- cypherpunks-legacy - lists.cpunks.org

Lots of work to do.
by crunch＠netcom.com 20 Nov '92

20 Nov '92

I said earlier: >> I've been getting good support for my ideas on implementing machine >>independent modules or "Libraries" of PGP routines that don't include >>I/O portions, but after looking at the code, I see this is going to >>take a lot of work, both in organizing the effort, and in implementing >>the code. Just how this is going to be done, I'm not sure, but this >>is what cypherpunks is all about. To hash these things over, flame on >>each other's ideas, etc. Miron says: >It would be very nice if PGP behaved better as a UNIX filter. For >example, I'd like it to return an exit code if it fails. I'd >also like it to have a flag that disables any access to the tty >for prompts. For example, if I have an automatic filter that >tries to decrypt all incoming messages, I don't want it to prompt >for a secret ring file when it can't decrypt something. I say the folliwing: The UNIX filter can certainly be written, but it should use the "services" of the PGP library code, which might have functions specifically for use with UNIX, But may not be called by Mac API's. It's important for me to point out that these PGP routines as C functions should be implemented as "Agents" or "Engines" and be totally self contained and not be depending on UNIX, MacOS or other facilities. It is fair for UNIX programs to CALL them, but the PGP should not depend on UNIX, or Machine dependent facilities other than File IO. Paul Rubin writes: >Those of us who support the freedom to use cryptography, run PGP, and >write whatever programs we wish (cryptographic and otherwise) should >be aware that the boycott against Lotus and Apple is still on. By >making PGP run on Macintoshes and with Lotus Notes, we improve the >usefulness of those systems and thereby help our enemies take away our >rights. I say --- Great!! but I have invested a lot of my own finances into purchasing my Mac II (Probably long before the boycott), and I certainly want to put it to good use. This includes my rights to privacy and to use PGP. I don't like Apple's policy, and think it sucks, especially if they dump hundreds of Mac programmers on the job marketplace, but sure don't want to ditch my Mac just because a few Apple FAT CATS made bad decisions. David Clunie writes: >2. A preliminary perusal of the code makes it obvious that extracting the > functionality from the interface is not an easy task. I agree, this isn't going to be easy, SW development is NEVER easy, so who is afraid of a little work? With all those unemployed programmers out there, we should be able to get PLENTY of help! JD

1 0

Re: PGP to SMTP mailer
by phr＠napa.Telebit.COM 19 Nov '92

19 Nov '92

Those of us who support the freedom to use cryptography, run PGP, and write whatever programs we wish (cryptographic and otherwise) should be aware that the boycott against Lotus and Apple is still on. By making PGP run on Macintoshes and with Lotus Notes, we improve the usefulness of those systems and thereby help our enemies take away our rights.

2 1

Re: Some proposals, Anonymous mailers
by dclunie＠pax.tpa.com.AU 19 Nov '92

19 Nov '92

> I've been getting good support for my ideas on implementing machine > independent modules or "Libraries" of PGP routines that don't include > I/O portions, but after looking at the code, I see this is going to > take a lot of work, both in organizing the effort, and in implementing > the code. Just how this is going to be done, I'm not sure, but this > is what cypherpunks is all about. To hash these things over, flame on > each other's ideas, etc. > > I have been studying the PGP code, and can see it's going to take a > lot of work to get it into a form where true machine portability can > be realized. As a Mac purist, a abhore the idea if translating Mac > GUI actions into ascii text and sending it to the current PGP "engine". > > Although it would take a lot of work, I propose that we develop PGP > to have the following form. > > a) Encryption engine library - Main set of routines currently in the > PGP program dealing with encryption of data. These would be I strongly support this concept. Having just implemented a new anonymous mail and posting system with privacy enhancement using PGP on a Unix machine, using the existing PGP code which is very keyboard oriented, proved to be a real headache, trying to second guess the responses that pgp expected. The whole deal would have been much easier calling library routines, or even more "Unix" like tool type interfaces. I am seriously considering rewriting some bits of PGP to do what I need but unfortunately: 1. I don't know anything about encryption, as Phil has made obvious in his responses to my ideas (quite rightly so). 2. A preliminary perusal of the code makes it obvious that extracting the functionality from the interface is not an easy task. However, I would be happy to volunteer my services should no one Unix based with more PGP or encryption experience is available. I also live outside the US at present which is a plus I guess as far as RSA is concerned. BTW. Re. my anonymous service - once I have Phil and Hal's suggestions implemented feel free to use it. Send mail to "anon.info(a)pax.tpa.com.au". The service is not yet really on-line, but if anyone wants to play with it feel free (given the proviso that I might change things and take it up and down periodically until I get it right; I will try to preserve alias #'s and stored public keys that have already been sent along). It is not based on the current perl scripts - I hacked it up in Bourne shell scripts before I heard about other peoples efforts, so all bugs are mine ! Note that it is basically a typical anonymous mailing system like that used in the various alt.personals and alt.sex groups, except that you can encrypt your messages to it, and it will encrypt responses back to you automatically, so dubious bounced mail and replies will not be readable by other's at your site or on the path. At present it is set up to allow posting to any group, but I am seriously considering blocking out the k12 groups after the recent godiva fiasco, quite against my philosophy, but my better judgement may yet prevail :( The same may go for file size and even rapidly repeated messages to the same addresses to prevent common patterns of "anonymous abuse". I hate to do this and may not, but I get the impression that I would be foolish not to. The immaturity of some people out there amazes me. BTW. I have also started a new mailing list for discussion of anonymous groups in general as well as my system. Send mail to "anon.subscribe@ pax.tpa.com.au" if you want to join. The list is strictly plaintext at the moment though unfortunately ! david

