- cypherpunks-legacy - lists.cpunks.org

[RRE FWD] PKI: 10 Public Policy Questions
by Rick Osborne 17 Dec '03

17 Dec '03

C'punks- Got this off of the Red Rock Eater list, <http://communication.ucsd.edu/pagre/rre.html>, and figured those of you not on it might like a read. _________________________________________________ From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: PKI: 10 Public Policy Questions X-Url: http://communication.ucsd.edu/pagre/rre.html [The bottom line: State legislation on digital signatures presupposes an overly centralized architecture and is weighted against victims of fraud. Pursuing inherently national or global issues on the state level permits interested parties to shop for a friendly legislature, who will then set a precedent that other jurisdictions are likely to follow. This system is biased against less politically mobilized constituencies and favors older technologies and more centralized business models.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 05 Feb 1997 09:48:01 -0800 From: Bradford Biddle <BIDDLECB(a)COOLEY.COM> Subject: PKI: 10 Public Policy Questions [...] * * * * * * * * * [Copyright 1997 C. Bradford Biddle; permission granted for non-commercial electronic redistribution] CFP '97: LUNCHTIME WORKSHOP, WED. MARCH 12 1997 12:30PM -2:00PM PUBLIC KEY INFRASTRUCTURES AND "DIGITAL SIGNATURE" LEGISLATION: 10 PUBLIC POLICY QUESTIONS BRAD BIDDLE* Following the lead of the state of Utah, numerous states and several foreign countries have enacted "digital signature" legislation aimed at promoting the development of a public key infrastructure (PKI). While PKI legislation has acquired significant momentum, it is not clear that lawmakers have carefully considered the public policy implications and long-term consequences of these laws. This luncheon session will explore certain policy questions related to a PKI, in an informal "open discussion" format. Ten questions we hope to address are: 1. Is legislation necessary at all? Proponents of digital signature legislation start with the premise that the need for a PKI is clear: public key cryptography and verifiable certificates offer the best hope for sending secure, authentic electronic messages over open networks, thereby facilitating electronic commerce. They argue that the reason that the commercial marketplace has not produced a viable certification authority (CA) industry is because of legal uncertainty (CAs are unable to determine their potential liability exposure because of a confusing array of applicable background law) or because existing law imposes too much liability on CAs. Thus, proponents argue, legislation is necessary in order to provide certainty in the marketplace and allow a much-needed industry to emerge, as well as to address other issues such as the legal status of digitally signed documents. Opponents of this view assert that it is far too soon to conclude that the market will not produce commercial CAs, and point to the increasing numbers of commercial CAs emerging even in the absence of legislation. Time is solving the "uncertainty" problem, opponents argue, and the "too much liability" problem is the product of flawed business models, not a flawed legal system. Opponents of legislation argue that the real danger is that a group of lawyers will impose a set of flawed rules that will fundamentally skew a dynamic infant marketplace and "lock in" a set of business models that the market would otherwise reject. The time for legislation and regulation is after identifiable problems exist in a mature industry, opponents say, not before an industry even exists. Opponents of legislation further argue that existing legal mechanisms can address the issue of the legal status of digitally signed documents. 2. Where should PKI legislation occur? Debate also occurs over the appropriate jurisdictional level for digital signature legislation. Some observers cringe at the thought of 50 inconsistent state digital signature laws; others believe that CAs and consumers will opt-in to the most sensible legislative scheme, and thus believe that competition between the states is helpful. Proponents of uniformity and consistency argue for PKI legislation at the federal or international level; opponents of this view point out that general commercial law has long been the province of state legislatures. 3. Is licensing of Certification Authorities the right approach? Under the Utah Digital Signature Act ("Utah Act") and much of the subsequent PKI-related legislation CAs are licensed by the state. The Utah Act makes licensing optional: CAs that obtain licenses are treated with favorable liability rules, but non-licensed CAs may exist in Utah. Licensing is a highly intrusive form of government regulation (other, less intrusive methods of regulation include mandatory disclosure requirements, altering liability rules to avoid externalized costs, bonding or insurance requirements, etc.). Typically, licensing as a form of regulation is reserved for circumstances where a market flaw cannot be addressed by other, less intrusive means. Does this sort of dynamic exist with CAs? Would consumers be able to make informed, rational choices between CAs? Could an incompetent CA cause irreparable harm? Could other types of regulation address any relevant market flaws? If unlicensed practitioners are allowed to exist, subject to different liability rules, how will this affect the CA market? 