December 2003 - cypherpunks-legacy

Re: Complying with the EAR [was: More Circumventing the ITAR]
by Michael Paul Johnson 17 Dec '03

17 Dec '03

On Thu, 30 Jan 1997, Sean Roach wrote: > At 11:14 AM 1/29/97 -0700, Michael Paul Johnson wrote: > >On Tue, 28 Jan 1997, Mark Rosen wrote: > > > >> I'm curious as to exactly what the ITAR/EAR/Whatever says specifically > >> about "unrestricted FTP sites." My program, Kremlin, is available for > > > >You should check the exact text yourself, but the way I read the EAR, you > >are not "exporting" strong cryptographic software without a license (exept > >to Canada, which needs no license) if you do things "such as" > >(1) have the guests to your site acknowledge that the EAR restricts > >export, (2) have the guests affirm that they can legally get the software > >(proper citizenship or residency & location), and (3) "check the address > >of the destination computer to see if it is in the USA" or Canada. The > >last one, I interpret rather loosely to mean that if the guest's email > >address domain isn't one commonly used in the USA or Canada, then I deny > >access. We all know that not all .com addresses are North American, but > >chances are really good that if the address ends in .ru, then the > >destination machine is probably not in North America. This is not a > >perfect way to prevent export, of course, but it is what the regulations > >say, as I read them. For a pointer to the regulations and to my access > >request form and crypto site, see http://www.sni.net/~mpj/crypto.htm > ... > An easy crack to that would be to request access from a hotmail, or > similair, account. This account would show up as being on US soil while the > account holder would not necessarily be so. In this way, someone with an > account ending in your .ru would get through because h[is/er] e-mail request > originated from inside the U.S. If that is the only chink in the armor you see, then you aren't looking very hard. The point of this system is not to prevent exports, but to (1) comply with the letter of the law by discouraging export in the specified manner, (2) to comply with the spirit of the law by reducing the number of exports of cryptographic software from the USA, while (3) making publication of strong cryptographic software in North America easy and safe from legal persecution. Without point (3), the national security of the USA would be harmed, IMHO, by the fact that proportionally more dishonest people (the ones the NSA and FBI are quict to draw attention to) than honest ones (the majority of the people who want to use strong cryptography to protect their privacy and business interests from the dishonest folks) would use strong cryptography. The only reason I can think of that the U. S. Commander-in-Chief and President of the United States of America and his staff have determined that export of strong cryptographic software can harm "national security" even when such software already is available outside of the USA, is that they are really more concerned about the numbers of people that use such software regularly, and therefore, they want to limit the total bandwidth of distribution capacity and ease of retrieval of such software. Export controls can effectively do both, even if they cannot realistically prevent export. Think about it. It was a pain to set up the EAR-compliant site that I set up compared to a simple site for global distribution, and few people would go through the hassle. Many major information services and ftp sites simply disallow strong cryptographic software rather than go through the hassle. Because of this, it is probably true that fewer people find, download, and use strong cryptographic software. Until more people set up more strong cryptographic software distribution sites and write more good, secure, robust, easy-to-use cryptographic software such that it is about as easy to find and use it as not to, the Feds win. Their point is proven. Fewer people use strong cryptography than would otherwise, and some small (but, to them, significant) percentage of those people who were discouraged from using strong cryptographic software might have used that software in a criminal activity. Too bad about the good guys who could have prevented computer crime or worse with the same technology, huh? http://www.sni.net/~mpj/crypto.htm Michael Paul Johnson Opinions herein are not necessarily Exabyte's. Work: mpj(a)exabyte.com http://www.exabyte.com Personal: mpj(a)csn.net http://www.csn.net/~mpj BBS 303-772-1062

2 1

[STEGO] Blowfish
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Timmy C[rook] Maytag's abysmal grammar, atrocious spelling and feeble responses clearly identify him as a product of the American education system. /\ \ / /\ //\\ .. //\\ Timmy C[rook] Maytag //\(( ))/\\ / < `' > \

