December 2003 - cypherpunks-legacy

Re: Recommendation: Creation of "alt.cypherpunks"
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Dale Thorn wrote: > Igor Chudov @ home wrote: > > Dr.Dimitri Vulis KOTM wrote: > > > "Timothy C. May" <tcmay(a)got.net> writes: > > > > At 1:20 PM -0600 2/11/97, Igor Chudov @ home wrote: > > > > >If the people decide for creation of a new USENET newsgroup, > > > > >we need to think very hard about actually moving it to a different > > > > >hierarchy from alt.*. I would propose comp.org.cypherpunks, > > > > >comp.cypherpunks, sci.crypt.cypherpunks or something like that. > > > It is too late to stop alt.cypherpunks, but if I had to make a > > prediction again, I would predict that soon posters will BEG to help > > them create comp.*.cypherpunks, because of spam and alt.flamage. > > I would lean toward sci.crypt.cypherpunks myself. Are there any > implications in the use of that name as to restrictions, etc.? > Not really. All you have to do is to go through a formal newsgroup creation process, post a RFD, second RFD, a CFV, and supposedly impartial votetakers will record the votes. You must get > 100 votes YES, and the number of YES votes should be more than twice (thrice?) the number of NO votes. - Igor.

1 0

Security (Re: Encryption for DNS registration)
by Bill Stewart 17 Dec '03

17 Dec '03

Donald Eastlake posted this on the IAHC-discuss list. Cool stuff. >Date: Wed, 12 Feb 1997 10:14:05 -0500 (EST) >From: "Donald E. Eastlake 3rd" <dee(a)cybercash.com> >To: iahc-discuss(a)iahc.org >Subject: Security (Re: Encryption for DNS registration) > >People may want to note that yesterday (Feb 11th) the IESG approved the DNS >dynamic update and DNS secure dynamic update (draft-ietf-dnssec-update-04.txt >and draft-ietf-dnsind-dynDNS-11.txt) as Proposed Standards. The base DNS >security protocol was approved some time ago and is now out as RFC 2065. TIS >is working on a government funded implementation which will be in the public >domain (http://www.tis.com/docs/research/network/dns.html) Their current >Beta implementation of the base DNS security has been approved for export. I >believe there is an independent implementation effort underway at Microsoft. > >While this was primarily motived by wanting to be able to securely do dynamic >updates of the DNS in connection with DHCP, it is a general facility and >could be one element of securely implenmeting a shared TLD. You would, >however, still need a way of sending general authenticated messages. PGP >seems like an excellent candidate for this as it is the de-facto standard >available world wide. > >Donald [ quotes from previous messages deleted -- Bill ] >===================================================================== >Donald E. Eastlake 3rd +1 508-287-4877(tel) dee(a)cybercash.com > 318 Acton Street +1 508-371-7148(fax) dee(a)world.std.com >Carlisle, MA 01741 USA +1 703-620-4200(main office, Reston, VA) >http://www.cybercash.com http://www.eff.org/blueribbon.html > > >

1 0

Private property & the cypherpunks list(s)
by Greg Broiles 17 Dec '03

17 Dec '03

(Readers curious about Jim Choate's list ownership/acceptable use policies might take a look at <http://www.ssz.com/ssz/conditions.html>.) Jim Choate wrote: > Please explain how making submissions de facto public domain censors > anyone? What the fuck is "de facto public domain"? It's public domain, or it's not. Your scheme imposes a cost (loss of intellectual property rights) against authors who would like to make themselves heard. It also prevents a certain class of messages (those messages whose status is "copyright claimed") from being distributed. Further, your suggestion that posters be required to include a "fair use header" is compelled speech. That's three flavors of "censorship" right there. I thought that the new list(s) were supposed to allow anyone to say anything they wanted. (Does "no fair use" count as a "fair use header"? It's not legally enforceable, but it seems like the easiest way to specify "minimum fair use required by law". If not, are you planning to moderate the list to make sure that people use only approved fair use headers? Hmm.) Even if the "copyright abandonment by implication" trick works (and I suspect it will not, given that an assignment or transfer of copyright must be in writing, 17 USC 204; and abandonment is essentially an assignment or transfer to the public domain), it will not apply to all text sent to the list. A person cannot abandon or assign something they do not have; so if someone sends a message to the list which contains text whose copyright is held by a third party, that copyright will still be valid. So what you've got is a list where you can't be sure that its contents are public domain, and a draconian rule requiring authors to give up their rights to what they've written. Do you imagine that all of the many-majordomo servers will implement your "public domain only" rule, or only yours? If the rule only applies to the ssz.com version, what's the point? If the rule is intended to apply to all servers, and servers aren't going to be allowed into the network without agreeing to implement it locally, um, tell me again about that "free speech" thing? Aren't you just taking advantage of your position as a person working on the many-majordomos project to impose your ideas about intellectual property on the rest of the list? Is such a strategy compatible with "free speech"? Also, how could a rule like this possibly be compatible with a Usenet gateway? There's no chance at all that you can expand a local rule on your system to all of Usenet through a gateway. And Declan McCullagh wrote: >I forward articles to cypherpunks that are copyrighted by my employers, or >magazines like Playboy and Wired for which I write freelance pieces. > >I like to think these articles have some value. I will not forward any of >them, nor would I be able to, if they magically became "public domain." Which are good points - also, don't forget that, from time to time, people have even posted code to the cpunks list, and many software authors like to retain copyright in their code so that they can insist on things like noncommercial distribtion or credit where the code is reused. If a work is truly "public domain", the author has no power to insist on those things. This proposed rule seems to limit postings to those which are perceived by their authors to be without commercial or reputational value. Is that a good idea? -- Greg Broiles | US crypto export control policy gbroiles(a)netbox.com | in a nutshell: http://www.io.com/~gbroiles | Export jobs, not crypto.

