December 2003 - cypherpunks-legacy

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Dr.Dimitri Vulis KOTM wrote: > > Ernest Hua <hua(a)chromatic.com> writes: > > > McNeil & Lehear (sp?) (ok, I know, one of them is gone, but I forgot > > > which) News Hour had a segment on crypto policy. Generally a balanced > > > non-technical report, except that there is no mention of the free > > > speech issue. > > Do you think they should have mentioned that cypherpunks are against free > > speech and that John Gilmore (spit) is a liar and a content-based censor? > > Gilmore is irrelevant and not worth mentioning. > BTW, there's an excellent picture in the Public Domain showing Robert > McNeil (sp?) looking over the fence on the grassy knoll, seconds after > they blew off the president's head. I guess ol' Bob musta been one of > those "extremely few, ignorant, stupid people" who thought shots may > have come from somewhere besides the depository (per O.C. Register). Another new error message! Seems like every other day now.

1 0

Re: SMTP import error #-5
by Dale Thorn 17 Dec '03

17 Dec '03

No Alias Created wrote: > Ernest Hua wrote: > > > > It is truly counter-productive to insist on conspiracy theories and > > > > anti-government rhetoric. Sure, there have been conspiracies in the > > > > past. Sure, there have been more than our fair share of atrocities. > > [mucho snippo] > > The danger in conspiracy theories (and you can check the L.A. Times for > verification of this) is that they are often tied in to anti-Semitism > and other forms of racism, and/or provide an excuse to.... > > The fact is, though, that only government possesses the power to ruin the > lives of masses of people, which they have often done, even in this century. > Anyone who says "the conspiracies aren't true" and "anti-government rhetoric > is automatically bad", etc. is just sticking their head in the sand. > > The militias are a necessary correction to government excess, however > negative the implications of militia power might be. > > As far as the difficulty in creating the infrastructure to monitor every- > one, well, it exists and is growing by the minute. All "they" have to do > is listen in, and have smart programs to sort out what they want to look > at (which they certainly do). Think of it as a percentage deal. The > people the govt. most want to monitor are the ones who are the most > active in their travel and communication, therefore, it greatly reduces > the monitoring load. Another new error message. Every other day, a new error. Who's doing this?

1 0

Re: market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

At 12:12 PM 11/26/96 +0000, Matthew J. Miszewski wrote: >> 2. Users of programs like PGP today already get at least a fairly decent >> RNG already. Would they want better? (I'm not suggesting a total >> replacement; I assume that the output of any hardware RNG would be hashed >> with more "traditional" PC sources, like disk timings, keyboard timings, >> etc, which should deter attempts to attack just the hardware part.) > >Why would you hash good RNG output? Re-read (read?) Applied Cryptography. Hardware RNG's contain biases, even though they may only be tiny ones. For example, a RNG based on radioactive decay and a geiger counter has a certain minimum "dead time" between decays that introduces a slight bias. Most electronic circuits naively intended to generate random numbers contain similar biases. If I build a device to generate ones and zeroes based on electronic noise, I must assume that there there will be some non-randomness in the output, however small. This is somewhat equivalent to saying that there is somewhat less than 1.000000 bit of entropy in each bit of the RNG output. If I recall correctly, a data stream with 0.5 bits of entropy per bit might be one that contains uncorrelated bits which are "0" 3/4s of the time, "1" 1/4 of the time. Fortunately, as I recall it is possible to, in effect, "distill" the randomness of the sample using hashing. Start out with 200 bits with 0.5 bits per bit of entropy, and you can produce 100 bits with 1.0000 bit per bit of entropy. (Condensing the thing even further can't put more than 1 bit of entropy into each bit; but what it does do is provide some margin for entropy sources whose biases may vary somewhat.) The advantage, however, is that it is probably far easier to distinguish 0.2 bits per bit of entropy from 0.1 bits, compared with distinguishing 0.99 bits from 1.000 bits. If you know you have at least 0.2 bits per bit, hashing down a factor of 10 would produce a solidly random output. If I understand the process correctly, this means that the "figure of merit" of any RNG should be the number of bits of randomized output it can successfully create per second. 100,000 bits per second of output with 0.5 bits of entropy per bit is, therefore, better than 10,000 bits with 1.000 bits per bit, because the former can be converted to 50,000 bits of unbiased output per second. This result may not be exactly counter-intuitive, but it is at least NON-intuitive. But what this does do is to provide an opportunity: Build a circuit that generates reasonably random output at 10x rate, hash it down to 1x, and you can be reasonably certain that the result is cryptographically random. The software could monitor the input to ensure that it remains substantially better than needed to guarantee random output. >I understand your desire to >deter hardware only attacks. I just think it might be an >overreaction. Of course mine could be an under-reaction 8-) I think if the hardware RNG could be corrupted and that would compromise the security appreciably, it WOULD be compromised in important-enough situations. However, adding hashing with more "traditional" sources of randomness would make the job futile. Corrupting the hardware RNG device would merely make the system fall back to the current level of security. >> 3. Even hardware RNG's aren't "perfect": they could be subverted, >> replaced, or perhaps influenced. Would someone who was sufficiently >> sophisticated as to recognize the need for it actually accept a real, >> functioning device? > >It would have to go through rigorous testing in the crypto community. > RNGs v. PRNGs goes through a yearly debate here on cpunks. There >have been some good discussions on the use of white noise and other >potential hardware sources. Im not sure if hks is back up or not, >but you might look there. Well, we have a chicken-and-egg problem. Until a commonly-used program (like PGP, maybe) easily gives the public the option to include a hardware RNG as part of its sources of randomness, few people will be inclined to implement such devices and they will remain atrociously expensive...so nobody will buy them. >If an independant entity could certify the product with a good >reputation for dedication to the community, you would get much >milage. PGP, Inc. might be interested for instance. I mean I have >used PGP for years but have not had the time to go through the code, >etc. I trust it because Phil's reputation precedes him. Well, with all due respect, if Phil hesitates to install a hardware random source link into a piece of software simply because he thinks that to do so puts his reputation on the line, he's placing a high hurdle in front of the development of good, economical hardware randomizers. There's plenty that software can do to protect itself from a compromised hardware RNG; monitoring the biases of the input and hashing it more than adequately is a good start. It should be possible to ensure that a hardware RNG can only improve security, not reduce it. Jim Bell jimbell(a)pacifier.com

