- cypherpunks-legacy - lists.cpunks.org

Re: A Trial Balloon to Ban Email?
by Jim Choate 13 May '03

13 May '03

On Mon, 12 May 2003, Sunder wrote: > And what about people that use something underpowered like a Palm IV to > send email? Does it really make sense to force their little dragonball > powered machines to do a whole lot of math? Tell 'em to get a real PDA, preferably a Zaurus but a PowerPC is acceptable. -- ____________________________________________________________________ We are all interested in the future for that is where you and I are going to spend the rest of our lives. Criswell, "Plan 9 from Outer Space" ravage(a)ssz.com jchoate(a)open-forge.org www.ssz.com www.open-forge.org --------------------------------------------------------------------

2 1

Re: economics of spam (Re: A Trial Balloon to Ban Email?)
by Steven M. Bellovin 13 May '03

13 May '03

In message <200305130152.h4D1qC1F007097(a)syn.hamachi.org>, Bill Sommerfeld write s: >> The other side of this equation is what a second of CPU costs in >> monetary terms to a spammer. (To an end user it is essentially free >> because his CPU is mostly idle anyway; the limiting factor for the >> user is his preference for fast mail delivery (and in the dialup >> case an unwillingness to sit waiting for tokens to be calcluated >> before his mail can be sent). > >If you believe http://news.bbc.co.uk/1/hi/technology/2988209.stm, >spammers are beginning to use viruses to deploy spam relays. > >If a spammer has a zombie army of a few thousand compromised systems, >the spammer's cpu time costs for hashcash will also essentially be >free. The spammers are doing that and more. For example, recent traffic on the NANOG list suggests that they are using false BGP advertisements on stolen address blocks to shoot and run. (There is a proposal to stop that via cryptographic authentication of BGP advertisements, but SBGP hasn't gotten any traction with most of the operator community yet. Just why is a subject for a separate thread.) --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

Asperger's Syndrome
by Tim May 13 May '03

13 May '03

A symptom of our weird, statist, collectivist times is that many who excel at math, science, and business are now being increasingly characterized as "having Asperger's Syndrome." (Cf. www.google.com for hundreds of references.) In one line, Asperger's Syndrome is said to be a variant of autism, a kind of "able to function in society" variant on autism. Bill Gates is described as having Asperger's. In the past few weeks, we hear that Isaac Newton and Albert Einstein were "probable Asperger's." Maybe a biochemical or DNA link to a real syndrome, besides brightness, will be found, but I suspect that a lot of people with the ability to concentrate are characterized as being some kind of second-rate Rainmans just because they don't watch "Oprah" and "Survivor" on t.v. I've never met Bill Gates, though I did meet some of his contemporaries (Gary Kildall, Steve Wozniak, and of course all the folks at Intel). He seems a little weird at times...but no more so than a lot of the folks I meet at Cypherpunks, Hackers, PenSFA, etc. My tentative conclusion is that calling someone successful a "case of Asperger's" is just another form of envy or trash-talking. (Or of the popular meme in the past 30 years where child actors are fed lines showing their putative precociousness as they psychoanalyze the adults around them.) --Tim May "A democracy cannot exist as a permanent form of government. It can only exist until the voters discover that they can vote themselves money from the Public Treasury. From that moment on, the majority always votes for the candidate promising the most benefits from the Public Treasury with the result that a democracy always collapses over loose fiscal policy always followed by dictatorship." --Alexander Fraser Tyler

13 28

Re: Cryptoanarchy: violence or peace?
by Tyler Durden 13 May '03

13 May '03

John Young wrote... "No, there's no contrast between commies and libertarians, left and right, they're all producing vast lakes of pig shit and blaming the foul odor of bloated self-interest on low-brow non-think chimeras of the government, corporations, the rich, the poor, the opposite, the other, those who are different, those who have more, or less, or get more attention, or fail to show respect, or who make fun of your fundamental beliefs, or insult your morals, ethics, aesthetics, politics, accomplishments, looks, way of talking, writing, joking, and worse, who have a knack for pushing overmuch sacred buttons of your ingrown fearful neurotic cult armed to the teeth with weapons of iron and spleen and inner infant hurt feelings, not understanding or giving a whit what you're deeply serious about, pathologically incapable of escaping the force of." Holy shit, Young. That was a grade-A rant, verging on the poetic. Kinda the Finnegans Wake of Cypherpunk posts. Needless to say, I didn't fully understand it, but that's no matter. -TD _________________________________________________________________ The new MSN 8: advanced junk mail protection and 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

Court will decide if police need warrant for GPS 'tracking'
by Major Variola (ret) 13 May '03

