December 2003 - cypherpunks-legacy

Re: Dissolving Choke Points
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

i do have unix (linux) and stuff, but i can't take a lot of subscribers -- maybe 200-300 or so. i actually wrote a proposal for a mailing list without a central control point, with several advantages being impossibility of control, absense of a single point of failure, and cryptographic verification of honesty of moderators. if there is any interest, i will post it here. igor Peter Hendrickson wrote: > > I was amused by the similarities of USG crypto policy and the > moderation of the cypherpunks list. Recently a number of new > regulations were announced to go into effect by a certain date. > Requests for comments were made after the policy was announced. Many > of us thought that was pretty sneaky. I feel the same way about the > moderation plan. > > Moderation has been a failure. I'm pretty good at filtering and I > can sadly report that there is very little signal out there. > > There are lessons to be learned here. One is that censorship does > not promote a stimulating and creative dialogue. The cypherpunks list > right now is about as interesting as hanging out by the 7-11. > > Another lesson is the danger of choke points. We can see how > tempting it is for people to exercise their control. Even John Gilmore > was unable to restrain himself from involuntary social engineering > experiments. Who would we have considered to be more trustworthy? > > Toad.com is a choke point, not just in terms of moderation but in > terms of the rate at which it can distribute messages. Let's > replace it. > > What we want are many machines carrying the cypherpunks list. A > message posted to any machine goes to all of the others. Each > machine sends messages to its subscribers only once. Some of > these machines should be across borders. > > The mail loop and multiple posting problems are solved by observing > the message IDs. > > Fast implementation: use moderated mailing list software. Put a > filter in the .forward file of the "moderator" account which looks > at the message ID and forwards the message if it hasn't been seen > already. The mailing list machines all subscribe each other. > > I've been looking for a stable machine with a good net connection to > do this. I haven't found one. However, if we have many machines > sharing the load, the stability of any one unit is not as important > because the list will survive multiple "hits". Only the subscribers > on one machine will be affected by having their messages delayed. > This greatly reduces the work and responsibility for any one list > operator. (As John will attest, keeping a machine running 24 hours a > day, 7 days a week, rain or shine, is a lot of work.) > > Also, with multiple machines, each unit handles a small amount of the > load. This makes more machines available and has less impact on > people's net connections. > > Last I checked, there were about 1200 addresses on the mailing list at > toad.com. All we need are about 10 machines to take 120 subscribers > each. (This is a completely manageable load.) > > Do you have a Unix machine on the Net? Does it have sendmail and > Perl? Then you have all that it takes to participate. Send me > mail and I'll help you set it up. > > Peter Hendrickson > ph(a)netcom.com > > P.S. I like and respect John and Sandy and I've learned a lot from > both of them. While basically well-intentioned, they just made a > mistake in this instance. > > - Igor.

