August 2004 - cypherpunks-legacy

I Come to Bury Sender ID, Not to Praise It
by R. A. Hettinga 27 Aug '04

27 Aug '04

<http://www.eweek.com/print_article/0,1761,a=134105,00.asp> EWeek I Come to Bury Sender ID, Not to Praise It August 26, 2004 By Larry Seltzer It must have seemed like a good idea at the time: The effort to create an effective standard for SMTP authentication relied, and still relies, on quick adoption by the largest companies in the e-mail business, and Microsoft is a significant company in both the e-mail software and service business. Why not bring them into the process and make them a central part of the solution? But it was not to be. With just hours to go on their deadline under the IETF standard process, Microsoft finally released their revised license for their intellectual property rights claims in Sender ID. Microsoft has offered a royalty-free license to all implementers of their property and, it would appear, more than satisfied the needs of the IETF. But open-source advocates in the working group have emphatically rejected the proposed license. Those who would create a distribution of it must obtain one of these royalty-free licenses directly from and fax a signed license form to Microsoft. So if you have a license and wish to publish your source code for others to implement, you can't include the intellectual property rights with the distribution. This only applies to people creating new distributions of the software, not people who simply want to use software that implements Sender ID, even GPL software, or who want to create Sender ID records in DNS. Fed up with spam? Read eWEEK.com's special report "Canning Spam." The reasons for the license are defensive. The only people who can't get a license are those who are suing Microsoft over the intellectual property claims in it. As one participant said, any company with a sizable R&D staff will need to make such defensive moves, and the IETF has happily worked with standards that involved IPR licenses before, many more restrictive and burdensome than this. But Sender ID is different. It is intended for a software market that has had a large presence of open source software. There is some dispute in the working group over whether the license is or is not compatible with most open-source licenses, especially the GPL, but there is a consensus that it is at least problematic for those licenses and a poke in the eye of those who use them. And lawyers from the Free Software Foundation have stated that the license is not GPL-compatible. I tried to warn them, and I know I wasn't alone. Microsoft gave the impression that stopping spam, phishing and other abuses of e-mail was important to them, but it obviously wasn't important enough. For Sender ID to be successful it needs to be adopted widely, and the only way that was going to happen was if it was unencumbered by burdensome licenses. And it had to be obviously free in everyone's sense of the word so that everyone could feel free implementing it and getting to the important business of fixing the broken e-mail system on the Internet. Microsoft just couldn't bring themselves to do it. Instead they actually advise people, if they are unsure of how the license affects them, to hire a lawyer. Next page: We can do better anyway. There's another point that's bothering people, which is the exact scope of their IPR claims. Microsoft has said they have patent claims related to Sender ID, but haven't said exactly what they are. Microsoft set up an e-mail address (stdsreq(a)microsoft.com) to which people could send questions on the matter. I asked them, "Can you tell me what patents Microsoft holds that pertain to an implementation of Sender ID?" and haven't heard back. It appears that the claims have to do with the retrieval of the PRA (purported responsible address) from the message. It's just not worth scuttling Sender ID over that. And it could have turned out well. The merger of SPF and Microsoft's Caller ID may have been a bit ugly and scientifically worthy of South Park's Dr. Mephisto, but it would have improved on the current situation a great deal. And it would have been good to show that Microsoft can be cooperative even with their most unrelenting and unreasonable enemies when an important issue is at stake. In a way it's just as well, since the technical luster had come off Sender ID in the last couple of months, such as in the concern addressed here over the clogging up of DNS records. No approach that addressed all the major problems with e-mail fraud would lack some flaws, but even if there was a consensus on Sender ID it was not an overwhelming one. And with the licensing debacle the consensus has swung overwhelmingly against Sender ID and Microsoft in particular. Perhaps Microsoft thought that Sender ID was such a killer standard that they could push people around, but it's not. They've only boxed themselves out of the process. The rest of the SID standards process will now be a waste of time thanks to Microsoft, and the other participants will afterwards pick up the pieces and get the job done with another spec. Rest assured that enough alternatives were proposed that something can be found that will suffice and that will have none of the license issues. I feel sorry for the Microsoft participants in the process, principally Harry Katz of the Exchange Edge team, who I'm sure only wanted the whole thing to work and were restrained by persons senior to them, probably Microsoft's vaunted legal team who did such a good job for them in the past. Of course, we all know what Shakespeare said about lawyers. Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Cheesecloth security for hard drives
by pgut001＠cs.auckland.ac.nz 27 Aug '04

27 Aug '04

Globalwin has just introduced an external hard drive enclosure (http://www.htpcnews.com/main.php?id=dorri_1) with built-in 40-bit DES encryption (and if it's the HW I think it is, that's 40-bit DES in ECB mode, and the vendor generates the key for you). Peter.

