December 2003 - cypherpunks-legacy

Re: 6502 ML programming (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 9 Oct 1997 02:32:27 -0400 > From: ghio(a)temp0133.myriad.ml.org (Matthew Ghio) > Subject: Re: 6502 ML programming > Jim Choate <ravage(a)ssz.com> wrote: > > > > There in no 'DATA' construct in 6502 assembly. > > > > This is some sort of macro that either the assembler or programmer > > defined. All official Rockwell/Commodore [1] 6502 assembly mnemonics are > > three letter. > > True, but most assemblers would let you insert static data into the object > file using various pseudo-ops like that. > > > > Idealy a jump table was created that had the various target addresses for > > your routines. > > Oh, those were fun to debug too... > > > > The most efficient way to store data in 6502 is to put it in the first 256 > > bytes of ram, then it could be called in no more than 2 clock cycles. > > Actually that took three cycles. One to fetch the opcode, one to fetch the > target address, and one to fetch the data byte. If you wanted to do it in > two cycles, you had to write the data into the operand of the instruction > that loaded it (self-modifying code). Wow, we actualy agree on all points...that has to be a first. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Component-based Commerce: CCS Lunch Talk Friday, October 17
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 9 Oct 1997 08:22:11 -0400 (EDT) From: Chris Wysopal <cwysopal(a)skywriting.com> To: dcsb(a)ai.mit.edu Subject: Component-based Commerce: CCS Lunch Talk Friday, October 17 MIME-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Chris Wysopal <cwysopal(a)skywriting.com> From: Roanne Neuwirth [SMTP:roanne@MIT.EDU] Sent: Wednesday, October 08, 1997 10:27 AM To: ccs-lunch(a)MIT.EDU Subject: Component-based Commerce: CCS Lunch Talk Friday, October 17 Greetings! This is to announce a CCS Lunch Talk, Friday, October 17, from 12-1:30 pm in E40-170. Bring your lunch and join us for an interesting session. We are pleased to welcome Jay M. Tenenbaum, Chairman of CommerceNet to CCS. He will speak on component-based commerce and an exciting new project. See you there!! Component-based Commerce Jay M. Tenenbaum Chairman, CommerceNet Digital anarchy is threatening the explosive growth of Internet commerce. Proprietary applications and platforms cannot communicate above the level of browsers. Websites are difficult to locate and incomprehensible to software agents. Such limitations prevent online businesses from leveraging each other's services, resulting in closed markets and trading communities. In response, CommerceNet has launched an ambitious object-oriented interoperability framework initiative called eCo System. eCo treats all commerce services on the Web as business objects. It provides the infrastructure (a Common Business Language, standardized metadata and middleware) for combining them in novel ways to build virtual companies, markets, and trading communities. eCo complements commercial ecommerce platforms, enabling them to communicate with one another, thus expanding the market for all. eCo System promises to transform the Internet into a massive economy of online services, all linked through a common framework. Companies will be able to encapsulate their services (e.g., shipping, banking) as eCo objects, that customers can seemlessly integrate into their own business processes. Entrepreneurs will be able to create innovative value-added services that compare, aggregate, integrate, and translate data across companies -- finding the best price or the closest supplier for example. This potential for instant partnering and for rapidly experimenting with new business concepts could spark an explosion of entrepreneurial activity rivaling that of the web itself. Based on market analyses by Forrester and IDC, CommerceNet projects a $1 Billion market for eCo-enabled Internet commerce building blocks and tools by the year 2000. The Internet commerce transactions enabled by these components could exceed $100 Billion. The talk will cover eCo System from both a technology and business perspective. Dr. Jay M. Tenenbaum (BS MIT '64; Ph.D. Stanford '71) is widely acknowledged as a founder of Internet commerce and its leading visionary. In 1990 he started EIT, the company that pioneered the enabling security and payment infrastructure. In 1994 he formed CommerceNet, the leading industry association for Internet commerce with nearly 600 corporate members worldwide. Dr. Tenenbaum has been a consulting Professor of Computer Science at Stanford University and currently serves on the boards of six Internet start ups. For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

