- cypherpunks-legacy - lists.cpunks.org

Re: Geopolitical Darwin Awards
by Tyler Durden 17 Sep '04

17 Sep '04

"Ken Brown" wrote... >Apparently the best thing about is the lack of American tourists - just >like Cuba ;-) What! I'm deeply offended by that remark...I demand you with.... Aw fuckit. It's true. In fact, when I'm in a restaurant outside the US, I have witnessed that the food quality is inversely proportional to the number of Americans in the place. (Oh don't get me wrong...places catering to Americans will have great heaping PILES of food, but it'll be bland and tasteless, and the beer will suck.) -TD "A Big, Fat Dynamo!" -Homer Simpson >From: ken <bbrow07(a)students.bbk.ac.uk> >Reply-To: bbrow07(a)students.bbk.ac.uk >To: Tyler Durden <camera_lumina(a)hotmail.com> >CC: jamesd(a)echeque.com, cypherpunks(a)al-qaeda.net >Subject: Re: Geopolitical Darwin Awards >Date: Fri, 17 Sep 2004 13:45:18 +0100 > >Tyler Durden wrote: > >>Who, the Iranians? Which ones are fanatics? >> >>I'll grant there are some fanatics left in Iran, but Iran seems >>increasingly dominated by fairly sleezy clergy/judges. Like any >>government, theirs is deteriorating into a mere racket. And if you ask me, >>fanaticism never lasts very long anywhere, only for about a generation >>during turbulent times. Iran in particular is a special case...seems to me >>their cultural momentum will always outweigh any temporary fanaticism. A >>country that has a small but thriving prostitution industry can't be all >>that fanatical. > >Prostitution industry? > >Iran has rebooted its swimming-pool maintenance industry. > >Its just this place, you know. > >Apparently the best thing about is the lack of American tourists - just >like Cuba ;-) > _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

1 0

Symantec to acquire @Stake
by R. A. Hettinga 17 Sep '04

17 Sep '04

<http://www.siliconvalley.com/mld/siliconvalley/9682511.htm?template=content…> The San Jose Mercury News Posted on Thu, Sep. 16, 2004 Symantec to acquire digital security company CUPERTINO, Calif. (AP) - Symantec Corp. said Thursday it is acquiring digital security consulting firm stake Inc. Financial details were not disclosed. The deal is expected to close next month. Cupertino, Calif.-based Symantec is one of the world's biggest information security companies, selling consulting services and software such as the Norton AntiVirus program. The company does business with individuals and corporations in more than 35 countries. Cambridge, Mass.-based stake sells consulting services and computer programs to protect networks from hackers and other security risks. Businesses that have purchased the company's SmartRisk and other products include six of the world's top 10 financial institutions and four of the world's 10 top independent software companies. ``Our customers are looking to us for a broad range of security expertise,'' said Gail Hamilton, a Symantec executive vice president. ``By joining forces with the leader in application security consulting, we expand the capacity and capabilities of our consulting organization.'' Symantec shares rose 31 cents to close at $51.32 Thursday on the Nasdaq Stock Market. ------ On the Net: Symantec: http://www.symantec.com stake: http://www.atstake.com/ -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: potential new IETF WG on anonymous IPSec
by Major Variola (ret) 17 Sep '04

17 Sep '04

At 02:17 PM 9/16/04 -0700, Joe Touch wrote: >Except that certs need to be signed by authorities that are trusted. Name one.

3 2

Re: public-key: the wrong model for email?
by Major Variola (ret) 16 Sep '04

16 Sep '04

At 10:28 PM 9/16/04 +0200, Hadmut Danisch wrote: >Because PKC works for this Alice&Bob communication scheme. If you >connect to a web server, then what you want to know, or what >authentication means is: "Are you really www.somedomain.com?" >That's the Alice&Bob model. SSL is good for that. What makes you think verislime or other CAs are authenticating? You can't sue them, they are 0wn3d by a State (and so can issue false certs, just like States issue false meatspace IDs), etc. >If I send you an encrypted e-mail, I do want that _you_ Ed Gerck, >can read it only. That's still the Alice&Bob model. PGP and S/MIME >are good for that. What makes you think that EG is a physical entity, if you haven't met him and learned to trust him through out of band channels? >The sender of an e-mail does not need to pretend beeing a particular >person or sender. Any identity of the 8 (10?) billion humans on earth >will do it. What makes you think that, given 1e10 humans, there are 1e10 identities? Ie, why do you think there is a one-to-one mapping? >PKC is good as long as the communication model is a closed and >relatively small user group. A valid signature of an unknown sender >has at least the meaning that the sender belongs to that user group. PKC is only as good as the means by which you obtain the public key. A server, a CA, are all worthless. The emperor has no clothes, get used to it.

