December 2003 - cypherpunks-legacy

Re: "cypherpunks is dead..."
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- A million monkeys operating under the pseudonym "Tim May <tcmay(a)got.net>" typed: > > (Getting PGP integrated into mailers > is stil bogged down, for reasons I have to believe have to do with > pressures from somewhere, else why would e-mail packages not make PGP > support painless?) Because PGP's user interface is yucky and its programmer interface is even worse. Amazing how people don't realize how much certain important things depend on such a (deceptively) simple concept as having a nice user interface and a nice programmer interface. In contradiction of certain cypherpunk urban legends, I suspect that such pedestrian details are far, far more important to the course of history than the clumsy and feckless machinations of government agencies. But for the good news, see the quote from Jim Bidzos in my ".plan". Regards, Zooko, Journeyman Interface Designer NOT speaking for any organizations or persons whose names might appear in the headers of this message, or who might occasionally toss me some spare change in return for my brilliant software design work. PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2i Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2 iQB1AwUBMwxxPkjbHy8sKZitAQFkwwL+Pmpv70F4mN+G58gnZj0a8nH6omppzucN CxMSw2iFc/rBcCQGoNO1Bx42TEShypN4HyBqrR49NEkJhihZ4dSfQB2FGsTZyFE0 P9X2/Oy10AwqC9nu90n/Ct5Z+63wFB6P =CCQx -----END PGP SIGNATURE-----

1 0

Re: Constitution and a Right to Privacy
by Dale Thorn 17 Dec '03

17 Dec '03

Greg Broiles wrote: > At 11:56 PM 2/19/97 -0800, Dale Thorn wrote: > >It's good if you don't read the L.A. Times. One of their lead editor- > >ializers (whores), a professor at USC law school named Erwin Chemerinsky, > >writes in relation to this subject "The federal government is an inde- > >pendent sovereign that cannot have its powers diminished by a state > >government's actions." (exact quote, 2/7/97). Either that's a load of > >BS doubletalk, or it's one of the more fascistic commentaries from the > >Times, which is usually bad enough. > Hey, don't forget to shoot the messenger. Chemerinsky's statement is a > concise summary of at least the last 70 years of double jeopardy > jurisprudence. The only thing that's unusual about the use of the "dual > sovereign" doctrine against the cops who beat King was that it's usually > used against ordinary citizens, not cops. Do you suppose it's possible > that some of the other evil conspiracies you see lurking behind every > bush are also just reflections of your own fears and misunderstanding? My background is not so much in conspiracy as it is in rational problem solving. Conspiracy is yet another model/filter with which to evaluate events, sometimes useful unless a person automatically rejects all of that and subscribes to the Elmer Fudd view of history. I understood clearly the (supposed) intent of the feds in retrying the Whites in the South who were beating up on Blacks and getting off with White juries - I just believe they would have served the people better by declaring mistrials or something instead of using the "dual sovereignty" BS, since a study of the Constitution and its preparatory papers shows the fathers clearly would have balked at this. One or more of the top feds also commented on the possibility of retrying Simpson in another criminal case, saying it was not possible under current law since it didn't have the same aspects as the Rodney King cops trials. However, that doesn't take anything away from the fact of a "democracy" run amok, in the hands of bozos like Michael Eisner and what's-his-schmuck at the L.A. Times, who are constantly beating the drums for revenge, so that the people will find "some way, somehow" to lynch people like Simpson, to "make him pay" for what he "so obviously" did to his victims.

1 0

Re: Cryptanalysis
by Peter Trei 17 Dec '03

17 Dec '03

> Date: Wed, 19 Feb 1997 08:16:46 -0800 > From: Bill Stewart <stewarts(a)ix.netcom.com> > To: Scott Auge <scotta(a)sauge.com> > Cc: cypherpunks(a)toad.com > Subject: Re: Cryptanalysis > At 11:21 AM 2/15/97 -0500, you wrote: > >Was wondering if anyone could help me with short explainations on the > >cryptanalysis of SKIPJACK and DES. If ya hit www.sauge.com/crypt you > >might get a better idea of what i'm trying to accomplish. > > Cryptanalysis of DES is a 25-year ongoing academic exercise, with > lots and lots of results. It's easy to attack it in 2**55 tries, > because of symmetry, but that's a very large number :-) Many people have made statements to the effect that the complement key property (if key K encrypts plaintext P to ciphertext C, then K' encrypts P' to C', where A' is the one's complement of A') of DES halves the work for a brute force attack, but these people don't seem to have ever tried to actually use this property - it's effectively useless. You still need to run the DES rounds, and the only win would be in the fact that preparing the key schedule of K' from the key schedule of K used to be easier than preparing it from K' directly. This is no longer a win, since preparing key schedule for (K+1) from the key schedule of K is just as easy. There's the possibility that I'm seriously dense (even Denning has made statements about halving the effort), but I just don't see it. [...] > The slow part of the attack _had_ been key scheduling, but recent work > by Peter Trei and others shows that you can do key scheduling very > efficiently for the brute-force keysearch problem by picking keys > in Gray Code order (since a one-bit change in key causes a simple > change in key-schedule - it's totally useless for normal encryption/ > decryption, but it's a big win for brute-force cracks.) It's not totally useless - if you're going to have to prepare a lot of different key schedules (say, for many session keys under IPSEC), it's still a win to OR together the key bit fanouts than to generate the key schedule by the traditional method. It trades a lot of upfront, one-time work for a later speedup. > There may be a distributed Internet crack using that approach, > though DES is still very inefficient on general-purpose computers and > works better on bit-twiddliing chips. There's one slowly shaping up, organized by the same people who did the RC5-48 crack. I'm still rooting for an uncoordinated search, which is already underway. Peter Trei trei(a)process.com PS: Is this the last message to cypherpunks actually about crypto?

