September 2004 - cypherpunks-legacy

Re: will spammers early adopt hashcash? (Re: Spam Spotlight on
by Adam Back 13 Sep '04

13 Sep '04

Reputation) User-Agent: Mutt/1.4.1i Ben and Richard CLayton's paper makes several assumptions and we'll see how those pan out in the field as time goes on. We don't really know what the true cost of maintaining ownership of many machines. No doubt much lower than it should be because of poor security on microsoft OSes. But even so there must be some turn over as the user instals AV, firewalls, gets cut off by ISP, gets IP blacklisted etc. The general argument is in the FAQ quoted below. Essentially whatever resources spammers do have, hashcash is going to slow them down because the balance of CPU power vs bandwidth is such that 20-bit hashcahs with current hardware is likely to slow down the output of a typical consumer destkop+DSL line down by afact or 10-100x less spam. (Depnds on CPU power, DSL uplink, and number of Bcc recipients per message). Hashcash costs equal cpu per Bcc recipient. Without hashcash Bcc recipients to the same domain or to a hub cost a tiny bit of bandwidth -- the size of the email address (+"RCPT TO \r\n"). Will it be enough -- we don't know yet, but if widely deployed it would make spammers adapt. We just don't yet know how they will adapt. The other question Ben & Richards paper doesn't explore is the CAMRAM way of using hashcash. In this model you only pay hashcash for _introductions_. After parties have replied to a mail, the mail is whitelisted (short term by address only (risky no auth, joe-job hazard) medium term with CAMRAM email header signatures). If simple hashcash per mail turns out not to be enough, CAMRAM can increase the work factor, as people do not reply to spammers; and many emails are to-and-fro vs first introduction emails. (So the sender can afford to pay more on average). Eric sent a spreadsheet with some of this type of calculation. There may also be some mileage in Hal Finney's RPOW http://www.rpow.net where the legitimate user can re-use stamps he receives. (The scaling issues of the RPOW servers would need to be engineered carefully, there are servers, they can be per eg domain , but still compared to hashash this is more infrastructure as hashcash is pure end-to-end). Adam http://www.hashcash.org/faq/ 2c and 2d | 2c But won't spammers steal CPU time? | | Spammers already compromise security on many users machines to make | so-called "Zombie" armies to send spam from. However currently the | rate at which spammers can send mail on a zombie machine is limited | purely by the speed of those machine's internet links. A typical DSL | user might be able to send 25 unique messages per second each of size | 1KB (assumes 256kbit uplink). Or many more messages per second if the | messages are delivered to multiple users at once (using multiple Cc or | Bcc recipients). Even a 20-bit stamp takes 1/2 second per recipient on | the highest end pc hardware at time of writing. This would slow | spammers down by a factor of 10-100 or more per compromised machine | (depending on whether the messages sent are sent individually or to | many users at once). | | 2d But won't spammers deliver to many recipients at once? | | Spammers commonly optimize the amount of spam they can send over a | given link speed by delivering messages to 100s or 1000s of Bcc | recipients at once directly to an end-site, or to an ISP mail-hub. In | this way they can consume just 3.5KB of bandwidth in sending messages | to 100 recipients compared to the 100KB which would be used to send | each message separately. This would allow a spammer to send 700 | messages per second (assumes DSL with 256kbit uplink). | | Delivering in batches reduces the degree of customization the spammer | can make because all of the message bodies in a batch have to be the | same, but never-the-less is a trick spammers commonly use to increase | the number of mails per second they can send. | | However with hashcash a separate stamp is required for each individual | recipient, which stops this spammer trick. If the spammer has to put a | hashcash stamp for each recipient, even a 3Ghz Pentium 4 can only | generate 2 stamps per second, compared to 700 per second with no | hashcash, so using hashcash in this scenario slows the number of mails | the spammer can send by 350x. Adam On Mon, Sep 13, 2004 at 10:37:47AM -0400, Adam Shostack wrote: > On Mon, Sep 13, 2004 at 01:18:32PM +0100, Ben Laurie wrote: > | Adam Shostack wrote: > | > | >On Tue, Sep 07, 2004 at 04:13:13PM -0400, Adam Back wrote: > | > > | >| Well we'll see. If they have lots of CPU from zombies and can get and > | >| maintain more with limited effort maybe even they can, and CAMRAM's > | >| higher cost stamp on introductions only will prevail as the preferred > | >| method. > | > > | >Adam, > | > > | > You've thought about this more than me. What do you see as > | >equilibrium postal rates if the spammers have 10k, 100k, or a million > | >nodes to send? > | > > | > Will spammers run under nice? Use your graphics card as a > | >co-processor? Is the rate of new vulns high enough to keep their CPU > | >pools filled? > | > | We have some figures for that kind of stuff in > | http://www.apache-ssl.org/proofwork.pdf. > > Thanks! That was exactly what I was hoping wouldn't get said, because > I no longer believe that hashcash is substantially useful. > > Adam S --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: will spammers early adopt hashcash? (Re: Spam Spotlight on
by Adam Back 13 Sep '04

