December 2003 - cypherpunks-legacy

Internet Society: 1999 Board of Trustees Call for Nominations
by John Gilmore 17 Dec '03

17 Dec '03

I'm currently serving a 3-year term on the Board of Trustees of the Internet Society, and have volunteered for the nominations committee. The board is elected by the membership; every year five or six Trustees are elected to three-year staggered terms. I would like to see talented people who care about the future of society serve on the board. I know there are many such among the cypherpunks. If you are willing to serve on the Board, please nominate yourself, or if you know someone who's willing to serve and who you think would be good, please nominate them. Send such nominations to isoc-noms(a)isoc.org. The message below gives all the details. Not everyone nominated will be on the ballot; the nominations committee will winnow it to a list of ten or fifteen people. And among those people, only the top five vote-getters will be elected by the membership. Anyone who the nominations committee doesn't pick for the ballot, can get on it anyway, if they submit a petition from 65 Internet Society members to put their name on the ballot. That's how I got on the ballot when I was elected a few years ago. (IETF is a great place to run around and get people to sign your petition.) Being a Trustee makes you responsible for the acts of the Internet Society. And you get to help decide what those acts will be. It's an unpaid, volunteer job. You get to fly (at your own expense) to the board meetings a few times a year. ISOC has done many good things, like training people in a hundred countries how to set up the first Internet node there. Like publicly stating (in RFC 1984) that it will ignore US export controls when designing worldwide Internet crypto protocols. Like working hard to resolve the mess around domain-name and IP-address administration, and the mess around the "Internet" trademark. ISOC also provides the organizational structure for the IETF and the Internet Architecture Board. ISOC will probably do many more good things -- particularly if it has good people as Trustees! Whether or not you want to be a Trustee, I encourage you to join the Internet Society as a member -- see http://www.isoc.org/isoc/membership/ John Gilmore Message-ID: <3.0.5.32.19981118080715.00927100(a)pop.isoc.org> Date: Wed, 18 Nov 1998 08:07:15 -0500 From: Internet Society <members(a)ISOC.ORG> Subject: 1999 Board of Trustees Call for Nominations 1999 Internet Society Board of Trustees Elections Call for Nominations On 26 February 1999, ballots will be posted for the election of new Internet Society Trustees. Election Day is scheduled for 3 May 1999, when received ballots will be opened and tallied. Internet Society members will be asked to elect FIVE Trustees who will serve three year terms. The role of a Trustee is detailed in the Internet Society By-Laws (not included in this notice but available on the Internet Society web server): http://www.isoc.org/trustees/ This notice is a call from the ISOC Nominations Committee for nominations of candidates for election. Nominations are to be forwarded to this committee via: - electronic mail to: isoc-noms(a)isoc.org or - fax to +1 703 648 9887 or - postal mail to: Internet Society 12020 Sunrise Valley Drive, Suite 210 Reston, VA 20191-3429 U.S.A. Attention: 1999 Nominations Committee Nominations are to reach the committee no later than 17 December 1998 in order to ensure due consideration of the nomination by the committee. Nominations (in the form of agreed nominations, suggestions or volunteers) are to include the name of the nominated individual, contact details and a brief explanation of the basis of the nomination. The committee will confirm with the candidates their willingness to stand for election as a nominated candidate if so selected. Nominees will also be requested to provide the committee with further personal details (in the format of a curriculum vita) as they relate to the selection guidelines that are to be applied by the committee, and provide to the committee a statement indicating their willingness and ability to devote an appropriate level of time to activities associated with the position of Trustee of the Internet Society. It is intended that the committee's selection process will result in 10 candidates for election as nominated candidates. This list will be passed to the Elections Committee on 19 December 1998, as well as informing voting members of the Society of the selected nominees. Additional candidates for election to the Board of Trustees may be nominated by membership petition, filed with the Chair of the Nominating Committee no later than 22 January 1999. A petition for the 1999 election will require the signatures of sixty-five voting ISOC members (1% of the total voting members). Specific details of the petition process will be included in the announcement