- cypherpunks-legacy - lists.cpunks.org

Re: Homer on Terrorism
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Tom Weinstein wrote: > Tim May wrote: > > Tom Weinstein wrote: > >> Tim May wrote: > > > >>> (What the Danes offered was a straight buiness deal, albeit made > >>> weirder and more frantic by the constraints of time, publicity, and > >>> worldwide attention. Still a business deal, though.) > what he said > was something like: > "Pay me lots of money or I will go to the press in such a way as to > damage you the most." > > That is blackmail. It's clear that the money is to prevent the damage, > not just for the information. This happens every day in major-league business ballparks. Information --> is power is --> money. Usually the word "blackmail" surfaces when one company takes a shit-kicking from the other company. Methinks the reason the word "blackmail" so easily springs to the lips of Netscape exec's is that they know they got caught with their pants down. They designed their code so that they or John Law could put their dicks in our hard drives and wiggle them around and now they are accusing the guy who has "pictures" of their guilt of doing something dirty. Although Netscape is claiming the "high ground" by saying they don't pay "blackmail," I think it is much more likely that they didn't need to *pay* for the information because they already *knew* exactly what the other company had discovered. Netscape calls their upcoming patch a "bug fix" when, in reality, it is the disabling of a "secret feature." Thus I wouldn't be too quick to accept their definition of "blackmail." > > Browsers are big business, and high stakes poker. It's not surprising > > to me to see this kind of bluffing and "terorrism" (to quote Homer, > > with his rosy-fingered typing). What's surprising is that it hasn't > > happened more often, or at least hasn't gotten as much publicity. It probably doesn't get reported very often because a company usually doesn't have foreknowledge of the problem (i.e. it is a genuine "bug" in their product) and thus it is in their best interest to pay to find out the specifics of the problem. When you're innocent of wrongdoing, it's called a business negotiation. When you're guilty of wrongdoing, its called blackmail? So if Tom Weinstein calls it blackmail, then I guess that pretty much indicates Netscape's position in regard to their browser's ability to be used to compromise the user's privacy and security. TruthMonger

1 0

How tO MutAte anD TaKE OVer tHe WOrld
by luciana luciana 17 Dec '03

17 Dec '03

I'm very interested on that. could u let me know anything else? ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1

Govt seeking emergency stay in Bernstein case
by John Gilmore 17 Dec '03

17 Dec '03

Date: Wed, 27 Aug 1997 13:43:36 -0700 From: Cindy Cohn <Cindy(a)mcglashan.com> Hi all, Just talked to Mr. Coppolino at the Justice Department. They are filing ex parte emergency stay papers tonight or tomorrow morning to try to stay the impact of Judge Patel's ruling pending appeal. He'll be faxing me the documents when they are ready. He said yesterday that they would seek to stay the "export" of crypto source code, although not the teaching or discussion (whatever that means). Cindy A. Cohn [Update: We received the faxed papers about 8PM; images of them will be in a sub-directory of http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/ on Thursday morning. The Bernstein team is opposing their motion; our filing will also be on the Web site. It was reported by C|Net that the government is "appealing"; this is not true. They are asking that Judge Patel to "stay" her own ruling -- hold it in abeyance -- to prevent Prof. Bernstein from exercising his First Amendment rights before they can appeal. But they have not filed an appeal, or formally indicated their intent to do so. --gnu]

1 0

2nd New Netscape Bug Reported
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

[Routers--Moose Jaw, Saskatchewan] June 17, 1997 Bellgate or Bill Gates? by Declan McCypherpunk A wanna-be programmer in this small Canadian town stumbled upon an undocumented feature in the Netscape browser which allows the user to place a bet on the date of death of computer magnate Bill Gates. While early reports are sketchy, it appears that the scheme involves Tom Weinstein, Ed McMahon and the cypherpunks remailer system. When approached by Kookie Roberts for comment, Tom Weinstein loudly proclaimed, "I don't even know Jim Bell, honest." When Kookie Roberts asked Weinstein who the hell Jim Bell was, he quickly muttered, "Never mind..." Ed McMahon would only say that on September 4th, some lucky winner would be receiving an anonymous digicash transaction from him. When pressed for details about the date, McMahon's face flushed a bright red and he quickly exited the scene, accompanied by men with Italian names, and a former CIA PR representative explained that what McMahon "meant to say" was "no comment." Unsubtatiated rumors also indicate that if the netscape.exe file is printed out as a .gif file, that it pictures a layout of Microsoft Corporate headquarters and the Gates estate. When asked for a response to the announcement of the new revelations a Microsoft spokesperson cryptically replied, "Anyone who bet on Bill Gates dying on September 4th ain't gonna win shit." When pressed as to whether he personally used the Netscape browser, the MS spokesperson only grinned and winked.

