December 2003 - cypherpunks-legacy

Re: Unix User Password File Encryption
by Three Blind Mice 17 Dec '03

17 Dec '03

On Sat, 2 Nov 1996, Erp wrote: > Compare the outcomed encryptions -- And find a pattern in them.. Now in There is the flaw in this logic. If you do find a pattern, then this means that the algorithm is *BROKEN*. --3bmice

1 0

Re: Dr. Vulis is not on cypherpunks any more
by Computer Virus Help Desk 17 Dec '03

17 Dec '03

At 10:34 AM 11/2/96 -0800, you wrote: >At 02:13 AM 11/2/96 -0800, John Gilmore <gnu(a)toad.com> wrote: >>As stated by Dr. Vulis, he is no longer on the cypherpunks mailing >>list, and indeed majordomo(a)toad.com HAS been instructed to ignore his >>requests to resubscribe. >>I removed him, on my own initiative. I got tired of asking him to >>stop stirring up flames. When he posted a message saying that we'd >>have to use technical means to stop him from flaming the list, I said, >>"OK". >[snip] >This all seems really silly to me. >Are people on this list not sophisticated enough to be capable of filtering >his posts if they don't like to read them? > >What's to stop him from using reailers or nymservers? Are you going to >block them, too? > >By doing something like this you give him far more attention and >encouragement than he deserves. It's a big mistake, IMHO. >Rich Well put! I tired a long time ago of Dr. Vulis and several others on this list. Rather than bitch about it or resort to the same big brother gestapo-censor bullshit we profess to abhor I simply utilized the extensive filtering capability of Eudora. I don't need "big brother" or big "cypherpunk" censoring my mail for me. We have become what we fear the most. How prophetic and pathetic. I agree.... a very BIG mistake, indeed....

1 0

Re: Censorship on cypherpunks
by Will French 17 Dec '03

17 Dec '03

> It's only authoritarianism if the government is involved. > Clearly, the government isn't involved in this matter. Until now, I'd considered the list as a model of a libertarian society, with the listowner as the government. My point is that if a mailing list (where physical force is generally not a factor) can't be run without arbitrary sanctions against members, how could anyone ever hope for a whole society, with a real, gun-toting government, to run that way? Will French <wfrench(a)interport.net>

4 4

Re: Dr. Vulis is not on cypherpunks any more
by Rich Burroughs 17 Dec '03

17 Dec '03

At 03:52 PM 11/2/96 -0800, Sandy Sandfort <sandfort(a)crl.com> wrote: >On Sat, 2 Nov 1996, Rich Burroughs wrote: > >> Are people on this list not sophisticated enough to be capable >> of filtering his posts if they don't like to read them? > >The short answer is, No. More specifically, we constantly have >a stream of new readers sampling Cypherpunks. Some are >technically sophisticated; some are not. I am guessing that people who come to read cpunks are probably more likely to have a grasp of filtering technologies than the average Net newbie. I may be mistaken. >In either case, new >readers do not have the historical perspective not to fall for >Dimitri's big lies. Is telling the truth a requirement for participating on the list? ;) How about posting a mini-FAQ about Dimitri or something? Responding to speech you dislike with more speech? >Nor do they have any way of know what an >abberation his sort of behavior is on this list. I think you underestimate people's ability to evaluate the situation. You mean well, but this type of paternal, well-meaning censorship is censorship nonetheless. (I know this isn't censorship in the strictest definition of the term, as in government restriction of speech, but I'd like to see us err on the side of keeping the forum as open as possible. YMMV.) >"So this is >what Cypherpunks are like," would be a sad, but understandable >misinterpretation of what we're all about. Judging any Usenet newsgroup or mailing list based on it's kookiest member could produce the same result. I'm relying on people to be able to pick a kook out of a crowd. Would you prefer that the representation that people get of Cypherpunks be of a group that kicks people off the list who disturb them? Are Cypherpunks that thin-skinned? I have never been forced to read one of the KOTM's messages -- it has always been my choice to. After the last Bernstein hearing, Tim and I ended up at the same table for lunch, along with two other people. The four of us began discussing Scientology, and partway through the conversation I realized that the Tim I was talking with was Tim May, and that we had already covered some of the same ground on this list. Tim was very persuasive in his view that the Scientologists should be given the widest latitude to spread their views, and that their right to speak be guaranteed. While I consider myself a free speech advocate, I am not an absolutist, and I loathe the CoS leadership. I was much more equivocal about their rights. As the conversation went on, I found my self more and more drawn in by Tim's arguments, as they were very much in line with my feelings on other speech-related issues. I found his points very persuasive, and they have had a lasting impact on my view of the situation, and my posts to alt.religion.scientology. I find it ironic to see someone kicked off a list for bad-mouthing Tim, who I found to be a very eloquent defender of free speech. > What John did was >appropriate. I still think it's a big mistake. How can you really keep him off the list? Limit posting to subscribers? Ban remailers and nym accounts? Don't you think he'll try to make himself a martyr; a victim? Will that make Cypherpunks look better? Rich