of nominated candidates on 19 December 1998. Following the closure of the petition period, the list of the nominated and petitioned candidates will be announced 29 January 1999. The Election Committee will mail the ballots out to ISOC voting members on 26 February 1999 and the election date is set to be 3 May 1999. Sincerely, Kees Neggers Chair, ISOC Nominations Committee Kees.Neggers(a)SURFnet.nl tel: +31 302 305 305 fax: +31 302 305 329 ------------------------------------------------------------------------ A. The 1999 ISOC Nominations Committee membership 1. Kees Neggers, Netherlands<Kees.Neggers(a)SURFnet.nl> 2. John Gilmore, US<gnu(a)TOAD.COM> 3. Jun Murai, Japan<jun(a)WIDE.AD.JP> 4. Leni Mayo, Australia<leni(a)moniker.net> 5. Steve Wolff, US<swolff(a)cisco.com> 6. Kim Claffy, US<kc(a)sdsc.edu> 7. Jill Foster, UK<Jill.Foster(a)newcastle.ac.uk> Committee Email address: isoc-noms(a)isoc.org ------------------------------------------------------------------------ B. Nominations Committee Selection Guidelines Candidates for ISOC Trustee should have a demonstrable involvement in the Internet. Such involvement may range from participation as a technology developer, researcher, user, network operator, policy maker (e.g. in government), sponsor of research and development. ISOC is interested in broadly-based representation on the Board of Trustees and seeks to identify candidates from industry, education and non-profit sectors and from government. The selection criteria will be directed to selecting a broad range of interests, and will include criteria of regional location, current activities, relevant experience and professional background. Ten candidates will be selected by this committee, using the criteria as outlined above. ------------------------------------------------------------------------ C. A Profile of the current Board of Trustees "#" marks board positions that are expiring. "&" marks board members who have indicated that they will not or cannot be candidates for re-election. The current membership (as of 1 November, 1998) of the Board of Trustees is as follows: #&Scott Bradner 1993-1999 USA <sob(a)harvard.edu> Vint Cerf 1992-2001 USA <vcerf(a)mci.net> #&Susan Estrada 1993-1999 USA <sestrada(a)aldea.com> #&David Farber 1993-1999 USA <farber(a)cis.upenn.edu> John Gilmore 1997-2000 USA <gnu(a)toad.com> Christian Huitema 1995-2001 France <huitema(a)bellcore.com> Geoff Huston 1992-1995, 1998-2001 Australia <gih(a)telstra.net> Christine Maxwell 1997-2000 France <maxwell(a)chiliad.com> Jun Murai 1997-2000 Japan <jun(a)wide.ad.jp> Kees Neggers 1992-1996, 1998-2001 <Kees.Neggers(a)SURFnet.nl> Tim O'Reilly 1995-2001 USA <tim(a)ora.com> Jose Luis Pardos 1997-2000 Spain <104056.110(a)compuserve.com> #George Sadowsky 1996-1999 USA <george.sadowsky(a)nyu.edu> Ben Segal 1997-2000 Suisse <B.Segal(a)cern.ch> #Vacancy Donald Heath Ex-officio USA <heath(a)isoc.org> ------------------------------------------------------------------------ D. Procedures for Nomination and Election of Trustees 1. Trustee Positions to be Filled The Board of Trustees will advise the Nominating Committee of the number of Trustee positions to be filled by vote of the individual members at each annual election. The Board may also advise the Nominating Committee of its desires with respect to the backgrounds of individuals to be nominated in order to achieve the balance of experience and qualifications required by the provisions of By-Law Article III, Section 2, which provides that "the Board shall seek to have among the Trustees representative individuals from industry, from educational and nonprofit organizations and from government." 1.1 Date of Election The Board of Trustees will annually adopt a timetable for Trustee elections. The election date shall be not less than 40 days prior to the next Annual Meeting of the Society. 1.2 Use of Electronic Mail All communications concerning the nomination and election of Trustees shall be in the form of electronic mail except the ballot, which shall be in the form of first class postal mail or FAX. Members of the Society who are not reachable by electronic mail may participate in the nomination process by postal mail or FAX. 2. Nominating Committee The Board of Trustees will annually appoint a Trustee Nominating Committee. The Nominating Committee will consist of 7 individual members of the Society, 5 of whom shall constitute a valid quorum. The Chair of the Nominating Committee shall be a member of the Board of Trustees. At least 2 members of the Nominating Committee shall be individual members of the Society not currently serving in any elected or appointed capacity in the Society. 2.1 Nominations by Committee The Nominating Committee will notify the members of the Society of the procedures for nominating individuals for election to the Board of Trustees, and will provide a minimum period for receiving nominations of 30 days. The number of individuals nominated shall exceed the number of Trustees to be elected. 