December 2003 - cypherpunks-legacy

Re: Fighting the cybercensor
by Hallam-Baker 17 Dec '03

17 Dec '03

I think that with the demise of Mr Bell and anyone running a remailer there would be an end to his scheme pretty quickly. Society is not bound to put up with cranks and psychopaths. there is no right to anonymously call for murder. The authorities could easily stop Bells scheme. The point I was making is that it is not consistent as claimed. Phill

1 0

Re: Last nail for US crypto export policy?
by f_estema＠alcor.concordia.ca 17 Dec '03

17 Dec '03

On Wed, 29 Jan 1997, Dan Geer wrote: > Export controls are meaningless without domestic use restrictions and > domestic use restrictions will never pass the test of the First > Amendment. <snip> Just because something is unconstitutional doesn't mean that learned judicial appointees will find it unconstitutional. When domestic GAK is passed, it will be structured to fit into the judicial philosophy of the day. This is under the same philosophy that says television shows are not speech, but rather a commercial enterprise. If the courts were first amendments absolutists, like the persons on these two lists, there would be no problem seeing porn on primetime TV. There would also be no V-chip law. When they manage to get the political conscensus, they will pass it. Incidentally, I remind you of the results of the moot court that was held at one of the CFP conferences, where a GAK case was tried in front of real federal judges by real lawyers. Our side lost.

2 1

Complying with the EAR [was: More Circumventing the ITAR]
by Michael Paul Johnson 17 Dec '03

17 Dec '03

On Tue, 28 Jan 1997, Mark Rosen wrote: > I'm curious as to exactly what the ITAR/EAR/Whatever says specifically > about "unrestricted FTP sites." My program, Kremlin, is available for You should check the exact text yourself, but the way I read the EAR, you are not "exporting" strong cryptographic software without a license (exept to Canada, which needs no license) if you do things "such as" (1) have the guests to your site acknowledge that the EAR restricts export, (2) have the guests affirm that they can legally get the software (proper citizenship or residency & location), and (3) "check the address of the destination computer to see if it is in the USA" or Canada. The last one, I interpret rather loosely to mean that if the guest's email address domain isn't one commonly used in the USA or Canada, then I deny access. We all know that not all .com addresses are North American, but chances are really good that if the address ends in .ru, then the destination machine is probably not in North America. This is not a perfect way to prevent export, of course, but it is what the regulations say, as I read them. For a pointer to the regulations and to my access request form and crypto site, see http://www.sni.net/~mpj/crypto.htm Disclaimer: I am not a lawyer, and most lawyers don't even understand this stuff, so you read and act on it at your own risk. This is just my best effort to comply with the law without sacrificing my right to publish. > download at the web page below. On my web page, I have some stuff in bold > print that informs about the ITAR and tells people to go away if they're > not from the US or Canada. Does this count as an unrestricted FTP site? Is there any reason why people have to look at your warning before reading your warning? At my site, the ftp site itself is in a hidden directory that changes names often enough that people can't successfully link to the restricted files for very long without going through my warning page. Indeed, my site can't be navigated and indexed properly by web search robots. At your site, it is extremely likely that someone would find your software without ever seeing your warning. Indeed, your software is on another server with another interface. I think that your site counts as unrestricted. > Also, back to the question of registration numbers. A registration number > is just a string of letters and numbers, and is essentially the same as a > friendly letter; it contains no cryptographic code. For all anyone knows, I > could just be charging for pseudo-random numbers, again, nothing of > cryptographic significance. Is it illegal for me to mail someone outside of > the US or Canada a registration code? Thanks for any help. The registration code is legally equivalent to the registered software that it unlocks. Sending the registration code to France, for example, would be likely to be considered the same as sending the registered software to France (in violation of the laws of both countries). Now if the "unregistered" software is weak (i. e. crippled key length) without the registration code, you need not worry about posting it publicly and without restriction, as long as you don't export the registration code (except to Canada) without a license. I do this with Quicrypt (ftp://ftp.csn.net/mpj/qcrypt11.zip) BTW, I posted krem104.zip at my site. Please let me know if I mangled it in the process... http://www.sni.net/~mpj/crypto.htm Michael Paul Johnson Opinions herein are not necessarily Exabyte's. Work: mpj(a)exabyte.com http://www.exabyte.com Personal: mpj(a)csn.net http://www.csn.net/~mpj BBS 303-772-1062

