April 2003 - cypherpunks-legacy

Re: Thanks for the living hell, and question about OpenSSL
by Major Variola (ret) 25 Apr '03

25 Apr '03

At 02:20 PM 4/25/03 -0400, someone claiming to be Patrick Chkoreff wrote: I was mistakenly thinking that because my sacred code did not >in fact record any IP-based transmission logs, users were safe as far >as anonymity and privacy were concerned. What I missed was that if >someone put a gun to my head Generally in security analysis you want to list threat models and how you resist (or not) them. >From this you can derive a spec. Often threats *not* considered provide easy attacks simply because the design didn't consider them. You will always find some attacks that will work, but are expensive for the adversary. Checked your keyboard for keystroke loggers recently, Mr. Scarfo? Swept your room for video bugs? Got a guy with a gun and a dog watching what gets pressed against the fingerprint scanner? And how much does he get paid? (CIA CI chief Aldritch was under $2e6, FBI CI mole Hanssen was cheaper, but his wife wasn't included in the deal, though his stripper got some.) This leads to the conclusion that security is economics + physics. The goal is to make attacks more expensive to your adversary, at "reasonable" cost to you. Subpeonas are cheap to some. ------ _Enemy of the State_ Easter Eggs: * In EotS, the birthdate of the evil spook (Thomas Reynolds, played by Jon Voight) is 9-11-40. (The movie was released in 1998.) * EotS was produced by "No Such Productions" * The screenwriter's surname is Marconi.

1 0

[Erosion of ISP liability-freedom]: schoolscandals.com bullied into closure
by Major Variola (ret) 25 Apr '03

25 Apr '03

Student Insult Web Site Closed Operators blame public outcry over postings of crude, malicious rumors. By Erika Hayasaki, Times Staff Writer A Web site that published crude and malicious rumors about Southern California middle and high school students was shut down Thursday after a public outcry from parents and students. Schoolscandals.com, a 3-year-old Web site run by Western Applications, a Nevada-based corporation, had featured links for chat rooms about nearly 100 Southern California middle and high schools with postings referring to students as "whores," "sluts" and "losers." Those chat rooms are now closed, and a message reads that the bulletin board has been suspended "until some method could be devised to control the content on the forum There is nothing any of us can do about it. We have no money, so we have no power." Ken Tennen, a West Hills attorney who represents the Web site owners, did not return telephone calls Thursday, although he told The Times last week that those who were calling for the site to be shut down were trying to "silence free speech." Ray Lopez, producer of the "John and Ken Show" on KFI-AM (640) radio, said they first aired a segment about the Web site last week after reading about it in The Times, and received hundreds of e-mails and telephone calls from angry students and parents. "High school students are really insecure to begin with, and something just needed to be done about this," Lopez said. One woman, whose son attends a Las Virgenes School District school and who had counseling after being ridiculed on the site, said she was thrilled that it was shut down. "I am glad the Web site is over and [my son] is glad it's done," she said. "He doesn't want to be hurt anymore, and he doesn't want other kids to be hurt." The message now on the site complains about the radio station's campaign against it. A 1996 federal law protects many Internet service providers from lawsuits about their content. Only those sites that hold the right to create and edit material on their sites can be held liable for content, said Mark Radcliffe, a cyberspace and new media law attorney. http://www.latimes.com/news/local/la-me-scandal25apr25,1,1974090.story?coll… ----- "Montag, why do you burn books ?" "It's a job like any other, pay is good and there is a lot of variety". -F451

1 0

Military Drops OpenBSD Funding Because of de Raadt's Antiwar Comment
by Major Variola (ret) 25 Apr '03