13 Sep '04

Reputation) User-Agent: Mutt/1.4.1i Ben and Richard CLayton's paper makes several assumptions and we'll see how those pan out in the field as time goes on. We don't really know what the true cost of maintaining ownership of many machines. No doubt much lower than it should be because of poor security on microsoft OSes. But even so there must be some turn over as the user instals AV, firewalls, gets cut off by ISP, gets IP blacklisted etc. The general argument is in the FAQ quoted below. Essentially whatever resources spammers do have, hashcash is going to slow them down because the balance of CPU power vs bandwidth is such that 20-bit hashcahs with current hardware is likely to slow down the output of a typical consumer destkop+DSL line down by afact or 10-100x less spam. (Depnds on CPU power, DSL uplink, and number of Bcc recipients per message). Hashcash costs equal cpu per Bcc recipient. Without hashcash Bcc recipients to the same domain or to a hub cost a tiny bit of bandwidth -- the size of the email address (+"RCPT TO \r\n"). Will it be enough -- we don't know yet, but if widely deployed it would make spammers adapt. We just don't yet know how they will adapt. The other question Ben & Richards paper doesn't explore is the CAMRAM way of using hashcash. In this model you only pay hashcash for _introductions_. After parties have replied to a mail, the mail is whitelisted (short term by address only (risky no auth, joe-job hazard) medium term with CAMRAM email header signatures). If simple hashcash per mail turns out not to be enough, CAMRAM can increase the work factor, as people do not reply to spammers; and many emails are to-and-fro vs first introduction emails. (So the sender can afford to pay more on average). Eric sent a spreadsheet with some of this type of calculation. There may also be some mileage in Hal Finney's RPOW http://www.rpow.net where the legitimate user can re-use stamps he receives. (The scaling issues of the RPOW servers would need to be engineered carefully, there are servers, they can be per eg domain , but still compared to hashash this is more infrastructure as hashcash is pure end-to-end). Adam http://www.hashcash.org/faq/ 2c and 2d | 2c But won't spammers steal CPU time? | | Spammers already compromise security on many users machines to make | so-called "Zombie" armies to send spam from. However currently the | rate at which spammers can send mail on a zombie machine is limited | purely by the speed of those machine's internet links. A typical DSL | user might be able to send 25 unique messages per second each of size | 1KB (assumes 256kbit uplink). Or many more messages per second if the | messages are delivered to multiple users at once (using multiple Cc or | Bcc recipients). Even a 20-bit stamp takes 1/2 second per recipient on | the highest end pc hardware at time of writing. This would slow | spammers down by a factor of 10-100 or more per compromised machine | (depending on whether the messages sent are sent individually or to | many users at once). | | 2d But won't spammers deliver to many recipients at once? | | Spammers commonly optimize the amount of spam they can send over a | given link speed by delivering messages to 100s or 1000s of Bcc | recipients at once directly to an end-site, or to an ISP mail-hub. In | this way they can consume just 3.5KB of bandwidth in sending messages | to 100 recipients compared to the 100KB which would be used to send | each message separately. This would allow a spammer to send 700 | messages per second (assumes DSL with 256kbit uplink). | | Delivering in batches reduces the degree of customization the spammer | can make because all of the message bodies in a batch have to be the | same, but never-the-less is a trick spammers commonly use to increase | the number of mails per second they can send. | | However with hashcash a separate stamp is required for each individual | recipient, which stops this spammer trick. If the spammer has to put a | hashcash stamp for each recipient, even a 3Ghz Pentium 4 can only | generate 2 stamps per second, compared to 700 per second with no | hashcash, so using hashcash in this scenario slows the number of mails | the spammer can send by 350x. Adam On Mon, Sep 13, 2004 at 10:37:47AM -0400, Adam Shostack wrote: > On Mon, Sep 13, 2004 at 01:18:32PM +0100, Ben Laurie wrote: > | Adam Shostack wrote: > | > | >On Tue, Sep 07, 2004 at 04:13:13PM -0400, Adam Back wrote: > | > > | >| Well we'll see. If they have lots of CPU from zombies and can get and > | >| maintain more with limited effort maybe even they can, and CAMRAM's > | >| higher cost stamp on introductions only will prevail as the preferred > | >| method. > | > > | >Adam, > | > > | > You've thought about this more than me. What do you see as > | >equilibrium postal rates if the spammers have 10k, 100k, or a million > | >nodes to send? > | > > | > Will spammers run under nice? Use your graphics card as a > | >co-processor? Is the rate of new vulns high enough to keep their CPU > | >pools filled? > | > | We have some figures for that kind of stuff in > | http://www.apache-ssl.org/proofwork.pdf. > > Thanks! That was exactly what I was hoping wouldn't get said, because > I no longer believe that hashcash is substantially useful. > > Adam S --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: "Forest Fire" responsible for a 2.5mi *mushroom cloud*?
by Major Variola (ret) 13 Sep '04