ANY OF YOUR ANSWERS YES?
by endeavor＠bizmax.com 17 Dec '03

17 Dec '03

Hello, I read your profile and thought that the following would be of interest to you. You are not on a mailing list so if this does not interest you there is no need to reply. Any of Your Answers Yes? Want to: >Legally slash your business/personal taxes drastically? >Protect any & all assets from any form of judgement? >Learn how to preserve your personal privacy? >Create a 6 figure income in the next 4-6 months? Any of Your Answers No? >Do you know how to make your "nest egg" work 3-5 times harder for you? >Do you know how to set up off shore trusts and protect your owned property from liens & levies? >Can you legally shelter all assets from all Taxes? Find out more and learn how to accomplish all of these by calling: 1-800-497-1799 (24 hr. recorded message)

1 0

Free Email Software!
by webtech＠lostvegas.com 17 Dec '03

17 Dec '03

////////////////////////////////////////////////////////////////////////// Advertising Secrets Exposed ! Are you having a difficult time trying to promote your business on the Internet? Have you posted classified ads with little or no response? Well, if you'd like to know something that you could use with your present business to make it Explode! I have the answer to your business growth problems. Free Email Software! Everybody's talking about Email Marketing! A gold mine for those who can take advantage of mass Email Marketing. Just imagine for a minute what this will mean to your business, being able to reach thousands of new propects daily, with no cost to you. We will give you a new software package called Freedom, absolutely Free, to use in your business. Now you will have, a do it yourself method of online advertising, that up till now only the professional Internet Marketer had access to. And have a powerful potential to target millions with simple click of your mouse. And if you need fresh Email addresses, we have them on, 3.5 IBM disk. The best prices on the Internet. 100,000 Addresses Oppty Seekers Only $29.95 Includes shipping and handling. 200,000 Addresses Oppty Seekers Only $39.95 Includes shipping and handling. 400,000 Addresses Oppty Seekers Only $49.95 Includes shipping and handling. And for the serious Internet Marketer, 25 million plus!! Our company has one of the largests databases on the Internet with over 25 million Email Addresses, these are split up in many different categories, and rotated frequently, giving you new addresses to choose from each time. This service allows you to access our database of Email Addresses as much as you want, from our website. All for only $199. No need to ever gather or purchase Email addresses again!! But because of our special internet promotion for the month of August only, you can purchase our E-Mail software program including 25 Million E-Mail addresses, and including full time tech support, telephone number, for only $99. for all orders received before Oct20/97 PRINT AND FILL OUT ORDER FORM BELOW Yes! Please Rush Me Fresh Email Addresses, And My FREE Email Software. Name______________________________________________________ Address____________________________________________________ City_________________________________State__________________ Zip____________________________Email________________________ Types Of Addresses Opportunity Seekers ( ) General ( ) 100,000 Addresses $29.95 Includes shipping&handling and Freedom Software. 200,000 Addresses $39.95 Includes shipping&handling and Freedom Software. 400,000 Addresses $49.95 Includes shipping$handling and Freedom Software. 25Million Addresses$99. From database Includes S&H and Freedom Software. And full time tech support, by telephone, for all orders received by Oct15/97 Freedom Software Only. Send $10. To cover S&H. IBM 3.5 Floppy disk. Bonus: Orders received before, Oct20/97 will receive another Software program Free, called "CHECKER" that allows you to receive checks by Fax, Email, and Phone. Sold over the Internet for $129. Free with your purchase of any or the above products! Never lose another impulse sale again, for lack of, a credit card, or the slowness of US mail. Plus another bonus for MLMERS, not only are we going to give "CHECKER" and FREEDOM to you, we will authorize you to give "FREEDOM and "CHECKER" to your entire Downline, to use " FREE" Just think what this will mean to your business, when you are able to give "FREEDOM" and "CHECKER" to your entire Downline to use, for Free, or use for an incentive for new recruits. Payment: Check ( ) Money Order ( ) Cashier's CK ( ) Other ( ) U.S Funds Send Order Form Along With Payment: To REV TECH MARKETING 2172 Kanoy ave Thomasville N.C 27360-8733 U.S.A. If you'd prefer not to receive any future mailings, just send an empty email to etech(a)ascella.net with remove me in the subject line. Mail End.