1 0

Re: Fighting the cybercensor
by Hallam-Baker 17 Dec '03

17 Dec '03

I think that with the demise of Mr Bell and anyone running a remailer there would be an end to his scheme pretty quickly. Society is not bound to put up with cranks and psychopaths. there is no right to anonymously call for murder. The authorities could easily stop Bells scheme. The point I was making is that it is not consistent as claimed. Phill

3 3

Workaround for filtering/cybersitter
by Mark Rogaski 17 Dec '03

17 Dec '03

If I had experience with Netscape plugins and spare time, I'd try it myself. But here's my proposed solution. A plugin in Netscape intercepts all requests, encrypt the URL with a pubkey algorithm, encode the string base64, send it as GET input to a proxy server. The proxy server decodes and decrypts the URL, gets the requested page, and returns it. This beats out URL-based filtering. Still need to figure out the specifics of key-exchange. If we use 40-bit encryption, it's exportable, and it still works in our threat model (ie. we don't care if the watchers figure out the URL a few hours later). To beat out dropping packets with unacceptable pattern in them, we could use an SSL-based server as the proxy. The plugin could even have a nice little on/off switch and a list list of available proxies. mark -- [] Mark Rogaski || "Computers save time like kudzu [] [] wendigo(a)pobox.com || prevents soil erosion." [] [] http://www.pobox.com/~wendigo/ || - afcasta(a)texas.net [] [] >> finger for PGP pubkey << || []

1 0

"Meeks Unfiltered" on ISP-TV Wednesday nights
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: "Meeks Unfiltered" *** Wednesday Nights *** *** 8:00 PM ET *** If you missed "Meeks Unfiltered" last week, you missed how easy it was to intercept cell phone calls, the recent decision on the Phil Karn encryption case, and electronic freedom in Hong Kong as it is taken over by China. Don't miss "Meeks Unfiltered" this week! Brock N. Meeks is the publisher of the 800,000 subscriber CyberWire Dispatch electronic news service, and he brings his crusading style into real-time Internet video with "Meeks Unfiltered." The live uncensored hour-long show, produced and distributed through ISP-TV, explores cyberspace and cyberpolitics Wednesdays at 8 PM Eastern Time. Call-in questions will be taken during the show at (301) 847-6571. Tell Brock and co-host Declan McCullagh what you think! **** This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.248.54, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html. See URL http://www.digex.net/isptv for more information about the ISP-TV Network To obtain Enhanced CU-SeeMe software, go to: http://goliath.wpine.com/cudownload.htm

1 0

Re: East German Collapse (Was: Fighting the cybercensor
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Rich Graves <rcgraves(a)disposable.com> wrote in article <5cnvpf$jeu(a)life.ai.mit.edu>... > Hallam-Baker wrote: > > > > One point I had forgotten. The demonstration took place > > on the 50th anniversary of Kristallnacht. This is one explanation > > as to why the border guards did not attempt to open fire with > > firearms or attempt to break up the demonstration with tear gas. > > I think the timing was a coincidence. (And I'm told that Kristallnacht > wasn't well advertised in East Germany; especially after the Soviets > sided the United Arab Republic, the official story was that Hitler had > been exterminating good Communists, not Jews.) This differs from my information. In point of fact the Nazis _did_ exterminate communists. At the time of Kristalnacht it was the communists who were the more direct target because they had places in the Riechstag. It was by imprisoning the communist deputies that the Nazis were able to take power and pass the enabling act. Portraying the Nazis as uniquely persecuting Jews is simply not supported by the facts. The Jews were the largest group of those persecuted but not the only group. Gypsies had less support in other countries. Other groups were persecuted for opposition rather than who they were but the numbers of murders were still large. This is one reason why the Catholic church established a convent inside Aushwitz where it is estimated that about a quarter of a million Catholics were murdered. Quite what one is then to make of appeasement by the Papacy at the time is beyond me... I don't think it points to any great moral or spiritual stand. > They gave him a gun and put him on the front, where he waved to his > friends as they walked across the border. > > I think a lot of the border guards were like Thomas. Shades of Machiavelli's description of the mercenaries union in the 1500s. Basically you could hire yourself an army but they weren't keen on there being much killing. > Yeah, yeah. Economics has something to do with it. But I think it comes > down to "Sure, I'll carry a gun, and I'll go where you tell me to go, > but I will not hurt anyone." Ideas matter. Absolutely! Phill

