December 2003 - cypherpunks-legacy

AltaVista sprouts a hole ...
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Russell Stuart <R.Stuart(a)rsm.com.au> MIME-Version: 1.0 Precedence: Bulk Date: Wed, 29 Jan 1997 08:07:27 +1000 From: Russell Stuart <R.Stuart(a)rsm.com.au> To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: AltaVista sprouts a hole ... From: risko(a)csl.sri.com (RISKS List Owner) Newsgroups: comp.risks Subject: RISKS DIGEST 18.77 Message-ID: <CMM.0.90.1.853810937.risko(a)chiron.csl.sri.com> RISKS-LIST: Risks-Forum Digest Monday 20 January 1997 Volume 18 : Issue 77 FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator ***** See last item for further information, disclaimers, caveats, etc. ***** <snip> ------------------------------ Date: Fri, 3 Jan 97 23:52:00 +0100 From: Anders Andersson <andersa(a)Mizar.DoCS.UU.SE> Subject: Leaking WWW surfer interest profiles I notice that AltaVista's inline advertisements link to a server outside Digital, "ad.doubleclick.net", and that the URL includes the user's list of keywords being searched. I'm concerned that these URL's may occasionally leak information about the user's interests and inclinations to third parties, information which the user may prefer to keep private. This is not a new problem that appeared with the inline ads, since also the Referer: field of the HTTP protocol discloses to a target server exactly what AltaVista index page led the user to it. However, this requires that the user willfully follows that link. If sensitive information being leaked via the Referer: field is a problem, the user may obtain client software that withholds Referer: data, either conditionally or unconditionally. Also, a user who has asked AltaVista for "gay" pages is probably not too concerned about accidentally disclosing this fact to the maintainer of said "gay" pages. However, the doubleclick.net ads appear to bear no relationship to the keywords being searched, and they appear not only in the URL for the hyperlink to follow, but also in the IMG SRC URL. This means that in order to avoid disclosing my keyword lists to doubleclick.net, I have to disable automatic loading of inline images when using AltaVista! Why is it that when I perform a search for, say, "gay OR nazi AND scientology", AltaVista tricks my browser to give this very search string away to an advertising company by means of an inline image (the contents of which has nothing to do with my search)? I think I can trust the AltaVista maintainers not to save my keyword lists for future analysis, but what about an advertising company? It's kind of serendipity reversed. When you open a book to look up information on a specific subject, the book scans your mind to find out what other interests and hobbies you have. Anders Andersson, Dept. of Computer Systems, Uppsala University Box 325, S-751 05 UPPSALA, Sweden +46 18 183170 andersa(a)DoCS.UU.SE ------------------------------ <snip> Regards Russell Stuart Software Development Manager RSM Technology PTY LTD ---------------------- Phone: +61 7 3844 9631 Fax: +61 7 3844 9522 Email: R.Stuart(a)rsm.com.au --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

3 2

Re: Child Porn
by Lucky Green 17 Dec '03

17 Dec '03

At 04:48 AM 1/29/97 +0000, Vipul Ved Prakash wrote: >(Forward) >*** NY student charged with sending child sex photos over Internet > >Nathaniel Levy, a psychology major at New York State University, was >charged Wednesday with using the Internet to transmit photos of >infants having sex with adults, the New York state attorney general >said. This is hilarious, given the fact that San Francisco State University's psychology department has what probably amounts to the largest collection of child pornography on the planet. Their collection also includes primary sources on any other type of kink you can imagine. And some that no sane person ever could imagine. [You have to be at least working on a PhD to access the collection.] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

1 0

More Circumventing the ITAR
by Mark Rosen 17 Dec '03

17 Dec '03

I'm curious as to exactly what the ITAR/EAR/Whatever says specifically about "unrestricted FTP sites." My program, Kremlin, is available for download at the web page below. On my web page, I have some stuff in bold print that informs about the ITAR and tells people to go away if they're not from the US or Canada. Does this count as an unrestricted FTP site? It's not all that much different from what MIT has up for PGP. Also, back to the question of registration numbers. A registration number is just a string of letters and numbers, and is essentially the same as a friendly letter; it contains no cryptographic code. For all anyone knows, I could just be charging for pseudo-random numbers, again, nothing of cryptographic significance. Is it illegal for me to mail someone outside of the US or Canada a registration code? Thanks for any help. Mark Rosen FireSoft - http://www.geocities.com/SiliconValley/Pines/2690 Mark Eats AOL - http://www.geocities.com/TimesSquare/6660