2.2 Nominations by Petition The Nominating Committee will notify the voting members of the Society of the names of individuals nominated by the committee for election to the Board of Trustees not less than 105 days prior to the date established for Trustee elections. Additional nominations for election to the Board of Trustees may be made by petition filed with the Chair of the Nominating Committee not less than 75 days prior to the election. Petitions may be filed electronically. The Nominating Committee shall specify the number of signatures of voting members required for petitions, which shall be at least fifty voting members of the Society, or 1% of the total number of voting members of the Society, whichever is greater. 2.3 Candidates for Election The Nominating Committee will provide the names of a completed slate of candidates for election to the Elections Committee not less than 74 days prior to the election date. 3. Elections Committee The Board of Trustees will annually appoint an Elections Committee composed of three voting members of the Society which will be responsible for establishing and supervising elections. The Chair of the committee shall be a Trustee whose term of office does not expire during the year of the election. 3.1 Eligibility to Vote All individual members of the Society in good standing are eligible to vote. An individual member is in good standing if his or her annual dues are not more than 60 days past due on the date of mailing of the ballot. 3.2 Ballot The Trustee election shall be conducted by written ballot of the individual members, which shall be mailed to each member of the Society in good standing not less than 60 days prior to the date of the election. 3.3 Voting Each voting member will be entitled to as many votes as there are Trustee positions to be filled by vote of the members. Votes may be cumulated on behalf of one or more candidates for election. A member may use fewer than the total number of votes available if he or she so chooses. 3.4 Receipt of Ballots All ballots for Trustee elections shall be received by the Chair of the Elections Committee by 5 PM local time on the day prior to the date of the election, at the place established by the Elections Committee for delivery of the ballots. 3.5 Counting of Ballots The counting of ballots will take place on the election date, at a time and place established by the Elections Committee. At least two members of the Elections Committee shall be present at the counting of the ballots. The committee will establish procedures to ensure the privacy, validity and accuracy of all ballots. 3.6 Certification of Vote The Elections Committee shall certify the results of the annual Trustee election to the Board of Trustees within 10 days following the election, forwarding a list of the candidates and the number of votes each candidate has received. 3.7 Challenges No challenge to any Trustee nomination or election procedure or result may be brought except by an individual member in good standing. Any challenge must be addressed to the President of the Society with a recital of the reasons for the challenge, and must be received within 20 days of the election date. The President, after consultation with the Chairs of the Nominating and Elections Committees and the members of the Board of Trustees, shall advise the author of the challenge of the Board's decision, which shall be final, within 40 days of the election date. ------------------------------------------------------------------------ 1999 ISOC Nomination and Trustee Election Committee Timetable November 17, 1998 . Nominations Period Opens December 17, 1998 . Nominations Period Closes December 19, 1999 . Nominations Committee Announcement January 22, 1999 . . Petition Period Closes January 29, 1999 . . Candidate Announcement February 26, 1999 . Ballots Posted March 1, 1999 . . . Election Period Opens May 3, 1999 . . . . Election Date May 3, 1999 . . . . Challenge Period Opens May 13, 1999 . . . . Elections Committee Certifies Result May 23, 1999 . . . . Challenge Period Closes June 12, 1999 . . . . ISOC Response to Challenge Period Closes June 21, 1999 . . . ISOC Board of Trustees Annual General Meeting ------------------------------------------------------------------------ F. Assumption of Office of Elected Trustees The term of office of elected Trustees shall commence at the adjournment of the next Board meeting following the completion of the election process. The term of office for departing Trustees shall end at the adjournment of the next Board meeting following the completion of the election process. The Board meeting is defined as having one agenda, which may extend over several days. The new Board may convene an organizational meeting after the completion of the meeting of the outgoing Board.