25 Apr '03

SAN JOSE, Calif. (AP) - The U.S. military's research agency cut off grant money for helping to develop a secure, free operating system after a top programmer made anti-war statements to a major newspaper. The U.S. Defense Advanced Research Projects Agency halted the contract less than two weeks after The Globe and Mail of Toronto published a story in which programmer Theo de Raadt was quoted as saying he was "uncomfortable" about the funding source. "I try to convince myself that our grant means a half of a cruise missile doesn't get built," de Raadt told the newspaper. Within a few days, de Raadt said he received an e-mail from Jonathan Smith, a computer science professor at the University of Pennsylvania and the grant's lead researcher, expressing discomfort over the statements. On Thursday, Smith notified de Raadt of the cancellation. "A tenured professor was telling me not to exercise my freedom of speech," de Raadt said. Smith declined to comment on the matter, and DARPA did not return telephone messages Friday. De Raadt's suspicions about the cancellation could not be confirmed. The $2.3 million grant had funded security improvements to the OpenBSD operating system since 2001 as well as related projects. OpenBSD, a variation of Unix designed for use on servers, is touted as so secure that its default installation has had only one bug in the past seven years. Thousands of copies of OpenBSD have been downloaded in the past six months. It's not clear, however, how many are in use. De Raadt estimates about 85 percent of the DARPA grant has been spent, with about $1 million being used to pay for OpenBSD developers. Much of the work has been handled by a team of 80 unpaid volunteers. Another $500,000 of the money funded the work of United Kingdom-based researchers on a related project called OpenSSL, which is used to encrypt data. DARPA, which oversees research activities for the Pentagon, is best known for developing the network that evolved into the Internet. http://ap.tbo.com/ap/breaking/MGAD9B1KOED.html

5 5

Re: Bad Elf.
by Tyler Durden 25 Apr '03

25 Apr '03

Greg Broiles wrote... "Oh, I can do better than that - "Whichever fucking asshole is sending me unwanted messages needs to stop now." "Shit, they haven't stopped. Why don't people listen when I boss them around?" Yeah, I was sacred too. If it doesn't stop maybe this guy will use bad words again! -TD >From: Greg Broiles <gbroiles(a)bivens.parrhesia.com> >To: cypherpunks(a)lne.com >Subject: Re: Bad Elf. >Date: Thu, 24 Apr 2003 19:22:19 -0700 > >On Thu, Apr 24, 2003 at 05:44:25AM -0700, A.Melon wrote: > > > Pierre Lethier, 48, had been wanted by the French authorities since > > > September 2000 on suspicion that he helped illicitly divert Elf funds >to > > > secure the company's 1992 acquisition of the eastern German Leuna >refinery > > > complex. > > > > This and a variety of other stuff, is showing up > > in RAZOR2. Whichever fucking asshole out there is > > reporting some of Fuhrer Rat's cypherpunk mail to > > RAZOR or any other UE signature repository, needs > > to stop now. > >Oh, I can do better than that - "Whichever fucking asshole is sending me >unwanted messages needs to stop now." > >Shit, they haven't stopped. Why don't people listen when I boss them >around? > >Maybe trying to shift responsibility for solving my problems to others >via the use of anonymous passive-voice messages (passive-aggressive >voice?) isn't a good strategy after all. > >Spam databases which aren't designed to cope with false reports and/or >differences of opinion about what's spam are doomed. On the way to >their doom, they may take some of your inbound mail with them. > >The Cloudmark/Vipul's Razor people don't seem interested in describing >their trust metric system in a public forum, so it's hard to say much >about it beyond "apparently it's not working very well." > >You might try "man 5 razor-whitelist" if you don't like having cpunks >mail tossed in the trash with the spam. > >-- >Greg Broiles >gbroiles(a)parrhesia.com _________________________________________________________________ The new MSN 8: smart spam protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

Re: Bad Elf.
by A.Melon 24 Apr '03

24 Apr '03

> Pierre Lethier, 48, had been wanted by the French authorities since > September 2000 on suspicion that he helped illicitly divert Elf funds to > secure the company's 1992 acquisition of the eastern German Leuna refinery > complex. This and a variety of other stuff, is showing up in RAZOR2. Whichever fucking asshole out there is reporting some of Fuhrer Rat's cypherpunk mail to RAZOR or any other UE signature repository, needs to stop now.

