December 2003 - cypherpunks-legacy

Gubmint-sponsored online gambling
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

In about 2 weeks Off-track Betting Corporation (the quasi-state agency in NYS that's in charge of horse betting) is planning to open a Web site where gamblers will be able to place bets. One will have to fork over real $$ to OTB before being able to bet it on the Web site. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Internet Message
by BJORN2LUZE＠prodigy.com 17 Dec '03

17 Dec '03

Sorry I wasn't able obtain the original SUBJECT here. Through-out the moral existance of the internet I find no reason to stop the comunications. There are factors like no AT&T, MCI, or SPRINT (those dime-a-minute rates are baffling). GOOD. Then there are more ideas exchanged. This can be a PLUS for businesses that are RETAILERS (in the long run). The internet can be used to UNITE the world with a single language. The internet can be used to share ideas, learn, and a good place to visit when you are feeling down. Now if you believe anything I said, than the idea that the iternet brings is UNITY. Isn't it strange that within the last 3 years, (taken from a local news channel) people have agreed that the U.S. is moving in a positive direction? Not really, within these last three years is the exact time the internet had become most publicly available. With PRODIGY, AOL, and COMPUSERVE making it happen. Who is the original credit due to? Tell me. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- my favorite site: http://pages.prodigy.com/VT/hackersguide on the internet today. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- --Nathan

2 1

booklet-bus-97
by health711＠cyberpromo.com 17 Dec '03

17 Dec '03

Fuck_You_Nerds, I just thought I would write you a short note,to tell you about a free booklet I discovered.I ordered and I can not believe the fun and money I am making.All you need to do is send them a self addressed stamped envelope to homebusiness 870 market street #450 San Francisco,Calif. 94102.Find it out for yourself.Available in 34 countries warmest regards & Happy Holidays Ellen

2 1

Cash - Covenience and privacy over the threat of being mugged
by varange＠crl.com 17 Dec '03

17 Dec '03

> It's that wonderful season again, when all the assholes > are out in force, and people feel obligated to purchase > merchandise to give to each other. For various reasons, > I don't believe in credit cards, and yet, trying to pay for > something by personal check at the local Hecht's, they either > *require* a credit card, or go through the Nazi check-warranty > company Equifax. Why not just carry sufficient cash for your purchasing needs? Irrational fear of muggers I guess is the primary reason not to carry around, say, $500.00 cash. But if you were mugged for that much, wouldn't you feel worse about the mugging itself than the actual loss of the money? I doubt the mere carrying of greater amounts of cash makes someone more likely to be mugged than someone carrying nothing. So it boils down to whether you think it's better to use the inconvenience and invasion of privacy of credit cards and/or checks and getting them stolen over convenience and privacy of cash and getting an anonymous $500.00 cash stolen. (You also can *sign* your cash to help trace thefts. I used to do this when hanging around disreputable charactors. Hell, drug dealers will accept your money if you wrote down his identification and "Crack Bill of Sale" in magic marker on every bill.) > Is it legal to require credit cards? Yes. BTW, my uncle was mugged at Provo Park for thirty five cents and my front windshield of my car was smashed in for the fifty cents in open view between the passenger seats. You know those ancient mono AM only radios that are almost always broken down in old cars? Yep, had a window smashed and the worthless radio stolen. In another vehicle that was even shittier looking I never locked the doors and nothing was ever stolen; the radio and cassette player actually worked! Merry bloody crassmus. -- Cheers!

1 0

RE: [NOT NOISE] Microsoft Crypto Service Provider API
by Blake Coverett 17 Dec '03

