December 2003 - cypherpunks-legacy

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:29 PM 12/20/1996, Bill Frantz wrote: >At 11:52 AM -0800 12/20/96, Peter Hendrickson wrote: >> If it's worthwhile having a backup processor around, then you just have >> to spend a little more to have backup software, too. > I thought your model was cheap processors and expensive software. I.e.,. > The cost of the software is greater than the cost of the hardware. Sounds > like more than just "a little more". There's no reason why one software package would cost more than the machine. I was assuming you didn't need your whole software library to finish the report. I would expect software prices to drop because everybody using the software would be paying for it. I would also expect more kinds of software to become available. At any rate, I just don't see this as a major problem. Does anybody know how often processors break down these days? My guess is that it is less common than getting into a car accident and much less common than all the other factors that make reports late. If companies started metering software, then this problem pretty much evaporates. >> If the old copy protection just worked, it would have been widely accepted. > Again, there is a complex infrastructure which offers the customer no > obvious benefit. The obvious benefit is that when you purchase software you don't have to pay for software development for the people who don't pay. Few people find this objectionable in principle. It is not out of the question for software vendors to sell two versions of the same software. One is the piracy-free version and the other is the copy-as-much-as-you-can version. I would expect the piracy-free version to be substantially cheaper. (Of course, it is not out of the question that piracy boosts sales by advertising the product. We haven't seen a good experiment for determining this.) > I disagree that copy protection would have been widely accepted, even had > it worked smoothly. In fact, this scheme can be characterized as a scheme > to make copy protection work. Your characterization is accurate. Ignoring the particulars of this scheme, it would certainly be neat if people could sell software without it being pirated. Peter Hendrickson ph(a)netcom.com

6 5

Get All The Phrack Issues
by varange＠crl.com 17 Dec '03

17 Dec '03

For a ton of (mis)information, read Phrack. Rather than downloading an issue at a time, get it all at: http://www.crl.com/~varange/maillists/phrack.zip 0d0a text formatted. If you have a lot of paper: unzip -c phrack > /dev/lp0 Or something like: pkunzip -c phrack > prn -- Cheers!

1 0

Re: Code+Data separation
by azur＠netcom.com 17 Dec '03

17 Dec '03

>At 12:08 PM -0800 12/19/96, Peter Hendrickson wrote: >>Are there any modern processors which keep the code and data separated? > A Harvard architecture is a common feature of signal processing chips. A number of japanese DSP chips (especailly for image processing) in the early 90's used this approach. I believe some earlier models in the TI 34000 series did also. Not sure about the current crop. -- Steve

1 0

Re: Credentials without Identity--Race Bits
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:34 AM 12/20/96 -0800, Tim wrote: >At 1:22 AM -0800 12/20/96, Vangelis wrote: > >Umm.. tried to get on a flight without having ID lately? Doesn't work - > >against policy. Anti-terrorism policy and all.. it's for your own > >safety, of course. >At the risk of undercutting Bill's facetiousness, this was of course >precisely his point. Yeah. I've spent most of this year going around North America on airplanes a couple of times a month. Sometimes they insist on government ID, claiming (falsely) that it's a government regulation. Other times they insist on photo ID (probably correctly) claiming it's a government regulation (usually I fly electronic-ticket, which they ask for photo-ID for, and I don't mind that.) United is almost always satisfied with my employee-ID and the credit card I used to buy the ticket with, except that they don't bother telling curbside baggage-handlers that. And that's not even counting the "You must turn on your laptop" crap. And it's PRO-terrorism policy "Be afraid! Be very afraid!" It's just not something a civilized place would do. (Of course now that Ted "Accused Unabomber" Kaczynski is in jail, the Olympics are over and it's pretty obvious that TWA 800 exploded due to bad design//////////natural causes, they really _ought_ to either give our civil rights back or else find some other excuse for it, like "heavy Christmas traffic is an attractive target". But instead they've got announcements about "suspicious packages should be reported to security checkpoints immediately" and "cars parked in the Red Zone will be towed away and detonated".) At least they weren't doing most of this paranoia when I visited my sister earlier this summer, bringing a couple pounds of Silly Putty in my luggage as presents for her kids, packed near the alarm clock.... # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 4:17 PM 12/20/1996, Andrew Loewenstern wrote: > I think this whole idea of encrypted software and processors is pretty >poorly > thought out. Thank you for this encouraging remark. > How do you handle an organization with a site license for 20,000 users of a > piece of software? Do you issue 20,000 unique copies? Yes, that would be necessary. It isn't hard to tell which executable goes with which processor. The software vendor could give away a database to do it. Or, the software vendor could put all the executables up on a web site. What's the big deal? > Do you really think the lower price of the software is going to offset > the cost of an organization to manage all those processor certificates? Yes, I do. (BTW, the software might be sold for the same price, but be better in other ways.) > Site licensed software is already about as cheap as the companies are willing > to sell it. In the current business environment. One reason site licenses are sold to companies is to make piracy less encouraging. It also solves a difficult bookkeeping problem: "How many copies are we running? Are we in compliance with the law?" Actually, site licenses don't always solve this problem, but they sort of do. We don't really know what pricing and terms would look like in a piracy-free environment, we can only guess. My guess is that preventing piracy makes more software available for better prices. If metering is feasible, it would work out very well because customers no longer have to take a chance on software and can easily explore all of the options they have. > How about the extra hard drive space you have to purchase because you can't > just keep one copy on a server anymore? Let's assume 10MB of executable code per package. A gigabyte costs about $200 now. That comes out to about $2 extra expense per software package. > Think about what a nightmare it would be to update a piece of software on > 20,000 machines simultaneously!! It's hard enough to do it now!! Whoever is doing the updating just needs to be able to quickly get the right copy. That's easy because each software module is self-identifying as is each processor. You just need to be able to go out on the Net to the software vendor or internally and ask some machine for the particular copy you need. > What happens if a software company goes out of business? You are then > completely screwed when your processor dies or becomes obsolete. This is true. Most people make their software buying decision based on what it can do now and for the next few years. I believe that is rational. > Around here we still run a few pieces of ancient hardware that were pretty > pathetic back in 1988. The software on them is critical but won't run on > anything else and there is no source code available. Believe me, nobody > here would dare to make that mistake again!!! At least with our current > situation if the hardware dies we would probably be able to find a > replacement (and I'm sure there are some replacements waiting in the stock > room...). But with your encrypted processor we couldn't even do that! Yes, it would definitely be harder to keep a code museum. People who plan on doing that are encouraged to choose another platform and software set. > It seems to me that this is yet another scheme that basically does nothing > but seriously inconvenience the software user. Much like clipper, I believe > this is a dog that won't hunt!! I find it interesting that you compare this scheme to Clipper. Judging from the tone ("!!!") of your post, there is something about my scheme which you find upsetting. People usually don't get annoyed by schemes which won't work. (Even dumb unworkable schemes are a breath of fresh air on this list right now.) What I think you really don't like about my scheme is that you think it might work and you fear various mandatory GAP proposals that could follow its wide acceptance. I would be interested to hear more about these concerns. > Perhaps instead of trying to find a way to force users into paying, software > companies should concentrate on how offer more value and make their prices > seem more attractive. These are not either/or propositions. If the decrypting processor increases the revenue of software companies, it means people can make more money providing better products to their customers. > Even with piracy, the software industry is far and away the most profitable > of all!! There is no such thing as "profitable enough." Peter Hendrickson ph(a)netcom.com

