December 2003 - cypherpunks-legacy

GoLive CyberStudio2
by John W. Adams 17 Dec '03

17 Dec '03

Hello Mac User, Our records indicate that you downloaded a free 30-day trial of GoLive CyberStudio 2 from our web site. Your 30-day trial evaluation period has expired. Purchasing the full copy of the software now will allow you to continue working without losing any of your pages or sites. I can also include the new "CyberStudio 2" book by Peach Pit Press (an $18.95 value) for free. I'll need for you to contact me within 30 days so that I may facilitate your purchase. Since your download, we are proud to announce that GLCS2 won the prestigious Eddy Award for Best Web Development Software at MacWorld this month, so you can rest assured that you are getting the best possible solution for your web development and management. I look forward to hearing from you. Thanks. John W. Adams, Direct Sales GoLive Systems, Inc. 800-554-6638, opt 1 or 512-464-8545 direct mailto:jwadams@golive.com http://www.golive.com

1 0

Internal Affairs: Looking for Lewinsky, from Netly News (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 23 Jan 1998 15:41:04 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: Internal Affairs: Looking for Lewinsky, from Netly News ******* http://cgi.pathfinder.com/netly/opinion/0,1042,1708,00.html The Netly News (http://netlynews.com/) January 23, 1998 Internal Affairs: Looking for Lewinsky by Declan McCullagh (declan(a)well.com) Call it the year the Internet brought down a president. If President Clinton just can't shake this week's accusation of peripatetic philandering, let's give the Net some credit. First, we must acknowledge Matt Drudge, the online rumormonger who finally exacted his revenge on Clinton for supporting Blumenthal v. Drudge, a lawsuit with a million-dollar price tag. When Newsweek spiked an expos of the Monica Lewinsky scandal, it was Drudge who spread the rumor across the Net and throughout the media on Saturday, January 17. [...] Of course, until yesterday, Clinton's impeachment seemed about as far-fetched a possibility as our unearthing one of Lewinsky's close friends on Usenet -- which is exactly what The Netly News was dispatched to do. Every time there's a major news event, our intrepid Internet team is called forth to scour DejaNews, troll IRC and mass-mail anyone who might possibly divulge information on the given subject. The Lewinsky search was less revealing than most. We found the former White House intern's annual salary; her home address in Portland, Ore.; the amount she and her mother donated to Democratic campaigns ($1,550 in 1996). Someone informed us, in all seriousness, that Lewinsky once gave him a goldfish. We also had people ask us if we'd pay them for information. (Fat chance.) [...]

1 0

IETF S/MIME to follow PGP in building in GAK?
by Adam Back 17 Dec '03

17 Dec '03

You may recall the furor generated by PGP Inc adding a GAK enabling feature thus making it easier for governments to impose GAK on the deployed PGP 5.x user base. PGP Inc called this feature CMR (Corporate Message Recovery) or ARR (Additional Recipient Request). Over on IETF S/MIME, right now there is a thread which looks set to add an almost identifical feature to S/MIME (spooky how similar the feature is even). Most of the regular contributors on S/MIME work for GAK sell out companies anyway, so I figure this is pretty much a done deal. (S/MIME already has another form of GAK also, in that the X.509 key directory specs allow the directory to optionally keep _private_ keys also). I think the ARR mechanism is actually more dangerous than keeping locally escrowed copies of keys in PGP because of the web of trust model. (See: http://www.dcs.ex.ac.uk/~aba/cdr/ for my thoughts on this). In the S/MIME world where there is a more hierarchical approach to Certification, you can expect government run CAs which demand a copy of your private key also. (eg. the UK DTI document on crypto licensing proposals was talking about this method). For S/MIME, S/MIME style ARR seems fairly balanced in lethality to CAs which keep private keys. I wonder if Phil Zimmermann feels proud of himself now that S/MIME looks like it will adopt his CAK/GAKware design. You might be amused at this introductory remark from the proposer on S/MIME IETF: : As a side note, this is not a radically new concept as something very : similar has already been proposed and implemented by PGP. : : Flames welcome. The guy's proposal below. It was well received too. Someone else proposed adding it in as a core MUST S/MIME requirement to handle these additional recipient requests. (You can follow the thread on the hypertext archive at www.imc.org (look for IETF S/MIME mailing list, or by subscribing to ietf-smime(a)imc.org) Adam ====================================================================== Date: Fri, 23 Jan 1998 13:07:01 -0700 From: "Steve Russell" <steve.russell(a)worldtalk.com> Subject: Corporate Key mechanism To: <ietf-smime(a)imc.org> A new and somewhat radical thread.... Because I believe the following to be true: - Requiring key recovery is a bad thing (complexity, cost, implementation, etc.) - Companies do have a need to access mail encrypted to or encrypted by their employees (lost keys, legal investigations, etc) - We are all working on methods of satisfying US export requirements so that we can export a cryptographically useful product - The is a middle step between full key recovery and no hope of recovery which involves encrypting messages to a 'corporate key' in addition to a individual public key when sending a message. Basically, what is involved is changing the user certificate format to designate a field for a second certificate which represents the corporate public key appropriate for that user. An application intending to encrypt mail to that user MUST then encrypt the message to both the user key and the corporate key. By no means am I implying that everyone that implements S/MIME leave a back door into all of their messages. However, since most companies that are implementing secure messaging are setting up their own CA (Entrust, OnSite, Netscape, etc.) and they have control over what fields are populated and with what information, they are able to choose whether or not they need visibility into their own data. As a side note, this is not a radically new concept as something very similar has already been proposed and implemented by PGP. Flames welcome. Steve