1 0

Filling Power Vacuums
by Timothy C. May 17 Dec '03

17 Dec '03

At 6:57 AM -0800 2/3/97, Sandy Sandfort wrote: >After reading through Tim's post, I don't think much would be >served by doing another point by point response. From Tim's >tone, it appears he is still seething about how this all came >about, so I'll just leave our two expressions of opinions where >they were. I have no wish to exacerbate any hard feelings Tim >may be having. Indeed, I have been seething for the past several weeks (off and on, as I am fortunately able to usually put it out of my mind and do other things with my mental energies....). I think I have figured out why I'm seething. It's about "power grabs." You see, in any anarchic situation, where reliance on self-control and self-filtering is emphasized, there is always a _temptation_ for some to "fill the power vacuum" and grab power. I learned in my years at Intel how easy it was to start bossing people around, and as I hired engineers and scientists, I built up quite a little empire. But I didn't like what it was doing to me, as it distanced me from the technology and also brought out "control freak" tendencies....I started worrying about how my people were using their time ("my" time), and I increasingly applied my own notions of what they should talk about and what were suitable topics for laboratory chatter. In other words, I became a censor. (Not a government censor, but a censor in the broader definition I've already cited.) So I gave it up. Even before eventually retiring from Intel, I elected to leave the management track and rejoin the "technical ladder," becoming one of Intel's so-called Principal Engineers. No longer could I control others, except through the example I set and the information I provided. And I was happy I had moved away from "the dark side of the force." (I accept the role hierarchies play in corporations. They can't be built with just people like me. They need leaders, controllers, power freaks, etc. But a virtual community like the Cypherpunks group is not such a heirarchical organization, and it needs few rules, leaders, etc. "We don't need no steenking leaders.") As this relates to Cypherpunks, I have steadfastly refused to consider any "management role," so to speak, in how the list is run, the formal policies, etc. I'm not saying there has been a call for management (though Detweiler used to rail against us for not having a management heirarchy, for not having rules and democratic procedures for "making decisions"), just that the power vacuum in anarchies such as ours is often an open invitation for someone to step in and "provide structure and guidance." I resisted any thoughts of doing this, and argued against this sort of thing whenever the topic came up in conversation. I chose to lead only by the posts I wrote and the ideas I worked on. There have been frequent calls over the years for the Cypherpunks to have a more permanent presence, perhaps even an office in Washington, D.C., such as the EFF had, the CPSR still has, and so on. And to have an Official Spokesman, a contact person for the media droids to contact. The calls for this have declined in the last couple of years, as people figured out that the Cypherpunks are not about having spokespunks for us, and that the media will just have to deal with the "anarchy" of having to herd cats to get information out of us. Now, of course, the message is being sent that Sandy Sandfort is in some sense the de facto leader, being that he determines what traffic goes out to the main list and what traffic gets bounced into the flames list. In fact, I'll make a prediction: The media will see that he is the chief censor and arbiter of worthiness and will increasingly contact him for the Official Point of View on various items they are interested in. It distresses me greatly that Sandy Sandfort has elected to move into this "power vacuum" to nominate himself as our Leader and Chief Censor. Foo on that. (I used to hear this at Intel, where the argument for a hierarchical structure was much stronger, to wit: "Tim, if you won't agree to manage others, you'll have to accept that people less technically competent than yourself are going to elect to become managers and they'll probably become _your_ manager in the not too distant future.") So, I sort of thank Sandy for helping me to realize certain things that I may not have explicitly realized before. Namely, I realize that I don't want the karmic burdens of power myself, preferring to lead only by the example I set and the ideas I generate. This is why "market anarchies" (books, music, ideas, all things where "no ruler" exists) appeal to me so much. And since I don't wish to assume the mantle of leadership, and don't see much need for leadership or global censorship (as opposed to locally contracted for filtering, a la Eric Blossom's list, or Siskel and Ebert giving recommendations, or ratings of restaurants, etc.), I am resentful and suspicious of people who _do_ step into the "power vacuum" to lead and control. Now I grant you that Sandy's form of leadership and control is relatively mild, but the very notion that Sandy can reject a long essay because of a couple of phrasings he dislikes (this was his "judgment call" point about why he (reluctantly?) allowed my post to go out) is a step in the wrong direction. And given our strong ideological bias toward market anarchies, this move toward censorship stands out like a sore thumb. At least the issue would be clearer if Sandy passed all posts through but deleted sections that offended him and marked deleted sections as "**CENSORED**." Yes, I'm seething. Sandy is right about that. I saw a group I helped create and spent thousands of hours on, writing articles and developing ideas choose--by fiat from the owner of the machine the list was being sent out from--to embrace the dark side, the control freak side. In the name of "comity," Sandy's term for the bonhomie he thinks he can cultivate, we lose our ideological purity. "Hey, even the Cypherpunks have embraced censorship." Instead of letting the power vacuum remain unfilled, and suggesting to people that they solve the problems it creates as best they can, Sandy jumped in to fill the vacuum. This is what I'm seething about. And even dropping the power grab at the end of the "experiment" will not stop this seething. Fuck it. --Tim May " Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: GAK cracking?
by C. Kuethe 17 Dec '03