4. Should legislation endorse public key cryptography, or be "technology neutral"? Most of the digital signature legislation to date has focused specifically on digital signatures created using public key cryptography. Some legislation has also addressed the issue of "electronic signatures" -- other, non-public key methods of authenticating digital transmissions. Proponents of biometric authentication methods argue that it is foolish to legislatively enshrine public key cryptography as the only technology capable of authenticating an electronic document. They argue that biometric methods can currently accomplish many of the same goals as digital signatures; they further argue that by precluding other technologies future innovations will be discouraged. They also note that public key cryptography can only be implemented using patents owned by a limited number of commercial entities, and question whether it is wise public policy to legislatively tie electronic commerce so closely to the interests of a few private sector actors. 5. Should legislation endorse the X.509 paradigm? When the Utah Act was enacted, it explicitly endorsed the X.509 infrastructure model. Subsequent laws have dropped the explicit endorsement of X.509, but nonetheless remain true to the X.509 paradigm. Under most digital signature legislation, certificates serve to bind an individual's *identity* to a particular public key. This binding is accomplished in the context of a rigid, hierarchical CA infrastructure. This model has been criticized for two main reasons: global CA hierarchies are almost certainly unworkable, and identity certificates often provide too much information -- frequently an "attribute" or "authority" certificate will do. Alternative certificate formats, such as SDSI and SPKI, have emerged in response to these and other perceived flaws with the X.509 model. However, it is not clear that these alternative certificate formats can be accommodated under current digital signature legislation. 6. How should liability and risk be allocated in a PKI? Liability allocation promises to be a vexing problem in a PKI. The liability issue is most dramatic in the context of fraud. An impostor can obtain the private encryption key associated with a particular party and create electronic documents purporting to be from that party. A second party may enter into an electronic contract relying on these ostensibly valid documents, and a loss may occur. Who should bear this loss? In the paper world, generally one cannot be bound by a fraudulent signature. This principle may not be entirely appropriate in an electronic context, however. In a PKI, the integrity of the infrastructure depends upon the security of private encryption keys. If a key holder bears no liability for fraudulent use of that private key, perhaps he or she may not have adequate incentive to keep the private key secure. How much liability should the private key holder bear? Under the Utah Act and its progeny, an individual who negligently loses control of their private key will bear unlimited liability. This risk allocation scheme raises the specter of consumers facing immense losses -- as one commentator puts it: "Grandma chooses a poor password and loses her house." In contrast, consumer liability for negligent disclosure of a credit card number is generally limited to $50. If consumer liability were similarly limited in a PKI, where would the risk of loss fall? If CAs had to act as an insurer in all transactions, the price of certificates would likely be extraordinarily high. If relying third parties faced the risk that ostensibly valid documents may in fact be forgeries and bear any resulting loss, then some benefits of a PKI are lost. 7. What mechanisms should be used to allocate risk? Currently at least one commercial certification authority, VeriSign, is attempting to allocate risk to both certificate subjects and relying third parties by contract. VeriSign includes significant warranty disclaimers, liability limitations, and indemnification provisions in its Certification Practices Statement (CPS). Certificate applicants agree to be bound by the CPS when obtaining a certificate. VeriSign's web page informs relying third parties that the act of verifying a certificate or checking a certificate revocation list indicates agreement to the terms of the CPS. However, it is not clear that a binding contract can be formed with relying third parties in this fashion. Thus the relationship between VeriSign and relying parties may not be governed by the CPS at all, but instead be subject to default contract and tort rules (which would be less favorable to VeriSign). As a policy matter, should CAs be able to form contracts with relying third parties, despite their rather attenuated connection? If relying parties will be bound by unilateral contracts imposed by CAs, they face significant transaction costs involved with determining the contract terms offered by potentially numerous CAs. If CAs cannot scale their potential liability exposure to third parties by contract, however, it may be impossible for CAs to compete on warranty terms -- and presumably such terms would otherwise be the subject of significant competition. 