1 0

RE: Fighting the cybercensor
by azur＠netcom.com 17 Dec '03

17 Dec '03

[big snip] >If every time someone made a mistake they got >punished, without the opportunity to understand the error and without the >opportunity to make corrections, they would be a psychological wreck. Yes, you have certainly pointed out a property of AP, insofar as teaching is concerned. The reality of the physical world is that some mistakes, for example steping off a cliff, are immediately punished by a fall and possibly death. The 'student' may or may not learn for the experience but other students who are witness most certainly will. >If every time someone made mistake they got assassinated, not only would no >one wish to do anything for fear of losing their lives, creating a >"society" of timid sheep, there probably wouldn't be many people remaining >to savor the triumph of being superior. I sincerely doubt that many would use AP to right small slights, anymore than many now kill others for the same reasons. The world has always been inhabited by bullies and tyrants who cared little of what harm they caused others. An AP system would quickly eliminate bullies and tyrants. > >AP is just another form of war. You can bet that if assassinations >increased a hundred fold as a result of your method, not only "governments" >but some very bright people would get together to figure out a defense >against it, for they also would be "at risk". I think the reaction of the society as a whole to AP would depend on what its perceived overall results were. If assassinations of scum and tyrants increased a hundred fold it would hardly be noticed on any political radar screen, except the bullies and tyrants. --Steve

1 0

Re: Fighting the cybercensor. (fwd)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>> Its worth noting that the origin of property is theft. In the case of the > > BULLSHIT. BULL FUCKING SHIT. The origin of property is labor. Claiming >that _my_ property is the result of ME stealing, and hence what I OWN belongs >to the community IS theft. I work, and as the result of that work something is >created. That something is MINE to do with as I will. If I choose to sell that >work for money, that money is mine. If I trade that money for shoes, those >shoes are mine. THere is no theft involved. Tell this to the Native Americans. --Steve

2 1

Re: PGPMail Log File
by Mutatis Mutantdis 17 Dec '03

17 Dec '03

On 31 Jan 1997 09:27:45 -0500, you wrote: >At 02:22 AM 1/31/97 +0000, "Robert Rothenburg 'Walking-Owl'" >< WlkngOwl(a)unix.asb.comwrote: >> Is there a way to disable the \WINDOWS\PGPW_32.LOG? >> In subtle ways it's a security hole if left to accumulate over time, >> since it keeps records of which keys you encrypted messages to. >> [..] >> I understand in certain group/corporate environs one would want >> logging; in others, one doesn't need it or should have the option (in >> an easily found place) to wipe it every once in a while. >This is a damn good question. I do NOT have the "write to a log file" >option slected in the misc. tab and it STILL writes a log file. How DO >we disable this? Well, I just found that option to uncheck it (thanks to your message) so I'll try it w/the log file unchecked and see what happens. (Duh!) Rob

1 0

RE: Fighting the cybercensor
by Steve Schear 17 Dec '03

17 Dec '03

[big snip] >If every time someone made a mistake they got >punished, without the opportunity to understand the error and without the >opportunity to make corrections, they would be a psychological wreck. Yes, you have certainly pointed out a property of AP, insofar as teaching is concerned. The reality of the physical world is that some mistakes, for example steping off a cliff, are immediately punished by a fall and possibly death. The 'student' may or may not learn for the experience but other students who are witness most certainly will. >If every time someone made mistake they got assassinated, not only would no >one wish to do anything for fear of losing their lives, creating a >"society" of timid sheep, there probably wouldn't be many people remaining >to savor the triumph of being superior. I sincerely doubt that many would use AP to right small slights, anymore than many now kill others for the same reasons. The world has always been inhabited by bullies and tyrants who cared little of what harm they caused others. An AP system would quickly eliminate bullies and tyrants. > >AP is just another form of war. You can bet that if assassinations >increased a hundred fold as a result of your method, not only "governments" >but some very bright people would get together to figure out a defense >against it, for they also would be "at risk". I think the reaction of the society as a whole to AP would depend on what its perceived overall results were. If assassinations of scum and tyrants increased a hundred fold it would hardly be noticed on any political radar screen, except the bullies and tyrants. --Steve

1 0

Re: Complying with the EAR [was: More Circumventing the ITAR]
by Michael Paul Johnson 17 Dec '03