17 Dec '03

> Not quite. The API comes with a program SIGN.EXE that will create a > "debugging signature" for your CSP, and a new ADVAPI32.DLL, described as > a "Modified advapi32.dll to load providers that are signed with > sign.exe." So the patch point is a bit more accessable than inside the > kernel. Maybe the "Modified advapi32.dll" should find its way offshore? Even better than exporting the hacked advapi32.dll, compare the it with the original one. I'd bet good money that the only difference is the contents of the RC_DATA/#102 resource attached to the image. (It's useful to note that the advapi32.dll from versions of NT before CryptoAPI doesn't have any RC_DATA resources.) And to think MS was good enough to provide an UpdateResource API that I haven't yet had a good reason to use. > Interestingly enough, CSP signatures are held in the registry instead of > the binary, necessitating some install procedure for a given CSP. Not > to start rumors, but NT 4.0 does use threads to watch some registry > entries that control the version (workstation/server). Not much of a > stretch to imagine a thread that tracks (reports?) changes to Nope, a little experimentation shows you can change those entries while the system is running to your hearts contents. Try temporarily renaming the signature key of the base provider. regards, -Blake

1 0

Re: Legality of requiring credit cards? (fwd)
by Peter 17 Dec '03

17 Dec '03

At 08:51 PM 12/23/96 -0500, you wrote: > Equifax does business by tracking reputations, as do all credit > reporting companies. That's how a free market handles bad checks. Even worse is an outfit called Telecheck. All they do is see if you have a listed telephone number. Since I do not give out my telephone number, and it is unlisted, an autobody shop refused to accept my check, and I ended up having to use a credit card. The idiot teller refused to call the bank to check my balance. What does a listed telephone number have to do with ability to pay?

1 0

Vandalism in New York City
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Xmas day vandals overturned 75 headstones in the Calvary Cemetry in Long Island City, near the residence of Earthweb's associate network administator Ray "Arsenic" Arachelian. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

