February 2004 - cypherpunks-legacy

Humorous Airport DoS (from cryptogram)
by Major Variola (ret) 15 Feb '04

15 Feb '04

For example, airports have dogs and devices for detecting the chemical emissions from explosives. If I took a small perfume sprayer and filled it with nitrobenzene (used in firearm bore cleaning solvents) and sprayed people's luggage with it as they awaited security screening, the airport would soon be shut down due to the threat perceived by security. Or if I sprayed the seats in the airports lounge or restaurant, the bomb-sniffing dogs would become butt-sniffing dogs, to the major embarrassment of security. This last, while humorous, would go a long way toward discrediting the security force.

2 1

The Politicization of Security (Re: CRYPTO-GRAM, February 15, 2004)
by R. A. Hettinga 15 Feb '04

15 Feb '04

At 4:32 AM -0600 2/15/04, Bruce Schneier wrote: > The Politicization of Security > > > >Since 9/11, security has become an important political issue. The Bush >administration has seized on terrorism as a means to justify its >policies. Bush is running for re-election on a "strong on security" >platform. The Democrats are attacking the administration's record on >security. Congress has voted on, and will continue to vote on, >security countermeasures. And the FBI and the Justice Department are >implementing others, even without Congressional approval. > >In the last issue of Crypto-Gram I published a couple of security >essays that had a political component. I was surprised by the number >of e-mails I received from people accusing me of bashing Bush (or >worse). American politics may be getting vitriolic, but I think it's >worth stepping back and looking at the political security landscape. > >I believe that the Bush administration is using the fear of terrorism >as a political tool. That being said, I'm not sure a Democrat would do >anything different in Bush's place. Fear is a powerful motivator, and >it takes strong ethics to resist the temptation to abuse it. I believe >the real problem with America's national security policy is that the >police are in charge; that's far more important than which party is in >office. > >Some of the Democratic presidential candidates for president have been >more rational about security, but none have discussed security in terms >of trade-offs. On the Republican side, I've read some criticisms of >Bush's heavy-handed security policies. Certainly the traditional >Republican ideals of personal liberty and less government intervention >are in line with smart security. And have the people who accuse me of >hating Republicans forgotten that the Clipper Chip initiative was >spearheaded by the Clinton administration? > >The Republicans don't have a monopoly on reducing civil liberties in >the United States. > >Rational security is not the sole purview of any political >party. Fighting stupid security does not have to be partisan. Bush's >White House has done more to damage American national security than >they have done to improve it. That's not an indictment of the entire >Republican party; it's a statement about the current President, his >Attorney General, and the Secretary of the Department of Homeland >Security. It's a statement about the current political climate, where >the police -- and I use this term to encompass the FBI, the Justice >Department, the military, and everyone else involved in enforcing order >-- and their interests are put ahead of the interests of the >people. My personal politics on non-security issues are not relevant. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Call to the Usual Suspects
by Trei, Peter 14 Feb '04

14 Feb '04

I'll be in the SF/SJ area the week of the RSA conference. Anyone interested in getting together for dinner one night? We used to try to schedule a BA Cypherpunks Physical Meeting to match up with the event, but the PMs seem to have died out. Peter Trei

2 1

Re: FCC vs decentralization
by Peter Gutmann 14 Feb '04

14 Feb '04

Eugen Leitl <eugen(a)leitl.org> writes: >On Fri, Feb 13, 2004 at 04:36:56PM +0100, Thomas Shaddack wrote: >> FCC recently mandated fees for Internet radio "broadcasters", based on the > >You're hailing from .cz, me from .de. Of what relevance is FCC to us? The RIAA/MPAA and US govt.are working on that. Stand by. Peter.

2 1

Re: Call to the Usual Suspects
by Peter Gutmann 13 Feb '04

13 Feb '04

"Trei, Peter" <ptrei(a)rsasecurity.com> writes: >I'll be in the SF/SJ area the week of the RSA conference. Anyone interested >in getting together for dinner one night? Do these things actually get organised? I thought you just bump into other Cpunks via the usual Brownian motion and at some point someone suggests a place to go, half the participants slope off to an alternative establishment on the way there, and that's how dinner gets arranged. Peter.

