- cypherpunks-legacy - lists.cpunks.org

CDR: Of Huns and throats
by Nomen Nescio 29 Sep '00

29 Sep '00

from _Onwards to Victory_, Cassell edition, page 100: "The proud German Army has by its sudden collapse, sudden crumbling and breaking up...once again proved the truth of the saying, 'The Hun is either at your throat or at your feet.'" -- Winston Churchill, speech to the United States Congress, 19 May 1943.

3 2

CDR: RE: visor phone vs. starium?
by Tim May 29 Sep '00

29 Sep '00

At 11:18 AM -0400 9/29/00, Trei, Peter wrote: > > >I have greater hopes for doing encrypted voice-over-ip, if we want >something that 's open source and user-verifiable. > A 3-way Cypherpunks physical meeting was DES-encrypted over the MBONE in 1993. Mountain View (CA), Cambridge (MA), and Vienna (VA). Audio quality was sketchy, especially with speakerphones being used, so we ended up turning off the DES. Got a little better, but not much. So, I'm surprised that more than 7 years later this isn't more common. (Confirming once again that Moore's Law is often applied carelessly and means less than some think it does.) Speaking of the Starium, I have the earlier version. It suffers from the "fax effect": those one wishes to communicate with using it must have one, obviously. Very few people do. A good solution for specific groups who can buy N of them and distribute them to all in their group. But not a standard. The Visorphone will also be subject to this, vis-a-vis a crypto module: most users will have Something Else. --Tim May -- ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, ComSec 3DES: 831-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, "Cyphernomicon" | black markets, collapse of governments.

1 0

CDR: RE: Lions and Tigers and Backdoors, oh, my...
by Trei, Peter 29 Sep '00

29 Sep '00

> ---------- > From: Michael Motyka[SMTP:mmotyka@lsil.com] > Using an embedded system is not a new topic here. I think its the only > viable method of securing data. > > On that note, given the little wireless gizmo of Tim's description, the > device could have, via appropriate applications on the insecure > host/transport gateway, access to a services on the host that would > expand its list of resources without compromising security. The obvious > useful resources are the network and mass storage though other i/o might > be interesting. All storage of course would be encrypted and never > available as plain text on the host. Any i/o used should not carry > information that is to be kept private, only as a means to transport > non-critical data into the PDA. > > What is required is a PDA that is open sourced all the way down to the > HW. Is the Palm this way? I think I've asked this before but frankly I > don't remember the answer. There are probably others that are OK. Yopy > looks interesting. Which ones will still be around in a couple of years? > Full source code for the Palm OS is available to registered developers (who have signed an NDA). It's not too difficult to become a registered developer. The only PDA I know of which is open source for HW & SW is the Itsy, but a number (Palm, iPAQ, etc) have had Linux ports. Peter Trei