1 0

No Subject
by vaneijk59＠sara.nl 17 Dec '03

17 Dec '03

addresses like CompuServe, MCI, ANON's, etc. This causes a tremendous amount of undeliverables. After completion of removal of duplicates and initial filtering we were left with the base of 10 Million addresses worth fine tuning to finish the project. Remember, we are not here to produce the CD with the gad zillion millions that our competitors are so proud to put their names on these days. We ARE here to produce the very BEST CD list as far as quality of addresses go We then ran a program that contained 300+ keywords to remove addresses with vulgarity, profanity, sex-related names, postmaster, webmaster, flamer, abuse, spam, etc., etc. Also eliminated all .EDU, mil, .org, .GOV, Genie, Delphi, GNN, Wow etc. We also filtered out all addresses found in any of our 1300+ domains list. We also filtered out addresses in excess of 30,000 which have proven to be affiliated with anyone found to be opposed to our using direct bulk email as a advertising medium. We have also purged the list to be free of any "web poison" addresses created by those who are opposed to us conducting legitimate business on the internet today. If you do not know what web poisoned addresses are, please look it up now. One list we recently purchased had over 90% poisoned addresses. The "bottom line" here is that you can go out on the world market today and purchase every lists for thousands of dollars and NOT have anymore worth owning than what we have compiled for you here today. You use these addresses, you will experience increased response, increased sales, and a host of other positives that far exceeds any hoped for results when using the competitor's inferior products. Our customers purchase our products over and over and over. Most of the competition ever succeeds is selling a second product to anyone after they purchase the first. So, you see, our list will save people hundreds of dollars buying all others that are out there on CD and otherwise. Using ours will be like using the 200+ million that we started with, but a lot less money and a lot less time!! We have always said, "You can buy from the REST or you can buy from the BEST". Your choice. _____________________________ What others are saying: "I received the CD on Friday evening. Like a kid with a new toy, I immediately started bulking out using the new email addresses. Over the course of the weekend, I emailed out over 500,000 emails and I received less than TWENTY undeliverables!! I am totally satisfied with my purchase!! Thanks Premier!!" Dave Buckley Houston, TX "This list is worth it's weight in gold!! I sent out 100,000 emails for my product and received over 55 orders! Ann Colby New Orleans, LA **************************************** HERE'S THE BOTTOM LINE The CD is comprised of 7 million PREMIUM & SUPER clean addresses -ready for mailing upon receipt of the CD. Each file contains exactly 100,000 email addresses. There are only AOL & Mixed addresses on this CD. You have 50 files of 100,000 each of AOL to equal 5,000,000 addresses. The AOL addresses are less than 6 weeks old and have been collected throughout the production schedule. The remaining files are comprised of General Internet addresses. There are 20 files of 100,000 each, totaling 2,000,000 premium addresses. NO Compuserve! No Delphi! No Genie! No Prodigy! NO Filler Addresses! Simply the Best of the Best!!! >>> ONLY $200.00! This price is effective for the next seven days, thereafter the price will be $299.00 so ORDER NOW! Remember, bottom-line you always get what you pay for! All lists are completely free of any Duplicates. We also on a continual basis, add New Names and Remove Undeliverables and Remove Requests. The result is the Cleanest Email Addresses Available Anywhere to use over and over again, for a FRACTION of the cost that other companies charge. Typical rates for acquiring email lists are from 1cent to as high as 3 cents per email address - that's "INFORMATION HIGHWAY" ROBBERY!. We continually work on our CD. Who knows when those other CDs were made. We're constantly adding and deleting addresses, removes. Etc. It all comes back to quality. Don't even hesitate on this one or you will miss out on the most effective way to market anywhere...PERIOD! If you have any further questions or to place an order, you can call toll free at: 800-600-0343 Ext. 2693 To order our email package, simply print out the EZ ORDER FORM below and fax or mail it to our office today. We accept Visa, Mastercard, AMEX, Checks by Fax. _________________ EZ Order Form _____Yes! I would like to order MILLIONS Vol. 2 email addresses for only $200.00. *Please select one of the following for shipping.. ____I would like to receive my package OVERNIGHT. I'm including $15 for shipping. (outside US add an additional $25 for shipping) ____I would like to receive my package 2 DAY delivery. I'm including $10 for shipping. (outside US add an additional $25 for shipping) DATE_____________________________________________________ NAME____________________________________________________ COMPANY NAME___________________________________________ ADDRESS_________________________________________________ CITY, STATE, ZIP___________________________________________ PHONE NUMBERS__________________________________________ FAX NUMBERS_____________________________________________ EMAIL ADDRESS___________________________________________ TYPE OF CREDIT CARD: ______VISA _____MASTERCARD CREDIT CARD# __________________________________________ EXPIRATION DATE________________________________________ NAME ON CARD___________________________________________ AMOUNT $____________________ (Required) SIGNATURE:x________________________ DATE:x__________________ You may fax your order to us at: 1-212-504-8192 CHECK BY FAX SERVICES! If you would like to fax a check, paste your check below and fax it to our office along with all forms to: 1-212-504-8192 ****************************************************** ***24 HOUR FAX SERVICES*** PLEASE PASTE YOUR CHECK HERE AND FAX IT TO US AT 1-212-504-8192 ******************************************************* If You fax a check, there is no need for you to send the original check. We will draft up a new check, with the exact information from your original check. All checks will be held for bank clearance. (7-10 days) Make payable to: "GD Publishing"

