- cypherpunks-legacy - lists.cpunks.org

RUL_net
by jya＠pipeline.com 17 Dec '03

17 Dec '03

May-June, 1996, Harvard Business Review. Two related articles which examine c'punks interests -- proposed business regulation of the Net; on-line security; copyright; encryption; authentication; E-cash; electronic commerce; protected communities to escape "frontier anarchy." Executive summaries by HBR: "Ruling the Net." Debora Spar and Jeffrey J. Bussgang The Internet promises a radical new world of business. But for many companies, it has yet to deliver. Although doing business in cyberspace may be novel and exhilarating, it can also be frustrating, confusing, and even unprofitable. Debora Spar and Jeffrey Bussgang argue that the problems companies face have little to do with a lack of technology or imagination. Their problems stem instead from a lack of rules. Without the order that rules create, business cannot be conducted. The authors explain why the informal rules that have developed on the Internet since the 1960s are no longer sufficient. Businesses thinking of allowing millions of dollars of transactions to occur on the wide-open Net need specific assurances. They require clear definitions of property rights, a safe and useful means of exchange, and a way to locate and punish violators of on-line rules. The authors believe that the key to commerce on the Internet lies in the creation of managed on-line communities. Such communities can be formed by service providers -- entities that will restrict on-line options, fine-tune offerings to match a select group of users, and provide some means of recourse in cases of fraud or abuse. Under those conditions, they will draw new companies on-line and increase the productivity of those already there. And, say the authors, the rewards for service providers will be substantial: Companies that make the rules on the Internet's emerging frontier have the opportunity to reap the greatest profits. [40 kb] "The Real Value of On-Line Communities." Arthur Armstrong and John Hagel III The notion of community has been at the heart of the Internet since its early days, when scientists used it to share data, collaborate on research, and exchange messages. But how can businesses best use its community-building capabilities? Not merely by putting their products or services on-line, the authors contend. Real value will come from providing people with the ability to interact with one another -- from satisfying their multiple social needs as well as their commercial needs. Companies that create strong on-line communities will command customer loyalty to a degree hitherto undreamed of and, consequently, will generate strong economic returns. The authors present four different types of community: communities of transaction, interest, fantasy, and relationship. Examples of each type already can be found on the Internet or through on-line services, but the successful community of the future will incorporate all four -- or as many as possible. As for economic value, the authors see four ways for a company to generate returns: through usage fees, content fees, transactions and advertising, and synergies with other parts of its business. In the near future, new business definitions may emerge around the notion of owning a specific customer segment across the full range of its interests and needs; owning specific products and services may no longer be so important. The authors urge businesses marketing to consumers to make the small investment required to "buy an option" on electronic communities in order to understand both their potential value and the radical changes they may cause. [33 kb] RUL_net (for the 2) ----- Reprints of "Ruling," No. 96309 and "Real Value," No. 96301 may be ordered from HBR for $5.00 each by email to: custserv(a)cchbspub.harvard.edu

