December 2003 - cypherpunks-legacy

LAN_law
by John Young 17 Dec '03

17 Dec '03

Los Alamos lab is using its supercomps to develop pattern-recognition programs to spot fraud in the health care system similar to work for IRS to spot tax cheats. LAN_law

1 0

If only...
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Bill Stewart wrote: > At 07:10 PM 6/13/97 -0700, Tim May wrote: > >>You mean they can license handguns, but not reporters??? > > >Indeed, it is strange. What part of "Congress shall make no law" > >do they not understand? > > the part between "Congress shall make no law" and "shall not be infringed"... If only they had written "Congress shall make no law." and left it at that... TM

1 0

Re: Declan as a Budding Washington Insider
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Paul Bradley wrote: > > I must side with Declan here, true, sometimes Declans articles show a > subtle hint of insiderism <tm>, but I believe that is an inevitable > consequence of working around people in D.C. who don`t want to be > directly associated with certain statements, to quote them against their > will would be journalistic suicide and would soon see Declan with no > contacts whatsoever. The editor of the main newspeak print media for the area I live in told me that their reporters are instructed to write their articles so as to be readable to someone with an eighth grade education. I certainly do not envy Declan for being in the position of having to make his articles readable for the people who are still trying to find the "Any" key while trying not to leave the cypherpunks with the impression he's a fucking retard. *** Next Week *** Declan reveals who is buried in "Grant's Tomb." TruthMonger

1 0

Re: Anonymous proxies & ITAR question (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Forwarded message: > From: "William H. Geiger III" <whgiii(a)amaranth.com> > Date: Mon, 16 Jun 97 17:48:52 -0500 > Subject: Re: Anonymous proxies & ITAR question > >>The renter of a car or truck is not responsible for the contents. The > >>driver of a truck is > > ^^^^^^ The renter is not responsible until they take contractual possession of the truck. From that point until placed on the companies property and the key is placed in the lock-box hanging on the fence (or whatever system they use where you live) it is the responsibility of the renter/driver/physical possessor of the truck for its behaviour or contents. > If I went and rented a truck and there was a "roach" in the ashtray I > should not be held accountable for possesion unless it could be proved > that it was mine and not from someone else that had used the truck or even > a worker at the retal shop. > > Ofcource if I had the trailer loaded with 100K of coke it would be a > little hard to say that someone else left it there. :) Why should coke be treated any different than pot? How much pot should I be able to put in such a truck and 'get away' with as a function of SOP? How much coke? No, ambiguity like this has no place in law. The litmus test should be whether a person or their property were damaged without their prior permission. Crimes should be a function of physical interaction and not some qualitative or even quantitative test. If it is a crime to do 100 of them then it should be a crime to do 1/10 (assuming it should be a crime in the first place). I can see it now, "Sorry sir, we had to let him go. He only 1/4 raped her." Blah. ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: Capitalist Assassination Politics
by Bill Stewart 17 Dec '03

17 Dec '03

Bell's AP isn't a Democratic Assassins Program - it's a free-market system. In a free market, when enough people want something enough to pay for it, like buying dope or killing someone, someone may decide it's worth their while and just do it. The catch is that he confuses mechanism with policy; the market doesn't really care _why_ someone has a price on their head. In a Democratic Assassins Program, everybody gets together and haggles about who ought to be killed and why, and if a majority wants someone killed, they go do it, or hire someone to do it for them, and tell the minority what a wonderful thing Democracy is. The US theoretically has a Republican Form Of Assassination - everybody votes on some representatives, and the representatives do whatever they can get away with, given future elections as a moderating threat, such as assassinating hundreds of thousands of Iraqis instead of the one Iraqi they told us we should all Hate for Two Minutes, or sending poisoned cigars to annoying bearded guys. In practice, we have a Capitalist Mixed-Economy Assassination Process - the Representatives decide to assassinate some people because it seems to be popular in the polls, and other people because the Big Business interests want them assassinated, or because the Pentagon wants to advertise their availability for future jobs, and some free-market "work" gets done, since you don't _have_ to annoy the national-scale interests to get assassinated, some things get done by Good Old Fashioned Volunteerism*, government-hired assassins decide ignore some collateral damage or work overtime in the war on Republicanly-Selected Substances and some people are society offenders who might best be underground or just tempt Darwin too many times. [* President's Commission on Volunteerism http://www.whitehouse.gov/volunteer.htm ] ---- Attachment Converted: http://www.cia.odci.gov/assassination/nominations.doc ---- # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)

1 0

LOW_orb
by John Young 17 Dec '03

17 Dec '03

Motorola plans to loft its third low-orbit sat system, dubbed Celestri, for high-speed data, video and broadcast. That will make 7 systems for highbanding low wares. LOW_orb