1 0

Very Preliminary release of IPSEC code for Linux (fwd)
by Mark M. 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 01 Nov 1996 01:32:11 +0200 From: John Ioannidis <ji(a)hol.gr> To: ipsec(a)TIS.COM Subject: Very Preliminary release of IPSEC code for Linux -----BEGIN PGP SIGNED MESSAGE----- Content-Type: text/plain; charset=us-ascii Greetings! The Linux IPSP implementation I have been working on lately is finally at a stage where it can benefit from feedback, and also where other may also benefit from it. This is NOT an untar-and-play release; far from it. It is being made available so that it can reach the UnP stage faster than if only I work on it. The code compiles into a loadable module for the 2.0.xx (I'm running 2.0.24) kernel. Use at your own risk. I won't be held responsible even if it mails the contents of your filesystems to the NSA and the KGB (or whatever), and then proceeds to encrypt them :-) The gzip-ed tar file is in: http://prometheus.hol.gr/~ji/ipsec-0.2.tar.gz If you want to mirror it to your ftp site, please drop me a note. Enjoy! /ji -----BEGIN PGP SIGNATURE----- Version: 2.6.i iQCVAgUBMnk2+c+A0YctPurVAQFSSAQAkt6e6a8TiYNcZ0rcLnxzIjm3uUTyYP3W sUaM9hkMYsDbePdc/O9GoA5Q/HnAg4/BNl+Tla1Os72NCq+uDZX2gDnlUFktnd9b q3S961FIL+ilmV0TepmQGGImjXPpThWMg4FKK7bhaiymcepJ7xs43sJoFEfkQ+uZ iUxTEo2j1Ro= =ztQp -----END PGP SIGNATURE-----

1 0

Re: Computer Security Risk Assessment Software?
by Frank Willoughby 17 Dec '03

17 Dec '03

At 05:44 PM 11/1/96 -0800, Dale Thorn <dthorn(a)gte.net> allegedly wrote: >Frank Willoughby wrote: >> The solutions to the above-mentioned problems are: >> Shop around. Find out which consultants are qualified and what they charge. >> Make sure the consultant caps his cost. You should know the maximum price tag >> associated with the consulting engagement BEFORE the consultant walks in the front >> door. This helps to avoid having the consultant camp on your doorstep at $XXX >> dollars per hour for days, weeks, or months on end. > >The above is a nice ideal. You should of course get a "really good" consultant, >and even better, get one who's "real honest". But my guess is those guys cost the >most of all, or at the very least, require the most research to find. Good point. To help establish the honesty, it wouldn't hurt to get personal and business references. It also wouldn't hurt to check the BBB (Better Business Bureau - a consumer rights group) to see if there are any complaints against the company. Ideally, the consultanting company would also be in the BBB's Care program which means that they will submit to binding arbitration in the event of a disagreement. (BTW, the BBB also investigates all claims to weed out claims made by one competitor against another, etc.). >The ideal of capping the cost is commendable as well, however, when the consultant >finds midway through the project that his initial estimate (made as carefully as he >possibly can) is way too low, he will now have an incentive to lie, cut corners,etc., >*particularly* if the customer looks like one of those antsy types who might withhold >payments and so on. Depends on the consulting company. It is also a good measure which can be used to separate the weasels from the good guys. The weasels will do exactly what you said. The good guys won't. Granted that once in a while, there will be a contract which will have some surprises in it and you - won't make as much money as you were supposed to. IMHO, this is a part of doing business. Usually, you will win, but once in a while you will lose. These things will happen. Learn what went wrong and take steps to make sure it doesn't happen again. Then go back to succeeding. BTW, I think it is the customer's right to withhold payments until the job has been performed to the customer's satisfaction. >My advice: Get a consultant to find a good IT consultant. Seriously. If you have the money to spend, this may be a good idea. Personally, I would tend to separate IT consultants from InfoSec consultants. InfoSec is a highly specialized field & seasoned InfoSec Officers don't exactly grow on trees (as companies who don't have one and are trying desparately to find one will testify). Seasoned InfoSec Officers who are consulting for customers are even rarer, but I would rather have that to have the security of my corporation depend on an IT consultant who has never had any experience working as an Information Security Officer (who has successfully implemented Information Security in a real business environment). There is no substitute for experience, IMHO. Food for thought. Best Regards, Frank Any sufficiently advanced bug is indistinguishable from a feature. -- Rich Kulawiec <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Information Security Consulting http://www.fortified.com Phone: (317) 573-0800 FAX: (317) 573-0817 Home of the Free Internet Firewall Evaluation Checklist