1 0

Re: Why does the state still stand:
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Here's a partial copy (edited to stay within fair use) of the U.S. News & World Report article I mentioned, off of their web site. -Allen _UPSET? TRY CYBERTHERAPY_ _AN ONLINE VISIT TO THE PSYCHOLOGIST MAY PROVIDE AN ANSWER, CHEAP_ Got the blues? Can't stop scarfing down bags of potato chips? Your spouse is always hostile, and you and the kids are, too? Therapy might help--at $125 a session. Or you could test a '90s solution: E-mail your way to mental health for a fraction of the cost. In the past year, angst has become a thriving niche on the World Wide Web. Many psychologists who are setting up home pages see electronic consultation as a way to plump up incomes hit by managed care and to attract new patients to the office. For the most part, these cyberpractitioners are careful to warn potential patients that the medium doesn't allow for detailed probing. "I give advice like Ann Landers and Dear Abby do," explains Dorothy Litwin, a New York psychologist who specializes in substance abuse, women's issues and couples therapy. Litwin is one of five women who joined forces about a year ago to form an electronic practice, Shrink-Link (address, box, Page 83). Four are New York State-licensed psychologists; one is a psychiatrist. Each has her own regular practice and specializes in a particular area of psychotherapy. For $20--you pay upfront by typing in your credit card number--you can send off your 200-word (or less) question; it is then routed to the appropriate therapist. Within 72 hours (often within 24 hours), you get back two or three paragraphs of privately E-mailed advice. _ The short answer._ The cybercouch is most effective at giving people who can clearly identify the dilemma (my daughter is anorexic; I'm deep in debt and can't stop spending) a start toward a solution. A typical Shrink-Link question: "My 5-year-old was diagnosed with attention deficit disorder (ADD) in 1993 and has been on Ritalin ever since. She has been having trouble falling asleep for the past several months and has been moodier than usual of late. What do you think?" The gist of the response: "Some trial and error is often required before the correct dosage and timing are found, and symptoms such as sleep disturbance and moodiness often occur in the interim. Moreover, since children's rates of metabolism change, dosages often need to be adjusted. Even if the dosage is correct, the behavior irregularities you describe could be caused by administering the drug too late in the afternoon or by a host of other factors, such as nighttime fears. These possibilities need to be ruled out one by one until the culprit is found." The advice could well be to seek face-to-face counseling. E-mail exchanges are no basis for a diagnosis, for example, warns Marlene Maheu, a San Diego clinical psychologist who headed the American Psychological Association's subcommittee that recently looked into the ethics of cybertherapy. "It's impossible to get an anonymous patient's complete family history in a 200-word question," she says. And without such cues as voice tone, facial expressions and body language, how can a therapist be sure what the problems really are? "Smiley screen faces are a poor substitute for real communication," agrees Leonard Holmes, a therapist based in Newport News, Va., who says his online services are not therapy but "E-mail discussions." ("It's a bit more private than a call-in radio show," he notes.) Holmes charges $1.50 per minute and will spend as much time "with" a patient as the patient desires. Maheu's subcommittee and other psychology professionals worry that a lack of standards makes people seeking online help vulnerable. "When you are answering questions by E-mail, it's tempting to stray beyond your area of expertise," says Maheu. "The APA's ethical principles prohibit that." Critics also worry that confidentiality is at risk. While patients remain anonymous, a hacker could conceivably identify them. And these Internet sessions aren't encrypted. "You have no way of knowing who is printing the E-mail message out or where it is stored," says Thomas Nagy, a psychologist and Stanford University School of Medicine psychiatry professor. Nagy also worries that people with really significant problems will stop with an online Band-Aid. Troubling, too, is the fact that patients may know little about the therapist and his or her qualifications. Many sites don't disclose details about the counselors' experience and where they earned their credentials. Leonard Holmes, by contrast, provides a complete biography on his Web page that includes his educational background, what state he is licensed in, as well as areas of expertise. That way, interested patients can check out his professional background before a session. [...] BY KERRY HANNON _A few routes to mental health_ _Shrink-Link_ (http://www.westnet.com/shrink) These New York women-- four psychologists and one psychiatrist--offer E-mail advice for $20 a pop. _Leonard Holmes_ (http://www.psychology.com/holmes.htm) Holmes is a therapist in Newport News, Va., who answers E-mail questions for $1.50 per minute and provides links to other sites. [...] _________________________________________________________________ CREDITS Send comments to webmaster(a)usnews.com Copyright U.S. News & World Report, Inc. All rights reserved. This site is engineered by AGTinteractive [IMAGE]

