- cypherpunks-legacy - lists.cpunks.org

Re: Pepsi World - Gotta Have It!
by geeman＠best.com 17 Dec '03

17 Dec '03

hoax, I presume? At 06:46 PM 3/20/96 -0600, you wrote: >Hey Squatter! > >Don't forget to cruise back by Pepsi World! > > >We're gonna keep showing ya the coolest, hippest stuff out there, including: > >- Shaq/Pepsi World's Slammin' Techno Dream Contest >- The Bev-o-Matic Contest >- An exciting, original Shockwave game >- Chat Rooms >- And basically, more entertainment than you can shake a stick at! > > > >Don't forget your squatter id 'cypherpunk' and password >'cypherpunk', you'll need them to maintain your Squatter's >rights in Pepsi World. > >

1 0

Re: Crypto CD UpDate
by Henry Huang 17 Dec '03

17 Dec '03

On Mar 26, 21:18, Timothy C. May wrote: > At 10:16 PM 3/26/96, aba(a)atlas.ex.ac.uk wrote: > >The idea of putting together a CD with crypto stuff is an excellent > >IDEA, and one which I very much welcome. > > > >However a question .. are you (Ben) located in the US? If so... > > > >that rules out overseas buyers unless you fancy messing with ITAR... > >Is it possible that you could come to some arrangement with some one > >outside the ITAR fence who has a CD writer (any one reading have one?) > >put together the same CD for those outside the US? ITAR is going to be a mess either way. If the CD is put together outside the U.S., you'd have to only use non-U.S. executables/source (or else put site owners at risk of violating the anti-export language in the ITAR). Of course, a lot of people don't take this seriously, so pick your poison ... > 1. The CD-ROM "freezes" the various programs, archives, etc. at the moment > the files are finalized and the CD-ROMs are pressed (or burned individually > on a CD-R, at somewhat higher per-copy price). If the author of the CD-ROM > is not committed to updating the CD-ROM at frequent intervals--say, every > few months--then the programs will exhibit "version decay" and be nearly > useless. > The next point is the reason. > > 2. The Web does a better job at making the latest versions instantly > accessible. True, a CD-ROM will generally have faster access, but I care > more about getting the _latest_ version of PGP, even if takes a minute or > two to snarf off the Web. That I could get an _older_ version of PGP in > fractions of a second off this CD-ROM is not compelling to me. I'd argue that having a slightly out-of-date CD-ROM is better than nothing, because: - It gives you an idea of what sorts of crypto applications are out there, - It gives you working versions of programs without having to crawl all over the Net hunting for one, - If the authors are smart they'll include URL's to an update site in the documentation (or the CD-ROM producer can do it), - Not everyone out there is Net-savvy, or has the time to go trudging around looking for the latest cutting-edge versions of software. Time *IS* money. I'd almost argue that Tim's emphasis on using the Web to get crypto assumes a sort of Net-centric view of how the crypto is going to be used -- similar to reported provisions in the Leahy bill. The idea that people who just want to encrypt personal data might not need the latest versions of everything out there is reasonable -- as long as the latest versions aren't BUG FIXES. In that case, Tim's argument about stale versions would carry some merit. But this is the case for ALL non-Net distributed software; you don't see companies refusing to cut CD-ROMs simply because they're worried their users won't be able to get the latest bug fixes. In the ideal case, they'd do the best they can to make sure that people did, but you have to be realistic. (Of course, if you're cynical, and believe that software companies care more about money than about helping their customers, then it doesn't matter. ;) > (And fractions of a second is too charitable: in actuality, I'd have > to locate the CD-ROM, dismount anything already mounted, mount the > CD-ROM, search it for "PGP," etc. Probably not even faster than > using Alta Vista and downloading.) Um, whatever. If you have a CD-ROM, you'll at least have SOME idea of what software is available on it. Not so with the Web (unless somebody wants to do the equivalent of this CD-ROM and put together a page with a HUGE number of links to crypto programs -- not to mention the protections necessary to avoid violating ITAR, e.g. the anti-export measures built into the PGP distribution site) Plus, comparing the speed of a CD-ROM to a modem is like comparing the speed of a station wagon to a skateboard. CD-ROMs aren't exactly fast, but they sure as hell aren't anywhere near as slow as the water-torture speeds of your average v.42bis modem. > 3. Where CD-ROMs really shine over modem alternatives is, of course, for > very large files. Images, MPEG or Quicktime movies, etc. "Multimedia" being > the operative term. For crypto, this is not an issue. (Except for list > archives, where having a few hundred megabytes of articles might be nice. > However, the absolute KILLER of this idea is the staleness problem mentione > in Point #1: if the archives on CD-ROM lack the most recent month or two, > their usefullness drops precipitously. If the CD-ROM is a year old, and no > updates have appeared, then its archives are useful only to list > historians. I don't buy this. Many of the well-known/widely-used Net-distributed crypto apps haven't put out updates for a LONG time. Even if it was the case that they were throwing out bug fixes every two weeks, my previous comments still hold. (And anyhow, you probably wouldn't WANT to have software THAT unstable in your collection anyway. ;) I'm starting to think that the question of whether this CD-ROM is useful depends on who you're selling it to. People who hang out on Coderpunks, or are "in the loop" as to version updates and crypto sites won't want this. People who want to buy the CD just to be "cool" aren't an issue. The SOHO market (i.e. people who don't normally use the Net, and who ordinarily wouldn't care too much about crypto) seems to be the ideal target. But how do you sell a piece of software to an audience that doesn't know it needs it? Perhaps this could be a chance to spread the gospel, so to speak. However, that would mean the CD would have to be designed around these people -- i.e. for ease of use, etc. These issues have probably been beaten to death a long time ago (e.g. PGP shells), and shouldn't be too difficult to resolve. The multi-platform stuff (DOS/Mac/**IX on one disc) will be harder; you'll need to code a different interface to the CD for each platform. > (In other words, I will almost always go to up-to-date archives on a Web > site rather than dusting off a CD-ROM that was issued several months ago. As would I. But we're "in the loop". Many people aren't. And the real issue being addressed here (getting easy-to-digest crypto to the masses) is a lot more difficult than just pressing a CD-ROM. Ben may need to rethink his strategy on this, in terms of how to most effectively promote this CD to that market. > 4. The Web approach allows powerful search engines, links from other pages, > and--importantly--multiple jurisdictions. The PGP could come from the U.S., > the Digital Postage code from Sweden, and so on. And, again as noted in # > 1, the developers could keep improving and iterating the code. Hmm, do I hear a volunteer for writing that Crypto Software Web page? ;) -H

