- cypherpunks-legacy - lists.cpunks.org

The pernicious characteristics of monocultures, by Paul Strassmann.
by Casper Aleva 29 Nov '01

29 Nov '01

The following essay by a manager with clue, Paul Strassmann, is part of the special report on Internet security and hackers on the American public broadcaster PBS and worth reading. Source: http://www.pbs.org/wgbh/pages/frontline/shows/hackers/blame/threat.html === The purpose of this article is to explain the risks arising from a Microsoft software monoculture. The term "monoculture" is originally derived from agriculture. It is the practice of growing the same crop each year on a given acreage. Rotating crops helps control certain insects and diseases; farmers who repeatedly grow the same crop on the same land become increasingly dependent on chemical insecticides, and must resort to new disease-resistant plant varieties, and practice soil fumigation and similar methods of controlling insects and diseases that are usually controlled by crop rotation. If a large number of farmers, in proximate geography, adopt monoculture practices, even the dependency on chemical means will not be sufficient to protect the crops. Although the quantity of food is increased, the humans create an environment that is hospitable to vermin, pathogens, and diseases. Paradoxically, by increasing specialization monoculture farmers increase the threats to their food supply. The potentially destructive, injurious and deadly characteristics of monoculture practices are remarkably comparable to conditions one finds prevailing in computer networks. Therefore, it may be useful first to examine an agricultural case before venturing into an exploration of what it means to have Microsoft software present in most of the computers in the world. Agricultural Case: The Irish Potato Famine The "Great Potato Famine" or the "Irish Famine" occurred in 1845-49 when the potato crop failed in successive years. The crop failures were caused by blight that destroyed the potato plant. It was the worst famine to occur in Europe in the 19th century. By the early 1840s, almost one-half of the Irish population--but primarily the rural poor--had come to depend almost exclusively on the potato for their diet, and the rest of the population also consumed it in large quantities. A heavy reliance on just one or two high-yielding varieties of potato greatly reduced the genetic variety that ordinarily prevents the decimation of an entire crop by disease, and thus made the Irish vulnerable. In 1845 a fungus arrived accidentally from North America, and that same year Ireland had unusually cool, moist weather, in which the blight thrived. About 1.1 million people died from starvation or typhus and other famine-related diseases. Many emigrated, and by 1921 the population was barely half of what it had been in the early 1840s. The Software Case: Microsoft's Dominance Microsoft's dominance in operating systems represents a new threat to the national security and to the systematic reliability of our computer-based society. It is a fact that a large number of political institutions, both in the U.S. and in other countries, are becoming increasingly aware of the economic and security risks that arise from the ubiquitous presence of Microsoft. The U.S. government as well as a European Economic Community (EEC) Commission is trying to contain the expanding power of Microsoft by litigation. This is insufficient. One must also address the risks from attacks on a largely homogeneous systems management environment. Info-terrorists and criminals will continue to take advantage of the ever-growing proliferation of flaws in the gigantic Microsoft system, consisting of hundreds of millions of lines of failure-prone code. The Microsoft software monoculture is dangerous because this firm is pursuing its global expansion objectives with unconstrained ambition. Its strength is reflected in its share of all profits from the software business. That advantage has widened steadily from 24 percent in 1987 to 64 percent in 1998 and is likely to climb as Microsoft is expanding its reach as a vendor of software packages to becoming a networking services giant. In its recently announced .Net initiative, Microsoft has projected a vision of a world that is inter-connected with Microsoft centers from where each computer receives not only its operating software but also a continuous stream of data and applications. Microsoft now sets its sights not only on the control of local computing but also on the sources from which all program code and data originate. Upgrading Microsoft software has been a logical choice for customers who wished to keep up with changes in technology. The risks of an integrated family of operating systems running all global computers, a declared Microsoft objective, make selecting a Microsoft platform more than a purely technical choice. An all-encompassing operating system bares itself to hostile exploitation of paralyzing security flaws. The presence of a fatal defect is unavoidable as the complexity of Microsoft systems expands to bizarre proportions with each new release. It is the search for such a fault that occupies the minds of some of the brightest computer experts. Finding a crack through which one could induce mayhem with only a few keystrokes would be worth a great deal of money, especially when supporting an act of terrorism. Microsoft and the Information Monoculture It's only a question of time before the ubiquitous presence of Microsoft operating systems, supported by a software-updating network, reaches a level of interconnectivity that makes a universal systems crash feasible. All that will be required is inducement of a widespread information infrastructure collapse through a deliberately executed and pre-planned act of information warfare. The risk from a software monoculture has increased due to the shift from custom-made software to packaged applications residing on an integrated family of Microsoft operating systems. As a result, the risks from planned subversion of a software monoculture now overwhelm the demonstrable benefits of standardization of an otherwise chaotic software environment. The future of Microsoft should not be judged only by antitrust criteria or the commercial merits of its software. It should be also reflected in the unprecedented security risks to our civilization that a software monoculture generates. The Microsoft defense that it was only maximizing profits using common competitive methods is insufficient. Business practices that may be tolerable for a small competitor become perilous whenever scaled up to security-threatening proportions to global computer networks. Our computer-based information society is still in its early stages of development. Its resilience and dependability is still not adequately understood. If history teaches anything, it is the insight that monocultures of any kind--especially if they can propagate in a matter of seconds--should not be allowed to flourish without adequate safeguards. === Casper Aleva Dutch Security Information Network e: tonus(a)dsinet.org w: http://www.DSINet.org/ c: http://www.DSINet.org/casper/pubkey.txt == "Don't quote, I want to know what _you_ have to say." -Unknown