1 0

Reputations
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:09 PM 5/15/96, Steve Reid wrote: >Another problem with reputations is that people are stuck until they get a >good one. A bad rep can always start over. In fact, a person/company can >look perfectly nice, but use a different identity for dirty work. Sure. And they do this today (use cut-outs or subcontractors to limit reputational damage or liability). >Naturally, you'd only trust dealings that involve a "nice" identity. Not necessarily. Many people play the numbers, implicitly trusting the Mafia to pay off on bets they win. (Many don't think the Mafia has a very "nice" identity, but your mileage may vary.) In fact, nearly all of the alleged problems with anonymous systems, especially the issues of defections, trust, expectation of payoff, etc., have parallels in other "extra-legal" situations. For example, the Mafia and other extra-legal or criminal operations. Do they sometimes defect (welsh)? Sure. Do they sometimes screw over the little guy? Sure. Do people trust them just enough to keep dealing with them voluntarily? Sure. (Before anyone mentions it, there are of course cases where people are forced to deal with criminal gangs nonvoluntarily, such as with shakedowns, hijackings of trucks, etc. But a large fraction of the dealings with the Mafia, Jamaican gangs, Russian mob, etc., are for market reasons, where a market need for drugs, girls, cheap cigarettes, gambling, loans, etc., is being filled by players who are outside the normal legal marketplace.) >Problem is, young people who are just starting out have a no-reputation >identity, and would be treated the same as the no-reputation identities >that are used for screwing people over. Sure, newcomers always have it rough. Whether the newcomer is Nancy the Nym, or Eustace T. Collins, III, Esq., just starting out in a law firm, the newcomer has little positive reputation. (It varies, and the degree may mean something, just as Nancy the Nym may have some reputation capital to show.) I mentioned "postive reputation." There is a real cost in throwing out, say, 30 years of accumulated reputation capital, and this will not be done lightly by many. Thus, in a given transaction, a lot may be at stake. (I don't mean for this brief article to be an essay on the many fascinating issues surrounding reputation and reputation capital. Cf. my Cyphernomicon for much more on this topic.) >Reputations could be very hard to create, and very easy to destroy. As in real life. People can destroy their reputations by being careless. (I disagree with your implied point that the opinions of others can easily destroy a reputation. In real life, it usually takes a lot more than just bad-mouthing. Even in nym-space, the same is apparently true.) >Well-known good reputations would be powerful and fairly hard to destroy, >so it's possible that the big reputations might try to crush little >reputations in an effort to gain some sort of reputation monopoly. Maybe. Implausible as a central problem, but all things will likely happen. This happens occasionally in the real world, as when a Big Reputation (e.g., Bill Clinton) belittles and marginalizes a Small Reputation (e.g., Paula Jones). There's a vast amount of stuff to think about with reputations. I applaud Steve for doing some thinking, but I don't think he's yet uncovered anything especially unique or worrisome. As a last point, see especially the role of anonymous escrow agents. A number of years ago the example I usually used was "Ace Escrow--You Slay, We Pay," to illustrate that an anonymous escrow holder (holding untraceable e-cash deposited by the purchaser of a murder contract) could pay off a murderer who presented certain evidence, all without any of the parties having any idea whatsover whom the other parties were. The problem is then one of whether the escrow company will simply pocket the money and not pay off. First, it can be set up (I think) that the e-cash is uncashable by the escrow company...but I'm not sure this is needed. A better solution is to rely on the basic nature of escrow or bonding services: their reputation capital is much more valuable to them than anything to be gained by defecting and burning their clients. Except if they are about to retire anyway...as with the bonded courier who defects to Rio de Janeiro with a bag of diamonds....the trick is to spread the escrow money around to multiple escrow agents, and to rely on "escrow testing services" which periodically ping or test the services.... There are many issues here. I'm not advocating murder markets, just noting that they provide an easy to understand and fairly "pure" example. If it can be done with murders for hire, it can be done with nearly anything. A few years ago, many valuable ideas were contributed in this area by Dave Ross, Phil Salin, Dean Tribble, Hal Finney, and Robin Hanson. You might search for their articles. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: ArcotSign (was Re: Does security depend on hardware?)
by HyperReal-Anon 17 Dec '03

17 Dec '03

Julian, 1. Minor nit-picks should be off-line, not spammed to 3 lists. 2. Tupographical errors should not be nit-picked. 3. Spell check your grammar flames. and 4. Do what I say, not what I do. proff(a)iq.org wrote: > > > >the legitimate user has, excepting the 'remembered secret'. Or is > > >there anything wrong with my logic? > > > > Yes. There is something wrong with you logic. > > > > Bruce > > ********************************************************************** > > Bruce Schneier, President, Counterpane Systems Phone: 612-823-1098 > > There's something wrong with you grammer. ^^^^^^^ "grammer" indeed! > > Cheers, > Julian.