1 0

FWD: (CHANGE: NUVUPSY - Against the therapeutic state)
by Robert Hettinga 17 Dec '03

17 Dec '03

Tell me what this has to do with cryptography, and I'll give you a nickle. Or, maybe not... ;-). Cheers, Bob Hettinga --- begin forwarded text Date: Thu, 20 Feb 1997 09:48:47 -0600 Reply-To: "Dr. Jeffrey A. Schaler" <JSCHALE(a)american.edu> Sender: NEW-LIST - New List Announcements <NEW-LIST(a)LISTSERV.NODAK.EDU> From: "Dr. Jeffrey A. Schaler" <JSCHALE(a)american.edu> Organization: The American University Subject: CHANGE: NUVUPSY - Against the therapeutic state To: NEW-LIST(a)LISTSERV.NODAK.EDU NVVUPSY has moved to a new server and has a new E-mail address. NUVUPSY on LISTSERV(a)MAELSTROM.STJOHNS.EDU "Although we may not know it, we have, in our day, witnessed the birth of the Therapeutic State. This is perhaps the major implication of psychiatry as an institution of social control." (Thomas Szasz, 1963) NUVUPSY is a forum to share points of view critical of the "therapeutic state" and institutional psychiatry, and those supportive of contractual psychotherapy and psychiatry. We're interested in discussions concerning the relationship between liberty and responsibility and its implications for clinical, legal, and public policy. The list will serve to promote alternative views to explaining unwanted behaviors. Sociological perspectives on the medicalization of deviant behavior are welcome. Other topics for discussion include but are not limited to: The myth of addiction as a disease; the ideology of biological determinism; the obsolescence of the schizophrenia hypothesis; coerced treatment for addiction and First Amendment rights; criticism of psychiatric drug prescriptions; etc. NUVUPSY Board of Advisors include: Bruce K. Alexander, Phil Brown, Robert C. Carson, David J. Essex, Louis B. Fierman, Robert E. Haskell, Reid Klion, James C. Mancuso, Roberta Russell, Theodore R. Sarbin, Jeffrey A. Schaler, and Richard E. Vatz. Archives of NUVUPSY mail items are kept in monthly files. You may obtain a list of files in the archives by sending the command INDEX NUVUPSY in the BODY of e-mail to LISTSERV(a)MAELSTROM.STJOHNS.EDU (NUVU as in "new view", V=vee) To subscribe, send the following command in the BODY of mail to LISTSERV(a)MAELSTROM.STJOHNS.EDU SUBSCRIBE NUVUPSY yourfirstname yourlastname Owner: Jeffrey A. Schaler, Ph.D. jschale(a)american.edu Martin W. Smith mws(a)metis.no NUVUPSY List Coordinators ------- Use this information at your own risk. For more information and disclaimer send E-mail to LISTSERV(a)LISTSERV.NODAK.EDU with the command INFO NEW-LIST in the body. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

[NTSEC] ! [ADVISORY] Major Security Hole in MS ASP (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

