- cypherpunks-legacy - lists.cpunks.org

Re: Maybe It's Snake Oil All the Way Down
by pgut001＠cs.auckland.ac.nz 04 Jun '03

04 Jun '03

Ian Grigg <iang(a)systemics.com> writes: >Also, a lot of cryptosystems are put together by committees. SSH was >originally put together by one guy. He did the lot. Allegedly, a fairly >grotty protocol with a number of weakneses, but it was there and up and >running. And SSH-2 is apparantly nice, elegant and easy to understand, now >that it has been fixed up. Actually SSHv2 is just SSL with a different packet format (when I did my SSHv2 implementation I recycled the code from the SSL engine, it was that close [0]). That's probably a good indication that SSL/SSHv2 is a fairly optimal (security/functionality/implementability/etc) design for an application-level security protocol if two groups independently came up with the same design, which brings us back the original question of why on earth Nullsoft tried to roll their own. Peter. [0] Note that my SSL implementation follows the standard SSL ladder diagram rather than the state-machine that SSL implementations are usually described as, which made it trivial to switch over for SSHv2 use. I've never understood why every explanation of the SSL protocol I've ever seen uses ladder diagrams but once they talk about implementation details they assume you're doing it as a state machine, which makes it vastly harder to implement. For example all the stuff about pending cipher suites and whatnot follows automatically (and transparently) from the ladder diagram, but is a real pain to sort out in a state machine.

2 1

RE: SIGINT planes vs. radioisotope mapping
by Trei, Peter 04 Jun '03

04 Jun '03

> Major Variola (ret)[SMTP:mv@cdc.gov] > > > At 05:28 PM 6/3/03 -0700, Tim May wrote: > > Possibly for construction > >of baseline maps of existing radioisotopes in university labs, > >hospitals, and private facilities. Then deviations from baseline maps > >could be identified and inspected in more detail with ground-based vans > >and black bag ops. > > Good call. I wonder if folks getting PET scans will have to kick back > longer in the waiting areas lest they be snatched by delta teams... > hopefully the .mils can distinguish Tc99 et al from other 'topes.. > similarly with mobile industrial inspection rigs --except that they have > the good stuff a RD gadget-maker would want. Maybe GPS + IFF > beacons will be added to those. > It appears that they can't tell the medical isotopes from others.... -------------------- http://www.mindfully.org/Nucs/2002/Irradiated-Patient-Security4dec02.htm High Security Trips Up Some Irradiated Patients, Doctors Say AL BAKER / NY Times 4dec02 In one case last spring, a man being treated for an overactive thyroid gland was stopped by the authorities on two occasions while at a subway stop at Pennsylvania Station. In another case about a month ago, a woman who had undergone a diagnostic heart study was stopped while trying to drive out of Manhattan through a tunnel. In both cases, the people involved had been treated with radioactive materials. And in both cases, doctors said, they were stopped by law enforcement officers armed with radiation detectors used to track possible terrorists. Such reports are flowing into doctors' offices, physicians in the metropolitan region and elsewhere say. -----------------------

1 0

Why is there a solution, Declan?
by Adam Shostack 04 Jun '03

04 Jun '03

Declan interviews Bruce Sterling, on news.com.com.com: http://news.com.com/2008-1082_3-1010864.html?tag=fd_nc_1 -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

RE: Maybe It's Snake Oil All the Way Down
by pgut001＠cs.auckland.ac.nz 04 Jun '03

04 Jun '03

"Lucky Green" <shamrock(a)cypherpunks.to> writes: >I trust that we can agree that the volume of traffic and number of >transactions protected by SSL are orders of magnitude higher than those >protected by SSH. As is the number of users of SSL. The overwhelming majority >of which wouldn't know ssh from telnet. Nor would they know what to do at a >shell prompt and therefore have no use for either ssh or telnet. Naah, that third sentence is wrong. It's: The overwhelming majority of [SSL users] wouldn't know SSL from HTTP with a padlock GIF in the corner. >Given that SSL use is orders of magnitude higher than that of SSH, with no >change in sight, primarily due to SSL's ease-of-use, I am a bit puzzled by >your assertion that ssh, not SSL, is the "only really successful net crypto >system". I think the assertion was that SSH is used in places where it matters, while SSL is used where no-one really cares (or even knows) about it. Joe Sixpack will trust any site with a padlock GIF on the page. Most techies won't access a Unix box without SSH. Quantity != quality. If you could wave a magic wand and make one of the two protocols vanish, I'd notice the loss of SSH immediately (I couldn't send this message for starters), but it would take days or weeks before I noticed the loss of SSL. Peter. --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