1 0

The Currency Site Member Update
by updates＠olsen.ch 17 Dec '03

17 Dec '03

Dear OANDA member, Updates in this edition: - Enhancement of Historical and Daily Table - Improved Personalization of the converters - Multilanguage Support for Historical and Interactive Table - OANDA co-brands Express by Infoseek *********************************************************** * This is our second edition of the Member Update. In * * the past we have received many suggestions for new * * products and services. We hope this newsletter helps * * keep you updated on the developments and new releases. * * If you do not wish to learn about additional services * * and news, please click on the following link * * mailto:updates@oanda.com?subject=nofurthernews and send * * the message without adding any text. Our goal is to * * fullfil your wishes and deliver the services you need. * *********************************************************** --------------------------------------------------------- Fast Enhanced Historical Currency Table - http://www.oanda.com/converter/cc_table Fast Enhanced Interactive Daily Table - http://www.oanda.com/converter/cc_quotes Due to the quickly increasing access to our two new products, we have adopted the fast cgi approach for both products. Furthermore the choice of output as HTML, ASCII and CSV facilitates the importing of data into spreadsheet solutions. If you do calculations with multiple currencies, you can now easily get the necessary rates into your spreadsheet. --------------------------------------------------------- Improved Personalization of converter services Description of manual editing for all converters: - http://www.oanda.com/site/personalize.shtml Interactive Interface: - http://www.oanda.com/converter/classic?do=pref Taken into consideration all the suggestions we have received, we now offer many personalization possibilities for all our converters including the customized versions. You can now select a personal list of currencies or, if you prefer, you keep the whole list, but your most needed currencies always appear on top of the menu. Therefore you can generate converters personalized to your needs of currency information. --------------------------------------------------------- Multilanguage support for the Historical Currency Table and the Interactive Daily Table: German - http://www.oanda.com/converter/cc_table?lang=de - http://www.oanda.com/converter/cc_quotes?lang=de French: - http://www.oanda.com/converter/cc_table?lang=fr - http://www.oanda.com/converter/cc_quotes?lang=fr Italian: - http://www.oanda.com/converter/cc_table?lang=it - http://www.oanda.com/converter/cc_quotes?lang=it To serve the needs of our international customers better, we are constantly expanding our language choices. We have just recently extended the support of French, Italian and German to our new products - the Historical Currency Table and the Interactive Daily Table. --------------------------------------------------------- OANDA co-brands Express by Infoseek http://express.infoseek.com/dve/download_express.phtml?dve_id=143 Announced on September 22,Express by Infoseek is a next-generation desktop search product which brings multiple search and information sources together in one place. With Express you can find, explore, and do anything on the Internet faster and easier. OANDA is among the first round co-distributors of this new product, along with USA Today, DejaNews, PC World, and others. To download the free co-branded Express by Infoseek, just click on the link above, or click on the Express logo at the top left of the OANDA home page. --------------------------------------------------------- OANDA Statistics Spotlight: Over 3000 sites are now using a customized version of our Classic Currency Converter or Cheat Sheet for Travelers. ---------------------------------------------------------- Thank you for using the OANDA services. Best regards, The OANDA team updates(a)oanda.com http://www.oanda.com