1 0

Re: anonymity and e-cash
by Hal Finney 17 Dec '03

17 Dec '03

From: Sean Roach <roach_s(a)alph.swosu.edu> > Here is another idea. > The merchant and customer agree on a price, with the merchant knowing that > the "bank" will take a cut for their services. > The merchant and customer both LOG IN to the bank seperately, each type in > their agreed upon price and cut & paste in the services rendered > information. If they match, the bank makes the necessary transaction > between the accounts, e-cash stash, etc. This provides no anonymity with respect to the bank, right? The bank knows who is paying whom. That's not very valuable IMO. The bank is still a centralized place where all this transaction information exists, a fat target for privacy opponents. I'd say that anonymity to the bank is more important than anonymity to the merchant for this reason. So I think you're going at this backwards. > Another idea that has been festering. If we could get a CPA involved in > this forum, I would be willing to have h[im/er] sign my key, (which is > seldom used, mostly because this is the only place I use e-mail), for that > reasonable fee that CPA's can charge. I know that it is not a standard, or > even legally recognized, post for CPA's, but I think that enough people > would trust them. The big question with identity certificates is what procedures were followed in verifying the identity when the cert was issued. If the CPA publishes some standard method, and his reputation is strong enough that people will trust him to follow it, then it might well be worth money to you to have him sign it. This is the traditional role of the Certification Authority. > This would take care of some of the "newly minted" key problems. Since > getting someone who is trusted to sign your key is a recognized method of > getting people to believe you are who you say you are. It depends on the circumstances where you expect to use your key. Within a small to medium circle of associates there may be some group members who sign keys and are trusted by other members of the group. There is no particular reason for it to be difficult. If you want a signature which will be accepted by everyone in the U.S. you have a harder problem. Hal

1 0

Re: 40-bit RC5 crack meaningless??
by ca3sal＠isis.sunderland.ac.uk 17 Dec '03

17 Dec '03

Strassmann wrote: >In summary: The claim of exportable cryptography being totally >insecure, because it can be cracked in 3.5 hours is not >realistic. The three clues announced in the contest >would not apply under infowar conditions. As the UK gets a lot of desktop PC software from the US, ie MS & Lotus we unfouantly have to live with the 40-bit limit. What the RSA Chalange and Ian Goldberg have achived is a couple of aritcales in the broad sheet papers http://www.telegraph.co.uk:80/et?ac=000145546611023&rtmo=33032622&atmo=3303… P4_FOLLOW_ON=/97/2/4/ecfilm04.html&pg=/et/97/2/4/ecfilm04.html (ouch) and http://go2.guardian.co.uk/archive.html The competion has shown to the general populs and not just "experts" what a crap deal were getting. Three and half hours gets people thinking. Ste

1 0

Re: 40-bit RC5 crack meaningless??
by Stephen.George.Allport 17 Dec '03

17 Dec '03

Strassmann wrote: >In summary: The claim of exportable cryptography being totally >insecure, because it can be cracked in 3.5 hours is not >realistic. The three clues announced in the contest >would not apply under infowar conditions. As the UK gets a lot of desktop PC software from the US, ie MS & Lotus we unfouantly have to live with the 40-bit limit. What the RSA Chalange and Ian Goldberg have achived is a couple of aritcales in the broad sheet papers http://www.telegraph.co.uk:80/et?ac=000145546611023&rtmo=33032622&atmo=3303… P4_FOLLOW_ON=/97/2/4/ecfilm04.html&pg=/et/97/2/4/ecfilm04.html (ouch) and http://go2.guardian.co.uk/archive.html The competion has shown to the general populs and not just "experts" what a crap deal were getting. Three and half hours gets people thinking. Ste

1 0

Re: Moderation experiment almost over; "put up or shut u
by chefren 17 Dec '03

17 Dec '03

On 11 Feb 97 at 3:54, John Gilmore wrote: > I've come to the conclusion that I'm not willing to host the > cypherpunks list any more. It's not the true assholes that brought me > to this decision; it's the reaction from the bulk of people on the > list: suspicion, flamage, and criticism with every attempt to improve > things. I noticed few people volunteering some of their own time, > money, or machines to help out. Almost all the suggestions were > advice for *other* people to implement: Hm... In the year 1513 or 1514 someone who could be an Honourable Member of this list (if one could be one...) wrote: > There is nothing more difficult to take in hand, more > perilous to conduct, or more uncertain in its success, > than to take the lead in the introduction of a new order > of things. <Niccolo Machiavelli, Il Principe> Please stop at looking too much on how people scream about your new ideas and continue this list the way you like it!!! I think it's Your Machine and we have to respect your decision to pull the plug, nobody should blame you for that, but please listen a little to the 1000+ people who don't scream and are obviously happy with the list and respected your right to do the "sandy filter experiment". +++chefren