2 1

Re: Libel/slander & crypto relevancy (fwd)
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:42 AM 1/28/97 -0600, Jim Choate: >> From: Greg Broiles <gbroiles(a)netbox.com> >> Civil actions against people doing "graffiti" are only interesting where >> the defendant has assets worth suing for. This economic dimension >> substantially limits the number of suits which will be brought. > >Thank you for agreeing with my thesis that the legal industry is one >driven by monetary gain and not justice. It is the one major problem >with law today, it ignores those who are not 'worth it'. Justice is >supposed to be blind and until that happens there can be no true >liberty. Law should be involved in rights and wrongs and not 'how much >money do I need to buy that villa in Spain'. Um, I was making the reciprocal of your point - that people with no assets have a special *advantage* with respect to civil suits, they're able to get away with a fair amount of misbehavior because it's not cost-effective for plaintiffs to sue them. If you're a defendant, being ignored as not 'worth it' is a good thing, not a bad thing. >There is also the aspect of 'reputation' of the organization which was >defamed. This will become even more critical to good business over the >Internet in the future than it is now. Now the only really important >'reputation' that one has to worry about is their credit report. I disagree strongly here. Think about the reputations of Odwalla and Sizzler and (Burger King? can't remember) after their E. Coli problems. Think about the reputation of Radio Shack for making mostly crappy products. Think about the reputation of some ISP's (Netcom, AOL) for continuing to charge people's credit cards for months after a cancellation. Reputation has many dimensions beyond credit reports. > Another aspect of this >that keeps coming up is one of 'big' corporations with 'lots' of money, >this monotonicity in legal thought is the reason I refer to the 'legal >industry' and not 'legal profession'. Currently the main force driving >law is how much money is available. Expansions of liberty simply can't >happen in this environment because there is no mechanism to protect >'little' organizations or persons without 'lots' of cash. This problem is >one that is not being addressed by anyone, most especialy lawyers who >will loose income which they aren't apt to do voluntarily. I agree that people get screwed because they can't afford to litigate or they can't afford a [good] attorney. But I think that the economic dimension to litigation is not necessarily all bad - if litigation were costless, what would prevent people from suing over essentially negligible disputes? I think it's good for people to stop and ask themselves "Is this dispute really worth fighting over?" The relatively high cost of litigation is a way to ration access to a relatively expensive resource, e.g., the courts. If litigants don't pay that cost, then taxpayers will. (And shifting more costs to losing litigants makes it easier, not harder, to be effectively judgment-proof by having few assets.) >> Criminal prosecutions for defamation (in the case of "graffiti") are still >> unlikely - a much more straightforward charge would be unauthorized access >> to a computer or some flavor of fraud, depending on the facts. > >This would be hard to do in the situation such as a mailing list because >the parties would have 'authorized access' and it does not include the issue >of inside parties nor 'web bbs's' where parties can enter comments and >other statements in a 'authorized' manner. There are mechanisms to use >computers for abuse of other parties besides hacking. I don't think that that web BBS or mailing list messages alone will lead to much criminal liability for defamation because I think it's difficult to do a lot of harm in that medium. BBS's have existed for 20+ years now - and how many online defamation cases have we seen? Maybe 10, total. Off the top of my head the only ones I remember are _Cubby v. Compuserve_ and _Stratton-Oakmont_, but there are probably others. Still, we're seeing what, at best one reported case for every 2 years? Online defamation liability exists, but I don't think there's ever going to be an avalanche of cases, simply because the damage involved tends to be relatively small compared to the monetary and emotional costs of litigation. >The point is that if joe-six-pack isn't secure in knowing that his views >and expression are not protected from abuse he won't use it. We all loose >in that case. But Joe Sixpack's lack of protection from abuse is also Joe Sixpack's protection from prosecution when he hasn't done anything wrong. Look at how pissed off some people are when Sandy moderates the list - imagine how much worse it would be if prosecutors were sifting through the list, identifying messages they thought were "over the line" with respect to defamation and then prosecuting the wrongdoers. Yow. Some people would be facing three-strikes minimums based on a single day's messages. :) I much prefer a world where we can engage in spirited debate without being afraid of prosecution (or civil suits) over a world where a tiny misstep means jail or litigation. You're of course free to want something else, but it's hard for me to see the logic behind arguing against private moderation but in favor of significant state regulation. Look at the way that big corporations use SLAPP suits to pick on Ma and Pa Kettle now, and imagine what big corporations could do if it was easier to create criminal liability for defamation. I think your proposed strengthening of defamation rules will prove to hurt the "little guys", not help them. >In this example, if party A makes a statement and then B changes it and >then re-distributes it as original comments by A then there is a problem >irrespective of the monetary worth of A or B. Digital signatures in and of >themselves won't help this from happening unless it is required to include >the full text and signature of any quote in any subsequent use of that >material otherwise the quote and the digital signature are out of sync and >therefore worthless. But people who receive the message unsigned know they're getting an unsigned message (or know that it was signed by the quoter, but not the quoted author) and can make the appropriate assumptions about the truth of the attributions, and adjust their assessment of the veracity of the quoter if it turns out that the quoter is a liar, or if someone challenges the quoter to produce a signed version of the statement and they cannot. We seem to have survived OK so far without special rules to punish people for lying - why do we need special ones for the Net? -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: [noise] RE: Shave the Whales
by Toto 17 Dec '03