1 0

y2k/gary north delusions
by Martinus Luther 17 Dec '03

17 Dec '03

VNZ quoted Gary North: > Astronomy is a precise science. It can predict > events such as this one with remarkable accuracy. > The astronomers do not know how intense this > shower will be, but they know for certain that tonight > will be the highest density night. Actually they were 10 or 12 hours out - which in Europe at any rate had the effect that the highest density night was't the one predicted :-) But I agree with you. This whole apocalyptic take on the thing is (almost certainly) wrong. (Of course that doesn't mean you shouldn't prepare for it... if you honestly thought that spending a few hundred dollars could save you from a 1% chance of death, you'd probably do it. If the 99% turns out to be true what have you got - a year's supply of baked beans & sardines in tomato sauce) Computers will crash - or rather more seriously applications will produce bad results, this is much more an application problem than an OS problem - in fact things are already going wrong. But it won't happen all in one big bang on the 1st of January. Things will get slowly worse for the next year, the rate of problems will go up, more people will be knocking up quick-and-dirty work-arounds and fewer people working on new projects. North looks at it as a programming problem - but it's not, not when it actually hits, it then becomes ann operations problem. And operators, system programmers & system administrators are used to working with computer systems that don't work. They do it every day. And the peopel who rely on computer systems are used to working when they go down. And if they aren't there are all those middle-aged middle-managers they laid off in the downsizing who can come back and show them how it used to be done. There will be hassle and hard work and very possibly a depression. But there is very, very unlikely to be the kind of catastrophic failure that North seems to long for. And even if it does fall out that way, he's wrong about cities as well. We *know* cities survive a hell of a beating, we saw it again and again in WW2. (Take a look at a picture of Hamburg in August 1943. They rebuilt that. Themselves, starting the day after) The complete physical destruction of the infrastructure of a city does not kill a city. A city is made of *people*, not buildings. People with the skills that make cities work, and people who - just because they are in a city - need to get along to make cities work. If all our big systems go down we will rebuild them. And what's more we'll rebuild them quickest in the big cities, because it's the big cities that have the concentration of people with the skills, and perhaps more importantly, the motivation to rebuild them. (Anyway, despite North, in the event of a complete collapse of business and government probably the worst place to be is the outer suburbs. You need fuel to get around (in the inner cities everything is close by). If there are refugees from cities they have to pass through the suburbs - and there is a lot more to steal there than there is on the open countryside & a lot fewer people to stop you than in the city centres.) *Real* rural life will continue of course, because people have the land and the skills to use it. And becauwse they tend to have stores. I don't know if it would be a very prosperous rural life for most people in the "developed" parts of the world though. I wonder what the sudden withdrawl of pesticides, herbicides, fertiliser, & fuel to fly the crop-sprayer would do to yields on the average American industrial farm? If the year 2000 is half as bad as North says it will be there will be a massive change in the balance of economic power away from North America and towards the so-called Third World. It looks like Gary North isn't really interested in the year 2000 problem. What he is interested in seems to be guns. He's latched on to this issue because it allows him to think and write more about guns. And, like so many other gunwankers he seems to get off fantasising about the total collapse of civil society because that way he gets to feel good about his guns. All this obession with death and destruction is a bit strange in someone rumoured to be a Christian. Of course where I am in London it's all academic. The nearest genuine open country is maybe 150 miles away, in a different nation, on the other side of the Channel. Most of what passes for countyside in the south of England is really exurbia, a sort of huge extended suburbia got up to look rural. Less than one percent of the population actually works on the land. We have more computer programmers than farmers. Most people in London have never even met a farmer. If it all falls over we will just have to put it back up again because there is no-where else to go. Hey, maybe North is right about the USA. Maybe all the programmers will leave town to starve in the country. Maybe the systems will never get fixed. Maybe heavily armed gangs will take over the cities. Maybe you never will rebuild your civilization. I hope not. But if it does turn out that way we'll send you some foreign aid. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

3 2

F.U.D. ... or "The Webmaster of this site is on more than weed"
by Ken Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, I came across a funny article about a "CIA, DEA, FBI, Lucent Technologies, Replay.com, Seed-bank.com Grand Conspiracy" at http://members.tripod.com/~spookbusters/sunnysnooping.htm Made for some interesting reading, and certain aspects of the site do merit discussion/investigation. Regards, Ken Williams Packet Storm Security http://www.Genocide2600.com/~tattooman/ E.H.A.P. Head of Operations http://www.ehap.org/ ehap(a)ehap.org NC State CS Dept http://www.csc.ncsu.edu/ jkwilli2(a)unity.ncsu.edu PGP DSS/DH/RSA Keys http://www4.ncsu.edu/~jkwilli2/pgpkey/ _____________________________________________________________ Get Your Private, Free, Encrypted Email at http://www.nsa.gov -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQEVAwUBNmKwiJDw1ZsNz1IXAQFV/Qf/TJLUEDFq8wJhgO7LLEAbBnwnZHm8jWjm 7J5KquhZXopBzZtTXb/GCitu7Wzo+MZZLi2UrtPysnyEJGgBBAqLN38NShwwS4bT iwd5MyUW37l4Ha4S2rn3HdneVcJlHLn53y9f6xaMDyW1uXbbVtfDEdXCnFXO5In1 URraEyPeNCYvvj5n2gcUeePIK1N+zLHgyRcaaAgjpVWFo6/lV/51YuLbWtC7obqS J76Ixeu1qbLV9LiYq4BsiBB8E+AemZ3Cq8U/8L1zjiUNxj5APgVG3QlNV1jjdO9H t/8c0s602IcVJJYMZhhBs4eCNvIi1dpi5Hn7VeUxsKnANm8OwJm6Fg== =GUk5 -----END PGP SIGNATURE-----

1 0

more FUD!
by Ken Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Interesting FUD-related thread on my message board that is tied in to the mail i just sent... http://www.genocide2600.com/~tattooman/wb/messages/1011.html Regards, Ken Williams Packet Storm Security http://www.Genocide2600.com/~tattooman/ E.H.A.P. Head of Operations http://www.ehap.org/ ehap(a)ehap.org NC State CS Dept http://www.csc.ncsu.edu/ jkwilli2(a)unity.ncsu.edu PGP DSS/DH/RSA Keys http://www4.ncsu.edu/~jkwilli2/pgpkey/ _____________________________________________________________ Get Your Private, Free, Encrypted Email at http://www.nsa.gov -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQEVAwUBNmKxg5Dw1ZsNz1IXAQFkfggAxXMR36cFDQj7drU1u2mqOrNyxIl9Ao0t SwqmoRApPwZgfnS9AG4OvVFj4DZ/vcU0YQp+lNFdlJmP/xI4CpSN+8iKS03avYdD IlasuNLV26bICpqy4cZvux1bZl2W3aaKyfPhK6nA27E83C+O3itiihqkPj/BW91Y jgCF9acVGp/axdGqjtevxXEn2cF7jqR3XzekNTtYjOj1kKhTcto9B6eZzlFu1xBy RHQa95t6SeIKsmXaEbAK0J+ztn5YomuLTT1knlZg0z3myCQ/FOuyy9/DPIU99ijv mSaGoByccUH72/H0pTyUHhmSMYAW2tTQyWqJdKnHwMGcn7V5INa1Jg== =EwZu -----END PGP SIGNATURE-----