13 Sep '04

At 06:59 AM 9/14/04 +1200, Peter Gutmann wrote: >(The nitrate was desensitised with ammonium sulfate and stored outside, >whenever anyone needed any they'd drill holes and blast off chunks with >dynamite. AN is extremely deliquescent; perhaps the sulphate was for that? Removing chunks with dynamite is trying rather hard for a Darwin award. When I was a teen I would save the instant-cold packs after soccer games, and recrystalize the AN within. It melts and gives off bubbles but I never collected enough N20 nor did it detonate.

3 2

Re: Flying with Libertarian Hawks
by Tyler Durden 13 Sep '04

13 Sep '04

Damn right. 'Conservative' means agreeing with the most vocal proponents of the current right wing apparatchiks. It seems to have little or no relationship to fiscally conservative ideas. "Left wing" now refers to anyone who disagrees with the 'Conservatives', even if said left wing policies are practically identical to those of the 'right'. -TD >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: cypherpunks(a)al-qaeda.net >Subject: Re: Flying with Libertarian Hawks >Date: Fri, 10 Sep 2004 05:53:06 -0700 > >At 07:53 AM 9/10/04 -0400, R. A. Hettinga wrote: > ><http://www.techcentralstation.com/090904A.html> > > > >Is it possible for one to be libertarian about policies at home and > >neo-conservative about policies abroad? After all, isn't the principle >of > >non-coercion incompatible with the interventionist policies of the >current > >Administration? Simply put: is there such an animal as a libertarian >hawk > >and if he exists, why do we so seldom hear from him? > >On the contrary, the Ayn Rand institute has been taken over by >vocal Zionists. They would never bomb Dimona but if a non-israeli >semite even thinks about uranium, its missiles away. > >Or if the South Koreans do a bit of clandestine enrichment, no big deal, > >they're "our" *friends*. > > >----- >"Stop shedding our blood to save your own and the solution to this >simple > but complex equation is in your hands. You know matters will escalate >the more you >delay and then do not blame us but blame yourselves. Rational people do >not risk their >security, money and sons to appease the White House liar." UBL > >The only language the American people understand is >dead Americans. -EC _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

3 2

Re: will spammers early adopt hashcash? (Re: Spam Spotlight on Reputation)
by R. A. Hettinga 13 Sep '04

13 Sep '04

--- begin forwarded text

1 0

Re: "Forest Fire" responsible for a 2.5mi *mushroom cloud*?
by Thomas Shaddack 13 Sep '04

13 Sep '04

On Sun, 12 Sep 2004, J.A. Terranson wrote: > "No big deal"? Who are they kidding? A 2-mile wide cloud is WAY too big to be caused by a single explosion, unless REALLY big. The forest fire claim sounds more plausible in this regard. An existing cloud could be used for masking, though. But a surface or atmospheric blast would produce a flash plowing through the entire EM spectrum; from long-wave radio to microwaves to hard gamma. That's something the satellites Up There can't miss even through a smoke cloud - at least if they are still operational or replaced by newer ones. (Remember the strong flashes of gamma bursts, originally discovered by satellites observing the nuclear test ban: <http://science.nasa.gov/newhome/headlines/ast19sep97_2.htm>.) Also a disruption of this kind would be perceivable in long range, possibly by quite many people. An underground blast, if not screwed up, wouldn't produce a cloud at all. However, both surface and underground blast would have a peculiar seismic signature. There is a network of both nonproliferation-surveillance and plain old scientific seismic stations all over the world. Something like that couldn't stay hidden for too long. Remember the day the the Kursk submarine became famous; the recording of the double signature, the explosion and shortly later following implosion, appeared online in couple days (or maybe even hours?) after the Event. It's difficult to imagine a true nuclear blast would stay unreported for more than few days. Even if it would really be a nuke test and the politicians would want to be quiet about it, there are too many subjects outside of the direct US political control to either report the measurements or the eventual pressure to not report them. According to CNN, there was also a strong blast reported in the area of a missile base. We don't know how strong the blast was, and if it couldn't be just a "conventional" explosion, caused by eg. a combination of a forest fire and an ammo depot. There is also a possibility the "senior officials with access to intelligence" were injecting media with false information. Remember there are many subjects with different agendas here and a little psyops here and there is quite common. Let's not jump on the conclusions yet. Wait 2-3 days, optionally watch the traffic in conferences of geologists taking care of the seismic activity worldwide and in the vicinity of the area of interest. It's Saturday and many people who could know the answers are away from their instruments; let's wait what they will find on their screens on Monday morning.

