December 2003 - cypherpunks-legacy

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 9:42 AM 12/20/1996, Bill Frantz wrote: >At 11:16 PM -0800 12/19/96, Peter Hendrickson wrote: >> Or, you could turn in the broken processor and have the manufacturer >> certify that it was turned in to the software vendors and that >> a new version of the software should be generated. > I meant processor backup of course. When my processor breaks at 2AM and I > need to get the report out by 8AM, I'm going to call the software support > line and get help. If your processor dies you are SOL whether or not you have software. If it's worthwhile having a backup processor around, then you just have to spend a little more to have backup software, too. > Or the friendly hardware manufacturer is going to come > right out and certify my processor is dead. Come on and get real. With > most software vendors I can't even submit a bug report. If the reissuance of software is not possible (which I don't believe), it's an acceptable risk. Processors die far far less often than disks, and disks are getting pretty reliable. If the software companies can't get it together to reissue software, then it would certainly be easy to sell processor insurance to people who wanted it. This would allow them to replace their ~$10,000 software library. (You can buy theft insurance for roughly the same payoffs, so it's a feasible business. Theft is harder to verify and in my judgement occurs much more frequently than processor failure.) > Note that I am not saying there is a technical problem here. I do see big > problems with infrastructure and marketing. The last time software > companies tried to market copy protection, it failed in the market place. > I predict that encyphered instruction streams will too, and for the same > reasons. If the old copy protection just worked, it would have been widely accepted. Old copy protection had many problems. It didn't stop piracy. Sometimes it crashed your machine. Some schemes worked on some Intel machines but not on others. Backups were a problem. Etcetara. Peter Hendrickson ph(a)netcom.com

3 2

Solidarity with Peruvian Guerrilla! (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi all, MRTA is a bunch of terrorists, irrespective of whether the issues they are trying to deal with are legitimate. They have threatened to kill people if they don't get their way. This alone is enough for me to not support them. They also have taken their internal bitch outside their unhappy home and involved other nationalities. If they were my neighbors I would call the cops and if allowed on the jury I would give them the max. What I would suggest is that the Japanese take as many of the MRTA out as they possibly can. I support the Japanese. Screw the MRTA and the Peruvian government, little Hitlers are little Hitlers. Banzai! Jim Choate CyberTects Forwarded message: > From cypherpunks-errors(a)toad.com Fri Dec 20 14:21:00 1996 > Message-Id: <v02130501aee03559777a(a)[136.152.11.117]> > Mime-Version: 1.0 > Content-Type: text/plain; charset="us-ascii" > Date: Fri, 20 Dec 1996 06:16:20 -0800 > To: aaron(a)burn.ucsd.edu (All recipients) > From: aaron(a)burn.ucsd.edu (Aaron) > Subject: Solidarity with Peruvian Guerrilla! > Cc: nyt(a)blythe.org (nyxfer), seac+nafta(a)ecosys.drdr.virginia.edu, > bc05319(a)binghamton.edu (TAZ), BAYLEFT(a)cmsa.Berkeley.EDU, > red-skinheads-l(a)eart.com, anarchy-list(a)cwi.nl, spg-l(a)xs4all.nl, > LABOR-L(a)YORKU.CA, a-infos(a)lglobal.com > Sender: owner-cypherpunks(a)toad.com > Precedence: bulk > > ** See list of useful Web sites at end of this post! ** > > Companer@s, > > I am writing this while I am tired and should be asleep, since I think that > this matter is too urgent to delay. I apologize for any careless > formulations. > > By now, you all know that the Peruvian guerrilla group MRTA (Movimiento > Revolucionario Tupac Amaru) has occupied the mansion of the Japanese > ambassador in Lima and is holding several hundred prisoners. Unless you are > in an unusual part of the world, you also have seen how the bourgeois media > are discussing the matter as a problem of how to deal with 'terrorists.' > > For the working people and all the oppressed and exploited of the world, > and for socialists, communists, and anarchists, the seizure of the > ambassador's residence along with about 400 bourgeois dinner guests is a > great accomplishment. It is a blow against the terrorism of the Peruvian > state and its imperialist patrons! Those captured in the raid include many > members of the Peruvian and international ruling elite, including the head > of Peru's secret police! It will be politically very difficult for the > Peruvian state to launch a military attack as a means of resolving the > crisis, since that would create quite a few 'illustrious corpses' and lead > to a falling out among bourgeois sectors.. (And it would be difficult to > get the world's poor majority to join the bourgeoisie in mourning its > dead!) It seems that there is already a falling out between Fujimori and > the Japanese over Fujimori's refusal, so far, to negotiate. > > It is very important that the situation in Lima not be resolved in a way > that can be seen as a victory for the bourgeoisie. It is our task to > publicize who the real criminals are in Peru and to help wring concessions > from the Peruvian dictatorship. In particular, we should demand the release > of all political prisoners and prisoners of war from Peru's hideous > torture-chamber prisons. In this context, let's not get involved in > sectarian battles among the various factions of Peru's anti-government > left. Whatever differences the groups have, and these are very serious, we > must keep in mind that the Peruvian state and its imperialist backers (in > Washington, Tokyo, London, Bonn, etc.) are the main enemy. All political > prisoners must be released, whether of MRTA, the PCP (Shining Path) or > neither. > > Thanks to the widespread publicity given to the events in Lima, many more > people will be interested in what we have to say about Peru than normally > would. Let's organize demonstrations at Peruvian Embassies, Consulates, > airline offices, etc. Let's raise our voices in whatever forum may be > available to defend the heroic guerrillas and to denounce the real > terrorists. > > --In solidarity, > --Aaron <aaron(a)burn.ucsd.edu> > > P.S. Plans are being made for a demonstration at the Peruvian Consulate in > San Francisco, California -- probably on Monday, December 23. If you live > in the area, please send me an e-mail message. Otherwise, do what you can > in your area! > > SOME USEFUL WEB SITES: > > Web site on the current crisis: > <http://burn.ucsd.edu/~ats/mrta.htm> > > What Are The Goals Of Your Embassy Occupation? -- Interview With Norma > Velazco, Representative Of The Tupac Amaru Revolutionary Movement (MRTA) In > Peru: > <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0089.html> > > Partial list of hostages: > <http://burn.ucsd.edu/~archive/ats-l/1996.Dec/0092.html> > > MRTA's web site in Europe: > <http://www.cybercity.dk/users/ccc17427/> > > Lima's best bourgeois newspaper (in Spanish): > http://ekeko.rcp.net.pe/LaRepublica/ > >

