December 2003 - cypherpunks-legacy

Maybe the CypherPunks *do* have some heart
by SUCRUM22_at_INDY-ADP＠smtp-gw.cv62.navy.mil 17 Dec '03

17 Dec '03

------------------ Begin Forwarded Message Text --------------------- The Houghton-Mifflin Publishing Co.. is giving books to children's hospitals; how many books they give depends on how many emails they receive from people around the world. For every 25 emails they receive, they give one book -- it seems like a great way to help a good cause. All you have to do is mail: share(a)hmco.com. Hope you can spare some time to write and then let your friends know. ------------------- End Forwarded Message Text ---------------------- Hey cypherpunks, just thought this might be of interest, forgive the spam, but remember, knowledge begins with reading. And no, don't go e-mail and ask what books the Co. is donating (i.e.. gov't supportive, procrypto controls etc etc) Its the Holidays, have some heart. And hey - if the number of books is related to the number of e-mails, i wonder if maybe we can enlist those "i'm sorry" spammers to fill those e-mail boxes <grin>. Happy <whatever-you-happen-to-celebrate>. ---------------------- SUCRUM22(a)cv62.navy.mil ----------------------- Don't confuse my views with those of the DoD or the United States Navy

1 0

RE: Microsoft IE may not work without censorship files
by Blake Coverett 17 Dec '03

17 Dec '03

> In the control panel I attempt to click on the Internet Icon and the > following occurs: A Content Advisor box appears and states the > following: Content advisor configuration information is missing. > Someone may have tried to tamper with it. Check content Advisor > Settings. End of quote. In the internet properties box, I tried to > look for what they recommended but was not sure what to look for. It's good to see they make at least an attempt at preventing the PICS filter from being turned off without a password. Of course the obvious answer is to give it to a teenage boy who wants to look at the dirty pictures and watch how fast it can be fixed with a little registry editing. regards, -Blake

2 1

RE: Ping of Death?
by Blake Coverett 17 Dec '03

17 Dec '03

> Anyone heard of the Ping of Death, aka the Ping Bomb. It's a large chunk of > hostile code, disguised as a mere ping, that can lead to server rebooting. > Technology Assignment Editor, Wired News, http://www.wired.com/ > Producer, Packet, http://www.packet.com/ I read the two parts above and shake my head... A 'technology assignment editor' that has missed this story till now, and can't use a search engine to boot? -Blake (who should only look at the pictures)

2 1

RE: Securing ActiveX.
by Blake Coverett 17 Dec '03

17 Dec '03

Ray wrote: > And I'd be happier running the signed ActiveX control, written by Peter > Trie, or anyone else within a Sandbox regardless of signature as it > increases security. We're in violent agreement here Ray. Sandboxes are good, signed code is good, having both is very good. We differ on the relative importance of the two techniques but I suspect that is because we are coming from different contexts. My work is all intranet so the users trust the software produced for them by definition. Obviously the factors are different on the net at large. > The above says that you wouldn't want to run ActiveX in a sandbox while > you would want to run Java in a sandbox. The difference between > technologies is that one runs native the other emulative. I wouldn't > want to run ANY foreign code outside a sandbox. Java or ActiveX. It's not a Java vs ActiveX thing for me at all. What is important is that some of the applets I write can't function in a sandbox, they need access to the disk and other resources for business reasons. For this type of thing signed code without a sandbox is the only choice. What I'd really like is the sort of thing Bill Frantz is describing on another branch of this thread. Signed code and an administrator defined policy that specified for a given signature exactly what types of resources should be accessible. Anything from don't execute and audit a security alarm to complete access to the whole machine. > The whole point of this was creating a distributed network of DES > crackers. Yes, but in good cypherpunk fashion I've hijacked the original topic into a new direction. :-) > > If you choose to run an unsigned control all bets are off. On a related note, > > I recently saw a Java implementation of a board game that recommended > > the user download the zipped up .classes and run it locally. How many > > average users realize this would disable the Java sandbox entirely? > > How many users know how to download the jdk and run the java vm locally? They don't need to. All they need to do is unzip the java classes into their classpath and all of the normal restrictions on an applet are ignored. Think it would be very hard to persuade a user to do just that in order to play a kewl java game? More importantly it shows that even expert users don't always know where the holes in the sandbox are. regards, -Blake

2 1

Re: The virus I got...
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

Uh..... My question is WHO in gods name trusts a uuencoded file that small especially from an address like that. Sounds like stupidity to me...