6 10

[ISN] Mitnick movie comes to the US
by R. A. Hettinga 13 Sep '04

13 Sep '04

I wonder if they include Shinomura boffing Gilmore's girlfriend in the Toad Hall hot tub? "Got Skills" indeed... Cheers, RAH --- begin forwarded text

1 0

Re: potential new IETF WG on anonymous IPSec
by Major Variola (ret) 13 Sep '04

13 Sep '04

Currently BGP is "secured" by 1. accepting BGP info only from known router IPs 2. ISPs not propogating BGP from the edge inwards Its a serious vulnerability (as in, take down the net), equivalent to the ability to confuse the post office machinery that sorts postcards. All you need to do is subvert some trusted routers. At 10:54 PM 9/10/04 -0700, Bill Stewart wrote: >Also, the author's document discusses protecting BGP to prevent >some of the recent denial-of-service attacks, >and asks for confirmation about the assertion in a message >on the IPSEC mailing list suggesting > "E.g., it is not feasible for BGP routers to be configured with the > appropriate certificate authorities of hundreds of thousands of peers". >Routers typically use BGP to peer with a small number of partners, >though some big ISP gateway routers might peer with a few hundred. >(A typical enterprise router would have 2-3 peers if it does BGP.) >If a router wants to learn full internet routes from its peers, >it might learn 1-200,000, but that's not the number of direct connections >that it has - it's information it learns using those connections. >And the peers don't have to be configured "rapidly without external >assistance" - >you typically set up the peering link when you're setting up the >connection between an ISP and a customer or a pair of ISPs, >and if you want to use a CA mechanism to certify X.509 certs, >you can set up that information at the same time.

1 0

Re: "Forest Fire" responsible for a 2.5mi *mushroom cloud*?
by Major Variola (ret) 13 Sep '04

13 Sep '04

At 06:23 PM 9/12/04 -0400, Tyler Durden wrote: >I had thought that one of the main tests was seismic...from what I >understood, Seismic monitors in the US can detect nu-cu-lar tests (above or >below ground) and even guess where and the size of the blast. Yes. Seismic sensors see some foreshock activity before an earthquake including the big ones. A nuke starts instantly. Standard S & P wave triangulation gives you the location. You can try to hide a blast (in sand; or in an excavated void) but its tough. At 06:50 AM 9/13/04 +0200, Eugen Leitl wrote: >About 4.5 kT of 50:50 ammonium nitrate/ammonium sulfate mix. One of the >largest, if not *the* largest nonnuclear explosions ever. Ammonium sulphate would not have exploded. Its the nitrate that is the fun group. It has an oxygen surplus, so anythign (like the rest of the ship) vaporized by the detonation would probaby burn. Fuel oil is cheap; aluminum dust is more energetic. At 10:40 PM 9/12/04 -0700, Bill Stewart wrote: >No FO, just AN all by itself. NH4NO3 turns into N2 + 2H2O + O, Slow decomposition yields nitrous oxide, ie the fun oxide. 19th century chemistry. (And anesthesiology!) >The first earthquake-like event I experienced was when a >chemical plant across the river from where I lived blew up; >I think it was a fertilizer plant of some sort. >(I was in Delaware; the plant was in New Jersey, and it was ~1968.) The DuPont black powder & nitro plants in Delaware have three strong walls, the weak side faces the river. When they blow up, its much safer. Unless you're on the river, of course. The N Korean blast could have been their missiles blowing up due to screw ups. There's a lot of energy in the fuels. Or it could have been a test of their nuke-testing systems. The media uses the phrase "October surprise", if NK detonates just before the elections. Of course, others are working on their own October gift to W. When the WTC towers fell, it was something like a 3 on the Richter scale. Lots of gravitational energy.

1 0

Re: "Forest Fire" responsible for a 2.5mi *mushroom cloud*?
by Tyler Durden 13 Sep '04

13 Sep '04

"Ken Brown" wrote... > >And if there was such a test, how long before China stomped all over them. >Last thing they want is a looney dictator with nukes on their borders (If >only to pre-empt Russia, US, or Japan intervening). Even if both the >Chinese state capitalists and the North Korean absolute divine monarchy >still use the locally redundant word "Communist" when describing themselves >to us Western barbarians. I think this pretty much nails it. Actually, I was imagining that there was still enough relationship left between PRC and NK for the Chinese to say, "Uh, a nuclear test would not be a good idea", meaning (in Chinese speak), "No way you're gonna do that". I'm sure the Chinese at this point regard their relationship with NK as baggage, though I know the Chinese do re-patriate NK refugees, so they're at least maintaining pretenses. -TD _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! hthttp://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0