- cypherpunks-legacy - lists.cpunks.org

Security alert!!!
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

WARNING: There's a rogue trojan horse out there on the internet known as the "stronghold web server". It's actually a hacked-up version of Apache with a backdoor, which allows hackers (or whoever knows the backdoor) to steal credit card numbers and other confidentil information on the Internet. Be careful! Always use encryption. Do not send confidential information 9such as passwords and credit card numbers) to any site running the trojan horse "stronghold". In general, beware of "snake oil" security products and hacked-up versions of free software. Please repost this warning to all relevant computer security forums. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

ad.doubleclick.net (fwd)
by Mark M. 17 Dec '03

17 Dec '03

Date: Thu, 23 Jan 1997 14:15:38 -0800 From: Caveh Frank Jalali <caveh(a)Eng.Sun.COM> Subject: URL filtering, Re: ad.doubleclick.net (RISKS-18.78) The obvious defense against hostile or undesirable web sites is to not visit them in the first place. This process can in fact be automated in netscape's browser. This saves bandwidth and your time! The basic premise is that the browser may optionally execute a function on every URL before it is accessed to determine whether a direct connection should be made or a proxy should be used in the process. This affords the opportunity to [mis]direct the browser to fetch the document from an invalid source. this is a good approximation of not getting the document at all. We sit behind a fire wall, so all WWW access has to funnel through a proxy. If I tell netscape to fetch an external document using a direct connection, the connection attempt will fail, and the document will not be accessed. Netscape will put a broken image icon in its place. Here are the nuts and bolts to do it, but some assembly is required: Under options/network preferences/proxies, select "automatic proxy config" and tell it which file to use. Call it something like "file:///HOMEDIR/.netscape/proxy.pac", replacing HOMEDIR with your home directory; the actual code is included below. Next, go to options/general preferences/helpers and create an application helper of type "application/x-ns-proxy-autoconfig" for suffix "pac", handled by "navigator". Install this java-script code to do the actual filtering. call it "file:///HOMEDIR/.netscape/proxy.pac", as mentioned before. ================ function FindProxyForURL(url, host) { if ( isResolvable(host) && ! shExpMatch(host, "[0-9]*") ) return "DIRECT" ; else if (host == "advertising.quote.com") return "DIRECT" ; else if (host == "ad.doubleclick.net") return "DIRECT" ; else if (shExpMatch(url, "*:*/ads/*")) return "DIRECT" ; else return "PROXY webcache:8080; "; }

1 0

Censorship
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

OKSAS <oksas(a)asimov.montclair.edu> writes: > On Thu, 30 Jan 1997, Dr.Dimitri Vulis KOTM wrote: > > OKSAS <oksas(a)asimov.montclair.edu> writes: > > > On Thu, 30 Jan 1997, Anonymous wrote: > > > > I cannot understand how some of my (accurate) criticisms of Sandfort's > > > > censorhip polices---some in direct response to his own self-serving pos > > > > declaring himself not to be a flamer himself---are not making it to the > > > > "New and Improved Censored List," while inane posts from Toto, Thorn, a > > > > someone named "Nurdane Oksas" are appearing. > > > > > > WEll....that's not so bad ;) > > > > I find Oksas's posts to be very interesting. > > Thank you. You are very welcome -- Sandy is a jerk for tossing your mail! > > > > > (Oksas has the especially annoying habit of quoting entire posts and th > > > > appending a one-line piece of completely list-irrelevant fluff. Also, > > > Is it so annoying...? why did you read it to that point??? :) > > > Why could you not be so anonymous and tell me? My posts are > > > a bit brief; Blancs' are far better, next time read hers. > > > > > > > engaging in lovey-dovey posts with Vulis, who writes messages about how > > > > longs to see Oksas naked.) > > > > > > Huh?? You are being a 'fluff' here ;) > > > > "Anonymous" is lying - I never posted any such thing. of course the > > cocksuckr moderator passed on the "anon's" lies to the censored mailing > > list, and I bet he's goingto auto-bounce my refutation to "flames" > > - just as everyone had predicted. > > Anonymous is a jerk. > > > So are gilmore and the sandfart. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Cats Out of Bags
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

as I've said before, I really hate the "cat out of the bag" saying, as Aaron's recent comments indicate. ONLY A TYRANNICAL GOVERNMENT WOULD PUT THE CAT IN THE BAG IN THE FIRST PLACE maybe we can distill this into a new saying, instead of the favorite "cats out of bags". I've said repeatedly that pro-crypto advocates using the "cat out of the bag" analogy is actually damaging to the position that the constitution guarantees crypto freedom via free speech and privacy. it encourages the government side to do exactly as Aaron is doing-- arguing that the cat is not out of the bag, when *that's*not*the*point* how about, GOVERNMENT SHOULD STOP SUFFOCATING CRYPTO CAT!!!

