- cypherpunks-legacy - lists.cpunks.org

Re: Imprisoned for Not Having a Gun?
by Hallam-Baker 17 Dec '03

17 Dec '03

Sandy Sandfort wrote: > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > In addition > to the "exceptions," there was no penalty for violation of the > law, thus making sure it was unenforceable. It was not a case > of "pro-gun fascism" but of rough American political humor. At > the very least it kept the city council out of more serious > mischief. Was there a bar against a person obtaining an injunction to force someone to purchase a gun or a provision providing that no liabilities would be incurred as a result of not owning one? The law is much too important to start abusing to make political points. Phill

2 1

Re: Imprisoned for Not Having a Gun?
by Hallam-Baker 17 Dec '03

17 Dec '03

Peter Trei wrote: > Quite a while back, I read an article in National Rifleman (the NRA > magazine), that for part of the 19th century it was the law that all > adult men in the Balkan statelet of Montenegro must carry a pistol > when in public (a close relative of the ruler had a monopoly on the > manufacture and sale of firearms in the kingdom). > > Traveler's reports noted the extreme civility of Montenegrin > society during this period. Yes and what happened in the early part of the 20th century with respect to that area of Europe? Phill

1 0

Rumors of death of Anguilla Data are greatly exagerated.
by Vincent Cate 17 Dec '03

17 Dec '03

Taxbomber wrote: >This is the work of some journalist hacks who did a major job of >character assassination by claiming that we (and our provider) >were involved in selling fake passports. This is a fraud by taxbomber. He is totally involved with selling fake passports. He calls them "camouflage passports" and they have names like "British Honduras" of countries that no longer exist, or never did. He does not think they are "fake", but the rest of the world does. He also suggested opening up bank accounts with these fake passports (encouraging fraud). My lawyer called me up and told me that fake passports are illegal in Anguilla and that I should pull this guy immediately. I did. It is our policy to not permit anything on our servers that is illegal in Anguilla. My lawyer is where I get the definition of "illegal in Anguilla". Tim: >(I assume this is Vince Cates' site, though I haven't doublechecked... Yes, taxbomber was using Offshore Information Services. Tim: >Longterm, I've never believed there is much safety in locating in *any* >physical country. (By this I mean advertising and making it clear that one >is in Country X, said to be "friendly" to tax avoiders, data havens, money >laundering, etc. As a practical matter, taxbomber would have been better off to not state what country his web site was currently in, let alone who the provider was. This reporter seems not to even use email, and I doubt he would know how to locate a sites provider. Tim: >I'd guess that Vince has had a fun time in the Carribbean, but that he'll >be closing up shop sometime soon. Once some services are yanked, confidence >is lost. I am not closing up at all. Anything that is legal in Anguilla can be done from my servers. If not, then not. Note that there are no taxes here, and there are still many things a guy can do here that are not permitted in other places. However, fake passports turns out not to be one of them. Sameer: > Note that the taxbomber site is moving to a provider in the US. Actually, at the moment http://www.taxbomber.com/ is off in Europe someplace. The US provider has been slow to come up with an IP address. :-) -- Vince

1 0

Re: Police prepare stunning end for high-speed car chases
by Duncan Frissell 17 Dec '03

17 Dec '03

Time to fire up the '57 Chevy. At 05:04 PM 8/10/96 +0200, Gary Howland wrote: >Police prepare stunning end for high-speed car chases > > BY GILES WHITTELL > AND NIGEL HAWKES > > IT COULD be the end of the car chase as we know it. With the automotive equivalent of > a stun gun, science fiction is coming to the aid of law enforcement. > > A high-powered electrical device under development at the Pentagon's Army Research

2 1

Re: Imprisoned for Not Having a Gun?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:21 PM 8/10/96, Hallam-Baker wrote: >Sandy Sandfort wrote: >> >> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> SANDY SANDFORT >> In addition >> to the "exceptions," there was no penalty for violation of the >> law, thus making sure it was unenforceable. It was not a case >> of "pro-gun fascism" but of rough American political humor. At >> the very least it kept the city council out of more serious >> mischief. > >Was there a bar against a person obtaining an injunction to >force someone to purchase a gun or a provision providing that >no liabilities would be incurred as a result of not owning one? > >The law is much too important to start abusing to make political >points. This, of course, was my exact point. I don't buy the argument that Kennesaw (or whatever) was just making a symbolic point. If one community passes a law which mandates the ownership of guns, in contravention to the Second Amendment, then another community could ban ownership of guns, using the same logic and "general principal." (Several have, of course. I think such laws violate the Second Amendment, but apparently the courts do not agree.) And what of making a "citizen's arrest" of a "perp" who refuses to own a gun. I prefer not to have to guess which laws are real and which are merely posturing. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Going Postal (Was: Boom!)
by James A. Donald 17 Dec '03

