December 2003 - cypherpunks-legacy

Re: Finjan "SurfinGate"
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Thu, 21 Nov 1996 12:10:51 -0600, Mike McNally wrote: >Check out http://www.finjan.com and the stuff about "SurfinGate". The >software supposedly can perform an on-the-fly inspection of a Java >applet or ActiveX control, and then apply a signature to it along with >a "safety" level qualifier to feed into a configurable policy mechanism. > >Any ideas as to how you can look at an ActiveX control and determine >whether it's safe or not? You can't. Anyone who claims to be able to do so is betting their scanning ability against the collective programming skill of hundreds of brilliant-but-twisted programmers/hackers. Remember CHK4BOMB? The old DOS program that would dump strings from an EXE so you could look for things like "Happy birthday yoshi"? They started encrypting and adding polymorphing and stealthing and . . . Now you could write a program that would scan for more 'obvious' attacks but it will probably be a continual catch-up game. You don't even have the ability to do checksumming of existing files (like you do w/virii). # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Database law... silver lining??
by Greg Broiles 17 Dec '03

17 Dec '03

At 04:44 AM 11/22/96 GMT, you wrote: >Real-To: "Richard L. Field" <field(a)pipeline.com> > > Should a database protection law such as HT 3531 be enacted in the U.S., >it just may turn out to be the best weapon yet for the protection of >personal data. Why shouldn't a "database" be interpreted to include an >individual's personal data? All that is required is that it be "arranged in >a systematic or methodical way". Heck, that's not so hard. And a "database >maker" isn't necessarily Lexis (the compiler of P-TRAK) and friends, it is >each individual who originally made a "substantive" (i.e., lifetime) >investment in the collection of the contents of his personal database. Cute, but any such proposal is almost guaranteed to allow for independent creation from a non-database source - e.g., warranty cards, info extracted from you when you ask for credit, public records, etc. For example, one comment to Article 3 of the proposed WIPO treaty on sui generis protection of databases provides: "3.02 The protection provided does not preclude any person from independently collecting, assembling or compiling works, data or materials from any source other than a protected database." (see <http://www.loc.gov/copyright/wipo6.html> for more.) It's very unlikely that Congress (or the PTO) intends to do anything that'll screw up what's already working well for big database publishers. Your theory is similar to a patent flavor for databases, while the proposals floated out so far are much more like copyright - e.g., independent creation is OK, but copying is not, even with wide public distribution, and long protection times. With patent, independent creation is not OK, copying (the information, not the device) is encouraged/allowed, and protection time is short. [Friday, 11/22, is the deadline to submit comments to the PTO asking them to withdraw consideration of the WIPO database treaty from the conference in Geneva. (Or encouraging them to submit it, if that's your opinion.) Comments can be sent to Mr. Keith Kupferschmid at diploconf(a)uspto.gov.) -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

re: sci fi
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:50 PM 11/21/96 -0800, John Anonymous MacDonald wrote: >Without a doubt contemporary SciFi authors such as Vinge and Stephenson have produced >great thought provoking works. Always a good read. > >But sometimes I'm drawn back to the rollicking rampages of EE Doc Smith or the playful >frollicks of Harry Harrison. While not presenting a plausible vision of our future >they do offer a significant amount of enjoyment. Pure brain candy! For absolute brain candy, I recommend "Star Smashers of the Galaxy Rangers". EE.Doc Smith meets the Hardy Boys. The ending I had to read twice... >So will some exceptionally creative sort spend 3 or 4 hundred pages exploring >BlackNet and the future of global networking? We can only hope. >Or has anyone looked at what has happened to trivial networks like >IRC's EFnet to see a potential model for how global networking will become >balkanized under bandwidth constraints, server cycle shortages, >and over worked sysadmins? One physical connection and many virtual, >private networks with limitted interoperability and crossover. The internet of >the near future may not be the open paradise it is today. The bandwidth will increase and people will find bigger and better ways to chew it up. Governments will make bigger and bigger claims to why their set of petty rule outweigh other governemnts petty rules, increasing fear, uncertanty and doubt in the process. All in all, things will change and life will go on. (Unless we all die and then all bets are off.) >I read in InfoWorld that the Telco Dereg act may destroy the local loop market >for T1 lines from LD COs. As many as 900,000 new T1's may become available at bargain >rates on the order of $40 per month with end point hardware under $700. Watch >PairGain Technologies as they are the leader in this hardware market and have >some real interesting vox/data over twisted pair toys. Mmmm! Bandwidth! I hear of people complaining how much time is spent online. This is going to be a heroin-like fix to those sort of people. (I already have access to a t-1. It can be pretty damn addicting. At least when the rest of the net is willing to cooperate...) I expect that the big winners in the bandwidth wars will be the hard drive manufacturers. Imagine the amount of crap that will accumulate when downloads take seconds instead on minutes (or hours). Buy your stock now! >Sheesh, I start out talking SciFi and end up talking PairGain! I guess the future >is now. Actually the future was last week. Sorry. You missed it. --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

