December 2003 - cypherpunks-legacy

New Australian export regulations
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

Australia's new export control regulations have just been posted to the net, you can get them from http://www.adfa.oz.au/DOD/al/iic/excontrl/excohome.htm (they're all Word 6.0 documents, I've been reading them with a binary file browser - blech). What makes them interesting is that most of the text is word for word identical to the Canadian regulations (which is sensible, since the Canadian ones are clear and easy to follow, unlike the US "We'll let you know when you've broken the law" FUD regulations). The only thing which is different is the section numbering, the mapping from Canadian to Australian section numbers appears to be: 10xy.y.z -> xY00?.Y.Z where y -> Y == 1 -> A, 2 -> B, etc and z -> Z == A -> 1, 2 -> B, etc, so that Canadian 1151.1.c becomes Australian 5A002.a.3 (this doesn't work in all cases, if there's no .n suffix on the Australian number then the .n part from the Canadian number becomes part of the main Australian number, eg 1071.5 -> 7A005. The text may not be taken straight from the Canadian one because some of the spelling mistakes in the Canadian one aren't present in the Austrlian one, or maybe it was prepared from a later version which had been spelling checked. For crypto software, you want cat_5.doc, equivalent to section 1150 of the Canadian regulations. Anyway, here's the good bit, in sou.doc, "GENERAL TECHNOLOGY NOTE (PART 1 - MUNITIONS LIST)" >3. Controls do not apply to "technology" "in the public domain", to "basic > scientific research" or to the minimum necessary information for patent > applications. Again, this is identical to the Canadian regulations. Since the Canadian government has already ruled that a whole variety of crypto software is exportable under this exception, it means that the same stuff (and equivalent software from Australia) should also be exportable, or at least that you've got a very good case for arguing with the Australian government if they decide it's not exportable. Then in definits.doc we again have the Canadian text: >"In the public domain" (GTN NTN GSN), as it applies herein, means >"technology" or "software" which has been made available without restrictions >upon its further dissemination (copyright restrictions do not remove >"technology" or "software" from being "in the public domain"). It's nice to have this stuff laid out at last, because it finally takes the Australian crypto controls out of a gray area and defines them so that stuff like SSLeay and my own cryptlib aren't restricted. Incidentally, there's also the cute: >1. The export of "technology" which is "required" for the "development", > "production" or "use" of items controlled in the Munitions List is > controlled according to the provisions in the Munitions List entries. > This "technology" remains under control even when applicable to any > uncontrolled item. This covers virtually any software development tool, and any kind of computer hardware, as well as natural neural networks and personal digital extensions (of the kind designed for keyboard data entry). I wonder if we'll see the regulations retroactively changed when someone in Canberra realizes what they've copied from the Canadian regs :-). Peter.

1 0

WIP_out
by John Young 17 Dec '03

17 Dec '03

12-21-96. NYP: "Global Agreement Reached To Widen Law On Copyright" On-Line Material: International law would specify that copyright protection includes the right to control the on-line distribution of copyrighted materials, as well as the right to prevent others from making unauthorized copies. "Fair use" -- the tradition of allowing individuals to make a limited number of copies for noncommercial purpose, or to use brief excerpts in news reports or artistic criticism -- would still apply in cyberspace. In a compromise meant to defuse one of the harshest criticisms of the treaty, negotiators agreed to delete language that would have treated even temporary copies of material downloaded from the Internet as possible violations of international copyright law. ----- WIP_out ---------- WIPO on the Web: http://www.wipo.org