17 Dec '03

On Thu, 30 Jan 1997, Sean Roach wrote: > At 11:14 AM 1/29/97 -0700, Michael Paul Johnson wrote: > >On Tue, 28 Jan 1997, Mark Rosen wrote: > > > >> I'm curious as to exactly what the ITAR/EAR/Whatever says specifically > >> about "unrestricted FTP sites." My program, Kremlin, is available for > > > >You should check the exact text yourself, but the way I read the EAR, you > >are not "exporting" strong cryptographic software without a license (exept > >to Canada, which needs no license) if you do things "such as" > >(1) have the guests to your site acknowledge that the EAR restricts > >export, (2) have the guests affirm that they can legally get the software > >(proper citizenship or residency & location), and (3) "check the address > >of the destination computer to see if it is in the USA" or Canada. The > >last one, I interpret rather loosely to mean that if the guest's email > >address domain isn't one commonly used in the USA or Canada, then I deny > >access. We all know that not all .com addresses are North American, but > >chances are really good that if the address ends in .ru, then the > >destination machine is probably not in North America. This is not a > >perfect way to prevent export, of course, but it is what the regulations > >say, as I read them. For a pointer to the regulations and to my access > >request form and crypto site, see http://www.sni.net/~mpj/crypto.htm > ... > An easy crack to that would be to request access from a hotmail, or > similair, account. This account would show up as being on US soil while the > account holder would not necessarily be so. In this way, someone with an > account ending in your .ru would get through because h[is/er] e-mail request > originated from inside the U.S. If that is the only chink in the armor you see, then you aren't looking very hard. The point of this system is not to prevent exports, but to (1) comply with the letter of the law by discouraging export in the specified manner, (2) to comply with the spirit of the law by reducing the number of exports of cryptographic software from the USA, while (3) making publication of strong cryptographic software in North America easy and safe from legal persecution. Without point (3), the national security of the USA would be harmed, IMHO, by the fact that proportionally more dishonest people (the ones the NSA and FBI are quict to draw attention to) than honest ones (the majority of the people who want to use strong cryptography to protect their privacy and business interests from the dishonest folks) would use strong cryptography. The only reason I can think of that the U. S. Commander-in-Chief and President of the United States of America and his staff have determined that export of strong cryptographic software can harm "national security" even when such software already is available outside of the USA, is that they are really more concerned about the numbers of people that use such software regularly, and therefore, they want to limit the total bandwidth of distribution capacity and ease of retrieval of such software. Export controls can effectively do both, even if they cannot realistically prevent export. Think about it. It was a pain to set up the EAR-compliant site that I set up compared to a simple site for global distribution, and few people would go through the hassle. Many major information services and ftp sites simply disallow strong cryptographic software rather than go through the hassle. Because of this, it is probably true that fewer people find, download, and use strong cryptographic software. Until more people set up more strong cryptographic software distribution sites and write more good, secure, robust, easy-to-use cryptographic software such that it is about as easy to find and use it as not to, the Feds win. Their point is proven. Fewer people use strong cryptography than would otherwise, and some small (but, to them, significant) percentage of those people who were discouraged from using strong cryptographic software might have used that software in a criminal activity. Too bad about the good guys who could have prevented computer crime or worse with the same technology, huh? http://www.sni.net/~mpj/crypto.htm Michael Paul Johnson Opinions herein are not necessarily Exabyte's. Work: mpj(a)exabyte.com http://www.exabyte.com Personal: mpj(a)csn.net http://www.csn.net/~mpj BBS 303-772-1062