1 0

custom protocol = job security
by Anonymous 17 Dec '03

17 Dec '03

At 08:54 AM 11/30/98 -0600, Brown, R Ken wrote: >> Dianelos Georgoudis[SMTP:dianelos@tecapro.com] described a security system > >If I was a bank I would be very wary of proposals like "We would write our >own transmission protocol. " That seems to introduce yet more complexity, custom protocol = job security

1 0

Re: F.U.D. ... or "The Webmaster of this site is on more than weed"
by Anonymous 17 Dec '03

17 Dec '03

Ken Williams writes: > I came across a funny article about a "CIA, DEA, FBI, Lucent > Technologies, Replay.com, Seed-bank.com Grand Conspiracy" at > http://members.tripod.com/~spookbusters/sunnysnooping.htm This is a critique of an article describing a way to do anonymous email and how to use remailers. The original article proposed using the Lucent privacy proxy at www.lpwa.com as an intermediary to a free email server like hotmail. The critique got all hot and bothered over the fact that Lucent is a government contractor and so the original post must have been a plant by the FBI. In fact, the LPWA-Hotmail technique is suitable for moderately secure anonymity but not for lawbreaking. This poster has used the technique occasionally for over a year. It is certainly better than hotmail alone, since hotmail includes the originating IP address in its outgoing email. By using LPWA, the originating IP field holds the LPWA IP address, and the actual originating IP address is not revealed. However, as LPWA clearly states in their privacy policy (http://lpwa.com:8000/policy.html) they keep logs of connections, and will make those available to law enforcement if presented with a court order. This would make it possible to track down the originating IP which sent the mail. Despite its limitations, this technique has the advantages of ease of use and moderate security. All you have to do is to set the lpwa.com proxy in your browser, and use hotmail for email. You can both send and receive email, which is hard to do with any other technique. It is comparable in security and convenience to the late anon.penet.fi server, which did much to increase awareness of anonymity technologies on the net. (The original article was titled "Quick and Dirty Anonymity", which seems an accurate enough description.)

1 0

Re: "Export" controls
by Michael Motyka 17 Dec '03

17 Dec '03

> Export farce is just a neat way of scaring companies and individual > contributors from developing and providing cryptographic systems > within US. > 100% accurate, but old, conclusions. > Anyone providing domestic crypto runs the risk of violating EARs. > Manufacturers are ultimately responsible when their products end up > overseas... > Can you give me an example of a commercial vendor who has suffered because someone bought a "dangerous" product ( Windows, for example ) at retail and carried it out of the country in a suitcase? My guess would be that anything sold at retail would pose no problem for the manufacturer unless domestic regulations were in place. Even then the retailer is the first in line for questioning. > [ For example, try to buy one of IBM crypto-cards - give them a call > and ask what does it take to purchase one with hard crypto on it > Save me the phone call and describe your experience. BTW - IBM derives a large portion of its revenues from government contracts. They would be pretty easy to convince. An non-dependant might be different. > Would a US citizen have to produce ID in order to buy ? > Not until there are domestic regulations. Except for firearms, cigarettes, alcohol and prescription drugs I can't think of any. My guess would be that start-up manufacturers could get their tails twisted long before the retail shelf: Personal Audits Business Audits Supplier problems ( caused by similar techniques being threatened or applied ) FCC EMI Test Delays and Failures Credit Problems Lots of Traffic Tickets for everyone. It could be fun to try an embedded product. Make some development kits then try to license it. Let a manufacturer with some resources handle the heavy lifting. If you have trouble with that give 'em the bird - just write a damn book, source, VHDL etc. You can even export that. My favorites are: Secure phone - I know it exists already but still fun Disk encryptor - SCSI/EIDE, a bump in the wire between the motherboard and the disk drive. With its own smartcard/keypad interface, keys are never seen by OS. It doesn't solve the security problem while the system is on but it sure as hell makes the disk useless to opponents once it has been shut off. Good storage. Effectively shredded if you destroy the smart card or forget the key. The proper way to keep your data as long as the courts respect the Fifth Amendment. Oh well, Mike

1 0

Re: Securing data in memory (was "Locking physical memory (fwd)
by lcs Mixmaster Remailer 17 Dec '03