1 0

CDR: RE: Bad Coding Practices
by Trei, Peter 29 Sep '00

29 Sep '00

> ---------- > From: Steven Furlong[SMTP:sfurlong@acmenet.net] > Reply To: Steven Furlong > Sent: Thursday, September 28, 2000 9:00 PM > To: Multiple recipients of list > Subject: Bad Coding Practices > > "Trei, Peter" wrote: > > <<NSA et al inducing a company to write bad crypto software>> > > > 2. Individual treachery. > > > > This type involves corrupting one or more engineers, whether via money, > > threats, or misplaced appeals to patriotism. This is more likely to > > succeed in the short term than type 1, but is very fragile for several > > reasons familiar to anyone who has done commercial software development. > > > > * Peer code reviews mean that many eyes look at the code. > > * Employee turnover in the field is high - 30-50% year. Thus, bugs > > inserted by earlier compromised employees are unlikely to > > last through many release cycles, as new employees come in > > and say 'Oops - Joe forgot to init the PRNG properly - lets fix > > that!' > > * Source code management systems make it very difficult to a single > > actor to monkey with code secretly, and even harder to cover his > > tracks. > > I'm less sanguine. What follows is mainly based on my experience as a > consulting or contract programming, but it matches the comments of other > programmers. I've never worked at a company which made privacy software, > though several companies rolled their own crypto for their products. > > - Code review? What's that? We can't waste time having programmers look > over each others work. Besides, we don't want to make it look like we > don't trust them. > > Even in shops which did have code reviews, they usually consisted of > Johnny-on-the-spot explaining in broad terms what a function did and > going over a piece of which he was particularly proud while everyone > else nodded sagely while thinking about their kid's soccer practice. I > wouldn't want to testify that any of the "reviewers" had even read the > code before or during the meeting. > My comments on code reviews is based on the practice at my current employer. When upper management supports the practice, and not only allows, but in fact requires engineers to take the time and effort to do real reviews, they can catch a remarkable number of errors. It also means that more than a single engineer is familiar with a given piece of code, which is a Good Thing. > - Depending on the shop, code which is difficult to understand may > remain untouched for years. So long as it does what it's supposed to do, > or its shortcomings can be compensated for at lower immediate cost than > rewriting the blob, many places just leave it be. The code chunk might > well be looked at by many eyes, but they'll all roll up before making > much headway. So the moral for the subverted programmer is to write his > poison pill very badly and don't explain how it works. > This is a real potential problem - old code that hasn't been looked at in years. Re-writing from spec every few years is one solution, but one that is rarely implemented. > - Many places I've worked have been too cheap to buy a version contol > license for every developer, so everyone just logs in as PVCS and checks > in changes. And hardly anyone looks at the comments, except to scan for > comments like "Fixed bug #521". > Clearly, you've worked in places with shoddy (and possibly criminal) practices. > Now, I think your general point is right, that it would be somewhat > difficult for a subverted programmer to insert deliberately broken > crypto, and a very bet to expect it to stay in for any length of time. > However, if the privacy software companies operate anything like the > companies I've worked for or consulted at, it could well happen. > Eavesdroppers in and out of uniform will look for, and try to generate, poor practices which will break otherwise secure systems. What I find most worrying is when management only pays security lip-service, a bullet item for marketing, without any real desire to make it strong. Lucky's discovery that some GSM phones in the US have lousy or non-existant keying practices is one example. I've actually turned down jobs from firms where I felt that they wanted crypto as a bullet item rather than for real security (one place wanted to use 20 bit keys, for example. (they no longer exist)). Peter Trei > Disgustedly, > SRF > > -- > Steve Furlong, Computer Condottiere Have GNU, will travel > 518-374-4720 sfurlong(a)acmenet.net > >

1 0

CDR: Re: More Columbine fall-out
by Secret Squirrel 29 Sep '00

29 Sep '00

Steven Furlong wrote: > ALBANY - Schools will be required to submit copies of their building > plans to local police and fire departments under legislation recently > signed into law by Gov. George Pataki. I wonder if this includes home schools.