1 0

sex & propoganda [psyops]
by Major Variola (ret) 26 Aug '04

26 Aug '04

http://www.psywarrior.com/sexandprop.html "H.M.G.'s secret pornographer" http://www.seftondelmer.co.uk/hmg.htm

1 0

Wired: Attacking the 4th Estate
by Sunder 25 Aug '04

25 Aug '04

http://www.wired.com/news/politics/0,1283,64680,00.html?tw=wn_tophead_6 or, the HTML crap free version: http://www.wired.com/news/print/0,1294,64680,00.html Attacking the Fourth Estate By Adam L. Penenberg | Also by this reporter Page 1 of 2 next 02:00 AM Aug. 25, 2004 PT John Ashcroft and the Department of Justice must be stopped. There, I've said it. Of course, now I half expect federal agents to drag me off to prison for violating the No One Dare Question the Government While We Are Engaged in the War Against Terror Act. (Duration: perhaps forever.) Sure, you say, no such act exists. But Ashcroft himself once testified that bellyaching over what he called "phantoms of lost liberty" only serves to "aid terrorists" and "give ammunition to America's enemies." And recently FBI agents attempted to intimidate political activists by visiting them at their homes to warn about causing trouble at the upcoming Republican convention. More to the point, under Justice Department guidelines, Ashcroft must approve any subpoena of a journalist, so how do you explain the rash of subpoenas that Special Prosecutor Patrick J. Fitzgerald, the U.S. attorney from Chicago, has doled out to Time magazine, The New York Times, The Washington Post and NBC? Already one reporter -- Matthew Cooper from Time -- has been held in contempt by a federal judge for refusing to appear before the grand jury that Fitzgerald convened to investigate which Bush administration senior official(s) leaked a covert spy's identity to columnist Robert Novak. <SNIP> ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. -------------------------------------------------------------------------

2 1

Re: Digital camera fingerprinting...
by Major Variola (ret) 25 Aug '04

25 Aug '04

At 11:52 PM 8/24/04 -0400, Dave Emery wrote: > Just a random distraction from the normal topics (but not >completely irrelevant either)... Highly relevant sir. > He told me that especially in the low end camera market NO >sensors used were completely free of anomalous pixels (black, white, >dim, bright etc) and much of the actual processing in digital camera >firmware was related to masking or hiding the inevitable defects which >apparently can include (at least in CMOS sensors) entire rows or columns >that are bad. Kinda like disk drives and DRAM arrays. Its all about yield. Covering up mistakes transparently. > This got me thinking - clearly these concealment patches are not >completely undetectable in families of (multiple to many) images taken >with the same exact camera... and for the most part the defects are born >with the sensor and change little over time if at all. And with few >exceptions they are random, and different for each sensor. Perhaps, but the jpeg-ization might lose these, or at least the image "unicity distance" might require many more pictures than a careful steganographer will publish. > Cypherpunk relevance (marginal perhaps), but the ability to say >that a particular image or set of images came from a particular camera >COULD have legal consequences for those bent on activities someone >thinks of as unfriendly to their interests... Very relevant, traffic analysis and fingerprinting (intentional or not) are always tasty subjects. One question for the court would be, how many *other* cameras have column 67 disabled? One of every thousand? And how many thousand cameras were sold? Pope Major Variola (ret)