3 2

Re: Windows source leaked?
by Major Variola (ret) 13 Feb '04

13 Feb '04

[sent to al-q; does cypherpunks-moderated(a)minder.net forward there?] At 06:25 PM 2/12/04 -0500, Riad S. Wahby wrote: >Among others, /. is reporting that Win2k and WinNT source code may >have leaked. The horror, the horror. >Lots has been said about OSS developers not wanting to look at this >for fear that they will be "tainted." While it is true that simply >the act of looking at the code is unauthorized and illegal, If you didn't steal it, its not your problem if you read it. I wonder >if there is any truth to the claim that a developer who looked at >Windows source would endanger future projects (assuming, of course, >that simple copying---which is clearly illegal---doesn't happen). How would M$ show that you had in fact read the code? And if you didn't copy it, why would a court care?

4 4

Re: Windows source leaked?
by Major Variola (ret) 13 Feb '04

13 Feb '04

At 05:34 PM 2/13/04 -0500, Steve Furlong wrote: > >In principle they can prove that the secret didn't have any influence on >the work, but in practice they're stuck having to prove a negative. I was hoping the courts would see the impossibility of proving a negative, and see true dissimilarities in the code as indicitive of fair play. > If push came to shove, the >implementors could have sworn that they had never seen the IBM code. But other than their "sworn word", how would anyone know what they did, except that their source differed from the original? I hope the precedent of the IBM case and the widespread ability to publish anything instantly nowadays sways an intelligent court without programmers getting harmed. Its rather asymmetric --open source is out there, proprietary isn't. I wonder if frags of OSS code can be found in proprietary binaries.

2 1

Re: Windows source leaked?
by Major Variola (ret) 13 Feb '04

13 Feb '04

At 02:08 PM 2/13/04 -0800, Eric Murray wrote: >On Fri, Feb 13, 2004 at 11:45:34AM -0800, Major Variola (ret) wrote: >(in reply to someone else) >> >> >Lots has been said about OSS developers not wanting to look at this >> >for fear that they will be "tainted." While it is true that simply >> >the act of looking at the code is unauthorized and illegal, >> >> If you didn't steal it, its not your problem if you read it. >I disagree. I meant there is no crime in reading anyone elses (lost) trade secrets. I don't have time to look up the cases now >but there have been a number of cases of companies being sued for >(effectively) their programmers having SEEN some other code. >The theory being that they are somehow contaminated with >the valuable ideas embodied within and are helpless to resist >implementing them. This has resulted in >many companies having "chinese walls" between some programming >groups who are working on a version of a competitors product that >the company has the code for. Yes I know about this. The solution was that the engineers worked from specs only and had never seen the code. It was OK if the specs were derived from reverse engineering, or in M$'s case, a source leak. So a cleanroom use of leaked code (Alice extracts specs, Bob who doesn't look at the code writes to them.) would be OK. How are you going to show that Bob read the leaked code? There simply won't be enough similarity *even if* (I'll assert) Bob does take a peak. Unless he's got photographic memory in which case he should be in Vegas. >This may not be "right", but it was extremely common in the early 90s. >It's very expensive so I would be quite suprised if there was not >strong case law on this. Its mostly about employee-grabbing being bad, and writing to specs to interoperate being ok. >> I wonder >> >if there is any truth to the claim that a developer who looked at >> >Windows source would endanger future projects (assuming, of course, >> >that simple copying---which is clearly illegal---doesn't happen). >> >> How would M$ show that you had in fact read the code? > >They'd just alledge that you had, and then have "discovery" >all through your files. An abuse perhaps, perhaps it would be noticed after the first few hundred uses... And one would hide or wipe or shred such files after use anyway, good hygiene. Essentially any program could look >like an "infriging work" to some judge somewhere. Yes but what to do? Perhaps organizations will help the sued with legal costs, precedents will get established that protect folks in the future. ..and goofball judges will be collected on wheelbarrows, bulldozed into the flaming ovens.. sorry..... channelling you know who... >If I were a conspiracy theorist I'd say tha MS released the code >themselves just for this reason. And surely this list is thirsty for conspiracy theories. \begin{IANAL} If someone spills the trade secret recipe for Coca Cola, its not the case that no one else can ever make a soda closer to Coca Cola than before. You can sue a ham sandwich. Sucks to be that ham sandwich though. \end{IANAL}

