep up to date and lock all of them out. We wound up taking action #(2) and reverting to an older release of bind which, fortunately, did not have the bug that caused the problem. We had to revert to BIND 4.9.3. Unfortunately, we did not think to do this for many hours because we were all convinced that the problem was external in nature and just didn't think to try a reversion. In hind sight, that is the first thing we should have tried since we had the friggin binary for the older version sitting in our source tree. As far as DNS goes... the DNS we run is not 'bsd' or 'sgi' .. it's the *official* world-wide BIND distribution run by Paul Vixie. It is really not appropriate to run the older versions shipped with most operating systems due to massive, massive security holes. The corruption problem was unavoidable. What *was* avoidable was the long period of time that elapsed before the problem got fixed, which I take full responsibility for. We spent most of that time trying to track down where the corruption was coming from... a near impossible task. Around 6:00 p.m. scuttlebutt started propagating regarding a possible bug in the last two BIND releases at which point we instantly reverted to an earlier version, which fixed the problem, then started banging our heads against the wall for not trying it earlier. Matthew Dillon Engineering, BEST Internet Communications, Inc. <dillon(a)best.net> ------------------------------ Date: 15 Aug 1996 (LAST-MODIFIED) From: RISKS-request(a)csl.sri.com Subject: Abridged info on RISKS (comp.risks) The RISKS Forum is a MODERATED digest. Its Usenet equivalent is comp.risks. => SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent) if possible and convenient for you. Or use Bitnet LISTSERV. Alternatively, (via majordomo) DIRECT REQUESTS to <risks-request(a)csl.sri.com> with one-line, SUBSCRIBE (or UNSUBSCRIBE) [with net address if different from FROM:] or INFO [for unabridged version of RISKS information] => The INFO file (submissions, default disclaimers, archive sites, .mil/.uk subscribers, copyright policy, PRIVACY digests, etc.) is also obtainable from http://www.CSL.sri.com/risksinfo.html ftp://www.CSL.sri.com/pub/risks.info The full info file will appear now and then in future issues. *** All contributors are assumed to have read the full info file for guidelines. *** => SUBMISSIONS: to risks(a)CSL.sri.com with meaningful SUBJECT: line. => ARCHIVES are available: ftp://ftp.sri.com/risks or ftp ftp.sri.com<CR>login anonymous<CR>[YourNetAddress]<CR>cd risks or http://catless.ncl.ac.uk/Risks/VL.IS.html [i.e., VoLume, ISsue]. The ftp.sri.com site risks directory also contains the most recent PostScript copy of PGN's comprehensive historical summary of one liners: get illustrative.PS ------------------------------ End of RISKS-FORUM Digest 18.38 ************************

1 0

Cocktail Party Conversation...
by Charles Gimon 17 Dec '03

17 Dec '03

...of the clueful who should know better... "Ms. Denning, I'd like to introduce Ms. Dyson. Ms. Dyson, Ms. Denning." *********************************************************************** Wild new Ubik salad dressing, not | gimonca(a)skypoint.com Italian, not French, but an entirely | Minneapolis MN USA new and different taste treat that's | http://www.skypoint.com/~gimonca waking up the world! | A lean, mean meme machine. ***********************************************************************

1 0

Re: The Earliest CP Remailer *DID* Emphasize Anonymity
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:27 AM 9/3/96, Bill Stewart wrote: >At 11:05 AM 9/2/96 -0700, Tim wrote: >>No, the focus was at _least_ as much on providing anonymity as on >>protection from eavesdroppers or traffic analysts. More so, actually. >>How do I know this? Well, I was the one who did the presentation on >>Chaumian mixes at the first meeting, describing them as remailers and using >>paper envelopes-within-envelopes to illustrate the concept. >>Later that day, in the "Crypto Anarchy Game" we played to educate the > >Thanks for the history correction; I got involved with Cypherpunks about >a year after the initial meeting/game, so I'm going on other people's >comments about the intent of mixes and remailers. Out of curiousity, >did either spam or blackmail show up during the first run of the game? A full range of interesting behaviors showed up. Usually this was publicized via the "out-of-band" channel of someone yelling "Hey, I was just told to deposit $100 credits to the account of "AnonymousBanker" or else my digital pseudonym will be published." A murder-for-hire business was started, several weapons-trading schemes developed, etc. Information selling was a big market success. (Not very surprising, given that Eric and I devised the playing cards, roles to be played (banker, assassin, money launderer, freedom fighter, whistleblower, etc.), and doled out crypto-currency (Monopoly money). The idea was not to discover real-world lessons, of course, but to graphically demonstrate some of the technology, some of the ways crypto-anonymity would change interactions, etc.) >>And all of the early uses were explicitly to anonymize the sender, not to >>deter eavesdropping (which conventional crypto works well for, anyway). > >Keeping the sender's identity hidden from the recipient is a different >problem than keeping either of them hidden from Untrusted Third Parties. >Conventional crypto is fine for keeping message content secure from >eavedroppers, but isn't enough to prevent traffic analysis; >that requires either mixes or at least message pools or broadcasts. Yes, but my point was more that we were more concerned about building a solid foundation which would solve a larger class of problems than just straight encryption would. Remailers do this. Anonymity of sender was a dominant mode in the game, for various reasons. But anonymity of receiver was also possible (we faked message pools by pinning messages to a board and then letting them be taken down, but not letting others spend time seeing which were taken down...obviously a determined person could have seen which were removed, and by whom...). Regarding traffic analysis, at least one person (George ?) set himself up as an NSA traffic analyst and tried to deduce pseudonym/true name mappings. (We gave some people roles as "NSA," "narc," and whatnot.) I no longer recall all the details of how the game evolved, interesting behaviors seen, etc. I think someone posted a summary of his reactions to the game a few weeks afterward, circa September/October 1992. It should be in any archives that cover this period. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0