- cypherpunks-legacy - lists.cpunks.org

Re: Please do not post off-topic flames to the list.
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

Unfortunately, you've probably all received something that started out like this: >> You are being gently flamed because. Sorry about that. I've been gone for the last few days and found out that one of my incoming mail filters was somewhat flawed. Instead of sending that generic response only to the esteemed Dr. Vulis it was sending it to any message with his address *in the header*. It also replied to any cc:ed addresses. Ooops... Also, there is no need to speculate about any ulterior motives. It was entirely a setup glitch. There's an important reminder here: don't make setup changes at 2 am and then disappear for 4 days! Again, sorry to the list about this. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # cadams(a)acucobol.com | V.M. (619)515-4894 "I have never been able to figure out why anyone would want to play games on a computer in any case when the whole system is a game. Word processing, spreadsheets, telecoms -- it's all a game. And they pay you to play it." -- Duncan Frissell

1 0

Re: Bernstein hearing: The Press Release
by Rich Burroughs 17 Dec '03

17 Dec '03

At 04:39 PM 9/21/96 -0800, Jim Bell wrote: >At 02:03 PM 9/18/96 -0700, John Gilmore wrote: [snip] >>* Any legal framework that allows a government bureaucrat to >>censor speech before it happens is an unconstitutional prior restraint. >>The government is not allowed to set up such a drastic scheme >>unless they can prove that publication of such information will >>"surely result in direct, immediate, and irreparable damage to our >>Nation or its people" and that the regulation at issue is necessary >>to prevent this damage. > >At the risk of being a devil's advocate, let me suggest that you are >conceding too much even with the preceding paragraph. The 1st amendment >says nothing about preventing speech which (even admittedly) would result >in "direct, immediate, and irreparable damage to our nation or its people." [snip] Jim, that's a quote of Potter Stewart from the Pentagon Papers case, if I'm not mistaken. It's not written in the Constitution, but Supreme Court precedent is the next best thing as far as con law goes. >The way you've written the paragraph I've quoted above, it appears that you >are somehow acknowleding that there are certain circumstances where certain >types of speech are controllable because they are "harmful," but you fail to >explain how even this constitutional restiction is tolerable. Frankly, I >don't see it! What you need to do is to be far more specific about such >speech and exactly where it can be controlled. What you need to do is look at the case law :) The government can restrict speech in time, place or manner, according to the courts. Restricting content is more difficult, and places a much heavier burden on the gov. To expect people writing about and arguing the case to completely ignore the existing case law is foolish, IMHO. >I should point out, also, that this is the second time I've mentioned this. >You're doing us a disservice if you concede too much in this area. I think that John and EFF are doing us a huge service by their involvement in the case. I am very optimistic about the outcome of the Bernstein case. Judge Patel's ruling that source code = speech really puts the debate in the plaintiff's court, and we saw some of that in the hearing on Friday, IMHO. Much of the argument was about prior restraint, with the government trying to claim that they are only trying to restrict a specific functionality of crypto code and not the ideas behind it. This seemed to be a fairly weak argument to me, and the plaintiff's attorney pointed out that the ideas embodied in the source code are what dictate the functionality. The plaintiff's attorney (Cindy Cohn) also argued 3 lines of cases that bear on the issue: 1) Compelled speech. 2) Anonymity. 3) Freedom of association. Cohn also argued that the statute is vague (terms like "general principle" and "fundamental research") and overbroad; also that the current version of ITAR does not even meet the scrutiny of the DOJ's own OLC review of the statute. When the attorney for the gov tried to drift back to the issue of whether source code is speech, Judge Patel said, "You'll get that chance again in another court with more judges." Near the end of the hearing, the government attorney stated that the statute describes "what is not controlled," which elicited a pretty hearty laugh from the spectators. Not a real strategic admission. The plaintiff's brief is at: http://www.eff.org/pub/Privacy/ITAR_export/Bernstein_case/Legal/960726_filin g/motion_partsj.html There's quite a bit of info in that same directory. Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon U.S. State Censorship Page at - http://www.teleport.com/~richieb/state New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Go away CIA
by skeeve＠skeeve.net 17 Dec '03