17 Dec '03

On Mon, 3 Feb 1997, tmcghan(a)gill-simpson.com wrote: > Just days after a U.S. graduate student cracked the most powerful > computer encryption system allowed out of the country, the Commerce > Department announced it would allow three companies to export an > even stronger system. [snip] > Companies said products with just 40-bit long keys, the old limit, > were too easy to crack. The approvals came just days after Ian Goldberg, a > graduate student at the University of California, cracked a message > encoded with a software key 40-bits long. > > The government did not name the companies given permission to export > stronger, 56-bit programs, but Glenwood, Md.,-based Trusted > Information Systems acknowledged that it was one of the three. Why does it not surprise me that TIS gets permission to export 56-bit (DES?) ? They do key recovery (is it GAK?) They brag about government consulting. The clients they will admit to having are listed on: http://www.tis.com/docs/products/consulting/govt/govcon.html and, purely unsubstantiated rumors here, but I've heard (seen) TIS, NSA, FBI and other "friends" of ours all together in the same paragraph. Conspiracy? Maybe... This is both good and bad.... yes, longer codes are now exportable, but only to / by certain people? I notice that the new cipher length is 56 bit...same size as DES? hopefully that's just a coincidence (yeah, right) or maybe somebody's starting to see the real world where people download pirate cryptosystems and says "so let's export bigger ones and make a buck off it, too..." (yeah, right) PLUR chris -- Chris Kuethe <ckuethe(a)gpu.srv.ualberta.ca> LPGV Electronics and Controls <c100305(a)wolfcreek.cs.ualberta.ca> http://www.ualberta.ca/~ckuethe/ RSA in 2 lines of PERL lives at http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Another ActiveX hole (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

-------+..........................................................+------- + ^ + : Ray Arachelian : #include <std_disclaimer.h> :../|\.. \|/ : ray(a)earthweb.com :.....................................:./\|/\. <--+-->: ................ : My oppinions are my own and do not :.\/|\/. /|\ :voice: 212-725-6550 : neccesairly represent those of my :..\|/.. + v + :....................: employer. :....... .... http://www.sundernet.com ...personal.email sunder(a)sundernet.com ..... ---------- Forwarded message ---------- Date: Mon, 03 Feb 1997 13:26:44 -0500 From: Andy Breen <abreen(a)earthweb.com> To: yak(a)earthweb.com Subject: Another ActiveX hole hmmmmmmmmmmmmm.... ------------------ DMK: An application of covert channels. From RISKS Digest Vol 18, Issue 80. Date: 1 Feb 1997 05:12:02 GMT From: weberwu(a)tfh-berlin.de (Debora Weber-Wulff) Subject: Electronic Funds Transfer without stealing PIN/TAN The Berlin newspaper "Tagespiegel" reports on 29 Jan 97 about a television show broadcast the previous evening on which hackers from the Chaos Computer Club demonstrated how to electronically transfer funds without needing a PIN (Personal Identification Number) or TAN (Transaction Number). Apparently it suffices for the victim to visit a site which downloads an ActiveX application, which automatically starts and checks to see if Quicken, a popular financial software package that also offers electronic funds transfer, is on the machine. If so, Quicken is given a transfer order which is saved by Quicken in its pile of pending transfer orders. The next time the victim sends off the pending transfer orders to the bank (and enters in a valid PIN and TAN for that!) all the orders (= 1 transaction) are executed - money is transferred without the victim noticing! The newspaper quotes various officials at Microsoft et al expressing disbelief/outrage/"we're working on it". We discussed this briefly in class looking for a way to avoid the problem. Demanding a TAN for each transfer is not a solution, for one, the banks only send you 50 at a time, and many small companies pay their bills in bunches. Having to enter a TAN for each transaction would be quite time-consuming. Our only solution would be to forbid browsers from executing any ActiveX component without express authorization, but that rather circumvents part of what ActiveX is intended for. A small consolation: the transfer is trackable, that is, it can be determined at the bank to which account the money went. Some banks even include this information on the statement, but who checks every entry on their statements... Debora Weber-Wulff, Technische Fachhochschule Berlin, Luxemburger Str. 10, 13353 Berlin GERMANY weberwu(a)tfh-berlin.de <http://www.tfh-berlin.de/~weberwu/

