December 2003 - cypherpunks-legacy

Re: PGPsdk is now free for non-commercial use
by Anonymous 17 Dec '03

17 Dec '03

Bill Stewart writes: > I'm pleased to see PGP Inc. permitting development of freeware, > but at leased from a first reading of the license, > it's a _really_ restrictive definition of "freeware" - > not only does the software have to be free, but it can only be used > in extremely restrictively non-commercial activities. > It's far more restrictive than RSAREF (though more precisely defined.) > Here's an excerpt from the web page at > http://www.pgp.com/sdk/sdklicencefree.html > For purposes hereof, the term "non-commercial" shall mean that > the application > (a) has been distributed or otherwise made available at no charge > (direct or indirect) and > (b) is not used for any commercial purpose, which includes, > but is not limited to, any activity engaged for the purpose > of generating revenues (directly or indirectly). > For example, a commercial purpose includes the use of the > application within a commercial business or facility or > the use of the product to provide a service, or in support > of service, for which you charge. > Commercial purpose also includes use by any government agency > or organization. > Examples of non-commercial purposes include use > at home for personal correspondence, > use by students for academic activities, > or use by human rights organizations. > > First of all, it sounds like it can only be used by students at > non-government-run universities, but not at Berkeley, and if > Random MIT Student develops PGPwidget using the toolkit, > students at U.C.Berkeley can't use it for academic use either, > except perhaps on their PCs at home (if they live off-campus.) > (Do any of the UK universities count as non-government-run?) You consider use by students at U.C.Berkeley to be use by a "government agency or organization". I don't think that is what is meant. They mean something like the NSA, or Congress, or the military. It would be better if they explicitly explained how public schools were to be dealt with. My guess would be that instructors and staff members would require a license, but that students could use it for free. Probably the best thing to do is to send email to PGP and ask them to issue a clarification. > But "within a commercial business or facility" is far more > restrictive. > I use a laptop for my home and work email, and carry it around. > It sounds like I can't use PGPwidget or PGPsdk for encrypting > personal email at lunchtime when my laptop is at the office, > and perhaps not from a hotel (at least if I'm there on business)? "Within" is probably meant in the organizational sense, not in terms of physical inclusion. The fundamental point is whether revenue generation is involved. Personal email does not generate revenue (arguably reading your personal email at work interferes with generating revenue). > I probably can't start PGPwidget at home and leave it running > when I carry the laptop to work. I probably can't use PGPwidget > when I'm reading my work email at home, though perhaps it's ok > to use it on personal mail that someone sent to my work MSExchange, > assuming it's not a widget that competes with a PGP product. You can't use it to do your work. Your company should buy a copy in that case. Reading your work email counts as part of doing your work. Mostly these seem like reasonable definitions of non-commercial use. But you have identified some gray areas that should be fleshed out. Xcalibur

2 1

Kill -9.9
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Eric Cordian wrote: > In the discussion of the Intel F00FC7C8 problem, it was alleged that > the instruction "unlk a7" will lock up a Motorola 68040 CPU even from > user mode. > Is anyone aware of non-privileged instructions which kill other popular > CPUs, like Alphas, SPARCS, and MIPS? In a world where government agencies using fear of the 'enemy' and bragging about their 'dirty tricks' to gain increasing funding, I am surprised that few seem to realize that many of the 'bugs' are actually 'features,' and that when one finds a true, non-designed bug in major hardware or software, there are certain government agencies which may pay handsomely for the information, depending on the potential and obscurity of the bug. In a world where the value of 'tracking chips' and 'kill switches' on personal automobiles is recognized, does anyone truly believe that government agencies with billions of dollars worth of funding have not recognized and instituted this technology surrupticiously in the same areas where they brag about introducing 'faulty parts' into weapons systems? The government is desperate to maintain their electronic snooping and warfare abilities as Year2000 approaches. Hardware & Software == Intel & MicroSoft == VX-Chip & GAK/GMR The government is using Anti-Trust actions to muscle both computer giants. A million dollar a day assault on MicroSoft, and release of compromising 'bug' information to put the squeeze on Intel. KillMonger

2 1

FREE Downloads on the new RealPlayer 5.0; FREE November Music Madness for RealPlayer Plus users
by RealPlayer News 17 Dec '03

