- cypherpunks-legacy - lists.cpunks.org

Freenet and anarcho-capitalist
by Jim Choate 09 Dec '00

09 Dec '00

http://slashdot.org ____________________________________________________________________ Before a larger group can see the virtue of an idea, a smaller group must first understand it. "Stranger Suns" George Zebrowski The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

RE: Signatures and MIME Attachments Getting Out of Hand
by Trei, Peter 09 Dec '00

09 Dec '00

> ---------- > From: Sean R. Lynch[SMTP:seanl@literati.org] > Reply To: Sean R. Lynch > Sent: Thursday, December 07, 2000 8:58 PM > To: petro > Cc: cypherpunks(a)cyberpass.net > Subject: Re: Signatures and MIME Attachments Getting Out of Hand > > <<File: SMIME.txt>> > > Sean writes: >ASCII plain text *is* The Way. But guess what, PGP/MIME *is* plain text. >You can even parse it with your eyeballs. Sean: Guess what: Your message comes as an attachment, which I have to open seperately. Peter

2 1

NYT:The Nexus of Privacy and Security
by Anonymous 09 Dec '00

09 Dec '00

By JOHN SCHWARTZ EDMOND, Wash., Dec. 7 Q Trust us. Please? That is the message from leaders of high-technology businesses and advocacy groups at SafeNet 2000, a Microsoft-sponsored conference on computer security and privacy. The stated purpose of the conference, which opened here today, is to reach a consensus on issues like when and how to publicize vulnerabilities in a vendor's software Q like, say, Microsoft's Q that could compromise privacy or data security. But the freewheeling panel discussions today touched on all the major policy issues facing high technology companies. And it showed, as Microsoft's chairman, William H. Gates, said in a keynote address, that privacy and security "are tied together in a very deep way." Announcing a Microsoft initiative on consumer privacy, Mr. Gates said the next version of the company's Internet Explorer software for browsing the Internet would incorporate a technology that could make it easier to ascertain the privacy policies on Web sites. The conversation at the conference was remarkably frank, and sometimes quarrelsome. In a discussion of privacy issues, Nick Mansfield of Shell Services International, a computer services subsidiary of the Royal Dutch/Shell Group, praised consumer privacy rules passed by the European Union and said that in contrast, "I don't see anything intelligent in the privacy field in North America." The comment elicited a murmur of irritation in the packed meeting room, but a few minutes later, Microsoft's own chief privacy officer, Richard Purcell, said much the same thing. Consumers, he said, merely see an industry that is squabbling over position in the market, not one that is moving forward with any coherence on privacy issues. "How do we get to that vocabulary, that purpose and that channel of communication," he asked, "that assures consumers that we aren't a lot of evil-headed monsters?" It was notable, though little remarked by the attendees, that the conference's host has often been at the center of the privacy and security debate. Some of the most prominent computer virus attacks, including the "I Love You" program started early this year in the Philippines and the Melissa program last year, took advantage of the vulnerability of Microsoft's wares and their near- ubiquity around the globe. Some who did not attend the conference were not so gentle. "The irony of it is amazing," Jeff Bates, editor of the online technology news site known as Slashdot, said in an e- mail interview. He accused Microsoft of being "a company that leaves me vulnerable to security holes so that it can make my screen look prettier." Others at the conference noted that one of the meeting's goals Q to come up with standard procedures for reporting software flaws Q would serve Microsoft well, since it has long been the victim of "gotcha" announcements that describe bugs before the company has had a chance to fix them. A former hacker who goes solely by the name of Mudge, who now works as a security consultant, defended Microsoft for having changed since the days when he and his friends would gleefully publish examples of its software flaws on the Internet. "There was a time when they would treat an information release quite differently," he said, by trying to sweep the problem under a rug. In recent years, Microsoft has poured money and personnel into responding to bugs, and has improved its relations with those who publicize them, Mudge said. Describing the new privacy features in Internet Explorer, Mr. Gates said they would let consumers decide what level of privacy protection they need Q whether, for example, the machine should accept cookies, the software deposited in consumers' PC's by Web sites to track visitors. The system, known as Platform for Privacy Preferences Project, or P3P, has long been under independent development. But the announcement means that Microsoft is pulling back from a simpler approach to giving consumers more control over their cookies by letting them block all "third party" cookies, those originating from sites other than the one that the Web surfer is visiting. Such cookies irk many privacy advocates, who say that they expose consumers to scrutiny by advertising firms, for example, without their knowledge or consent. On the security side, Mr. Gates said Microsoft, which suffered an embarrassing series of hacker intrusions in October, had been trying to act as a model for other companies by instituting a pilot program using "smart cards" to restrict access to the inner workings of the company's computer networks. The project put the cards into the hands of about 1,000 system administrators, who must insert them into special readers on their computers to make any changes on the company's networks. Barry Steinhardt of the American Civil Liberties Union said the example showed the frequent tension between privacy and security, since the technology allows a person's movements to be tracked when a door is opened or a PC used. Smart cards, he said, "have value as security technology, but they are very destructive of privacy Q you're identified everywhere you go." Mr. Gates called for enhancing network security systems to help people get the information they want, block the mail they do not want and prevent computer intrusion. Moments after his speech, Microsoft's public relations firm sent out press releases announcing that the kinds of security software described by the Microsoft chairman were available from Microsoft.