Re: Reflections on the Bernstein ruling
by jim bell 17 Dec '03

17 Dec '03

At 11:57 PM 12/20/96 -0800, Greg Broiles wrote: > >(Please keep in mind that I'm not a lawyer yet, and that my comments are >intended only as the reflections of an amateur and are intended as >discussion fodder, not legal advice.) > >Folks seem to be very excited about Judge Patel's ruling in the Bernstein >case - and with good reason. It was, for example, a first-page >above-the-fold item in both of the Bay Area's legal newspapers today. >Unfortunately, most of the media reports have done a poor job of >interpreting the ruling, and it's easy to draw bad conclusions from erratic >news reports about the case. The decision is available online ><http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/961206.decision> >thanks to the folks at EFF. I thought list members might appreciate a >summary of the decision and its potential effects. Please comment on my (layman's) proposal that no "mens rea" ("guilty mind") can be attributed to a person who is relying on a not-yet-overturned judicial decision. In other words, if a person has a genuine belief that what he's doing has been upheld by the Patel ruling, he cannot be claimed to have had "mens rea." (I am presuming, here, that before he does anything, he "clears it" with a lawyer who assures him that what he's planning is at least covered in the Patel decision as being okay. I understand, of course, that "mens rea" may be irrelevant in CIVIL REGULATORY issues, but not in CRIMINAL ones.) >1. What the ruling said >In brief, Judge Patel ruled that Category XIII(b) (the category which >refers to cryptographic equipment/software) is unconstitutional because it >functions as a prior restraint upon speech without providing important >procedural safeguards which are required when a prior restraint scheme is >put into place. She ruled that the "technical data" provision of the ITAR >is also unconstitutional when it refers to technical data about Category >XIII(b) items because of the lack of procedural safeguards. > >Mopping up other points raised by the suit, Judge Patel ruled that the term >"defense article" as defined in 22 CFR 120.6 should be read to elide the >phrase "or technical data"; and that when interpreted that way, the terms >"defense article", "defense service", and "technical data" are not >unconstitutionally vague. She also ruled that the term "export" is not >unconstitutionally vague, and writes (in 'dicta', which is legalese for >"offhand comment", e.g., without precedential value but interesting as a >hint re what's going on in the judge's mind) that placing software on an >"Internet site" which can be accessed from a foreign country is an export >for ITAR purposes. What about leaving a floppy on a sidewalk in Des Moines, Iowa, which might be picked up by a wandering foreign tourist who happened nearby? Sheesh, these judges are real idiots, even when they accidently are coming to (mostly) the right conclusion. However, if being "on the Internet" is automatically presumed to be an export, why can't we program using remote-control editors which might, someday, be available on the Internet? (maybe they already are; somewhat analogous to the old timesharing computers of yore. If the underlying files were kept overseas, modified by specific editing commands sent to a remote system, presumably Patel's dicta would suggest that those files were never "exported" per se. They were formed and kept overseas, INTENTIONALLY, to avoid the later necessity of exporting them had they been kept in the US.) This would be an modifed and automated version of the way versions of PGP later than 1.0 were supposed to have been developed: Actual coding was done overseas, based on suggestions and comments from other countries. (including, presumably, the US.) Yes, realize that pessimism overtakes me here. "The system" never wants to admit a contradiction. I would argue, however, that whereever the system wishes to draw the line and call everything outside the line "an export," that decision should be considered binding on the government even when such a conclusion leads to unexpected and undesireable consequences. (for the government, at least...) >She also ruled that the "fundamental research in science and engineering" >(120.11(8)) and "general scientific, mathematical, or engineering >principles" (120.10(5)) exceptions to the definition of "technical data" >are void because they are too vague. As far as I can tell, they are thus no >longer available to potential ITAR defendants. Wouldn't it be more accurate to say that they are no longer considered precisely defined exceptions, NOT that the exceptions no longer exist? It seems to me that if the "burden of non-ambiguity" falls on those writing the regulations, failure to eliminate ambiguity would have to be resolved in favor of tolerating actions that fall into the grey area. For example, if a law was passed that said, "pornographic writing is illegal," and the SC later determined that "pornographic" was ambiguously defined, what they WOULDN'T do is to make ALL writing illegal! (which would, obviously, be an over-broad restriction, in an of itself.) Otherwise, what would on the surface appear to be a overturning of a law would actually be a _broadening_ of it. >It's also unclear that Judge Patel's ruling is enough to make export of >crypto source legal by people/organizations located even in the Northern >District of CA. Venue is proper, in an ITAR case, in any jurisdiction which >the defense articles have moved through. (18 USC 3237(a); _US v. Durrani_ >659 F.Supp 1177, 1182 (D. Conn, 1987); an easy analogy is to the _US v. >Thomas_ "Amateur Action" case, where Tennessee venue was proper for >prosecution of California defendants who sent porn into Tennessee.) So it's >at least arguable that the feds could simply bring an ITAR prosecution in >another district, if exported crypto flowed through that district. But again, deal with the mens rea issue. If Patel said, "It's okay to export this software because the regulation is invalid," and you do so relying on this ruling, wouldn't any subsequent (criminal) prosecution both have to prove you did it, and ALSO prove that you were being unreasonable in relying on the ruling? (Are rulings of illegality somehow more "reasonable" than rulings of legality?) I'm not suggesting that her decision can't be overturned in the future; I'm suggesting that until it is overturned, each member the public is entitled to act in reliance on it, perhaps at least the ones in her jurisdiction. >So while the ruling has considerable historical, cultural, and symbolic >significance, it's dangerous to assume that it means that export >restrictions on crypto are dead. However, wouldn't it be a good idea to take advantage of what is at least a temporary decision? If I were a large corporation, having just developed an excellent design for a crypto telephone, I might want to export it NOW, which is in effect taking advantage of a temporary loosening of restrictions. Jim Bell jimbell(a)pacifier.com

2 1

RE: [NOT NOISE] Microsoft Crypto Service Provider API
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Wed, 25 Dec 1996 23:17:53 -0500, Blake Coverett wrote: >And to think MS was good enough to provide an UpdateResource >API that I haven't yet had a good reason to use. Right thoughtful of them, wasn't it..? <g> >> Interestingly enough, CSP signatures are held in the registry instead of >> the binary, necessitating some install procedure for a given CSP. Not >> to start rumors, but NT 4.0 does use threads to watch some registry >> entries that control the version (workstation/server). Not much of a >> stretch to imagine a thread that tracks (reports?) changes to > >Nope, a little experimentation shows you can change those entries >while the system is running to your hearts contents. Try temporarily >renaming the signature key of the base provider. Now, yes. However I wonder how quickly a service pack would be released to extend the monitor garbage... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Legality of requiring credit cards?
by jim bell 17 Dec '03

