- cypherpunks-legacy - lists.cpunks.org

'Lincoln's Constitution': Desperate Times, Desperate Measures
by R. A. Hettinga 23 Aug '03

23 Aug '03

The usual statist apologia for statist apologia... Cheers, RAH ------- <http://nytimes.com/2003/08/24/books/review/24POSNERT.html?pagewanted=print&…> The New York Times August 24, 2003 'Lincoln's Constitution': Desperate Times, Desperate Measures By RICHARD A. POSNER LINCOLN'S CONSTITUTION By Daniel Farber. 240 pp. Chicago: The University of Chicago Press. $27.50. Since Sept. 11, 2001, the United States has been at war. It is a war unlike our previous wars, but it is a war nevertheless. War places law under pressure, and so it is timely to consider the pressure exerted on law by our previous wars, a pressure that was greatest during the Civil War. Hence ''Lincoln's Constitution,'' by Daniel Farber, a professor of law at the University of California, Berkeley, and the University of Minnesota. Farber addresses two topics. The first is the relation between the federal government and the states. Farber asks whether secession was lawful and, if not, what means were lawful to combat it. The second topic is the curtailment of civil liberties, and other constitutionally highhanded actions by Lincoln. Here the question is whether Lincoln upset the balance between the executive and the legislative and judicial branches of the federal government. Farber makes a workmanlike lawyer's case for the constitutionality of most of Lincoln's controversial measures, yet in doing so seems somehow to miss the point. In defense of suspending habeas corpus, a power that the Constitution seems pretty clearly to reserve for Congress (though Farber disagrees), Lincoln asked rhetorically and, as it seems to me, unanswerably, ''Are all the laws, but one, to go unexecuted, and the government itself go to pieces, lest that one be violated?'' In the weeks following Lincoln's inauguration, and indeed for the first two years of the war (until the almost simultaneous Union victories at Gettysburg and Vicksburg), the outcome of the Civil War was in doubt. Suspending habeas corpus may have been one of the measures that kept the Union going during this very dangerous period. The suspension not only enabled thousands of rebels and subversives to be detained without access to judges, many of whom were sympathetic to the Southern cause, but also showed Lincoln to be resolute, indeed ruthless, in the prosecution of the war. Resoluteness in times of great danger is essential to staving off defeatism; it goes some distance in explaining why Britain withstood the Nazi onslaught in 1940 and France did not. Farber is a law professor, not a historian. His method is that of close study of the constitutional text, the original understanding of the text's meaning and the Supreme Court's decisions interpreting and applying the text. The discussion is lucid and often ingenious, and the research, so far as I can judge, meticulous. But there is something rather odd about the enterprise, given that Farber is one of the relatively small band of law professors who explicitly defend pragmatism as the right way for judges and lawyers to think about law, especially American constitutional law. ''Pragmatism'' for these purposes may be defined as an overriding concern for the practical consequences, long-term as well as short-term, of constitutional principles -- as distinct from a more lawyerly insistence that such principles be ''logically'' derivable from orthodox legal materials, like the constitutional text, its understanding by the text's authors or ratifiers and previous judicial decisions from which rules applicable to new cases can be deduced. The pragmatic approach is forward-looking, asking what the decision in a case will do for us, the living. The orthodox lawyer's approach is backward-looking, asking what outcome would have the longer or better legal pedigree -- that is, would correspond more closely to some authoritative enactment or pronouncement in the past. The greater the practical consequences of a legal principle or decision, the more attractive the pragmatic approach is. That makes it a natural approach to take to constitutional law. Not only does the Constitution deal with matters of great practical significance, but it is very hard to amend, which magnifies the consequences of judicial decisions construing it. The most critical episode in the history of the United States was the Civil War. Never was the need for adjusting the law to pragmatic realities greater. Farber is not oblivious of this issue -- how could he be? -- yet it barely figures in his analysis, which is preoccupied with esoteric questions like ''the precise locus of American sovereignty.'' He makes the interesting point that the Supreme Court's recent states' rights decisions echo some of the arguments made by Jefferson Davis in support of secession, but he comments unpragmatically that ''the fact that these arguments can be deployed even today and can win the assent of . . . justices proves their durability and continuing allure.'' Pragmatists doubt that abstract arguments are what move Supreme Court justices; those arguments are, rather, the rhetorical decor of decisions reached on other, more practical grounds. Those who think it would have been disastrous had the secession succeeded will be inclined to believe that Lincoln was right to suspend habeas corpus. Was he legally right? That is a different question. One answer is that whatever measures are necessary to save the nation from suicide are, if not compelled, at least permitted by the Constitution, whatever the text, history or precedents might seem to imply. There are no limits to lawyers' ingenuity, and Farber is able to generate plausible arguments for the constitutionality of most of Lincoln's acts. With a little more effort he could defend all of them as lawful. For example, Farber endorses a particularly facile ''legal'' justification for Lincoln's suspension of habeas corpus: that since the president can use deadly force against rebels, he should be allowed to detain them indefinitely. But habeas corpus enables a court to determine whether a detained person is a rebel. That is why we try criminals rather than lynch them. (Moreover, Farber slides too easily from the question of whether Lincoln was authorized to suspend habeas corpus to whether he was authorized to flout Chief Justice Roger Taney's order granting habeas corpus, as he did. Officials are obliged to obey judicial orders even when erroneous.) There is a pragmatic argument against this approach, an argument for saying that Lincoln was right to do what he did -- in fact had no choice -- but that what he did violated the Constitution. In this view, it would have been a kind of treason had Lincoln been scrupulous in observing the limitations that the Constitution placed on his authority. There is value in distinguishing what is right from what is legal in order to avoid creating precedents that subsequent presidents might invoke in less exigent circumstances. One wouldn't want presidential suspensions of habeas corpus to become a habit. Article 48 of the Weimar Constitution allowed the president of the German Republic to suspend the Constitution in situations of emergency. The presidents invoked the power frequently, creating precedents for Hitler to employ when he took power in 1933. That is a pragmatic argument for limiting the pragmatic interpretation of our Constitution. Nonetheless, when the pressure of the practical is as enormous as it was in the Civil War, the marking off of nice legal distinctions has almost a frivolous air. Farber argues that Lincoln acted unconstitutionally when at the outset of the Civil War he used government money to pay people to recruit soldiers for the Union Army, because there was no Congressional appropriation for this purpose, and when he invited volunteers to join the Regular Army, because the raising of armies is a Congressional prerogative. It is one thing to say that the Constitution reserves the ominous power to suspend habeas corpus for Congress, and another to say that the Constitution is to be interpreted so literally that a president must use subterfuge to raise armies during a national emergency. That is the kind of literalism that would forbid the creation of the Air Force as a separate branch of the armed forces because the Constitution authorizes Congress to create and regulate only land and nava! l forces. It is curious to find a pragmatist like Farber sympathetic to such casuistry. But I do not want to end on a critical note. Farber has written a timely and important book, which should provoke fruitful discussion of enduring issues of civil liberties and judicial philosophy. Richard A. Posner's most recent book is ''Law, Pragmatism, and Democracy.'' He is a judge on the United States Court of Appeals for the Seventh Circuit. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: paradoxes of randomness
by Sarad AV 23 Aug '03