1 0

Georgia court hears testimony in anonymity case, from TNNN
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 31 Jan 1997 08:33:44 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: fight-censorship(a)vorlon.mit.edu Subject: Georgia court hears testimony, future of free speech, from TNNN The Netly News Network http://netlynews.com/ Brick By Brick by Declan McCullagh (declan(a)well.com) January 31, 1997 ATLANTA, Ga.-- A federal judge heard testimony yesterday in a landmark case challenging a Georgia law that forbids anonymity online. The ACLU filed the lawsuit -- the first-ever challenge to a state Net-censorship statute -- last September on behalf of 14 plaintiffs, arguing that the statute is unconstitutional. The law also criminalizes the "unauthorized" use of company names online. It is so broadly written, the ACLU claims, that America Online screen names could be considered illegal. Yesterday's hearing was designed to educate U.S. District Court Judge Marvin Shoob about the Net, in much the same way that lawyers educated a three-judge panel that struck down the Communications Decency Act in Philadelphia in June 1996. It began with a Georgia Tech professor who painstakingly demonstrated how the Internet works. "This pointing device in the middle of the screen is the cursor," he said. The lawsuit is one of many that will shape the future of free expression in cyberspace -- and new media. The Georgia challenge seems straightforward, but in truth is a key part of the ACLU's strategy to cement a foundation of legal precedents that will build on one another, brick by statutory brick, and solidify into a framework for free speech on the Internet. The most fierce battlefield, however, will be in state capitols and courtrooms like these. More than 20 states already have launched various offensives against the Net, but the ACLU is choosing its battles carefully. Depending on how Judge Shoob rules, near-perfect anonymous speech may, for the first time in history, be completely legal -- at least in one federal district. In a move that could derail congressional attempts to rehabilitate the CDA if the high court strikes it down, the ACLU assailed a New York State law banning sexual images that are "harmful to minors." The organization also is planning to sue in Virginia, Florida and California, highlighting a different legal point in each case. True, the decisions won't be binding on other courts -- unlike, say, a U.S. Supreme Court ruling -- but in such a new area of the law, judges will grasp at even district court precedents. "You can't underestimate the importance," said ACLU attorney Chris Hansen. "The law works through precedent. Each case builds on the one before it." Key to the strategy is the argument that states can't regulate speech on the Internet at all. It's a nuclear bomb of a legal theory, which relies on the Constitution's commerce clause and on Supreme Court cases that bar states from controlling "commerce that takes place wholly outside of the state's borders." The coalition's brief offers Usenet newsgroups as an example: "The posting of this message in California, therefore, may subject the California author to prosecution in Georgia under the Act." The state countered that local standards should always apply. Daniel Formby, Georgia's deputy attorney general, said yesterday: "You do not have to enter a state to violate its laws." Free-speech victories in states such as Georgia would permit netizens to bypass the strict controls on television and radio that ban the transmission of "indecent" words or images. When the Internet starts carrying movies and soaps, the stronger free-speech standards of cyberspace will extend to those broadcasts. "We gain stronger First Amendment rights for other media when they converge, as the Internet absorbs other technologies," said ACLU attorney Ann Beeson. Sitting quietly in the rear of the Atlanta courtroom throughout the hearing was State Rep. Don Parsons, who with the Democratic leadership introduced the Georgia law last spring. Parsons insists the ACLU's challenge is wrongheaded. Does the law ban anonymous speech? "Certainly not! Absolutely not!" he claimed. So what was the purpose behind the the law? To prevent fraud, said Parsons. But that's not what I found. The genesis of the bizarre Georgia law lies not in policies as much as in rank statehouse politics. I went looking for Georgia's Speaker of the House and found him in his office. He leaned back in his chair and chewed on a cigar. A 72-year old Democrat, Thomas Murphy has reigned over the state House of Representatives for 24 years from an office studded with stuffed rabbits and bobcats and conveniently adjacent to the House floor. Yesterday, he declined to discuss the measure. "I can't tell you anything about it because I don't know anything about it or computers or the Internet or anything like that," he said. But he knows politics, and his enemies, especially Rep. Mitchell Kaye, a fellow who fancies himself the Newt Gingrich of the Georgia legislature. Like Gingrich, Kaye is a technocratic Republican hailing from bluenose Cobb County, and like pre-1994 Gingrich, he sees himself as waging guerrilla warfare against a corrupt and entrenched Democratic majority. Dem leaders are equally uncomplimentary. "None of us likes Mr. Kaye... No manners towards anyone. He tries to cause all the confusion he can," Speaker Murphy grumbled. Indeed, the whole statutory mess began shortly after Kaye created his own web site, www.gahouse.com, which he uses to post legislation, contact information and some partisan pages for his conservative caucus. It proved popular, drawing thousands of visitors a week -- and the wrath of lawmakers such as Speaker Murphy, longtime veterans of traditional machine politics. It was Kaye's use of the state seal on his site -- even with appropriate disclaimers -- that handed Democrats a way to muzzle him through the law the ACLU has challenged. The irony is, of course, that the Georgia Democrats never intended to ban all anonymous and pseudonymous discussions. They never believed they'd be attacked in court by a team of New York City lawyers. But by punishing anyone who "uses any individual name... to falsely identify the person" -- even without intent to deceive -- their law censors not just Mitchell Kaye, but netizens as well. "The last thing they want is sunshine on this case," said the upstart Republican, who joined the suit as one of the plaintiffs. "They pass a lot of unconstitutional legislation around here." ###

1 0

Re: Fighting the cybercensor. (fwd)
by Steve Schear 17 Dec '03

17 Dec '03

>> Its worth noting that the origin of property is theft. In the case of the > > BULLSHIT. BULL FUCKING SHIT. The origin of property is labor. Claiming >that _my_ property is the result of ME stealing, and hence what I OWN belongs >to the community IS theft. I work, and as the result of that work something is >created. That something is MINE to do with as I will. If I choose to sell that >work for money, that money is mine. If I trade that money for shoes, those >shoes are mine. THere is no theft involved. Tell this to the Native Americans. --Steve

1 0

Key Security Question
by Z.B. 17 Dec '03

17 Dec '03

My computer went into the shop a few days ago, and I was unable to take my PGP keys off it before it went in. What are the security risks here? If the repairman chooses to snoop through the files, what would he be able to do with my key pair? Will I need to revoke the key and make a new one, or will I be relatively safe since he doesn't have my passphrase? Zach Babayco zachb(a)netcom.com <-------finger for PGP public key If you need to know how to set up a mail filter or defend against emailbombs, send me a message with the words "get helpfile" (without the " marks) in the SUBJECT: header, *NOT THE BODY OF THE MESSAGE!* I have several useful FAQs and documents available.

3 2