17 Dec '03

Dale Thorn wrote: > > Mullen, Patrick wrote: > > Is there a way we can keep the caricatures w/out getting the rest of the > > message > > w/ these postings? I like the ASCII art, but... > > BTW, some of the recent ones are pretty amazing: a bat, a scorpion, > a cow, etc. Maybe we could have the original cypherpunks list saved as an historical ASCII arts treasure. Toto

1 0

Re: Getting into MIT is impossible
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

can any kind soul tell me, what are the SAT scores needed to be in the top 10%, top 1%, and top 0.1% of all the students who take these tests? thank you igor Anonymous wrote: > > > > According to Rick Osborne: > > "I disagree and can speak from experience. I was denied admission to MIT > even thought I had a 3.82 GPA, 1440 SAT (one try), and had taken 9 AP tests > with two 5's, four 4's, two 3's, and one 2. As for being well-rounded, I > was on several academic teams, sang in Chorus, acted and stage managed in > Drama, and played Tennis." > > People get into MIT--or don't get into MIT--for lots of reasons. Most > intelligent people apply to several schools, knowing that admissions > practices are subject to the vagaries of reality. > > In my case, my SATs were about 1500, with some 800s in achievement tests. > And the usual bullshit high school clubs, political offices, etc. etc. I > was accepted by MIT, but not by Caltech. I didn't lose any sleep over the > way things turned out. > > And I decided not to go to MIT, either. > > "The only thing I didn't have that the next MIT applicant had was money. I > made the mistake of letting them know that I was dirt poor and would need > full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the > Russian front!"" > > My guess is that "other factors" were involved. > > I noted with some interest, but little surprise, that the guy claiming MIT > required a 4.0 GPA and a 1600 combined SAT score could barely spell, and > had major problems making a coherent point. Methinks this is why MIT > rejected him, not his lack of a "1600." > > ">For what it's worth, I wanted to go to MIT my sophomore year in high > >school, too > > "Lucky you. It had been a dream of mine since I was an annoying > overachiever of 6. Sux to be white trash, I guess." > > MIT offered me a substantial economic aid package, in the form of loans, > grants, and various campus jobs. What does this tell you? > > "MIT may be a great school, but they tend to be snooty assholes for the most > part. (DISCLAIMER: Not all MIT grads/attendees are necessarily "snooty > assholes", I'm just saying that I've yet to meet one that wasn't.) > > I've known about a dozen or so MIT grads, and only one of them was a snooty > asshole, and it was a _she_, one of the first MIT women grads (and she was > _very_ impressed by this). > > Most MIT grads are perfectly reasonable. > > Xanthar > > > > > -- > - Igor.