17 Dec '03

RealPlayer just got BETTER and it's FREE Dear RealPlayer User, We are delighted to announce that the beta (preview) version of RealPlayer 5.0 has just been released. The great quality audio you already enjoy in the RealPlayer has gotten even BETTER! The video is LARGER. We have added NEW FEATURES like streaming RealFlash animations and near-CD voice quality at 28.8 kpbs. Best of all, these new features are all ABSOLUTELY FREE! You can upgrade free to the RealPlayer version 5.0 right now simply by visiting: http://www.real.com/50/index.html And there's new content to enjoy at the touch of a button. Whether you want music and videos, or business programming, you can get there faster through new Destinations choices. Like we said, it's all FREE. Download it now! We've also released a new version of /---------------------\ RealPlayer Plus, which ENHANCES the | November Music | RealPlayer, giving you the BEST-QUALITY | Madness by Capitol | RealAudio, RealVideo, and RealFlash. | Records. Hot music | | by cool artists, | RealPlayer Plus delivers these | only for RealPlayer | great benefits: | Plus users. Visit | | the URL below for | - The Best-Quality Live and On-demand | the complete artist | RealAudio, RealVideo, and RealFlash | list and more info. | - Scan for Live Audio and Video Sites \---------------------/ - Presets for Your Favorite Content - 30-day Money Back Guarantee So make your computer the world's COOLEST entertainment center with RealPlayer Plus. Visit: http://www.real.com/50/order.html Maria Cantwell Sr. Vice President RealNetworks, Inc. --------------------------------------------- For information about this e-mail including how to subscribe to or unsubscribe from future announcements, please visit: http://www.real.com/mailinglist/index.html

1 0

Re: WARNING: Serious Pentium Bug
by Anonymous 17 Dec '03

17 Dec '03

"William H. Geiger III" <whgiii(a)invweb.net> wrote: >For the same reason Intel does nothing about any of thier bugs: they are >assholes. The only way any of these type of things are ever addressed is >by enough users putting pressure on Intel to fix their fuckups. (Really >slopy not testing the microcode) Yeah. A conspiracy theorist might be prompted to theorize that Intel deliberately placed this in their processor, took a chance that nobody else would find it and publically release it, and then leaked the information themselves. If they refuse to replace the P5s many people will upgrade to a PPro or a P5. Of course Cyrix and AMD throw a wrench into this theory, but I doubt there are a whole lot of people who won't be buying any more Intel products due to this, and some of the clones have or did have big problems such as annoyingly slow FPUs. If they don't make it extraordinarily easy for me to replace my processor I'll probably be one of the people who falls into the latter catagory and goes off to Cyrixland.

1 0

Key Signing
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Bill Stewart wrote: > > In particular, if you publish the key with your first posting, > then you can demonstrate later that you're the poster who > used that name. Thus, Checkered Daemon announced his nym with > a key, and since I could find no other record of use of that name, > I was willing to sign that key 0x50EC521D as his (I do use > a separate key for signing nyms; I've signed them for a few other > people such as Black Unicorn, some of whom I've since met in person.) > You can also get similar results by posting your key fingerprint > in your messages and sending the key to a keyserver, and it's > a bit more compact, but for a first posting using a nym > it's worthwhile to include the key. Excellent advice, Bill! I am including the key (below) for my new nym, which has not been used before, and would like for people to sign it and send the signed key to the list. This way, people will know by the signature, that it is, indeed: Necessarily Knot, ME - -----BEGIN PGP MESSAGE----- Version: 2.6.2 lQD4AzRmZWoAAAECAMnJrqd/TERCLeFscdgNvwVxrVG4tRm0VThMEXXkctCGMaUD jcETxcV0ZseRUcyUKfqlLd3CRsIwClozlWHHR7EABREAAfwJ5D1Ecilit/Mwsn4N GcWZXWpg3mM6/Epzs2pEhi3I926ZiWPB1DKmdZR4nVemsnwv47SWLJyCnE4sben5 h8oHAQDTFaJDJSN7+9NToOE4NFiruAXXMIHEQ6ZH21oW1sYSiwEA9LmhvfahDVKo 1/CMtxxozAtG8rWycBYVIVrkDKiVgjMBAKeB2VY/f7tzmv7KxUUtN9607+CQlWPp E3HBLTlwtuRAUxC0FU5lY2Vzc2FyaWx5IEtub3R0LCBNRQ== =caeb - -----END PGP MESSAGE----- -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQBVAwUBNGZSSApaM5Vhx0exAQHWcQH/VHc1j8RenSUsPd+UJMCcrPWS5Euu+VVn hD4zGvaJ9irsyh1eKDLbMOUO5dOwxQuOQGDI5rB6cRuoh9ULdQjQyw== =c+x0 -----END PGP SIGNATURE-----

2 1

Re: [patent] Secure electronic message transfer and voting scheme
by ulf＠fitug.de 17 Dec '03

17 Dec '03

>Patent Number: 5682430 >Inventor(s): Kilian, Joseph John{#buSako, Kazue#} The full text is available at <http://patent.womplex.ibm.com>. The novelty in this patent is an algorithm that uses Fiat-Shamir to prove that the mixes operate correctly. The general idea of using non-interactive zero-knowledge proofs to verify that mixes follow the protocol was already published by Rackoff and Simon in 1991, although that is not acknowledged in the patent specification. Does anyone have details about Kilian's patent application on identity escrow, other than the paper at <http://www.princeton.edu/~erez/ident.ps>?

