December 2003 - cypherpunks-legacy

No Subject
by Mix 17 Dec '03

17 Dec '03

The main difference between Timothy May and shit is that shit smells better. \o _o o o \o |o |o >> /\/ o__ _o o/ Timothy May | | /| |\ | / /|/ \|o o\ | \ \ | | | << << << | << < \

2 1

EU Rejects GAK
by John Young 17 Dec '03

17 Dec '03

9 October 1997 Source: The New York Times, October 9, 1997, p. D4 Europeans Reject U.S. Plan On Electronic Cryptography Threats to Privacy and Commerce Are Cited By Edmund L. Andrews Frankfurt, Oct. 8 -- The European Commission has rejected proposals by the United States aimed at insuring that police agencies can crack coded messages over telephone and computer networks. In a lengthy report released today, the European Commission said the American approach could threaten privacy and stifle the growth of electronic commerce and that it might simply be ineffective. The report appears to all but doom efforts by the Clinton Administration and the Federal Bureau of Investigation to establish a global system in which people who use cryptography would have to deposit a "key" for unlocking their codes with an independent outside organization. As envisioned, the police or intelligence agents would be able to use this key once they got court approval to carry out a wiretap. The plan has been vigorously opposed by the computer industry, which fears that it would jeopardize sales to foreign customers. Because of the Internet's borderless nature, American officials have long acknowledged that their plan is workable only if most other countries adopt similar systems. If not, people could simply route their communications through countries with no restrictions. The White House had already run into heavy opposition from civil rights groups, the computer industry and Congressional Republicans. And earlier this year, the United States failed to muster any support for its plan from the Organization for Economic Cooperation and Development, a consortium backed by more than 40 countries. But the European Commission's blunt opposition, reported today in The Wall Street Journal, went considerably further, raising a slew of objections to "key recovery" and "key escrow," systems. Among them were these: + Hackers could find new ways to breach security." Inevitably, any key access scheme introduces additional ways to break into a cryptographic system," the report said. + The systems could weaken European data-privacy laws. "Any regulation hindering the use of encryption products," the report said, "hinders the secure and free flow of personal information." + Even with a "key escrow" or "key recovery" system, criminals cannot be entirely prevented from using strong encryption. More broadly, the European Commission said, any kind of key-based system could jeopardize the rise of electronic commerce. "If citizens and companies have to fear that their communication and transactions are monitored with the help of key access or similar schemes," the report said, "they may prefer remaining in the anonymous off-line world." American officials did not disguise their disappointment, and challenged the Europeans to come up with better alternatives. "I am a little surprised," said William Reinsch, Deputy Secretary of Commerce in charge of export administration. "My question to the European Commission is, where do they think the market is going? Our sense is that corporations engaged in electronic commerce want key recovery in some form, because they want to recover their own records and to monitor their own employees." Beyond high-minded policy issues, European officials quietly acknowledge that they have political and economic concerns. For one thing, several countries do not like the idea of deferring to an American system that might allow American companies to dominate the next generation of security products. The German Government, meanwhile, is worried that American authorities might have improper access to data on German users -- possibly violating Germany's tough new laws on data protection. But the European Union is far from united. Britain has generally sided with the United States in supporting an international system for regulating data encryption. Indeed, the European Commission remained vague about what alternatives to the American system it might actually favor, nor does the report attempt to block member countries from setting up key-based systems if they want to. American computer and software companies greeted the European policy declaration as a victory. "Even the hard-line Governments, the U.S. and the United Kingdom, have said that any cryptography restrictions have to be internationally coordinated because otherwise you can just download material from another country," said Chris Kuner, a lawyer in Frankfurt who represents Netscape Communications and other networking companies in Europe. "This shows that Europe does not agree with the idea of mandatory key recovery. This idea that is the only possible regulatory framework for the world has been clearly rejected." [End]

