- cypherpunks-legacy - lists.cpunks.org

Re: Workaround for filtering/cybersitter
by Sean Roach 17 Dec '03

17 Dec '03

At 03:43 PM 1/29/97 -0500, Mark Rogaski wrote: >If I had experience with Netscape plugins and spare time, I'd >try it myself. But here's my proposed solution. > >A plugin in Netscape intercepts all requests, encrypt the URL >with a pubkey algorithm, encode the string base64, send it as GET input to >a proxy server. > >The proxy server decodes and decrypts the URL, gets the requested page, >and returns it. This beats out URL-based filtering. > >Still need to figure out the specifics of key-exchange. If we use >40-bit encryption, it's exportable, and it still works in our threat >model (ie. we don't care if the watchers figure out the URL a few hours >later). > >To beat out dropping packets with unacceptable pattern in them, we >could use an SSL-based server as the proxy. > >The plugin could even have a nice little on/off switch and a list >list of available proxies. ... The above paragraph would be a problem, unless you wanted to update the program with a great regualrity. Each time the offending government got the software and blocked all of those sites, the software would be worthless. This would be no big deal if you could guarantee some means of someone getting the software, which would certainly be illegal, again and again. Better to have the user key in the proxy that h[is/er] cousin/uncle/best friend/boss/client/guest told h[im/er] about. Here is a similar idea. Have your plug-in replace the part of Netscape that checks the URL with INTERNIC or similar. Have the system accept your address for the proxy and send the requested URL to it, the server then FTP's the contents of the page (and if server time is readily available, its sub-pages), places them in a temporary directory on itself and allows your computer to see it there thinking that it is on a totally different machine. This way the proxy owner would not have to stay on top of the latest restricted material. The main problem would be that the system would absorb twice as much time, once for the download to itself, and once to show it to you. This is not terribly different to Netscape's caching of recently visited pages in memory on the off-chance that you will return. If you changed passwords at the same time that you changed addresses, and reported them together, the government wouldn't be able to keep up. When the government did its sweep of objectionable words, it would come to this site that would have no such data. Only by having the access password, would they be able to reveal that site as a proxy. If they knew the password then they would already know that that was a proxy site because they would have been given both the password and the address at the same time. You then try to maintain several different addressess at a time, each with a different password. As the Government blocks one, change its password and its address. The software would be either two-piece, assuming a dedicated client plug-in, or one-piece. The pieces would be as follows. The proxy, this software would be as small as possible and would only be a front end. Ideally this software should fit on one 3.5" disk. The address to this machine would be the address handed out. In the one-part scenario, this would be implemented as a web-page with a CGI script for the address. The user types in the request and this bot fetches it, placing it in a special directory for the use of this script, this directory would probably be erased after the allotted space was filled, though not before, (you don't stay logged in to the remote machine when using Netscape so erasing on hang-up would mean continually reloading the data.) The proxy would then refresh your client with the requested information. In the two piece scenario, this proxy would interact with the plug-in in much the same way, forgoing the CGI script. The client, the plug-in, if present, would take over the Location field and have a set up menu to type in the proxy's URL and password. In that way the user would see h[im/er]self as accessing the web page directly. Certainly more user friendly, once the client were configured, though not quite as flexible. In this system the government could make both accessing the proxy and possession of the client illegal. It would also be a problem for persons who use a machine to which they have no control. If the setup were un changeable or reset after power-down, this system would require the user to continually re set up the client. The proxy could be as simple as an opening screen with a field for the password and the URL. The proxy should re-link all external links into its own system so that the system can be transparent after the initial page. In other words, the links should be replaced with a second HTML document with the password and search-criteria inside in much the same way that search-engines relay your request to itself, in the URL. This would be a simple script that changed all occurances of "A HREF="HTTP://This.is.the/real/site.html"" to "A HREF="internal/directory.html Query?=HTTP://This.is.the/real/site.html+password""

1 0

Re: Shave the Whales
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

What a joy to make a public mockery of Dogfucker L"amprey" Vulis K"adaver" Of The Moment! __[I]__ o-o' __oOo__(-)_oOo__ Dogfucker L"amprey" Vulis K"adaver" Of The Moment V