8. Should digitally-signed documents be considered "writings" for all legal purposes? The Utah Act and most other digital signature laws provide that digitally signed documents have the same legal effect as writings. Critics have noted that while most of the functions or goals of writing requirements may be served by electronic documents, this may not be true in all instances. For example, the law often requires a written instrument to effect notice -- i.e., to alert an individual that a lien has been filed on their property. It is not clear that a digitally signed electronic message would achieve the same effect. Additionally, there are other contexts -- such as wills or adoption papers -- where paper documents may prove more effective than electronic documents. Moreover some paper documents (such as bank drafts or warehouse receipts) are negotiable instruments, and this negotiable character depends upon the existence of a single, irreproducible copy of the document. Thus, critics say, digital signature legislation should not override all writing requirements without separately considering the extent to which sound policy might require retention in specific circumstances. 9. How much evidentiary weight should a digitally-signed document carry? Evidentiary issues, though seemingly arcane and procedural, can raise important public policy concerns. For example, the Utah Act creates a presumption that the person who owns a particular key pair used to sign a document in fact did sign the document. Holding an individual presumptively bound by obligations entered into under their digital signature could be inequitable if the individual is the victim of the fraudulent use of such a signature. This potential problem can be compounded by the evidentiary weight assigned to digitally-signed documents. Under the Utah Act digitally-signed documents are accorded the same evidentiary weight as notarized documents, and someone challenging the authenticity of such a document can overcome the presumption of authenticity only with "clear and convincing evidence" (in contrast, one can overcome the presumption of validity of a paper signature simply by denying that it is one's signature). Critics of the Utah Act's approach argue that providing digitally-signed documents with this status creates unreasonable evidentiary burdens for victims of fraud challenging the validity of electronic documents signed with the victim's private key. 10. Should governments act as CAs? Much of the currently enacted digital signature legislation envisions state government agencies acting as "top level" certification authorities who in turn certify a second tier of private sector CAs. At the federal level, the U.S. Postal Service has declared its intention to act as a CA on a nationwide basis. Should governments be acting in this sort of role? Critics say no, arguing that government involvement will skew an emerging private sector CA marketplace. Government actors may face very different liability rules than private sector market participants -- governments can choose to scale their potential liability exposure through the doctrine of sovereign immunity. Thus, critics argue, government CAs may "win" in the marketplace not because they are more efficient or provide better service, but rather because they can stack the rules in their favor. Proponents of government involvement argue that governments can play an important role precisely because they can create sensible ground rules for all PKI participants. Additionally, they note that governments have existing relationships with all of their citizens, making the process of identification and public key binding that much easier. ---------------------------------------------------------------------------- -------------- * Brad Biddle is the author of "Misplaced Priorities: The Utah Digital Signature Act and Liability Allocation in a Public Key Infrastructure," which appears in Volume 33 of the San Diego Law Review, and serves as Vice Chair of the Electronic Commerce Subcommittee of the American Bar Association's Committee on the Law of Commerce in Cyberspace. He is a third-year law student at the University of San Diego and is a law clerk in Cooley Godward LLP's San Diego office, where he served on the legal team advising the Internet Law and Policy Forum's Working Group on Certification Authority Practices. He can be contacted by phone at (619) 550-6301 or by e-mail at biddlecb(a)cooley.com. _________________________________________________ _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Most obscure warning: If you fork() without ever waiting on your children, you will accumulate zombies. -PERLFUNC man page