1 0

Re: Past one terabit/second on fiber[PHONE GEEK TALK]
by Bill Stewart 17 Dec '03

17 Dec '03

>>> "Wow", I said. Far faster than the 2.5 Gb/sec transmission that is >>> currently fairly standard for long-haul fiber trunks. >>The ads say they are selling it - that doesn't mean shipping it... yet >>at least. (Note that my employer is a direct competitor of Lucent >>so I have a vested interest in setting the facts straight) No comment :-) And I certainly don't presume to speak for Lucent.... Traditional fiber-optic technology is a hybrid between electrical and optical components - big hulking multiplexers feed a high-speed electrical signal to a laser, which sends optical pulses down the fiber. Every N km, a regenerator reads the photons, decides if it saw a 0 or 1, and feeds that as an electrical signal to an output laser. Repeat as needed. The means that if you want to upgrade the signal speed, you not only need to replace the muxes and lasers, you need to replace all the regens. That's more of a problem for long-distance companies than locals (the common FT Series G 1.7 Gb system uses them every 40 km.) The new optical amplifiers not only go farther (e.g. 120 km), but they do everything optically instead of dropping down to electrical so they support a wide range of data speeds. I don't know that they can support the 1Tb experimental stuff, but they work fine for the 8-color x 2.5Gb Dense Wavelength Division Multiplexing stuff AT&T will be using. This means that the first time you do an upgrade, you need to rip out a bunch of regens, splice around 2/3 of them, replace 1/3 with opamps, and optionally replace the equipment at the ends with even bigger hulkinger multiplexers. Depending on capacity needs, you may not fire up all 8 colors at once. The next time you want to upgrade the same route, replace the muxes if you didn't, or fire up more colors, or upgrade to the new Year 2005 model. And since you've got to pick _some_ framing technology, it might as well be SONET, which lets you build self-healing rings if you want (the FDDI-like configuration, which not everyone uses, burns half the capacity on restoration circuits, more than some of the less-healable SONET configurations or mux-based restoration like AT&T's FASTAR.) AT&T has announced that they'll be pouring lots of capital into this over the next few years, partly to keep up with demand, and partly to deploy SONET rings for faster restoration. >I was figuring they'd cut out silences...as well as echo-suppression >cutouts. Do they still do this? Given modern fiber's capacity, I wonder >if they bother. Voice compression and silence suppression aren't done domestically (at least by most carriers.) Undersea cables still use this, though I don't know how much it's done on the newer fiber cables. Of course, people running private networks do whatever they want, and for overseas connections, people are often willing to trade lower-voice-quality compression for the cost savings, especially if the PTT on the far end is expensive. >>I don't know that any number fiber cable is "standard" but >>36-fiber cable is not unusual. To find the capacity of a cable, you >>have to cut the number of fibers in half (as you did) because >>generally each fiber is used only for a single direction of traffic. >>You then have to cut it in half again because phone companies have >>everything redundant. A fairly common configuration for FT Series G is 8 fiber pairs (one fiber for each direction), with 7 in service and 1 protection pair to recover from mux-card and regen failures and other single-fiber hits. To restore whole-bundle hits (e.g. backhoe fade), some of the 7 pairs are typically dedicated to restoration - though seldom half. The restoration pairs are often used for short-time reserved applications such as TV connections for sports events, videoconferencing, or other applications where someone needs a lot of bandwidth for a short time and is willing to be pre-empted or blocked if there's a failure. >There's also a lot of 'dark fiber' out there, right? Fiber laid as >part of a cable but not activated, because it's not yet needed. That's _highly_ location and company dependent. Long-haul connections are likely to be used efficiently, because you can get economies of scale and because growth will fill them up (e.g. across the Rockies). Short-haul connections (e.g. around town) are more likely to have dark fiber because the big costs are digging up streets and paying for government officials\\\\\\\\ licenses and permits rather than the costs of the fiber you're putting in a trench once you dig it. And the short-haul doesn't need regens, and often uses lower bandwidth than the fiber can handle (OC3 muxes are much cheaper than OC48, though per-Mbps they cost more.) And of course, _everybody_ seems to want a T3 to the Bay Area or other Internet-heavy locations. >> I would add that much of a >>phone companies cost is in billing and customer service, etc. >>Not the cost of installing and maintaining the fiber and equipement. > >This suggests that there would be a market for