1 0

Phones gain coded security
by R. A. Hettinga 16 Sep '04

16 Sep '04

<http://www.vnunet.com/print/1158147> IT Week Phones gain coded security Certicom offers a cross platform security kit for handset developers Daniel Robinson, IT Week 16 Sep 2004 Cryptography firm Certicom has announced a cross-platform security toolkit for future mobile phone handsets. The Certicom Security Architecture for Mobility will provide a common programming interface for developers to access functions such as encryption across various mobile chipsets and operating systems, according to the firm. The move should speed development of handsets with better security. Certicom's Security Architecture for Mobility (CSA) builds on the company's Security Builder Middleware, a hardware abstraction layer that is optimised to work with a specific chipset or hardware platform. The first supported hardware will be Intel's Wireless Trusted Platform, which consists of security functions that are built into Intel's PXA270 series of XScale mobile chips. CSA will support this from the fourth quarter of this year, and support for other mobile platforms will follow. "Pressure for greater security is coming from enterprise customers. [Security] used to be seen as an add-on to IT systems, but lately it has been regarded as something that has to be embedded from the beginning," commented Certicom's vice-president of marketing, Roy Pereira. CSA has resulted from Certicom's collaboration with Intel on security for a major handset vendor, Pereira said. He declined to name the vendor, for commercial reasons. Handset vendors are focused on applications, not cryptography, Certicom said, and its middleware layer lets them easily build in cryptography support, shortening the development time and giving handset makers a common interface for encryption functions no matter what the underlying chipset is. "They could move their code from a basic ARM chip to a PXA270 and get a boost from the hardware support without having to rewrite," Pereira said. CSA also includes a software cryptography module for platforms that do not have on-chip encryption hardware. Other optional modules include Security Builder IPSec, a library of VPN functions for resource-constrained devices; Security Builder SSL for Secure Sockets Layer commun- ications; and Security Builder PKI for managing digital certificates. However, CSA offers more than just encryption, according to Pereira. It supports the secure boot feature of Intel's Wireless Trusted Platform, which checks the handset has not been tampered with before starting the operating system. Certicom said it would support all major handset platforms, including those with on-chip security hardware. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Geopolitical Darwin Awards
by Major Variola (ret) 16 Sep '04

16 Sep '04

At 09:27 AM 9/14/04 -0400, John Kelsey wrote: >>From: "Major Variola (ret)" <mv(a)cdc.gov> >>Removing chunks with dynamite is trying rather hard for a Darwin award. > >As far as I can tell from what's reported in the new, a great deal of North Korea's daily operation fits that category. How about Iran stating that they're messing with UF6, when Israel[1] is a known pre-emptive bomber of Facilities to the East? That's pretty much tickling the dragon. [1] A wholly 0wn3d subsidiary of the US. Or perhaps vice-versa.

3 2

RE: Symantec labels China censor-busting software as Trojan
by Tyler Durden 16 Sep '04

16 Sep '04

"We hope that the mislabelling of Freegate is a simple mistake, soon rectified, rather than yet another example of an IT firm helping Beijing implement restrictions." I'd say this was naive, but they give an example after this that shows they know the score. Symantec wants in to China and their $$$, and Jong Nan Hai holds the key. Hum. Seems the Chinese government is pretty effective at self-preservation. Does this contradict the widely-held Cypherpunk belief in the inevitability of deterioration of the state? Perhaps from a Crypto-anarchy perspective, there's a bootstrap point: once there exceeds a certain level of state info-control, it's very hard to get rid of it. Below that level it seems the state can't hold on. (Perhaps W is a little smarter than we thought!) -TD >From: "R. A. Hettinga" <rah(a)shipwright.com> >To: cypherpunks(a)al-qaeda.net, cryptography(a)metzdowd.com >Subject: Symantec labels China censor-busting software as Trojan >Date: Wed, 15 Sep 2004 00:38:32 -0400 > ><http://www.theregister.co.uk/2004/09/14/symantec_targets_freegate/print.html> > >The Register > > > Biting the hand that feeds IT > >The Register ; Internet and Law ; Digital Rights/Digital Wrongs ; > > Original URL: >http://www.theregister.co.uk/2004/09/14/symantec_targets_freegate/ > >Symantec labels China censor-busting software as Trojan >By John Leyden (john.leyden at theregister.co.uk) >Published Tuesday 14th September 2004 18:10 GMT > >Symantec has labelled a program that enables Chinese surfers to view >blocked websites as a Trojan Horse. Upshot? Users of Norton Anti-Virus >cannot access Freegate, a popular program which circumvents government >blocks, the FT reports. > >Freegate has 200,000 users, Dynamic Internet Technology (DIT >(http://www.dit-inc.us)) its developer, estimates. It lets users view >sites banned by the Chinese government by taking advantage of a range of >proxy servers assigned to changeable internet addresses. But a recent >update to Symantec's AV definition files means the latest version of >Freegate is treated as malware and removed from systems protected by >Norton. Short of disabling Norton AV, users would have little say in this. > >A Symantec staffer in China told the FT that Norton Anti-Virus identified >Freegate as a Trojan horse, but declined to provide a rationale for such a >definition. The absence of an explanation from Symantec raises concerns. We >hope that the mislabelling of Freegate is a simple mistake, soon rectified, >rather than yet another example of an IT firm helping Beijing implement >restrictions. > >History provides as least one example >(http://www.vmyths.com/rant.cfm?id=316&page=4) of the AV industry extending >favours to China that it would normally withhold. AV firms normally keep >virus samples under lock and key. But suppliers agreed to hand over virus >samples to the Chinese government a few years ago as a condition of trading >in the country. These samples could be easily found on the net but the >incident illustrates a precedent of China being treated as a special >exception. >-- >----------------- >R. A. Hettinga <mailto: rah(a)ibuc.com> >The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> >44 Farquhar Street, Boston, MA 02131 USA >"... however it may deserve respect for its usefulness and antiquity, >[predicting the end of the world] has not been found agreeable to >experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' _________________________________________________________________ On the road to retirement? Check out MSN Life Events for advice on how to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement

