- cypherpunks-legacy - lists.cpunks.org

Cypherpunks at InfowarCon '96
by Mark O. Aldrich 17 Dec '03

17 Dec '03

There've been a couple of posts mentioning that there will be a Cypherpunk presence at InfowarCon '96. Besides the more public figures (Eric Hughes and Phil Zimmermann, among them), I'm sure that the audience will have a fair number of list participants in attendance. If anyone wants to say "howdy" or swap key fingerprints, I'll be there both days and for the reception on the 4th. I'm the panel moderator for "B1 - Emergency/Disaster Planning for the Effects of Information Warfare" affair on the 5th (stop by if you want to see FEMA and the Red Cross go at it). If you're at the "schmooze and booze" reception on the evening of the fourth, please come up and introduce yourself. I'll be the guy who's 6'2", 200lbs, shoulder-length brown hair in a red bandanna headband, full beard, jeans, boots, and my leather biker vest. I should be fairly easy to spot :) ------------------------------------------------------------------------- |Just as the strength of the Internet is |Mark Aldrich | |chaos, so the strength of our liberty |GRCI INFOSEC Engineering | |depends upon the chaos and cacophony of |maldrich(a)grci.com | |the unfettered speech the First Amendment|MAldrich(a)dockmaster.ncsc.mil | |protects - District Judge Stewart Dalzell| | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Nuke attack? No, bug in DNS! (fwd)
by Vipul Ved Prakash 17 Dec '03

17 Dec '03

I think this is the main cause of all strange things happening on the net for last few days. Vipul Rishab A. Ghosh Wrote : > Was I the only one nuked by the DNS/BIND crash yesterday? I hope > I've not been automatically unsubscribed from the list. As not > everyone here reads c.p.tcp-ip.d I've attached Karl Denninger's > analysis. For those who were luckily immune, my ISP (best.com) like > many others, had it's DNS crash for _local_ domain names (belonging > to the ISP and customers like me) through most of yesterday. No, > not a virus, but bad DNS records "floating around" as Karl puts it, > that happened to expose a bug in the latest version of BIND. > > So much for immunity to nuclear war! > > Rishab > > > From: karl(a)MCS.COM (Karl Denninger) > > Newsgroups: comp.protocols.tcp-ip.domains > > Subject: SERIOUS PROBLEM WITH DNS SERVERS AND BAD RECORDS - Rev 4.9.4 > > Date: 23 Aug 1996 10:10:39 -0500 > > Organization: MCSNet Ops, Chicago, IL > > Message-ID: <4vkhlf$u4(a)Jupiter.mcs.net> > > > > CAUTION! > > > > There are a series of bad nameserver records floating around on the net > > which are blowing up BIND versions 4.9.4 (REL and T5B) and possibly other > > releases as well. > > > > This has been VERIFIED to be impacting multiple ISPs and their DNS servers. > > > > We are shutting off updates from ANY DNS server which presents bogus data, > > which stops it from killing our code, but is of no help to the large number > > of domains which are presumably rendered unreachable. > > > > At present, this list is: > > > > bogusns 204.94.129.65 158.43.192.7 > > ; > > bogusns 199.3.12.2 38.241.98.5 199.71.224.105 206.215.3.10 > > bogusns 134.75.30.253 198.41.0.4 128.63.2.53 198.41.0.4 > > bogusns 206.66.184.11 206.66.104.37 > > ; > > bogusns 163.173.128.6 163.173.128.254 200.6.39.1 192.33.4.12 128.174.36.254 > > bogusns 129.79.1.9 128.174.5.58 > > > > > > All of these have presented at least one malformed record to us in the > > last two hours! > > > > Folks, if you run one of these servers, start tracking down the problem on > > your end. If this is bad cached data, THOSE AFFECTED MUST FLUSH IT > > AS SOON AS POSSIBLE TO TRY TO PREVENT PROPAGATION. > > > > This problem started as an isolated set of incidents yesterday, and is now > > spreading like wildfire. > > > > The actual bad data appears to be a domain name being returned in an > > authority record which is of the form "domain.com<tab>com". We have not > > yet caught a bad returned record in a debug file; that is being attempted > > now. > > > > When this goes through "dn_expand" in the BIND code, it causes memory > > arena corruption and subsequent failure to resolve VALID zones which you > > are authoritative for. First signs are reports of "corrupted authority data" > > if you are using "dig" to check zones which you hold authority records for. > > > > We are working on a way to "harden" the code against this kind of junk data, > > but until we can get one deployed our defense is to shut down communication > > from those who are presenting us the garbage. > > > > PLEASE CHECK YOUR NAMESERVERS OUT AND TAKE NECESSARY STEPS YOURSELF! This > > is a serious problem which has the possibility of melting significant parts > > of the Internet infrastructure. > > > > -- > > -- > > Karl Denninger (karl(a)MCS.Net)| MCSNet - The Finest Internet Connectivity > > http://www.mcs.net/~karl | T1 from $600 monthly; speeds to DS-3 available > > | 23 Chicagoland Prefixes, 13 ISDN, much more > > Voice: [+1 312 803-MCS1 x219]| Email to "info(a)mcs.net" WWW: http://www.mcs.net/ > > Fax: [+1 312 248-9865] | Home of Chicago's only FULL Clarinet feed! > > > > > > -- > > bryant durrell http://www.innocence.com/~durrell > > durrell(a)innocence.com http://www.innocence.com/fengshui > > durrell(a)bofh.net http://www.innocence.com/shadowfist > > big black nemesis parthenogenesis no one move a muscle as the dead come home > > > >

