- cypherpunks-legacy - lists.cpunks.org

Re: Sendmail Bugs
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > There is a document on alt.security which describes exploitable sendmail > > bugs. The reference is <809544856snz(a)hacknet.demon.co.uk> > > I saved a copy in case anyone would like one. > > Would you please email me a copy of that doc-file? > > I would find it very interesting... :-^) > 8lgm has released a lot more of their exploit information to the public as well including a lot of sendmail stuff...I wouldn't be surprised if that was the source of this. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

Non-US SSL128 site
by Donald M. Kitchen 17 Dec '03

17 Dec '03

Saw this on usenet. Figured someone might want to give it a spin... From: John Hemming - Chief Executive MarketNet <johnhemming(a)mkn.co.uk> Newsgroups: sci.crypt Subject: Announce>128 bit RC4 SSL available outside US Date: 30 Aug 1995 10:16:39 GMT Message-ID: <421dq7$rk4(a)marble.Britain.EU.net> NNTP-Posting-Host: 193.119.26.63 We have now updated our servers to a) Use 128 bit SSL if the client allows it. b) Tell users which cipher is being used on a secure session. To experiment point your secure client at one of the following: https://193.118.187.101/ https://193.118.187.102/ https://193.118.187.105/ https://193.118.187.111/ (the main server does not run SSL to minimise PK calculations) If you do not have a client that can use 128 bit RC4 then ftp://193.119.26.70/mktnet/pub/horse.zip does to the job, but is quite flaky otherwise.

2 1

Where is Secure Drive 1.4?
by scottg＠b4a206.mdc.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- <Decloaking after 3+ years> Hi Folks, I have a previous version of SecureDevice (v1.3). Is v1.4 the current version or something higher? Where is an FTP site so I can grab it? TIA, scott gallaher <scottg(a)b4a206.mdc.com> | I believe in the 1st Amendment. TECO Master & DBA | Pornography is just a fringe benefit. PGP Key fingerprint: AD A8 C9 AA D7 D3 6A E3 0C 58 5A 10 41 37 45 EE GCS d- s+: a C++++ U->L++++ P? L>+++ !E[teco+++] W N++ k- w--- !O M- V$ PS+ PE Y++ PGP(++) t+ !5 X R(++) tv+ b++(+++) DI+ !D G e++ h----(*) r+++ y++++(++*) -- Geek Code V3.0 <Resuming lurking mode...> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBME4SV9PstJd5R1NxAQFN9wH/UYh59UzgBKotUs/HDYJ7jHEPlcmOIy/E Zo74KQcSb9QtaPMntSpHiZq3W1ZaIRrl+jx9HkZbsBbXHRVi7+HGXQ== =xvbE -----END PGP SIGNATURE-----

1 0

Re:
by Peter Trei 17 Dec '03

17 Dec '03

> From: Mix <mixmaster(a)remail.obscura.com> > To: cypherpunks(a)toad.com > The optional penis smiled as the blue arc-phase > crossed the scamper gap. There were many of us > who felt gloved by the discharge, as if irradiated > with baby milk powder. > Later, the arc-monster cried quietly in the > humming chair, whilst remaining still enough > for the scamper gloves to plunge authoritatively. > - A'Tak A'Tdorn I assume that messages of this type are some form of steganographic communication. I just wish that they were in alt.anonymous.messages: here they are just noise to most of us (though I suspect John Young parses them just fine :-). At least they're more entertaining than Platypus' 'agraphic typo' technique. Peter Trei

1 0

Re: Commerce Department encryption rules declared unconstitutional
by John Young 17 Dec '03

17 Dec '03

Declan wrote: >I think that's about right. One of the important questions was how broadly >Patel would rule, whether her ruling would apply just to Bernstein & >associates or whether she would enjoin the government from enforcing >ITAR/EAR at all. > >Unfortunately, she chose the former. But look on the bright side: her >narrow decision may be less likely to be reversed, no? Does this not shift now to Peter Junger's suit: same issues, broader challenge, same opposing arguments? Did Patel rule narrowly in Bernstein to set the stage for the broader case in the works? BTW, is there a suit being readied to follow Peter's? Karn II? PRZ 6.0? What say, Peter, Lee, Cindy, Phil, Phil, Anthony et al?