2 1

RE: Welcome to the Church of Strong Cryptography.
by Tyler Durden 25 Aug '04

25 Aug '04

Goddam, Variola...I thought you had a sense of humor! >At 01:26 PM 8/24/04 -0400, Tyler Durden wrote: > >>PS: I thought Tyler had nominated himself as leader? :-) > >No, almost the opposite. I propose that any 'Cypherpunk' can declare >himself > >to be leader and make 'official statements' at any time. > >Oh, then you'd be reformed cypherpunk. The orthodoxy is that the >group has no head (an arch). Well, Duh...no "Alpha Cat" of course. But if you're able to reverse-scam someone or get some Qwality 'tang, then I won't cock-block you if you declare yourself Cypherpunk leader to an outside party, so long as you have zero expectations that the idea of a Cypherpunk 'leader' will have any practical effect on my actions. >and governments Well, shit Variola. Here's where I can tell you haven't gotten laid in a while. The 'release' was basically a gag...couched in Amerikan Rhetoric it was actually stating precisely this (eg..."even terrorist cells operating inside the DC Beltway..."). Done properly, the idea would be to have it go down the sheeple's throat nice-n-smooth like, see, until they get to the end and experience some dim glimmer of recognition as they realize who the real terrorists are. And by then it's too late...the sheeple has swallowed a 'poison pill' gaurunteed (Officially, by Cypherpunks, or your money back) to convert them one day into a little, tiny sleeper cell. >Forget turbans, real terrorists wear neckties. And don't forget those little American Flag lapel pins...the "mark of the beast"? -TD _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

Welcome to the Church of Strong Cryptography.
by Major Variola (ret) 25 Aug '04

25 Aug '04

At 01:26 PM 8/24/04 -0400, Tyler Durden wrote: >>PS: I thought Tyler had nominated himself as leader? :-) >No, almost the opposite. I propose that any 'Cypherpunk' can declare himself >to be leader and make 'official statements' at any time. Oh, then you'd be reformed cypherpunk. The orthodoxy is that the group has no head (an arch). I think of it as a grad student lounge with open doors, and a few conversations going on at once. Anyone can pop in (wearing a mask or not) and make a fool of himself, or enlighten others, or ask questions (as long as they're not homework), or even forward nominally relevent articles, or flame others for doing so. Of course, others >can (and most probably will) choose to ignore the official statement, or >even declare himself to be leader and 'officially' rescind that statement >and/or issue a completely contradictory statement. This will be particularly >useful when getting (for instance) public interest to move elsewhere. Or it will seem a petty schism like the Sierras or Athiests or Amerikan Xians etc.. The only coherence is an interest in crypto and society. This reasonably extends to privacy, opsec, surveillance and reverse-surveillance, OS bugs, hardware, censorship, finance, etc. Read the fatwa --er, the cyphernomicon :-) Read the Bill of Rights, (now a quaint obsolete historical document) and think about technology. >For instance, it might be usefulto have an official statement ready if/when >the Cryptome press starts poking around Cypherpunks: The useful statement is May's Cyphernomicon (ie an outline) and the bulk of the discussions of the last 12 years (better get a few reams of paper for the printout, Mr. Fed). PKZ's rant is also good introductory material IMHO. >FOR IMMEDIATE RELEASE >Cypherpunks is a collection of diverse individuals dedicated to preserving >the freedoms that all Americans value. As part of this effort, Cypherpunks >periodically analyzes the systems used by terrorists and other enemies of ^ and governments >freedom in an attempt to strengthen such systems and prevent their abuse. Even with my addenda your statement is too restrictive. E.g., some here, I have gathered, worry about corporations (but not LLCs) too. ......and now, some quotes for Tom Ridge to ponder..... Forget turbans, real terrorists wear neckties. "Stop shedding our blood to save your own and the solution to this simple but complex equation is in your hands. You know matters will escalate the more you delay and then do not blame us but blame yourselves. Rational people do not risk their security, money and sons to appease the White House liar." "Can you hear me now?" -UBL "Naturally the common people don't want war...But, after all, it is the leaders of a country who determine policy, and it is always a simple matter to drag the people along, whether it is a democracy or a fascist dictatorship, or parliament or a communist dictatorship. All you have to do is tell them they are being attacked, and denounce the pacifists for lack of patriotism and exposing the country to danger. It works the same in every country." --Hermann Goering, (1893-1946) Nazi Reichsmarschall, at the Nuremberg Trials, 4/18/46. From _Nuremberg Diary_ by Gustave Gilbert. The risks posed by ignorant politicians may yet be far more dangerous that the odd virus and software mistake..... Prof. Dr. Debora Weber-Wulff Additional case studies are needed, however, to determine which traits of chemical and biological terrorists might help identify them because charisma, paranoia, and grandiosity are alo found to varying degreees among, for example, leaders of political parties, large corporations, and academic depts. --John T Finn, _Science_ v 289 1 sept 2000 We have always been at war with Oceania bin Laden -Orwell In no part of the constitution is more wisdom to be found, than in the clause which confides the question of war or peace to the legislature, and not to the executive department. -James Madison "The tragedy of Galois is that he could have contributed so much more to mathematics if he'd only spent more time on his marksmanship." "Your children are not safe anywhere at any time." -IAMGodsniper commenting perhaps on the USG's propensity for using them as cannon fodder. "Quis custodiet ipsos custodes?" "When a man assumes a public trust, he should consider himself public property." Bluffs will be published if comical but otherwise ignored. -JY SAFETY RULES FOR US STRATEGIC BOMBERS 5.1. Don't use nuclear weapons to troubleshoot faults. http://cryptome.org/afi91-111.htm