17 Dec '03

(Regarding the one pound limit on anonymous parcels) At 08:13 AM 8/9/96 -0700, David.K.Merriman(a)toad.com, wrote: > Don't know that I'm a 'bomb expert', but it would appear reasonable that 6 > just-under-a-pound bombs would do approximately as much damage as a > similarly sized larger device. As was pointed out earlier in this thread, a one pound device containing high explosive can drop a plane out of the sky as if it was swatting a fly. Note that any moron can make high explosive, though the average moron has a good chance of blowing himself up in the process. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Anguilla / taxbomber - legality
by Vincent Cate 17 Dec '03

17 Dec '03

I meant to quote this part in the previous post: taxbomber: >Needless to say, we have NEVER EVER dealt in one single fake >passport, nor have we ever offered, sold or brokered any forged, >stolen or "lost" documents. Nor is there any need to do so, if you can >get the real thing absolutely legally. He was definately selling fake passports. He thinks of them as camouflage. If I look up fake in websters, they fit the definition. Turns out this is not legal in Anguilla. If it is no longer in his web page, you can see quotes from his web page in the David Evans article. The Internet spans many counties and if something is not legal in one country but legal in another, someone can move. He has moved. One of the exciting things about the Internet. If there are taxes in your country and banks cooperate with the government, you can incorporate in Anguilla, put your web site here, and run your business from here (coming in over the Internet) tax free. But fraud is illegal in Anguilla, and fake passports are concidered fraud. -- Vince http://online.offshore.com.ai/

2 2

Re: National Socio-Economic Security Need for Encryption Technology
by Arun Mehta 17 Dec '03

17 Dec '03

At 02:05 10/08/96 -0700, Timothy C. May wrote: >At 12:15 PM 8/10/96, Scottauge(a)aol.com wrote: >>I was watched CBS reports a couple nights ago about how all these blue collar >>and now white collar jobs are going across seas. > >Where do I begin? First, what does "taking jobs away from us" mean? That we >own these jobs? And who is "us"? Well said. While I didn't see the CBS program , I bet the scaremongerers did not point out that programmers don't just produce software, they are major consumers as well. The growth of the software industry in other countries therefore means business for US industry, which produces most of the compilers and other utilities that programmers everywhere use. This clearly helps programmers in the US. >>So a possible way to protect jobs is to protect the knowledge on how to do >>them. To some extent this happens automatically -- for instance, if you live in the Silicon valley, your knowledge levels are higher on account of higher frequency of user meets, conferences, etc. But, to the extent you use the Internet as an information source, it is available internationally. So you cannot have it both ways: use an open forum like the Internet, and hope to keep knowledge bottled in. In earlier generations of computing, monopolistic organizations such as IBM and DEC charged huge sums for information. One of the reasons that IBM was thrown out of India in the mid seventies was their practice of shipping only outdated computers from the US to India. Indian programmers were at a disadvantage, and clearly could not charge as much as American ones. But the openness of MS-DOS and UNIX changed all that, a trend that has only been strengthened by the Internet. While jobs could easily move overseas, the developing world may not be able to absorb them. To start with, such migration assumes the availability of excellent telecom facilities. These are severely lacking in most developing countries, which have about 75% of the world's population and 16% of its product, but only 12% of the total number of telephone main lines. These too are mostly in cities. While the World Bank's 1988 figures indicate that in industrialized countries, major cities have a 20-30% higher telephone density than do other areas, in a country like Ethiopia, cities have a density of about 14 times the national average. In other words, most people in developing countries have practically no access to telecom facilities. In addition, the quality of the facilities, typically provided by state-owned monopolies, is often abysmal. While low-earth orbit satellite projects such as Iridium, Odyssey, Teledisc and Globalstar threaten to change all this, little impact will be felt until the end of the decade. In any case, telecom facilities in the industrialized countries will most likely continue to be considerably superior, providing workers there with an ongoing competitive advantage. Further, as economists such as Paul Krugman point out, developing countries lack the means for sustained growth ("Which Asian Model?", Newsweek, November 20, 1995). Those economies that have shown dramatic growth, such as the East Asian, have relied essentially on low-cost inputs, rather than on their efficient utilization. Professor Alwyn Young of Boston has in fact come to the surprising conclusion that Singapore's total factor productivity (which measures such efficiency) is so poor as to be comparable to that of the Soviet Union. He points out that "at just the time that everybody was ranting about how magnificent Japan was, it ceased to catch up." Cheap inputs is not a long-term phenomenon, as companies looking for good programmers in India are increasingly discovering. Programmer salaries in India are rapidly rising. While many youngsters are keen to become programmers, India lacks adequate training facilities. Today, teachers receive poor pay, even by Indian standards. Educational institutions are hardly going to be able to raise salaries of software teachers alone, while raising them for everybody will be impossible. Consequently, there is going to be little incentive for good programmers to become teachers, and the educational institutions will continue to churn out large numbers of poorly trained students. It is suggested that universities in industrialized countries could use the Internet to teach students in developing countries, but the efficacy of this model has yet to be proven. Also, a very small percentage of Indians are fluent in English, and from it come the senior bureaucrats, managers for the private sector, the military, newspapers, educational institutions -- in short, all the important posts of the country. Unless there is to be a severe disruption of the nation's activities, not too many can be diverted to cater to export. >>Perhaps there is a larger picture in the world that the cyperpunks mailing >>list is missing. That cryptography is not just for personal privacy, but >>could involve job security also - as a matter of fact, the income base for >>this whole country. I'd argue the opposite: I see no reason why companies such as Netscape have to put up with such draconian US laws as ITAR: why don't they simply develop their software overseas? If they made a highly publicised move, that might do wonders to change the opinions of US Congresspersons voting on ITAR-related legislation. My prediction is that with the blessings of the Internet, the next generation of multiracial programmers, even those that were born in the USA, will be more likely to be found on the beaches of tropical islands than in the fog of San Francisco. When you can work in the shade of a palm tree, even if you should earn less, it's worth it :-) Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