3 2

Re: [Lucrative-L] lucrative accounts revisited
by Patrick Chkoreff 24 Apr '03

24 Apr '03

On Thursday, April 24, 2003, at 06:46 PM, Joris Bontje wrote: > Like Patrick M (the Lucrative-one) said, it is unlinkable-by-policy vs > unlinkable-by-mathematics. If you don't blind coins (and want them to > be > able to be linkend), the easiest solution is storing the valid coins. > If > you do have blinded coins, the only solution is storing spend coins. Strictly speaking, my server stores neither the valid nor the invalid coins. It stores the hashes of the valid coins. Therefore, the server has no way of discerning the details of any coin stored in its database. All it can do is recognize a valid coin when it sees one, and immediately extinguish it and issue a new one. So, can somebody give me a concrete example of a "linkage" problem here? I'll tip you a couple of grams in the DGC of your choice if you can do a good job of it. One person suggested that Citibank might issue a coin X to Alice, who then spends it at Bob's Kinky Sex Emporium, who then deposits that coin at Citibank. Citibank begins building a profile of Alice's kinky tastes because it remembers issuing X. But that is simply not how it works. Citibank issues coin X to Alice. Alice immediately swaps X with the server and obtains a new coin Y. Alice gives coin Y to Bob in return for kinky porn. Bob immediately swaps Y with the server and obtains a new coin Z. Bob gives coin Z to Citibank. Citibank immediately swaps coin Z with the server and obtains a new coin A. I do not see "linkage" here. Citibank never sees X again. To be clear, I am NOT trying to solve the problem of having a coin circulate several times out in the wild without any contact with a server, and somehow prevent a double spend in that scenario. I do not see how that is even remotely possible. Alice has a fancy string of bits on her computer. She transmits that string of bits to Bob and gets a sweater. Then she transmits the same string of bits to Charles and gets a beer. You cannot prevent this without consulting a server. -- Patrick http://fexl.com

2 1

Feral Robot Dogs (fwd)
by Jim Choate 24 Apr '03

24 Apr '03

http://xdesign.eng.yale.edu/feralrobots/, -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

1 0

[Lucrative-L] Great news! Lucrative has a home!
by R. A. Hettinga 24 Apr '03

24 Apr '03

--- begin forwarded text

1 0

Re: [Lucrative-L] lucrative accounts revisited
by Patrick Chkoreff 24 Apr '03

24 Apr '03

> From: "James M. Ray" <jray(a)omnipay.net> > > At 10:46 AM -0400 4/24/03, Patrick Chkoreff wrote: > ... >> With these cards you would have a true off-network solution. I wonder >> if it's feasible to do the crypto and hardware for this? > > While crypto-hardware is cool stuff, and I'm all-for-it, I think > that ubiquitous bandwidth is much more likely to happen. > We have to remember, we're INTO this stuff. Most people would > not see the benefits of a $100 cryptocard nearly as quickly ... I can see your point, but let me think about it a bit. Alice is at a craft fair with digital coins loaded into a PDA that costs at least $100. So she's already somewhat of a geek to begin with. But she is glad that her general-purpose PDA is capable of handling coins in addition to her date and address book. No need to pony up more money for a specialized crypto-wallet. But for every geeky Alice, there are at least one hundred non-geeky Alyssas out there. Alyssa is not likely to purchase a relatively expensive and difficult to use general purpose device. She might, however, pony up for an inexpensive, easy to use, specialized crypto-wallet. She would not consider anything that has icons and a stylus, but she would readily adopt a sleek little black-box crypto-wallet. Maybe it even comes in her favorite colors. So even if the network is as reliable and ubiquitous as the atmosphere itself, in this new digital coin economy both Alice and Alyssa are going to be carrying around SOMETHING. Which is easier, persuading geeky Alice to purchase a cheap specialized device, or persuading non-geeky Alyssa to purchase an expensive clunky general purpose device? Of course, the network will NOT be as reliable as the atmosphere itself, and there is at least one alternative. Physical cash is the obvious choice -- after all, these digital coins are ultimately redeemable for valuable physical objects like gold and silver coins or notes for same, so I expect people to carry around a combination of valuable atoms and valuable bits as they shop. But in the case of inexpensive crypto-cards, there is a second option. Direct offline beaming of digital coins from one device to another. Assuming it can be done simply, inexpensively, and securely. So when the network is inaccessible and Alyssa is out of cash, she's still in luck. Whip out the candy-red colored crypto-wallet and snag the sweater. > ... Or Joris may > be right, there's something to be said for physical cash... Definitely. At the very least, the issuer stores that in the vault to back up the digital coins. :-) But seriously, people are going to want to hold and trade valuable physical stuff because it is a form of wealth independent of the server, ubiquitous networks, or even crypto-wallets. It's the real deal, the final deliverable upon which all bit-bashing is based. > I'm also curious about how all this is going to be profitable. > How (aside from a small e-gold donation, if he tells me his > account number!) will Lucrative-Patrick get paid? Thanks. > JMR This is a very good question. Obviously if you are an ISSUER I can see how it might be profitable -- you simply charge transaction fees whenever coins are swapped, split, merged, etc. at the server. You can assess storage fees to cover your base costs or even try to nick a small profit there. All of this would be implemented as tunable parameters in the server software, perhaps even DYNAMICALLY self-tuning based on market conditions, changing constraints on bandwidth and disk usage, etc. If you are a mere CODER like Lucrative-Patrick and Fexl-Patrick, well sorry, we're just slaves in it for the fun. :-) Work for tips, become an issuer, hold a day job, whatever it takes to get your next fix. -- Patrick http://fexl.com