2 2

Re: 6502 ML programming (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 9 Oct 1997 02:32:27 -0400 > From: ghio(a)temp0133.myriad.ml.org (Matthew Ghio) > Subject: Re: 6502 ML programming > Jim Choate <ravage(a)ssz.com> wrote: > > > > There in no 'DATA' construct in 6502 assembly. > > > > This is some sort of macro that either the assembler or programmer > > defined. All official Rockwell/Commodore [1] 6502 assembly mnemonics are > > three letter. > > True, but most assemblers would let you insert static data into the object > file using various pseudo-ops like that. > > > > Idealy a jump table was created that had the various target addresses for > > your routines. > > Oh, those were fun to debug too... > > > > The most efficient way to store data in 6502 is to put it in the first 256 > > bytes of ram, then it could be called in no more than 2 clock cycles. > > Actually that took three cycles. One to fetch the opcode, one to fetch the > target address, and one to fetch the data byte. If you wanted to do it in > two cycles, you had to write the data into the operand of the instruction > that loaded it (self-modifying code). Wow, we actualy agree on all points...that has to be a first. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Component-based Commerce: CCS Lunch Talk Friday, October 17
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 9 Oct 1997 08:22:11 -0400 (EDT) From: Chris Wysopal <cwysopal(a)skywriting.com> To: dcsb(a)ai.mit.edu Subject: Component-based Commerce: CCS Lunch Talk Friday, October 17 MIME-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: Chris Wysopal <cwysopal(a)skywriting.com> From: Roanne Neuwirth [SMTP:roanne@MIT.EDU] Sent: Wednesday, October 08, 1997 10:27 AM To: ccs-lunch(a)MIT.EDU Subject: Component-based Commerce: CCS Lunch Talk Friday, October 17 Greetings! This is to announce a CCS Lunch Talk, Friday, October 17, from 12-1:30 pm in E40-170. Bring your lunch and join us for an interesting session. We are pleased to welcome Jay M. Tenenbaum, Chairman of CommerceNet to CCS. He will speak on component-based commerce and an exciting new project. See you there!! Component-based Commerce Jay M. Tenenbaum Chairman, CommerceNet Digital anarchy is threatening the explosive growth of Internet commerce. Proprietary applications and platforms cannot communicate above the level of browsers. Websites are difficult to locate and incomprehensible to software agents. Such limitations prevent online businesses from leveraging each other's services, resulting in closed markets and trading communities. In response, CommerceNet has launched an ambitious object-oriented interoperability framework initiative called eCo System. eCo treats all commerce services on the Web as business objects. It provides the infrastructure (a Common Business Language, standardized metadata and middleware) for combining them in novel ways to build virtual companies, markets, and trading communities. eCo complements commercial ecommerce platforms, enabling them to communicate with one another, thus expanding the market for all. eCo System promises to transform the Internet into a massive economy of online services, all linked through a common framework. Companies will be able to encapsulate their services (e.g., shipping, banking) as eCo objects, that customers can seemlessly integrate into their own business processes. Entrepreneurs will be able to create innovative value-added services that compare, aggregate, integrate, and translate data across companies -- finding the best price or the closest supplier for example. This potential for instant partnering and for rapidly experimenting with new business concepts could spark an explosion of entrepreneurial activity rivaling that of the web itself. Based on market analyses by Forrester and IDC, CommerceNet projects a $1 Billion market for eCo-enabled Internet commerce building blocks and tools by the year 2000. The Internet commerce transactions enabled by these components could exceed $100 Billion. The talk will cover eCo System from both a technology and business perspective. Dr. Jay M. Tenenbaum (BS MIT '64; Ph.D. Stanford '71) is widely acknowledged as a founder of Internet commerce and its leading visionary. In 1990 he started EIT, the company that pioneered the enabling security and payment infrastructure. In 1994 he formed CommerceNet, the leading industry association for Internet commerce with nearly 600 corporate members worldwide. Dr. Tenenbaum has been a consulting Professor of Computer Science at Stanford University and currently serves on the boards of six Internet start ups. For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

ANY OF YOUR ANSWERS YES?
by endeavor＠bizmax.com 17 Dec '03

17 Dec '03

Hello, I read your profile and thought that the following would be of interest to you. You are not on a mailing list so if this does not interest you there is no need to reply. Any of Your Answers Yes? Want to: >Legally slash your business/personal taxes drastically? >Protect any & all assets from any form of judgement? >Learn how to preserve your personal privacy? >Create a 6 figure income in the next 4-6 months? Any of Your Answers No? >Do you know how to make your "nest egg" work 3-5 times harder for you? >Do you know how to set up off shore trusts and protect your owned property from liens & levies? >Can you legally shelter all assets from all Taxes? Find out more and learn how to accomplish all of these by calling: 1-800-497-1799 (24 hr. recorded message)