2 1

Re: USPS
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:54 PM 8/26/96, Bruce M. wrote: >On Fri, 23 Aug 1996, William H. Geiger III wrote: > >> Once in place all the goverment needs to do is ban all e-mail not sent >> through their system. Add this to the outlawing of all non-keyescrowed >> encryption, and the ability to archive all messages sent through their >> system. Now the goverment would have total access to everything you >> wright. > > Why not? I believe it is already illegal to place anything in a >person's physical mail box that the post office hasn't processed. For >the sake of preserving the 'integrity and security' of the Internet I >can see the govt. taking such future actions. I'm skeptical of this analogy (that it could be used to take control of e-mail). The postal mailboxes that the Postal Service claims to control are those that are either marked "U.S. Mail" or fit the form and function typically associated with a "mailbox." A box standing on a post by the side of the road near one's house, for example. Often saying something about "Approved by the U.S. Postal Service," blah blah. The Postal Service has nominal ownership of these boxes, even when installed by customers (as is the norm, of course). (This comes up in one major way: non-Postal Service deliveries are not supposed to be made into such boxes. Secondly, there are limits on what customers can do to "defend" these boxes against vandals...this has come up in discussions of placing a small box inside a large box and filling the space between with cement, to break the arms of hooligans who play "mailbox baseball.") Anyone is free to place boxes on their property marked "For Federal Express Deliveries," "For Packages from Neighbors," etc. Or to rent "Mailboxes, Etc."-type boxes. These latter examples are analogous to e-mail accounts folks have at various ISPs. Or to Mailboxes, Etc.-type rental boxes. The Postal Service has limited jurisdiction over rental mailboxes, and even less authority over my placing of a "UPS leave stuff here" box on my porch. Thus, I don't seen the analogy as giving the Postal Service more sweeping powers over e-mail than they already have over physical deliveries. And given the already-anarchic and already-distributed nature of e-mail, it's hopeless. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

The Observer [UK] editorializes against online freedoms (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

