December 2003 - cypherpunks-legacy

Re: how to release code if the programmer is a target for coercion (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Ryan, Thanks for the clarification. I've added a few issues that have occured to myself and Doug Floyd (operator of the dh-l mailing list) during several short discussions we've had over the last year. Forwarded message: > Subject: Re: how to release code if the programmer is a target for coercion (fwd) > From: Ryan Lackey <rdl(a)mit.edu> > Date: 15 Jan 1998 05:19:25 -0500 > The problem reduces to one of distribution of public keys. Agreed. > In my model > (er, actually Lenny Foner's model, in this case), you distribute something > that has intrinsic verifiability -- the eternity source. If I understand this you mean to use the code itself as the key? So you require all the eternity servers to use the same source? Doesn't this imply at some point a single point of distribution and hence another point of attack? > So whether > or not rdl's eternity-dds signing key is compromised is irrelevant to > the users -- in fact, the assumption is that since I am a known target, > I've been killed or compromised. So, there's this potentially untrusted > code out there. I am unclear as to what you mean by 'known target', are you refering to a particular eternity server, the eternity server code itself, the document the user is looking for, or the provider of the document? I suspect the provider of the document. Doesn't the fact that you can't address issues of key validity become an issue? How does this model handle key aging or do you propose to leave the same keys out there for extended periods of time (ie decades after your death)? Doesn't this extended lifetime represent a threat to the validity of the keys since it provides mallet an exceptional period of time in which to mount the attack? Especialy since nobody is checking the keys? It further seems to me that the main motive of most law enforcement is going to be going after the user of the data the majority of the time since this is much more time critical than knowing who provided the data. After all simply knowing who did the original sourcing is not enough to remove the problem after the fact. Eternity servers are after intended to be long lived mechanism, this provides the authorities much time to follow the data and analyze the network traffic. Wouldn't it be important to provide some sort of delivery mechanism that provides a full encryption envelope around the data until it is delivered to alice? I recognize this exacerbates instead of alleviates the key server security issues. > People who have known public keys then inspect and sign the code. It is > assumed these people have distributed their public keys far and wide, signed > by lots of people, etc. As long as you can assume the "PGP web of trust", > the distributed software signing thing works. Ah, ok. So we again are assuming everyone is using the same particular piece of technology. In this model, would it not add security to the mechanism to have the eternity server deliver the encryption software (ie PGP)? How does this model handle the physical contact that is required in the PGP web of trust? In particular how does it verify that the actual physical contact occured? Can you address the key distribution mechanism and how it addresses the issue of a mallet producing their own key server with their own keys signed sureptitiously by their own multiplicity of 'nyms? Do you see a group of 'Johny Appleseeds' roaming the country in person dropping little dolops of signed keys off? Or, do you believe some sort of key verification service will need to be generated that compares keys for individual 'nyms on the various servers and publishes a list of keys that don't match (something that would to my thinking be prime data for a data haven server). Doesn't such a 'trusted' service have the same sort of 'user end' threats as the eternity servers themselves? Assume for a moment that mallet wants to monitor a particular alice. Alice makes her request which goes through mallets tap. Outbound traffic is uneffected so that the actual keys sent to the server are good. However, no the return stroke mallet intercept the traffic, provides their own bogus keys and signed document. How do you see alice finding a way to recognize this? The threat with this model is that alice might be turned and therefore condemn any co-participants in whatever activity alice is supposed to be involved in (eg ingesting lettuce or leading a freedom cell in Burma)? > I agree that the current state of PGP use is probably not enough for > the "PGP web of trust" -- I've *never* used a key and found it signed by > anyone I know. However, I think even the current system puts a pretty high > barrier to fraud, and if there started to be fraud, people would start > signing each other's keys. I agree with all the points but the last. When the cost becomes too high (ie inconvenient) they simply won't use it. I just can't seem to grasp why people would spend even more money (which would provide a flag via monitoring of funds) to physicaly meet a group of others who they probably don't know and therefore probably shouldn't trust at such a fundamental level. > A keyserver serving keys like "rdl's eternity-dds release signing key" might > be subject to traffic analysis, true. However, as you suggest, you could > put the keyserver inside Eternity. Then, the problem just gets shifted -- now > you need (a) pgp signing key(s) which has/have signed all of those keys. I believe it is a fundamental mistake to have the key server inside the eternity server, just as I object to anonymous remailers that provide such service. The key servers should be on different machines to provide physical independance & legal indipendance - these are long lived keys after all and there is no reason architecturaly to put the keys at threat if the data haven is at threat, and finaly technological indipendance - it should not require a upgrade of the eternity software (and visa versa) to upgrade the key server software. Another issue that was raised previously, neither I nor anyone else addressed it at the time, is this acceptance of latency of distribution. Since we are talking about providing potentialy damaging documents (to who is intentionaly left vague) doesn't this latency provide opportunities for attack? Unlike a remailer network where it defeats traffic analysis in the data haven model it seems like a perfect means to get the processing window to actualy mount a trace. Anyway, since I am still about 3-6 months from actualy implimenting any of my own Plan 9 based (network level anonymity) model this is all conjecture. Hope it provides at least a seed for something useful. Ta ta. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