17 Dec '03

Well well... After putting up the CIA hack mirror page on http://www.skeeve.net/cia/ I learnt a few things. o it got 50,000 hits in 1 day o everyone from the cia, senate, fbi, nsa (ncsc) and every other bloody US gov department looked at it masses of times. The CIA looked at it every 10-15 minutes. zztop{root}:15: cat skeeve.net-access_log | grep ucia.gov | wc -l 281 o Even the CIA tries to hack you. relay1-ext.ucia.gov unknown - [21/Sep/1996:01:56:44 +1000] "GET /cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd HTTP/1.0" 404 1180 o Dozens of in.fingerd/in.telnetd attempts from ucia.gov, some mil sites and ncsc.mil sites. as I speak the house are looking at it. b252-209.house.gov unknown - [21/Sep/1996:02:41:37 +1000] "GET /cia/ I "PRESUME" there are no laws (international or otherwise) being broken by my housing of the mirror... not like I actually care.. but it would be good to know. Ok... ive been up all night chuckling at all the different sort of sites hitting the mirror... time to sleep. -------------------------------------------------------------------- Skeeve Stevens Email: skeeve(a)skeeve.net CEO/The Big Boss/All round nice guy URL: http://www.skeeve.net/ MyInternet Australian Anglicans Online http://www.myinternet.net/ http://www.anglican.asn.au/ Phone: (+612) 869-3334 Mobile: (0414) SKEEVE [+61414-753-383] Key fingerprint = D2 7E 91 53 19 FE D0 5C DE 34 EA AF 7A 5C 4D 3E