1 0

Re: ACLU/EPIC: First Amendment Pledge Campaign
by Tim May 17 Dec '03

17 Dec '03

Before I even log in and see if anyone else caught this, I wrote: >And will EPIC then withdraw its support of Pro-CODE, which says that >certain forms ^^^^^^^^^^ I meant SAFE, of course. Pro-CODE contains no criminalization of crypto speech provisions, at least not that I've seen. It's SAFE that's so pernicious. --Tim May There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Homer on Terrorism
by Secret Squirrel 17 Dec '03

17 Dec '03

Of course it was blackmail. The reason people are confused about this is they assume that blackmail is bad. Blackmail is good. The alternative is releasing the damaging information. Blackmail gives the person who has something to hide a chance to keep the information quiet. He has more options than he would have in a system where blackmail was impossible. Laws against blackmail are even more senseless than laws against libel. In the case of blackmail, the supposed victim is asking not to be allowed to take actions which are in his own self interest, a classic case of protecting someone from himself. Fortunately, cryptography will liberate blackmail just as it will other forms of communications. BlackMonger

1 0

More about Netscape Bug finder
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 16 Jun 1997 18:24:32 -0500 From: Bill GL Stafford <springco(a)arn.net> Organization: Spring Management Company MIME-Version: 1.0 To: "dcsb(a)ai.mit.edu" <dcsb(a)ai.mit.edu> Subject: More about Netscape Bug finder X-Priority: 3 (Normal) Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Bill GL Stafford <springco(a)arn.net> Christian Orellana, gambled $1000 and lost. Not the worst thing he could have done. Now the world knows how Netscape approaches a potential crisis. They did not panic although they may have come close to it. I've seen that much lost in a cloak room with a pot not near as big as Christian sought. Anyway you look at it it's just a roll of the dice.Bill GL Stafford springco(a)arn.net Wired Magazine on web An Email Trail from Bug Spotter to Netscape 6:01pm 13.Jun.97.PDT The following is a copy of the email exchange between Netscape officials and Christian Orellana, the Danish consultant who found the Netscape Navigator bug. A copy of the text was provided to Wired News by Netscape and appears unedited. Wired News has chosen not to publish Orellana's email address. Subject: Major security bug in Netscape Navigator 3 and 4 Date: Mon, 9 Jun 1997 19:19:13 +0200 From: Christian Orellana To: stracy(a)netscape.com Hello! We have discovered a major security bug in Netscape Navigator 3.0, which remains uncorrected in the new Communicator release. The bug affects Navigator running on all platforms in the standard configuration. The bug allows access to any file on the clients file system, and does not affect Microsoft Internet Explorer. This bug is potentially very interesting to Netscape considering that the new release of Navigator is due in just three days. The bug has not previously been reported, and remains unknown to anyone but us (to the best of our knowledge). Please get back to us a.s.a.p. (before Netscape DevCon) if this knowledge is of any interest to you. You can reach me at the phone number below. I have tried to reach Netscape for a while now, and if Netscape remains uninterested in the issue I may contact some other interested parties. Yours sincerely, Christian Orellans [sic] --- Subject: Please confirm Date: Mon, 9 Jun 1997 20:14:08 +0200 From: Christian Orellana To: stracy(a)netscape.com Hello! Could you please confirm that you have received my previous letter. Also I would like to restate my claim that this is of the utmost importance for the upcoming launch of Communicator. The bug allows complete read access to the clients hard disk. Christian Orellana. --- Subject: Re: [Fwd: Major security bug in Netscape Navigator 3 and 4] Date: Mon, 09 Jun 1997 11:51:04 -0700 From: edithg(a)netscape.com (Edith Gong) Organization: Netscape Communications To: Shannon Tracy , lalam(a)netscape.com References: <339C3C32.FE3F5683(a)netscape.com> Shannon, I don't know what else to do. Can someone in DSE contact this person to get the details by phone. We can't investigate until we understand what the issue is. I'll see if someone in tech support can contact the customer Edith --- Subject: Re: Please confirm Date: Mon, 09 Jun 1997 12:00:03 -0700 From: Shannon Tracy Organization: Netscape Communications To: Christian Orellana References: Dear Christian Orellana: Yes, I received your message. The project manager just responded that they are trying to find someone to contact you, however, we can't investigate until we understand what the issue is. Can you please furnish a few additional details so that we know who best might be able to handle this situation? Thanks, Shannon Tracy --- Subject: Re: Please confirm Date: Mon, 9 Jun 1997 21:11:44 +0200 From: Christian Orellana To: stracy(a)netscape.com (Shannon Tracy) References: Dear Shannon. In short the first version of the bug I had up and running allowed me to get any file whose path I knew on the clients hard disk. I just got another version up and running, and considering that the location of quite a few files on a typical windows/mac/unix installation is pretty well known, it should be no surprise that this new version can actually scan the clients harddisk for specific files, and download them. I can not reveal much more detail, without giving away the bug, which I will not do, since I think this information is so valuable to Netscape that it should be worth a good deal of money. The information is certainly worth a bit on the free market, and I am currently awaiting responses from other parties. In other words I think the person most suited for handling this, is someone in charge of the company check book (-; Regards - Christian --- Subject: final note on Navigator bug Date: Mon, 9 Jun 1997 23:07:59 +0200 From: Christian Orellana To: stracy(a)netscape.com (Shannon Tracy) Netscape: I think my approach to you on this subject has been fair and serious. I am offering you a piece of information that I consider of very high value. The implications of the bug mentioned in previous emails are immense. Considering the widespread use of home-banking software, not to mention the impact on multiuser systems in the government and corporate sector, like unix and NT environments, where access to the encrypted password-files would render the systems extremely vulnerable, I think all pre Communicator versions of Navigator (supposing you fix the bug in Communicator) would be pretty useless. I will leave it to you to estimate what impact that would have on Netscape stocks. I have to inform you that David Gross at CNN is on hold with the news, and is only waiting for me to give him the final demonstration, to verify the bug. I must also inform you that CNN is not the only interested party, and that I will consider my options once I get Netscape's standpoint on the matter. I would be more than happy to give a demonstration of the bug, under controlled circumstances, but we would have to sign some sort of agreement first. Regards, Christian Orellana. --- Subject: Re: [Fwd: Major security bug in Netscape Navigator 3 and 4] Date: Thu, 12 Jun 1997 16:40:33 -0700 From:chrish@netscape.com (Chris Holten) Organization: Netscape Communications To:chrish@netscape.com References: 1 Subject: Major security bug in Netscape Navigator 3 and 4 Date: Mon, 9 Jun 1997 19:19:13 +0200 From: Christian Orellana To: stracy(a)netscape.com Hello! We have discovered a major security bug in Netscape Navigator 3.0, which remains uncorrected in the new Communicator release. The bug affects Navigator running on all platforms in the standard configuration. The bug allows access to any file on the clients file system, and does not affect Microsoft Internet Explorer. This bug is potentially very interesting to Netscape considering that the new release of Navigator is due in just three days. The bug has not previously been reported, and remains unknown to anyone but us (to the best of our knowledge). Please get back to us a.s.a.p. (before Netscape DevCon) if this knowledge is of any interest to you. You can reach me at the phone number below. I have tried to reach Netscape for a while now, and if Netscape remains uninterested in the issue I may contact some other interested parties. Yours sincerely, Christian Orellans --- Subject: Please confirm Date: Mon, 9 Jun 1997 20:14:08 +0200 From: Christian Orellana To: stracy(a)netscape.com Hello! Could you please confirm that you have received my previous letter. Also I would like to restate my claim that this is of the utmost importance for the upcoming launch of Communicator. The bug allows complete read access to the clients hard disk. Christian Orellana. For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