3 2

/dev/random and similar
by Three Blind Mice 17 Dec '03

17 Dec '03

There was a thread here a while back about /dev/random and similar devices for Linux, but I managed to lose the mails and the hks.net archives still aren't working (any news on that?). If someone could tell me where I could find such a driver, I would appreciate it very much. TIA! --3bmice

3 2

RE: Mass-market crypto phones
by Peter Trei 17 Dec '03

17 Dec '03

"Clay Olbon" writes: > If I'm not mistaken (and I've been known to be from time to time :-), cell > phones are already encrypted between the phone and cell tower. He's mistaken, at least for analog cellphones in the US - digital cellphones (just starting to come in now) may have some form of protection. Before a law was passed, it was easy and legal to listen in on cellphones on most scanners and many ham radio outfits (and even some UHF TVs). Now it's merely easy. It's kind of pathetic - I'm sure that the billions lost to cellular fraud far outweigh the value of crimes that the LEA groups have been able prevent by preserving their ability to illegally eavesdrop on cell calls without a warrant. Peter Trei trei(a)process.com (standard disclaimer applies) Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

3 2

RE: Mass-market crypto phones
by Clay Olbon II 17 Dec '03

17 Dec '03

At 09:41 AM 11/22/96 -6, Peter Trei wrote (in part): >It's kind of pathetic - I'm sure that the billions lost to cellular fraud >far outweigh the value of crimes that the LEA groups have been >able prevent by preserving their ability to illegally eavesdrop on >cell calls without a warrant. Lots of TV specials lately on stealing cell-phone codes and cloning phones. Seems to me that this would be ridiculously easy to stop using crypto. As a side issue (related to your comment about banning the listening in on cell-phone calls). I find it pretty amazing that it is possible to make it illegal to listen to signals broadcast over public airways. Yet another way crypto will help society - it will make such laws restricting our freedoms obsolete. Clay >Peter Trei >trei(a)process.com >(standard disclaimer applies) > >Peter Trei >Senior Software Engineer >Purveyor Development Team >Process Software Corporation >http://www.process.com >trei(a)process.com ******************************************************* Clay Olbon olbon(a)ix.netcom.com engineer, programmer, statistitian, etc. **********************************************tanstaafl

1 0

Re: Crypto Bounties
by Ted Anderson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Regarding the idea of setting up markets (or bounties) for software, I'd like to direct your attention to the Idea Futures scheme. This is currently embodied as a web server at: http://www.ideosphere.com/ideosphere/fx/main.html There is some background on the idea by Robin Hanson who talks extensively about using it as a funding mechanism. In addition there is a whole suit of market claims denominated in fake money. Ted Anderson -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMpXDrgGojC9e/wyBAQGPmgP/fXo4g3w9yefWiQK+Lp2RRxpwjwmmTmr3 b75k0deXV5gX/WdcNccvdFEYcZ5MMTEMQYOeFxhPi0Xr5goIJLJ++oPCRGXAWADQ k98PDgzfM+si8QqT8K7PG+BwejankJsh1npqaJVCE/8dboZBKNFVlsrzg7oGTfw2 adgiDyWD7Og= =pbS3 -----END PGP SIGNATURE-----