=====================================Kaos=Keraunos=Kybernetos============== .+.^.+.| Ray Arachelian | "If you're gonna die, die with your|./|\. ..\|/..|sunder(a)sundernet.com|boots on; If you're gonna try, just |/\|/\ <--*-->| ------------------ |stick around; Gonna cry? Just move along|\/|\/ ../|\..| "A toast to Odin, |you're gonna die, you're gonna die!" |.\|/. .+.v.+.|God of screwdrivers"| --Iron Maiden "Die With Your Boots on"|..... ======================== http://www.sundernet.com ========================= ---------- Forwarded message ---------- Date: Thu, 20 Feb 1997 11:39:01 -0600 From: Mark Joseph Edwards <mark(a)ntshop.net> To: "'bugtraq(a)netspace.org'" <bugtraq(a)netspace.org> Cc: "'ntbugtraq(a)rc.on.ca'" <ntbugtraq(a)rc.on.ca>, "'ntsecurity(a)iss.net'" <ntsecurity(a)iss.net> Subject: [NTSEC] ! [ADVISORY] Major Security Hole in MS ASP MICROSOFT IIS AND ACTIVE SERVER ADVISORY Security Hole in ASP Discovered in Microsoft ASP February 20, 1997 DESCRIPTION A serious security hole was found in Microsoft's Active Server Pages (ASP) by Juan T. Llibre <j.llibre(a)codetel.net.do>. This hole allows Web clients to download unprocessed ASP files potentially exposing user ids and passwords. ASP files are the common file type used by Microsoft's IIS and Active Server to perform server-side processing. HOW IT WORKS To download an unprocessed ASP file, simply append a period to the asp URL. For example: http://www.domain1.com/default.asp becomes http://www.domain1.com/default.asp. With the period appendage, Internet Information Server (IIS) will send the unprocessed ASP file to the Web client, wherein the source to the file can be examined at will. If the source includes any security parameter designed to allow access to other system processes, such as an SQL database, they will be revealed. DEFENSE There are two known ways to stop this behavior: 1.Turn read permissions off of the ASP directory in the Internet Service Manager. This may not be a practical solution since many sites mix ASP and HTML files. If your site mixes these files together in the same directories, you may want to segregate them immediately. Now and in the future, treat your ASP files like any other Web based executable, and keep them in separate directories wherein permissions can be adjusted accordingly. 2.Download this filter written by Christoph Wille Christoph.Wille(a)unileoben.ac.at which can be located at http://www.ntshop.net/security/tools/sechole.zip or from http://www.genusa.com/asp/patch/sechole.zip END OF ADVISORY

1 0

Translating C++ to Java
by Chris Laffra 17 Dec '03

17 Dec '03

Hi, I hope the following information is of interest, otherwise please ignore... In August 1996 my book "Advanced Java" was published, and it still is one of the only books that is not only absolutely emphatic about the language, but in addition has a critical, honest, and objective look at Java. I am very happy with the reception of the book -- it is one of the Java best-sellers, especially considering the small intended target buyers segment (the more advanced Java programmer). Enclosed with the book is C2J, an automatic C++ to Java translator, written in C++ and requiring specific UNIX tools. My version of C2J was not very useful for a lot of people because of the requirements on the environment. I challenged the online community to look at the software and come up with a full Java version. I am happy to report that has happened. A student at PACE University in New York, Ilya Tilevich, took the challenge and did a really nice job in making C2J a full Java program. For more information, check out my personal home page at America Online: http://members.aol.com/laffra and download the zip file containing the Java class files and source code. I hope this information is useful for you, Chris Laffra.

1 0

Re: Why Digital Video Disks are late to market
by Anonymous 17 Dec '03

17 Dec '03

> ... there apparently has been some speculation among the U.S. PC community > that Matsushita may be stonewalling on the software-licensing issue so that > it can establish its hardware-based decryption solution in the marketplace. The day it gets published in software is the day someone runs a disassembler on it. That's all there is to it.

2 1

Re: "cypherpunks is dead..."
by snow 17 Dec '03

17 Dec '03

> At 3:37 PM -0500 2/19/97, Robert Hettinga wrote: > is stil bogged down, for reasons I have to believe have to do with > pressures from somewhere, else why would e-mail packages not make PGP > support painless?) There are several packages that do provide at least some level of PGP integration, but I have 2 very good reasons: 1) The "market place" isn't willing to pay for the additional work. 2) It isn't "sexy" enough to cause a programmer to want to add it to a mailer just for fun.

1 0

Re: "cypherpunks is dead..."
by Robert Hettinga 17 Dec '03

17 Dec '03

At 2:37 pm -0500 on 2/20/97, snow wrote: > > At 3:37 PM -0500 2/19/97, Robert Hettinga wrote: > > is stil bogged down, for reasons I have to believe have to do with > > pressures from somewhere, else why would e-mail packages not make PGP > > support painless?) Uh, that wasn't me. Sorry... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

Re: DES and RSA crypto hardware from the free world
by Dan Geer 17 Dec '03

17 Dec '03

These chips look *very* promising. Who needs Clipper, or HP's Clipper-under-another-name, when you can get triple DES from the free world at prices like this? The critical thing is to get the horse out of the barn before the door is barred. Each and every one of these sorts of vendors has to establish use and distribution on a wide basis before governments of any stripe start locking down on domestic use. There is little time and, yes, I am a paranoid who hopes thereby to survive. --dan

1 0