Information longs to be free, even if some forums aren't... We've put scans of the full story onto www.scallywag.com. The source is a reporter for a competing newspaper. ---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 09:40:43 -0700 (PDT) From: Rich Graves <rich(a)c2.org> To: fight-censorship(a)vorlon.mit.edu Subject: Re: The Observer [UK] editorializes against online freedoms Attribution for the forward deleted on request. Richardson's included PGP-signed letter, though, is public. I hope this reassures US activists that *even the British* know the story is wrong. -rich ---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 12:24:05 +0100 Subject: Response to Observer A nice technical response to some of the factual innacuracies in The Observer piece. Not quite the way I would have done it . . . but good nonetheless. -----BEGIN PGP SIGNED MESSAGE----- I. T. Consultancy Limited Our reference L2217 The Editor The Observer 119 Farringdon Road London EC1R 3ER 26 August 1996 AN OPEN LETTER - FOR PUBLICATION Sir, I read with some interest the article by David Connett and Jon Henley in yesterday's edition regarding the Internet and child pornography. I was particularly interested as I am a computer consultant advising clients on Internet issues. In my professional opinion, the technical standard of the reporting was sufficiently poor as to be both inaccurate and misleading. The purpose of this letter is to clarify certain technical issues which might cause your readers to reach unfounded or incorrect conclusions. It is important to be aware of the various methods by which information generally (which can include pornography) is distributed around the Internet. Your article focuses on one particular route, namely Newsgroups. It is Newsgroups which are detailed in the Metropolitan Police's letter to Internet Providers and which are concentrated upon by your article. There are several other means of distributing information. I believe however that the Police letter lists fewer than the 150 groups referred to by the authors. Interestingly enough Newsgroups only offer the means of broadcasting information to anyone who wants to retrieve it. The authors do not appear to have a sufficient grasp of what a "remailer" does. For example they seem to draw a direct link between the use of such remailers and people being able to "log on and participate in 'live' and 'interactive' filmed sessions". A lay reader would perhaps draw the inference that the remailer is somehow involved in any such live participation. Unfortunately this could not be further from the truth. Remailers simply allow people to post messages, either as email to other people or to Newsgroups for general reading. Nothing more. Remailers are generally incapable of being "logged on" to. Your article also refers to "remailing companies", from which the lay reader might infer that remailers are operated for commercial profit. Such an inference would again be wholly incorrect. I know of no organisation operating a remailer for profit, indeed none of them even charge for their services. They are generally run by individuals on a voluntary basis who consider them as a service to the Internet community. Your article appears not to mention any of the purposes of such remailers other than in terms of the distribution of pornography. In my view it would be difficult to present a balanced article without doing so. Different remailers take different steps to prevent whatever their operators consider as "abuse". My understanding is that Mr. Helsingius' service restricts messages to 48k bytes (or characters) and prohibits postings to the "binaries" newsgroups designated for images. I also understand that it only allows 30 messages per user per day. At a technical level these restrictions would make it almost impossible to use his service for mass distribution of any binary data, not just pornography. It therefore appears surprising to me that your article should allege that Mr. Helsingius' remailer is responsible for handling "90 per cent of all child pornography" on the Internet. I wonder what substantiating evidence The Observer has to this effect other than the alleged claim by Toby Tyler. Indeed it appears from your article that the words "is supplied through this remailer" may not be a direct quote from Toby Tyler. Your article alleges that "the photographs made available to Demon's subscribers through the Internet are supplied anonymously by remailing companies". The lay reader might infer from this that all photographs therefore come via remailers. Again this would be far from the truth. Finally I hope this letter offers some assistance to your readers in clarifying a number of issues which were perhaps less than clear in your article. Given your newspaper's difficulties with technical issues, I would be grateful if you would kindly refer any editing of this letter to me prior to publication. Yours faithfully, Matthew Richardson -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAgUBMiFvEAKwLwcHEv69AQGjIQP+IGR9rhvdYXe7CuCcwPl/tIrIBryikTM2 IVOpygTF2nCPf3WEJ8czRvs1emp9d9d++69XiG1f6QAeP9Jv/h9KzVtV7mjjuqCX LhlhXBYjLIiGCcxljKZ07zHFlCeZWCzuAmIFnZbz2fNNjqyicheIMlxI2tDrGgjp dlaGZuAI2XY= =dkXg -----END PGP SIGNATURE-----

1 0

Re: Sen. Leahy's "impeccable cyberspace credentials"
by James A. Donald 17 Dec '03

17 Dec '03

At 09:50 AM 8/26/96 -0700, Declan McCullagh wrote: > Go a head and reject the "Beltway politicians". It's fashionable, sure, but > what does it really accomplish? Some of them are dangerous. Others are > sympathetic. Not true, some of them are merely less dangerous and harmful than others. As to whether Leahy is one of the less dangerous and harmful ones, that is seriously questionable. > The fact is that short of armed rebellion they are going to be > here for a while.I shudder to think of the wrath our opponents > could wage if we all threw up our hands packed up our bags and left town. Bad cop, good cop. You cooperate with the "good" cop, you go to jail. You tell them both to go to hell, then maybe you will not go to jail, and if you do go to jail, at least you will have the satisfaction of screaming injustice all the way: Re read what our "good" cop has been up to: > > Worse yet, as recently as this month Leahy has > > been clamoring to fund the invasive wiretapping legislation ("Digital > > Telephony") he shepherded through Congress two years ago. > > > > Equally distressingly, Leahy demonstrated his "impeccable cyberspace > > credentials" by cosponsoring the Senate online copyright bill -- aka the > > Hollywood Media Mafia's wet dream. (Yes, these are the same rapacious > > folks who are demanding that the Boy Scouts and summer camps pay cash to > > sing "God Bless America" and "Puff the Magic Dragon.") Opposed by the > > American Library Association, EFF, and teachers' organizations, Leahy's > > bill would slam fair use rights online and could make it a crime to > > browse the Net without a license. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Credit enforcement
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:43 PM 8/17/96 -0400, you wrote: >I thought that classical libertarians agree that the enforcement of >contracts is a proper function of the government. The minarchists generally do, the anarchists generally don't, at least if you're talking about last-resort contract enforcement. The primary mechanisms always have been to use the market, whether through reputations, insurance companies, bonding agencies, boycotts, or (often the most powerful) the sheer value of repeat business. Much of the development of commercial law from the Romans through the Middle Ages been to find peaceful and efficient ways to do business without the King helping. There are historical alternatives to having government do it; the Irish, Icelandic, Somali, and American Arbitration Association non-state-based justice systems had/have various sets of social pressure to do the job. (For instance, Somali dispute resolutions usually end up with some number of cows or other money getting paid to a winning plaintiff, and if you don't pay, your extended family has to. Rarely, the family also refuses and bringing in a higher-reputation judge fails, and a brief feud ensues...) On the "should the government or the free market do this" scale, most people put last-resort contract enforcement at the "we don't mind too much if the government does it" end rather than the "overthrow the government if they even think about touching it" end, which is for issues like sex, drugs, rock&roll, freedom to travel, etc. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Reassign Authority!