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 7:43 AM 12/20/1996, Hal Finney wrote: >> The manufacturer is going to publish a list of ALL of the public keys? >> We're talking one key per chip, right? Isn't that an AWFUL lot of >> keys, like, in the millions range? > Probably an easier way would be for the chip manufacturer to issue a > key certificate (signature) on the chip keys. Then it is a trivial > matter for any software manufacturer to verify that a proferred chip > key is legit; just check the cert. Now why didn't I think of that! >>> One approach is for the manufacturer to authenticate software submitted >>> by approved vendors. The vendors are then tasked with encrypting it >>> for the correct processor. >> I'm not sure the "approved" bit would go over too well... one idea >> would be to license the compiler writers, who would build the >> encryption into compilers. It's still not horribly great, but >> better. > Hey, it's a free world, right? Some people only run authenticated > code from big companies; other people turn off the authentication > bit in the CPU and can run any old thing they stumble across on the net. > Everybody's happy. Maybe not everybody. My scheme would not let you turn off the authentication bit. That means that if somebody does find way to get at the secret key, they still can't run the code without doing something expensive with particular processors. Basically, this won't be worth the trouble. > The first group doesn't have to worry about viruses, > or at least they have somebody to sue if they see one, and the second > group gets to run all the freeware and PD code they can today. The second group would have to buy a different processor altogether, the way I proposed it. But, that does not seem unreasonable. One could even imagine systems which have a "free" processor and a decrypting processor. While they would have to have completely different instruction sets, they could be pin compatible. >> Right; the only reason I could see people using this would be for >> economical reasons. > Yes, I think this is a point often missed in these discussions. People > say, why would I want a CPU which will limit the software I can run, > something which will let a software maker give me a version of his > program which will only run on my CPU and which I have no ability to > share with others? What's in it for me? > The answer presumably is that the software manufacturer will sell software > with such limits for much less than he will sell unlimited software. That's > because software piracy is such a major problem, and this way he can be > protected against piracy from this copy of his program. So people with > these CPU's can buy their software a lot cheaper. I agree with all of this. Some people might be happier if they think of this as just another kind of agreement that people can make. Right now the software development agreement is weak because piracy is so easy. We rely a little bit on the law and a whole lot on the integrity of customers. Really, that isn't ideal. It would be nice if people could make strong agreements to write software. My judgement is that software piracy is less of a problem in the U.S. than it is elsewhere. My impression is that there are many other countries in the world where the whole "I should help pay for the development of this software because I am using it" idea just doesn't really show up on the screen. This processor would make it possible to sell software to the whole world without really worrying too much about how well each government enforces its laws or how ethical the people in foreign countries are. > Of course the big downside is that the track record of tamper resistant > hardware has not been too strong lately! If a system like this gets into > widespread use and somebody finds out that shooting X-rays at the chip > exposes its secret key, you've got a big problem. Processors are really only good for 3 years or so. The vendor is only betting that attacks won't become widespread in that time period. That is not a perfectly safe bet, but it isn't bad. The attacks can exist, but so long as they are expensive or hard to generalize to all processors, the software vendors are safe. Peter Hendrickson ph(a)netcom.com