FW: IRS/Co$ Secret Agreement web page (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

-----Original Message----- Subject: IRS/Co$ Secret Agreement web page http://www.primenet.com/~cultxpt/irs-cos.htm The IRS gave the Church of Scientology a sweetheart deal on October 1 1993, granting it privileges that no other tax exempt organization gets. The above web page includes the Secret Agreement, IRS tax code portions at issue, US Supreme Court ruling that the Secret Agreement violates, and other important information. I update it almost daily.

1 0

FBI to search school shooters computer [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > SUSPECTED HIGH SCHOOL GUNMAN TO MAKE COURT APPEARANCE > > FBI will search his computer for evidence of motive > > January 15, 1998 > Web posted at: 9:36 a.m. EST (1436 GMT) > > PADUCAH, Kentucky (CNN) -- The teen-age suspect in last month's > Kentucky school shooting was scheduled to make his first public > court appearance Thursday morning, as the FBI announced plans to > search the contents of his personal computer. > > Michael Carneal, 14, is accused of opening fire on an informal > prayer group in the lobby of Heath High School, where he was a > freshman. Three students were killed and five wounded in the > December 1 attack. > > Carneal was indicted as an adult on three counts of murder, five > counts of attempted murder, and one count of burglary. The > commonwealth's prosecutor has said he'll pursue the maximum penalty > of life in prison, which would mean Carneal, if convicted, would > have to serve 25 years before he could be considered for parole. > > In a search for a possible motive into the deadly shootings, the FBI > has agreed to search the contents of Carneal's personal computer. > Lobby Heath High School lobby where the shooting occurred ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

re: Microsoft Metaphors
by Thomas Porter 17 Dec '03

17 Dec '03

On Thu, Jan 15, 1998 at 10:09:09AM -0500, Declan McCullagh thoughtfully expounded: > What are the best metaphors to use when talking about a browser and an > operating system? Is the combination like a car and an engine, or a car and > a roofrack? A pair of gloves? > > Or is it even useful to talk about a browser/OS metaphor in the case of > Microsoft, since IE has been glued into the operating system in the form of > .DLLs? Might that be more like the wheels of a car? I might look at it like air conditioning in a car: If present, it requires significant alterations to the basic vehicle, and might be difficult to remove cleanly, _but_ air conditioning in no way affects the basic operation of the car, and cars can be bought without air conditioning. Hmmmmm, actually A/C does affect the car's operation: uses more gas and degrades performance! A better metaphor than I thought. -- Tom Porter txporter(a)mindspring.com ------------------------------------------------------------------------ "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Music Boulevard Storewide Sale
by http://www.musicblvd.com/ 17 Dec '03