2 1

Zimmermann v. ViaCrypt???
by Mark Voorhees 17 Dec '03

17 Dec '03

Read http://infolawalert.com/stories/051796a.html for a story on how Phil Zimmermann is trying to retrieve all the rights to PGP from ViaCrypt in order to jump start his new venture, PGP, Inc. He's taking a sell out or get sued approach with ViaCrypt, which until recently has not had much success marketing PGP. Mark PS--Apologies in advance if this has been posted before.

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

In doing a search on the "RELIGIOUS FREEDOM AMENDMENT", Lycos popped over 2000 hits. In checking out several sites, this one seemed the most rational in discussing the issue. http://www.religioustolerance.org/const_am.htm

1 0

Feds bust Inet gambling
by David Honig 17 Dec '03

17 Dec '03

All parties were consenting but the Fed doesn't like it. First the virtual betting parlors. Then the virtual banks and cryptocash. http://dailynews.yahoo.com/headlines/technology/wired/story.html?s=n/reuters /980304/wired/stories/gambling_1.html Wednesday March 4 4:56 PM EST U.S. authorities launch Internet gambling crackdown NEW YORK (Reuters) - U.S. federal authorities charged 14 people on Wednesday with running gambling sites on the Internet in violation of federal laws. In complaints unsealed in Manhattan Federal Court, the U.S. Attorney's office charged the 14 with using Internet Web sites and telephone lines to bet on U.S. football, basketball, hockey and baseball games, charging a 10 percent commission per bet. At least some of the defendants were scheduled to appear before a U.S. magistrate judge later on Wednesday. The defendants were charged with using Internet sites to open bettor accounts, usually with a minimum deposit of $500, and then accepting bets on games and game score spreads and maintaining accounts for clients. Client funds were directed to banks or addresses in such offshore locations as Antigua, Curacao, Costa Rica and Panama, where betting is legal. But the complaints alleged that the six operations conducted much of their business within U.S. borders. One defendant, Steven Budin, 27, of SDB Global (www.sdbg.com) said his business used the Internet only for marketing, not to take bets. "We don't take wagers over the Internet," he said. ------------------------------------------------------------ David Honig Orbit Technology honig(a)otc.net Intaanetto Jigyoubu "But if we have to use force, it is because we are America; we are the indispensable nation." ---Secretary of State Madeleine K. Albright http://www.jya.com/see-far.htm