5 5

Re: AP [was: Re: Kiddie porn on the Internet] [NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 12:38 PM 9/22/96 -0400, hallam(a)vesuvius.ai.mit.edu wrote: > >I agree with Bill, AP sounds like a very good club for the Exon types >to beat us with. But they're not doing it. They know about it, but they're NOT using it. This should tell you something. This really is no surprise to me; before I started publicizing AP, I tried to carefully consider whether letting the cat out of the bag was going to assist the government in stopping it. My conclusion was that they didn't stand a chance. If anything, they're afraid of publicizing the idea, because their opposition to it can look only self-serving. >Jim's latest comments sounded no different to me than the mealy mouthed >"understanding" messages that Sinn Fein publish about the IRA. Given >the opportunity to condem any attack on the President under AP rules >we get a non commital non-condemnation. Its the type of thing that Gerry >Adams says after his men have just killed two kids with a bomb in a litterbin >outside a MacDonalds. Don't try to tar me with that brush. I made it clear long ago that I'm opposed to truly random attacks on ordinary citizens. However, I hasten to add that I'd very much prefer that these attacks be re-targeted against the people who deserve them. However, I usually find that the people who make the biggest deal about disliking random citizen attacks are the ones who recommend replacing them with...nothing...and have no plan to solve the problems with any other method, violent or otherwise. [doctrinaire BS deleted] >As the Marxist idealogues got frustrated by their evident lack of progress >they turned to terrorism. The Bader Minehof gang believed that they could >spark the revolution by jolting society out of its complacency. Their >strategy was remarkably like AP. Somehow, I doubt it. Anybody who thinks an AP-like system would be effective for bringing in his pet communist (or fascist, or monarchist, or anything other than pure-anarchic) government is an idiot. AP is fundamentally anti-heirarchical in its leanings and effects. >If the heads of large corporations were >likely to be assasinated then noone would want to lead a large firm. Who said companies need "leaders"? Remember, I said AP is anti-heirarchical. Any heirarchies, particularly those forced on people, are strongly deterred. This includes social and religious heirarchies, BTW. Even corporate heirarchies would only exist if approved-of by the vast majority of the shareholders, most of whom will be the workers as well. > In >fact as any person with counter terrorism experience will tell you the >threat of death is remarkably ineffective as a means of intimidation. It >creates the opposite effect, strengthening the resolve of the target. I >discussed this point recently with someone close to Mossad who agreed. Under a set of circumstances similar to the status quo, that is not surprising. But that can change. That WILL change. People occupy positions of authority when they feel, personally, they are better off doing so than not. Give the average member of the public (not merely crazed "terrorists") the opportunity to remove those people, and you won't be able to keep them around. I mean, presumably they do their job for a salary and benefits, right? How many bombs or bullets will they tolerate, rather than resigning and taking a safer job? >Terrorism is becomming an increasing concern. The amount of damage an >individual can cause is much greater than that possible in the past. If anything, I think the advantage of AP is that it REDUCES the amount of damage that any given person has to cause, per citizen, to achieve his anti-government political ends. I've pointed out that it would only take a penny or two from each citizen, on average, to remove one of even the highest-level US officeholders. Far less than that if you include resignations. What I'm advocating is a system that makes it impossible for agents of the status quo to resist the opposition of the public, which is unlike the current system. Rather than have to build a bomb, or wait for somebody else to do so, the ordinary citizen only needs to make a modest contribution to the "revolution fund." And today, an officeholder can claim to resist "terrorism" based on the fact that he opposes the extreme action of a handful of people. What happens when they have to admit that a million people paid for that gun to be fired or that bomb to be planted? >There >are plenty of exhausted ideologies about which can be fashioned into >a justification of murder. Don't blame me for them. > Jim's post shows very clearly how Libertarianism >can be converted into a justification for terrorism. Its a very short gap >between being opposed to government and actively fighting against it. What, exactly, is the MEANING of "being opposed to government"? If you pay taxes to support that government (even if that support is not voluntary) those taxes mean that you are indeed acting to strengthen that government and assist its efforts. I suggest that you can't realistically claim "opposition to government" (other than rhetorical) under these circumstances. >I see libertarianism as the exhausted remnant of the mercantilism of the >1980s. As constructed it recognises only those rights which favour the >privileged in society and none of those which benefit the ecconomically >disadvantaged. Politically it reached its peak influence almost a decade >ago when Regan and Thatcher were at their zenith. The '94 congress will >probably be seen as the turning point in the political tide with the mainstream >of politics moving back to the left again. There will always be people arround >who conclude that the failure was not being close enough to the ideology. You've already made it clear you don't consider yourself a libertarian. Why go on with this stuff? >If the libertarians are not carefull they will be inexorably linked in the public mind >with the terrorists who act in their name. I think the stereotypical "terrorist" doesn't really claim to "act in their [the public's] name." The one recent counter-example that I've heard of, that of the EPR in Mexico, is a very welcome exception. If anything, I think the governments of the world are truly frightened that "terrorism" as commonly practiced will change from the "blow up random airliner" mode, passing through the "blow up nearby government building" mode, to "find and kill a particular official" mode. Far less collateral damage, far harder to whip up public opposition to in the press, etc. Jim Bell jimbell(a)pacifier.com

7 7

Re: (Fwd) Australian "ITAR" regulations
by cjh＠osa.com.au 17 Dec '03

17 Dec '03

Peter Trei writes: > Forwarded from the cypherpunks list... > http://www.austlii.edu.au/cgi-bin/sinodisp.pl/au/legis/cth/consol_reg/cer43… Thanks for posting this URL Peter. Of particular note is the heading: > 43. Other goods as follows: An anonymous opinion from inside the Defence Dept holds that electronic bits on a wire do not constitute goods, and as a result if you ship electronically, you are not subject to the regulations. If you ship a CD or floppy or other physical media containing software, you violate the regulations. I'll add this to the SSLeay legality FAQ - standard disclaimers apply of course, obtain professional legal advice before exporting SSLeay. ------------------------------------------------------------ Clifford Heath cjh(a)osa.com.au Open Software Associates Limited 29 Ringwood Street / P O Box 401 Phone +613 9871 1694 Ringwood VIC 3134 AUSTRALIA Fax +613 9871 1711 ------------------------------------------------------------ Deploy Applications across the Internet and Intranets! Visit our Web site at http://www.osa.com