1 0

cryptix java AES effort
by Adam Back 17 Dec '03

17 Dec '03

(AES is the Advanced Encryption Standard, a NIST standardisation process ongoing at present to select a replacement encryption algorithm for DES. Algorithm submissions were requested by NIST from any interested parties.) AES requires submitters to include reference java implementations. Systemics provides a BSD licensed (free for commercial and non-commercial use) java crypto library called cryptix. Cryptix has an IJCE interface which means that it integrates with other java crypto apps as a standard java cryptographic service class. http://www.systemics.com Systemics are interested to add AES candidate algorithms to cryptix, and are offering to provide the java implementation to any AES algorithm submitters, see: http://www.cs.ucl.ac.uk/staff/I.Brown/cryptix/aes/AES_crypt.html Systemics also are interested in encouraging programmers to join in this effort: http://www.cs.ucl.ac.uk/staff/I.Brown/cryptix/aes/AES_prog.html Adam -- Now officially an EAR violation... Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

URL for S/MIME CAK discussions
by Adam Back 17 Dec '03

17 Dec '03

I wrote: > (You can follow the thread on the hypertext archive at www.imc.org > (look for IETF S/MIME mailing list, or by subscribing to > ietf-smime(a)imc.org) The discussions on S/MIME CAK/GAK implementations start with: http://www.imc.org/ietf-smime/mail-archive/1038.html Adam

1 0

Disney.com Registration Notification
by guest_mail＠online.disney.com 17 Dec '03

17 Dec '03

Dear Parent -- We at Disney.com wanted to let you know that a guest has registered at our Web site as your child. We welcome guests of all ages, and it is our policy to let parents and guardians know when children under 16 send us personal information. This message is only a confirmation -- it does not require a reply if you grant your child permission to be registered at Disney.com. If you'd like to cancel that Registration, please see the instructions below. Here's what we received when your child registered: Your child's first name: cypherpunks Your child's last name: cypherpunks Child's e-mail address: cypherpunks(a)algebra.com Parent's e-mail address: cypherpunks(a)algebra.com Your child's year of birth: 1990 Child's Disney.com Registration Name: cypherpunks You might want to ask what your child's Password is and make a note of it. If you or your child lose or forget the Disney.com Registration Name and/or Password, you can retrieve them using the special, easy-to-remember "code word" your child also selected upon registering. If your child wins prizes at Disney.com, you will receive them on his or her behalf. If you'd like to cancel your child's Disney.com Registration, please follow these simple steps: 1. Click the "Reply" button on your e-mail application. 2. Make sure your reply contains the text of this message (including your child's name, e-mail address, and Registration Name). 3. Type "Unsubscribe my child" in the "Subject" area at the top of your message, and send the message back to us. That's it! We welcome you and your child to Disney.com, the best place to find out what's new from Disney! -- Your friends at Disney.com (c) Disney