1 0

Re: Libel & the 1st Amendment (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 29 Jan 1997 10:46:57 -0500 (EST) > From: Declan McCullagh <declan(a)pathfinder.com> > > * The 1st Amendment does protect some lies. No, it protects speech. The Constitution is meant to protect citizens from a priori constraints on their speech, not the results of the content ex post facto. It is clearly not in the best interest of society to limit opinions or fiction. > If I say "Jim Choate is a > Venusian albatross," the statement is probably (?) a lie, No, for it to be a lie there must be a potentiality of its truth. A nonsense statement which happens to fit the syntactical rules of a language wouldn't qualify. A more apt situation would be, "Hey, <some person>, I saw <your name> in a public restroom blowing the President's pink torpedoe and <your name> was begging for more!". The statement should have to be transmitted to <some person> without the permission of <your name>. The legal standard should be that if you make statements purported to be true about a third party without their prior consent you should be held to a minimum standard of evidence demonstrating the actuality of your statement. A democratic society should have no tolerence for libel, slander, or other forms of lies. > but I doubt > you'll prevail in a libel suit. What damages do you have? That's the key, > I believe -- the statement has to lower you in the opinion of others. Which is exactly one aspect of the problem. Wrongs should not be based on quantity or opinion. By focusing on what others think trivializes the issue at hand, a untruth about a person has been passed off as a truth. > * Many 1st Amendment experts don't believe in the legal concept of libel. > It is, they say, a rich man's game Exactly, instead of equal protection under the law we have a specieocracy. > -- if I'm libeled by the NYT, I'm > probably not going t be able to sue them, but Donald Trump can. Moreover, > if I don't have the resources to sue but the statement is libelous, it > creates a *presumption* in the minds of the readers that the article is > certainly true. (If it were not, I would have sued, right?) Another good example of why our system is broke. > * The concept you may be searching for is consensual speech, which I > believe a society should tolerate. Libelous speech isn't consensual, > though obscenity is. There is no such thing as 'obscenity' just as there is no such thing as 'community standard'. These are the results of mental masturbation to justify some power freaks alterior motives. No, what I should be permitted to say should not rest on what others may permit. If so then I should have a say in what they can say, which means I have a say in what they can say about what I can say, ... (got it yet?) What we need is a fundamental change in the legal system which focuses on first principles and results, not social status or wealth or the potential for gain. Perhaps what we need is a legal system where both the defence and prosecuting attornies are selected by lot. We already have such a system applied to the defence. If it is considered sufficient for a defence it should qualify as sufficient for prosecution. Each practicing attorney would receive a stipend allocated by the appropriate legislative body. The court and police (who should represent the people in general) would provide both parties the results of any tests and equal and simultaneous access to all evidence. If a person wants additional legal council they can buy it from their own pocket but the attorney is limited to act only as a adjunct to the appointed attorney (ie they would not be allowed to speak in court). In civil cases the plaintiff should place a bond, set at some percentage of the maximum permissible award, at the time the case is filed. This would at least cover the general costs of the court and limit nuisance cases. Jim Choate CyberTects ravage(a)ssz.com

2 1

David E. Smith / Known Flamer
by Toto 17 Dec '03

17 Dec '03

David E. Smith wrote: > My understanding was that the moderator is supposed to ONLY > filter out ads and utterly-content-free messages. That seems to be a very common misunderstanding--one which will remain without question on the censored list, since they have chosen to remain behind the ElectroMagnetic Curtain. > (Mind you, I took the smart out and subbed to cp-unedited, > so I'm in no place to judge.) You're in a far better place to judge than those who have chosen to remain spoon-fed their world-view. > Aha, a good point to be brought up: Sandy, are you autofiltering > anyone based on user name, or on certain keywords? Seems to > defeat the purpose of having a _human_ moderator. > You realize, of course, that your question is moot, since this post of yours was already thrown in the crapper/flame-list. It seems that questioning the process is a 'flame'. Toto

1 0

Re: Complying with the EAR [was: More Circumventing the ITAR]
by Sean Roach 17 Dec '03

17 Dec '03

At 11:14 AM 1/29/97 -0700, Michael Paul Johnson wrote: >On Tue, 28 Jan 1997, Mark Rosen wrote: > >> I'm curious as to exactly what the ITAR/EAR/Whatever says specifically >> about "unrestricted FTP sites." My program, Kremlin, is available for > >You should check the exact text yourself, but the way I read the EAR, you >are not "exporting" strong cryptographic software without a license (exept >to Canada, which needs no license) if you do things "such as" >(1) have the guests to your site acknowledge that the EAR restricts >export, (2) have the guests affirm that they can legally get the software >(proper citizenship or residency & location), and (3) "check the address >of the destination computer to see if it is in the USA" or Canada. The >last one, I interpret rather loosely to mean that if the guest's email >address domain isn't one commonly used in the USA or Canada, then I deny >access. We all know that not all .com addresses are North American, but >chances are really good that if the address ends in .ru, then the >destination machine is probably not in North America. This is not a >perfect way to prevent export, of course, but it is what the regulations >say, as I read them. For a pointer to the regulations and to my access >request form and crypto site, see http://www.sni.net/~mpj/crypto.htm ... An easy crack to that would be to request access from a hotmail, or similair, account. This account would show up as being on US soil while the account holder would not necessarily be so. In this way, someone with an account ending in your .ru would get through because h[is/er] e-mail request originated from inside the U.S.

