- cypherpunks-legacy - lists.cpunks.org

Re: Sen. Patrick Leahy's PGP key now avail.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:36 PM 5/2/96, Will Rodger wrote: >Wanna write the good Senator on the occasion of his newest bill? His pub >key's out there. (URL is http://bs.mit.edu:8001/pks-commands.html#submit/ >) Why does anyone need his public key to communicate with Senator Leahy? If it's for sender-anonymity, this does not do it, though other tools (remailers) do. Unless the information is "secret," why bother? It adds extra time at his office's end (you don't think Leahy types in his password to PGP do you?), and it accomplishes little. >From a personal viewpoint, I'm glad my key is no longer very accessible. I used to get PGP-encrypted messages which had no earthly reason to be encrypted, except that people apparently wanted to practice their PGP skills. (For those who sent me items that had a reason to be encrypted, you know who you are and you know this comment does not apply to you.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: The Decense Project
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"rjc(a)clark.net" "Ray Cromwell" 10-FEB-1996 23:32:12.32 >The first piece of the Decense software is designed to provide "penet" like >double-blind anonymous transactions for the http protocol. It is written >as a cgi-bin script which provides a seamless mapping between anonymous >ids and remote web servers. Servers running Decense can be chained like >anonymous remailers to increase site level security. [...] >http://<decense.server.host>/<cgi-bin-dir>/decense/<anonid>/<relative url> I had one idea that you might want to keep in mind. Most web robots (e.g., Altavista's) try to avoid cgi scripts. Since I would assume that one would wish these to be indexed (information being available doesn't do much good if nobody can find it), this could be a problem. Setting up as to fool the web robots (especially making sure that the Decense urls aren't in the site's robots.txt file) into thinking this is a normal page with an appropriate link would appear to be a good idea. Now, of course the site running Decense would probably not like too much traffic (the reason for most sites not running anonymizing proxies, which should be combined with Decense), I would suggest that the system be set up to receive ecash from the web sites linked (or from the user, although that would remove the web robot access unless you could verify that it was a known indexing robot.) The MarkTwain pickiness on merchants may be a problem on this, depending on what links are available. One idea on getting around this would be to go through the European bank offering ecash; I don't know if their setup is compatible with the MarkTwain ecash, however. Lucky Green? Indeed, setting this up in a European country with good anti-censorship laws would be preferable in any event; the Scandinavian countries might work well. The greater tolerance for some such material in Europe is why I would think that the European bank might be more flexible. (I would be curious if a U.S. business could get a merchant agreement with the European bank; Lucky Green?). -Allen

1 0

Dole Backs Crypto Export
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Financial Times, May 3, 1996, p. 7. Dole backs removal of software export ban By Louise Kehoe in San Francisco Senator Bob Dole, the presumptive Republican presidential candidate, yesterday threw his support behind proposed legislation to remove US export restrictions on computer software used to encode Internet messages. The new Security and Freedom through Encryption bill introduced yesterday by several Republican senators and congressmen, also rejects a controversial Clinton administration proposal to enable law enforcement agencies to unlock encoded electronic messages. For Senator Dole, the encryption bill provides an opportunity to seek support from Silicon Valley high-tech leaders many of whom backed Mr Bill Clinton in 1992, and to boost his election campaign efforts in California. "The administration's misguided proposal on encryption amounts to a pair of cement shoes for Silicon Valley," said Senator Dole. "It seems to me that a new pair of track shoes might be a better answer. The administration's big brother proposal will literally destroy America's computer industry," he said. Encryption software is currently classified as "munitions" and exports are strictly limited by the US state department. US and other western intelligence and law enforcement agencies are opposed to the commercial use of the most powerful encryption methods which they argue could be used to mask criminal or terrorist activities by effectively preventing wire-taps. However, US software companies maintain that the current export restrictions threaten US pre-eminence in the world software market. A study by the Computer Systems Policy Project, a computer industry group, estimated that within four years the US economy would lose $60bn in revenues and roughly 216,000 jobs as a result of encryption export controls. Moreover, current regulations, which allow export only of "weak" encryption, are unacceptable because such encoding has been demonstrated to be ineffective. Last year, for example students in France were able to break encryption which is used in the export version of Netscape Communication's popular Internet browser software. The limited availability of strong encryption software is also blocking the progress of electronic commerce on the Internet, US computer experts argue, because companies and individuals are reluctant to make electronic payments over the Internet without assurance of security. -----