1 0

Key Ass-crow
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Paul Bradley wrote: > > Can someone explain the difference between key recovery and key > > escrow? > Key escrow is where your keys are held by one or more trusted and > supposedly independent third parties, on reciept of a court order they > would release the keys. Kind of like trusting a friend not to bugger you while you are drunk and passed out. (But he can't prevent the police from hauling you in for public intoxication and locking you up with someone who might do so.) > But in the end it all comes down to GAK (government access to keys), same > shit, different name. This is much like having a Dominatrix who chains you to the toilet and brings out a mixed bag of utensils and instruments which are about to be used for purposes that are a far cry from what they were created for, and to access areas that Nature never intended to be subjected to large amounts of sunshine. Perhaps someone should come out with a GAK T-shirt which has a citizen "assuming the position" while a GAK cop stands behind him with a crowbar stuck halfway up the citizen's ass, and saying, "If you don't have anything to hide, then you have nothing to worry about." AssMonger

2 1

Kerrey bill introduced in Senate (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Forwarded message: > Date: Tue, 17 Jun 1997 19:09:09 -0400 > From: Robert Hettinga <rah(a)shipwright.com> > Subject: Kerrey bill introduced in Senate > Sen. Kerrey's evil "Secure Public Networks Act" was introduced in the > Senate today, cosponsored by Sen. McCain. > > The bill, if passed, would: > > Criminalize breaking another person's ciphertext for the purpose of > violating their privacy, security, or property rights; (goodbye, Netscape > bugs bounty and DES/RC4 cracks) (s. 105(3)) Actualy it would prevent me from cracking your ciphertext, it does not prevent me from trying to crack my own ciphertext. Since I am supplying the plaintext it is clear that I can continue to test Netscape or any other algorithm. It also implies, by specificaly mentioning privacy, that you can give me permission to attempt to crack your ciphertext. It, intentionaly or not, give you the individual the choice and not Uncle Sam. > Criminalize intercepting another's intellectual property for the purpose of > violating intellectual property rights (s. 105(4)) I have absolutely no problem with making it illegal for you to packet sniff my network when your specific goal is to take internal information against my will and use it against me. I think this is the kind of law that needs to be made. I would however suspect that existing law covers this quite thoroughly. > Require federal government purchasers of crypto equipment to buy GAK > crypto; (s. 202, 204) The federal government can require whatever the hell it wants of itself. I don't work for them anymore and would not consider it in the future. When they start telling me that I have to do something for their convenience, then and there I have a major bitch. > Require crypto products purchased with federal funds for use on a public > network to employ GAK crypto; (s. 203, 205) See above. > Legalize the export of 56-bit DES crypto; (s. 302) Ain't much, but it is a step in the right direction. I mean, 64-bit ain't that far from 56, and shoot if your gonna give me 64 how about 128 since it is ONLY twice as 'large'. > Criminalizes the issuance of signature certificates by registered CA's for > encryption keys if the user has not complied with GAK procedures; (s. > 407(a)(4)) When did they pass a law requiring registration of CA's in the first place? Or is this another law that only applies to voluntarily registered government CA's? And just exactly what is the ANSI/ISO standard of said registrant? RFC? > Criminalizes requesting a signature certificate for an encryption key from > a registered CA if the user has not complied with GAK procedures; (s. > 407(a)(5)) I don't understand this. Is the person asking committing the crime for asking for a signature certificate without complying with GAK processes? Or is the person refusing to register their key with a CA after the CA received a request from a third party? > Allows the Secretary of Commerce to "make investigations, obtain > information, take sworn testimony, and require reports or the keeping of > records by .. any person", to the extent necessary to enforce the Act; (s. > 701(a)) Are you saying they must require everyone in a particular business class to comply with their regulatory mechanations without exception OR that they will be able to force such regulatory excesses as they can squeeze out of an individual person/business? > Allows the Secretary of Commerce to subpoena witnesses and documents in any > State at any designated place; (s. 701(b)(3)(A)) Their enforcement agents already have this power since they are considered federal agents equivalent to DEA or FBI (Hint: NEVER argue with a guy wearing NOAA, NASA, USGS, DoA, etc. *AND* a badge). > Allows the Secretary of Commerce to impose civil/adminstrative penalties of > up to $100K for violations of the Act; (s. 702(1)) Without trial? ____________________________________________________________________ | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Bernstein decision: image files upgraded
by John Gilmore 17 Dec '03