2 1

Re: So, what crypto legislation (if any) is necessary?
by shabbir＠vtw.org 17 Dec '03

17 Dec '03

I think this is a very important area to consider, and I thank Tim for putting his thoughts into this very organized form. My replies: Timothy C. May writes: >>If the Leahy bill is unacceptable, what legistlation is necessary? I >>can't see how the use of cryptography in the commission of a crime needs >>to be a separate offence, but I could see how it could be treated as a >>special circumstance - that doesn't really needed a new law though. > >I don't see any compelling need for U.S. legislation. And given the >pressures to attach all sorts of language to bills, I think it best that no >legislation happen. Unfortunately, this is not an option. Legislation will happen, with our endorsement or without it. One good example is the Grassley computer crime bill earlier in 1995. Nobody advised him on this, as far as I can tell, he just went out and drafted it. Lo and behold, he drafted a provision that basically criminalized all crypto, including rot13. We have to wake up and learn from the fight against the net censorship legislation. This is realpolitik. Congress will legislate crypto, whether we want them to or not. This is not news anyone wants to hear, but we have to face up to it. >* DOMESTIC USE OF ENCRYPTION: Currently, no restrictions whatsoever. No >laws saying messages can't be encrypted, no laws saying keys must be >escrowed, no laws about permissable strength of ciphers, no special laws >covering disclosure of keys. Just silence, blessed silence. The >Constitution says there shall be no laws about permissable speech (what >language one speaks in, or writes in), and other provisions about compelled >testimony seem adequate. Congress has discovered the net, and partly though the widespread fame of this list, they have also discovered crypto. Simply saying, "we don't want any laws that address crypto" may be the ideal solution, but that won't stop them from passing laws that govern the domestic use of crypto. >* EXPORT OF CRYPTO BEYOND U.S.: This is indeed a thorn in the sides of U.S. >companies, but is not _per se_ an issue I worry about. So long as I have >strong crypto, I don't really care too much about export. It would be nice >to get the ITARs modified, but not at the risk of adding language (such as >Leahy did) making use of encryption a possible crime (we've debated this, >so I won't elaborate here). Besides, I think the best way to overturn the >ITARs is through a court challenge; as I have noted, even the NSA's lawyers >felt that the ITARs would not withstand court scrutiny. Unfortunately, many U.S. software companies don't agree with you. While I agree with you (I've got PGP, what's the problem?), several of these companies are working through their trade organizations to introduce and push crypto legislation to allow them to raise the key length in their products. Put ourselves in their shoes for a minute. They're sitting there, with their 40 bit products, knowing that it blows chunks. They want to produce stronger crypto, but know they won't be able to export it. They talk to the company's attorneys, who speak to speak to the lobbyists, and poof, a crypto bill. >* KEY ESCROW: A matter of contract law, nothing more. If I want to give a >copy of my key to my lawyer, fine. If I want to give a copy to Vince's >Offshore Key Repository, no current U.S. laws stops me from doing so, and I >can even get it to him securely without violating any ITARs by using the >cipher that _he_ uses and then importing it here! > >IMPORTANT NOTE: It is often said, in a correct interpretation I think, that >a third party holding a key (Joe's Key Warehouse) is _not_ covered by the >5th Amendment's protections against self-incrimination, and so must honor a >subpoena. Sounds accurate to me. However, what if Joe is _also_ one's >lawyer? Does attorney-client privilege apply here? Perhaps. A better >solution is also fully legal at this time: use only offshore key storage. A >U.S. subpoena to Vince's Offshore Key Repository will carry no weight in >Anguilla. (Can I be compelled to ask Vince to send my key? Sure. But Vince >and I could have a stipulation that such "duress requests" will not be >honored, no matter how loudly I squawk.) This is actually very important. The Leahy bill forces Joe's Key Warehouse to only divulge your key when they've been presented with a warrant that's on par with whatever they used to get your original communication. That means that Louis Freeh can't issue an administrative subpoena to get your key, after he's got a judge to allow the FBI to search your house. They have to get a judge involved for both parts. It's better than where we are today, where Joe's Key Warehouse is vulnerable to every law enforcement joker that can write an administrative subpoena. We haven't yet had an incident that demonstrates this, but we will. Of course, if you're the sort of person who thinks that the FBI and the Department of Justice are involved in a big criminal conspiracy to begin with, we shouldn't even be talking about due process, as you don't believe it exists... >In conclusion, things are fine as they are. I see no compelling need to >write a special law confirming the rights we already are enjoying. If the >Congress wants to relax the ITARs (fat chance), they can direct that the >language of specific sections be redrafted. (I'm not even sure when and how >the original language was crafted, though it is part, I believe, of the >ancient Munitions Act and/or Trading with the Enemy Act. The enabling >legislation for the ITARs, and especially for the specific items actually >ON the "Munitions List" could be trivially changed. Were this Leahy's >intent, an easy thing to write a bill for. I doubt this was his intent, >however. I think this indeed is what Leahy was aiming for. A quick glance at the bill will prove this out. The approach that "things are fine as they are" is like saying "I'm on a freight train, heading for a cliff, but they're still serving me caviar so it's OK". Sure, it feels ok, but the train's still moving, no matter how far you are into your denial. I can't say this enough: the net has moved into realpolitik. Congress has found us, and their first step is to regulate us. Then, they'll outlaw us. Let's hope we convert enough legislators to netizens before they outlaw us. -Shabbir J. Safdar co-founder, Voters Telecommunications Watch