1 0

Personal Firewalls Fail the Leak Test
by Nomen Nescio 09 Dec '00

09 Dec '00

By Brian McWilliams In an attempt to show that personal firewalls may afford their users little protection against serious threats, a respected PC security expert has released a new software tool that pokes holes in many of the leading desktop security packages. Security-conscious Internet users, especially those on broadband connections, have made desktop firewall software into a booming business for companies like Symantec and Network Associates. But according to Steve Gibson, president of Gibson Research, almost all of these utilities only provide "pseudo protection" against attacks. That's because they put most of their effort into blocking incoming hacker attacks, while paying only scant attention to what he calls internal extrusion. "I really believe the problem of software in your computer misbehaving is much bigger than the problem of hacker attacks. Most people don't have any vulnerabilities; there's nothing a hacker can do to you. So I argue against the necessity of any kind of inbound blocking tool," said Gibson. To prove his point, Gibson has developed a free utility called LeakTest. The 27-Kbytes program is a trojan-horse/spyware simulator that attempts to slip past a personal firewall's defenses and connect to a server on the Internet. Not surprisingly, popular intrusion detection programs like BlackIce Defender from Network Ice fail to catch the outgoing connection and report it to the user. But more disturbingly, several firewalls that claim to offer outbound detection are also fooled by LeakTest. Among them, the best selling Norton Personal Firewall and McAfeeFirewall. Both are among a small number of desktop firewall programs that attempt to address the problem of unauthorized outbound leakage, but Gibson says they fall short and can be easily fooled or bypassed because they come pre-programmed to allow some applications to pass through the firewall. "This idea of allowing all these apps pre-approval is ludicrous. It's trivial to get permission out of the firewall without notifying the user," said Gibson, who observed that only one firewall, ZoneLab's ZoneAlarm, prevents malware from masquerading as a trusted program. "They do a cryptographic signature of the programs you're allowing. That's not hard to do, but they're the only ones who do it," he said. Tom Powledge, Symantec's product manager for Norton Internet Security, said the risks outlined by Gibson are low if users are running both a firewall and anti-virus software. And he said Symantec knows of no instances of programs that specifically target Norton Personal Firewall, which is shipped with NIS. But in response to Gibson's critique, Symantec plans to revise the application integrity checking feature in NIS, with an update available to users over Live Update by early next week. In the meantime, Powledge said concerned users can turn off automatic firewall rule creation. Judging by comments on the LeakTest message board at Gibson's site, plenty of users are concerned about the newly exposed porosity of their favorite firewall software. But Symantec's Powledge said their fears could have been avoided if Gibson had given vendors the customary advance notice before releasing LeakTest. "We were seeing no concern about this, and no exploits have been written. And while this makes customers aware of a potential issue, it also makes hackers aware," said Powledge. But Gibson, who had an earlier run-in with RealNetworks over the privacy behavior of its RealDownload product, said he's learned that unless pressure is brought to bear, companies are resistant to change. "These firewalls are not going to get better unless there's someone saying and able to prove -- and to enable the user to prove -- that these things are junk."