1 0

Re: Order Now: True Names: And the Opening of the Cyberspace Frontier
by Anonymous User 29 Nov '01

29 Nov '01

Really-From - Well Known Cypherpunk I'd be happy to be wrong here, but the bet ain't over till the fat lady ships the books. Amazon's promised to accept orders before, and while we're closer to the promised "this time for sure" date than I've seen in the past, it's still just a promise. Meanwhile, if you want to see articles by Tim May, Dorothy Denning, Duncan Frissell, Hakim Bey, Eric Hughes, and Other Well-Known Cypherpunks and fellow-travelers in print, there's an interesting collection isbn://0-262-62151-7 mitpress.mit.edu 2001 "Crypto Anarchy, Cyberstates, and Pirate Utopias" edited by Peter Ludlow On 11/23/2001 - 20:44, Matthew Gaylor wrote: > [Note from Matt: I made a small wager in palladium that Vinge's True > Names: And the Opening of the Cyberspace Frontier would be available > to order prior to Jan. 1, 2002 with a well known Cypherpunk. And I > won. Acct# 101893.] > > > At 3:03 AM -0700 8/13/01, Well known Cypherpunk wrote: > >Subject: Re: BTW- I'll bet you... > > > >OK - Done deal, if you'll accept the modification that it be > >orderable and shippable by Amazon or other on-line bookstore > >within a week after that. > > > <http://www.amazon.com/exec/obidos/ASIN/0312862075/ref=pd_bxgy_text_1/ > 103-1236763-4454202> > > True Names: And the Opening of the Cyberspace Frontier > by Vernor Vinge, James Frenkel (Editor) > > List Price: $14.95 > Our Price: $11.96 > You Save: $2.99 (20%) > This item will be published in December 2001. You may order it now > and we will ship it to you when it arrives. > See larger photo > > This item qualifies for free shipping on orders over $99! Click for details > Great Buy > Buy True Names: And the Opening of the Cyberspace Fron... with The > Collected Stories of Vernor Vinge today! Total List Price: $42.90 > Buy Together Today: $31.52 > You Save: $11.38 > > > Paperback - 384 pages (December 2001) > Tor Books; ISBN: 0312862075 > > Amazon.com Sales Rank: 28,271 > X-Authenticated-User: idiom

2 1

7248 Would you like to lose weight while you sleep? 5090652
by 5250906ultimate＠excite.com 29 Nov '01

29 Nov '01

As seen on NBC, CBS, CNN, and even Oprah! The health discovery that actually reverses aging while burning fat, without dieting or exercise! This proven discovery has even been reported on by the New England Journal of Medicine. Forget aging and dieting forever! And it's Guaranteed! Click here: http://ultimatehgh1000.81832.com Would you like to lose weight while you sleep! No dieting! No hunger pains! No Cravings! No strenuous exercise! Change your life forever! 100% GUARANTEED! 1.Body Fat Loss 82% improvement. 2.Wrinkle Reduction 61% improvement. 3.Energy Level 84% improvement. 4.Muscle Strength 88% improvement. 5.Sexual Potency 75% improvement. 6.Emotional Stability 67% improvement. 7.Memory 62% improvement. You are receiving this email as a subscriber to the Opt-In America Mailing List. To remove yourself from all related maillists, just click here: mailto:pacserver@btamail.net.cn?Subject=REMOVE