17 Dec '03

If you couldn't read the decision because the original image files were too fuzzy, try them now. They're wider and longer, and a lot easier to read. They're almost as small as the previous ones, because we encoded them better. We're still working on scanning it in to plain text. http://www.eff.org/pub/Legal/Cases/Bernstein_v_DoS/Legal/970825_decision.im… John Gilmore

1 0

Netscape Bug Reproduced
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Subject: Netscape privacy problem reproduced at EIFIST Date: 6/16/97 5:34 PM Netscape privacy problem: Using information gleaned from the web site of the Danish company that first reported the problem, Keith Woodard and Dave Humphrey at EIFIST have built a web page which reproduces the privacy problem in Netscape Navigator and Communicator web browsers. From that effort they have developed a better understanding of how the Netscape bug works, and what defensive measures users can take until a bugfix is available from Netscape. First, the problem is indeed read-only, and involves only files to which the explicit path name is known. Second, all file systems accessible from the Netscape user's system are reachable -- that means mapped network drives as well as the local hard disk. Third, JavaScript can be used by a web site to automate reading a user's file so that it is invisible to the user. However, the bug does not involve use of Java at all. The demo website can be visited at the following URL: http://eifist.frb.org/hacker/fileupload.html Please urge all Internet web users to take the following interim steps until a permanent fix is available from Netscape: * In Navigator 3.x and 2.x, go to the Options menu and select Security Preferences. Select the "Submitting a Form Insecurely" preference to enable that warning dialog box. This will generate a warning box whenever a site tries to upload a form, giving the user a chance to decide whether to allow it. * Also, in Navigator 3.x and 2.x, go to the Options menu and select Network Preferences. Turn OFF the "Enable JavaScript" preference. This will block execution of JavaScript code which might try to perform an invisible file upload, while permitting display of the rest of the page. These measures are temporary until a full bug fix is made available by Netscape and proven against the EIFIST demo page. Regards

1 0

Re: [IMPORTANT] Accounts payable
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timmy C. May styles his facial hair to look more like pubic hair. .oooO Oooo. ( ) _ _ ( ) \ ( / ) ( \ ) / ----\_)-/ (---) \-(_/---- Timmy C. May ( ) ( ) oooO Oooo

2 1

Re: Homer on Terrorism
by John Young 17 Dec '03

17 Dec '03

Steve Schear wrote: >I agree. It seems a bit like blackmail to me. These 'consultants' would >have better off having friends buy put options on Netscape stock prior to >the phone call. Then if Netscape won't pay their price they get the money >from the market when they make the information public, including the source >code. Spare me the insider trading rants. Good point. Perhaps CNNfn and PC Rag insiders did just that. Maybe even got a few for CaboComm's account. Maybe the insiders at NSCP dumped a few after the negotiations tanked. Screaming "terrorism" for smoke. Isn't it conventional wisdom that the market is churned with with blackmail, greenmail, "terrorist" slaughter of W&O and such, laying down "free market" smoke. Story from Federal pen here is that the WTC bomb aimed to topple the pile onto World Financial Center across the road where the plushest players squat on gold but job-lock TLAs running the op said no-no, just terrify the fats into upping our CT-consulting fees and budgets, like IRA @ London City. Inmate Ian was heard to warn, "Worked like a charm, din it: now shut your hole Youseff about that salted laptop fabbed up St Andrews, Great Malvern."

1 0