5 4

Receiving Messages Anonymously
by pdh＠best.com 17 Dec '03

17 Dec '03

Receiving anonymous messages is still an open problem. The solutions we have so far are cumbersome to operate. They also depend on a chain of machines remaining up and reliable for a long time, which is expensive. A quick solution is to use the list to send anonymous messages. It is inexpensive to tell if a message is encrypted for a key you control so it is cheap to find messages you can read. The nice thing about this solution is that it is quite difficult to make a complete list of cypherpunk recipients given the multi-rooted "tree" structure of the list. There are leaves in many countries. Even if every wire were tapped and tracked, it would be hard to guarantee that people were not moving list traffic around on diskettes. To make filtering easy for people, I would suggest adding an "X-Private-Message" field to the header. For PGP messages, the contents of this field could be "PGP-Key-Id:0xDEADBEEF". (New formats can be invented as new protocols are invented.) Some people will object to this new form of "noise" message. It should be easy for somebody to set up a subsetted version of the list which pre-filters the private messages. (Although, how anybody can read the raw list without a filter of their own is a mystery to me.) A good reason to receive the complete list is that it conceals the fact that you are receiving (or not receiving) anonymous messages. If you think you might ever in the future receive an anonymous message, this will allow you to do so without revealing it. This scheme could be attacked by actively intervening with the propagation of the list and supplying people with different messages depending on which branch of the "tree" they are on. This could be used successively to narrow the list of "suspects" receiving a certain message. There are two ways to prevent this. One is to receive the list from more than one source and compare the messages received. If many people are doing this, which is likely since each has a strong motivation to detect this attack, then the first attempts should be detected immediately. The other method is to have a trusted person post a signed list of message ids and checksums that have come down the wire every day. (Acknowledgement: This is probably a rehash of BlackNet.) Peter

2 2