1 0

Re: Moderation [Tim,Sandy]
by Lucky Green 17 Dec '03

17 Dec '03

At 12:28 PM 2/3/97 -0800, Peter Hendrickson wrote: >At 11:38 AM 2/3/1997, Lucky Green wrote: >> I am well aware of the name recognition and reputation capital associated >> with CP, still I believe it best to *kill the list*. > >If you don't like the list, why not unsubscribe? That won't solve the problem. The list has become counterproductive. It is impossible for other lists to provide a real forum for the discussion of the topics that this list used to be about while CP still exists. At the same time, CP has long stopped providing such a forum. CP is draining energy from its subscribers and the cause. Kill it! Kill it now! -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

RE: My Departure, Moderation, and "Ownership of the List"
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May With no false modesty I tried awfully hard to compose substantive essays on crypto-political topics, often more than one per day. (Others did too, but they seem to be tapering off as well, leaving the list to be dominated by something called a "Toto," the "O.J. was framed!" ravings of Dale Thorn, the love letters between Vulis and someone name Nurdane Oksas, and the occasional bit of crypto news. Ho hum. I'm glad I'm not reading the list in e-mail, and thus can easily avoid replying to these inanities... .......................................... Your thoughtful contributions to the list are missed, Tim. As soon as I realized that you had left the list I suspected it had something to do with its moderation. However, I must protest the inclusion of Toto's posts as one of the "inane". His posts were intentionally formulated to cause to stand out what was, indeed, inane - as he said, to "hold up a mirror". And he continually decried the list experiment, pointing out the philosophical contradiction of a moderated "anarchist" forum. If the antidote to bad speech is more speech, then he certainly provided some, although not on the level or style as yourself. And you may say that some of these posts are not worth replying to, but didn't I see you respond to one of Dale's, regarding a photo of Jessica-the-pilot which he keeps above his desk? .. Blanc

2 1

Information Warfare
by pdh＠best.com 17 Dec '03

17 Dec '03

The cypherpunks list has been under "attack" for some time. How have we managed it? Very poorly in my view. Some people have dismissed the idea that rogue governmental elements are behind some of our problems. Yet, there is no reason to rule out this hypothesis. The government has not always behaved well with regards to its perceived enemies in the last few decades. The FBI seems to infiltrate everything - even churches!. This is well documented. The CIA has worked hard on disrupting various political movements of which it did not approve using provocateurs and other conspiratorial dirty tricks. (I believe the FBI has, too, but I do not recall any documentation offhand.) We know that "Information Warfare" is the big thing in the defense establishment right now. It's all over their web pages. We see articles from the Kennedy School which seem to compare free speech with disease. Etc. Etc. We also believe that the things the Cypherpunks are interested in are on the radar screen. Maybe the Cypherpunks are, too. Is it unreasonable to ask whether some people are getting funding to experiment with disrupting "groups" like the Cypherpunks? I can easily picture people inventing all sorts of important sounding words like "psy-op" for what is little more than rudeness. Whatever the cause of the disruptions, the solutions are the same. Most of the proposals I've been hearing have to do with controlling the behavior of other cypherpunks and creating more structure. This is a mistake. It's clear that even the definitions of "spam" and "flame" are hard to nail down. The next idea will be to moderate on the basis of content. How will we decide what is content? Clearly that's much too important a question to leave to just one person. What we need is a committee to decide! What's next? Robert's Rules of Order? All of this detracts from the work we have before us. If you've ever been involved with a non-profit organization, you will know that enormous energy is spent on internal political scheming. That's a boring waste of time. Let's go down a better path. Let's think about the best way for each cypherpunk to manage disruptions. Please consider these suggestions: 1. Filter noise. I filter based on origin. If a kill file doesn't work, use a positive filter to read messages only from people who are worthwhile. It has been suggested that this doesn't work because some people post garbage, but also occasionally post something good. There's gold in the ocean, too. Why don't we retrieve it? If you don't want to manage a filter yourself, find somebody to do it for you. A number of people offer filtering services. Remember that in an open forum, noise increases with signal. The more worthwhile and interesting threads are on the list, the more worthless postings we are going to see, particlarly when people are consciously disruptive. 2. Post signal. Filters are useless when there is no signal. Signal comes from cypherpunks. You are a cypherpunk. 3. Birds of a feather flock together. When you respond to somebody, you mingle your on-line identity with theirs. Fly with the eagles. Peter Hendrickson ph(a)netcom.com