1 0

Re: Cats Out of Bags
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

Sandy: >> >> 1. it is unconstitutional to put a crypto genie in a bottle >> in the first place. >> 2. it is unconstitutional to make laws against ringing crypto bells. > >We do not disagree except neither of the metaphors I gave suggest >anything about the "putting in the bag" part of the deal. In no >way does either suggest a right, power or even ability of anyone >to limit any freedom. They are mute on the subject. Their sole >meaning is that one CAN'T undo what is already done. In the >instant case, that means the wide-spread availability of strong >crypto. ability to use strong crypto is not "either or" but a matter of degree. the question is not "is strong crypto available", but, "how much harder would the NSA's peeping be if ITAR was relaxed? the real question is, do we have the right to use strong crypto, or don't we? if we don't then the government has the authority to regulate it to its heart's content, *regardless* of whether those laws are effective or not. cpunks seem to think that a govt can only have *effective* laws. but there is obviously no such constraint. I think we need to approach it from the point of view that we have the *right* to use strong crypto, and see if the supreme court agrees. hence I'm very interested in the bernstein etc. cases, which may be the ultimate breakthrough eventually.. there is no end to the blathering about genies, cats, or bells that can sway the govt, but a single supreme court decision can have a revolutionary effect. again I still think the genie/cat/bell metaphor is a disservice to the cause, but feel free to defy me. just one crackpot's opinion, YMMV

2 1

RE: Machine readable form (was:RE: [DES] DES Key Recovery Project, Progress Report #7)
by blanc 17 Dec '03

17 Dec '03

From: Phil Karn You have to admit that it is far more consistent to treat both the book and the floppy as a munition than to take the position DoS eventually took. Even if the more consistent position is a far more restrictive one that has even less chance of surviving a court challenge. ........................................................... In terms of consistency, if the government reserved the right to control printed source code (in the future), and books and floppys containing it are considered munitions, then cryptographers, who have it in their heads, would also be considered munitions. They would have to be prohibited from leaving the country and constrained not only from using the internet, but from any kind of communications medium. Ian Goldberg would not be allowed to visit Anguilla or participate in any more contests. :>) .. Blanc

1 0

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

At 11:15 AM 1/30/97 -0800, jim bell wrote: >What you're presented (included in its entirety below) is what I've come to >call an "AP story problem." I've worked through many of those myself; >their main problem is that they don't carefully describe why _each_ person >in the "play" you've described would be motivated to do what it's claim he >does, and why he DOES NOT do other things to fix the situation he's in. >Remember, I'm not merely talking about the main character, but also the ones >who are (apparently?) incidental. > >For just one example, you said: "conventional bodyguards could be >included, ones with no real pay but with the fore knowledgethat they will be >buried with the tyrant." > >What motivates these people? Are they hostages? If they're hostages, then >presumably that means they're motivated to seek the death of anyone who is >holding them. What about their relatives; don't they have any sympathy for >those who are taken? Why don't they donate to AP to see the lead guy dead? As I stated in the bottom, the children would be privaledged. They would merely be told that it is a great honor. It could very well be. Assuming that the tyrant did not die, these children would live in comparable luxery. They would be at risk only if the tyrant was. By keeping the children at hand, the parents would balk at taking action against the tyrant, not only their own action, but also that of others. The children would merely be there to thwart the attempts of others. The "Tiger Teams" would have to get through security on their own, takers on this offer would be very few unless the bounty were great, the defenses were weak, or the thrill level were high. An encounter with a bloodless thrill seaker might go like this "I hacked your system, here's proof, now pay up", remember, for some, it is the proof that a thing can be done that is the greatest thrill. Also, the tyrant would feel bound to keep h[is/er] word to avoid others deciding to take the challenge for the smaller sum. Remember also that 10% controls 90%, this means that each potential tyrant has on average 9% of the wealth, while the remaining 90% has about 1/90th of the remaining 10%. To match the wealth of the tyrant, these people would have to get together 90% of their numbers and commit everything. If 100 people were in the total population, and 1000 dollars in circulation, 10 people would be tyrants with about 90 dollars apiece, the remaining 90 people would each have 100/90 dollars, or 1.11 dollars each. It would take 81 of them together to match the wealth of one. With that many, they might as well attack outright because they would now include practically all of the population. If the tyrant had more than 9 of the peasants close to him, he would be at risk by conventional means. The real threat would not be the people, of limited means, using the system. But rather other tyrants using the system.