1 0

The CyberSitter Diaper Change, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

[From this morning's Netly News. Check out the HTML version of the article at netlynews.com for links to the threatening letters, etc. --Declan] The Netly News http://netlynews.com/ December 20, 1996 The CyberSitter Diaper Change By Declan McCullagh (declan(a)well.com) Brian Milburn is angry. The president of Solid Oak Software, makers of the CyberSitter Net-filtering software, has seen his company's product come under heavy fire this year. Its offense? Critics say that CyberSitter has reached far beyond its mandate of porn-blocking and instead has censored innocuous, even invaluable web sites. I admit I'm one of its critics. In a CyberWire Dispatch that Brock Meeks and I published in July, we revealed that the censorware bans such places as the International Gay and Lesbian Human Rights Commission and the online home of the National Organization for Women. Our Dispatch showed the world -- or at least our readers -- that the makers of CyberSitter have a clear political agenda. The article prompted follow-ups in CyberTimes and the National Law Journal and an editorial in the Washington Post with an exchange of letters to the editor between a NOW executive and a representative of Focus on the Family, a conservative group that markets CyberSitter. To Milburn's mind, our act of revealing the truth about his company's product was, literally, criminal. In August, he told us that he had asked the U.S. Department of Justice to launch a criminal investigation into the publication of our article. He was particularly upset with one paragraph that included a fragment of his database demonstrating that CyberSitter expressly bans info about gay society and culture. He wrote: "Your willful reverse engineering and subsequent publishing of copyrighted source code is a clear violation of US Copyright law. While we would easily prevail in a civil court in seeking damages... we will seek felony criminal prosecution under 17 USCS sect 503(a) of the Copyright Act, and are preparing documentation to submit with the criminal complaint to FBI [sic]." Milburn was upset because CyberSitter's database is scrambled to prevent kiddies from grabbing addresses of porn sites from it. It's lightweight encryption, sure, but just enough to frustrate Junior. The scrambled database also allows Solid Oak to add and delete banned sites without the user's knowledge -- something that we believe is a dangerous practice. Now, I should point out here that neither I nor Brock did the actual decrypting; we had received a copy of the descrambled filter list from a confidential source. In any event, Dispatch's attorneys replied to Milburn, saying that the article was "protected by the full force of the First Amendment to the United States Constitution" and fell squarely within the copyright act's "fair use" provisions. We never heard back from him or the FBI. But that nastygram from Milburn wasn't his last. As criticism of CyberSitter becomes more intense, he's stepped up his counterattacks, threatening legal action, blocking critics' sites, or both. Take Bennett Haselton, a college student who cobbled together a site called Peacefire in August. This fall he started an anti-CyberSitter page that listed some of the more controversial actions of the software. Milburn complained. On December 6 he wrote to Haselton's Internet provider, Media3 Technologies, and tried to persuade them to give Peacefire the boot. His e-mail said: "One of your subscribers has made it his mission in life to defame our product as he appearantly [sic] has a problem with parents wishing to filter their children's access to the internet." Another charge was that Haselton had linked to a copy of our Dispatch. Solid Oak then added Peacefire and Media3 to its list of blocked sites. To Marc Kanter, Solid Oak's marketing director, it was necessary. "The site directly has links to areas that have our source code decoded on it.... There's no reason that our users should be able to go to sites that effectually inactivate our program," he said. Milburn also accused Haselton of reverse-engineering CyberSitter to get the text of its database -- that is, of being the confidential source for the CyberWire Dispatch. "Reverse engineering had to have been done in order to get the information, and we believe Mr. Haselton was the one who did it," Milburn wrote. Note to Millburn: Haselton wasn't our source. Then there's the case of Glen Roberts. His web page giving instructions on how to disable CyberSitter is now banned -- as is his Internet service provider. That's because CyberSitter differs from its competitors CyberPatrol and SurfWatch, which can restrict access by URL; instead, CyberSitter has to block access to the entire ripco.com domain. So what's my problem, really? If people don't want to use CyberSitter or other nanny apps, they don't have to. It's voluntary. It's effective. It protects children, and it sure is better than the Communications Decency Act. I have one major objection to all of the software filters currently on the market: Consumers have no way of knowing what's being blocked. Without knowing what's on the filter list, parents can't know what Junior will or won't be seeing. When reporters who try to reveal that information are faced with potential criminal investigations, the press's ability to shed light on these companies is threatened. Such programs also give parents near-complete control over what their children can and can't read. Traditionally, kids have been able to browse the stacks of a library away from parental supervision. But when the library is online, access can be completely controlled by censorware. Pity the closeted gay son of homophobic parents, prevented by CyberSitter from accessing soc.support.youth.lesbian-gay-bi. Finally, it's a kind of intellectual bait-and-switch. The "smut blockers" grab power by playing to porn, then they wield it to advance a right-wing, conservative agenda. Family values activists would never have been able to pass a law that blocks as many sites as CyberSitter does. Besides censoring alt.censorship, it also blocks dozens of ISPs and university sites such as well.com, zoom.com, anon.penet.fi, best.com, webpower.com, ftp.std.com, cts.com, gwis2.seas.gwu.edu, hss.cmu.edu, c2.org, echonyc.com and accounting.com. Now, sadly, some libraries are using it. Solid Oak claims 900,000 registered users. ###