17 Dec '03

At 11:20 AM 12/25/96 -0800, Eric Murray wrote: >Brian A. LaMacchia writes: >> >> At 09:35 PM 12/24/96 -0800, jim bell wrote: >> >Bzzt, wrong answer! By definition, if the report was filed as a >> consequence of >the transaction, then the transaction was reported IN FACT >> and the person didn't >evade it! (whether he wanted to evade it is, of >> course, pure speculation on your >part. It is, obviously, questionable >> whether the government can make a person's >mere _desires_ criminal.) >> >> Please, Jim, *go read the law*. Do it now, before you even think about >> replying to this message, else you'll say something else stupid and >> irrelevant. Look, I'll even give you the complete, specific URL for the >> section of the U.S. Code in question; all you have to do is cut-and-paste >> it into your favorite Web browser: >> >> http://www.law.cornell.edu/uscode/31/5324.html > >It appears that Jim's 100% wrong- they omit the 'Suspicious >Transaction' report in the list of reports that the gambler was >busted for trying to avoid: Well, I agree that I was "shooting from the hip" on my statement that the government doesn't prohibit informing the victim (and yes, such people are indeed properly called "victims") that a report was made (see below). Imagine that, Jim Bell OVERestimating the ethics of the government! That'll teach me a lesson. > > >Section 5324: > >(a) Domestic Coin and Currency Transactions. - No person shall for the >purpose of evading the reporting requirements of section 5313(a), > section 5325, or the regulations issued thereunder or section 5325 > or regulations prescribed under such section 5325 (FOOTNOTE 1) > with respect to such transaction - > > (FOOTNOTE 1) So in original. See 1992 Amendment note below. > (1) cause or attempt to cause a domestic financial institution > to fail to file a report required under section 5313(a), > section 5325, or the regulations issued thereunder or > section 5325 or regulations prescribed under such section > 5325; (FOOTNOTE 1) > (2) cause or attempt to cause a domestic financial > institution to file a report required under section 5313(a), > section 5325, or the regulations issued thereunder or > section 5325 or regulations prescribed under such section > 5325 (FOOTNOTE 1) that contains a material omission or > misstatement of fact; or > (3) structure or assist in > structuring, or attempt to structure or assist in > structuring, any transaction with one or more domestic > financial institutions. Notice that they don't define what would constitute an "attempt to cause a domestic financial institution to fail to file a report..." Since from the story told, it is obvious that there is no hard-and-fast rule on reporting, it should be equally obvious that there is no sure-fire way to prevent a report. As such, equally so, there is no object way to tell (other than, say, a direct statement by somebody) that a person's actions were intended to avoid a report. >Section 5313 is the 'normal' reporting section, Section 5318(g) >is "suspicious" transactions (note that it wasn't listed in 5324 above): > >(g) Reporting of Suspicious Transactions. - > (1) In general. - The Secretary may require any financial > institution, and any director, officer, employee, or agent > of any financial institution, to report any suspicious > transaction relevant to a possible violation of law or > regulation. > > (2) Notification prohibited. - A financial > institution, and a director, officer, employee, or agent of > any financial institution, who voluntarily reports a > suspicious transaction, or that reports a suspicious > transaction pursuant to this section or any other authority, > may not notify any person involved in the transaction that > the transaction has been reported. > > >This is really scary to someone like me who doesn't often read >laws. They're required to report "suspicious" transactions >(with the definition of "suspicious" left completely wide open) >and they're not allowed to tell you that you have been reported. >This sounds like police-state tactics, not something that would >happen in a free and open society. Given that the 1st amendment to the US Constitution supposedly is intended to guarantee freedom of speech, any prior restraint on speech must be presumed to be unconstitutional unless proved to be constitutional. Since under the circumstances described there is no known crime or ongoing investigation, such a prohibition on speech doesn't even rise to the level of hypothetical "obstruction of justice" which is occasionally brought up as a phony justification for such bans. Jim Bell jimbell(a)pacifier.com

1 0