- cypherpunks-legacy - lists.cpunks.org

Internet: commercial or not?
by L. Detweiler 28 Aug '93

28 Aug '93

This is just a little blip on the screen of the increasing strains in the commercialization of the internet, a message enclosed below for your perusal. There is a huge amount of seismic fault-slipping on this subject. What is `allowed' on the internet? For example, are people allowed to send credit card numbers to businesses for purchase? this is happening with e.g. Wired subscriptions and other situations, but most places who advertise directly get flamed by someone in the NSF ranks, and afterwards at least do it more discreetly. The situation is that the `internet' is now such a patchwork of different nets, all with different policies and oversight, is very close to anarchy, but still with distinct `taboos' against commercial activity, to put it lightly. But the day that everyone will be dialing up the Online Shopping Program over their PCs is inevitable and rapidly approaching. The only question is, what will become of the current `internet'? Will future networks just be laid on top of it, or will it whither up after all traffic moves to completely `unrestricted' commercial networks? I was just telling someone in email: to the extent that you like the Internet, it is unrepresentative of the typical government program. To the extent that you dislike it, it is representative. It has only flourished to the degree it has because of relative *unregulation* and *unrestriction*. A major problem is that there is no way to guarantee that a given message traverses exclusively commercial networks in going from one source to another. I propose that new mail protocols be developed that enforce the distinction, such that the message can `request' it be transmitted in a completely commercial `unrestricted' path or not at all. In this way a new group of networks governed by agencies explicitly commited to unrestricted commercial traffic (hehe, sounds sort of ominous like Unrestricted Submaring Warfare). In the current situation, all the government bureacrats fire off messages that `even though your message can travel on commercial nets only, there is no way of guaranteeing that it does not cross public networks, therefore it must abide by NSF Internet Use Policies.' In a system where transmission paths are prescribed for email, a completely commercial network can be achieved, an absolutely critical foundation for all future electronic economics, and all our favorite ideas (digital banks, services, etc.), with no whiney complaints from the Backward Bureacrats. If anyone is familar with the proliferation of online services over commercial internet subnetworks, such as the `biz' distribution of Usenet, please post more information on the progress of this. Read my words! as beautiful and promising as the Internet is today, it is just a small glimmer in the eye of future cyberspace, in which all traffic is unrestricted except in volume and cost per bit (the former prodigious and the latter piddly), so that commercial enterprise can flourish. We have already waited long enough. The current taboos on the internet will look quaintly archaic. Look at the way this guy below is whining because the NIC service had a `nice booth at InterOp' with enough cost to have funded `3-4 full time employees typing whois entries' and asks for an `audit' because of the possibility of (horrors) `advertising'. Yes, in the current dark ages I concede he has a valid point (they are funded in part by NSF grants), but this shows in crystalline clarity the absolutely chilling effect that government funding has on a project (e.g., the internet) in constraining its full commercial development. The greatest supporters are the greatest detractors! Where else would a company be criticized & investigated for having a classy booth at a trade convention (uh, Microsoft excepted)? When the whole cyberspace in unrestricted, though, I suppose he'll pop up complaining about the big companies with glossy booths that could have funded 20 children on Welfare. BTW, Network Information Center, database & catalogue of all internet services, while a thinly veiled approach likely to evolve into a full-fledged charging & advertising Cyberspatial Yellow Pages, is clearly a cornerstone of AT&T's new drive into the internet for the masses. (What is this guy referring to in the `attempt to reduce expected services as with Whois'?) ===cut=here=== Posted-Date: Fri, 27 Aug 93 12:09:31 EDT Date: Fri, 27 Aug 93 12:09:31 EDT Sender: ietf-request(a)IETF.CNRI.Reston.VA.US From: William Allen Simpson <bill.simpson(a)um.cc.umich.edu> To: ietf(a)CNRI.Reston.VA.US Cc: Stephen Wolff <steve(a)cise.cise.nsf.gov> Reply-To: bsimpson(a)morningstar.com Subject: over funding of [InterNIC] It has become apparent with the recent spate of disregard for internet etiquette (posting job positions, posting "advertisements"), and the simultaneous attempt to reduce expected services (whois), the providers of the InterNIC are not suitable. Did everyone see that they can afford a nice booth at InterOp? When did any previous NSF grantee get such a thing? The cost could have funded 3-4 full-time employees typing whois entries. Obviously, the grant was too large, since they have all of this extra money for advertising. And why would they need to advertise, except that they want to leverage a monopoly grant position into some commercial market? I call for an NSF audit to endure that NSF money was not spent for advertising and lobbying. Bill.Simpson(a)um.cc.umich.edu ------- End of Forwarded Message