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Anonymous wrote: >> (untransferable signatures) > >This is also a good idea, but it needs more work, too. There is a >big education problem here. People barely understand the >implications of regular digital signatures. Now you are throwing >this new kind in, which guarantee the message came from another >person, but aren't binding. What happens when an employee receives a >message from a supplier signed with that kind of signature? Can he >make a decision on that basis, or not? > >In paper business correspondence, there is no such distinction. A >signed letter is transferable. Go beyond this and business will be >scratching its heads. It's a solution looking for a problem. How about arbitration? Two parties may wish to make an agreement to be judged by an arbitrator of their choosing. In certain cases, the State can be expected to intervene. If only the arbitrator knows the signatures to be valid, the State has no fair basis on which to make an intervention. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND5vYpaWtjSmRH/5AQGzygf/TdMgevKLw87e6ZtJ6++pyrOKliu/OunT Z4uxcWzDGPEcyNchhOsb6B+NSOehcgvqIhxs4NNTJqMVICiJCBhBTZlsQt7bW6kq Ayz62YWFZZeMcYbsP87FmuGLxsyh/wW2Nh/s80J9obS6vn7HQJBUp/Ox7Ho9RPIp bdijOAw6nxtPt0SWcr38F8XVj/XpqA768nn5uWwdtd2aCAIQf7uLE7poZLVL7+UQ VMiHlgsRIlcHEakNbCExrBTuyCzyoKo5LY+PPzlLCTC93rzXyPIdO8Ain6p49qa5 i/7z+WbT8powUsmwj5BEfPSKOo1CcuHfdAUgeSI4JawfhqYJAnzpRg== =m09K -----END PGP SIGNATURE-----

2 1

Free Email Software!
by webtech＠lostvegas.com 17 Dec '03

17 Dec '03

////////////////////////////////////////////////////////////////////////// Advertising Secrets Exposed ! Are you having a difficult time trying to promote your business on the Internet? Have you posted classified ads with little or no response? Well, if you'd like to know something that you could use with your present business to make it Explode! I have the answer to your business growth problems. Free Email Software! Everybody's talking about Email Marketing! A gold mine for those who can take advantage of mass Email Marketing. Just imagine for a minute what this will mean to your business, being able to reach thousands of new propects daily, with no cost to you. We will give you a new software package called Freedom, absolutely Free, to use in your business. Now you will have, a do it yourself method of online advertising, that up till now only the professional Internet Marketer had access to. And have a powerful potential to target millions with simple click of your mouse. And if you need fresh Email addresses, we have them on, 3.5 IBM disk. The best prices on the Internet. 100,000 Addresses Oppty Seekers Only $29.95 Includes shipping and handling. 200,000 Addresses Oppty Seekers Only $39.95 Includes shipping and handling. 400,000 Addresses Oppty Seekers Only $49.95 Includes shipping and handling. And for the serious Internet Marketer, 25 million plus!! Our company has one of the largests databases on the Internet with over 25 million Email Addresses, these are split up in many different categories, and rotated frequently, giving you new addresses to choose from each time. This service allows you to access our database of Email Addresses as much as you want, from our website. All for only $199. No need to ever gather or purchase Email addresses again!! But because of our special internet promotion for the month of August only, you can purchase our E-Mail software program including 25 Million E-Mail addresses, and including full time tech support, telephone number, for only $99. for all orders received before Oct20/97 PRINT AND FILL OUT ORDER FORM BELOW Yes! Please Rush Me Fresh Email Addresses, And My FREE Email Software. Name______________________________________________________ Address____________________________________________________ City_________________________________State__________________ Zip____________________________Email________________________ Types Of Addresses Opportunity Seekers ( ) General ( ) 100,000 Addresses $29.95 Includes shipping&handling and Freedom Software. 200,000 Addresses $39.95 Includes shipping&handling and Freedom Software. 400,000 Addresses $49.95 Includes shipping$handling and Freedom Software. 25Million Addresses$99. From database Includes S&H and Freedom Software. And full time tech support, by telephone, for all orders received by Oct15/97 Freedom Software Only. Send $10. To cover S&H. IBM 3.5 Floppy disk. Bonus: Orders received before, Oct20/97 will receive another Software program Free, called "CHECKER" that allows you to receive checks by Fax, Email, and Phone. Sold over the Internet for $129. Free with your purchase of any or the above products! Never lose another impulse sale again, for lack of, a credit card, or the slowness of US mail. Plus another bonus for MLMERS, not only are we going to give "CHECKER" and FREEDOM to you, we will authorize you to give "FREEDOM and "CHECKER" to your entire Downline, to use " FREE" Just think what this will mean to your business, when you are able to give "FREEDOM" and "CHECKER" to your entire Downline to use, for Free, or use for an incentive for new recruits. Payment: Check ( ) Money Order ( ) Cashier's CK ( ) Other ( ) U.S Funds Send Order Form Along With Payment: To REV TECH MARKETING 2172 Kanoy ave Thomasville N.C 27360-8733 U.S.A. If you'd prefer not to receive any future mailings, just send an empty email to etech(a)ascella.net with remove me in the subject line. Mail End.