a LD phone company that >charged, say, a yearly payment of $200-300 for essentially unlimited use. (The main >impediment to this would be regulatory; as I understand it LD companies have >to pay local telco's for connections on a per-minute connect basis. Is that >right? This needs to get fixed.) Their billing costs would be very small. There's a lot of cost in switching equipment as well. A feature-rich voice telecom switch costs _far_ more per 64kbps voice circuit than the 1/(24*28*36=24192) fraction of a fiber that carries it. And big muxes, while cheaper than voice switches, are still expensive. >>Internet telephony should make the use of bandwidth even more >>efficient - thereby cutting costs. The big guys who own >>the fibers will still make money - the pipes that carry internet >>traffic are still needed. But the little guys will get squeezed out. >>(until they become ISPs ;-). Internet traffic could theoretically >>be carried over this large amount of protection fiber (mentioned above) >>that is out there for a much lower marginal cost than the current >>T3 or OC3 pipes that are being used. In addition to Internet telephony, ATM switch makers are doing voice compression, and some of the fiber vendors are starting to use their equipment to offer business voice services. And voice-over-frame-relay, which has more delay and therefore doesn't handle voice as well, also is getting some market, especially internationally. Pricing is a really difficult problem - if you price bandwidth proportional to the 64kbps voice circuits, it's either too expensive for most businesses to buy much or priced too low to make money on switched voice. But if you price high-speed circuit bandwidth much cheaper than proportional, it becomes cost-effective to buy customer-premises equipment and bulk bits and run your own phone services. Phone companies have been worrying about this for video services for years, but fortunately Moore's Law and research have let compression improve enough that you can run cheap video on 2*64kbps and good video on 6*64kbps, so they haven't been killed. But Internet and similar data needs are starting to demand high bandwidth at low costs, and the market will have to catch up somehow. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: found nym-differentiation! Still need perpetual motion, FTL travel, cold fusion
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Bryce wrote: > > "Perry Metzger" <perry(a)piermont.com> is alleged to have written: > (> Bryce wrote:) > > > > Simple as pie, because of some of the properties of DC-Nets. > > > If someone sends out the wrong number of pubkeys, then > > > everyone will know, right? So when that happens everyone > > > just reveals their shared-secret data from the DC-Net > > > session. > > > > And if several people lie about their shared secrets? This is what secure bit-commitment is for. The refinements to the DC-net protocol since Chaum's original paper make this a non-issue if you are willing to spend the CPU cycles to do all of the necessary work. > If some of your N participants are going to collude to share > their nyms then it is manifestly impossible to stop them. > But that doesn't bother me. The purpose of this scheme is > to create N nyms for N people and be sure that each of then > N people who wanted a nym got one. If you are sure that > each of the N people wanted a nym, then you can be sure you > have a one-to-one mapping between people and nyms, but > unconditional untraceability from nyms to people. Or, to rephrase the question in a manner which my lead you to the solutions which already exists for this problem: You have an anonymous access channel in which you need to do frame reservation such that each member can reserve one and only one frame for the transmission phase which follows frame reservation. You are both talking about disrupter detection in an anonymous channel and it has already been solved... > But perhaps what you were talking about was a > denial-of-service attack on the DC-Net's network layer. > That has been addressed extensively in Chaum's original > "Dining Cryptographers" paper. Chaum's method for dealing > with denial-of-service attacks is typically brilliant, but > even so it is an unwieldly and expensive (in terms of > computation and bandwidth) proposition. I recommend "Dining > Cryptographers" to everyone, and I hope that someone who > reads it will come up with a better solution. They already have. Actually, the trap method in Chaum's original paper is both expensive and flawed. Get a copy of EuroCrypt 89 and read the DC nets papers in there by B. den Bos and by Michael Waidner. If you are in the Bay Area I have a copy of Pfitzmann and Waidner's "Dining Cryptographers in the Disco: Unconditional Sender and Recipient Anonymity with Computational Serviceability" which I would be happy to make copies of. This is probably the most comprehensively secure DC-net scheme I am aware of; although, like most Crypto papers, it is way more complicated and computationally expensive than necessary for real life. jim