1 0

No Subject
by Anonymous 28 Aug '93

28 Aug '93

Hi, Being new to this list, I've got a ways to go before I understand everything I'm reading. But one thing I'd like to know today, is JUST WHO IS DAVID STERNLIGHT? I've seen his name mentioned here for the first time, and many times since. Tanks

4 3

Physical security lapses will getcha every time.
by fergp＠sytex.com 28 Aug '93

28 Aug '93

-----BEGIN PGP SIGNED MESSAGE----- On Fri, 27 Aug 1993 01:46:57 -0400 (EDT), Mike Ingle <uunet!delphi.com!MIKEINGLE> wrote - > The most likely place for a bug would be in the randomness. > I suppose it is possible that a one-line bug somewhere could > leave out most of the randomness, making the keys still look > random but actually be predictable. Random number generation > is hard to verify. How has that in PGP been checked? The PGP > source is so big and spread out, it's hard to check. I don't > think there is a bug, but it would be nice if PGP were > carefully examined and attacked. Where are these rumors > coming from? They are bad for the cause. Let's be realistic, Mike. The biggest threat to any security, on any basis, is the threat of human nature. The chances of someone factoring your PGP encoded message is somewhere in the range of slim-to-none, but the chances of someone (you) -physically- compromising their key is much, much higher. In fact, I'd venture to say that it's much higher than even you or I imagine, given the fact that some folks ignore what most of us would deem common sense and use PGP on a multi-user system (such as a SUN server, any other UNIX-flavored workstation, or even a Netware server). Fact Two: That's why you won't see messages from me either (a.) signed with PGP, or (b.) encrypted with PGP from any of my other e-mail accounts. All are UNIX (open) environments and I don't like the implications of the possibilities of my secret key being exposed, even if I do trust the folks I work with. Call me a schizoid. Cheers, -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLH6FrJRLcZSdHMBNAQEs1AP8D3ve8oRYIT4/Lne3LYY9xZWkghZFQyhH CcCdFhHfAyXeAnz6puIpSN+9zior4/W9pcgxK/EdcCt72hMOzTYQvWtFZVIE0nQA Fn+a5FkUwCLhvfiIqCSPvBjG8UvBt2RTuv7GN0IiIfMwzCeAkB9MTkoNQut48DGU thDLDXfnRxs= =0v11 -----END PGP SIGNATURE----- Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> Key fingerprint = EE D2 93 7D 04 6D C6 05 AC 36 AD 9D 8E 4F 41 58

2 1

Re: .Comparing ViaCrypt and freeware.
by peter honeyman 28 Aug '93

28 Aug '93

> If you're worried about backdoors, reverse engineer it and verify > that it works as advertised. Given that the program has to largely > duplicate an existing set of source, this should be trivial. do you mean decompile it, or reverse engineer it based on the outputs? that former is tractable, but i suspect the latter is comparable to "busting" the idea algorithm. neither is "trivial" in my mind. peter

2 1

Re: Source Code NOT available for ViaCrypt PGP
by George A. Gleason 28 Aug '93

28 Aug '93

What about the idea of having someone who is known trustworthy examine the source code under nondisclosure? A passing grade from a couple of the respected members of the community here would be great for ViaCrypt's promotional efforts, if nothing else...! -gg

3 3

Cisco vulnerabilities?
by fergp＠sytex.com 28 Aug '93

28 Aug '93

On Thu, 26 Aug 93 21:17:16 -0600, L. Detweiler <uunet!longs.lance.colostate.edu!ld231782> wrote - > ===cut=here=== > > Date: Wed, 25 Aug 1993 12:56:54 -0700 (PDT) > From: Al Whaley <Al.Whaley(a)sunnyside.com> > Subject: Cisco routers > > Rumors abound that Cisco routers have a back door; that is when > a TCP port is disabled, it can still be accessed from Cisco's > IP number. > > I have personally verified this with the sendmail port. > > Al Whaley al(a)sunnyside.com +1-415 322-5411(Tel), -6481 (Fax) > Sunnyside Computing, Inc., PO Box 60, Palo Alto, CA 94302 > Sure, they have a backdoor -- it's called unsecured ports and lackidaisical security. Cisco routers don't really have "TCP" ports, per se. They have ethernet ports, or token ring ports, v.35 serial ports, and dial-up rs-232 for fail-safe configuration when some idiot drops your feed at the local rboc and you need to "look into" your net. If the "entrance" passwords are enabled properly, then I feel quite sure that this threat is minimal. However, I have learned recently that some facets of SNMP encapsulation can exploit _management_ but can not, however exploit the configuration of the router. It can add to the traffic overhead. Also, there is an additional "enable" password for configuration modification, such as changing IP addresses of the ethernet or serial interfaces (ports) and saving the configuration to NVRAM. I had a guy adamantly try to convince me the other day that the (Cisco) routers were in jeopardy because of the ability to TFTP a new (albeit, damaging) operating system directly into NVRAM (a sleight of hand), rendering the box useless. It can be done, in fact, Cisco would have to ship me a whole new box overnight if it happened, but if I mind my P's and Q's (read: adhere to proper security), he's pissin' in the wind. ;-) Cheers, Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense Type bits/keyID Date User ID pub 1024/1CC04D 1993/03/15 Paul Ferguson <fergp(a)sytex.com> Key fingerprint = EE D2 93 7D 04 6D C6 05 AC 36 AD 9D 8E 4F 41 58