1 0

Re: Why no "Banner Ad Eaters"?
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: >Yeah, I'm surprised that "banner ad eaters" have not been widely deployed. >(If they're available, I haven't about them.) Something to remove the >annoying banners, or stop them from wasting valuable time loading in the >first place. Tim, I'm surprised. WebFree for the Macintosh does this very thing. It matches on URL substrings and simply removes these things wholesale from your browser window. No broken image boxes, nothing. It also kills cookies and stops animated GIFs from leaking through, if you want to nuke either of those things. The URL is: http://www.falken.net/webfree/ Junkbusters (http://www.junkbusters.com/) offers a personal proxy server kind of thing that lets you mash just about everything: HTTP headers, user agent info, referer URL, cookies, etc. It runs on either NT or Unix variants. One could also use it to get around a firewall configured to reject non-standard browsers, but That Would Be Wrong, as Nixon once said. It lets you specify which sites or substrings to look for, and which ones you trust. It also does proxy chaining. Ratbert ratbert at nym dot alias dot net

3 3

Jay Leno on Clinton 1/23/98
by David Miller 17 Dec '03

17 Dec '03

Tonight in Leno's monologue they did a piece on the eriee similarities between Nixon and Clinton: NIXON: Was known for the campaign slogan "Nixon's the One!" CLINTON: Known by the phrase "That's the Guy!" NIXON: Was known for his "widows peak" CLINTON: Known to make widows peak NIXON: Took on Ho Chi Minh CLINTON: Took on Ho NIXON: Was familiar with G. Gordon Liddy CLINTON: Familiar with the G-spot NIXON: Wanted "Peace with Honor" CLINTON: Wanted "Piece while on her" --David Miller middle rival devil rim lad

1 0

.
by Gortega＠ix.netcom.com 17 Dec '03

17 Dec '03

1 0

2 sides to the poll on DOJ v. M$
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- let's look at the tail of the Reuters newsclip on M$ settling the immediate contempt action --a settlement most of the outside experts say gives the government an advantage in the final determination. what I dont like is that M$ scored a huge PR victory by caving in to the government --it had no choice, but many of the fence sitters are now going to state that M$ is "reforming" --which is pure bullshit; they are playing the Lenin-Stalin game of dealmaking so they can regroup and work around it, then blatantly violate it after they have sufficient strength. I like the comment Maureen quoted the 21st from one attorney who liked M$ to smallpox --"...stamp it out, ...or it will come back." But a poll issued Friday cast doubt on how far the public backs the government's scrutiny of Microsoft. A Time/CNN survey of 1,020 adults Jan. 14-15 found 46 percent thought Microsoft's dominant role in the software industry was good for consumers against 30 percent who thought it was bad. I am surprised they determined only 46% thought it was good as it has made for cheap, almost good enough, and ubiquitous software --if you dont mind settling for mediocrity with most innovations products M$ has either preempted or stolen. what is really surprising is that there really were 30% who acknowledged the danger of M$ as a monopoly! people vote for government with their wallets --voting for "cheaper" commerce-- even more so. Americans are not known for their discriminating choice of products based on quality and function --they almost always settle for "almost good enough" and cheap. secondly, they are truly "sheeple" and must have what everybody else has which is a market driven by positive feedback --in analog amplifiers, that often causes smokeouts-- and controlled are commonly referred to as oscillators. The same poll found 51 percent thought the government should refrain from steps to reduce Microsoft's advantage over other software companies vs. 32 percent who thought the government should intervene. this one is also very telling. the 51% is peanuts against the fact that 30% actually believe the government should intervene! --that is even more impressive considering that most Americans want government to do less and trust federal agencies even less. for something as complicated as antitrust actions, I find the 32% proactive intervention percentage rather warm and fuzzy in that there is a real understanding that M$ is a malignant cancer, and needs to be treated as such. M$ made a serious mistake treating the judge, the DOJ, and the American people with the contempt they have always treated their competitors. gone are the home grown 'aw shucks' appreciation of the American success story --Gate$ and crew have been shown to be the selfish 4 year old brats we in the industry have all learned to "love".... the only danger of this recent poll is that M$ spin doctors will show it as a victory --it's not. 30+% that want to curtail your power is not a victory --the percentage changed from a few hundred or a thousand of in the industry who feel Gate$ has long since passed the acceptable level of control to greater than 30% of the population-- _that_ is significant. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQBVAwUBNMmLfbR8UA6T6u61AQH4HQH/TIjc9GJhrJdcPvXtQ1A9CNVRk9zQdCRH YHR5X0OGgEWN+U5cLnMRvEGbhoLiKDRHTklsE7vKmsGSBZc7MwAd0A== =uPBW -----END PGP SIGNATURE-----

1 0