17 Dec '03

Dear Music Boulevard Customer, Happy New Year from Music Boulevard! Ring in 1998 on the right note, with new music! Through January 26th we've lowered prices on every CD, cassette, video and T-shirt in our catalog of over 200,000 items -- our entire store is on sale! Search for your most-wanted recordings or refer to our comprehensive Buyer's Guide (created by Music Boulevard's staff of music experts) to find essential albums in every musical genre and style, from Surf and Garage Rock to New Orleans Jazz to Reggae to 20th Century Classical music. Follow the link below to go to our Buyer's Guide... http://www.musicblvd.com/cgi-bin/tw/1462_0_/mb2/live/mrkt/specials.txt $1 U.S. SHIPPING! Extra, Extra! Due to enthusiastic customer response, we've extended our shipping sale! Through the end of January, the shipping charge for U.S. orders is just $1 for unlimited items. With our unbeatable prices and shipping rates, expanding your music collection in '98 is one New Year's resolution you just can't break! EARN FREE CDS! How many CDs did you buy in '97? Our Frequent Buyer's Club members earn store credit for a free CD after each tenth item purchased on Music Boulevard. If you haven't already joined the club, don't delay - starting earning points towards your first free CD today! THE VOTES ARE IN... And the winner is...Music Boulevard! We've been named the official online store for the 40TH ANNUAL GRAMMY AWARDS! For the best recordings and performances of 1997, look no further than our comprehensive "Guide to the Grammy Nominees", including nominees in over 90 categories, audio clips, cover art, and much more. All nominated albums -- from outstanding artists Paula Cole, Babyface, Hanson, and many other top artists -- will be sale-priced through the Grammy Awards Ceremony on February 25th. After the 25th, revisit the Guide for a complete list of the winners and special savings on the best of the best! Just follow the URL below... http://www.musicblvd.com/cgi-bin/tw/1462_0_/mb2/live/mrkt/grammyguide/genera l.txt NEW AND NOTEWORTHY Music Boulevard keeps you informed of the latest and greatest new music! The stellar soundtrack to 'Great Expectations' is highlighted by brand new songs from Tori Amos, Chris Cornell of Soundgarden, and Scott Weiland. Just released -- Ben Folds Five's 'Naked Baby Photos,' a collection of 17 of the quirky pop group's best rare, live, and unreleased songs. And at the top of the music charts, the soundtrack to the epic romance 'Titanic' features the music of legendary film soundtrack composer James Horner as well as the Celine Dion's beautiful performance of the love theme "My Heart Will Go On." GET THEM BEFORE THEY'RE HOT! Visit Music Boulevard today to pre-order tomorrow's biggest hits! On January 27th, keyboard virtuoso John Tesh unveils his latest full-length album of lush, soothing New Age compositions. Also on the 27th, the master of English Jungle techno, Goldie, returns with his long-awaited second album, the double-CD 'Saturnzreturn.' On February 3rd, Seattle supergroup Pearl Jam makes a comeback with their fifth and finest studio album yet, 'Yield,' featuring the hit single "Given To Fly." Advance order these much-awaited new albums today and have them delivered to your doorstep on release date! Thanks for shopping Music Boulevard! The Music Boulevard Staff TO UNSUBSCRIBE To unsubscribe from this mailing list, send an Email to: remove-musicblvd(a)sparklist.com and you will be automatically removed from this list.

1 0

Re: Microsoft Metaphors (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi Dan, Forwarded message: > Date: Thu, 15 Jan 1998 11:26:03 -0500 > From: Dan Ritter <dritter(a)bbnplanet.com> > Subject: Re: Microsoft Metaphors (fwd) > The computer is a building. A building once built doesn't change and it's a pain in the ass to change the rooms and such. A general purpose stored program computer is intentionaly designed to get around these limitations. Computers before the stored program paradigm most certainly fit the building model however. > The OS makes it a supermarket. The OS provides a multiplicity of resources for me to use (purchase) at my leisure? I don't think so, unless you want to model the user as the company that loads the shelves. In a computer, unlike a store, each time I want to use a jar of tomato paste (program) to build lasagna (job) I don't have to go out and buy a new jar of tomato paste. > The browser is the map of the store showing what foods are in what aisles. That one I'll buy (figuratively). ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Crypto Kong penetration.
by James A. Donald 17 Dec '03

17 Dec '03

-- 2 Since release there have been a very large number of hits on the Kong documents, and mere 102 downloads of the program, and 74 downloads of the source code. The large number of source code downloads indicates that I am only reaching the crypto techie audience, that for the most part is already able to use PGP, not the non tech audience that Crypto Kong was designed for. On my web page I have documentation as to how business users can and should use this product. (See the section "contracts and certificates" <http://www.jim.com/jamesd/Kong> I and Mather Cromer have prepared a release document targeted at business users (See below) Does anyone have any suggestion of how to get the message in front of the target audience? (press release oriented towards businessmen follows: -- Announcing Crypto Kong. Free digital signatures and encryption. <http://www.jim.com/jamesd/Kong/Kong.htm>. Many businessmen use a faxed signature for a contract, or for authority to act, or worse still, a shared password, as stockbrokers often do. This is almost worthless. The signature on a fax can be, and often is, a mere bitmap, not genuinely scanned in from a signature written in ink on a paper document, but merely applied digitally to an image in computer memory. If that bitmap was also applied to some other document sent to the same company, which it usually was, then the fax proves nothing. On the other hand, often one cannot wait for FedEx to deliver signed documents. The answer is digital signatures and encryption. With digitally-signed electronic documents, you can send unforgeable signed documents instantaneously across the globe. Crypto Kong is easy to use and it uses the same identity model that as businesses today use for ordinary handwritten signatures, unlike other products which impose their own different way of handling identity. Crypto Kong takes away the hassles of certificate management, public key authentication, and complicated operating instructions. Anyone can immediately use it to sign documents, to compare signatures or to encrypt sensitive messages. Kong compares the signatures on documents, rather than comparing a signature against certificates. Crypto Kong software makes it easy to send or receive digitally signed documents or use top grade encryption to keep messages private. Crypto Kong provides support for contracts and the documentation that accompanies transactions. The Crypto Kong application and detailed documentation information is available as a free download from the Kong home page: Kong is compatible only with Windows 95 and Windows NT. Complete source code is also available for download from the home page. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG SgQ8pgY/MeQpI9CfGR5kSsRdW61mSVYtqHkEMoMU 47jSLQPPmYxhaKH9MyohUU9Q9i3bzVWjwey/s3Od4 --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG gME+6HSq3N3G1iw88pJyVqcNc8dlMZhS2f+zUijA 4IpLFuTI1zY7tEU4+gDAFM6uhgcWP9IyA/3guXt7j 4WRob8mo+81LCLSyU4RiPNOilXHZTlyvZzsFMr+9d --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the state. http://www.jim.com/jamesd/