1 0

Some proposals to consider
by crunch＠netcom.com 19 Nov '92

19 Nov '92

Greetings fellow cypherpunks: A lot has happened since I got on here last Friday. My previous message contains my public key, Pse use it if you want to send me private mail. I bet the NSA boys are tearing the hair out of their heads by now, but it's about time we do something to preserve our privacy. It is my plan to help "organize" the Mac implementation of PGP, by putting together a Mac Implementation team of programmers to beef up MacPGP, by added better GUI, such as cutting and pasting of keys DIRECTLY into key rings without having to go through a file (makes for added security). My plans also call for tight coordination with the other platform development teams. I've been getting good support for my ideas on implementing machine independent modules or "Libraries" of PGP routines that don't include I/O portions, but after looking at the code, I see this is going to take a lot of work, both in organizing the effort, and in implementing the code. Just how this is going to be done, I'm not sure, but this is what cypherpunks is all about. To hash these things over, flame on each other's ideas, etc. So far, the Mac inplementaion team consists of the following individuals, and are (or soon will be) working closly with Eric Hughs, Phil Zimmerman, and the other PGP folks Mac PGP team: Richard Outerbridge [71755.204] Jim Clausing internet: jac(a)cis.ohio-state.edu Zbigniew Fiedorowicz internet: fiedorow(a)function.mps.ohio-state.edu INTERNET:crunch@netcom.com INTERNET:crunch@netcom.com Doug McNaught internet: doug(a)midget.towson.edu Philip Zimmermann internet: prz(a)sage.cgd.ucar.edu I talked with another individual last evening who also wants to be added to the team, but the others haven't yet been introduced to him yet. It is my plan to propose this idea to the PGP meeting at Sygnus this upcoming Saturday at noon. Then, I'll report to those that couldn't make it, due to their location. The progress on the Rander box is as follows: I am currently evaluating several proposed designs, and have sent out queries for data sheets on devices I plan on checking out for use, prices, etc. I have been studying the PGP code, and can see it's going to take a lot of work to get it into a form where true machine portability can be realized. As a Mac purist, a abhore the idea if translating Mac GUI actions into ascii text and sending it to the current PGP "engine". Although it would take a lot of work, I propose that we develop PGP to have the following form. a) Encryption engine library - Main set of routines currently in the PGP program dealing with encryption of data. These would be a set of "support" routines that would permit encryption of data in files, as well as data in memory. These would be totally machine independent, and only ONE set of sources should exist and contain compiler options for platform specific code. These functions would then return error codes instead of console output. Needed "key phrases" can be passed in as "char *", and sucessful operations would return NULL or if error, an appropriate code be returned. Other routines would be necessary, such as telling it where the random ring buffer is located, and how long it is. These routines would maintain their own pointers into this buffer. This library would call routines in the Random number manager and pass information such as where the buffer is located. See below: b) Key management library - Main set of routines that know how to manage the keyring files, it would have functions designed to extract keys, add and remove them, and work on the keyring files directly. Again, these would be machine independent routines. This would also call routines in the Random number manager below. c) Random number management - Main set of routines to manage a "circular buffer" of random numbers used to generate keys. This would work with both software and hardware random number generators, and would provide externally machine independent functions, but internally they would be machine specific. d) GUI's for the various PGP application programs. Mail management, file management, network applications, etc, all calling the routines in a,b, and c. Also includes Hypercard Xcmds, etc. Items a and b should have only ONE set of source code, and be maintained and managed by existing people. Items c would also be same source code, but have conditional compiler statements to "switch in" the machine dependent portions as apppropriate. I think it's possible to design the code in a and b to have very few machine dependent conditional compiler #ifdef statements, by forming the main PGP guts portion to operate on textual input in the form of "char *" instead of console input, and let the calling code pass "char *" to PGP library routines. Machine dependent stuff is in (d) and might include existing UNIX PGP "main()", Mac PGP main application, and lower level "utilities" such as Hypercar XCMD's etc. In fact, it is even possible to build these libraries to use NO global variables, and use structures instead. But me, being Mac biased, will probably get a lot of resistance to this proposal, but it is just that, a PROPOSAL. At any rate, I think that portability issues would be better solved if we were to adopt C code portability and to assume that not ALL platforms work well with console type input, and that Console I/O should be "factored out" of the machine independent portions of the existing PGP code. So, what way folks, has anyone got a better idea or proposal? Cheers JD