1 0

Re: UPSs
by StanSquncr 17 Dec '03

17 Dec '03

In a message dated 98-03-20 19:13:07 EST, shadow(a)tfs.net writes: << some protection is better than none. my roommate and I have our computers in the same room off of the same outlet but my computer has an UPS and his does not. During a storm, lightning hit near the apartment building and it took out his computer but not mine. But I do have a friend who lost his computer to a direct strike to the power lines and it took out the surge strip as well. At least in my case, it was not a direct strike into the power lines but what happened to my roommate made him get an UPS to at least have some protection next time. At least he will not have to possibly shell out another $1,500 for another computer. >> I cannot argue against 'some is better than none' (or, if you're adding onto your existing internal power supply, 'more is better than some'). BUT, of all things, when lightning strikes close to me, it takes out my modem, nothing else. (and it's happened more than once (and they say it doesn't ever strike in the same place twice! ;-) )) Stan

2 1

Re: "Too cheap to meter"
by Deranged Mutant 17 Dec '03

17 Dec '03

On 17 May 96 at 18:54, Timothy C. May wrote: [..] > Alan's irony is well-placed. The most egregious repetition of the "too > cheap to meter" nonsense is George Gilder's "dark fiber" vision...a vision > of "infinite bandwidth" to all users. > > Guess what? If Gilder's "dark fiber" is ever built, there are a lot of > folks who will "fill it" rather quickly. Canter and Siegel were just the > beginning. "Too cheap to meter" goes away pretty quickly. Remember not-so-many-years-ago when 640k PCs were awsome and a 40MB HD was unfillable? A better phrase is "if you build it, they will fill it (eventually)". Rob. --- No-frills sig. Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

NYT on Netscape Flaw
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, May 18, 1996, pp. 31, 43. New Netscape Software Flaw Is Discovered By John Markoff Computer science researchers at Princeton University said yesterday that they had discovered a new and potentially serious flaw in the Netscape Communicatlons Corporation's Navigator software, the leading program used to browse the World Wide Web of the Internet. The flaw, which was found in recent versions of the Netscape software that support Sun Microsystems' Java programming language, could allow people to write destructive or malicious programs and potentially destroy or steal data or otherwise tamper with a computer that was connected to the Internet and used the Navigator program. Netscape executives said that the researchers had been in touch with them about the problem on Thursday and that the software company was in the process of producing a new version of the Navigator program that would protect against potential attacks. This is the third flaw in the Navigator program discovered in recent months by the Princeton group. Netscape has been under tremendous scrutiny over the security of its popular software since the fall, when a group of researchers at the University of California at Berkeley discovered a flaw in the Netscape security system. In the most recent case, Thomas Cargill, an independent software consultant working with the Princeton group, discovered a problem in the way Netscape has used the Java language in its Navigator program. The group disclosed a similar flaw in March in the Netscape Navigator that would permit a Java program to run illicitly on a computer that was running the Netscape program and perform damaging operations. "Netscape has fixed a series of problems, and the overall security of their system has improved, but there is still some reason for concern," said Prof. Edward Felton, the leader of the Princeton group, which includes two graduate students, Drew Dean and Dean Wallach. Programs that are known as viruses and worms are a serious threat to computer networks because they can move from machine to machine quickly, carrying out destructive applications. Sun Microsystems' Java language has been designed to limit what a virus can do once it is transferred across the Internet. But the security mechanisms only work if the virus's code can be restricted in a safety "box" constructed out of software. Netscape's executives acknowledged yesterday that the Princeton University team had on both occasions been able to find doors that let program code out of the safety box. "We're trying to create a sandbox which has rooms where only certain things happen," said Jeff Trehaft, Netscape's director of security. "What happened is that the Princeton team found a door and it turned out that there weren't adequate protections surrounding the door." The company said it was in the process of posting on the Internet a new version of the most recent test version of its next-generation Internet program, version 3.0 beta. The program contains a special fix to prevent the new attack. He said Netscape had not yet posted a fix for the most recent commercial release of its software, version 2.02, but was instead encouraging customers to use the 3.0 beta software. Since the Berkeley researchers discovered the first security flaw the company has offered a $1,000 "bugs bounty" to programmers who are able to locate security flaws. [End]

1 0