1 0

Re: What, Me Worry?
by Duncan Frissell 28 Aug '93

28 Aug '93

To: cypherpunks(a)toad.com Since I received 3 or 4 requests to explain my earlier signature line... C.>>"In his first three months in the White House, President Clinton C.>killed C.>>more people in the United States than during the 12 years of C.>Reagan-Bush." C.> C.>Could you expand on this? I'm curious. C.> Sorry, I was rushed. The "improved" version: During the first three months of the Clinton Administration, federal enforcement agencies killed more Americans than they killed during the entire 12 years of the Reagan and Bush Administrations. Waco! This is true because usually the Feds kill few Americans directly (fewer than 1 a month). DCF --- ~ WinQwk 2.0b#0 ~ Unregistered Evaluation Copy

1 0

Key Escrow Anecdote...
by wayner＠cs.cornell.edu 27 Aug '93

27 Aug '93

I was speaking with an international crypto consultant who told me this story about a business with an office in a South American country. They decided to start encrypting their link. Within a week, a team of soldiers burst through the door and smashed the encryption hardware to bits. On the way out, they asked, "What are you trying to hide from us?" -Peter

2 1

What, Me Worry?
by Duncan Frissell 27 Aug '93

27 Aug '93

To: cypherpunks(a)toad.com >From Thursday's WSJ news that suggests that the competition may be a tad busy to worry about suppressing strong crypto: Poor Man's Cruise Airliners Can Exploit U.S. Guidance System But So Can Enemies --------- Global Positioning Satellites Could Be Used to Direct Cheap, Accurate Missiles ---------- Defense Aide:It's a Quandry Washington--At the Pentagon, they call it "the poor man's cruise missile." It is a low-flying guided missile or robot aircraft that is relatively cheap to produce, but capable of hitting targets with a precision the U.S. once monopolized... (you can fill in the rest of the story) Reminded me of the late 60's early 70's with VonuLife and the gypsies and the troglodytes arguing that high-tech weapons would render large cities (aka target-rich environments) uninhabitable and people would have to spread out into communities too small to waste hardware on. Also, Vinge's "The Ungoverned" in which tornado-killer missiles are retargeted at the government baddies. This is an example of what I call the Sack-Full-Of-Cats-Thrown-In-The-River effect. As things get dicey for large "target-rich" institutions like governments, and their revenues drain away to the nets, internal and external struggles for fading influence begin. It ends up like a sack full of cats thrown into a river. Noisy, but fun if you don't like the cats. Duncan Frissell Who likes cats himself and could almost feel sorry for the rulers of others if they hadn't quite killed so many people. "In his first three months in the White House, President Clinton killed more people in the United States than during the 12 years of Reagan-Bush." --- WinQwk 2.0b#0

2 1

Re: Digital Coin Claim
by nobody＠pmantis.berkeley.edu 27 Aug '93

27 Aug '93

At 10:24 PM 8/25/93 -0400, Paul L. Moses wrote: >I think that creating a chain of title for digicoins would defeat the whole >purpose of the exercise. Creating a history of ownership is done in order to >increase accountability, not privacy. And such a history is necessary only to >clarify disputes over ownership, liens, defects....things which are simply not >problems with currency and bearer instruments. > >The question is, what is the end to which this chain of title is being put? >To verify that the holder is a "valid" holder? THIS IS IRRELEVANT. He who >holds, owns. Yes, but holds what? I think you missed the point. You're thinking that people use their identity-revealing keys to sign these public documents. I think Hnash intended that people use anonymous or even one-time-only keys. The bearer instrument is not the thing that gets publicized, it is the private key corresponding to the public key in the public document. When you generate that key, you put no identifying info in it. You use it only once, to transfer ownership. Hence, your true identity is not tied in to the history of ownership. This leads back to the question about settling disputes - if the keys associated with the owner of the coin do not identify him, he could attempt to use the same coin more than once. This could perhaps be circumvented by having a single registry. The merchant would wait until the registry showed her (her key) to be the owner before handing over the goods.

1 0