1 0

Microsoft banned from security email list
by Nomen Nescio 09 Dec '00

09 Dec '00

By Stephen Shankland Staff Writer, CNET News.com December 8, 2000, 1:05 p.m. PT URL: http://news.cnet.com/news/0-1003-200-4062758.html The administrator of a popular computer security mailing list banned postings from Microsoft on Thursday after the company stripped detailed information out of its advisories, but a compromise is likely on the way. Microsoft last week pared down the security warnings it sends by email to the Bugtraq and NT-Bugtraq mailing lists as well as to 130,000 other subscribers who want to know about vulnerabilities and fixes to Microsoft software, said Scott Culp, Microsoft's security program manger. Instead, the emails include a link to a Web page with additional details. Microsoft made the change so customers get the most up-to-date and accurate information rather than potentially out-of-date news from an archived email. "The goal is to make sure the information is as useful as it can be, it's timely, and it's accurate," he said. But he acknowledged Microsoft still must send new email out if the Web site changes. Bugtraq moderator Elias Levy thought the change was a step in the wrong direction. "I will no longer be approving any advisories with little or no content that point you to some other place for information," he said in a posting Wednesday. The change meant information is a step farther away, not archived and available in a single central source that might not always be available, he said. The dispute marks another chapter in the sometimes rocky relationship between Microsoft and security experts. While outside programmers often find problems with Microsoft's software, sometimes they earn Microsoft's ire by publishing the vulnerability before Microsoft has time to fix it. Levy wasn't the only one to complain. In a note Friday, programmer Forrest Cavalier voted to resurrect the older format, saying Microsoft has been known to move Web pages so older addresses no longer work. "There was a time that Microsoft URLs had a half-life of a few months," he said. Russ Cooper, moderator of a different security mailing list called NT-Bugtraq, applauded Microsoft's change. "Its very easy to have conflicting information about the scope of a vulnerability depending on which email version of the bulletin you're looking at," he said in a Wednesday posting. Culp, who spoke Friday with Levy at a Microsoft security conference, said Microsoft expects to change the format of the advisories to compromise. "There's a trade-off between how often can you send the (advisory) vs. the extra step of going to the Web page. Somewhere in there is a middle ground," Culp said. Levy began posting text versions of the Microsoft Web pages, but he said Microsoft told him "in no uncertain terms" that reproducing the information "would be considered an act of copyright violation." "So until Microsoft changes their policy or changes their email bulletins back to the old format, you won't see them on the list," Levy said. Microsoft is seeking email comment on the new advisory format. About 1,500 people so far have sent their opinions to the secfdbck(a)microsoft.com email address, he said. Levy couldn't be reached for comment today. Another change that comes with the new format is that Microsoft can track who is reading its Web advisories through the use of invisible tracking software called Web bugs, according to Privacy Foundation chief technology officer Richard Smith, who noted that he didn't see that as "a big deal." "One thing that Microsoft is learning here is what bulletins people consider important," he said in a posting to Bugtraq. "With the older format, where all the info was in an email message, they did not get this feedb

1 0

Home Improvement for Christmas
by feedback＠tapdirect.com 08 Dec '00

08 Dec '00

Give our popular Kitchen Remodeling Secrets & Tips eBook as a gift to your favorite do-it-yourselfer. Now is the time before the Christmas rush to receive it for yourself or a friend. What a quick and easy solution for home improvement help in time for Christmas! Remember, the eBook reveals how to save 35% on supplies and appliances, and 50% on hand tools and power tools. Also, how to get maintenance or repair professionals for a lot less money without sacrificing quality, how to keep from getting ripped off and much more. And, you can have it all on your computer for easy reference or send it as a gift for that special someone. Our easy to read text file eBook fully covers all these topics: Kitchens, Bathrooms, Color, Plumbing, Wiring, Painting, Remodeling to add Space, Storage, Flooring, Doors & Windows, Fences, and Decks. Each of the twelve sections includes fixup and repair projects with how-to information and step by step instructions. This entire eBook can be on your computer in just a few minutes. Download it for yourself or send it to a friend or relative as a Christmas gift. Please go now to http://www.tapdirect.com/kitchentips.htm for the most current information on remodeling and home improvement help. Click on the SECURE ORDER FORM button to order with confidence on our secure server. You have nothing to lose! Our satisfaction guarantee covers you completely. Merry Christmas and Happy Holidays! Tom Skinner, Owner Kitchen Remodeling Secrets & Tips