1 0

Re: anonymous poster quality up
by jimg＠mentat.com 17 Dec '03

17 Dec '03

Tim May wrote: > - --Tim May (I'll sign this with my new PGP 5.0 key, which has also been > signed with my 1992 PGP 2.0 key) So what <is> your new PGP 5.0 public key? I checked for the key ID 0xDF02DF6A on the key server at www.pgp.com and didn't see it. I <do> believe your claim that it's a 5.0 key, though, since it ends in the even nibble 'A', and all RSA key IDs are odd. :) Jim Gillogly jim(a)acm.org

1 0

Object code disassembly (was Re: [LONG, off-topic]] Interactive Programming)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

> It worked. After a few iterations of this I had all the entry points, and > everything that didn't disassemble cleanly was outputted as hex data. > > For fun, run objdump on a cleanly compiled unix binary... It makes it all > look so easy... :) Not quite that easy. Awhile back I disassembled RealAudio because I was curious how their codec worked. Turns out it was not all that interesting and the codecs in nautilus and speak freely are probably better. But anyway.... Running objdump on the binary spit out ~800000 lines of code. They statically linked the whole thing, motif, c library, and all. I'm not sure what they compiled it with, the c-library they had in there didn't look like any of the standard ones. It disassembled fine, but 800k lines of assembler dump is not really all that readable. So I ended up doing it interactively, setting breakpoints on the I/O operations and backtracing to find the coder. The user interface code tended to get in the way a lot. The 1kb/s coder is very basic. No predictor/corrector, and no redundancy (eg lempel-ziv, rle) compression at all. It's just a frequency/band coder at 10 frames per second. I guess thats so it can handle dropped frames. No checksums at all. The "28.8" codec is more sophisticated. It appears to be a LPC and compresses data into much larger blocks/packets. I didn't look into it too deeply because there are lots of other lpc coders available. Shortly after this, they put out a new version 3.0, with yet another codec, which I never looked at. This was quite awhile ago, and all this is from memory. So the codec was rather uninteresting, but there were a number of other "features" which got my attention. I looked at the network protocol. Its pretty simple. The client connects to the server and requests the file it wants. It also sends a whole bunch of other info, like host operating system, version number, etc. ("for statistical purposes, right? uh huh..." are you guys over there at anonymizer.com reading this? hint, hint.) Then it does something truly bizarre. The client and server exchange 32-digit hex numbers. The client calls gettimeofday() and gethostname() and uses this as a random seed. Then it sends a 128-bit random number, encoded as 32 ascii hex digits. The server does the same. I haven't a clue what this is for. Considering that the other data structures are all binary, sending this as ascii is really dumb. It looks as though its part of some third-party library. I thought maybe it was some variant of netscape cookies but it doesn't save anything to disk. It's just wierd. I tried stepping through this section of code a few times, but doing so usually caused the server to time-out. Then the server starts sending the audio file as one big stream of packets - same format as the files it saves to disk, just broken up into packets, each preceeded by a length byte. In udp mode the client sends acks every second or so. In tcp mode there are no in-band acks at all, it relies solely on the tcp protocol driver. No checksums on anything, and it uses predictable port numbers. You can probably spoof it real easy. That might make for an interesting prank.

1 0

Re: What's really in PGP 5.5?
by Anonymous 17 Dec '03

17 Dec '03

The danger with the PGP system is that it could be easily perverted into a British style trusted-third-party system for GAK. The government would set up a key management infrastructure to provide an official repository and CA to register keys. It could even be "voluntary" if only government-approved CAs had liability protection which private CAs didn't have, making it hard for the privates to compete. However the price to use the government registry is that each key has to use the PGP features to specify a TTP as an additional recipient. Every message encrypted to that key should also be encrypted to the TTP key. Only government-approved TTPs may be used, and although there are many to choose from, all have to provide easy and secret GAK. The PGP 5 software will then automatically encrypt to the TTP key. Yes, this can be defeated using superencryption or faking the additional-recipient block in the message. But we know any scheme can be defeated. It still satisfies the government's requirement to get routine access to most email communications, and to allow criminals who use standard email packages to be watched.

