- cypherpunks-legacy - lists.cpunks.org

FWD: PGP-fone Mailing List Archive
by Bill Stewart 17 Dec '03

17 Dec '03

>Date: Fri, 20 Dec 1996 07:32:52 -0500 (EST) >From: "Fred B. Ringel" <fredr(a)rivertown.net> >To: pgp-fone(a)rivertown.net >cc: pgp-users list <pgp-users(a)rivertown.net> >Subject: Mailing List Archive >Hi all- > > Finally got around to doing something I had meant to do. I have set >up an HTML-ized version of the PGPfone Mailing List archives. It is >reachable off the PGP Fone Registry, but the exact URL is : > > http://pgp.rivertown.net/pgp-fone/archives > >Now any newcomers to the list will find it easier to catch up, or if you >need to look something up, the archives are indexed by date, author, >and subject/thread. Hope you find it useful. Until I figure out how to >update it automatically over an NFS mounted system, I will manually update >them at least once a week. > > I'm sending this to PGP-Users too so anyone interested in the >PGPfone list can get a taste of what is going on there. The PGPFone list is >up to almost 100 subscribers and growing (tell your friends!!) > > Fred >/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ >Fred B. Ringel -- Rivertown.Net Internet Access >Systems Administrator -- http://www.rivertown.net >and General Fixer Upper -- Voice/Fax/Support: +1.914.478.2885 > > > # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: Ebonics
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> wrote: >In order to remain compliant with the new California law requiring >increased use of "Ebonics," the new academic name for "Black English" (and >known by honkey mofos as "ghetto jive"). Apparently the coloreds have had >enough of "standard English" and its repression of their culture. To meet >the requirements of this new law, 10% of my posts from now on will be >written as best I can manage in the Ebonic language. ("Ebonics" elided) There's got to be a better way than Ebonizing manually. First there was the Canadianizer, eh, hoser? Then there was Zippy (www.metahtml.com/demos/zippy/) which is terrific for Willy/Freeh/Reno speeches. We really need an Ebonizer (TM)! BTW, Tim's not kidding about the Oakland, CA school system. Check your regular news source.

3 2

Re: Code+Data separation
by azur＠netcom.com 17 Dec '03

17 Dec '03

>At 12:08 PM -0800 12/19/96, Peter Hendrickson wrote: >>Are there any modern processors which keep the code and data separated? > A Harvard architecture is a common feature of signal processing chips. A number of japanese DSP chips (especailly for image processing) in the early 90's used this approach. I believe some earlier models in the TI 34000 series did also. Not sure about the current crop. -- Steve

1 0

Re: Executing Encrypted Code
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:25 PM 12/20/1996, Andrew Loewenstern wrote: >Peter Hendrickson writes: >> I would expect software prices to drop because everybody using >> the software would be paying for it. > I don't mean to sound rude or insult you personally, but this is utterly > absurd. If everyone is paying for the software then the company would be > making even MORE money. Only a fool would want to make less money!! If >money > wasn't important to these people they wouldn't be in the business of selling > software in the first place! > Aside from putting a gun to people's heads, the only thing that lowers >prices > is competition. Yes, I was assuming a free market. Sorry if that was not clear. Not only would software companies face competition in the decrypting-processor market, but they also face competition with other packages running on other platforms. Presumably customers would need some sort of reason to use the decrypting-processor. Some companies may choose lower price. > Only a fool would want to make less money!! I agree completely! >> It is not out of the question for software vendors to sell >> two versions of the same software. One is the piracy-free >> version and the other is the copy-as-much-as-you-can version. >> I would expect the piracy-free version to be substantially >> cheaper. > That would render the entire scheme pointless. It only takes _____ONE_____ > copy of the software to get out for the whole world to pirate it. This was discussed a few posts back. Let's say you manage to get the secret key out of the decrypting-processor. That gives you the executable which could run on any decrypting-processor. Since it is not authenticated (*) you can't run it on another decrypting-processor. You can run it in emulation someplace else, but a heavy performance price is paid. If the leading edge processors are all decrypting-processors, a very heavy performance price is paid. If the instruction set is kept secret, even writing an emulator could become hard. (* I am being inconsistent, incidentally. At one point I said that software would be authenticated once, but I now realize that to prevent multiple uses it has to be authenticated for use on a particular processor, too.) Peter Hendrickson ph(a)netcom.com

1 0

Security hole in premail
by Mixmaster 17 Dec '03

17 Dec '03

There's a pretty nasty bug in premail that allows any non-root to obtain the contents of the premail secrets file. This is a race condition that can be exploited because an indefinite amount of time can pass between the time that premail checks if the secrets file exists and when it tries to write to the file. It can be exploited as follows: attacker: $ umask 111 $ ln -s ~/premail-secrets-file /tmp/.premail-secrets.$< normal user: $ premail -login Remember to logout when done. Your premail passphrase, please: All the attacker has to do is execute "touch premail-secrets-file" between the time that the user is prompted for the passphrase and the time when the login is completed. $ ls -al premail-secrets-file -rw-rw-rw- 1 d00d nogroup 19 Dec 20 19:01 premail-secrets-file $ cat premail-secrets-file [contents of premail secrets file] This bug can be fixed in two ways. One way is to set the premail-secrets setting to some non-world-writable directory. The second way is to apply the following patch: *** premail.orig Fri Dec 20 18:46:01 1996 --- premail Fri Dec 20 18:55:54 1996 *************** *** 3574,3579 **** --- 3574,3582 ---- } for ($triesleft = 2; !$done && $triesleft; $triesleft--) { $pass = &getpass ($x); + if(!-O $ps) { + &error ("Secrets file exists and is owned by another user\n"); + } $status = &decrypt_secrets ($ps_pgp, $ps, $pass); if (!-s $ps) { unlink $ps; } $done = (!$status && -e $ps);