1 0

Remailer Network Under Attack
by Wazoo MixMaster 17 Dec '03

17 Dec '03

It looks like a new round of attacks against the remailer network is underway. Once again, the provocation is "abuse". Unknown persons have been using anonymous remailers and mail2news gateways to "plant" e-mail addresses in various NGs for the spam-bots to harvest and deluge with spam. The original intention appears to have been to "poison the well" for spammers by planting addresses that they'd get in trouble for sending their junk mail to. It appears that one or more copy-cats is now using the same methodology to plant the addresses of people who they'd like to see spammed. (I'm using the term "plant" rather than "forge" since the messages seem to contain sufficient disclaimers that the From: addresses are not genuine. Sufficient for a normal HUMAN reader, but not an automated address harvester, that is.) Within the last week or so, a chorus of complaints has arisen about this practice, orchestrated by about a half dozen individuals who meet an interesting criteria -- they all hold dual accounts on both Netcom and a small ISP known as DataBasix.com. The scenario is quite similar each time this has happened in the past, such as with the cross-posted pro-smoking/anti-smoking threads last year. One of the complainers politely asks that the abusers be identified and their abuse stop. This is, of course, impossible because the perpetrators are posting anonymously. The second step, which follows the first very closely, is a demand that the remailer be shut down with threats being CCed to sysadmins and upstream providers. Given the variety of addresses being "spam baited", the only logical target of this abuse is the remailers themselves. Both sides of certain heated controversies report being made the target of this spam bait, each side accusing the other of being responsible. The only question is whether the main group of complainers (the Netcom/DataBasix group) are merely innocent bystanders or whether they may have initiated the "abuse" as an excuse to shut down the remailers in furtherance of some unknown agenda. Either that, or someone else is attacking the remailer net and it's just a coincidence that a group fitting such a curious pattern (dual accounts on the same two ISPs) should step in and demand the dismantling of several elements of the remailer/m2n-gateway infrastructure. HYPOTHETICAL QUESTION: Would mentioning the "Reichstag Fire" invoke Godwin's Law prematurely? <g>

2 1

Re: How to make majordomo request confirmations of subscriptions?
by Michael H. Warfield 17 Dec '03

17 Dec '03

ichudov(a)algebra.com enscribed thusly: > Hi All, > I would like to set up my majordomo to request subscription > confirmations from users, by sending them a cookie. Looking at the > majordomo config files, I have not found such option. Majordomo 1.94 and above... subscribe_policy = open+confirm Last I looked, majordomo does not have subscription expirations or periodic confirmations. A couple of months ago someone else on a large mailing list I help run suggested a package that would periodically mail a bounce probe. The probe would have explicit instructions to do NOTHING if you wanted to remain on the list, just ignore the message. If the message came back, due to an E-Mail bounce, vacation program, or someone who decided they didn't want to remain on the list after all, you toasted them off. Sort of an inverse confirmation message. I lost the message about the package before I could find it. It sounds like a great compliment to majordomo. Maybe should be another feature for majordomo? Anyone who has heard of this add-on, let me know. I'm still looking for it. > Ideally I would like to have a system that a) requires the > new users confirm new subscriptions and b) once in a while > as users to confirm their existing subscriptions. The instruction which go back with the job results and the confirmation need to be beefed up. I've had a lot of subscribers get "confused" when their STUPID windows mailer breaks their "auth" message into two lines and majordomo refuses to recognize it. Forwarding the confirmation message back or "replying" to it tend to screw up big time, so I modified the message in my version to instruct users to "create a new message with this line as the only line in the body". It's cut down on the screwed up subscriptions immensely. Majordomo also needs to be enhanced a bit to flush out bits and pieces of floatsam in the E-Mail address that are not valid E-Mail addresses... Example: "Michael H. Warfield" <mhw(a)wittsend.com> would result in messages going back to Michael, H., and Warfield, as well as mhw(a)wittsend.com. I'm planning on cleaning out any whitespace separated tokens which do not contain an embedded "@" followed by a least one "." and ending with an alpha or a ".". That's on my to-do list for this week or next... Along with upgrading to 1.94.1. > Is there any way to do it? > Thank you. > - Igor. > -- Michael H. Warfield | (770) 985-6132 | mhw(a)WittsEnd.com (The Mad Wizard) | (770) 925-8248 | http://www.wittsend.com/mhw/ NIC whois: MHW9 | An optimist believes we live in the best of all PGP Key: 0xDF1DD471 | possible worlds. A pessimist is sure of it!

1 0

Openmarket/128 bit export?
by Adam Shostack 17 Dec '03

17 Dec '03

Just saw a newswire about Openmarket exporting 128 bit ssl for OM-Transact. Anyone have any details? Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0