1 0

Re: SecurID
by vin＠shore.net 17 Dec '03

17 Dec '03

Paul J. Bell <pjb(a)ny.ubs.com> gave a desperate shout for help: >someone at my firm is about to press the securid system down our collective >throats. please point me to the recent thread on this subject, and/or point >me to some url's or the like, or to someone who has some firsthand >knowledge of the pitfalls and/or vulnerbilities of secirid. I think Enigma Logic, Digital Pathways, and Cryptocard -- all vendors of competitive one-time passsword (OTP) tokens --have diatribes against the ACE/SecurID system on their web sites. Check them out. Over the past two years, there have also been a number of fairly in-depth debates about SecurIDs and the ACE protocols on the Firewalls mailing list (ftp the archives at greatcircle.com) and in comp.security.unix. My SecurID FAQ, available from SDTI at <http://www.securid.com> might give you ideas too. Most people find the SecurID (and most of its competitors) relatively well-designed and and secure devices. Most of the negative comment I've seen is from competitors who say the SecurID and it's ACE support system is too expensive, and from ACE administrators who gripe that the software is not optimized for their favorite platform. It is unfortunately true that SDTI has not yet mastered the knack of producing perfectly bugless code. Earlier this year SDTI also fouled up badly when they failed to bring their Customer Support operation up to speed to support a new generation of authentication servers (ACE 2.X) which involved a relatively more complex Unix installation. They've spent a lot of money and hired a lot of people, but I don't think there is yet a consensus about whether they've licked that. Still, some people think they get their money's worth. SecurID is the OTP token of choice at most (80 percent +) large corporate sites --in a market with a lot of competitors, including well-done freeware OTP alternatives: s/key and OPIE. Of course, those buyers could all be wrong. SDTI's success is really built on the fact that users -- the people who actually carry the tokens -- usually say they like the SecurID better than the alternatives. The SecurID claims the lion's share of the market because it is relatively intuitive and easy to use: the PIN and token-code can be typed in like a (long) traditional password. The alternative tokens -- all challenge/response devices -- force the user to engage in a multi-step process to get a random challenge from the remote host, tap it into the token, encrypted it, then send it back to the host as the OTP. SecurIDs are supported by an ACE authentication server which -- alone among the OTP vendors -- holds its Access Control files in a commercial-grade SQL-savvy relational database, which means that can be interlinked with HR or any other SQL-savvy corporate RDBS. As the industry sets the stage for enterprise-wide IP security (hopefully soon to include crypto) many believe the authentication server's capabilities become more important than the token's design. But, hey, those folks could be wrong. SDTI also just bought RSA Data Security, which some feel enhances its prospects for making some further contribution to enterprise security. Even before that, some 50 of the leading independent vendors of network-based products (from firewalls and comm servers to big databases) had chosen to integrate ACE/SecurID client code into a huge variety of products. This is a fairly unprecidented level of industry support -- but they might be all wrong too. ACE/SecurID is notable among other OTP systems for both its support infrastructure (STDI supported the client/server architecture five years before any other OTP vendor,) and because it is a (patent-protected) time-synched device: the 30/60-second dynamic token-code the SecurID displays is a hash of Current Time and a token-specific secret seed. This has pros and cons (honest, both pros and cons;-) Unfortunately, what ACE/SecurID does not do -- what no OTP can do -- is safeguard or secure your communications links. (It also does not minimize the need for ongoing