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

In the grand tradition of RSA-in-3-lines-of-perl, we present Crash-A-Pentium-in-44-characters: main(){int i=0xc8c70ff0;void (*f)()=&i;f();} - f00fie

6 6

No Subject
by Mix 17 Dec '03

17 Dec '03

Monday, November 10, 1997 - 04:25:17 MET The following is from http://www.mobil.com/speedpass/ Note that I've only quoted the parts I think are relevent to a security discussion... ---begin quote--- How does Mobil Speedpass work? Speedpass uses an electronic system located in the pump to "talk" with a miniature radio-like device (a transponder). Together, these electronic devices provide "instant" access to gasoline by automatically charging fuel purchases to the credit card you've selected. The technology is similar to the state-of-the-art technology successfully used by many tollways. What happens if my Speedpass is lost, stolen or damaged? Treat it just like a credit card. Immediately notify our Service Center at 1-800-459-2266. Tell us your name or Speedpass number. And we'll cancel your old Speedpass and send you a new one right away. You should write down your Speedpass number (8 digits on tag) and keep it in a safe place. Is there a pin code with my Mobil Speedpass? No. Can other people intercept the transmission of my credit card number? No. The Speedpass system operates on a dedicated transponder identification code. Your credit card code remains outside the Speedpass signal system, maintaining the confidentiality of that information and protecting your account from unauthorized use. ---end quote--- I see several options, none seem too secure: 1) "dedicated transponder identification code" (dtic from now on) is sent in the clear. Anyone who can listen and re-transmit can get free gas. 2) Speedpass and the gas pump negotiate DH key exchange and use DES/RC5/IDEA/Whatever. Anyone who can impersonate a gas pump can gain access to dtics and get free gas. 2) Gas pumps have an RSA keypair, and all of the speedpasses know the public key. The dtic is encrypted to the gas pump's key along with some random data. Anyone who can compromise the gas pump's private key (including service station operators/employees?) can imitate a gas pump and get dtics, with which to get free gas. The third option seems pretty secure at first, until you realize that it's like putting all of your eggs in one basket and giving thousands of people physical access to the basket. Anybody know how they are actualy doing it? Is there some more secure way I haven't thought of? -Some anonymous guy with no 'nym

1 0

Gun Control brings on a new arms race
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Tim May wrote: At the San Francisco Gun Show this past weekend, I watched with great amusement as the San Mateo County Sheriff's Office deputies and Brisbane Police stared in apparent horror as citizen-units loaded up on high-capacity mags, armor-piercing ammo, Class III body armor, and on and on. The cops are stationed at the door, ostensibly to spot gross violations of the law, such as carry of loaded weapons. The cops asked me if I was carrying guns into the show to sell...I just shrugged. Without a warrant, they were helpless to do more than just ask. It was a gas. Gee, sounds like Christmas. Christmas starts earlier every year. Sparticus

1 0

Australian banks using uncracakble IDEA!
by Anonymous 17 Dec '03

17 Dec '03

Conflicting agendas cloud accord on internet trading By John Davidson http://www.afr.com.au/content/971110/inform/inform3.html Banks will lose their shirts; retailers will go bust if the import tax threshold isn't lowered; retailers will go bust if the threshold isn't raised; individuals will be monitored by a person or persons unknown; the Tax Office will kill it first, or maybe it won't. These are just some of the often strange and always contradictory claims heard by the Joint Parliamentary Committee of Public Accounts during the Sydney leg of its inquiry into internet commerce last week. [...] One expert witness, who said he had been involved in the establishment of the internet more than 20 years ago, testified that internet commerce should be banned because the speed and security of the network had barely improved in the last decade. Modem speeds, said Richard Marschall from Marschall Acoustics, were still limited to 9600bps (contrary to the claims of ISPs and modem makers, which offer speeds of around 50kbps) and using the internet was still grossly inefficient compared to putting a disk in the post. Worse, 90 per cent of all internet bandwidth was used to (slowly, one presumes) download pornography. Claims that the internet could be used for serious business were also grossly inflated, he said. Dr Marschall said that any banks that chose to use the internet for commerce would "lose their shirts" because the security of the internet was so poor. The cryptography relied on by banks to scramble data on the public network could readily be cracked, he said, because law enforcement agencies refused to let people use strong versions of the software for fear of it falling into the hands of criminals. (Those Australian banks that offer Web banking sites do, in fact, use a strong form of cryptography known as IDEA, which is thought to be effectively uncrackable.) "The internet (is) an ideal media (sic) for fraud and other unethical practices," he said in his submission. "It is not clear if there is any fix for these problems -- short of pulling the plug and banning internet commerce. Commercial transactions were banned for the first 15 years of the internet's existence for precisely these reasons."

2 1