1 0

Re: Last nail for US crypto export policy?
by Lucky Green 17 Dec '03

17 Dec '03

At 01:41 AM 1/30/97 -0800, Bill Stewart wrote: >I think we do need to get some sort of push going for 3DES as a >replacement for DES - it's strong enough, even though DES is showing >its age, and it's an obvious transition from the current technology. >It's slower and clunkier than IDEA or RC4/128, but still not bad. The migration to 3DES is underway, at least in the banking sector. ANSI X.9, the group that deals with many of the protocols used in the banking industry, has made tremendous progress. 3DES, elliptic curve, and a host of other improvements all are out of committee and should be available as official (for bankers :-) specs soon, if they aren't already. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

NSA Rainbow Series.
by Genocide 17 Dec '03

17 Dec '03

A while back someone posted the 1-800 number for the NSA to call in and get the Rainbow series delivered.... well, I called and put in an order and it never came, I need to call them again... I don't have the phone numbere number anymore...does anyone have it? Can someone email me the number again? Genocide Head of the Genocide2600 Group ============================================================================ **Coming soon! www.Genocide2600.com! ____________________ *---===| |===---* *---===| Genocide |===---* "You can be a king or a street *---===| 2600 |===---* sweeper, but everyone dances with the *---===|__________________|===---* Grim Reaper." Email: gen2600(a)aracnet.com Web: http://www.aracnet.com/~gen2600 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ It is by caffeine alone that I set my mind in motion. It is by the Mountain Dew that the thoughts acquire speed, the lips acquire stains, the stains become a warning. It is by caffeine alone that I set my mind in motion. ================================================================================

2 1

Re: RC5-12/32/5 contest solved
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Jim Bell rote: >Assuming it's possible to build a chip which tests solutions in a >massively-pipelined mode, the 400,000 or so solutions per second tried (for >what is probably a $2000 machine) would probably increase to 100 million per >second per chip (at a cost of maybe $100 per chip, if implemented in >parallel). That's 5000 times more economical, which would translate to a >find in 2-3 days if the same dollars in hardware were invested. Hi Jim, still on your list 8*) Funny thing is that 3 1/2 hours for a 40 bit search is the "real world" number I was using two years ago (can look it up in various archives) so is interesting that the first real test came out exactly the same. Is why I said 40 bits should not protect anything worth more than U$250.00 Have good reason to believe your estimate for a purpose built machine this year (expect 600,000,000 to 1,000,000,000 kps per sieve - these will not be cheap chips but will be commecially available). Expect 400 arrays would be required to do DES in a day (average) but is a lot more achievable than the 65k postulated by the gang of nine. Still would not be too concerned about using DES so long as every message encrypted (including orders for a tuna on rye) and each uses a different key - is "security by obscurity" in a way but am comfortable with it. Besides, if really concerned will just superencrypt. Warmly, Padgett "I love it when a plan comes together."

2 1

Re: Rejection policy of the Cypherpunks mailing list
by aga 17 Dec '03

17 Dec '03

On Thu, 30 Jan 1997, jim bell wrote: > At 09:05 PM 1/28/97 -0800, Dale Thorn wrote: > > >I dare say that the downside of this is much less pleasant than the > >virtual anarchy (in the bad sense) we suffer now. If the police get > >out of control, A.P. will arrive just in time to plug a few of those > >holes, so to speak. Ideally, future robotics should be able to > >provide something like Gort (sp?) to take the place of human officers, > >given advances in the kind of pattern matching needed to deter > >aggression and the like. Those who don't make it past the robots, > >well, the rest of us can learn to behave, and we'll be much better > >off when we do. > > > Your comparison with the fictional Gort, in the movie "The day the earth > stood still" is of course apt. It was only after I'd written most of the > essay that I realized that an AP-type system would function much as Gort did. > > Occasionally we (CP) see a spoof where somebody claims to have developed a > software program to "replace the judicial system" or something like that. You may be able to replace the "Letter of the Law" but you can not replace the "Spirit of the Law" with an Android or a bot. (notice I refuse to type like a geek with those "`" characters) So, humanoids will always be entitled to a jury of their "peers" as the constitution says, and that means no AI involved. AI was made for usenet management. > Well, the problem with such a claim (aside from the obvious and enormous > AI-type difficulties) is that the current system contains numerous biases. > Writing a program to replace the legal system would presumably require that > these biases be measured (and admitted-to!) and implemented into a > well-defined system. > > What we'd discover is that the current system only barely resembles the > guarantees in the US Constitution. At that point, there would be an argument > between those who will insist that the Constitution be followed, and those > who believe that the current de-facto system, however biased, be maintained > as-is. > The 12 to 0 verdict will always be the bias in favor of the defendant, and it must stay that way. > > > Jim Bell > jimbell(a)pacifier.com > With the different combinations of Perl and Java and Lisp that are around today, the time will come when an android or an AI bot will have become dangerous to society, and charged with a crime. Will it be entitled to a jury of it's peers? mail.cypherpunks alt.usenet.admin