2 1

Keith Henson Needs Help (fwd)
by J.A. Terranson 16 Sep '04

16 Sep '04

Besides forwarding the below, let me point out (for those few who aren't familiar with this case) a few choice tidbits (taken from the web site that has been tracking this case since it's inception, http://www.operatingthetan.com/ ): "On 26 Apr 2001, Keith Henson was convicted of "interfering with a religion", a misdemeanor under California law, for picketing outside Scientology..." "At trial, the judge threw out all Henson's witnesses, disallowed any testimony about his reasons for picketing the cult, and allowed the prosecution to present excerpts from Henson's Internet postings out of context; the Scientology witnesses also committed perjury which Henson was unable to rebut." The worst part of all this is that the underlying charges of "terrorism" were based on this *obviously* sarcastic thread from usenet: http://www.operatingthetan.com/evidposts.txt This is an incredibly serious abuse of our so-called "justice system" - anything you can do to help Henson out may come back to help *you* out someday. No none of the cosmic karma crap, but I guarantee you that if we allow people to be imprisoned for making jokes that are politically offensive, by specifically preventing them from presenting any exculpatory evidence at trial (a rapidly increasing practice in our "courts"), we will *all* suffer for it. Send mail. Physical mail! Ask your friends to do it too. The only thing more important than getting the angry little midget monster out of the White House are these kind of incredible abuses of the system. -- Yours, J.A. Terranson sysadmin(a)mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? ---------- Forwarded message ---------- Date: Thu, 16 Sep 2004 00:16:46 -0400 From: R. A. Hettinga <rah(a)shipwright.com> To: cypherpunks(a)al-qaeda.net, cyberia-l(a)listserv.aol.com, nettime-l(a)bbs.thing.net Subject: Keith Henson Needs Help <http://www.kuro5hin.org/print/2004/9/14/32340/5809> kuro5hin.org || technology and culture, from the trenches Keith Henson Needs Help (MLP) By Baldrson Wed Sep 15th, 2004 at 07:42:14 AM EST For those who don't know him, Keith Henson co-founded the L5 Society, was President of Xanadu Corporation and was a featured character in The Great Mambo Chicken and the Transhuman Condition: Science Slightly Over the Edge. He's about to be deported from Canada to the United States where he faces time in the infamous California prison system. Recently on the cryonics mailing list Keith Henson issued a plea for help: ... at this point I am a "failed refugee." The only thing that can keep me from being deported to the US on short notice is an appeal to the Minister of Citizenship and Immigration. Her office gets 15,000 letters a week so it takes a well known case to reach the level where it gets attention. What is going on here and why should anyone care? The short story is that Keith has been fighting against Scientology and as a result ended up fleeing the United States to Canada to avoid a misdemeanor conviction brought against him by Scientologists. Here's the prosecuting attorney's speech given the jury on the charges: Now, His Honor read to you in the beginning of the case that the defendant has been charged with three counts. First count is -- now, these are numeric numbers and they mean nothing to you, so I will give you names for what they are. The first one is 422, violation of Penal Code Section 422. And 664/422 and 422.6. Now I'll give them names. 422 is terrorist threats. Now, that conjures up images of Beruit or the Twin Towers bombing, but that's not what it means. It just means a threat that causes someone terror, that frightens people. That's what Count One is. Count two is 664/422, is the attempt, the attempt to do the exact same thing, to cause to threaten, to attempt to threaten and cause terror or frighten someone. And the last count is 422.6. And that's essentially defined as the interference with someone's rights guaranteed by the Constitution, their civil rights, and in this case the right to practice their religion without fear. Essentially 422.6 is a hate crime. Now, let's talk about the first count, and we'll go count by count. The first count, 422, again I told you was just threats that caused people to be afraid. Essentially the elements are these: Number one, there has to be somewhat of a threat. There has to be a threat. The person has to intend there to be a threat. And lastly, that the victims have a reasonable fear. However, the person doesn't have to have to want to carry it out. There has to be no intention to carry out the threat. Keith's been in