2 1

Re: "Bit Tax" proposed by satan@hell.gov
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:13 PM 5/3/96, Steve Reid wrote: >The problem with a tax on data is that it would be *extremely* unfair. Chill out, it's not a real proposal. >It would be like a tax on atoms. With a tax on atoms, the tax on a bag of >groceries would be hundreds of times greater than the tax on a diamond >ring, because there are more atoms in a bag of groceries > >Bits are the digital equivalent of atoms. With a tax on bits, the tax on >the download of an up-to-date virus scanner would be hundreds of times >greater than the tax on an emailed business contract. > >If this bit tax thing were attempted, the amount of time people spend >online would be determined entirely by their income; if you can't afford "Yeah, my tax guy really saved me a lot last year...he knows some really great data compression algorithms." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: encrypted Unix backup software
by VaX#n8 17 Dec '03

17 Dec '03

In message <199605030425.XAA05924(a)primus.paranoia.com>, Bill Stewart writes: >>Although I could probably hack up "catblock" to do the job, and use >>a line of the form >>dump -0uBf ... | symmetric_cipher | catblock blockfactor > /dev/tape >Yup [agrees on cmdline] >You don't need to write "catblock", though - there's the "dd" command >designed for just such applications... >Newer versions may handle multiple tapes a bit better. Hmm, I've got this a few times from people and I just wanted to clear up a few points. 1) BSD dd doesn't treat EOT specially: /* ... If a partial write, and it's a character device, just warn. If a tape device, quit. ... */ GNU dd (from what I remember) doesn't, either. 2) "dd" will only work safely across all tape types and all size pipes using the degenerate form "dd ibs=1 obs=(your_bf_here) conv=sync ...". I'll hack up catblock today. Who says we don't code :)

1 0

RE: Calling other code in Java applications and applets
by Blake Coverett 17 Dec '03

17 Dec '03

> For example one security restriction is that applets aren't allowed > to read files. If an applet calls a native method then that native > method can read any files it wants. I'm talking about the model, > not about the quality of implementation. I'm not saying it's > a bad or untrustworthy thing to do (call native methods), I just > thought it was worthwhile to point out that once you call a DLL > from an applet, you have effectively chosen to disable the application > level SecurityManager. It's your call as to whether this is a problem > or not. I was right in the first message... it is a reputation thing. We don't disagree on any of the fact here, just on their implications. I see this from the point of view of the author of these native methods, cypherpunk still do write code sometimes. From that point of view where is the difference between calling my native code methods and calling the java.awt.*, or netscape.* methods that are native code? Yes, either can do anything they want, irregardless of the SecurityManager. For J. Random User on the net, Sun/Netscape's reputations are fairly strong and mine is non-existent. For the corporate IS folks to whom I contract this situation is reversed. (Despite impressive IPOs I still get a lot of friction about 'programs downloaded from the net'.) -Blake

1 0

Re: PICS & CyberAngels
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"declan+(a)CMU.EDU" "Declan B. McCullagh" 4-MAY-1996 12:28:04.26 >Indeed. Under SafeSurf, I've rated the fight-censorship mailing list >archive site as suitable for all ages, which I believe it is, though the >CyberAngels think otherwise. I wonder what will happen now? SafeSurf is >supposedly sending me "an end-user license agreement" to sign... I believe this is another case, like that of the SafeSurf dislike of the mention of illegal drugs in any but the standard PDFA (sp?) manner, in which the Guardian Angels' politics are coming through. They may claim to be anti-CDA, but given their harrassment of various sexually-oriented businesses ("cleaning up Times Square" et al) their real opinions seem to be showing through. They'd make themselves even more unpopular if they were honest about it, of course. I have no doubt that, if the CDA is upheld (God forbid), they'll be secretly reporting violations to the DOJ. They already appear to have a policy of reporting allegedly "obscene" material. -Allen P.S. Feel free, anyone, to forward this (and my other stuff on the CyberAngels) to them. I'd like to see their defense, unless they're going to admit they don't have any.