2 1

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

This time I have opted for a point by point. At 07:59 PM 2/5/97 -0800, jim bell wrote: ... >The kind of effects I'm thinking of are primarily the "military spending" >situations, where: > >1. Large numbers of potentially competent and useful people get put into >useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. >(Those people who still think military spending is really necessary >obviously haven't read AP.) This point I can not argue with, at least not directly. I do believe that the military way is wasteful of resources. However, this is one area that has actually benefitted the lower-income bracket in that it gives them "inexpensive" (off-chance of death) access to good training. >2. Large amounts of money are spent on military hardware, money which goes >to fund people who would otherwise develop useful products in the >non-government private sector. Three things that promote technological growth, expansion, war, threat of war. As for expansion. we really have no where else to go. As for war and threat of war, the computer was invented during a war, atomic energy was harnessed during war, the internet was created during threat of war. Many advancements, though not all, come to benefit society later. For that matter, steel was probably invented during a war as well, but I can't prove it. >3. The patent system decreases competition, increases profits and prices in >the marketplace due to government actions to allow and enforce monopolies. The patent system gives the innovator a reward for ingenuity, that person can decide what to do with the invention for a short period of time, after which it becomes available to all. (BTW I really think that computer code should be copyrighted and not patented, this allows others to reproduce the work independantly without repercussions, gives the necessary protection, makes it more obviously a form of speech.) >4. Government employees are paid more for their activities than they would >receive in the private sector. Ironically, in this case an >"apples-to-apples" comparison is misleading: It would be wrong to compare a >middle level government manager to his counterpart in private industry, >because to postulate there is such a government-job assumes that the >private-sector would do it post-AP. To this I can't argue, business is certainly leaner than government. Of course most desert plants are more robust than their resource-wasteful wetland counterpart. Where there is a near-bottomless supply of material, as in taxes, true streamlining really doesn't happen. Remember, the automobile really didn't become anywhere near fuel-efficient until after the energy crisis. > >>If you are right then governments would effectively lose the ability to tax, >>with or without representation, as most people do not agree on everything, >>like how their money is spent. However, even now, as pointed out in some >>recent posts, our tax money is used to foreward the goals of a few, these >>few want to eliminate guns, crypto, free speech, ect. Although we are in >>oppostition, our money is still used to foreward the goals. > >Yes, the main effect of AP is the elimination of the ability to tax. Now, >nothing would prevents individuals from continuing to fund an organization >called a "government" so that it could do those (non-coercive) things that >individual wants to see done. But I think it'll be amazing how many of >those heretofore-funded-by-govt projects (previously promoted as being >wanted by a large fraction of the citizenry) that evaporate when the public >is given the option to continue to fund them voluntarily. > > >Let's suppose, hypothetically and for vast simplification, the government >engages in two activities, "A" and "B." Further suppose government taxes >from two groups, let's call them "Alphas" and "Betas." It is traditionally >thought that Alphas like spending on "A", but hate spending on "B". >Likewise, it is figured that Betas like spending on "B", don't like spending >on "A". > >Post-AP, one might innocently suspect that maybe the "Alphas" would simply >fund only "A", while Betas" would donate money for activity "B". Assuming >the amount of funding for those activities was equal, you might think that >things could go on as they already do. But no. The reality is that >"Alphas" merely like spending on "A" _more_ than they do "B", and they will >tolerate their own money being used for both only because the "Betas" are >similarly forced. Add volunteerism to the whole mix, and not only would >these two groups only fund just what they really wanted, they would soon >discover they don't even want the level of spending they previously argued >for, pre-AP. As it is, the "A" group, that's not us, is being promoted with virtually all of the capitol, the "B" group, us, is being attacked in policy and attempts are being made to keep us from getting any bigger. ...

1 0

Re: ITAR and Paper ROM
by jim bell 17 Dec '03

17 Dec '03

At 09:26 AM 2/5/97 -0800, Steve Schear wrote: >>Given that high-density inkjet printers can do 600x600 dpi resolution, it >>should be possible to achieve the equivalent of 100x100 bpi of >>easily-recoverable data on ordinary paper. That's about 800 kilobits, or >>100 kilobytes. What does ITAR say about this? > >I'm not sure if what I did in the 80s, trying to create what I called >'paper ROM, is applicable. In these investigations I used matricies of >small (1-3 mm) squares of gray (16 levels) or color (64 levels) with a mind >to replace diskettes for inexpensive mass data distribution. I was able to >reliably get 100-200 KB/page side using standard offset printing. With >modern ink-jet/laser printers you should be able to reliably get at least >10-50KB/page side. Although a technical success, I abandoned the effort >when I discovered someone had patented (4,488,679) something similar a few >years earlier. It seems to me that the main impediment to doing this in the middle 1980's was the lack of inexpensive scanners. But the utility of a system like this has, unfortunately (?) or perhaps fortunately, probably been killed by the Internet. Today, a magazine or newspaper can merely post a short pointer to a website including an FTP, or something similar. True, that doesn't guarantee the availability of the data years later, but... Jim Bell jimbell(a)pacifier.com