1 0

Relieve your ETL project pain - 25 critical checkpoints
by Data Junction Corporation 29 Nov '01

29 Nov '01

You've received this offer because because you've previously expressed interest in data warehousing, ETL or data integration. Feel free to pass along to your data-centric friends and colleagues! To be removed from receiving future offers, please forward a copy of the complete message to unsubscribe(a)datajunction.com. You are subscribed as <cypherpunks(a)toad.com>. **************************************************************************** **FREE! "25 critical checkpoints for pain-free ETL", distilled from more than 700+ man-years' ETL experience.** Need to reduce your ETL project pain? Your PDF copy of "25 critical checkpoints for pain-free ETL" is FREE for a limited time, but the experience that informs it is priceless. Download now! http://www.datajunction.com/specials/welcome.asp?ID=SG2 **How do you know the optimal time to use intermediate data formats for ETL? Should you choose HTTP or SMTP if ETL recoverability is an issue? How do scalability and reusability impact each other?** Find your best answers to these and many other questions. "25 critical checkpoints" is just a click away, and it's FREE. http://www.datajunction.com/specials/welcome.asp?ID=SG2 **Reduce your ETL project pain and download today -- you have nothing to lose, and you could gain a world of ETL savvy.** These checkpoints are based on Data Junction's more than 700 man-years' experience in integration. Benefit from others' hard-won wisdom, and use these checkpoints as part of your next integration proof-of-concept or RFP. While you're downloading, you can learn more about our award-winning tools and solutions. Go to http://www.datajunction.com/specials/welcome.asp?ID=SG2 today. Please use Priority Code SG2. Thanks for your time. David Inbar Vice President, Sales and Business Development Data Junction Corporation

1 0

Slashdot | Seeking Current Info on Linux Encrypted FS?
by Jim Choate 29 Nov '01

29 Nov '01

http://slashdot.org/askslashdot/01/11/28/1549252.shtml -- -- ____________________________________________________________________ Day by day the Penguins are making me lose my mind. Bumper Sticker The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

TheBostonChannel.com - Helen Thomas - It's The People's White House
by Jim Choate 29 Nov '01

29 Nov '01

http://www.thebostonchannel.com/helenthomas/1095648/detail.html -- -- ____________________________________________________________________ Day by day the Penguins are making me lose my mind. Bumper Sticker The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

CDR: Re: Speech May Not Be Free, but It's Refundable
by Jim Choate 29 Nov '01

29 Nov '01

On Wed, 28 Nov 2001, David Honig wrote: > > Speech May Not Be Free, but It's Refundable > > Its not censorship if its not the government. Bullshit. Any time ANY(!!!) party interferes with your free expression it is censorship. ----- The above are your words, you've said them. Congratulations, you've just contradicted yourself, and therefore are wrong. Again. Gee, what a surprise. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :Surveillance cameras|Passwords are like underwear. You don't /|\ \|/ :aren't security. A |share them, you don't hang them on your/\|/\ <--*-->:camera won't stop a |monitor, or under your keyboard, you \/|\/ /|\ :masked killer, but |don't email them, or put them on a web \|/ + v + :will violate privacy|site, and you must change them very often. --------_sunder_(a)_sunder_._net_------- http://www.sunder.net ------------

1 0

CDR: Re: Speech May Not Be Free, but It's Refundable
by Jim Choate 29 Nov '01

29 Nov '01

On Wed, 28 Nov 2001, David Honig wrote: > > Speech May Not Be Free, but It's Refundable > > Its not censorship if its not the government. Bullshit. Any time ANY(!!!) party interferes with your free expression it is censorship. ----- The above are your words, you've said them. Congratulations, you've just contradicted yourself, and therefore are wrong. Again. Gee, what a surprise. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :Surveillance cameras|Passwords are like underwear. You don't /|\ \|/ :aren't security. A |share them, you don't hang them on your/\|/\ <--*-->:camera won't stop a |monitor, or under your keyboard, you \/|\/ /|\ :masked killer, but |don't email them, or put them on a web \|/ + v + :will violate privacy|site, and you must change them very often. --------_sunder_(a)_sunder_._net_------- http://www.sunder.net ------------

1 0

Calif's online birth records questioned (ID, privacy, etc)
by Khoder bin Hakkin 29 Nov '01