23 Aug '03

hi, Okay- I need 5 bits to represent 32 coins.I count as coin 0,coin 1,... coin 31. If it is a perfectly random fair coin throwing experiment,then 50 percent of them will be heads. So I know that 16 of them will be heads. What we do is i simply place all the 32 coins on the table in a row or column. I look at the first coin and determine if it is a head or a tail. I repeat the same proccess till i count 16 heads. If I count 15 heads at coin 31, then I cant reduce the entropy. How ever, if i count 16 heads at coin 30,then I dont have to check that coin 31,I already know its a tail,so I have less than 5 bits of entropy. So if it is a perfectly random experiment,I wouldn't get 16 heads before i look at coin 31,which is the last coin and thats what you said-isn't it? So how did chaitin get to compress the information from k instances of the turing machine in http://www.cs.umaine.edu/~chaitin/summer.html under the sub-section redundant? he says- "Is this K bits of mathematical information? K instances of the halting problem will give us K bits of Turing's number. Are these K bits independent pieces of information? Well, the answer is no, they never are. Why not? Because you don't really need to know K yes/no answers, it's not really K full bits of information. There's a lot less information. It can be compressed. Why? " If the input programs are truely random-there is no redundancy and thats a contradiction to the claim in the paper. Thanks. Regards Sarath. >It's simple, if I am correct. The redundancy simply > makes you care > less about the specific instance you are looking at. > > > To represent 32 coins-i need 5 bits of > information. > > Since the experiment is truely random-i know half > of > > them will be heads,so in this case using 5 bits of > > information,i can determine all the coins that are > > heads and that are tails. > > Same deal, unless you are counting pairs, in which > case you cannot > distinguish between the members of a pair. You need > an extra bit to > tell a head from a tail. > > > So-the question is what is the minimum number of > bits > > or entropy required to determine which all coins > are > > heads and which all coins are tails,is it 5 bits > or 6 > > bits of information? > > With 5 bits, you can count to 31, so you need 6. > > Just my two tails. > __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