1 0

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

This time I have opted for a point by point. At 07:59 PM 2/5/97 -0800, jim bell wrote: ... >The kind of effects I'm thinking of are primarily the "military spending" >situations, where: > >1. Large numbers of potentially competent and useful people get put into >useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. >(Those people who still think military spending is really necessary >obviously haven't read AP.) This point I can not argue with, at least not directly. I do believe that the military way is wasteful of resources. However, this is one area that has actually benefitted the lower-income bracket in that it gives them "inexpensive" (off-chance of death) access to good training. >2. Large amounts of money are spent on military hardware, money which goes >to fund people who would otherwise develop useful products in the >non-government private sector. Three things that promote technological growth, expansion, war, threat of war. As for expansion. we really have no where else to go. As for war and threat of war, the computer was invented during a war, atomic energy was harnessed during war, the internet was created during threat of war. Many advancements, though not all, come to benefit society later. For that matter, steel was probably invented during a war as well, but I can't prove it. >3. The patent system decreases competition, increases profits and prices in >the marketplace due to government actions to allow and enforce monopolies. The patent system gives the innovator a reward for ingenuity, that person can decide what to do with the invention for a short period of time, after which it becomes available to all. (BTW I really think that computer code should be copyrighted and not patented, this allows others to reproduce the work independantly without repercussions, gives the necessary protection, makes it more obviously a form of speech.) >4. Government employees are paid more for their activities than they would >receive in the private sector. Ironically, in this case an >"apples-to-apples" comparison is misleading: It would be wrong to compare a >middle level government manager to his counterpart in private industry, >because to postulate there is such a government-job assumes that the >private-sector would do it post-AP. To this I can't argue, business is certainly leaner than government. Of course most desert plants are more robust than their resource-wasteful wetland counterpart. Where there is a near-bottomless supply of material, as in taxes, true streamlining really doesn't happen. Remember, the automobile really didn't become anywhere near fuel-efficient until after the energy crisis. > >>If you are right then governments would effectively lose the ability to tax, >>with or without representation, as most people do not agree on everything, >>like how their money is spent. However, even now, as pointed out in some >>recent posts, our tax money is used to foreward the goals of a few, these >>few want to eliminate guns, crypto, free speech, ect. Although we are in >>oppostition, our money is still used to foreward the goals. > >Yes, the main effect of AP is the elimination of the ability to tax. Now, >nothing would prevents individuals from continuing to fund an organization >called a "government" so that it could do those (non-coercive) things that >individual wants to see done. But I think it'll be amazing how many of >those heretofore-funded-by-govt projects (previously promoted as being >wanted by a large fraction of the citizenry) that evaporate when the public >is given the option to continue to fund them voluntarily. > > >Let's suppose, hypothetically and for vast simplification, the government >engages in two activities, "A" and "B." Further suppose government taxes >from two groups, let's call them "Alphas" and "Betas." It is traditionally >thought that Alphas like spending on "A", but hate spending on "B". >Likewise, it is figured that Betas like spending on "B", don't like spending >on "A". > >Post-AP, one might innocently suspect that maybe the "Alphas" would simply >fund only "A", while Betas" would donate money for activity "B". Assuming >the amount of funding for those activities was equal, you might think that >things could go on as they already do. But no. The reality is that >"Alphas" merely like spending on "A" _more_ than they do "B", and they will >tolerate their own money being used for both only because the "Betas" are >similarly forced. Add volunteerism to the whole mix, and not only would >these two groups only fund just what they really wanted, they would soon >discover they don't even want the level of spending they previously argued >for, pre-AP. As it is, the "A" group, that's not us, is being promoted with virtually all of the capitol, the "B" group, us, is being attacked in policy and attempts are being made to keep us from getting any bigger. ...

1 0

Re: ITAR and Paper ROM
by jim bell 17 Dec '03

17 Dec '03

At 09:26 AM 2/5/97 -0800, Steve Schear wrote: >>Given that high-density inkjet printers can do 600x600 dpi resolution, it >>should be possible to achieve the equivalent of 100x100 bpi of >>easily-recoverable data on ordinary paper. That's about 800 kilobits, or >>100 kilobytes. What does ITAR say about this? > >I'm not sure if what I did in the 80s, trying to create what I called >'paper ROM, is applicable. In these investigations I used matricies of >small (1-3 mm) squares of gray (16 levels) or color (64 levels) with a mind >to replace diskettes for inexpensive mass data distribution. I was able to >reliably get 100-200 KB/page side using standard offset printing. With >modern ink-jet/laser printers you should be able to reliably get at least >10-50KB/page side. Although a technical success, I abandoned the effort >when I discovered someone had patented (4,488,679) something similar a few >years earlier. It seems to me that the main impediment to doing this in the middle 1980's was the lack of inexpensive scanners. But the utility of a system like this has, unfortunately (?) or perhaps fortunately, probably been killed by the Internet. Today, a magazine or newspaper can merely post a short pointer to a website including an FTP, or something similar. True, that doesn't guarantee the availability of the data years later, but... Jim Bell jimbell(a)pacifier.com