1 0

Re: anonymous poster quality up
by jimg＠mentat.com 17 Dec '03

17 Dec '03

Tim May wrote: > - --Tim May (I'll sign this with my new PGP 5.0 key, which has also been > signed with my 1992 PGP 2.0 key) So what <is> your new PGP 5.0 public key? I checked for the key ID 0xDF02DF6A on the key server at www.pgp.com and didn't see it. I <do> believe your claim that it's a 5.0 key, though, since it ends in the even nibble 'A', and all RSA key IDs are odd. :) Jim Gillogly jim(a)acm.org

1 0

Object code disassembly (was Re: [LONG, off-topic]] Interactive Programming)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

> It worked. After a few iterations of this I had all the entry points, and > everything that didn't disassemble cleanly was outputted as hex data. > > For fun, run objdump on a cleanly compiled unix binary... It makes it all > look so easy... :) Not quite that easy. Awhile back I disassembled RealAudio because I was curious how their codec worked. Turns out it was not all that interesting and the codecs in nautilus and speak freely are probably better. But anyway.... Running objdump on the binary spit out ~800000 lines of code. They statically linked the whole thing, motif, c library, and all. I'm not sure what they compiled it with, the c-library they had in there didn't look like any of the standard ones. It disassembled fine, but 800k lines of assembler dump is not really all that readable. So I ended up doing it interactively, setting breakpoints on the I/O operations and backtracing to find the coder. The user interface code tended to get in the way a lot. The 1kb/s coder is very basic. No predictor/corrector, and no redundancy (eg lempel-ziv, rle) compression at all. It's just a frequency/band coder at 10 frames per second. I guess thats so it can handle dropped frames. No checksums at all. The "28.8" codec is more sophisticated. It appears to be a LPC and compresses data into much larger blocks/packets. I didn't look into it too deeply because there are lots of other lpc coders available. Shortly after this, they put out a new version 3.0, with yet another codec, which I never looked at. This was quite awhile ago, and all this is from memory. So the codec was rather uninteresting, but there were a number of other "features" which got my attention. I looked at the network protocol. Its pretty simple. The client connects to the server and requests the file it wants. It also sends a whole bunch of other info, like host operating system, version number, etc. ("for statistical purposes, right? uh huh..." are you guys over there at anonymizer.com reading this? hint, hint.) Then it does something truly bizarre. The client and server exchange 32-digit hex numbers. The client calls gettimeofday() and gethostname() and uses this as a random seed. Then it sends a 128-bit random number, encoded as 32 ascii hex digits. The server does the same. I haven't a clue what this is for. Considering that the other data structures are all binary, sending this as ascii is really dumb. It looks as though its part of some third-party library. I thought maybe it was some variant of netscape cookies but it doesn't save anything to disk. It's just wierd. I tried stepping through this section of code a few times, but doing so usually caused the server to time-out. Then the server starts sending the audio file as one big stream of packets - same format as the files it saves to disk, just broken up into packets, each preceeded by a length byte. In udp mode the client sends acks every second or so. In tcp mode there are no in-band acks at all, it relies solely on the tcp protocol driver. No checksums on anything, and it uses predictable port numbers. You can probably spoof it real easy. That might make for an interesting prank.

1 0

Re: What's really in PGP 5.5?
by Anonymous 17 Dec '03

17 Dec '03

The danger with the PGP system is that it could be easily perverted into a British style trusted-third-party system for GAK. The government would set up a key management infrastructure to provide an official repository and CA to register keys. It could even be "voluntary" if only government-approved CAs had liability protection which private CAs didn't have, making it hard for the privates to compete. However the price to use the government registry is that each key has to use the PGP features to specify a TTP as an additional recipient. Every message encrypted to that key should also be encrypted to the TTP key. Only government-approved TTPs may be used, and although there are many to choose from, all have to provide easy and secret GAK. The PGP 5 software will then automatically encrypt to the TTP key. Yes, this can be defeated using superencryption or faking the additional-recipient block in the message. But we know any scheme can be defeated. It still satisfies the government's requirement to get routine access to most email communications, and to allow criminals who use standard email packages to be watched.

1 0