17 Dec '03

Bill Stewart wrote: > Back in the mid-80s, Princeton University got some SDI money for the > Massive Memory Machine Project, researching what you could do if > you had enough memory for anything you wanted. Even with the > CS approaches of the time, you'd do a lot of things differently. > Their non-massive toy machine was a 1.5MIPS VAX with 128MB RAM - > which took 10 extension racks to hold all the RAM. > These days 128MB is cheap, as are 500 MIPS P2s, but 50GB of RAM > is still bigger than most machines' busses will hold, > and even 2GB of DRAM is a lot bigger and more power-hungry than > most laptops can really support, much less 2GB of fast SRAM. There used to be a rule of thumb that you'd want roughly a megabyte per megahertz. Today, with our 200+ MHz processors, we tend to have considerably less memory than this. My Gateway PC from a couple of years ago came with a 200 MHz Pentium Pro but only 32 MB of memory. Most PCs today are not well balanced architecturally. They should really have a couple hundred megabytes of memory. Memory is cheap enough today that this can be added, but the motherboard configuration may limit the amount. If you had this much memory, swapping to disk would be a smaller problem. As for the idea of running without a disk drive, see the handheld PDAs like the PalmPilot and the Microsoft WinCE machines. The problem with these from the security standpoint is that the memory is non-volatile. With a PC, we don't worry too much about junk in memory because we turn it off occasionally. We are concerned about the disk because that is where the persistent storage is. But with a memory-only machine, you end up using your memory as a de-facto disk drive, so that the contents of memory become just as sensitive as the contents of disk would be on a PC. Someone who gets hold of your PDA can dump out memory and find sensitive data which is stored there. Theoretically you can use a password to protect data, but then there are tradeoffs between security and ease of use, and you may end up leaving data exposed for extended periods. But speaking of using passwords to protect data, how about an encrypted swapfile for a PC? There are fast enough ciphers today that the virtual memory system could encrypt data as it swaps to the disk, and decrypt as it loads back into memory. You'd type in the passphrase at boot time. This would solve the problem of sensitive data leaking onto the disk via the swapfile. There could still be traces in memory, but at least this most obvious leak would be plugged. You don't have to wait for apps to be rewritten to use secure memory allocation drivers, you get the benefit immediately. Can existing encrypting-filesystem drivers be used for swapfiles?