2 1

Re: Computer crime prompts new parole restrictions
by Greg Broiles 17 Dec '03

17 Dec '03

At 05:44 PM 12/17/96 -0800, Lucky Green wrote: >What motto does the US Parole Commission have on their seal? May I suggest >"Arbeit macht frei"? Who are these people anyway? I never heard of this >commission... See <http://gopher.usdoj.gov/bureaus/parole.html>; I dunno what's on their seal. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

[NOT NOISE] Microsoft Crypto Service Provider API
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I just got my copy of the Microsoft Cryptographic Service Provider Development Kit, Version 1.0. It appears to support only Windows NT. A first glance reveals no built-in GAK (but I haven't examined it closely yet!). Dammit, now I'm going to have to build an NT box! - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMrdK4Rvikii9febJAQFXQQP/TUlEBwQpLNE3WBq45AXcbAzqc8RkmvkT 5mtz2FSwGleKvg5HRjB5JF3SjjyQ32nsGMpnt/J/r6K84Q7pJWPBHOPgcVzEGSqw ORqumCQlL8uUJKk552BdB9X92QNiDV33QkIIyKQv8An208jTnqEWrYvg1R1lwCXf lkne/kxf0po= =fQZX -----END PGP SIGNATURE-----

2 1

Parolees Can't Possess Crypto
by Duncan Frissell 17 Dec '03

17 Dec '03

The new federal parole guidelines that will ban some cons from the nets will also ban them from posessing crypto software which will also make virtually any computer use impossible. "Main Justice" does say that with the Klinton Admins plans for universal access counter this proposal since the cons will have access at schools, libraries, etc. (not to mention Internet Cafes). DCF