1 0

Buy your COMPUTER parts direct from any wholesaler!
by daniel＠earthstar.com 17 Dec '03

17 Dec '03

BUY QUALITY COMPUTERS AND COMPUTER PARTS DIRT CHEAP!!! YOU'RE THROWING YOUR HARD-EARNED MONEY AWAY, if you're not buying your computer parts direct from wholesalers, using my method. Stop relying on unethical computer salesmen to sell you your computer and all its ancillary parts. Why pay full retail. With my method, you can not only PAY WHOLESALE PRICES, but your purchases will be TAX FREE, coming from out of state! You could be buying computer parts for your friends, neighbors, family, coworkers, employers and anyone else. You choose if you add a profit for yourself or not. I was the purchasing agent for over six years with a multimillion dollar computer company. I've been in the business for myself for the last four years. Believe me, I know what I'm talking about. And I'm willing to share my secrets, along with a list of hundreds of contacts in the wholesale computer business for just $4.95. If you still need convincing, E-Mail me at daniel(a)earthstar.com. If you're already convinced that my nominal fee is well worth the fantastic savings you can begin enjoying on your computer parts, send $5.00 to Daniel Decker,11904 Blueway Ave. , OKC, OK 73162 Be sure and include your e-mail address I will immediately e-mail you my secret, oh-so-easy method to getting wholesale costs, tax free, and the list of wholesale computer companies. The list includes the contact names and phone numbers that will help you find any part you need, from RAM chips to CD ROM burners. I'm so confident that this information will pay for itself many times over, I'll refund the COMPLETE purchase price if your not 100 percent satisfied. No questions asked, no hard feelings, period. WHAT ARE YOU WAITING FOR? The longer you wait, the more money you could be wasting. Contact me immediately. I'm ready to help you save money. Daniel Decker daniel(a)earthstar.com

1 0

Re: [ANNOUNCEMENT] Enigma
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Tim C[reep] May's family tree goes straight up. All of his ancestors were siblings, to dumb to recognize each other in the dark. _ {~} ( V-) Tim C[reep] May '|Y|' _|||_