1 0

Re: Workaround for filtering/cybersitter
by Sean Roach 17 Dec '03

17 Dec '03

At 03:43 PM 1/29/97 -0500, Mark Rogaski wrote: >If I had experience with Netscape plugins and spare time, I'd >try it myself. But here's my proposed solution. > >A plugin in Netscape intercepts all requests, encrypt the URL >with a pubkey algorithm, encode the string base64, send it as GET input to >a proxy server. > >The proxy server decodes and decrypts the URL, gets the requested page, >and returns it. This beats out URL-based filtering. > >Still need to figure out the specifics of key-exchange. If we use >40-bit encryption, it's exportable, and it still works in our threat >model (ie. we don't care if the watchers figure out the URL a few hours >later). > >To beat out dropping packets with unacceptable pattern in them, we >could use an SSL-based server as the proxy. > >The plugin could even have a nice little on/off switch and a list >list of available proxies. ... The above paragraph would be a problem, unless you wanted to update the program with a great regualrity. Each time the offending government got the software and blocked all of those sites, the software would be worthless. This would be no big deal if you could guarantee some means of someone getting the software, which would certainly be illegal, again and again. Better to have the user key in the proxy that h[is/er] cousin/uncle/best friend/boss/client/guest told h[im/er] about. Here is a similar idea. Have your plug-in replace the part of Netscape that checks the URL with INTERNIC or similar. Have the system accept your address for the proxy and send the requested URL to it, the server then FTP's the contents of the page (and if server time is readily available, its sub-pages), places them in a temporary directory on itself and allows your computer to see it there thinking that it is on a totally different machine. This way the proxy owner would not have to stay on top of the latest restricted material. The main problem would be that the system would absorb twice as much time, once for the download to itself, and once to show it to you. This is not terribly different to Netscape's caching of recently visited pages in memory on the off-chance that you will return. If you changed passwords at the same time that you changed addresses, and reported them together, the government wouldn't be able to keep up. When the government did its sweep of objectionable words, it would come to this site that would have no such data. Only by having the access password, would they be able to reveal that site as a proxy. If they knew the password then they would already know that that was a proxy site because they would have been given both the password and the address at the same time. You then try to maintain several different addressess at a time, each with a different password. As the Government blocks one, change its password and its address. The software would be either two-piece, assuming a dedicated client plug-in, or one-piece. The pieces would be as follows. The proxy, this software would be as small as possible and would only be a front end. Ideally this software should fit on one 3.5" disk. The address to this machine would be the address handed out. In the one-part scenario, this would be implemented as a web-page with a CGI script for the address. The user types in the request and this bot fetches it, placing it in a special directory for the use of this script, this directory would probably be erased after the allotted space was filled, though not before, (you don't stay logged in to the remote machine when using Netscape so erasing on hang-up would mean continually reloading the data.) The proxy would then refresh your client with the requested information. In the two piece scenario, this proxy would interact with the plug-in in much the same way, forgoing the CGI script. The client, the plug-in, if present, would take over the Location field and have a set up menu to type in the proxy's URL and password. In that way the user would see h[im/er]self as accessing the web page directly. Certainly more user friendly, once the client were configured, though not quite as flexible. In this system the government could make both accessing the proxy and possession of the client illegal. It would also be a problem for persons who use a machine to which they have no control. If the setup were un changeable or reset after power-down, this system would require the user to continually re set up the client. The proxy could be as simple as an opening screen with a field for the password and the URL. The proxy should re-link all external links into its own system so that the system can be transparent after the initial page. In other words, the links should be replaced with a second HTML document with the password and search-criteria inside in much the same way that search-engines relay your request to itself, in the URL. This would be a simple script that changed all occurances of "A HREF="HTTP://This.is.the/real/site.html"" to "A HREF="internal/directory.html Query?=HTTP://This.is.the/real/site.html+password""

1 0

Re: Workaround for filtering/cybersitter
by Sean Roach 17 Dec '03

17 Dec '03

At 12:28 PM 1/30/97 -0600, William H. Geiger III wrote: ... >I would also want to make the ISP's liable for their users accessing this info. That way I >can intimidate them into doing all the work for me. (You can see >this approach in several areas of US law enforcemant. Arrest bartenders for >serving minors, arrest store clerks for selling cigaretts to minors, shut down of BBS for >users posting "dirty pictures", going after ISP's for pirated >software and other copyright infringments by their users.) ... I live in Oklahoma. Here at least, bartenders don't sell beer to minors, they sell it to persons who are clearly older. Older friends of the minors, and minors who finished puberty early. The bartenders only protection is to close up shop, depriving everyone of a drink. The same is true of tobacco products. About 8 months ago I had a girl who I barely knew, except that she was obviously in Junior High, recognize me, ask me if I was 18, to which I replied yes, and ask me to buy her a carton of cigerettes, to which I declined. Not for any law imeding me, but I consider suicide a right, but I will not help someone kill themselves. This girl, more than likely already hooked on the drug, had probably used this technique numerous times before without a glitch. The same would be true of blockingon-line content. If it were done right.

1 0