December 2003 - cypherpunks-legacy

No Subject
by Anonymous 17 Dec '03

17 Dec '03

INTELLIGENT VIRUS INVADES NT SERVERS A new computer virus that attacked 10 MCI Worldcom networks last week is capable of spreading throughout computer networks and scrambling the documents on those networks as it goes. "We've never seen anything this sophisticated in 10 years of doing this," says Network Associates' general manager of network security. "This is a completely new strain of virus and the first we've seen that propagates itself with no user interaction." The "Remote Explorer" virus runs on Microsoft Windows NT servers and affects common programs like Microsoft Word. Users clicking on their Word icon might experience a slight delay, but otherwise would be unable to detect the presence of the virus; meanwhile, the virus is busy corrupting files and spreading to other programs. Microsoft officials say they're "aware of other viruses that have the same characteristics," and Network Associates says it has developed a Remote Explorer detector and is working on a solution to decode the affected files. (Wall Street Journal 22 Dec 98) #!/usr/local/bin/perl -0777-- -export-a-crypto-system-sig -RC4-3-lines-PERL @k=unpack('C*',pack('H*',shift));for(@t=@s=0..255){$y=($k[$_%@k]+$s[$x=$_ ]+$y)%256;&S}$x=$y=0;for(unpack('C*',<>)){$x++;$y=($s[$x%=256]+$y)%256; &S;print pack(C,$_^=$s[($s[$x]+$s[$y])%256])}sub S{@s[$x,$y]=@s[$y,$x]}

1 0

Re: bug recipes
by Pallas Anonymous Remailer 17 Dec '03

17 Dec '03

>..someone describes the use of mutton for anthrax >breeding.. > >The mils are already vaccinated, so anthrax is >passe. What you *really* want to do is dig up a >smallpox victim... The only Mils vaccinated are the ones going into saudi and bosnia and other High-threat area's. They will not be fully vac'ed for another 3-5 years. As far as smallpox...I'd just as soon that shit NEVER get dug up. I somehow doubt a skeleton could harbor usable smallpox but I am not up on my biology tonight. --Skrill

2 1

Is Sameer/C2net Attempting to subvert the OpenSSL and Mod-ssl projects
by Anonymous 17 Dec '03

17 Dec '03

To: cypherpunks(a)cyberpass.net cc: Subject: OpenSSL and C2Nets attempted subversion of same(Sameers track record -------- On the Subject of Sameers record with open source mod_ssl.c(this was the component that Sameer wishes wasnt available(and did his best to deny to his customers) and indeed was quite sucessful in preventing its availability until Ralf Engleschall's mod_ssl becam available... This is the REAL reason C2net took a nose dive...) and now it appears Sameer is trying to co-opt that project also. I trust Ben Laurie and Ralf... They developed the code . I DONT trust Sameer... he is simply a privateer, he takes sources and trys to restrict availability so he can make a profit from Intellectual Property NOT developed by him... I specifically suspect his announcement coming on the heels of Ben's. I dont think this person will ever get a clue about either Open Source or GPL. merry Xmas the baby ruth bar in the swimming pool :)

2 1

Ping
by Anonymous 17 Dec '03

17 Dec '03

TEST TEST TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~ TEST TEST ~

1 0

We pay you to host our banner
by Bernies 17 Dec '03

17 Dec '03

You got this email because you address have added into our database by you or someone. If you don't want to got this email any more, simply send a blank email with REMOVE at subject to us. Thanks because reading this mail, now you can earn one dollar ($ 1.00 ) just hold a banner at you site. If someone fill out a form form you web site and you will get $1.00. Very simple and easy. For more information or you want to join us, pls email to us at email_tool(a)yahoo.com or burnerutm(a)hotmail.com iwth subject headline :BANNER HOLDER Thanks Bernies