13 May '03

I read somewhere that the original wiretap laws were motivated when police bugged a phone booth (fishing), and snared someone placing a bet. The court held that there was an expectation of privacy. Interesting to see what they say now. Segues nicely with the CALEA/cellphone locator tech too. http://seattlepi.nwsource.com/local/121572_gps12.html Monday, May 12, 2003 Court will decide if police need warrant for GPS 'tracking' By KATHY GEORGE SEATTLE POST-INTELLIGENCER REPORTER William Bradley Jackson worried that he hadn't properly concealed his victim's shallow grave. So he snuck away one quiet fall day to finish the job, unaware that sheriff's deputies had secretly attached a satellite tracking device to his truck. Police trickery triumphed over his treachery. Spokane County sheriff's investigators used the hidden device to retrace Jackson's path to the gravesite, where they found crucial evidence that would lead to his murder conviction in 2000. But what if the same secret technology, called global positioning satellite tracking, could track anyone at any time? The Washington Supreme Court will decide soon whether police agencies throughout the state may use the device freely -- without a warrant. The Jackson case is the first in the state dealing with the issue. "Do we really want the ability to track everybody all the time, without any suspicion, or without probable cause?" asked Doug Klunder, a Seattle attorney who wrote an amicus brief, or friend of the court, in the case on behalf of the American Civil Liberties Union of Washington. "How close are we to Big Brother?" Many law enforcement agencies, including the King County Sheriff's Office and King County Prosecutor's Office, believe no warrant is needed for the tracking devices. That's because they simply record electronically what anyone could see by following a vehicle on the public streets. "We'd be shocked if the court said otherwise," said King County sheriff's spokesman Kevin Fagerstrom. In Jackson's case, the state Court of Appeals in Spokane agreed no warrant was needed. The court's opinion last year said, "A law officer could legally follow Mr. Jackson's vehicles on public thoroughfares .... The GPS devices made Mr. Jackson's vehicles visible or identifiable as though the officers had merely cleaned his license plates, or unobtrusively marked his vehicles and made them plain to see." Critics of the Spokane court's opinion say there's a big difference between following someone's real-time movements and recording them for computer analysis later. "There's just something that feels more underhanded about it," said Klunder. It's not just government abuse the ACLU fears. Stalkers could use GPS to find their victims, and jealous husbands could use it to spy on their wives. "If the police can do it without a warrant, then presumably a private citizen can, too," Klunder said. <snip>

2 1

Ames, Hanssen, Stakeknife
by Major Variola (ret) 13 May '03

13 May '03

"If it is true that Stakeknife was the head of [IRA] internal security, then it is a major coup for the British," http://www.upi.com/view.cfm?StoryID=20030512-043253-8646r (Yank megamedia notices what cryptome.org's had for days..) Yep, just like counter intel chiefs Aldrich Ames and Bob Hanssen. Funny how CI/"internal security" attracts double agents... Stakeknife was only an eighth-of-million US$ a year, much cheaper than the CIA & FBI's moles were to the CCCP, but living expenses are probably cheaper in N. Ireland than in D.C. ---- "Markets can remain irrational longer than you can remain solvent" -- John Maynard Keynes RNA virii can mutate faster than you can sequence it