Canada for a few years and is trying to remain there as a refugee. Well, I'll confess my bias. Although Keith and I have known each other since the early days of the L5 Society, we have serious disagreements on a lot of things -- not the least of which are many opinions about Jews, genes and memes etc. More immediately relevant is the fact that I just don't "get" Keith's fight against Scientology. Scientologists seem like a joke to me and IMHO people who get involved with them suffer about as much but no more than people who get involved with New York City nightlife. Be that as it may, I personally don't like seeing anyone spend time in a US, let alone California, prison system. I once refused to testify against a young Hispanic after he had stolen my car because, despite the fact that he would be more protected than a man of my ethnicity in a California prison, he would nevertheless be subjected to a substantial likelihood of being "punked out". That's not my idea of justice. Keith is an old guy -- unlikely to be punked out despite the fact that he's a non-violent 'white guy' -- but he's the kind of guy who probably wouldn't do well in a California prison. As I said, we have serious differences but I've known him for decades, and his going into a California prison doesn't sit right with me anymore than it does with a young Hispanic kid who I don't know. The US now incarcerates a greater percentage of its population than does any other country. That's quite an accomplishment for a system known world-wide to also be a source of racist sexual sadism. So quite honestly I don't care what Henson has or hasn't done. He doesn't belong in a US prison. No one does. Even the best of US prisons still will extradite to the worst of US prisons. There are precedents for refusing to extradite criminals from Canada due to conditions in the US prison system. For example, assistant U.S. attorney Gordon Zubrod from Harrisburg, PA made the following public statement to 3 suspects who fled to Canada (this statement was captured for the public record during a Canadian Broadcasting Corporation interview): "You're going to be the boyfriend of a very bad man if you wait out your extradition." After that it was very hard for the Canadian authorities to justify extraditing the suspects to the US. Now, agreed, it is rather unusual for a federal official to lose his grip this way, but everyone knows this is exactly the sort of power that "law" enforcement officials wield over criminals in the US. Why does it take a federal official slipping up royally like that to get asylum? To make matters worse, Keith claims he has been threatened with abuse in prison by Scientology zealots: "And cult agents have made fairly clear public threats that I would not survive jail." Is Keith making this up? Not likely. Scientologists aren't known for their tact, any more than are federal attorneys. Anyway, back to the question: Why should you care? Maybe you don't like Scientology. Maybe you like Keith. Maybe you just like to mess with the California government. Whatever, Keith Henson is asking for help and he quite probably actually needs it. Full discussion: http://www.kuro5hin.org/story/2004/9/14/32340/5809 -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

jpegs are vectors
by Major Variola (ret) 16 Sep '04

16 Sep '04

http://news.bbc.co.uk/2/hi/technology/3661678.stm Image flaw exposes Windows PCs Computer users could be open to attack from malicious hackers because of the way that Windows displays some images. A buffer overrun of course. But this is even better than the PNG vulnerability reported earlier this year. All your service packs are belong to us.

1 0

AOL dumps sender ID
by R. A. Hettinga 16 Sep '04

16 Sep '04

<http://www.theinquirer.net/?article=18483> AOL dumps sender ID @2Brute? By Nick Farrell: Thursday 16 September 2004, 07:25 POPULAR ISP AOL has knifed Microsoft's anti-spam technology Sender ID. According to internetnews.com, AOL has dumped the idea following concerns expressed by the Internet Engineering Task Force (IETF), coupled with the tepid support for Sender ID in the open source community. However, AOL says it will press ahead with in favour of the Sender Policy Framework (SPF)which was a component of Sender ID. The company said it will also publish Sender ID files so its users' e-mails are compliant with Sender ID-enabled servers and applications. A spokesman said that AOL also has serious, technical concerns that Sender ID appears isn't backwardly-compatible with the original SPF specification. The full story can be found here. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0