2 1

Compromise proposal
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

[this goes to cypherpunks(a)toad.com and freedom-knights(a)jetcafe.org. I am not reading f-k, but I am interested in Dave Hayes's opinion.] Hi, I am not normally considered an ally of Dimitri Vulis, so let this be an attempt at being impartial. Many members of cypherpunks list are right when they oppose the forced unsubscription of Dimitri Vulis from this list. The sorry state of this list is not the result of his flames alone, there is a large number of people who discuss things of no cryptographic relevance. We should remember that besides flames and scandals, Vulis has been posting things that are most relevant to this list's topic. We should also remember that individuals have the right and responsibility to define what content they want to see and what content they do not want to see. I am surprised at libertarians putting forward propositions that are intended to promote welfare of "new subscribers" and try to shield them from "lies". Similarly, individuals are free to create voluntary moderated associations as they see fit. As it was created, this mailing list was not a moderated association. At the same time, unfortunately, flames that Dimitri generated had rendered previously 80% unusable list to be 99% unusable. These flames had zero value for me personally. Since cypherpunks is a private list (although it used to be unmoderated), I can understand the list owner who wants to save his creature from total destruction. I propose the following: 1) The block on Dimitri Vulis's subscriptions should be removed 2) We should not impose any limitations on anyone's speech except 3) 3) Dimitri and everyone else should put prefix "[FLAME]" into all Subject: header fields of their flame-related messages. 4) The sole discretion of determining what is flame and what is not should be exercised by John Gilmore. His definition of "flame" can be as broad as reasonably necessary. 5) John Gilmore should have the right to forsibly unsubscribe, for a period not exceeding two months, anyone who posts flames and does not use the right prefix. 6) Cypherpunks list owner shall have the right to install any filters he considers necessary in order to catch and review any messages before they go to all subscribers, solely in order to verify their compliance with item 3). Messages that do not comply may be rejected and their authors can be unsubscribed, as defined in 5). This solution will allow anyone with a clue to use appropriate filtering and improve the signal-noise ratio, and at the same time will not in any way limit anyone's freedom of speech. I am also eagerly awaiting when Perry creates a moderated cypherpunks list. - Igor.

1 0

Telling quote from Bernstein hearing
by Lucky Green 17 Dec '03

17 Dec '03

In the recent hearing of the Bernstein case, Anthony Coppolino for the Justice Department said: "We don't care about the theory; we don't care about the idea Mr. Bernstein has, which was to take a particular type of algorithm and use it to allow for an encrypted interactive conversation. That's his idea. We don't care about his idea; we care about the result of what it can do." http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/Legal/ 960920.transcript Encrypted interactive conversations seem to be something to be concerned about...They are afraid of us. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

4 3

Re: Discrete logs 1 [non-cryptography related annecdote]
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 31 Oct 1996 09:16:26 -0800, Hal Finney wrote: >properties than regular logarithms, but I thought this bit of history >would spark some memories in old-timers and give a new perspective for >younger people. It's kind of funny how quickly they dropped out of usage. I'm probably one of the estimated 7 people under the age of 30 who actually know how to use one. (Long story - it involves a couple months in a math class w/o a decent calculator) I was in an Algebra class taught by 'Father Time' - interesting facial expression when he first noticed my 'calculator' (similar to the one he got when I blurted out the [correct] answer to a problem he'd been explaining while I was reading a book and ignoring him - in retrospect, RAH was more educational). We had to take some sort of state math test and I had just gotten my new programable graphing calculator a week or two before (more lost sleep - with a little creativity and a boring class you can get some interesting code on those thingies) but for some reason I decided to bring both calculator (the allowability of which was highly suspect) and sliderule. The proctor saw me and had a major fit -- over the sliderule! Yeap, in the state of California they don't let algebra students use a sliderule to 'cheat' on the assessment test. They do, however, allow you to use a modern graphing calculator with programs and an equation solver (Did I mention the optional IR link?). The same thing goes on with SATs and especially SAT-IIs. Some higher-end calculators, esp. HPs, have plugin cartridges which automate much of the basic work in chemistry, physics, etc. I never saw anyone who used such things even get asked about it. Do we even need social engineering with people this stupid? # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