3 2

Re: Snake-Oil FAQ
by steven ryan 17 Dec '03

17 Dec '03

At 05:27 AM 9/22/96 -0700, you wrote: >My view is that people interested in buying and using crypto are either >bright enough to learn, or are not. A "Snake Oil FAQ" is largely >unnecessary, for either category. For the first, because they're bright. >For the second, because they're not. My view is that there is a large third group of people who are bright enough to learn, but don't have the time or inclination to read books or do extensive research on the subject. There are a lot of people using PGP for the wrong reason, not because they read the books or did the research. Nor do they even understand how it works as opposed to how it is used. They are using it because they cruised the net and read good things about it or heard it was cool. A Snake Oil Faq could help prevent these people from choosing wrong products. It would also be very helpful to have all the arguments in one place in one concise faq. Before I joined this list and read Applied Cryptography I was in a discussion in a previous job about securing one of our products. The programmer wanted to protect the key with a convoluted series of transpositions. I knew it was dumb but couldn't successfully argue the point why. A faq would have been helpful. There a lot of people with a casual interest in crypto who will remember that there is a faq on bad crypto. When the time comes they may be able to use those arguments to help avoid the use of bad crypto. Steven ------------------------------------ Steven Ryan - Reading Access - sryan(a)reading.com PGP Fingerprint: E8 A2 C5 A2 7A C4 77 93 0A 1B 1D C6 B9 2F 36 9B Finger me for my PGP public key

1 0

provably hard PK cryptosystems
by Adam Back 17 Dec '03

17 Dec '03

extracting from part of another thread... Dimitri Vulis <dlv(a)bwalk.dm.com> writes: > Adam Back writes: > > [...] I think I remember that you posted some time ago a way to have > > two plausible decryptions for one ciphertext, to enable things like > > duress keys, in terms of RSA. The problem with this, however is > > that RSA is currently very slow to use in its pure form for > > messages. > > I don't recall this one... My feeling about RSA is that one of these > days there will be a breakthrough allowing much faster factorization > (either through a better algorithm on a conventional computer, or by > a practical quantum computer) and then all the codes based on > factorization will become essentially plaintext. It's time to start > looking for other hard problem to base PKC on. I'm not sure about quantum computers, some people who know much more about particle physics than I do seemed initially sceptical, and didn't think it was doable. However I have read some optimistic sounding news clippings (on the list) which sounded as if things are progressing well, with techniques being found using redundancy to get around what were earlier problems of reliability. Is this accurate reporting (thinking of garbled stories by over enthusiastic journalists)? I'd be interested to hear opinions from anyone who does know about particle physics about the likihood of practical quantum computers being practical in the next 20 years or so. RSA has always had problems with two pitfalls in any proof of its hardness: no proof that RSA is as hard as factoring, and no proof that factoring is hard. Rabin and variants of it at least have the proof of being as hard as factoring. You mentioned your opinion that a vastly better factoring algorithm may yet be found. What about the possibility of finding proof of a useful lower bound for the complexity of factoring, do you have any thoughts on the likelihood of this being achieved? That would be a very significant result, and in the absence of a quantum attack would be as good as it gets. It would allow you to make realistic calculations about physical limits of attacking it, in a similar manner to the entropy calculations possible for brute force of symmetric ciphers. (Heat death of the sun before a solution even if every particle was part of hardware key cracking computer type arguments). One other area that did sound promising was some kind of mapping problem in n dimensional tiling that Tim was discussing at a physical meet while I was over in the US. A news clipping posted to cypherpunks a short time ago was talking about a researcher who had constructed a crypto system related to the problem of finding paths in a tiling problem (sounded like the same problem). The interesting part was that the researcher was reported as having a proof of hardness. Similarly is this being reported accurately? > E.g., does anyone know of any progress made on public-key > cryptosystems based on the word problem in semigroups, described in > Neal Wagner and Marianne Magyarik, _A public key cryptosystem based > on the word problem_, Advances in Cryptology: Proceedings of Crypto > '84, G. R. Blakley and D. Chaum, eds., Lecture Notes in Computer > Sciences #196, Springer Verlag, 1985, and also mentioned in Wayne > Patterson, _Mathematical Cryptology for Computer Scientists and > Mathematicians_, Rowman and Littlefield, 1987? Not familiar with the problem. Is it something you could explain briefly, or are there any on-line papers on the subject? > >From what I neard, NSA tried very hard to implement it and failed, > and the Soviets actually built a cryptosystem similar to what they > described. I tried to duplicate what the Soviets supposedly did, but > without success. Adam -- #!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj $/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1 lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)