1 0

Home Improvement for Christmas
by feedback＠tapdirect.com 08 Dec '00

08 Dec '00

Give our popular Kitchen Remodeling Secrets & Tips eBook as a gift to your favorite do-it-yourselfer. Now is the time before the Christmas rush to receive it for yourself or a friend. What a quick and easy solution for home improvement help in time for Christmas! Remember, the eBook reveals how to save 35% on supplies and appliances, and 50% on hand tools and power tools. Also, how to get maintenance or repair professionals for a lot less money without sacrificing quality, how to keep from getting ripped off and much more. And, you can have it all on your computer for easy reference or send it as a gift for that special someone. Our easy to read text file eBook fully covers all these topics: Kitchens, Bathrooms, Color, Plumbing, Wiring, Painting, Remodeling to add Space, Storage, Flooring, Doors & Windows, Fences, and Decks. Each of the twelve sections includes fixup and repair projects with how-to information and step by step instructions. This entire eBook can be on your computer in just a few minutes. Download it for yourself or send it to a friend or relative as a Christmas gift. Please go now to http://www.tapdirect.com/kitchentips.htm for the most current information on remodeling and home improvement help. Click on the SECURE ORDER FORM button to order with confidence on our secure server. You have nothing to lose! Our satisfaction guarantee covers you completely. Merry Christmas and Happy Holidays! Tom Skinner, Owner Kitchen Remodeling Secrets & Tips

1 0

Gates to Privacy Rescue? Riiight! (was Re: BNA's Internet Law News (ILN) - 12/8/00)
by R. A. Hettinga 08 Dec '00

08 Dec '00

At 8:30 AM -0500 on 12/8/00, BNA Highlights wrote: > THOUGH TECHNOLOGY MIGHT HELP PRIVACY > A meeting of business leaders in Redmond, Washington led to > a frank debate over the insufficiency of North American > action on consumer privacy and the potential for technology > to play a key role in protecting such privacy. For example, > Bill Gates announced that the next version of IE would > better allow consumers to ascertain Web site privacy > policies. > http://www.nytimes.com/2000/12/08/technology/08SECU.html -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

2 1

今夜はこちらで
by Delivery Boy 08 Dec '00

08 Dec '00

いつもの掲示板・出会い・メールフレンドサイトをご利用戴き有り難うございます。本日は新しいサイトのご案内をさせて戴きます。 http://homepage2.nifty.com/degedock/mori/ もし、ご不要でしたら削除して下さい。今後、このご案内メールご不要の場合は、お手数ですが「リターンメール」して頂ければ次回より削除致します（時間差により重複する場合がございます　その際はご容赦下さい）ご意見・ご希望・ご感想など、ご遠慮なくこちらまで emd(a)ta3.so-net.ne.jp

1 0

RE: Knowing your customer
by Trei, Peter 08 Dec '00

08 Dec '00

Green carders, yes. Visiting foreigners who are not working, not neccesarily. Tourists certainly not. How about if James Higginsbottom opens an account in the London branch of Citibank? Does he need a US SSN to do so? (I don't think so). Can he use the account in the US (I suspect he can). Peter > ---------- > From: R. A. Hettinga[SMTP:rah@shipwright.com] > > At 10:20 AM -0500 on 12/7/00, Trei, Peter wrote: > > > Are you saying that a visiting foreigner can't open a bank account in > the > > US? > > I'd be quite suprised if this is the case. > > I would be surprised if you didn't need at least a tax ID number, myself. > > I'm not sure, because I don't have one, but I think that people with Green > Cards have to have Social Security Numbers, right? > > Cheers, > RAH >

3 2