1 0

Security hole in premail
by Mixmaster 17 Dec '03

17 Dec '03

There's a pretty nasty bug in premail that allows any non-root to obtain the contents of the premail secrets file. This is a race condition that can be exploited because an indefinite amount of time can pass between the time that premail checks if the secrets file exists and when it tries to write to the file. It can be exploited as follows: attacker: $ umask 111 $ ln -s ~/premail-secrets-file /tmp/.premail-secrets.$< normal user: $ premail -login Remember to logout when done. Your premail passphrase, please: All the attacker has to do is execute "touch premail-secrets-file" between the time that the user is prompted for the passphrase and the time when the login is completed. $ ls -al premail-secrets-file -rw-rw-rw- 1 d00d nogroup 19 Dec 20 19:01 premail-secrets-file $ cat premail-secrets-file [contents of premail secrets file] This bug can be fixed in two ways. One way is to set the premail-secrets setting to some non-world-writable directory. The second way is to apply the following patch: *** premail.orig Fri Dec 20 18:46:01 1996 --- premail Fri Dec 20 18:55:54 1996 *************** *** 3574,3579 **** --- 3574,3582 ---- } for ($triesleft = 2; !$done && $triesleft; $triesleft--) { $pass = &getpass ($x); + if(!-O $ps) { + &error ("Secrets file exists and is owned by another user\n"); + } $status = &decrypt_secrets ($ps_pgp, $ps, $pass); if (!-s $ps) { unlink $ps; } $done = (!$status && -e $ps);

1 0

Instruction Sets which are tough to emulate
by ph＠netcom.com 17 Dec '03

17 Dec '03

I'm guessing there are a bunch of ways to make a processor hard to emulate. For instance, you can make the registers 65 bits wide. Can anybody think of some more? Peter Hendrickson ph(a)netcom.com

2 1

Re: Ebonics
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

At 11:29 AM 12/20/96 -0800, Timothy C. May wrote: (snip) >De honks be chimin.' Code be fly! I's huffa be gots to be sizing, bitch. >PGP 3 be dope, nuffin but bad! > >I be axing you if it be outa honkeyland or outa Afrika? Dat bitch Reno be >sayin' it be 'legal be usin' dope 'warez. Day be hos. Jesus Tim. You're letting your lilly white show. -feeling-oppressed-by-every-law-in-existance-white-boy Matt

8 8

Re: Dale defends free society from the NSApunks
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

:Date: Fri, 20 Dec 1996 14:10:11 -0800 :From: Rich Graves <rcgraves(a)disposable.com> :Stop bashing Dale, you ADL/CFR/NSA thought police, you. I can recognize sarcasm! You're on the list! Yes, THE list! Yours from NSA.

2 1

Re: Executing Encrypted Code
by AwakenToMe＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-12-20 19:54:09 EST, ph(a)netcom.com (Peter Hendrickson) writes: << > I believe this is a pipedream. As it stands now, virtually all of the > software that requires special hardware dongles is ridiculously expensive, > even compared to similar offerings from other companies. >> Well.... it seems to me that if the software is going to be so expensive.. that would THEN motivate to put dongles on.. seeing as these are the hardest to crack.

1 0

RE: Life with Dale
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May [.....]what was left of her [is] rotting in a grave somewhere north of me. ....... [...] interestingly, the Cypherpunks had a big beach party between Pescadero (where Dubroff lived) and Half Moon Bay (where she flew out of) just a couple of days prior to her departure. (This was the beach party put together by Doug Barnes, last spring.) ....................................................... Coincidence? .. Blanc <g> > > > >

1 0

Re: Executing Encrypted Code
by Dalban 17 Dec '03

17 Dec '03

Scott V. McGuire wrote: > You should expect software companies to make more money and for prices to > come down. Remember, there's not just one software company. This scheme > would force some of the people who would copy software to buy it, > increasing the profits to the software companies. So, why would the price > come down? Well, because of the increased profit margin, there is now > room for the price to come down, and since there is competition among > software companies, at least one of them will lower prices for the > advantage it will give them. The others will have to follow. And therefor I write: Of course that would be in a microsoft-less world where there wasn't one company who controlled huge market shares, who dominated the industry and who didn't have both government and 'big business' in their pocket. Microsoft is the great 'teflon corportation' able to shake off controversy after controversy regarding everything from hostile marketing strategies to product dumping. Since Microsoft already maintains a virtual monopoly I don't see how making the user pay will serve justice. In your world we'd have to pay for whatever inferiour product is handed to us... not only limiting our choice and freedom but making Microsoft that much more powerful. My two bits, take it or leave it. Dalban

3 2

Re: FWD: PGP-fone Mailing List Archive
by Bill Stewart 17 Dec '03

17 Dec '03

>reachable off the PGP Fone Registry, but the exact URL is : > http://pgp.rivertown.net/pgp-fone/archives Actually seems to be http://pgp.rivertown.net/pgp-fone/archive/ # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0