1 0

Re: Getting into MIT is impossible
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Anonymous <nobody(a)REPLAY.COM> wrote in article <5cndl2$89k(a)life.ai.mit.edu>... > "The only thing I didn't have that the next MIT applicant had was money. I > made the mistake of letting them know that I was dirt poor and would need > full aid/grants/etc, and to quote "The Great Escape" it was "Zzzt! To the > Russian front!"" > > My guess is that "other factors" were involved. Inevitably since the admissions tutors would not have known the means of the parents. Thats the whole idea of "needs blind" admissions. The admissions people could not give a damn about means. The alumni that are most likely to make donnations are those who made it from scratch in any case. > I noted with some interest, but little surprise, that the guy claiming MIT > required a 4.0 GPA and a 1600 combined SAT score could barely spell, and > had major problems making a coherent point. Methinks this is why MIT > rejected him, not his lack of a "1600." Possible but remember that dyslexia is not an indicator of intelligence. The director of the Media Lab is dyslexic. Certainly if you think that being taught in a particular operating system is important you should probably try elsewhere. Depending on which classes you take you could end up using UNIX, Windows or Genera. The main advantage of UNIX is that it is reasonably compact and we have full sources which means that people can be set operating system projects. Windows NT is much too large for that although it does have many interesting APIs that make it usefull for teaching application level stuff. I would imagine that there will be people interested in NextStep for Apple too, Tim-B-L was always a Next person, but he learnt how to use it because he had an open mind. If he had thought that nothing could be better than what he had already he would still be using CERN-VM. If someone can't cope with an unfamilliar O/S they probably shouldn't be an engineer at all. An O/S is only one large software system a grad needs to deal with. They have short lifetimes, rarely being dominant for more than a decade. Phill

1 0

Re: Trigger-Words...
by Elliot Lee 17 Dec '03

17 Dec '03

On Wed, 29 Jan 1997 harka(a)nycmetro.com wrote: > Actually, I might not have chosen the correct words for what I > wanted... > I am looking for sniffer-programs, that analyze e-mail traffic on > the Net and filtering out all e-mails potentially interesting for > _intelligence services_. For example, I've heard, that if an e-mail > contains the words: "assassinate President" (DISCLAIMER: I hope, our > President lives a long and happy life, even after his > impeachment...:)), it will automatically get filtered and checked > out by the Secret Service. Everytime someone sends a message through White House web site to the president ( there is a comment form on the site ) it is scanned for keywords. It probably happens on other key avenues as well. Of course there are exceptions to every rule. I heard of a woman who wrote to Clinton something like: You are such a dynamite leader. I think you have such an explosive personality, and I'm dying to meet you. If you want to scan your E-mail, write a little perl script that takes a list of keywords to scan for, and the action to take when the keywords are found. It shouldn't be too hard. -- Elliot http://www.redhat.com/ "I'm a member of the Association of Federations of Linux Project Initiators That Never Really Get Much Done (AFLPITNRGMD, for short)." Just do it!

1 0

Workaround for filtering/cybersitter
by Mark Rogaski 17 Dec '03

17 Dec '03

If I had experience with Netscape plugins and spare time, I'd try it myself. But here's my proposed solution. A plugin in Netscape intercepts all requests, encrypt the URL with a pubkey algorithm, encode the string base64, send it as GET input to a proxy server. The proxy server decodes and decrypts the URL, gets the requested page, and returns it. This beats out URL-based filtering. Still need to figure out the specifics of key-exchange. If we use 40-bit encryption, it's exportable, and it still works in our threat model (ie. we don't care if the watchers figure out the URL a few hours later). To beat out dropping packets with unacceptable pattern in them, we could use an SSL-based server as the proxy. The plugin could even have a nice little on/off switch and a list list of available proxies. mark -- [] Mark Rogaski || "Computers save time like kudzu [] [] wendigo(a)pobox.com || prevents soil erosion." [] [] http://www.pobox.com/~wendigo/ || - afcasta(a)texas.net [] [] >> finger for PGP pubkey << || []

2 1