4 3

Re: SIGINT planes vs. radioisotope mapping
by Major Variola (ret) 04 Jun '03

04 Jun '03

At 05:28 PM 6/3/03 -0700, Tim May wrote: > Possibly for construction >of baseline maps of existing radioisotopes in university labs, >hospitals, and private facilities. Then deviations from baseline maps >could be identified and inspected in more detail with ground-based vans >and black bag ops. Good call. I wonder if folks getting PET scans will have to kick back longer in the waiting areas lest they be snatched by delta teams... hopefully the .mils can distinguish Tc99 et al from other 'topes.. similarly with mobile industrial inspection rigs --except that they have the good stuff a RD gadget-maker would want. Maybe GPS + IFF beacons will be added to those. --- SAFETY RULES FOR US STRATEGIC BOMBERS 5.1. Don't use nuclear weapons to troubleshoot faults. http://cryptome.org/afi91-111.htm

1 0

Waste (or is it W.A.S.T.E.?) author/releasor to resign from AOL/Time Warner
by Tim May 03 Jun '03

03 Jun '03

The author/releasor of Waste/W.A.S.T.E. (All Rights Reserved--neither T. Pynchon nor T. May use this name anymore) is apparently leaving AOL/Time Warner, the company that purchased his company, Nullsoft. <http://story.news.yahoo.com/news?tmpl=story&cid=528&ncid=528&e=2&u=/ ap/20030603/ap_on_hi_te/aol_nullsoft> So I guess we won't have the Waste/W.A.S.T.E. proprietary crypto innards to kick around anymore. ObRay: "Why is this discussion here? We should be talking about SSH vs. SSL!!" --Tim May "That the said Constitution shall never be construed to authorize Congress to infringe the just liberty of the press or the rights of conscience; or to prevent the people of the United States who are peaceable citizens from keeping their own arms." --Samuel Adams

1 0

Re: [ChemBrin] Tracking NYC farts
by Tyler Durden 03 Jun '03

03 Jun '03

"This summer, federal scientists plan to release benign gases in Manhattan and use the sensors to track them." Reminds me of the good ole days when they released viruses in the subway for a similar purpose. I'm guessing that in this case "benign" depends on your definition of benign. Want to scuttle a fed program? Broadcast this on the Villiage Voice boards and on as many gay sites as you can find. -TD >From: "Major Variola (ret)" <mv(a)cdc.gov> >To: "cypherpunks(a)lne.com" <cypherpunks(a)lne.com> >Subject: [ChemBrin] Tracking NYC farts >Date: Tue, 03 Jun 2003 13:05:53 -0700 > >[And in a few years, the sensors will be augmented with tobacco, pot, >maybe programmable >DNA-scurf detectors.] > >http://www.nydailynews.com/front/story/89128p-81072c.html >Federal scientists will soon blanket the heart of midtown and the West >Village with high-tech sensors designed to track biological, chemical >and radiological agents in the event of a terrorist attack. > > The security project is a first step toward creating a vast network of >sensors that can predict how the fallout from a weapon of mass >destruction might spread through the city. > > "We would like to work out what areas would be dangerous and, more >importantly, what areas would be safe," said Bruce Hicks, director of >the Air Resources Laboratory of the National Oceanic and Atmospheric >Administration. > > The research is considered crucial because mathematical and computer >models that forecast the airborne paths of toxins were designed for >rural areas, not cities. > > "Right now, the models that we have are not set up for dense urban >areas with the canyons and the complexities that exist in New York," >said Dr. Ralph James, director of the Energy, Environment and National >Security unit at Brookhaven National Laboratory on Long Island. > > Five sensors already have been placed as part of the project, called >the Urban Atmospheric Observatory. > > The instruments, attached to a federal building near Varick and W. >Houston Sts., measure wind direction, velocity and turbulence. > > Scores of similar sensors, as well as radiation detectors, are expected >to be placed this year around midtown and the West Village - considered >potential terrorist targets. > >Tracing gases > > "Anywhere we can hang an instrument, we are going to try to get one out >there," said Michael Reynolds, a research scientist at the Brookhaven >labs, part of the Energy Department. > > This summer, federal scientists plan to release benign gases in >Manhattan and use the sensors to track them. > > "That way, we can really get an idea of how well the models work," >Reynolds said. > > A similar program, called DCNet, is underway in Washington, where 13 >sensors have been placed near sensitive sites, including the White >House. > > New York is seeking up to $10 million from the Homeland Security >Department to expand its network. > > Reynolds said it would cost about $30 million to $40 million a year to >fully implement the sensors in New York. _________________________________________________________________ STOP MORE SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

[eb@comsec.com: Re: Maybe It's Snake Oil All the Way Down]
by Eric Murray 03 Jun '03

03 Jun '03

----- Forwarded message from Eric Blossom <eb(a)comsec.com> -----

1 0

[PaulLambert@AirgoNetworks.Com: Re: BIS Disk Full]
by Eric Murray 03 Jun '03

03 Jun '03

----- Forwarded message from Paul Lambert <PaulLambert(a)AirgoNetworks.Com> -----

1 0

[eb@comsec.com: Re: Maybe It's Snake Oil All the Way Down]
by Eric Murray 03 Jun '03

03 Jun '03

----- Forwarded message from Eric Blossom <eb(a)comsec.com> -----

1 0