1 0

Re: wealth and property rights
by Murray Hayes 17 Dec '03

17 Dec '03

On Wed, 27 Nov 1996 15:00:36 -0800 (PST), Dave Kinchlea wrote: >On Wed, 27 Nov 1996, snow wrote: >You are clearly an angry young man. I am sorry you have such a poor >opinion of people, I am even more sorry if it is justified. You can >believe me or not, but what you describe is *not* the ordinary case in >this country. Of course, in this country we have a disgusting 10+% >unemployment rate. Even if people DO want to work, there are no jobs. > >All that aside, I can tell you do not have a family if you thing that >$6.50/hr is a living! Even accounting for the difference in our dollar, >I would say that is barely subsistence income for a single person. Are >we *all* not worthy of more than that? > Yes, there are maany angry young men in this country. Unions prevent young men from compeating in the market place. Unemployment Insurance artificialy increases the unemployment rate by 2% (this is a figure that many people more knowledgable than me have stated) welfare increases the unemployment rate by another 1%. The Canadian Pension Plan is out of money and yet I am still forced to contribute and for what??? Will it still exist when I retire? Not bloody likely. Fortunatly NAFTA has forced some of our companies to compeat or die. Take a look at Canadian. Are they gone? I didn't get to watch the news today...... I'll bet that most of the employees would gladly take a 10% wage cut to save to company but the union leaders won't let them vote on it. Why? Because they would loose power. Look at what the govn't do. Most of them just contribute to the problem by offering hand outs. They don't need hand outs! ONE gov't (Alberta) offered to lower the fuel taxes. YAAAAA RALPH!!! (Who's ecinomic reforms incidentally (sp) was hearalded by the Post as a model for govn't across North America) Cut taxes and kill the union leaders. Sorry for siting my sources..... mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

2 1

Re[2]: Sound card as a random number source ??
by Pavel Korensky 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk wrote: > > I`m not entirely sure about the possibility of correlations in any of > these sources but they aren`t really a good idea because all can be > accessed by someone else. eg. Steal your random noise audio tape, > sample dolby decoded sound at the same time as you etc. And what if I will use FM receiver, tuned on some channel where is the noise. If the potentional attacker don't know the what channel was tuned, he is not able to reproduce this IMHO. Of course, maybe it is possible to record the whole spectrum to tapes, but I think that the noise will change when recorded and played back from tape. Bye PavelK -- **************************************************************************** * Pavel Korensky (pavelk(a)dator3.anet.cz) * * DATOR3 Ltd., Modranska 1895/17, 143 00 Prague 4, Czech Republic * * PGP key fingerprint: 00 65 5A B3 70 20 F1 54 D3 B3 E4 3E F8 A3 5E 7C * ****************************************************************************

1 0

Re: Whitehouse Releases Blueprint...
by Will Rodger 17 Dec '03

17 Dec '03

At 04:08 AM 11/29/96 +0000, you wrote: > > Notably, the emphasis is on the needs of business, not "people." > > We are in an excellent position to observe and document the process whereby > "business" -- that is, organizations motivated primarily, if not exclusively, > by the desire for short-term profits accruing to vested interests -- comes > to dominate and control a technology. The auto and television industries come > to mind as two prior examples. We are about to see the net go the same way. > Take notes. > > "I have to praise the administration and Ira for > reaching out to the private sector for > comments," Computers and Communication > Industry Association President Ed Black said. > "There's a great emphasis on the needs of > business here." > > Even so, privacy activists remained > disappointed with many of the document's > features. "This isn't anything new," said David > Banisar, counsel to the Electronic Privacy and > Information Center. "The privacy stuff is > terrible. They say it's market driven, but > markets don't work with privacy. It's like what > happened with P-Trak." > You bring up a point that is implied - but not explicit - in the article. And it's a good one. Funny thing is, two of the _industry_ folks suggested individuals probably needed to be included in the document more than they were. Neither was keen on being quoted on the record regarding non-business interests, of course. Given the attitude of the folks I talked to, I suspect non-business interests are still fairly important to the White House on this one. And remember: Ira Magaziner won no friends in industry with his health care proposals a couple of years back; some folks think he's leaning in favor of industry at least initially to make sure what happened then doesn't happen again. If Netizens find suggestions from the administration too heavy-handed, my guess is there's still time to move the discussion. Cheers. Will Rodger Washington Bureau Chief Inter@ctive Week

1 0

cgi-bin vulnerability
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

does anyone have a pointer to any sample scripts for exploiting the cgi-bin/phf vulnerability? cheers, -paul

3 2

Re: Counterproductive Dorothy Denning Flames
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> So, they feel compelled to harrass anyone who's smarter / more > knowledgeable than they are (sometimes using the anonymous remailers) in > an effort to drive all intelligent discussion off their "private mailing > list", so ignoramuses like Bradley can sound like "local experts". I think you might be missing the very succinct and subtle point that all you ever contributed to this list (despite your knowledge of cryptography) was rants about sovok jews and Tim Mays sexual orientation. I happen to be knowledgable about cryptography but even if I`m not an expert I do tend to post things that are of value and interest as opposed to worthless flames. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

2 1