1 0

SCC's SmartFilter Bans Crypto/Privacy Website(s) as Naughty, not Nice?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 24 Dec 1998 03:59:49 -0500 To: cryptography(a)C2.net From: Vin McLellan <vin(a)shore.net> Subject: SCC's SmartFilter Bans Crypto/Privacy Website(s) as Naughty, not Nice? Sender: owner-coderpunks(a)toad.com This is an amazing story! Security Computing Corporation <http://www.scc.com> sells a content filter ("SmartFilter") which is used to restrict web access from within corporations and other organizations. Lauren Weinstein, the moderator of the widely respected Privacy Forum, a mailing list and website on the Internet at <http://www.vortex.com>, recently reported that for over a year (see the attached post) corporate employees at sites which use SCC's SmartFilter have typically been restricted from accessing the Privacy Forum website or archives because the Privacy Forum's occasional discussion of cryptography. These discussions -- no code, all high-level discussions of civil and ethical values, policy, and crypto politics -- were apparently enough to define the Privacy Forum website as a repository of "criminal skill." Some SCC corporate customers, according to Weinstein, had explicitly asked for crypto resource sites on the web to be defined as off-limits. It is still unclear how those requests (one from the corporate site which brought the matter to Weinstein's attention) resulted in SCC staff labelling the Privacy Forum website -- along with, one must presume, many _many_ others -- as a repository of criminal skills. (Other sites which fall into this SmartFilter category include, for example, websites which make available information about what ingredients can be used to make a bomb. Shades of Wassenaar and ITAR.) What is amazing, of course, is that Secure Computing is one of the more sophisticated vendors in computer security. There are a lot of smart people at SCC who will doubtless cringe when they hear this story. It may, in fact, seem hilarious to some of them that SCC's website evaluation staff (and the web filters they use to express and embody their judgements) could categorize a privacy site as "criminal" just because it archives discussions of cryptography and crypto politics. Some of the best of those discussions, for instance, may have involved SCC employees like cryptographer Rick Smith;-) What is _really_ sad is that -- when Weinstein complained that a website categorized as offering "criminal skills" by SCC's SmartFilter staff may, with no recourse, suffer irrepreparable harm -- the best and most daring response SCC could come up with was to promise to set up a website at which organizations and commercial entities could query the SCC database to see how SCC's website evaluators labelled them. (This, of course, presumes these organizations hear about SCC's Smartfilter product.... It also presumes that representatives of those agencies, firms, or organizations feel compelled to inquire to see if SCC's professional moralists labelled them in some similarly eccentric category.) Not exactly clear on the concept, those clever SmartFilter folk. Frankly, not in a million years would anyone outside of the bowels of the Hoover Building consider crypto savvy (or an obsession with privacy) as inherently "criminal." Not yet anyway. I do hope that SCC has sold a few thousand copies of SmartFilter which routinely block corporate employee access to some feisty, litigious, and well-networked civil libertarian groups like the ACLU, EPIC, CDT, or PI as repositories of Criminal Skills. Oh, yes indeed! In fact, if the Privacy Forum was labelled as "criminal" because of an ocassional discussion of crypto, does it make sense that the websites of SDTI/RSA, Entrust, IBM, MS, Netscape, et al, eluded the ban and some similar label? Inquiring Minds wanna to know. The SmartFilter has been awarded "certification" by the International Computer Security Association's testing labs: <http://www.icsa.net>. The SmartFilter data sheet is at: http://www.securecomputing.com/P_Tool_SF_Docs.html and there is a white paper at: http://www.securecomputing.com/sfwhitep.pdf SCC provides SmartFilter access controls adapted for both Unix and Windows NT, as well as for the Microsoft Proxy Server, the Netscape Proxy Server, several firewalls, the CSM Proxy Server, the NetCache Proxy Server, and the Squid Proxy Server. Feliz Navidad, _Vin ------- original message ----------------- > From: privacy(a)vortex.com [SMTP:privacy@vortex.com] > Sent: Sunday, December 20, 1998 4:58 PM > To: PRIVACY-Forum-List(a)vortex.com > Subject: PRIVACY Forum Digest V07 #21 > > PRIVACY Forum Digest Sunday, 20 December 1998 Volume 07 : Issue > 21 > [...] > > Date: Wed, 16 Dec 98 12:25 PST > From: lauren(a)vortex.com (Lauren Weinstein; PRIVACY Forum Moderator) > Subject: Privacy Discussions Classified as a "Criminal Skill" > > Greetings. Is discussing privacy in the PRIVACY Forum a criminal skill? > According to one widely used commercial web filtering tool, the answer was > yes! The controversy over software to block access to particular sites, > based on perceived content, has been continuing to rage. Attempts to > mandate the use of such software in environments such as libraries and > schools have raised a variety of serious concerns. In addition to fairly > straightforward freedom of speech issues, another factor revolves around > how accurate (or inaccurate) these filtering systems really are. > > I've now seen firsthand that errors by a filtering system can indeed be quite > serious, an event that seems to certainly validate some of these concerns. > But there is something of a silver lining to the story, as we'll see > later. > > I recently was contacted by someone at a large corporation, who was trying > to reach the PRIVACY Forum web site, which is constantly being referenced by > individuals and commercial, educational, government, and other sites around > the world. This person was upset since whenever they attempted to reach > the http://www.vortex.com site and domain that hosts the PRIVACY Forum, > their web software blocked them, informing them that the block was in place > due to the site being categorized as containing "criminal skills." > > As the webmaster for the vortex.com domain, this certainly came as news to > me. The message they received didn't give additional information--they > didn't even know exactly where it came from. It was apparent though, that > the entire organization was probably blocked from reaching the PRIVACY > Forum, since the filtering software in question was affecting a main > firewall system. > > After a number of phone calls and discussions with the system administrator > for that organization, the details began to emerge. The company was running > a filtering software package from Secure Computing Corporation of San Jose, > California. This package received weekly updates of blocked sites in