29 Nov '01

http://ap.tbo.com/ap/breaking/MGAGJMM2NUC.html Calif. Lawmakers Question Availability of Birth Records Online By Jennifer ColemanAssociated Press Writer Published: Nov 29, 2001 SACRAMENTO (AP) - California birth records - available online through genealogy sites - could be used to create false identity documents, a state lawmaker warned. But even privacy advocates admit limiting access to the public records won't solve the problem of identity theft, or the production of fake identification cards, such as those used by the men suspected in the Sept. 11 terrorist attacks. State Sen. Jackie Speier said Wednesday she was appalled that California officials sold an index of birth records dating back to 1905 to genealogy site RootsWeb.com. With a few clicks of the mouse, Speier demonstrated at a Senate hearing on privacy how easily she could find information such as date of birth and mother's maiden name for herself - and state Attorney General Bill Lockyer. That information is often used by banks as identifiers for transferring funds, she said. The Department of Health Services sold the index twice this year for about $900 each, officials said. The state doesn't keep records of who buys the indices. "The index is a public record. We are compelled to provide that information" under the California Public Records Act, said Mike Rodrian, chief of the DHS's center for health statistics. Calls to RootsWeb.com by The Associated Press seeking comment were not immediately returned. Copies of birth certificates are available through county registrars or through the state vital records office in Sacramento, said DHS spokeswoman Lea Brooks. Though the state database contains "two of the three key pieces of information needed to commit fraud" removing the list might not reduce identity theft, said Beth Givens, executive director of the San Diego-based Privacy Rights Clearinghouse. "The vast majority of identity theft cases don't involve birth certificates. Where the birth certificate factors in is primarily where it's used by undocumented immigrants to obtain identification," she said. Speier said the fact that birth records are public "should raise some red flags" especially following news that suspects in the Sept. 11 terrorist attacks were able to get fake driver's licenses in Florida and Virginia. Terry Francke, with the California First Amendment Coalition, said other states have been removing public documents from the Internet following the Sept. 11 terrorist attacks. "There is a fair spate of this happening," Francke said. In September, the U.S. Judicial Conference decided to remove online access to federal criminal filings, saying the documents would remain available at courthouses, but were too available on the Internet. Other government agencies have also pulled some information off-line. The Environmental Protection Agency no longer offers detailed reports on chemical plants online, saying the information could be used in terrorist attacks. The reports are still available at the agency's office. The debate over whether birth records are public records should be focused on if the documents "give the people the ability to keep an eye on their government, or is it providing access to people's personal information," said Gary Daniels, of the National Center Against Censorship.

2 1

Re: Antivirus software will ignore FBI spyware: solutions
by Tim May 29 Nov '01

29 Nov '01

[I sent this a couple of hours ago, hasn't appeared on my feed, lne.com. Apologies if you get it twice.] On Monday, November 26, 2001, at 11:49 AM, Sunder wrote: > Great and wonderful except: > > 1. If such spyware has already been installed on your system you can't > trust your os therefore: > > a. It may use your OS to hide the key capture log, so you > won't be able to just watch files. Think of a kernel patch > that removes all references to a specific file, not just > sets it to be hidden. Yes, but this is probably beyond current and foreseeable attacks. I don't dispute that all sorts of advanced attacks are possible, just that the fixes this guy suggested are "much better than doing nothing." Even _secure_ OSes (KeyCOS, for example) are vulnerable to attacks when physical access is gained...doesn't make it easy, though. > > 4. If you live in a crowded area, your iPod can be lifted off you > in a false mugging, or break in, pick pocketting while you're at a > restaurant, movie, etc. This implies a level of surveillance/commitment beyond what most FBI attacks are at. More importantly, theft of my iPod would then trigger certain actions. Cancelling my existing key and generation of a new one. All of these kinds of "they've got your hardware" attacks are present with nearly all systems. All require more work than the simple insertion of a keystroke logger involves. It's all measures and countermeasures. > > 10. Ordered any new copies of a bit of software? Maybe they have a deal > with FedEx, UPS, the Mailman. Maybe what you're getting is the upgrade > and then some. How can you tell that copy of SmallTalk doesn't carry an > extra bit of code just for you? How can you tell that the latest patch > to > MacOS you've just downloaded really came from Apple? Sure DNS said it > was > from ftp.apple.com but how do you know that the router upstream from > your > internet provider didn't route your packets via ftp.fbi.gov? Paranoia can be a dangerous thing. --Tim May "Gun Control: The theory that a woman found dead in an alley, raped and strangled with her panty hose, is somehow morally superior to a woman explaining to police how her attacker got that fatal bullet wound" --Tim May "That government is best which governs not at all." --Henry David Thoreau

3 2