1 0

Give money to Iraq charities, go to jail
by Declan McCullagh 24 Apr '03

24 Apr '03

NEWS RELEASE Glenn T. Suddaby, United States Attorney for the Northern District of New York, announced today that OSAMEH ALWAHAIDY has entered a plea of guilty in U.S. District Court, Syracuse to a prosecutor's Information charging him with violating the International Emergency Economic Powers Act (IEEPA) by sending money to Iraq in violation of the sanctions imposed on that country. In entering his guilty plea, ALWAHAIDY, age 41, Fayetteville, New York, admitted that he assisted others at "HELP THE NEEDY" in sending money to Iraq, notwithstanding his knowledge that sanctions had been imposed on that country since 1990 prohibiting such transactions. Specifically, ALWAHAIDY admitted allowing RAFIL DAHFIR to use checks from an account on which ALWAHAIDY was a signatory to transfer money from HELP THE NEEDY'S account to the private accounts of another indicted defendant, MAHER ZAGHA. ALWAHAIDY further admitted that on October 25, 1999, November 9, 1999, and February 23, 2000, he helped transfer $20,000, $50,000, and $30,000 respectively to MAHER ZAGHA's business account in Jordan knowing those funds would be forwarded to individuals in Iraq. ALWAHAIDY stated in the plea agreement that he believed that the money was intended to help needy people, especially needy people in Iraq. The government noted in Court, however, that the purpose of the prohibitions on transfers of money into Iraq is to prevent money sent for any purpose from being misused once in Iraq and that it's investigation into the use of that money once it was sent to Jordan is still under investigation. ALWAHAIDY had previously been charged with conspiracy to violate IEEPA in an Indictment that was made public on February 26, 2003. Conspiracy to violate IEEPA is a charge that carries a maximum possible penalty of five years incarceration. As a result of today's guilty plea, ALWAHAIDY faces a maximum possible penalty of ten years incarceration when he is sentenced. In addition, he faces a maximum possible fine of $250,000. A special assessment of $100 is also mandatory in a case of this type. The plea agreement filed today provides that the conspiracy charge pending against ALWAHAIDY will be dismissed at the time of his sentencing and he will not be furthered charged in connection with this case. Finally, the plea agreement contemplates that he will cooperate with the government in its ongoing investigation. The Honorable Norman A. Mordue, U.S. District Court Judge, presided over today's proceeding. The entry of this plea is a result of the continuing investigation undertaken by agents from the Federal Bureau of Investigation; the Internal Revenue Service; the Social Security Administration, Office of Inspector General; the Defense Criminal Investigation Service; the New York State Police; the United States Customs Service; the Immigration and Naturalization Service; the U.S. Postal Service; the Department of Health and Human Services, Office of Inspector General; and the United States Marshals Service. Although additional information concerning this case will be limited at this time, further inquiries can be directed to First Assistant U.S. Attorney Joseph A. Pavone at (315) 448-0672.

1 0