6 14

RE: JAP back doored
by Vincent Penquerc'h 23 Aug '03

23 Aug '03

> JAP was back doored by court order. It was a forced upgrade (after a > service interruption) to monitor "one site" that continues to be Still useful to protect against third party eavesdroppers, I guess. Short of onion routing, are there any other services like that around, apart from the likes of anonymizer.com ? I've been using JAP for some time, but mainly to hide my IP from visited sites. Guess I'll keep on using it. I'm on Win32 BTW, as headers indicate. I'm at work, too paranoid to access Internet from my own Unix box ;) -- Vincent Penquerc'h

3 2

A little more about CDROMs
by Thomas Shaddack 22 Aug '03

22 Aug '03

http://www.wired.com/news/medtech/0,1286,60138,00.html Summary: Coating a CD by a reagent, then exposing it to a sample that changes its color, then counting read errors on the CD. Maybe could be a nice application for the lowest-level laser signal access I proposed earlier. (It apparently really could have some unexpected applications beyond CD copying, Tim.)

1 0

Re: Popular Net anonymity service back-doored (fwd)
by Thomas Shaddack 22 Aug '03

22 Aug '03

Yet more info. Let's not overreact before we get complete dataset. ---------- Forwarded message ---------- Date: Fri, 22 Aug 2003 09:34:27 +0200 Subject: Re: Popular Net anonymity service back-doored From: nordi <nordi(a)addcom.de> To: bugtraq(a)securityfocus.com, full-disclosure(a)lists.netsys.com On Thursday, 21. August 2003 14:05, Thomas C. Greene wrote: > It's not secure, and claiming that it is taints anything else they may be > doing on behalf of users. They're *still* saying it's impossible for anyone > to intercept users' traffic or identify them. Actually, this is absolutely not what they are saying. When you visit the website of the JAP project http://anon.inf.tu-dresden.de/ it says in big, red letters: "Aus aktuellem Anlass weisen wir noch einmal ausdr|cklich daraufhin, dass sich die JAP Software in Entwicklung befindet und noch nicht maximale Sicherheit bietet. (siehe unten ... )" In English this means something like "Due to recent events we explicitly inform you of the fact that the JAP software is still being developed and does not yet provide maximum security. (see below ...)" As I said: big, red letters at the top of their main page. And when you click that "see below" link it says there "Attention! [...] This version does NOT yet implement the security features described above and desired by us. But it does alread protect you against atackers that control the net only locally at one place such as [...] the owner of a mix." So by the time you download that software you should have already read _two_ statements telling you that JAP is not as secure as it could be. It also tells you that in the current configuration, the JAP people can see all your traffic if they want to: Note that it says it will protect you against "the owner of _A_ mix". But if you take the Dresden-Dresden cascade, the JAP people obviously control _all_ of them. And the above statement already implies that in this case, JAP cannot protect you. If you still want to use JAP, http://www.heise.de/newsticker/data/uma-20.08.03-000/ (in German) tells you how to do it securely: simply use just a single mix that is not controlled by the JAP project and you'll be fine. The court order is only valid for the JAP people, so everybody else in Germany (and elsewhere of course) can offer a non-backdoored mix which will make the cascade secure. This actually means that all cascades but the Dresden-Dresden one are secure. MfG nordi -- Denn der Menschheit drohen Kriege, gegen welche die vergangenen wie armselige Versuche sind, und sie werden kommen ohne jeden Zweifel, wenn denen, die sie in aller Vffentlichkeit vorbereiten, nicht die Hdnde zerschlagen werden. Bertolt Brecht, 1952

2 1

SIGINT thesis
by Major Variola (ret) 22 Aug '03

22 Aug '03

This from cryptography mailing list (URL corrected from orig): Some people on this list may be interested in http://www.staff.ncl.ac.uk/d.f.j.wood/thesis_index.htm (Note: I haven't read more than Chapter 1.)

1 0

Re: Popular Net anonymity service back-doored (fwd)
by Thomas Shaddack 22 Aug '03