1 0

Re: Macintosh Mixmaster port... Who's doing it?
by Greg Broiles 17 Dec '03

17 Dec '03

At 03:16 PM 9/22/96 -0500, Adam Shostack wrote: > A real Mac port of Mixmaster, that integrated with Claris >EMailer and Eudora would be a huge boon to the millions of Mac users >out there. I have no doubt that Vinnie's mac crypto conference talked >a lot about this sort of thing. Actually, the Mac crypto conference didn't spend any time at all on Mixmaster - which is not intended as a criticism of either the conference or of Mixmaster, but it just didn't happen. I gave a very short talk and said that I thought the Mac needed three apps, for people who wanted to jump in a write something useful to the cause of privacy on the net and didn't want to reinvent any wheels: a remailer client with a good user interface, a Mac-native remailer, and an implementation of DC-nets. Mixmaster would, of course, address two of those three. Lucky tells me that there is already a Mac implementation of DC-nets, but it doesn't seem to be very well known. My impression of the demographics of the conference was that it was folks who are mostly working developers who aren't necessarily up-to-the minute on crypto and ecommerce stuff, but are interested enough to at least think about including it in their applications. I'm pottering around with a Java-based remailer that acts like a POP client so it can run on a client machine, not a Unix box; but other people should take that as a challenge to see if they can finish one before/better than me, not a reason to avoid writing one. Hal Finney has already done some very nice work with Java and mailing; see his home page (the address of which I don't have immediately at hand) for more details. For what it's worth, I think future remailer/Mixmaster development might do well in Java. I'm not especially sold on or trusting of the alleged security or trustability features of Java (sorry, no offense) but I *do* think it's a neat tool for building non-machine specific network aware applications. Ignore the fact that people use it to build silly animations or that downloadaded applets may or may not be secure - it's still useful as a development tool. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

4 3

Re: Internet File System?
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

This is actually a good idea. There is something in the UNIX world called NFS (network file system). It is based on TCP/IP sockets. I do not know if you know anything about UNIX, but the file system used does not have logical drives (like a: or b: etc), just one huge tree that can span across many harddrives on many computers, thus making them all look like one. NFS helps to connect the other computer's file systems to the network tree. I think it is pretty cool... There is an RFC for it, though I do not remember the number. I read it once cuz I was planning a windows 95 version so I can hook my laptop up to my UNIX computers, but I found software to do it with and was like, why should I kill time on it when I could be using it to make money! It is very complete and designed to be implemented in C. Since Java is so close to C, a port could probably be made fairly easily (provided ya know something about writing file systems/operating systems ;) )

2 1

LD
by blanc 17 Dec '03

17 Dec '03

Dr. Dimitri Vulius, you made this remark to someone: ...You really should get to know L.D. better before you repeat the lies Timmy May spreads about him. ......................................................................................... May I recommend that you read the content within these urls: http://www.csn.net/~ldetweil/ and especially: ftp://crvax.sri.com/risks/15/risks-15.27 (and 28) These contain a history which will clarify for you some of the comments made about L.D.'s relationship to the list, Tim May, etc. .. Blanc

1 0