1 0

What's really in PGP 5.5?
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ryan Anderson wrote: >>What you call "fragility" is properly called "security". Would you >>describe 128-bit keys as more "fragile" than 40-bit keys? Why is PGP, >>Inc. inventing propaganda terms for the authorities? > >Okay, call it security but the point is, if you're protecting documents vital >to your company using encryption (say the design of a new product) and the >person who knows the passphrase dies, you've just lost a great deal of money. > >PGP for Business Security gives the business a way to have a backup key that >can read that person's information. Frankly, it might not be able to read >anybody elses, from the description given. > >This is a feature that any business (that understands encryption) will want. > >They can easily store the secret keys of the other id someplace secure, and >never retrieve them until someone dies. Disavow knowledge of them to >government, etc. heck, the keys can even be in the primary person's >posession. (Perhaps stored in a safe-deposit box, or without a passphrase, >etc.) Decrypting files and decrypting messages are not the same problem. The PGP product has SMTP support - it is explicitly designed to weaken transmitted messages. Just like Clipper. [Jon Callas wrote:] >>It is fascinating to me that every example you use does not involve >>decrypting transmitted messages. Yet, that is the feature which is >>under discussion. > >Amazingly, he gave an example where, had encryption been used, the >project would have stopped, and restarted because the person with the >keys was incapacitated. Are you just being combative here? No. I am making the distinction between files and messages. It is quite easy to use a key for encrypting files which is different from encrypting your messages. The key for encrypting files can then given to the appropriate company officer. It has been possible to use PGP in this mode forever. What is new is the feature set which will make it very easy to impose GAK on the customers of PGP. According to Mr. Schneier, the code is just sitting there in all their products waiting to be compiled in. >>The demand for the ability to decrypt encrypted messages in the >>corporate environment can easily be measured with this test: how >>many companies have a policy that requires employees to record all >>outgoing mail? > >Well, any company giving stock advice (and governed by SEC rules on >stock tips, etc.) is already require to have all outgoing mail >approved (e-mail and snail), so does it matter if they record it or >not? The answer to the question I posed is "No". The example you cite requires the company to review message before transmission, not afterward. After transmission, the recipient of the message can submit it as evidence to the SEC should there be an impropriety. This is no different from the way it works now. There is probably a context issue here. It sounds like you do not share the context within which many people on this list are operating. The Big Problem for PGP, Inc. right now is that in 18 months or so their products may be illegal to use within the United States. While many of the rank and file in the company may be willing to accept corporate dissolution under those circumstances, the board, the investors, and the senior management are unlikely to welcome that option. So, they are preparing for that situation. They are releasing products with GAK support right now. By the time it becomes mandated by law, it will be easy to compile the well tested features into all of the products, or just discontinue their line of privacy products and sell only their Big Brother Inside products. The corporate key becomes the government key with the stroke of a pen. PGP, Inc. is betting that they'll win either way. If GAK goes down in flames again, they can still trade on their reputation for being The Good Guys. If GAK becomes mandated by law: "We didn't want to do it, but we had no choice." Some of us may be in the habit of thinking of PGP, Inc. as the hero. However, the problem with organizations is that they are easily corrupted. Does this mean everybody in the organization is now working for the government? No, it does not. Most likely there are many PGP, Inc. employees who are feeling uncomfortable with this new development but they are being given the same lines we are getting. Many of these people are probably getting an additional "inside scoop" from their leaders that explains the "real" strategy. Hopefully, the rank and file at PGP knows that people you like and see in the hallways every day will still lie to you if they think their career depends on it. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNDuw65aWtjSmRH/5AQGwLgf7BBYy2HO30eDXO2YLqkgtuOxAcnQU19AO DOKIa3jwU723ICgWD00dPW1GegKL5LaRfp3a+Xtd+qjHaFs0IlXr4kJGv1wiCJhu sRKxmSi3g1aGIfiF48uMef5bbzPL27b3u78rJds+E44LP9zEnieBcACBp+3977W0 0N0k7ADY6ME+zmc4f5D5aLdJa8gprOCPj1nF6esspkMuDDu5iH/YY/GT6VprRCub NojEXPS/uB6tgTS4vDfenL8UWUUqjXQof8MrRoMAG6dsjvNEyU5WlhbnDgyh9nF5 DbuP9+oA8DHYSmEGzTxD4oG7mGwb+NMMuYOyg3xC1H8ou2Ajv0kfOg== =UtlQ -----END PGP SIGNATURE-----