1 0

File Sharing's New Face
by R. A. Hettinga 13 Feb '04

13 Feb '04

<http://www.nytimes.com/2004/02/12/technology/circuits/12shar.html?position=…> The New York Times February 12, 2004 File Sharing's New Face By SETH SCHIESEL EATTLE AFTER working for a parade of doomed dot-com startups, a young programmer named Bram Cohen finally got tired of failure. "I decided I finally wanted to work on a project that people would actually use, would actually work and would actually be fun," he recalled. Three years later, Mr. Cohen, 28, has emerged as the face of the next wave of Internet file sharing. If Napster started the first generation of file-sharing, and services like Kazaa represented the second, then the system developed by Mr. Cohen, known as BitTorrent, may well be leading the third. Firm numbers are difficult to come by, but it appears that the BitTorrent software has been downloaded more than 10 million times. And just as earlier forms of file-sharing seem to be waning in popularity under legal pressure from the music industry, new technologies like BitTorrent are making it easier than ever to share and distribute the huge files used for video. One site alone, suprnova.org, routinely offers hundreds of television programs, recent movies and copyrighted software programs. The movie industry, among others, has taken notice. What Mr. Cohen has created, however, seems beyond his control. And when he was developing the system, he said, widespread copyright infringement was not what he had in mind. Rather, he was intrigued by a problem familiar to many Internet users and felt acutely by friends who were trading music online legally: the excruciating wait while files were being downloaded. "Obviously their problem was not enough bandwidth to meet demand," Mr. Cohen said in an interview at a Mexican restaurant near his home in Seattle. "It seemed pretty clear to me that there is a lot of bandwidth out there, but it's not being used properly. There's all of this upload capacity that people aren't using." That was the essential insight behind BitTorrent. Under older file-sharing systems like Napster and Kazaa, only a small subset of users actually share files with the world. Most users simply download, or leech, in cyberspace parlance. BitTorrent, however, uses what could be called a Golden Rule principle: the faster you upload, the faster you are allowed to download. BitTorrent cuts up files into many little pieces, and as soon as a user has a piece, they immediately start uploading that piece to other users. So almost all of the people who are sharing a given file are simultaneously uploading and downloading pieces of the same file (unless their downloading is complete). The practical implication is that the BitTorrent system makes it easy to distribute very large files to large numbers of people while placing minimal bandwidth requirements on the original "seeder." That is because everyone who wants the file is sharing with one another, rather than downloading from a central source. A separate file-sharing network known as eDonkey uses a similar system. For Mr. Cohen, BitTorrent was always about exercising his brain rather than trying to fatten his wallet. Unlike many other file-sharing programs, BitTorrent is both free and open-source, which means that those with enough technical know-how can incorporate Mr. Cohen's code into their own programs. While writing the software, "I lived on savings for a while and then I lived off credit cards, you know, using those zero percent introductory rates to use one credit card to pay off the previous card," Mr. Cohen said. The first usable version of BitTorrent appeared in October 2002, but the system needed a lot of fine-tuning. Luckily for Mr. Cohen, he was living in the Bay Area at the time and his project had attracted the attention of John Gilmore, the free-software entrepreneur, who had also been one of the first employees at Sun Microsystems. Mr. Gilmore ended up helping Mr. Cohen with some of his living expenses while he finished the system. "Part of what matters to me about this is that it makes it possible for people with limited bandwidth to supply very popular files," Mr. Gilmore said in a telephone interview. "It means that if you are a small software developer you can put up a package, and if it turns out that millions of people want it, they can get it from each other in an automated way." BitTorrent really started to take off in early 2003 when it was used to distribute a new version of Linux and fans of Japanese anime started relying on it to share cartoons. It is difficult to measure BitTorrent's overall use. But Steven C. Corbato, director of backbone network infrastructure for Internet2, the high-speed network consortium, said he took notice in May. "We started seeing BitTorrent traffic increase right around May 15, 2003, and by