1 0

[NOISE] Sphere packing
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

Dimwit Virus K[rust]OfTheMonth styles his facial hair to look more like pubic hair. (___) (o o)_____/ @@ ` \ Dimwit Virus K[rust]OfTheMonth \ ____, / // // ^^ ^^

1 0

[PGP] Cats out of bags
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

Dr.Destitute Violent K[arcinogen]OTM is so in love with himself, he cries out his own name when orgasming. Then again, no one else is ever around. /\ /\ + \______/ + / . . \ < / > Dr.Destitute Violent K[arcinogen]OTM \ \--/ / ------

1 0

Tapping these resources.
by WIZZYH2H＠aol.com 17 Dec '03

17 Dec '03

I noticed that there are several programs that will let anyone send encrypted email. What about encrypted messages over a chat system like irc, chat rooms(aol, BBS) and systemwide messages (IM, whisper, private message)? The server wouldn't have to do anything except send the messages, the users software could handel all the protocols and message identification. Dialup and logon features aren't needed either, allmost all cilents will let you shell. I have been looking for, and tring to write a program to do this, but Im a rookie programmer and my attempts have yet to produce a functional send/receive utility. Where are programs like this.. are there any to be found? wizzyh2h(a)aol.com OR wizzy(a)juno.com

1 0

Re: Deloitte-Touche, e$pam plug, Moderation, Cypherpunks as a cresote bush
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:09 PM 2/5/97 -0500, Robert Hettinga wrote: >In the meantime, if you're interested in e$, or financial crypto, or other >stuff I'm interested ("it don't say e$pam until Bob says it says e$pam" >:-)), you might want to check it. I think that Bob's e$ list should be considered a viable alternative to the other two filtered cpunks lists; I recommend it to people looking for a moderated alternative to the list. (I get e$, but use Eudora and procmail to suck out the duplicates where messages are copied from lists I already get.) He also finds a lot of the stuff that used to show up on cpunks but doesn't any more because people have wandered away. I've been meaning to write up a long message explaining why I think I'm about to drop off of the list. It's peculiar to spend a lot of time discussing things with a group of people over the course of several years and then disappear without saying why. But I'm having trouble coming up with anything more profound than "it's not interesting any more." Philosophically, I agree with Lucky - it looks to me like it's time to kill the list and move on to other things. But that's not my choice to make, and perhaps other people can still extract something useful from this. More power to them if they can. I'm starting to think that cpunks may be similar to college, in that it's a good thing for a few years, but if you stick around too long you just get bitter and cranky and frustrated because the new people keep talking about the same old problems. Don't they know we've already talked about that? -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvmSHP37pMWUJFlhAQGu3Qf/WTpImfcNb4883V2h/JHKsZh1hWR+hrSH e7hgtUAujphktzteZi6NqC47QEQHRIbgT/SRHelDB4lJLPv3TtIN09ZUwK6GWb/F QfmoyPXBVfM5Pt/FqPqtPpXnehC7r71SO0jQ2qKqTrhcuSDYNmOjtCrjK/BIEJ7l mMYcxY7JKBq0H8u1BNzZaMfCkEvDytUejgsevusWGGfkwodUSTon81Kbxmy7Yg2w 3vOmESgMz2Vm2av2bHTYBy3CSy3JzB8m2OPQo+Wang6WJDfvJaDaALGuHgem8PH8 0jCjBww2vEOJ0xj62oQ/mD2heEe+TZZnDZ5ZRynID1wOOm7SOOOeAg== =+SRl -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: pgpmail 4.5
by Alex de Joode 17 Dec '03

17 Dec '03

Huge Cajones Remailer sez: : you wrote: : There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. : The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. : i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b : can someone clear this up? [usura@basement]:/pub/ftp/pub/crypto/incoming {22}$ md5 pgpmail45.exe 5ea438501d0133f0849c2fe8f9125b6b pgpmail45.exe -- -AJ-

1 0