2 1

Improper biometric controls...
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Thu, 9 Oct 1997 11:55:35 -0400 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef(a)substance.abuse.blackdown.org Cc: bostic(a)bsdi.com Subject: Exam tip o' the day Date: Thu, 09 Oct 1997 11:50:58 -0400 From: glen mccready <glen(a)qnx.com> Resent-From: 0xdeadbeef(a)substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef(a)substance.abuse.blackdown.org> archive/latest/2317 X-Loop: 0xdeadbeef(a)substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request(a)substance.abuse.blackdown.org Forwarded-by: Rob Windsor <windsor(a)oc.com> Forwarded-by: Kirk A Schneider <kschneid(a)oc.com> It was the week of finals, and obviously, everyone was stressing. This happened in a big (+300) lecture class, it was some hard science course with one of those real pain-in-the ass professors. Everyone taking this course had been dreading this final from the start. They all knew they had no hope. There was one student in the class who felt confident in the area if he could just take his time and work his way through each problem. So, on the day of the final, he decided he would just take his time on the test. The exam began, and he slowly paced himself, carefully working out each problem. This was diffficult because the professor was one of those guys who would obnoxiously yell to the class how much time they had left every three minutes. He was just one of those guys who needed a smack in the face. Finally, time was up, and the teacher told the class to stop, and to bring their test papers down to his desk. With over three-hundred people, this procedure took quite a while. That one student just continued working on his test. Eventually, ten extra minutes turned into twenty, until the student was there for almost an hour after the exam had ended. He looked at his paper, and decided he had completed the test to his satisfaction, and he could now hand it in. He gathered his things and walked down to the teachers desk. The professor was sitting at the desk, the tests were still sitting on the desk in a neatly stacked pile, and it was clear he had just been waiting for this student to finish so that he could tell him that he had failed. The student reached his professors desk with a big smile on his face. The professor said to him, "This test was due an hour ago. By handing it in now it is considered late, and consequently, you fail." The student looked right at the professor and said to him "Do you know who I am?" The professor clearly upset by his student's response said "What are you talking about?" Again the student said, "Do you know who I am?" The professor responded by saying no, of course not... Just as he said this, the student lifted up half of the test papers still sitting on the teachers desk. He casually slipped his test on the pile, and let the rest of the tests fall naturally back onto the stack. He looked at his professor and said "I didn't think so." --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

RE: EU Rejects GAK
by Phillip Hallam-Baker 17 Dec '03

17 Dec '03

Before people get carried away it is important to realise that the EU institutions do not map onto US ones. The EU Commission does not have an analogue in the US system. It is an unelected group of beureacrats whose purpose is (roughly speaking) to harmonize EU law. It does not have legislative powers in its own right, nor does it necessarily have much influence. The EU lawmaking process is essentially that the Commision drafts some suggestions and passes them onto the council of ministers which accepts, rejects or ammends them. If there is unanimous agreement in the concil of ministers (majority vote on a restricted number of issues) then a directive is issued which the national parliaments must then enact into law. The limited scope of EU laws is critical, the EU is much like the US prior to the civil war, the member states are sovereign. Thus there is nothing the EU Commission can do to prevent member states outlawing crypto, nor for that matter can they force them to allow it. They can assist in forming EU wide regulations either way however. The real importance of the EU report is probably that it denies the statements made by the Freeh et. al. claiming that US alies in Europe are in favour of GAK. Despite the fact that there has never been any public demonstration of a commitment the administration has disingenuously claimed that it has the support of and indeed is being pressured to take its stance on export controls by other countries. Needless to say it is unconvincing to be told 'trust me' by someone who is clearly peddling a lie. Few people can prove it is a lie because few people can claim to have the personal access to European politicians the administration can. I know UK politics well enough to know that the current parliament is not going to back any increase of powers for a security service that many members of the government was used politically by the Conservatives. It would be like the nation of Islam calling for arbitrary arrest powers for the police. Phill

1 0