3 2

Number Theory on Computers book...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, If you're looking for a good beginners book for number theory that is focused on using computer programs (BASIC) then check out: Exploring Number Theory w/ Microcomputers Donald D. Spencer ISBN 0-89218-113-3 (note I couldn't find w/ this, had to use the title) $24.95 Camelot Publishing PO Box 1357 Ormond Beach, FL 32175 904-672-5672 I ordered mine through Bookstop and should take 4-8 weeks for delivery. There is a teachers manual available as well (I suspect it is answers only) for $15.95 ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

BUG Bounty...
by Peter Wayner 17 Dec '03

17 Dec '03

My publisher is reprinting _Digital Copyright Protection_, a book that describes how to use encryption and steganography to control digital data. I get to fix any problems that are out there. To encourage people who may have spotted errors, I'm offering a bounty of $20 to the first person who reports an error subject to the following limitations: * The errors must be technical. I appreciate anyone who wants to correct my grammar, but I think that these types of errors are too hard to pin down. We could spend more time arguing than solving them. * I reserve the right to aggregate errors and determine the right way to split them up. This isn't a loophole, it's just a way to prevent someone from noting a pattern and asking to be paid for each separate occurance. For instance, imagine that someone notes that I forgot to put a page number on a blank page at the front of the book. Is every page number after that wrong? I promise I won't use this as a loophole. * I reserve the right to make arbitrary judgements about the "first" person to submit a claim. This is to prevent a club of people from finding an error and reporting it in synchrony. I may choose to pay each person the $20 reward, choose one I feel is most deserving, or even split the reward n ways. It's up to me. I'll probably choose the first one unless there are extenuating circumstances. Thanks to everyone who takes part in this project. Let me know if you have any questions. In the past, I've found that few people reported the errors and I'm hoping that $20 will be enough of an inducement. Perhaps there are no errors there? This is the best way to prove a negative. Thanks again, Peter Wayner

1 0

Re: Crypto Kong penetration.
by James A. Donald 17 Dec '03

17 Dec '03

-- On Thu, 15 Jan 1998, James A. Donald wrote: >> If you try and shove that identity stuff onto people they >> will not do it. Too much like hard work. They will >> happily let the government licensed authorities do it for >> them. The PGP model clearly has not flown yet, and it is >> not going to fly. At 02:16 PM 1/15/98 -0500, Ray Arachelian wrote: > IMHO, this is pure grade A bullshit. If you included PGP > in MsMail, and Eudora and pine and elm from the get go, > everyone would use it. Proven false by experiment: Observe what happened with Verisign and MIME. The cost is not signing your stuff. The cost is setting up a key and publishing it, and getting other peoples keys and verifying them. Integration with Eudora makes it trivial to sign and to decrypt, *after* you have created and uploaded a key, and downloaded and verified other peoples keys, which is not trivial. People would rather the kindly benevolent government did that hard stuff for them. Verisign/MIME is *already* integrated into everyone's mailers, and they are not using it because Verisign key management is too hard, and Verisign key management is arguably more user friendly than PGP key management, though clearly less user friendly than Crypto Kong's (lack of) key management. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG s/7IS+OXDf+elZBg6ff+1Sq4aO4aoy9DRhH58rhP 4HFsRTnHTjnMnwGwjenI4jPJsM/0cy02LwoJAtbQ8 --------------------------------------------------------------------- We have the right to defend ourselves and our property, because of the kind of animals that we are. True law derives from this right, not from the arbitrary power of the state. http://www.jim.com/jamesd/

1 0