1 0

Re: Ebonics
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> wrote: >In order to remain compliant with the new California law requiring >increased use of "Ebonics," the new academic name for "Black English" (and >known by honkey mofos as "ghetto jive"). Apparently the coloreds have had >enough of "standard English" and its repression of their culture. To meet >the requirements of this new law, 10% of my posts from now on will be >written as best I can manage in the Ebonic language. ("Ebonics" elided) There's got to be a better way than Ebonizing manually. First there was the Canadianizer, eh, hoser? Then there was Zippy (www.metahtml.com/demos/zippy/) which is terrific for Willy/Freeh/Reno speeches. We really need an Ebonizer (TM)! BTW, Tim's not kidding about the Oakland, CA school system. Check your regular news source.

3 2

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 18:51:28 EST, you write: << How about the extra hard drive space you have to purchase because you can't just keep one copy on a server anymore? >> Well... considering most apps for client server (on the client machine) arent _huge_ (memory is so damn cheap anyway) Why on earth(forgive me if I am truly missing a point here) would you put all the copies on the server?

1 0

Yiddish humor
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

How do you call a "cypher punk" without AIDS? Gay gezund. How do you call a "cypher punk" with AIDS? Gay in drer. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Van Eck articles
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

>Looking for: > >"Protective Measures Against Compromising Electromagnetic Radiation Emitted by >Video Display Terminals" by Professor Erhard Moller, Aachen University, 1990 >(no source citation) I have a copy of the original German version of this, I can snail mail a copy if anyone wants to translate it. It has lots of graphs and diagrams which probably won't scan very well, and it will need translation before most of the people on the list can make any use of it. I know there are English versions floating around, but I've never seen one. BTW the work was done in the early '80's, not 1990. Peter.

1 0

nyetscape 3.x bug
by Psionic Damage 17 Dec '03

17 Dec '03

Has anybody noticed that netscape 3.x has a bug that brings the last page that I was on onto the next page that I go to, do I need to delete a history file or something, or does anybody have the answer to resolving this problem. Sincerely, PsiD pSIONIC dAMAGE Zer0 Faith Inc. www.geocities.com/SiliconValley/Heights/2608 H/P/A/V/C ANTIVIRUS/COUNTERSECURITY "ONLY THE ELITE SURVIVE!"

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 3:19 PM 12/20/1996, Andrew Loewenstern wrote: >Hal Finney writes: >> The answer presumably is that the software manufacturer will >> sell software with such limits for much less than he will sell >> unlimited software. That's because software piracy is such >> a major problem, and this way he can be protected against >> piracy from this copy of his program. So people with these >> CPU's can buy their software a lot cheaper. > I believe this is a pipedream. As it stands now, virtually all of the > software that requires special hardware dongles is ridiculously expensive, > even compared to similar offerings from other companies. Why do you think this is? I don't understand why I would buy a more expensive package that required a dongle rather than a less expensive package which does not. This is mysterious. Peter Hendrickson ph(a)netcom.com

1 0