2 1

Another remailer
by wmo＠rebma.rebma.mn.org 19 Nov '92

19 Nov '92

I've installed Eric's anonymous remailer scripts at remailer(a)rebma.mn.org. Rebma is my home machine... It's not right on the Internet, but it is a Telebit connection away. Feel free to use it as you see fit. I don't have Hal's PGP additions, but I am interested in running them. Hal's messages said he hoped more people put up remailers so that they could be chained together. Sounded good to me. -Bill -- Bill O'Hanlon wmo(a)rebma.mn.org

1 0

Re: How far is to far?
by tcmay＠netcom.com 19 Nov '92

19 Nov '92

Mark (mark(a)coombs.anu.edu.au) writes: > Maybe it's not in the spirit of this mailing group but what of the question > of purposeful abuse of the anon mailers/newsposters? Say for instance some > person posts either a sh*tload of garbage to every known group, flooding > the USENET or a more personal attack whereby they send out anonymously > information that was so fundamentally personal to someone they could > possibly react very badly.... > > What if someone posted some top secret information and the various three > letter acronyms all went out for someone's blood. Abuses of various sorts will surely occur. The same thing happens with the postal systems of the world ("blackmail," poison pen letters, ransom demands, extortion threats, child pornography, sedition, etc.), with the phone systems (ditto above), freely available Xerox machines, and so on. Computers and computers nets will be no different. A difference is that the authorities are trying to stop all such abuses on computer nets and all such things they dislike by banning privacy and by restricting use. This is a doomed effort. > As a few people have mentioned they would *like* the opportunity to use > an anon system but the initial step of creating and running it isnt so > appealing due to the fundamental dangers of it. > > Most people would respect such systems but you find one really rotten or > immature loser that will use it for there own anti-social ends. This is where "reputations" and "kill" files come to the fore. Immature flames and other minor crimes are best dealt with by "down-checking" the reputation of the digital pseudonym of the offender. (Completely anonymous postings, where no "handle" or digital pseudonym is provided are likely to be "killed" by most readers.) For more serious "crimes" perpetrated by crypto users, well, nothing's perfect. As I said above, they have other channels to use as well. An advantage of the digital pseudonym nets is that these criminals don't know who you are or where you live (a la "True Names") and hence can't perpetrate certain crimes. When in cypherspace, be careful! --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: awaiting Macintosh version. -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: awaiting Macintosh version.