2 1

Re: East German Collapse (Was: Fighting the cybercensor
by Hallam-Baker 17 Dec '03

17 Dec '03

One point I had forgotten. The demonstration took place on the 50th anniversary of Kristallnacht. This is one explanation as to why the border guards did not attempt to open fire with firearms or attempt to break up the demonstration with tear gas. Also consider that the Tiennamen square massacre had occurred only a few months before and it did not appear to have settled the issue of who controlled china. Many of the dissidents were still at large, China was a pariah nation. East Germany had recently been visited by Gorbachev who did not appear ready to help keep the regime if things got sticky. The mass defections were taking place at their peak at a rate of tens of thousands in a day. Something like a quarter of the youth between 18 and 25 had defected. Bill if anything understates this point. Certainly if the people decide that the structures of state are not worth supporting change can be astonishing. I think that the spending into bankrupcy thesis might be argued for the case of the USSR and more plausibly the US. The problem is that I don't think that the military spending in either case bore any relation to need, to the threat from the other side or to any rational determination. I think both budgets simply increased to the limit that the economies could support and beyond. There is a similar problem in the third world today. Many third world countries spend more on arms than they do on health or education. Much of the alledged "foreign aid" is in fact subsidies for this trade. The arms are primarily to suppress internal dissent. There are plenty of governments left in need of similar reform. Phill

2 1

Re: Best Computer School?
by Matthew Toth 17 Dec '03

17 Dec '03

MIT is one the best schools in the country for C.S. Close behind is Carnegie Mellon University (C.M.U.) in Pittsburgh, PA. (the folks who put out CERT.) Not sure how much Crypto they do, though.

2 1

Re: Fighting the cybercensor. (fwd)
by snow 17 Dec '03

17 Dec '03

Phill wrote: > I'm a philosophical anarchist and I don't consider the state to have > "rights" over its "subjects", nor do I believe in the pure ideology of > property you do. > > Its worth noting that the origin of property is theft. In the case of the BULLSHIT. BULL FUCKING SHIT. The origin of property is labor. Claiming that _my_ property is the result of ME stealing, and hence what I OWN belongs to the community IS theft. I work, and as the result of that work something is created. That something is MINE to do with as I will. If I choose to sell that work for money, that money is mine. If I trade that money for shoes, those shoes are mine. THere is no theft involved. > controllers of China literally so since they stole most of their "property" > from the previous rulers. They "won" it in combat. The people of china obviously prefered new government to the old one, or they would have prevented the takeover. > I believe that the relationship between a state and individual is > a much more complex one than the slavish subjection model > you propose. In this I am in agreement with practically every > philosopher since Locke. Practically every philosopher since Locke has recieved their education at a Government or "Elite" sponsored school, and made their livings the same way. I'm not claiming conspiracy here, but those that feed at the trough aren't going to insult it overmuch.

2 1

Re: Best Computer School?
by Declan McCullagh 17 Dec '03

17 Dec '03

MIT probably has a need-blind admissions policy; they don't care whether or not you have money. When they admit you, at least. Let me plug Carnegie Mellon University, which consistently ties with MIT and one of them California schools for first place in computer science. It's not quite as hard to get into as MIT, though you do have to deal with Pittsburgh winters. The town itself is small enough to be friendly, and big enough to be interesting. Jim Morris, the head of the computer science department, was my instructor for a data structures class and truly seemed to care about his students' well-being. Oh, and I remember we had t-shirts saying: "MIT -- the CMU of Massachusetts." -Declan Rick wrote: >At 12:32 PM 1/28/97 -0500, Derek Atkins wrote: >>This is really exagerating. You do not need a 4.0, 1600, etc. to be >>admitted to MIT. Sure, you need good grades, but a 3.6 average and >>1350-1400 SAT scores is perfectly adequate to be admitted to MIT. > >I disagree and can speak from experience. I was denied admission to MIT >even thought I had a 3.82 GPA, 1440 SAT (one try), and had taken 9 AP tests >with two 5's, four 4's, two 3's, and one 2. As for being well-rounded, I >was on several academic teams, sang in Chorus, acted and stage managed in >Drama, and played Tennis. > >The only thing I didn't have that the next MIT applicant had was money. I >made the mistake of letting them know that I was dirt poor and would need >full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the >Russian front!" > >>For what it's worth, I wanted to go to MIT my sophomore year in high >>school, too > >Lucky you. It had been a dream of mine since I was an annoying >overachiever of 6. Sux to be white trash, I guess. > >MIT may be a great school, but they tend to be snooty assholes for the most >part. (DISCLAIMER: Not all MIT grads/attendees are necessarily "snooty >assholes", I'm just saying that I've yet to meet one that wasn't.) >_________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ >"He who knows, does not speak. >He who speaks, does not know." ------------------------- Washington Correspondent The Netly News Network http://netlynews.com/

2 1