1 0

Whistleblowing on the Internet
by Geoffrey Gussis 17 Dec '03

17 Dec '03

I'm writing a paper for my ethics class on Whistleblowing, and specifically how it has been aided by the Internet. If anyone knows of any resources, pointers, etc., I would greatly appreciate it. The results will be published on-line, and I can send a copy to anyone who is interested as well. I am interested in information covering both the private sector and the government as well. I do know that the Federal Government has an online BBS where you can send in information on fraud, etc. What I have uncovered so far: + As far as a Lexis/Nexis search goes, I only found a few articles, and they centered around the Tobacco Papers, and the Scientology debate. + I located the Whistleblowing FAQ and contacted its author, but its last update was in 1994 and it is no longer being maitained. + I visited a couple of other related Internet sites (I searched using many search engines), but they don't really have examples of using the Internet for whistleblowing purposes. + I am also aware of the majority of Anonymity/Privacy sites on the Internet, and will definitely be utilizing them in the paper. Overall, I am quite surprised that there isn't a whistleblowing clearinghouse on the Internet; a site sponsored by a non-profit that lists email addresses and secure forms for sending anonymized email to those areas of the public and private sector that deal with whistleblowing. As the Internet is a great medium for information dissemination, and offers significant privacy advantages, I really expected to find much more. Is anyone else working in this area? Any help would be greatly appreciated. Cheers, Geoffrey Gussis 2L - Washington University School of Law ___________________________________________________________________ Internet Law Projects at http://www.digidem.com/legal/ + Worldwide Top-Level Domain/Trademark Dispute Resolution Policies + Businesses on the Internet (BOTI) Legal Research Initiative + Legal Links in Electronic Commerce and Interactive Entertainment

2 1

CLE_nup
by jya＠pipeline.com 17 Dec '03

17 Dec '03

8-26-96. FiTi: "Cleaning up the global economy. Policymakers must ponder the effects of money laundering." Is money laundering - as opposed to the crimes which produce it - necessarily such a bad thing? As Vito Tanzi notes in his IMF paper, the fact that money launderers are not fussy about economic fundamentals can help governments continue to pursue lax fiscal and monetary policies if they are equally unfussy about the origin of capital inflows. A pact with the devil, perhaps. But for many countries it may seem more attractive than signing up to a global financial market equivalent of Neighbourhood Watch. + Money Laundering and the International Financial System, IMF working paper, May 1996. ----- http://jya.com/clenup.txt (7 kb) CLE_nup

1 0

Re: Cypherpunk voting - ITAR or CDA
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 1:37 AM 8/25/96 -0400, Vincent Cate wrote: >So it seems Dole is the better vote. Is this important enough to many >cypherpunks to actually determine their vote? Every time I think about voting for Dole, I read something in the papers that convinces me it is a bad idea. The most recent is that he wants to raise the intensity of the disastrous, failed war on drugs. You know the war. The one that has forced suppliers to enforce their contracts with violence because the courts won't help them. The one that eliminated the concept of responsible use which has worked so well with alcohol. The one that has eliminated reputation from the drug market, leading to overdoses and poisonings. The one that is responsible for most of the wire taps authorized in the USA. The one that has turned the USA into the prison capitol of the world. Don't get me started. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1

RSA/Security Dynamics filings are on the web
by John Gilmore 17 Dec '03

17 Dec '03

The RSA/SDTI merger may be the only chance we ever get to see RSA's financial info. Previously it was a privately held company, which didn't report its finances publicly; now it'll be reported as part of SDI (a much bigger company), so its finances will be hidden in their larger business. You can also see what RSA and SDTI are saying about the RSA/Cylink/Schlafly lawsuits, the origins of VeriSign, how Addison Fisher bankrolled RSA and owned 55% of it, etc. Look on the SEC's EDGAR system, which contains copies of reports that the government requires publicly traded companies to file. Go to http://www.sec.gov/cgi-bin/srch-edgar?security+dynamics+technologies and view the various forms. The most fun is probably the big one, the 1.5MB S-4 form from the merger itself. These documents will require a tolerance for legalese, but there are lots of gems in there for the patient. John Gilmore

1 0