a wide > variety of categories, one of which was "criminal skills." > > The administrator had no idea what rationale was used for these decisions, > they just pulled in the list each week and applied it. He immediately placed > vortex.com on a local exception list so that it would no longer be blocked to > their users. > > I then turned my attention to Secure Computing. After a number of calls, I > found myself speaking with Ken Montgomery, director of corporate > communications for that firm. He confirmed the information I had already > received. The filtering product in question ("SmartFilter") was apparently > not being marketed to individuals, rather, it was sold to institutions, > corporations, etc. to enforce filtering policies across entire entities. > The product covers a wide range of information categories that users of the > software can choose to block. He said that the majority of blocked sites > were in categories involving pornography, where there was (in his opinion) > no question of their not belonging there. > > The "criminal skills" category reportedly was broadly defined to cover > information that might be "of use" to criminals (e.g. how to build bombs). > He had no explanation as to why my domain had been placed in that list, > since by no stretch could any materials that are or have ever been > there fall into such a categorization. He did discover that the > classification of my domain had occurred over a year ago (meaning > other sites could have been receiving similar blocking messages for > that period of time when trying to access the PRIVACY Forum) and > that the parties who had made the original classification were no longer > with their firm--so there was no way to ask them for their rationale. > (All of their classifications are apparently made by people, not > by an automated system.) > > However, it seems likely that the mere mentioning of encryption may have > been enough to trigger the classification. The administrator at the > organization that had originally contacted me about the blocked access, told > me that the main reason they included the "criminal skills" category in > their site blocking list was to try prevent their users from downloading > "unapproved" encryption software. This was a type of information that he > believed to be included under the Secure Computing "criminal skills" > category (the "logic" being, obviously, that since criminals can use > encryption to further their efforts, encryption is a criminal skill). He > also admitted that he knew that their users could still easily obtain > whatever encryption software they wanted anyway, but he had to enforce the > company policy to include that category in their blocking list. > > As PRIVACY Forum readers may know, no encryption software is or ever has > been distributed from here. The topic of encryption issues does certainly > come up from time to time, as would be expected. For the mere *mention* of > encryption in a discussion forum to trigger such a negative categorization > would seem to suggest the fallacy of blindly trusting such classification > efforts. > > Mr. Montgomery of Secure Computing initially suggested that it was up to > their customers to decide which categories they wanted to use in their own > blocking lists -- he also stated that as a company they were opposed to > mandatory filtering regulations. I suggested that such determinations by > their customers were meaningless if the quality of the entries in those > categories could not be trusted and if errors of this severity could so > easily be made. I felt that this was particularly true of a category with > an obviously derogatory nature such as "criminal skills"--the ramifications > of being incorrectly placed into such a category, and then to not even > *know* about it for an extended period of time, could be extreme and very > serious. > > To their credit, my argument apparently triggered a serious discussion > within Secure Computing about these issues. I had numerous subsequent > e-mail and some additional phone contacts with Mr. Montgomery and others > in their firm concerning these matters. First off, they apologized > for the miscategorization of vortex.com, and removed it from the > "criminal skills" category (it was apparently never listed in any > other of their categories). > > Secondly, they have agreed with my concerns about the dangers of such > miscategorizations occurring without any mechanism being present for sites > to learn of such problems or having a way to deal with them. So, they will > shortly be announcing a web-based method for sites to interrogate the Secure > Computing database to determine which categories (if any) they've been > listed under, and will provide a means for sites to complain if they feel > that they have been misclassified. They've also suggested that their hope > is to provide a rapid turnaround on consideration of such complaints. > > While by no means perfect, this is a step forward. I would prefer a more > active notification system, where sites would be notified directly when > categorizations are made. This would avoid their having to > check to see whether or not they've been listed, and needing to keep > checking back to watch for any changes or new categorizations. If more > filtering software companies adopt the Secure Computing approach, there > would be a lot of checking for sites to do if they wanted to stay on > top of these matters. Secure Computing feels that such notifications are > not practical at this time. However, their move to provide some > accountability to their filtering classifications is certainly preferable > to > the filtering systems which continue to provide no such facilities and > operate in a completely closed environment. > > So, we make a little progress. The PRIVACY Forum and vortex.com are no > longer miscategorized and have been removed from all Secure Computing block > lists. Secure Computing was polite and responsive in their > communications with me, and will establish the system discussed above in > reaction to my concerns. Web filtering of course remains a highly > controversial topic with many serious negative aspects, but we see that when > it comes to dealing with the complex issues involved, it would be a mistake > to assume that all such filters all created equal. > > --Lauren-- > Lauren Weinstein > Moderator, PRIVACY Forum > http://www.vortex.com > [...] ----- "Cryptography is like literacy in the Dark Ages. Infinitely potent, for good and ill... yet basically an intellectual construct, an idea, which by its nature will resist efforts to restrict it to bureaucrats and others who deem only themselves worthy of such Privilege." _ A Thinking Man's Creed for Crypto _vbm. * Vin McLellan + The Privacy Guild + <vin(a)shore.net> * 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548 --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