October it was above 10 percent of the traffic," he said. Data for the week of Jan. 26, which Mr. Corbato said was the latest reliable information, showed that BitTorrent generated 9.3 percent of the total data traffic on Internet2's so-called Abilene backbone, which connects more than 200 of the nation's biggest research universities, in addition to laboratories and state education networks. By contrast, no other file sharing system registered more than 1 percent of the traffic, though Mr. Corbato said his network might be underreporting the use of those other services. Just a few months ago, however, that success still had not translated into dollars for Mr. Cohen. "This past September I had, like, no money," he recalled. "I was just scraping along and doing the credit card thing again." But unknown to Mr. Cohen, BitTorrent was serving as a job application. Out of the blue, he heard from Gabe Newell, the managing director of Valve Software, based in nearby Bellevue, Wash. Valve is developing what gaming experts anticipate will be a blockbuster video game, Half-Life 2, but it is also creating an online distribution network that it calls Steam. Because of Mr. Cohen's expertise in just that area, Valve offered him a job. He moved to Seattle and started work in October. "When we looked around to see who was doing the most interesting work in this space, Bram's progress on BitTorrent really stood out," Mr. Newell said. "The distributed publishing model embedded in BitTorrent is exactly the kind of thing media companies need to build on for their own systems." All along, Mr. Cohen had accepted donations from BitTorrent users at his Web site, bitconjurer.org, but the sum had been minimal. In October, however, Mr. Cohen's father prevailed on him to ask a bit more directly. Now, Mr. Cohen said, he is receiving a few hundred dollars a day. "It's been a pretty dramatic turnaround in lifestyle in just a few months, with the job and the donations coming in," Mr. Cohen said. "It's nice." According to survey data from the Pew Internet and American Life Project, file sharing is on the wane, apparently as a result of the music industry's legal offensive. Last May, 29 percent of adult Internet users in the United States reported that they had engaged in file sharing; that figure dropped to 14 percent in a survey conducted in November and December. Nonetheless, the ranks of the BitTorrent faithful - whether anime fanatics, Linux users, Deadheads or movie pirates - appear to be growing. And some are quite thankful to Mr. Cohen. "I think Bram is going to be like Shawn Fanning in terms of the impact this is going to have," said Steve Hormell, a co-founder of etree.org, a music-trading site that predates the file-sharing phenomenon, referring to the inventor of the original Napster service. "It is a bit of paradigm shift and I can't stress the community aspect of it enough. You have to give back in order to get. Going back 15 years, that's what the Internet was all about until the suits came along." Not surprisingly, the movie industry is not amused. "BitTorrent is definitely on our radar screen," Tom Temple, the director for Internet enforcement for the Motion Picture Association of America, said in a telephone interview. While the association first became aware of the technology about a year ago, BitTorrent's surging popularity prompted the group to start sending infringement notices to BitTorrent site operators in November. "We do have investigations open into various BitTorrent link sites that could lead to either civil or criminal prosecution in the near future," Mr. Temple said. For his part, Mr. Cohen pointed out that BitTorrent users are not anonymous and that their numeric Internet addresses are easily viewable by anyone who cares. "It amazes me that sites like Suprnova continue to stay up, because it would be so easy to sue them," he said. Using BitTorrent for illegal trading, he added, is "patently stupid because it's not anonymous, and it can't be made anonymous because it's fundamentally antithetical to the architecture." That said, Mr. Cohen is not in the nanny business. "I'm not going to get up on my high horse and tell others not to do it because it's not my place to berate people," he said. "I just sort of watch it with some amusement." -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Free RSA Expo passes available
by Trei, Peter 13 Feb '04

13 Feb '04

The RSA Security Conference in San Francisco is coming up: Feb 23-27. As in the past, free Expo passes are available if you register online at the conference site: http://2004.rsaconference.com/ (The expo is not open all days - check the schedule). Last year, getting a badge required an ID and getting photographed. I expect its the same this year. Some list members succeeded in gaming this system in highly entertaining ways. Peter

1 0