May 2003 - cypherpunks-legacy

moderated cryptography list
by pmetzger＠lehman.com 17 Dec '03

17 Dec '03

Hello, all. I'm looking for a site willing to host a high-quality moderated cryptography mailing list which I am thinking of starting up. The list would be designed as a low volume, high readership, high quality source for 1) In-depth technical discussions of cryptography 2) Announcements of cryptographic products 3) Announcements of news items of interest to the cryptography community. 4) VERY limited numbers of postings on the social implications of cryptography, and I mean VERY limited. All postings would be explicitly approved by the moderator before going out to assure quality. Yes, that means fascistic restriction of your capacity for free speech, in exchange for not being overwhelmed with garbage every day. It is ultimately envisioned that should the list be a success I would try to move it to a moderated Usenet newsgroup. If you think that such a list is a Good Thing, and you can host it (which requires that you have a good internet connection and root access or similar on the machine in question), please let me know. I'll do all the work, and the crypto community will thank you tremendously. Perry Metzger

2 1

Re: Anarchy Gone Awry (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This post is a perfect example why the two lists should be kept seperate and not merged. This sounds to me like it belongs on alt.politics.data- highway. -uni- (dark)

2 1

Re: CHAUM CHIMES IN
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

>Date: 08 Sep 93 16:30:55 EDT >From: Sandy <72114.1712(a)CompuServe.COM> >Subject: CHAUM CHIMES IN >Message-Id: <930908203054_72114.1712_FHF95-2(a)CompuServe.COM> ..From: > SANDY SANDFORT Reply to: ssandfort(a)attmail.com [ . . . ] >Of course, the next letter to the editor calls for the adoption >of systems to track every vehicle at all times. The genius who >wrote the letter, thinks it would be a good way to prevent >nuclear, biological or chemical terrorism. Geeeeez. It was signed by Dorothy Denning, right? Actually, they should take that to its full conclusion. We need implants in every individual, broadcasting to the local surveillance agency, giving not only location but also every word spoken in the vicinity. It could also do a chemical analysis of the air in the neighborhood. It should also have a radiation counter. It should also monitor the host body, looking for signs of anger or sexual arousal? How else will we be guaranteed safe from mad bombers, rapists and child molesters? How else will our big budget LE agencies be able to protect us? I know. When it's finally adopted, worldwide, they'll call it the Ellison Plan. :-( - Carl

2 1

Stegno and DAT and digital music...
by Peter Wayner 17 Dec '03

17 Dec '03

In this week's Sunday NYT, Hans Fantel, their music guy, writes at length about the new "dithered" CD's and how the guys have improved the sound. He says that the original CD format was limited to 16 bits of sound because of costs. But many audiophiles reacted very negatively to the tinny, metalic quality to the music. For this reason, the companies have developed 20 bit DAT recording tape and then come up with ways to "dither" this into 16 bits. I am curious if anyone knows the details of these algorithms. Also, his point suggests that flipping the least significant bit of 16 bit music may not be imperceptable to some ears. If the classical music starts to sound tinny then there might be something subversive in the least significant bits. -Peter Wayner

2 1

Remail: errors
by HFinney＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have been out of town for the last week, so I missed some CP mail. It looks like some good things are happening with remailers, though. Kudos to Karl, Sameer, and the others for their work! I have received many messages to my remailer in the last week which came from remail(a)tamsun.tamu.edu, which were PGP-encrypted apparently in an effort to get my remailer to send them. They did not work, though, because there was no "Encrypted: PGP" header to trigger the remailer's decryption. This can be arranged by creating the message something like this: ======================================================== :: Request-Remailing-To: hfinney(a)shell.portal.com :: Encrypted: PGP - -----BEGIN PGP MESSAGE----- <rest of message> - -----END PGP MESSAGE------ ======================================================== This would then be sent to remail(a)tamsun.tamu.edu. I don't know whether the multiplicity of such erroneous messages is just due to one person stubbornly re-trying, or whether there is an error in one of the new programs for creating chained remailer messages. Hal Finney hfinney(a)shell.portal.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBLJaNuKgTA69YIUw3AQHrNwQAowMEQwuH6YyHoj6T7AqZFLNdTf+eqJ9L LhAatHS94nmC1smkfVNq0dZmigmkvBdMNEPlBZemmxALz+KJw6OSY/ULSBmuVNEq 5rJANh3XimoJWqLISy2lZiuC5Fw2R7UvRadcdM94pncSVvev92Fyf7CqEOOtrGAK PUzRds7BVNo= =FpLa -----END PGP SIGNATURE-----

2 1

more than spread spectrum
by cme＠ellisun.sw.stratus.com 17 Dec '03

17 Dec '03

There are alternatives to spread spectrum, if we're threatened with loss of freedom to communicate. We could lay our own wires/fibers. We could set up a mesh network of infrared lasers through the air. Last time I looked, there were no laws against shining lights out your window as long as they didn't bother anyone. An infrared laser could hardly bother anyone. We could produce a line of cheap cards to plug into a PC which would do packet routing, using a variety of physical links -- our own wires, lasers, very low range radio, .... Each card would connect to three or more neighbors and become part of the global mesh. Adaptive routing with no global map would suffice for the card and would keep the whole system peer-to-peer with no need for central control and no chance for central tapping. Of course all of these solutions require a high density of users. A college campus might be the right place to start. We could then branch out to cities. I suspect that a place like Chicago or NYC with high rise apartments might be the place to start -- many options for line-of-sight communications. The benefit isn't just for Cypherpunks. It's a free network for the masses -- like the original USENET (with each user donating routing and store/forward) but with unrestricted, low-range, continuously operating physical links. I'll volunteer to do the software for the node card. Does anyone have hardware design/fab to donate to the effort? - Carl