4 3

Trusted Computing at WEIS2003
by Nomen Nescio 12 May '03

12 May '03

The 2nd annual workshop on "Economics and Information Security" will be held May 29-30 at the University of Maryland. Unfortunately the website at http://www.cpppe.umd.edu/rhsmith3/index.html is woefully out of date. At least two of the papers will focus on Trusted Computing as exemplified in the TCG (formerly TCPA) and NGSCB (former Palladium) proposals. Ross Anderson himself, co-chair and founder of the conference, has a new paper at http://www.ftp.cl.cam.ac.uk/ftp/users/rja14/tcpa.pdf. Another one, by Stuart Schechter et al, is discussed at an EWeek article, http://www.eweek.com/article2/0,3959,1053555,00.asp. The Schechter paper is online at http://www.eecs.harvard.edu/~stuart/papers/eis03.pdf. EWeek talks about the role of TC in limiting which applications get access to protected content: "This kind of protection is seen as central to the types of advanced digital rights management systems sought by content owners as a countermeasure against piracy. However, this chain of trust can be turned around and used by the people doing the illegal copying and distribution, according to the paper's authors." The authors are quoted, "Though this technology was envisioned to thwart pirates, it is exactly what a peer-to-peer system needs to ensure that no client application can enter the network unless that application, and the hardware and operating system it is running on, has been certified by an authority trusted by the existing clients..." A similar point was made here last summer during our extensive debate about the potential threat of Trusted Computing. It would be fair to say that it was not well received, however. Perhaps now that the ideas are being aired in an academic environment, people will take a closer look at TC and gain a fuller understanding of the technology. Even Ross Anderson recognizes that TC can help the pirates as well as the protectors: "There is also a significant risk - that if TC machines become pervasive, they can be used by the other side just as easily. Users can create `blacknets' for swapping prohibited material of various kinds, and it will become easier to create peer-to-peer systems like gnutella or mojonation but which are very much more resistant to attack by the music industry - as only genuine clients will be able to participate. The current methods used to attack such systems, involving service denial attacks undertaken by Trojanned clients, will not work any more [23]. So when TC is implemented, the law of unintended consequences could well make the music industry a victim rather than a beneficiary." Anderson's paper is a significant improvement on his bizarrely paranoid and error-filled FAQ. He's had to back down on a number of his claims. For example, Windows Server 2003 implements some DRM and document-locking features which he attributed to Palladium. He also seems to back away from claims that Microsoft will censor your data. He has to squirm to deal with the work on TC Linux and try to explain how this fits into his model of the monopolizing influence of these technologies. Anderson now has to admit that his claims of a software blacklist are mistaken as well: "Among early TCPA developers, there was an assumption that blacklist mechanisms would extend as far as disabling all documents created using a machine whose software licence fees weren't paid. Having strong mechanisms that embedded machine identifiers in all files they had created or modified would create huge leverage. Following the initial public outcry, Microsoft now denies that such blacklist mechanisms will be introduced - at least at the NGSCB level [18]." Notice the claim that Microsoft has perhaps removed this feature based on public outcry - an outcry for which Ross Anderson can no doubt take credit. This fulfils a prediction made here last year, that when their apocalyptic scenarios failed to arrive, the critics would take credit for having prevented them! What a racket - if you're right, you're right, and if you're wrong, you're even more right. While this newer paper is better than the abysmal FAQ (which unfortunately is still spreading its lies and misinformation, even though Anderson now admits that he knows it is wrong), it has significant flaws as well. All the analysis is presented from the perspective that businesses can do whatever they like and consumers have no choice but to go along helplessly. Not once does he consider that the discipline of the marketplace applies to sellers as well as buyers. Any paper claiming to be relevant to the topic of "Economics and Information Security" should not be content with such a one-sided view. All too often the text degenerates into the kind of anti-Microsoft conspiracy theories which can be found in the sleaziest corners of the net. He never really explains why Intel, IBM and HP are going along with these nefarious schemes. Intel, we are told is behaving "strategically". What is the strategy? Why will TC help Intel? Anderson mumbles something about "lock-in" but that doesn't apply to the hardware vendors. He doesn't want to admit the obvious, that Intel thinks this will sell more computers, because people will like their computers better when they can access more content. This is what happens when you ignore the demand side in your analysis. Anderson also presents a number of scenarios of Microsoft dominance in the application demain as if they are new. Why, law firms might feel obligated to buy Microsoft Office in order to communicate with their clients! Imagine that. Who could conceive of such a twisted, backwards, upside down world as one in which companies felt stuck with buying Microsoft for compatibility? If he really thinks this is a new threat, I'd suggest Anderson visit the real world occasionally. I dunno, maybe things are different over there in the Unreal Kingdom. Despite these problems, I do want to emphasize that Anderson's paper is a step forward. And the paper by Schechter is also encouraging in that it is willing to reject the anti-TC paranoia and take a clear-eyed look at the technology. Still, both of these papers express their results in somewhat negative terms: look, you guys at the RIAA and MPAA, you better not push for TC because it might benefit the pirates too. None of these authors has quite been able to take accept the logical conclusion of their analysis, which is that this is a technology which can enable a whole host of powerful new applications, many of which have probably not even been invented yet. Then it should be up to the marketplace to decide which will succeed and which will fail. Everyone wants to short-circuit that messy final step and decide for themselves which are the "good" applications and which are evil. I suggest that we not reject out of hand the principle of allowing people to make decisions for themselves about what they want to do with their computers, and that includes utilizing TC technology.

1 0

changes at lne.com
by Eric Murray 12 May '03

12 May '03

The spam load at lne.com is WAY too high. Last month for example there was an average of 96 spams per day submitted to cypherpunks(a)lne.com. "submitted" means that it was the first time we saw that particular mail. Since the CDR system sends everything to all nodes, that means we got and passed on about 4x that number. 800 spams a day is a waste. So I have changed the way we deal with CDR mail. We will no longer pass to other CDRs mail that we would not send to subscribers. Eliminating outbound spam will cut our cypherpunks spam load in half. I am also going to filter the non-subscriber mail more effectively. Lately I have had to check about 50 spams a day to see if they are actually posts to the list. I find one real post every two or three days. Now I will save for human processing only the non-subscriber mail that is PGP signed or encrypted, or that looks like a reply. The majority of non-subscriber mails I've forwarded to the list have been replies. (I'll save everything for a while to make sure my filtering works). As always, other CDR operators and anyone else interested in running a CDR are welcome to my scripts. Eric

5 8

New seccure commercial messaging site?
by barabbus＠hushmail.com 12 May '03

12 May '03

Stealth Message is a secure messaging system designed for communicating sensitive and confidential information. It protects your privacy, allowing you to communicate in complete confidence with friends and colleagues. http://www.stealthmessage.com/s/home/index.cfm?re=about Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427

2 1

Re: New seccure commercial messaging site?
by Major Variola (ret) 12 May '03

12 May '03

At 01:05 PM 5/12/03 -0700, barabbus(a)hushmail.com wrote: >http://www.stealthmessage.com/s/home/index.cfm?re=about Also: the user MUST trust that that site does not log IP addresses of the sender. (Otherwise traffic analysis is easy.) The workaround here is to send from a netcafe, wearing a mask, with a stone in your shoe. For sending messages to friends from work, their approach suffices.

1 0