4 3

Re: y2k+oil refineries
by Anonymous 17 Dec '03

17 Dec '03

North's "scrap the refinery, the chip broke" scenario was forwarded to comp.software.year-2000 by Paul Milne, resident doomsayer, foul-mouthed religious fanatic, economic Marxist, and all around kook. It prompted a very knowledgable reply which pointed out how silly the whole idea was, from someone with relevant experience. Maybe next time Detweiler could check c.s.y2k to filter out North's nuttier ideas before forwarding them here. Author: SAG Email: stephen.and.marilyn.goldstein(a)worldnet.att.net Date: 1998/12/01 fedinfo(a)halifax.com wrote: > > From GN: > > Category: > Noncompliant_Chips > Date: > 1998-11-30 13:28:22 > Subject: > Fuel Production Plants > > * * * * * * * * > > I have one very, very reliable source within that industry who tells me that > the oil refining industry can't cope with the task. I am told that the problem > of embedded systems can NOT be fixed EVER, no matter how much time were > allowed. WHY? Because the refineries themselves would have to be dismantled to > uncover these embedded systems. Essentially, the refineries would have to be > destroyed and rebuilt!!! These embedded systems are buried within enclosed > systems. Identifying, testing and replacing these systems is too impractical. > It is financially unsound to do so. The better option is to build new ones. > There is no time to do this with less than 400 days left and the time to build > a new refinery is 3 to 5 years. > > So, what does this mean? My sources, especially the most reliable source tell > me that it means that on January 1, 2000... the oil and gas refineries will > cease operations. These facilities also have converted their inventory > management control systems to small inventory levels so that inventory levels > are running about 1 to 2 days capacity. A few years ago, the industry averaged > a 1 to 6 month supply in storage tanks. Not so today. > > The results: By 1/5/2000 there will be no gasoline, no diesel fuel, no > natural gas, no heating oil, no fuel oil products at all. This means trains > will have no fuel. Trucks will have no fuel. Cars will have no fuel. Electric > Power Plants will have no oil for fuel, nor coal... because there will be no > fuel to power the vehicles to get it to them. So, there will be no > electricity. And you know the remaining domino schematic from that point. > > ====== > > I have no way of knowing whether the embedded systems are just that, embedded > in such a way that they can not be accessed. I imagine that some could be > under fifty feet of concrete or otherwise inaccessable. If this is so, then > there is not the slightest doubt at all, that it is indeed all over. Period. > > I am not going to bandy about the issue of whether this source is reliable or > not. It makes no difference. The only thing I am concerned with is whether > these systems are in fact inaccessable. I know that not every system is > inaccessable. The question is whether there are enough inaccessable systems to > mean that the refineries etc. will not function. > > Of course, I would love to hear someone counter this with evidence showing > that what has been related above is not true, or it is an urban myth etc. > But, I would like 'evidence'. Not conjecture or inuendo or suppositions. > > If it were so, that there were indeed these inaccessable systems, would the > companies involved let it be known publically? I think not. > > If this report is accurate, the remediation is 100% moot as I have said all > along, and you can kiss your butt good-bye. I'm not sure if I want to play this game Mr. Milne -- you offer this article which is, conjecture, innuendo and supposition but demand that any counter story be documented by "evidence." That's pretty tough and, frankly, I'm not up to the task as my knowledge is with electric power plants -- not oil refineries. They do, of course, share some important characteristics and so I'll give it a try. The approach will be from two perspectives -- first, I'll explain some power plant construction practices that contradict the refinery story; second, I'll offer another review of the nature of the "embedded" systems that might be at issue. Power Plant (and refinery) construction . . . . Remember, power plants and refineries are: o Capital intensive o Make increased use of computerized process control systems o Operate a continuous manufacturing/conversion process employing high temperatures and pressures. Typical design life of a coal-fired power plant is 40 years. During that period, any number of components *will* fail and *will have to be replaced.* Wouldn't make much sense to put a $500million investment at risk 'cause a $20.00 part failed in some inaccessible location. Thus EVERYTHING is accessible. You want evidence and I'm not about to take you on a power plant tour but even if you've never been inside a power plant the construction practice is similar to that found in many other industrial settings and, if you've ever been aboard a naval vessel or taken a cruise, ships. These settings are nothing like your home (or even an office) with all the infrastructure components nicely hidden behind walls -- pipes are exposed and clearly labeled -- power and control cables are laid in exposed cable trays and risers. Electronic components are often mounted in racks with easy access from front and back -- probably not at all like your computer or home theatre configuration. All this is to PERMIT MAINTENANCE, REPAIR and MODIFICATION. So you need to understand that the problem isn't just maintenance, in general, or for y2k. Process plants need to be modified frequently -- market conditions demand a change in inputs or outputs. Can't get enough sweet crude? Exxon doesn't close the refinery -- they modify it to handle the new feedstock (I got the grand tour from a fellow I knew who worked at Exxon's Baton Rouge refinery, years ago). Want some pictures? Here are a few from several "continuous process" industries: http://www.powerprocesspiping.com/, http://www.bdmechanical.com/ppiping.htm, http://silverweb.nf.ca/m&m/cb-p&p.htm, and http://www.shambaugh.com/process.htm. Now consider the nature of these embedded components. This has been the subject of much discussion in csy2k. I'd like to suggest that there are three broad categories of components in this context: o The control system(s) -- SCADA -- one or more intelligent nodes build on traditional minicomputer, or more recently, microprocessor-based server technology. These are very accessible -- they're in, adjacent to, or very near, the control room. In an even more modern "distributed control system," some of the capability will be located in different areas of the plant. Nevertheless, they still have to be very accessible -- stuff breaks -- memories get hard, multibit errors, disk drives fail, etc. o Remote devices -- the control systems can't run without data and so you have dozens to thousands of remotes -- devices that measure process parameters (temperature, pressure, mass flow, volumetric flow, acceleration and mechanical position (valve position or tank levels)) and a smaller number of remotes that can act on SCADA commands (start a motor, open a valve, etc.) Though most of these devices are pretty dumb, some may have a bit of silicon-based intelligence and therefore susceptible to y2k problems. BUT, they all have to be accessible because 1) they malfunction or need to be recalibrated and 2) plant modifications often require removal/replacement to accommodate process changes. o Embedded systems -- I think that the consensus is that the real embedded systems are those systems that are not obviously run by a computer -- the power plants water chemistry analyzer or the refineries gas chromatograph. These are on the site but they're not in the "plant" -- they're in the lab -- very accessible. Now "accessible" doesn't always mean you can walk right up and touch it! Guess where the flue gas monitoring remotes (temperature, opacity) are located -- top of the boiler or in the stack. But here's the scenario -- opacity indicator increases (flue gas has more smoke in it) but the stack gas "looks" clear. Do you shut down the plan on environment limits or do you send a maintenance man to replace the remote? Now is it possible that conditions would be different at an oil refinery. Sure, like I wrote at the beginning, I'm not really familar with these. But, really, we'd be looking at some obtuse examples -- imagine that rather than using a tank level indicator to see how much gasoline is in a tank, someone came up with the bright idea of putting a strain gauge *under* the tank and determing the amount of product in the tank but computing the weight on the gauge and using that to compute the amount of product. The device fails and, we'll all agree, it is not practical to replace it. Does the refinery stop using the tank? I wouldn't think so. They retrofit a traditional tank level indicator (float) to provide the needed information. HTH, SAG

2 1