1 0

RE: Mass-market crypto phones
by Mullen Patrick 17 Dec '03

17 Dec '03

_______________________________________________________________________________ From: Adam Shostack on Fri, Nov 22, 1996 1:21 > > I'd just like to second what Lucky wrote at the end of his >very nice summation of the crypto phone hardware issues. Eric's phones >have damn good voice quality in secure mode. I should probably make it more clear that my comment referred to price, NOT quality. I'm sure it is a wonderful product (I haven't tried it myself), but I believe the price tag was at or around $1000. My comments on the hardware used was for demostration purposes, not for saying anything was wrong with the design strategy. In fact, I thought it was a perfectly fine strategy, and easy(ish) to implement. Basically, it took the dedicated computer you would need for phone encryption and put it in a cheaper box. To be honest, I thought he had a good idea. I just wouldn't want to pay $1000 for phone encryption. But, it's rare I have conversations where I need that much security. I'm sure the product is worth it; it's just out of my price range. And probably out of the price range of the average user. PM USER ERROR: REPLACE AND STRIKE ANY KEY WHEN READY

2 1

Re: Word Lists
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

this used to be a good site for what you want. YMMV "An anonymous ftp server has been built on wocket.vantage.gte.com which contains the following files in the pub/standard_dictionary directory:" -paul > From cypherpunks-errors(a)toad.com Fri Nov 22 03:04:16 1996 > X-Sender: camcc(a)smtp1.abraxis.com > X-Mailer: Windows Eudora Pro Version 3.0 (32) > Date: Thu, 21 Nov 1996 17:29:07 -0500 > To: kb4vwa(a)juno.com (Edward R. Figueroa) > From: camcc(a)abraxis.com (Alec) > Subject: Re: Word Lists > Cc: cypherpunks(a)toad.com > Mime-Version: 1.0 > Content-Type> : > text/plain> ; > charset="us-ascii"> > Sender: owner-cypherpunks(a)toad.com > Content-Length: 1012 > > At 01:40 PM 11/21/96, you wrote: > :I'm looking for a Large Word List, for a pkcrack program. > : > :Anyone have any idea where to find one, or how to convert a dictionary > :formated file to a wordlist file? > : > :Ed > : > http://world.std.com/~reinhold/diceware.wordlist.asc > > This is the wordlist for Diceware, and I quote, "7776 short English words, > abbreviations and easy to remember character strings. The average length of > each word is about 4.2 characters. The biggest words are six characters long. > > The list is based a longer word list posted to the Internet news group > sci.crypt by Peter Kwangjun Suk." > > This may not be long enough for your needs. > > The address of the Diceware page is > > http://world.std.com/~reinhold/diceware.page.html > > Good luck. > > Cordially, > > Alec > > PGP Fingerprint: > Type bits/keyID Date User ID > pub 1024/41207EE5 1996/04/08 Alec McCrackin <camcc(a)abraxis.com> > Key fingerprint = 09 13 E1 CB B3 0C 88 D9 D7 D4 10 F0 06 7D DF 31 > > >

1 0

re: sci fi
by Alan Olsen 17 Dec '03

17 Dec '03

At 06:48 PM 11/22/96 +0100, Asgaard wrote: >On Thu, 21 Nov 1996, Alan Olsen wrote: > >> For absolute brain candy, I recommend "Star Smashers of the Galaxy >> Rangers". EE.Doc Smith meets the Hardy Boys. The ending I had to read >> twice... > >A rather odd book that I found immensely stimulating is >'Venus on a halfshell' by a Nym (allegedly for Kurt Vonnegut, >who in most of his books under his own name now and then >refers to some hilarious non-existing SF story by this 'author'). Philip Jose Farmer claimed to have written that one. It also brings up an interesting point... Nyms are fairly commonplace amongst the writing community. (Even Steven King wrote under a nym (or two).) In fact there are books listing "nyms of the famous" for book collectors. Payment schemes for authors under nyms are already in place. (For example, I do a monthly column under a nym and they have no qualms about paying me.) DBAs also cover nyms in some respects. Nyms do not have to have a "sinister purpose" (as the feds would like us to believe). I think that they are far more ingraned into the culture than people realize. (Where would this world be without Mark Twain (a nym for Samuel Clemmens), Maxwell Grant (the nym for Walter B. Gibson and others for the Shadow pulps), and the thousands of other nyms that appear in the publishing field?) Just because they are published under a nym does not mean anyone takes their books less seriously or enjoy them less. (In fact, there are many authors that are nyms unbeknownst to the readers. I would say that most nyms in the publishing world are...) --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0