1 0

Re: Another John Young Sighting
by Tyler Durden 25 Aug '04

25 Aug '04

Variola wrote... >PS: I thought Tyler had nominated himself as leader? :-) No, almost the opposite. I propose that any 'Cypherpunk' can declare himself to be leader and make 'official statements' at any time. Of course, others can (and most probably will) choose to ignore the official statement, or even declare himself to be leader and 'officially' rescind that statement and/or issue a completely contradictory statement. This will be particularly useful when getting (for instance) public interest to move elsewhere. For instance, it might be usefulto have an official statement ready if/when the Cryptome press starts poking around Cypherpunks: FOR IMMEDIATE RELEASE Cypherpunks is a collection of diverse individuals dedicated to preserving the freedoms that all Americans value. As part of this effort, Cypherpunks periodically analyzes the systems used by terrorists and other enemies of freedom in an attempt to strengthen such systems and prevent their abuse. Indeed, Cypherpunks has good reason to believe that there are large cells of terrorists and other Men With Guns scattered throughout the nation, even in the DC Beltway area. Or, perhaps there's a "Suicide Girl" you've been stalking...erh, I mean trying to impress. You might try: FOR IMMEDIATE RELEASE Major Variola (Retired) was recently elected to be the President/Chief Executive Offiicer/King of the Cypherpunks Group(TM). Variola was considered by all to have not only formidable intellectual powers, but a large-ish penis as well. All members of the Cypherpunks list have promised to act upon any official statement by Variola, without delay or question, and around the world are toasting the new era of his leadership. All hail Variola. or "Dear Mr Mohammed: I am particularly interested in hearing more about your offer to transfer funds to an eGold account. Please send the money right away, and rest assured that you will have the full support of all members of the Cypherpunks list. And so on... -TD _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

5 4

Reason on Gilmore VS Ashcroft
by Sunder 25 Aug '04

25 Aug '04

http://www.reason.com/links/links082404.shtml ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"Our enemies are innovative and resourceful, and so are we. /|\ \|/ :They never stop thinking about new ways to harm our country /\|/\ <--*-->:and our people, and neither do we." -G. W. Bush, 2004.08.05 \/|\/ /|\ : \|/ + v + : War is Peace, freedom is slavery, Bush is President. -------------------------------------------------------------------------

1 0

RE: Another John Young Sighting
by John Kelsey 25 Aug '04

25 Aug '04

>From: "Trei, Peter" <ptrei(a)rsasecurity.com> >Sent: Aug 24, 2004 9:39 AM >To: Tyler Durden <camera_lumina(a)hotmail.com>, jya(a)pipeline.com, > cypherpunks(a)minder.net, cypherpunks(a)al-qaeda.net >Subject: RE: Another John Young Sighting ... > 5) CYA. Since 9/11, the lower echelons of the >security apparatus know that if Something Bad >happens, and they are shown to have discounted >any hint or suspicion concerning any person >even very peripherally involved, their ass is >grass and their career goes in the toilet. Yep, I think you hit it on the head. I'll bet the list of suspected terrorists never get a name removed other than by death, if then. Who wants to be the guy who correctly assessent the evidence to remove someone's name, only to have the same guy blow up a plane a year later? IMO, this seems like a fundamental problem with watchlists. >Peter --John Kelsey

1 0