22 Aug '03

More informations. ---------- Forwarded message ---------- Date: Thu, 21 Aug 2003 20:38:46 +0200 Subject: Re: Popular Net anonymity service back-doored From: Florian Weimer <fw(a)deneb.enyo.de> To: bugtraq(a)securityfocus.com, full-disclosure(a)lists.netsys.com Cc: Thomas C. Greene <thomas.greene(a)theregister.co.uk> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 "Thomas C. Greene " <thomas.greene(a)theregister.co.uk> writes: > traffic might be going straight to Big Brother, right? Wrong. After taking > the service down for a few days with the explanation that the interruption > was "due to a hardware failure", the operators then required users to install > an "upgraded version" (ie. a back-doored version) of the app to continue > using the service. This is technically incorrect. As far as I know, the client update is completely unrelated. The logging functionality has been implemented in the mixes themselves, otherwise you would be able to circumvent it by using a different client. The CVS commit occured on 2003-06-27. Logging is implemented this way: if the last mix in the cascade (which sees the request in the clear) detects a suspicious request, it is logged together with an ID. The ID is transmitted (through the cascade) to the first mix, which logs the ID and the IP address. Combining the two log files, it is possible to collapse the cascade and backtrack the requests. This exploits that TU Dresden operates both the first and last mix in the Dresden--Dresden cascade (which is the only that works reliably, AFAIK). An employee of TU Dresden described this scheme in an interview with Heise Online, a German online news site, back in October 2001. He announced an implementation within the next six months, but I don't know at the moment if he was speaking for the JAP project as a whole, or if he was just expressing his own ideas. According to the news sources I have read, the court requested surveillance based on the target IP address. However, the source code does not contain code to monitor specific (target) IP addresses, but an elaborate URL screening facility, based on regular expressions. Just by specifying ".*", it should be possible to log all requests (and the corresponding IP addresses). I don't know why the source code doesn't implement the surveillance based on IP addresses, as the court allegedly requested. > "What was the alternative? Shutting down the service? The security > apparatchiks would have appreciated that - anonymity in the Internet > and especially AN.ON are a thorn in their side anyway." Note that this kind of target-based monitoring would be much harder on the plain Internet unless the remote site is willing to cooperate. A broken anonymizer makes this type of surveillance quite easy. > But that's not the point. Disclosure is the point. The JAP Web site still > claims that anonymity is sacrosanct: "No one, not anyone from outside, not > any of the other users, not even the provider of the intermediary service can > determine which connection belongs to which user." The official declaration ("Selbstverpflichtung") of the mixes, which promises that neither logging will be enabled nor backdoors will be implemented, hasn't been updated either. However, perhaps the JAP team at TU Dresden hadn't much choice. I haven't seen the court order, but I could imagine that they weren't allowed to inform the users because it would have harmed the criminal investigation. Following the order while fighting it within the legal system is perhaps a wiser choice than just resisting it (and thus breaking the law yourself). But I agree that it takes them awfully long to update their web site, now that some information is public. Finally, they could have avoided all the hassle if they hadn't published the source code. Why did they publish? I don't believe it's an accident. For BUGTRAQ readers: Symantec strips message headers. The original To: and Cc: are:

2 1

Re: Is it time to kill the JAP backdoor cretins and their families?
by An Metet 22 Aug '03

22 Aug '03

>It would be easy for me to say that all of the operators connected with JPE Maybe this is the place to post their names, for posterity.

1 0

Digicash Patents
by R. A. Hettinga 21 Aug '03

21 Aug '03

--- begin forwarded text

1 0

Secure Programming Cookbook for C and C++
by R. A. Hettinga 21 Aug '03

21 Aug '03

<http://www.oreilly.com/catalog/secureprgckbk/desc.html> oreilly.com -- Online Catalog: Secure Programming Cookbook for C and C++ Full Description Password sniffing, spoofing, buffer overflows, and denial of service: these are only a few of the attacks on today's computer systems and networks. At the root of this epidemic is poorly written, poorly tested, and insecure code that puts everyone at risk. Clearly, today's developers need help figuring out how to write code that attackers won't be able to exploit. But writing such code is surprisingly difficult. Secure Programming Cookbook for C and C++ is an important new resource for developers serious about writing secure code. It contains a wealth of solutions to problems faced by those who care about the security of their applications. It covers a wide range of topics, including safe initialization, access control, input validation, symmetric and public key cryptography, cryptographic hashes and MACs, authentication and key exchange, PKI, random numbers, and anti-tampering. The rich set of code samples provided in the book's more than 200 recipes will help programmers secure the C and C++ programs they write for both Unix® (including Linux®) and Windows® environments. Readers will learn: How to avoid common programming errors, such as buffer overflows, race conditions, and format string problems How to properly SSL-enable applications How to create secure channels for client-server communication without SSL How to integrate Public Key Infrastructure (PKI) into applications Best practices for using cryptography properly Techniques and strategies for properly validating input to programs How to launch programs securely How to use file access mechanisms properly Techniques for protecting applications from reverse engineering The book's web site supplements the book by providing a place to post new recipes, including those written in additional languages like Perl, Java, and Python. Monthly prizes will reward the best recipes submitted by readers. Secure Programming Cookbook for C and C++ is destined to become an essential part of any developer's library, a code companion developers will turn to again and again as they seek to protect their systems from attackers and reduce the risks they face in today's dangerous world. Return to Secure Programming Cookbook for C and C++ -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0