1 0

Re: Moderation [Tim,Sandy]
by pdh＠best.com 17 Dec '03

17 Dec '03

At 1:12 PM 2/3/1997, Lucky Green wrote: >At 12:28 PM 2/3/97 -0800, Peter Hendrickson wrote: >>At 11:38 AM 2/3/1997, Lucky Green wrote: >>> I am well aware of the name recognition and reputation capital associated >>> with CP, still I believe it best to *kill the list*. >> If you don't like the list, why not unsubscribe? > That won't solve the problem. The list has become counterproductive. It is > impossible for other lists to provide a real forum for the discussion of > the topics that this list used to be about while CP still exists. At the > same time, CP has long stopped providing such a forum. CP is draining > energy from its subscribers and the cause. Kill it! Kill it now! Who should do what to comply with your proposal? Should John shut down the list? Are you asking everybody to unsubscribe? I don't think "killing the list" is an option for you or anybody else. The List transcends all domains. Peter Hendrickson ph(a)netcom.com

1 0

Re: PGP 2.1
by Lynne L. Harrison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Mon Feb 03 17:19:14 1997 > Mark Henderson wrote: > > > > Larry Johnson writes: > > > Hello, > > > Can any;one tell me how to get a version of PGP 2.1? > > > Thanks > > > > > But, why do you want version 2.1? > > Because the guy who wrote it was let off after that on his jail > charges, so I'm not going to use anything he made after that if > I don't know why. > I'm not saying that he rolled over or nothin buyt I'm gonna be > paranoyd like he said in the book. I dont suposse he'd mind, > since he said it. > I'm not real smart sometimes but I'nm not a real lamer, either. > (I don't think) I bite my tongue.... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMvZkYj5A4+Z4Wnt9AQEtNwP/TXMTZcozL0dNIJjBbdX7mwu0DiEJZV29 nzmIOPZFQyqeVgc1+DrYc0oB6hILAdC5Juf2k7sHr3bzqwNUWERY+PskVRWxRsi6 onN5OqNiAZxVJMcUDZx2r34vZd9Z3TtkGqHDY91xr6Q8UgBYcsmI1SwyjUTwgwST oraGSR/h8eE= =YYIb -----END PGP SIGNATURE-----

1 0

Re: RC5-12/32/5 contest solved
by Eric Blossom 17 Dec '03

17 Dec '03

A. Padgett Peterson P.E. Information Security apparently wrote: > Have good reason to believe your estimate for a purpose built machine this > year (expect 600,000,000 to 1,000,000,000 kps per sieve - these will not > be cheap chips but will be commecially available). Expect 400 arrays > would be required to do DES in a day (average) but is a lot more > achievable than the 65k postulated by the gang of nine. I received a nice flyer in the mail the other day from "Chip Express" (www.chipexpress.com, 800-95-CHIPX). They are offering Laser Programmed Gate Arrays. It appears to be a reasonable way to get some Wiener chips built. As I recall, the Wiener design required about 23,000 gates. Their blurb had the following table in in: FPGA Gates ASIC Gates 500 Units 1000 Units 5000 Units 40,000 20,000 $77 $45 $10 Not Avail 200,000 $176 $150 $82 So it appears that you can get 5000 Wiener key search chips build for about $50K. I'm not sure about the speed, but I wouldn't be surprised if you could clock these at 50 MHz. The Wiener design is pipelined and searches one key per clock, so each chip could search 50e6 keys / second. 50e6 * 5000 = 250e9 keys / second for $50K Happy Hunting... Eric

1 0