system administration; capable auditing and oversight; or an explicit local security policy -- all of which can also be burdensome to the user. But the real bear is network security.) On an unprotected network or telephone link -- in the face of a sophisticated attack -- nothing but network-level crypto or link encryption can stave off either eavesdropping or active TCP "session stealing." (Several of SDTI's strategic partners do provide encrypted tunnels through open networks. There are even some well-regarded freeware or shareware options.) SecurIDs, like any OTP, only identifies the guy who knocks on the front door. This is useful; it's even important -- but it's not enough. Most environments need (but don't have) crypto too. But even in the face of this acknowledged threat -- session hijacking -- many sites still find it useful to invest in OTP tokens, often SecurIDs. They do this because: * OTPs can offer a more-certain two-factor authentication (something known; something held); * OTPs foil a whole array of trojan and sniffer-based attacks which seek to collect the passwords of innocent users like yourself; and * OTPs can raise a partial barrier against network-based attacks. Effectively, OTPs force most network-based attacks to become overt... so the user and/or sysadmin has a chance to recognize that something is wrong and react defensively. Some believe the ACE/SecurID system actually does a little better than that. The ACE protocol encrypts all packets containing user authentication data as it passes between the ACE/Clients (often embedded communication servers of various types) and the ACE/Server. This establishes an encrypted virtual net for authentication data with the user site, which blocks another class of attacks. In an ACE/SecurID-protected environment, the threat of network-based attacks is thus somewhat constained. Authentication calls, and the TCP/IP sessions they authorize, remain quite vulnerable if they are transmitted over the Internet, or an extended private network, or telephone links susceptable to physical wiretaps. OTPs safeguard the authentication calls against replay attacks --and most of the race attacks seem managable -- but unencrypted sessions ultimately remain vulnerable to both eavesdropping and session hijacking In many corporations, however, only a fraction of the data traffic travels on these high-risk links. While there are net-based attacks that might reach in to grab unencrypted message traffic on your internal LAN (Is someone is also trying to force a firewall on you guys too, PJ?) within the ACE client/server environment, at least user authentication data -- name, OTP, and PIN -- seems to be securely encrypted. Not that there aren't hackers -- and cynical system administrators -- probing and testing it daily. Rumors and dark suspicious whispers abound, as seems inevitable with any successful product that relies on crypto. (Actually, any widely used computer security product -- have you noticed?) Personally, I find it reassuring to remember that for virtually every flaw there is, inevitably, a fix. But then, Wall Street's recent soaring climbs and plunging drops remind me of just how potent rumors can be. Please come back and tell us if you find any real dirt, Mr. Bell. (And please pardon the blithe spirit that infected my comments. It's just hard to play the straight man on a Saturday summer night.) Also, an obligatory avowal: SDTI regularly pays me huge sums of money for information and advice, but they ignore at least half of what I say. You can too. Suerte, _Vin Vin McLellan +The Privacy Guild+ <vin(a)shore.net> 53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548 <*><*><*><*><*><*><*><*><*>

1 0

Re: Police prepare stunning end for high-speed car chases
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:16 8/10/96, Anonymous wrote: >Why don't they just have government access to car engines? They could >just require car manufacturers to include remote shutdown devices for >the engines. But they will. Didn't you know that? -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0