Re: FDA_dis
by Murray Hayes 17 Dec '03

17 Dec '03

On Tue, 29 Oct 1996 17:51:56 -0500, Hallam-Baker wrote: >Declan McCullagh wrote: >> >> I'll have to reread John's piece tomorrow (I'm on vacation right now), but >> it doesn't surprise me. He and I have been arguing about this topic via >> email for the last week or so. He takes the traditional liberal view of >> government regulation of drugs is necessary; I take the more libertarian one. >> >> The Cato Institute, BTW, will be putting together a roundtable on this soon. >> >> -Declan > >Characterising this as the "traditional liberal view" is somewhat >misleading, >its not as if Bob Dole or Newt Gingrich would disagree much. The >argument is >more over which special interest group is to be advantaged by changes in >regulation. If I was a citizen of a country where the government was >elected >by a billion dollars of corporate contributions I might be a >libertarian. Are you saying that you are anti-corporation? That would make no sense. Many corporations are very benificial to society. Take Shell for example. It did all that it could to save the life of that guy in Nigeria, but the "libertarians" who instantly boycotted Shell would have you belive that they encouraged the sentence. >Its important to remember that its the World Wide Web and not simply >limited >to the US. As long as US companies set up subsidiaries in Europe they >will be constrained by European law. In the net.age law is becomming a >major >export for many countries. What is becoming a major export? Weak laws? Why would a country encourage criminals to come to it's boarders? >Regulation is not necessarily anti-commerce. UK beef farmers would be >better >off today if there had been more regulation, a weak "free-market" >attitude >to public health has destroyed the entire industry. I don't think you have analysed the situation. It was the regulating that deystroyed the UK cattel industry and put the entire world at risk. The British government protected the beef industry despite a ban on British beef accross Europe. If Eroupe is considered to be the "Free Market" as you suggest, then it would be exactly opposite to what you have suggested. The "Free Market" labled the animals coming from Britian to be of questionable quality. The regualtors in Britian disaggreed because it would cost them a few penny's to slauter the infected heards. Then Britians started getting sick. The rest of the world throws up bans of British beef; Yet the British regulators still do not cleanse the heards. The only way to ensure the desease is gone is to kill every last cow in Britian and bring in fresh stock. THAT MEANS NO GIVING THEM TO INDIA YOU STUPID FUCKS. It is often in a >companies >commercial interest to voluntarily agree to be regulated. Microsoft >recently >signed an agreement to be bound by the European computer privacy >regulations >because by doing so they gained a business advantage - people would >trust >them with their data. This is another interesting point. Why is it better for a company to agree to any regulation? Do you REALLY trust Microsoft? I do not. They write poor code. They probably signed the aggreement because they knew that there product was so bad that it couldn't violate any restrictions or they contracted the work out to the NSA who wrote the code for them and so they know that it can be cracked if they need to track down every last copy of the OS for their marketing group to do a statistical analysis on. > >Much of the advertising regulation being discussed is private, agreement >on >standard formats for image placements for example. There is existing >government >regulation of advertising in many countries however. In particular much >stricter control over advertising of drugs, making misleading statements >in >advertising and so on.In the UK there is regulation of advertising >through >the advertising standards council which is a voluntary body in the sense >that it has no statutory enforcement powers but has practical authority >because the publishers will not publishe ads that fall foul of its >decisions. I belive that this is the GOVERNMENT body called the BBC. We have a similary group up here called the Communist Broadcast Corporation. Actually, I must be fair to them, I do like Air Farce. I don't think your argument holds any water. Different cultures have different social norms. I was quite shocked to see John Clease stark f**king naked on a tea commercial (isn't tea a carrier of caffine? yes. Does caffine change the way in which you body works? yes. Is caffine food? no; therefore caffine is a drug and tea carries that drug.) > >A more serious problem however is likely to be dramatically different >cultural norms. In the US people expect to be lied to in adverts. In >countries >where there is regulation of advertising there is a general expectation >for comparisons to be fair and for ads to be truthful. I'm just waiting >for a major corporation to create an Intel scale PR disaster by applying >sleasly US style marketing techniques in markets where the downside is >very large. One recent example is Hoover which had a $30 odd million >debacle over a "free flights" giveaway that was based on sleasly US >style >marketing techniques. The company ended up having to live up to the >spirit of its offer rather than the letter as it intended simply to >preserve the value of the brand. So? All this proves is that the US is more oreiented toward the free market than other places. In the free market, on's "brand value" is incredibly important. I think you are also missing the distinction between a company and it's marketing. I'm sure Hoover, as in your example, has many marketing camnpaines going on at any time and that every so often an overeager director of the comapany that Hoover hired to do the campain makes a mistake. I'm sure this happens all the time, just take a look at another marketing company: Microsoft. > >If you don't believe in anti trust laws there is no basis on which you >can object to the sort of regulation by cabal that the advertising >standards council represents. Of course such cabals cannot exist in the >libertarian belief system since their existence is denied a-priori >by invoking the spirit of Milton Freedman. Milton Freedmen is of course >a rightwing ecconomist whose theories are widely admired by free >market ecconomists who admire Mitlon Freedman. Does that mean a libertarian is more Free Market oriented or more Command Market oriented? I'm not sure there is any correlation at all. I belive in anti trust laws, does that mean I can object to regualtions? mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

3 2