1 0

Re: WSJ on Big Java Flaw
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <199603261814.KAA23974(a)netcom5.netcom.com>, frantz(a)netcom.com (Bill Frantz) wrote: # At 10:58 AM 3/26/96 -0500, John Young wrote: # > Java was originally touted by Sun as a secure language. But # > at least two other flaws have already been discovered in # > the technology, including a less-serious problem uncovered # > by the Princeton team last month. Sun's Ms. Mueller said # > the problems have been correctable details in the way the # > Java code is written, not problems with its basic design. Actually, I suspected and reported the same bug some weeks before the group at Princeton. <URL: http://www.aztech.net/~steve/java/~>. That said... # Having worked on a secure OS, with a small security kernel etc. etc. etc. I # realize that even those systems have bugs. The Java people will work out # their bugs. Others will read their code and find more bugs. (It is to # Sun's GREAT credit that they are releasing their source under a not very # restrictive license.) Eventually, in several years, Java security will be # ready for prime time. This is exactly what I would say. Sun has released source code for what that they label as "Beta Software." I agree with their labeling, and don't fault them for having buglets in beta software. I commend them for releasing souce code. My biggest gripe is with other companies (no names mentioned) who are shipping Java, integrated and "turned on" by default in their "production-level" products. # Of course, for really valuable things, or the really paranoid, you # shouldn't connect your computer to a network. The top dog certificate key # in SET is handled this way. Generally good advice. (SET is an "Alpha Specification" and has its own problems, that I won't go into here, but again, I commend the principals involved for allowing "outsiders" to view and comment.) I'd also add that running uncertified (by the local CA) applications is bad voodoo, and should be avoided, but that's an issue that most admins don't have much real control over in most environments. -- Steve(a)AZTech.Net [ I thought about adding a P.S., but most of you probably don't care what I do for a living, who I work for, nor what I work on, and why. Send email if you're curious. ]