1 0

CDR: Exciting News from Dialpad!
by Your Friends at Dialpad 29 Sep '00

29 Sep '00

Dialpad.com Newsletter Volume 1, Issue 1 ***********************Advertisement*************************** This newletter is sponsored by: NetFlip. Get $200 in minutes! Click here! http://click.dialpad.com/dp12354576.240.0.131 *************************************************************** Dear Joe, Thank you for subscribing to our monthly Dialpad.com newsletter. Our newsletter features our latest products, press releases, and tips to make your Dialpad experience the best it can be. Also, please join us in thanking our advertisers. They keep our basic service free through banner advertising. So, if you're online and you see an ad that interests you, please click on it. Clicking never disconnects your calls. The more you click, the more we can improve our services and keep Dialpad free! For questions about our service, visit our Help section at http://click.dialpad.com/dp12354576.240.0.114 where you will find answers in our FAQ's and Dialpad web searcher. We hope you enjoy our service and continue to make free long distance phone calls from your PC to anywhere in the U.S. Regards, Brad Garlinghouse Chief Executive Officer, Dialpad.com P.S. Don't forget to tell your friends about Dialpad! DIALPAD CHECKLIST We've put together a checklist to make calls using Dialpad easier than ever! - Does your keypad not appear? Download the latest JAVA VM here: http://click.dialpad.com/dp12354576.240.0.116 - Still not getting a keypad? Try clearing your cache file. Click here http://click.dialpad.com/dp12354576.240.0.114 for directions.If it still doesn't appear, try downloading the latest version of your browser. - Not sure how to make a call? Check out our tutorial at http://click.dialpad.com/dp12354576.240.0.114 - Hearing an echo? Perhaps it's time to buy a headset from our new dialpadStore at http://click.dialpad.com/dp12354576.240.0.118 THIS MONTH'S FEATURES Here are some of the new features to enhance your Dialpad experience! dialpadStore - Check out the latest e-products in our new store! http://click.dialpad.com/dp12354576.240.0.105 Firewall Reflector - Use Dialpad at work or at home! http://click.dialpad.com/dp12354576.240.0.106 PC-to-PC calling - Call your friends whenever they are on-line! http://click.dialpad.com/dp12354576.240.0.107 Skins - Change the look and feel of your Dialpad applet! http://click.dialpad.com/dp12354576.240.0.108 Dialpad Agent - Launch Dialpad from your desktop! http://click.dialpad.com/dp12354576.240.0.109 **********************Advertisement*************************** Get $200! Click here! http://click.dialpad.com/dp12354576.240.0.131 ************************************************************** DID YOU KNOW? E-commerce - You can save 20% at the new dialpadStore. Just enter coupon DLPD2 at checkout and receive up to $10 off headsets, electronics, and many other great products. Firewall Reflector - Our new patent pending technology facilitates voice data travel across company firewalls, personal NAT and other IP sharing environments. If your company or home firewall blocked Dialpad in the past, give it another try! One-click calling from the phone book - By entering names into your personalized phonebook, you can dial your friends directly with one click of the mouse. Dialing method - You do not need to enter a '1' when entering a 10-digit phone number. You can also make phone calls using letters such as 800 FLOWERS. Capacity - Our capacity is continually being expanded to support our unprecedented growth. That means no more busy signals and less congestion. ***********************Advertisement************************** Make over $200 in minutes! Earn cash by completing offers. Click here! http://click.dialpad.com/dp12354576.240.0.131 ************************************************************** To unsubscribe from this newsletter, simply reply to this email with "Remove" in the subject line.

1 0

CDR: VIPER
by FOX2000 29 Sep '00

29 Sep '00

1 0

CDR: VIPER
by FOX2000 29 Sep '00

29 Sep '00

1 0

CDR: VIPER
by FOX2000 29 Sep '00

29 Sep '00

1 0

CDR: RE: Re: Shunning, lesbians and liberty
by Trei, Peter 29 Sep '00

29 Sep '00

> James A.. Donald[SMTP:jamesd@echeque.com] wrote: > At 12:30 PM 9/28/2000 +0300, Sampo A Syreeni wrote: > > Oh but it is quite possible to put people in similar trouble if we > > grant that the right to property is absolute - if somebody owns on a > > sufficiently wide scale the basic commodities one needs to survive > > in the modern world (like fresh water, farming land, employment > > opportunities), others are born right in the middle of the > > proverbial desert. > > But in a free market this never happens. It only happens when the > government intervenes. Thus, for example, we only see homelessness where > there is rent control, we only see hunger where there is rationing and > collectivized farming, and so on and so forth. > > --digsig > James A. Donald > I haven't been following this debate closely, so I don't know which side you're on, Jim, but I assume (hope!) that you are merely being sarcastic. Peter Trei

1 0