5 5

Re: Direct Socket to Remailer?
by loki＠obscura.com 17 Dec '03

17 Dec '03

At 11:41 PM 9/3/95, starrd(a)iia2.org wrote: >On Fri, 1 Sep 1995, Lance Cottrell wrote: > >> You should try the telnet port 25 trick. It is amazingly simple (but not >> secure). Just "telnet some.machine.com 25" and type help. It will guide you >> through it. It is quite informative. > >Se sure to test it first, sometimes it records who *really* sent it as >well as the "forged" return address. > >Test it by mailing to yourself and then look at all the headers. > I should have been more clear. I was advocating this as interesting and educational, not as an effective anonymity technique. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Mathematics > NSA + GCHQ
by Lucky Green 17 Dec '03

17 Dec '03

At 10:41 AM 8/25/97 -6, Peter Trei wrote: >Interestingly, many of the European workers looked on the monetary >award with disdain - they participated 'to show Internet user >solidarity', and other such reasons. Also, many were using university >owned machines, and were legally constrained from accepting money >earned from their use. I am sure the university will make an exception to the rule once a $1M check for the regents arrives. The Internet idealists are your base for any distributed crack. But the cracks that come next are too complex to be performed by just your base. As in an election, you have to reach beyond your base to win. The students can show their solidarity. It will require tempting cash offers before large scale distributed cracks can suck cycles from the millions of computers in other environments. --Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred. DES is dead! Please join in breaking RC5-56. http://rc5.distributed.net/

2 1

Bernstein decision is out!
by John Gilmore 17 Dec '03

17 Dec '03

Judge Patel has made her decision, and it is up on the Web at http://www.eff.org/. We're still preparing the legal analysis, but the basic outline is that she declares the Commerce Dept. export-control scheme unconstitutional. She also issued an injunction against the Commerce Dept. preventing them from enforcing these regulations against Prof. Bernstein or others who distribute his software. More details later... John Gilmore

1 0

Need this? Why not?
by Alec McCrackin 17 Dec '03

17 Dec '03

:: Request-Remailing-To: <aba(a)dcs.ex.ac.uk> Adam, Quoted from PGP Users mail: Check on the pgp-users web page (http://pgp.rivertown.net) for information on all types of remailers, both under pgp-links and remailer-info. BTW did you see that shit-for-brains Toto has been posting (intentionally?) misinformation on the "CC: Trojan" effort. I seen he has dragged you into the light--going so far as to suggest you be fucked to death by his succubus crytotart. He screwed up and posted a message to me to the list! He claims to be "field testing" the CC: machine and rerouting mail. Too much booze in my opinion. "Bad, mad, and dangerous to know." XO Alec

1 0

DoJ press release on Bernstein case
by John Gilmore 17 Dec '03

17 Dec '03

Forwarded-by: Shari Steele <ssteele(a)eff.org> Department of Justice For Immediate Release Tuesday, August 26, 1997 CIV (202) 616-2777 TDD (202) 514-1888 JUSTICE DEPARTMENT STILL REVIEWING DISTRICT COURT DECISION ON EXPORT CONTROLS ON ENCRYPTION SOFTWARE WASHINGTON, D.C. -- The Justice Department said today it is considering what further legal measures it will take following yesterday's ruling by the U.S. District Court in San Francisco that certain aspects of the government's regulations on the export of encryption software are unconstitutional. Another federal court upheld the export controls on encryption software. The Administration is committed to promoting the legitimate use of encryption. Through encryption--or the coding of messages--businesses can protect trade secrets, hospitals can safeguard medical records, and individuals can be assured that personal messages on the information superhighway remain private. But, as President Clinton stated upon issuing an Executive Order on this subject on November 15, 1996, the use of encryption products by unfriendly parties outside the United States can jeopardize the foreign policy and national security interests of the United States, and public safety of U.S. citizens. Judicial proceedings in Bernstein v. Department of State are not yet concluded, and the decision governs only that case. In March 1996, in another pending case in Washington, D.C., Karn v. Department of State, the District Court ruled that export controls on encryption software are constitutional under the First Amendment and serve important interests of the United States. That case is still pending to consider export controls on encryption now administered by the Commerce Department. Until this issue is resolved, export controls on encryption software remain in place. Individuals or companies wishing to export encryption software by any means must continue to adhere to applicable export licensing controls on such software before exporting it abroad. ### 97-351

1 0