1 0

Re: [Political Rant] Was: examples of mandatory content rating?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hal9001(a)panix.com" "Robert A. Rosenberg" 15-APR-1996 03:46:01.05 >At 18:52 4/14/96, E. ALLEN SMITH wrote: >>I'm not sure if the major use for ratings may not be searching for >>material that the raters don't like. I'd be interested in many things the >>fundys don't like, for instance. One could even do this via one of the >>"services" that mails out listings of places to be locked from kids - just >>sign up one of your anonymous employees, and get the data and put it on your >>anonymous web access site. Doing so - if you don't admit you've done it - may >>be cheaper than doing the research yourself. Of course, you'll need to check >>out each such site to make sure that it isn't a decoy that they've inserted. >When you do the checking, make sure it is from an IPN that does not point >back at you (or at least only points to a Server Supplied not a Dedicated >IPN). You might also want to watch out for "Canary Trap" Decoys (where each >list has an unique set of Decoys [or at least one unique Decoy] so they can >tell which copy was compromised). I'm assuming that the Decoy is a "valid" >[possibly virtual] domain address which is being logged. The way to get around the second problem is to sign up with such a "service" twice, then filter out anything not appearing on both. Since at least some of the parental censorship "services" have customization for the parent, doing more than one would also be a means to pick up more specific evaluations of the sites in question. -Allen

1 0

Reputation Webs and Java/Applet Security
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:10 PM 5/4/96, Blake Coverett wrote: >I was right in the first message... it is a reputation thing. We don't >disagree on any of the fact here, just on their implications. > >I see this from the point of view of the author of these native methods, >cypherpunk still do write code sometimes. From that point of view >where is the difference between calling my native code methods and >calling the java.awt.*, or netscape.* methods that are native code? Yes, >either can do anything they want, irregardless of the SecurityManager. > >For J. Random User on the net, Sun/Netscape's reputations are >fairly strong and mine is non-existent. For the corporate IS folks to >whom I contract this situation is reversed. (Despite impressive IPOs >I still get a lot of friction about 'programs downloaded from the net'.) By the way, I think "reputation webs" may get one of their earliest uses in this situation, with applets or chunks of code being "vouched for" by testing or credentialling agencies, analogous to Good Housekeeping Seals and Underwriter's Laboratories. (This model applies to more than just Java applets, of course. To some extent, reviews of programs and testing of snippets of code has always involved this "reputation rating" process...I'm just suggesting it could be implemented in-line with the runtime environment....) While we often talk about the human example, where we want to do nifty things like rank and rate the postings of J. Random User by what others we trust (or don't trust) are saying, the fact is that most people are willing to see what J. Random User is writing and judge for themselves. Hence, reputation markets (what I'm calling "reputation webs," as with "webs of trust") have been slow to take off in human communication circles. (At least automated, that is.) For Java applets, once digital signatures are supported we have the possibility of automating the checking of who has said good things about the applets, who has said bad things, how much faith we place in these opinions, and so on. Almost a class hierarchy in itself (though mix-ins might be useful, as the hierarchy is not strictly single-inheritance, it seems). Thus, the "Wall Street Testing Agency," with various stringent policies about what applets can do and what they must not be allowed to do, may have ratings of applets, keeping even Perry happy. Someone at a Wall Street firm could then screen out applets based on these ratings. Others might have completely different criteria. (And the web could change dynamically, as the user's environment changed. For example, a PC used largely for games will likely have a different model of whom to trust than a workstation used for high finance. And one could imagine moving sensitive files to a removable disk, popping out this disk, and then altering the settings to reflect a lower perceived risk.) Virus checking is to some extent already in this model, with "well-regarded" virus checkers acting as a gatekeeper of sorts. One might even (hopefully!) be able to integrate this directly into one's programming environment. Maybe the "SecurityManager" class could be turned into a "ReputationManager" class, with today's "SecurityManager" being just one of many possible configurations (e.g., the one JavaSoft is recommending). And the NSA and NCSC might have their own "Orange Book" sorts of requirements. Let a thousand flowers bloom...but keep track of their reputations. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: A MODEST PROPOSAL (fwd)
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:05 PM 5/4/96 EDT, "E. ALLEN SMITH" <EALLENSMITH(a)mbcl.rutgers.edu> wrote: > The reason I say majordomo is broken is that it shows up > with the address of the original sender, not the address of the list, > as the From address. Other mailing list software does not do this. I think that's user-settable, but there is no ideal approach. Cypherpunks tried several different approaches to addresses, and settled on this one as causing the least overall problems. The big advantage is that replies go to the original sender by default rather than to the list (which reduces the amount of personal mail going to the list, winning both on noise-reduction and embarassment-reduction); the disadvantage is that bouncemail goes to the original sender, rather than the list or the list-manager (bouncemail to the sender is annoying, but minor; bouncemail to the list is extremely annoying, as well as potentially causing mail loops, which are an extreme lossage. Bouncemail to the list-manager is ideal (not that the list-manager usually reads it), but it's hard to get without reducing replies directly to originators, as well as increasing replies accidentally going to the list-manager. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

2 1