1 0

Re: Crypto CD UpDate (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > It pains me to often be the one who throws cold water on what seems to be a > good idea, and what comes from a well-intentioned person. But I have to > call 'em as I see 'em. And maybe I'm wrong. But here are my thoughts. You know you love it...;) > 1. The CD-ROM "freezes" the various programs, archives, etc. at the moment > the files are finalized and the CD-ROMs are pressed (or burned individually > on a CD-R, at somewhat higher per-copy price). If the author of the CD-ROM > is not committed to updating the CD-ROM at frequent intervals--say, every > few months--then the programs will exhibit "version decay" and be nearly > useless. > The next point is the reason. I do soho consulting and I help provide several of my customers with software of various nature. One thing I have come to realize is that they are not interested in being in the fast lane. They are secure in knowing that the software behaves in a predicible way (not necessarily designed that way either). A large part of this attitude is based in their not being computer anything sorts. I find CD's a great way to keep libraries of old software that sometimes comes in handy. > 2. The Web does a better job at making the latest versions instantly > accessible. True, a CD-ROM will generally have faster access, but I care > more about getting the _latest_ version of PGP, even if takes a minute or > two to snarf off the Web. That I could get an _older_ version of PGP in > fractions of a second off this CD-ROM is not compelling to me. (And > fractions of a second is too charitable: in actuality, I'd have to locate > the CD-ROM, dismount anything already mounted, mount the CD-ROM, search it > for "PGP," etc. Probably not even faster than using Alta Vista and > downloading.) Yes, except it is much easier to track my access to the web than my CD-Rom. > 4. The Web approach allows powerful search engines, links from other pages, > and--importantly--multiple jurisdictions. The PGP could come from the U.S., > the Digital Postage code from Sweden, and so on. And, again as noted in # > 1, the developers could keep improving and iterating the code. CD's are great advertising.

1 0

Re:
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:42 AM 03/28/96 -0800, Anonymous wrote: >At 12:21 AM 3/28/96, Syed Yusuf wrote: >>If a person who speaks three languages is tri-lingual >>If a person who speaks two languages is bi-lingual >> >>What do you call a person who only speaks one language? >> >>---------------------answer follows: >> >>An American. > >Or our version: > >What do you call a person who has to learn English as a second language in order to compete in the world? > >A foreigner. > >(Sorry for the insult, but it seems that this thread is bringing out insults from foreigners of all sorts.) > >--Tim > > >Dont be sorry! > >Foreigner can atleast speak broken English. Can American speak broken foreign language? As a matter of fact, I speak broken Tagalog, broken Japanese, pidgin Korean, and and can generally make myself understood in Chinese, Thai, Vietnamese, Spanish, and French. Oh, yes, I'm also fluent in Aussie :-) Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVoK/8VrTvyYOzAZAQHrXAP/ZMOgx+VkqHXCQHBFXIdVVHzlCcJIo3L6 2LyqMnY0cJ5ZFD8mCNsBTTe2DAXFpN1WV03JFym/JIxAuL0TQuN0WKZ2HFSuk997 AZPo21whZbXVQlRGrr6JjiR8p2nqHMMBpNC2bfr2r/rny7UmnGGp8C1e6crPtrQF PiyDbd20zbM= =Swae -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

DES or RSA on a PIC
by MeRC 17 Dec '03

17 Dec '03

Does anyone have ANY code for DES or RSA encryption for use on a PIC microcontroler? A friend and I are developing an ASCII terminal (dumb term) that encrypts data going to the serial port and decrypts data coming from the serial port, so you could successfully send a message over a modem and have it automatically encrypted\decrypted. We have all the hardware almost done, but we are having a hell of a time writing the code for the encryption... Thanx in advance... l8r, -MeRC merc(a)redrose.net -or- merc(a)success.net -----BEGIN PGP MESSAGE----- Version: 2.6.2 iQCVAwUAMUC05tnn3Dsf47p5AQE6AAP9E/JebLn1UtkOk41IGw/i4XHKckVcI6RH ptBMucqx01sSTxaR8tXPmmkKjz5f3xndxepbbs6nKfoNuSaODWSirOlNvt3i1DWL iUmB9+rUYmwwlpD7t6qyy2XzsAxO/M/nFT4ZxO8wi96nR/Rmp00LvCoK+YcjgQnj HReyQrIl4X+ZAI0DMUCzOgAAAQQAv6IH+OnLeP+chsgwymSVKqsXHO1xwJLxs657 Cf3miDM3mNBB/qmRziQ1zHeC/nXgaGhR7eAdidL6MngDXl6+cw4Z5xXvenu5MpEW zpZpwDK5/XwuvCIexQP2eHIb2Ms6vna7fUoaHGrrV4844KIVg+E36ZgWT1ZP2efc Ox/junkABRGwAYe0I01pY2hhZWwgRC4gV2hpdGUgPG1lcmNAc3VjY2Vzcy5uZXQ+ sAED =ZbPJ -----END PGP MESSAGE-----

1 0