1 0

Re: Credentials without Identity--Race Bits
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

aaron(a)herringn.com wrote: >Flew down to LA recently with a firearm (checked, of course). > >Looking over the ticket later, I was mildly surprised to find "GUN" in >a string of otherwise unintelligible text. This is a case of damned if you do, damned if you don't. The last time that I declared (as the legal notices at the check-in podium admonished me to do) a firearm in my luggage, my bag sported a large, chromium yellow GUN tag that also featured a graphic representation of a pistol (I guess for baggage handlers who can't read, or can't read English, and would still like to take advantage of one of the perks of their position).

2 1

RE: Life with Dale
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May [.....]what was left of her [is] rotting in a grave somewhere north of me. ....... [...] interestingly, the Cypherpunks had a big beach party between Pescadero (where Dubroff lived) and Half Moon Bay (where she flew out of) just a couple of days prior to her departure. (This was the beach party put together by Doug Barnes, last spring.) ....................................................... Coincidence? .. Blanc <g> > > > >

1 0

Dale defends free society from the NSApunks (was Re: Encryption ?
by nobody＠replay.com 17 Dec '03

17 Dec '03

I thought this was so funny I've saved it. Perhaps we could vote on the quality of Dale's ideas and arrive at an estimate of the proportion of NSA supporters on the list. THE AKOND OF SWAT :Date: Thu, 19 Dec 1996 07:36:03 -0800 :From: Dale Thorn <dthorn(a)gte.net> :To: SHARK <otaner(a)boun.edu.tr> :Cc: cypherpunks(a)toad.com :Subject: Re: Encryption ? : :SHARK wrote: :> :> I am a Mathematic student at Bosphorus University in Turkey. :> I am interested in both computer applications and mathematical base of :> encryption.Where can I find this kind of staff on internet. :> Is it necessary to have high level of mathematical background in order to :> deal with encryption?? :> :> By the way Is there any member of this list from Turkey? : :There are a lot of NSA people here on cypherpunks, and they try very :hard to control encryption, to make everyone think it is difficult, to :discourage independent inquiry. : :That is the main reason they accuse people of being snakeoil vendors, :to discourage people from inquiring about really new ideas, like some :of my ideas for example. : :Just so you know....

3 2

Re: Proof that "cypher punks" have complete degenerated...
by geeman＠best.com 17 Dec '03

17 Dec '03

At 09:08 AM 12/19/96 -0800, you wrote: >geeman(a)best.com wrote: >> It wasn't worth commenting on. >> Appending data after the ctrl-Z as stego? >> Not even worth a letter to the ed! > >> Dr.Dimitri Vulis KOTM wrote: >> > No one even commented on the latest Dr. Dobbs issue. > >After seeing the initial post, I ran out to get a copy, but they were >all gone. I find it hard to believe that appending data to a file is >considered stego, even by a commercial publication such as Dr. Dobb's. >Can anyone confirm this? > Well, there it is, indeed. I couldn't friggin believe it, since I've written for them and usually the stuff's pretty good. A program to append data after a text file's ctrl-Z EOF byte. If you _really_ want it secure, crypt it with the compiler's PRNG. ;)

1 0

RE: Reflections on the Bernstein ruling
by Blake Coverett 17 Dec '03

17 Dec '03

Greg Broiles wrote: > In brief, Judge Patel ruled that Category XIII(b) (the category which > refers to cryptographic equipment/software) is unconstitutional because it > functions as a prior restraint upon speech without providing important > procedural safeguards which are required when a prior restraint scheme is > put into place. She ruled that the "technical data" provision of the ITAR > is also unconstitutional when it refers to technical data about Category > XIII(b) items because of the lack of procedural safeguards. I'm not even remotely a lawyer, but I have to disagree with the second sentence above. As I read it Judge Patel believes that the technical data provisions are also unconstitutional but can not rule that way because United States v. Edler, 579 F.2d 516 (9th Cir. 1978) is the law in the 9th circuit. The relevant quote is: While this court is inclined to agree, despite revisions to the ITAR since 1984 and especially in light of Freedman and FW/PBS, Edler remains the law of this Circuit and this court is bound by its holding.[13] Moreover, Edler was reaffirmed, albeit in cursory fashion, by the Ninth Circuit in 1989. United States v. Posey, 864 F.2d 1487, 1496 (9th Cir. 1989). If the Ninth-Circuit wants to reconsider those opinions it is free to do so, but that decision is theirs to make. Happily she does go on to say that because she has ruled that Category XIII(b) is unconstitutional that the technical data provisions for items relating to XIII(b) are unenforceable. regards, -Blake

1 0