1 0

Clarification on The Politics of Export Restrictions
by Rick Hornbeck 17 Dec '03

17 Dec '03

I am submitting the following a second time as the first one did not seem to get posted. ============== I agree the strategy would have to be hijack-proof. Something like Gore experiencing a convenient "change of heart" towards the end of this current term and convincing Clinton and the administration to soften crypto export restrictions which would make Gore look like a hero to the high-tech community just in time for the election. Naturally this would have to be carefully scripted but the objective would be to keep the democrats in power. Just a theory. >>Return-Path: <owner-cypherpunks(a)toad.com> >>Date: Wed, 29 Jan 1997 23:43:43 -0800 >>From: Greg Broiles <gbroiles(a)netbox.com> >>To: Rick Hornbeck <rnh2(a)ix.netcom.com> >>Cc: cypherpunks(a)toad.com >>Subject: Re: The Politics of Export Restrictions >>Sender: owner-cypherpunks(a)toad.com >> >>At 09:44 PM 1/29/97 -0800, Rick Hornbeck wrote: >> >>>Is it possible the unreasonable crypto export restrictions are simply being >>>imposed at this time for the purpose of making Al Gore look good when he >>>runs for President in 2000? >> >>I suppose it's plausible, but it's an opportunity open to both candidates, >>and more plausibly (because of lack of collaboration) to the Republicans - >>e.g., Dan Quayle and the "Crypto Freedom For Americans" platform, promising >>to rescue Silicon Valley from those evil regulatory Democrats. >> >>If I were an evil politician trying to set up a trick like you suggest, I >>think I'd want a scheme that my opponent(s) couldn't hijack and use against >>me. >> >>-- >>Greg Broiles | US crypto export control policy in a nutshell: >>gbroiles(a)netbox.com | >>http://www.io.com/~gbroiles | Export jobs, not crypto. >> | >> >> >>

1 0

ad.doubleclick.net (fwd)
by Mark M. 17 Dec '03

17 Dec '03

Date: Thu, 23 Jan 1997 14:15:38 -0800 From: Caveh Frank Jalali <caveh(a)Eng.Sun.COM> Subject: URL filtering, Re: ad.doubleclick.net (RISKS-18.78) The obvious defense against hostile or undesirable web sites is to not visit them in the first place. This process can in fact be automated in netscape's browser. This saves bandwidth and your time! The basic premise is that the browser may optionally execute a function on every URL before it is accessed to determine whether a direct connection should be made or a proxy should be used in the process. This affords the opportunity to [mis]direct the browser to fetch the document from an invalid source. this is a good approximation of not getting the document at all. We sit behind a fire wall, so all WWW access has to funnel through a proxy. If I tell netscape to fetch an external document using a direct connection, the connection attempt will fail, and the document will not be accessed. Netscape will put a broken image icon in its place. Here are the nuts and bolts to do it, but some assembly is required: Under options/network preferences/proxies, select "automatic proxy config" and tell it which file to use. Call it something like "file:///HOMEDIR/.netscape/proxy.pac", replacing HOMEDIR with your home directory; the actual code is included below. Next, go to options/general preferences/helpers and create an application helper of type "application/x-ns-proxy-autoconfig" for suffix "pac", handled by "navigator". Install this java-script code to do the actual filtering. call it "file:///HOMEDIR/.netscape/proxy.pac", as mentioned before. ================ function FindProxyForURL(url, host) { if ( isResolvable(host) && ! shExpMatch(host, "[0-9]*") ) return "DIRECT" ; else if (host == "advertising.quote.com") return "DIRECT" ; else if (host == "ad.doubleclick.net") return "DIRECT" ; else if (shExpMatch(url, "*:*/ads/*")) return "DIRECT" ; else return "PROXY webcache:8080; "; }

1 0