1 0

Re: How far is to far?
by fen＠genmagic.com 19 Nov '92

19 Nov '92

[mark(a)coombs.anu.edu.au writes:] >Maybe it's not in the spirit of this mailing group but what of the question >of purposeful abuse of the anon mailers/newsposters? Say for instance some >person posts either a sh*tload of garbage to every known group, flooding >the USENET or a more personal attack whereby they send out anonymously >information that was so fundamentally personal to someone they could >possibly react very badly.... I see two answers: one is public censure, which has appeared to work to a large extent in at least one newsgroup whose users make habitual use of an anonymous remailer (alt.sex.bondage) . Another is broadcatch, a favorite topic of mine, which is concerned with the filtering of information. (Note: where "broadcast" is a one-source-to-many subscriber system, "broadcatch" scans many sources for information relevant to one subscriber. The end result is less quantity and higher quality.) With broadcatch, you could turn off threads of conversation you were not interested in, block out flamers, and IGNORE ANONYMOUS EMAIL in general. Of course, pseudonyms may come to be trusted and thus not filtered out, though they, too, are cryptographically anonymous. (Another common mechanism of broadcatch filters is to allow through articles with mentions of the subscriber's name.) Also, in the long run, when networks are made up of smarter, cooperating machines, neighboring machines to a flamer that is generating mass ammounts of email will begin to choose not to listen as often at that address. In sum, I think that it is someone's right to say anything they want, as long as I don't have to listen. Fen ~~~ ~~~ Fen Labalme General Magic We Are Everywhere 40 Carl Street #4 2465 Latham Street ------------------- San Francisco CA 94117 Mountain View CA 94040 The US Constitution 415/731-1174 (home) 415/966-6273 (my desk) may not be perfect, <fen(a)netcom.com> 415/965-9424 (fax) but it's better than <fen(a)well.sf.ca.us> <fen(a)genmagic.com> what we've got now.

1 0

Re: Anymous Remailers and Newsposters
by fen＠genmagic.com 19 Nov '92

19 Nov '92

[VANGUARD(a)gribb.hsr.n0 writes:] >I have been aware of the need to make anonymous postings on the >newsnet. I have made most of the neseccery softwar to allow for such >a gateway, but it seems that the local system administartor is >strongly opposed to the idea of the protection given by beeing >anonymous. Such a gateway has an enourmous potential, and it is easy >to see why some wouldn't like the idea. I just thought I'd mention that there are several anonymous remailers currently in use by users of the alt.sex.bondage newsgroup. Unfortunately, I don't have the addresses handy, but they re-post the address and instructions for use every week or so... Fen ~~~ ~~~ Fen Labalme General Magic We Are Everywhere 40 Carl Street #4 2465 Latham Street ------------------- San Francisco CA 94117 Mountain View CA 94040 The US Constitution 415/731-1174 (home) 415/966-6273 (my desk) may not be perfect, <fen(a)netcom.com> 415/965-9424 (fax) but it's better than <fen(a)well.sf.ca.us> <fen(a)genmagic.com> what we've got now.

1 0

Re: PGP to SMTP mailer
by fen＠genmagic.com 19 Nov '92

19 Nov '92

[wcs(a)anchor.ho.att.com (Bill Stewart) writes:] >On the other hand, I'd be interested in seeing a PGP hook built into >Lotus Notes .... if Lotus were to license RSA support. I believe that Lotus has licensed RSA technology for notes. Fen ~~~ ~~~ Fen Labalme General Magic We Are Everywhere 40 Carl Street #4 2465 Latham Street ------------------- San Francisco CA 94117 Mountain View CA 94040 The US Constitution 415/731-1174 (home) 415/966-6273 (my desk) may not be perfect, <fen(a)netcom.com> 415/965-9424 (fax) but it's better than <fen(a)well.sf.ca.us> <fen(a)genmagic.com> what we've got now.

1 0

How far is to far?
by mark＠coombs.anu.edu.au 19 Nov '92

19 Nov '92

Maybe it's not in the spirit of this mailing group but what of the question of purposeful abuse of the anon mailers/newsposters? Say for instance some person posts either a sh*tload of garbage to every known group, flooding the USENET or a more personal attack whereby they send out anonymously information that was so fundamentally personal to someone they could possibly react very badly.... What if someone posted some top secret information and the various three letter acronyms all went out for someone's blood. As a few people have mentioned they would *like* the opportunity to use an anon system but the initial step of creating and running it isnt so appealing due to the fundamental dangers of it. Most people would respect such systems but you find one really rotten or immature loser that will use it for there own anti-social ends. Comments? Mark mark(a)coombs.anu.edu.au mark(a)gnu.ai.mit.edu markm(a)rmit.edu.au

2 1