I want to spam the Jury Duty information
by Anonymous 17 Dec '03

17 Dec '03

I think about putting up about $200 or so (whetever a decent spamming will cost me) and spam the internet with the information about jurors rights and jury nullification. Anyone thinks that it is a good idea?

2 1

Suggested reading
by Jim Choate 17 Dec '03

17 Dec '03

The Iron Cavalry Ralph Zumbro ISBN 0-671-01390-4 $6.99 US Note especialy the last chapter, "Puma Force". ____________________________________________________________________ What raises the standard of living may well diminish the quality of life. The Club of Rome The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Assault on Civil Liberties
by DOOM Anonymous Untraceable User 17 Dec '03

17 Dec '03

<http://www.sjmercury.com/columnists/gillmor/docs/dg121398.htm> "Civil liberties and privacy grew more tenuous. The Clinton administration maintained its record of utter unfriendliness toward the Bill of Rights as it applies to technology. The administration's hard-line stand on encryption, the scrambling of data to keep it away from prying eyes, shows no signs of moderation. And the administration pursued the absurd notion, which flies utterly in the face of reality, that private businesses can regulate themselves in ways that protect consumers' privacy."

1 0

What's up with C2 and SSL?
by jim finder 17 Dec '03

17 Dec '03

Would someone mind explaining the background of this dispute? I've seen posted several vague accusations that imply that (depending on the poster) either Sameer or Ben have acted badly and unwisely in some way, and that at least one of them has a "bad track record" with open source software. I don't have enough information to judge, which I expect is also the case for many other readers here. Could someone please lay out exactly what this bad track record is, and what was wrong with Sameer and Ben's announcements? Otherwise we all just have to guess what is going on here. Also, what happened with SSLeay? Either that, or stop making public accusations. Jim ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0