2 1

Re: Computer crime prompts new parole restrictions
by Greg Broiles 17 Dec '03

17 Dec '03

At 03:58 PM 12/17/96 -0800, Lile Elam wrote: >I saw this article in the nando.net paper today and was interested in >your thoughts on it. It looks like people on probation will be limited >in there use of encryption and access to the Internet. One nit to pick - parole and probation are not the same thing. Probation is a sentence imposed by a judge, and parole is the administrative/executive modification of a sentence. They function in similar ways (e.g., people who have been convicted of a crime are not locked up but subjected to extra rules) but have some legally meaningful differences. The press release from the USPC is online at <http://gopher.usdoj.gov/gopherdata/press_releases/592usp.htm>. >To me, it seems like this could be equated to preventing >people on probabtion from using something like a phone. I am >having problems with it because I feel these limitations are too >severe. I mean, a good way someone on probabtion to make a living >is to learn how to use the web and prehaps get a job as a html >coder. This seems like a pretty fact-specific question; but it's not unusual for people convicted of crimes to be restricted from using tools similar to the ones they used to commit crimes, e.g., drivers' licenses are suspended where people are convicted of driving crimes, professional licenses are taken away when people have committed professional misconduct, and so forth. I agree that this can be counterproductive (it doesn't make much sense to seriously handicap someone and then blame them for not doing very well) but I don't think that computers and the Internet are meaningfully different in this way. >There is a hacker I know of (Kevin Poulsen) who is prevented from >using computers during his current probation and it really has limited >his options alot. I curated and maintain a website for him at URL: > > http://www.catalog.com/kevin/ > >where this issue is dicussed. My hunch is it didn't make a big difference, but his letter to the judge who accepted his guilty plea and sentenced him seems to suggest that he turns to computer crime out of curiosity, boredom, and obsession - motives which are probably still present. Three years without computers may force him to find some other outlet for his creative and exploratory drives. This seems like a long-term win for him. (I think denying him access to higher education is much worse than denying him access to computers.) >It also seems to me that preventing people on probation from >using encryption would be difficult especially when encryption is used >in webservers (ie Netscapes Secure Server). One could accidentally >access one and not know that he was sending/receiving information >via an encrypted channel. This sounds like a fact issue for a probation/parole revocation hearing, e.g., did the defendant intend to violate the terms of his or her release agreement? Depending on the situation, an unintentional violation of the terms of release might not result in revocation. (I'm inclined to think it never should, but I'm not having much luck finding any relevant caselaw quickly. I'm also handwaving here because different jurisdictions will probably apply different rules.) My impression is that the USPC was bamboozled (by the USDOJ?) into adopting unnecessary regulations - the press release mentions a "surge of how-to information" available on the Net re criminal activity; but I'm skeptical that such a surge has taken place, or that it's especially relevant to people on parole. The action may also have been unnecessary (viz, the restrictions on crypto) because people subject to parole and probation are already subjected to incredibly draconian restrictions - e.g., the terms of probation and parole usually specify that they must allow the supervising officer to search their home at any time, must report where they live and work, cannot form social relationships with people deemed undesirable, cannot quit their job or change residences, must report their income and expenses in considerable detail, must give blood/urine samples on a surprise basis, etc. People who are on parole or probation have no privacy and very little autonomy. It's not much of a stretch to "You must let the probation officer look through your house" to "You must let the probation officer see what's on your hard disk" - in fact, I think the first implies the second. (Obviously, there are a ton of fact-specific issues here (and I've written briefs arguing why parolees/prisoners should get more privacy), but at the "public policy" level, it's pretty clear that probationers and parolees have sharply curtailed Constitutional rights - which is usually OK with them, because they like that better than being locked up. In my perspective, it makes more sense to rethink the goals and methods of the criminal trial/punishment system, rather than focus on minutiae about computer crime. Lots of otherwise apparently decent people are subjected to relatively harsh punishment on a pretty regular basis, and many people think we aren't already mean enough to convicted people. Most of the people who think this have never had someone they cared about subjected to the penal system. But this isn't really C-punks material any more, so I'll stop here.) -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: The virus I got...
by Psionic Damage 17 Dec '03

17 Dec '03

How come not everyone got it, did it depend on the x-mailer you are using? At 02:59 AM 12/18/96 -0000, you wrote: > > >----------geoboundary >Content-Type: text/html; charset=us-ascii >Content-Transfer-Encoding: 7bit > > > ><HTML> ><BODY> ><CENTER> ><A HREF="http://www.geocities.com">Postage paid by: <IMG SRC="http://www.geocities.com/pictures/newgeobt.gif"></A></CENTER> ></BODY> ></HTML> > >----------geoboundary > > > > Delivered-To: reece-cpunks(a)taz.nceye.net > Delivered-To: reece(a)taz.nceye.net > From: "Vincent Padua" <vincent(a)psnw.com> > Date: Tue, 17 Dec 1996 16:41:57 -0800 > X-MSMail-Priority: Normal > X-Priority: 3 > X-Mailer: Microsoft Internet Mail 4.70.1155 > MIME-Version: 1.0 > Content-Type: text/plain; charset=ISO-8859-1 > Content-Transfer-Encoding: 7bit > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > There was an e-mail sent to the list that had attached to it a virus. Well > lucky me I got. It was a .com file that apparently turns your files into > directories. I can't boot into Win95 since it turned my HIMEM.SYS into a > directory. So, I seem to have fixed that, but now it says "access denied" > and then prompts me with C:\>. Did anyone else get it? Has anyone heard > or fixed this virus? > >Yes. It's a deadly mutation of the GOOD TIMES virus. > >(People actually go to the trouble of stripping off the leading crap >from the uuencoded part and then *run a program* from someone called >Fuck(a)yourself.up? Furrfu.) > >----------geoboundary-- >

1 0