1 0

re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 16:43:37 EST, you write: << I would suppose that one could hack the code to find the counter, assuming you could decompile it (or wanted to). >> Nope. Just a good debugger (Softice... Borland..etc) And not to mention there's a billion disassemblers on the net

1 0

Re: Flying on planes without ID
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 17:23:29 EST, you write: << Anyone have the current black-letter regulations? I'll have some time to kill over the holidays that might as well be used for civil disobedience. What's likely to happen to me if I refuse to show ID? Provide invalid ID, don't get caught, then publicize the fact? Provide invalid ID and get caught? Or, better: "My wallet was stolen. The only ID I have on me is my ACLU membership card and my PGP key. Can I still get on the plane?" >> Well, something of the sort happened to me... I didn't have my ID on me. (Delta airlines..) and they _WOULD_NOT_ let me on the plane without the proper ID. I actually had lost my ID shortly before... Then... A different time at the airport.. American airlines told me that If I didn't have ID.. Id still be let on... just that the way they process my baggage would be different ( I imagine they would physically look through it... Adam

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:25 PM 12/20/1996, Andrew Loewenstern wrote: >Peter Hendrickson writes: >> I would expect software prices to drop because everybody using >> the software would be paying for it. > I don't mean to sound rude or insult you personally, but this is utterly > absurd. If everyone is paying for the software then the company would be > making even MORE money. Only a fool would want to make less money!! If >money > wasn't important to these people they wouldn't be in the business of selling > software in the first place! > Aside from putting a gun to people's heads, the only thing that lowers >prices > is competition. Yes, I was assuming a free market. Sorry if that was not clear. Not only would software companies face competition in the decrypting-processor market, but they also face competition with other packages running on other platforms. Presumably customers would need some sort of reason to use the decrypting-processor. Some companies may choose lower price. > Only a fool would want to make less money!! I agree completely! >> It is not out of the question for software vendors to sell >> two versions of the same software. One is the piracy-free >> version and the other is the copy-as-much-as-you-can version. >> I would expect the piracy-free version to be substantially >> cheaper. > That would render the entire scheme pointless. It only takes _____ONE_____ > copy of the software to get out for the whole world to pirate it. This was discussed a few posts back. Let's say you manage to get the secret key out of the decrypting-processor. That gives you the executable which could run on any decrypting-processor. Since it is not authenticated (*) you can't run it on another decrypting-processor. You can run it in emulation someplace else, but a heavy performance price is paid. If the leading edge processors are all decrypting-processors, a very heavy performance price is paid. If the instruction set is kept secret, even writing an emulator could become hard. (* I am being inconsistent, incidentally. At one point I said that software would be authenticated once, but I now realize that to prevent multiple uses it has to be authenticated for use on a particular processor, too.) Peter Hendrickson ph(a)netcom.com

1 0

van Eck snooping
by azur＠netcom.com 17 Dec '03

17 Dec '03

I've done some experimentation in this area. It is not possible to use a VCR in a simplified manner anymore as all recent computer CRTs are no longer use a 60 Hz half-frame, interlaced, format. Reductions in radiated emissions, per FCC Part 15, since the earlt 80's have significantly raised the bar for remote monitoring (still possible though). -- Steve

1 0

Re: Credentials without Identity--Race Bits
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

aaron(a)herringn.com wrote: >Flew down to LA recently with a firearm (checked, of course). > >Looking over the ticket later, I was mildly surprised to find "GUN" in >a string of otherwise unintelligible text. This is a case of damned if you do, damned if you don't. The last time that I declared (as the legal notices at the check-in podium admonished me to do) a firearm in my luggage, my bag sported a large, chromium yellow GUN tag that also featured a graphic representation of a pistol (I guess for baggage handlers who can't read, or can't read English, and would still like to take advantage of one of the perks of their position).

2 1