4 3

Maybe It's Snake Oil All the Way Down
by Scott Guthery 08 Jun '03

08 Jun '03

Hello, Rich ... When I drill down on the many pontifications made by computer security and cryptography experts all I find is given wisdom. Maybe the reason that folks roll their own is because as far as they can see that's what everyone does. Roll your own then whip out your dick and start swinging around just like the experts. Perhaps I'm not looking in the right places. I wade through papers from the various academic cryptography groups, I hit the bibliographies regularly, I watch the newgroups, and I follow the patent literature. After you blow the smoke away, there's always an "assume a can opener" assumption. The only thing that really differentiates the experts from the naifs is the amount of smoke. Now I'm certainly not arguing that given wisdom and hard experience have nothing to contribute but they aren't substitutes for either mathematical or even statistical certainty. And I do note in passing that their history of delivering fundamental truth would counsel having a backup plan particularly when it comes to the family jewels. Cheers, Scott -----Original Message----- -----Original Message----- From: Rich Salz [mailto:rsalz@datapower.com] Sent: Fri 5/30/2003 9:26 PM To: Eric Rescorla Cc: Bill Stewart; cypherpunks; cryptography(a)metzdowd.com Subject: Re: Nullsoft's WASTE communication system > It's utterly baffling to me why people like this choose to design > their own thing rather than just using SSL. Totally agree. At this point in time, if it's a TCP based protocol and it isn't built on SSL/TLS, it should pretty much be treated as snake oil, I'd say. Perhaps some kind of evangelism is needed. /r$ --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

26 52

web apps with large volumes of bidirectional http traffic
by Ryan Lackey 03 Jun '03

03 Jun '03

I need to find some relatively widely deployed applications which have frequent user interactions (rapid clicking on links, from as large a population of links as possible, and also form filling and such). (it should be pretty obvious what this is for) I'd like: 0) *rapid*/frequent user interactions; fast clicking on things (like every second, no more than 5 seconds) 1) "sticky"...long interactions with a given site (on the order of hours) (also all links need to be under the same url/same server) 2) large number of potential links for users to click on, with desirable properties for click distribution (I *think* I want them to be nearly equally likely, but I might just want a defined distribution, or I might even want the opposite of that) 3) relatively small data sizes for downloaded data, UNLESS downloaded data is generated unique and "randomly" 4) widely deployed already on the internet, or compelling enough that there would be a decent number of potential server operators. Obviously I could *create* an app which has the desirable characteristics, but I'd like something which can deal with existing data or apps served over the internet) 5) good data on how likely users are to click on things, how fast they click, etc., so one could easily operate within those parameters. So far, the best ideas: 1) Porn 2) Mailing lists with lots of internal links (next, reply, etc.) 3) Sites with search engines with lots of linked data (encyclopedia, etc.) 4) html games (or flash, maybe) -- either imagemaps, or just tables, things like chess, or puzzles, or whatever I'd definitely appreciate any suggestions on possible web apps which meet these criteria; reply to lists or ryan(a)venona.com. I'll post when it's ready. Thanks, Ryan -- Ryan Lackey [RL960-RIPE AS24812] ryan(a)venona.com +1 202 258 9251 OpenPGP DH 4096: B8B8 3D95 F940 9760 C64B DE90 07AD BE07 D2E0 301F --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

2 1

BIS Disk Full
by Anonymous 02 Jun '03

02 Jun '03

I tried to notify the BIS that I was posting some code and I got this error back: > <web_site(a)bis.doc.gov>: > 170.110.31.61 failed after I sent the message. > Remote host said: Can't create transcript file ./xfh4VJhUa02511: No space left on device > > <crypt(a)bis.doc.gov>: > 170.110.31.61 failed after I sent the message. > Remote host said: Can't create transcript file ./xfh4VJhVC02512: No space left on device Are our rights suspended until they get their system fixed? :-)

2 1

Nigerian Spammers Using TDD/TTY Telephone Relay Service
by Bill Stewart 01 Jun '03

01 Jun '03

This weekend I received three or more cell phone calls from 800-855-0000, which said they were the AT&T Relay Service, which relays phone calls from deaf people using TDD or TTY or now internet webform services. They claimed to be a "Dr. Charles Ego" (or some name like that) asking to confirm that I'd received his email, and asking for my email address. I was a bit puzzled, because none of the deaf people I have known over the years are doctors, and one of the two signing people I know well was at dinner with me when the call arrived, and they were calling like this was a business call, but it was Sunday night before a US Monday holiday, so they were probably calling from somewhere that it was Monday daytime. The name sounded enough like the usual fraudulent Nigerian Email Scam, so I asked what time zone he was in, and he replied 12:00 GMT, which didn't make sense (either it's Atlantic Time, or he was just wrong.) So I poked around the AT&T Relay Service web site, and it sounds like we've got a new web-based interface to free telephone relay service and the spammers have discovered the potential for abusing it. Sigh. And it's got a privacy policy that sounds like it'll be difficult to track down these callers..... The web site says they deal with privacy issues by not storing call content, though at first reading it doesn't really say whether they do or don't store call record information like IP address, phone number, or call duration, though since it's free that probably means it's either government-subsidized or some other mandated program with accounting requirements like that, or if they have an "except for drugs or terrorism" requirement.

6 8