- cypherpunks-legacy - lists.cpunks.org

Please criticize PGP-based robomoderator
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Date: Fri Mar 22 21:25:47 CST 1996 To: cypherpunks(a)toad.com Subject: Please criticize PGP-based robomoderator Hello, Today UVV's announced that a new group, soc.culture.russian.moderated, was voted into existence. If all goes well, it should be newgrouped soon. For this group, I wrote a robomoderator program that does the following: 1) Enforces posting style required by the charter 2) Checks PGP signatures on incoming messages and prevents some types of forgeries 3) Implement secure (PGP-based) exchange between robomoderator program and human moderators, for messages requiring their approval 4) Black lists, white lists, and lists of suspicious words (Cypherpunks may imagine that ``medusa'' would be a suspicious word for this list) 5) Signs (with Greg Rose's PMApp) approved articles to prevent posting articles with forged approval 6) supports appeals, moderators' mailing list, and more. A specification for the robomoderator is on my home page at http://www.algebra.com/~ichudov/usenet/scrm/robomod/robomod.html and your criticisms and suggestions are more than welcome. For security reasons, we cannot post the code yet. We'll do it after I systematically proofread it to make sure that it is secure. Robomoderator is written in perl and sh, with some C code. It is working, but there are sopme minor things to do (they are listed in the TODO list on my WWW Page). Thanks to Dr. Dimitri Vulis for several good suggestions that I implemented. - Igor. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMVNx8sJFmFyXKPzRAQEgVwP+Il58rOpbWtlC0MW4tPrYEnuF9JC5OJET VhaWud9lYzMDo9sdiBBmmgPqs5n3/lPpvxuNX4oCNbooP/U7SE8iqqOlcEdRDI3d KCSS8jol+T+VQGyVg8GkNrjSzSrfBrnka/CYMCXzKPGCFKcj5QiO1ufuBlhcxNsa glTt8xf5BrY= =xUgQ -----END PGP SIGNATURE-----

1 0

Conference of Interest
by Black Unicorn 17 Dec '03

17 Dec '03

Interested Cypherpunks might wish to review the following: The U.S. Russia Business Council presents its Fourth Annual U.S.-Russian Trade and Investment Forecast '96 While at first glance not crypto related, in past this conference has brought together a fascinating combination of spooks, private sector types, TLA's and academics. The amount of access to otherwise secretive and shadowy officials and "big name" types is significant. I have found in past that everyone at the conference is fairly approachable. The networking and back room, off topic discussions are so numerous that in some ways the title of the conference is a misnomer. Though the fees are hefty, I encourage c'punks who will be in the area to consider attending. Additional information is available at (202) 739-9180. The U.S. Russia Business Council presents its Fourth Annual U.S.-Russian Trade and Investment Forecast '96 on Monday, April 1, 1996 at The Four Seasons Hotel Corcoran Ballroom 2800 Pennsylvania Avenue, NW Washington, DC 20006 Preliminary Agenda 8:00-9:00 am Registration 9:00-9:15 am Welcoming Remarks - Eugene K. Lawson, President, U.S.-Russia Business Council Introductory Remarks - Ambassador Robert S. Strauss Chairman, U.S.-Russia Business Council 9:15-9:45 am The Honorable Anthony Lake Assistant to the President for National Security Affairs 9:45-10:15 am H.E. Yuli Vorontsov Ambassador of the Russian Federation 10:15-10:30 am Break 10:30-11:00 am The Honorable Jan Kalicki Counselor to the Department of Commerce and U.S. Ombudsman for Energy and Commercial Affairs to the NIS 11:00-11:30 am Eugene K. Lawson - Financing Update 1996 11:30-12:00 am The Honorable John M. Deutch Director of Central Intelligence 12:00-12:30 pm Reception 12:30-2:00 pm Luncheon Luncheon Speaker - The Honorable Michel Camdessus Managing Director of the International Monetary Fund 2:00-2:30 pm The Honorable Lawrence H. Summers Deputy Secretary of the Treasury 2:30-3:30 pm Panel Discussion - "View from the Trenches" 3:30-5:00 pm Panel Discussion - "Russian Presidental Election and Beyond" 5:00-6:00 pm Cocktail Reception --- My prefered and soon to be permanent e-mail address: unicorn(a)schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

Re: Digital Signature Inititiative
by Alan Olsen 17 Dec '03

17 Dec '03

I am glad to see this clarification on the signature policy. (Sorry for the paranoia, but I have reasons to be wary of plans made in Redmond...) The article that I quoted in the first post was quite misleading as to a number of points. (Which is why I should not believe things written in one page articles, but that is another point...) With the author's credentials, I would have expected a wee bit more accuracy (or clarity). I do have a number of comments on what you posted, however... At 04:04 PM 3/22/96 -0800, Stuart Theodore wrote: >Good afternoon, > >I am the program manager at Microsoft responsible for putting the >digital signature program in place. I am sending this mail in response >to a recent mail string sent to these aliases appearing at the bottom. > >To summarize some important points of the program: > >* The program creates a certificate authority infrastructure which >consists of thrid party non-software affiliated companies such as >VeriSign and GTE who will act to grant certificates to allow code to be >signed. The policies defining who can be a certificate authority and >what it means to be a trusted software publisher will be a matter of >public policy(standard). The point being that Microsoft does NOT >control who can/cannot sign code. This is a good thing. (This was clarified after I posted by a developer who had returned from an MS developers conference on Internet Apps.) It is also nice to see that there will be more than one option of signing services. Hopefully the policies will not be such as to shut out the small, independant web designers/developers. >* This approach solves the problem of identity and integrity, and is >viewed by MS as complementary to the sandboxing approach used by Java >scripting, which we view to be incomplete and unsatisfactory by itself. >We believe that Java needs to sign platform dependent Java classes in >addition to their sandboxing scheme. Actually it protects against mallicious code (for the most part), but not against badly designed code. I can see where improperly tested and designed code could cause problems on host machines. I have not seen anything that makes OLE code more secure (or more stable) in the real world environment. (Just lots of paperwork being signed that says "We will not use these powers for Evil".) With Java, there has been alot of work to make the language less subject to abuse. I have not seen anything in that regards involving OLE. >* The W3C is creating a working group in this area to develop standards >around the policies mentioned in the first point, and the formats of the >certificate and signature formats. Microsoft is committed to making >this a open, industry, x-platform standard... This is a good thing. And I hope that they release them to the rest of the world before implementing them and releasing in a bunch of MS products. (This is one of my big beefs with Microsoft. I have seen a number of cases where APIs are released to developers MONTHS after they appear in Microsoft products. Not cool.) >* regarding the mac question - there already is a version of Internet >Explorer for the Macintosh, available for download at >www.microsoft.com/ie. Microsoft is has already announced its committment >to building cross-platform internet products. I am glad to hear it. Before this thread i had not heard of a Mac version. (Maybe it is becuase my friends who use the Mac have dropped using any Microsoft products. Come to think of it, it was because of how Word for the Mac implemented OLE... (Among other things.)) >I would be happy to answer more questions you may have about this >program, inluding proving more information. The part that interests me about the signing of executables is not for distribution over the web. (I beleive that OLE is not abuse proof enough for that yet.) What I would like to see is an API (or internal routines) to allow the app to check the signature opon loading and perform checks to detect tampering within the executable. This I see as a very useful thing, mpore so than the web applications. Is such a thing planned? Also, is there a web page that has additional information/plans about this API? --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Re: LET'S ROCK!!!!
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

At 8:26 AM 3/22/96, WThinker wrote: >Ok, here is the situation. I have a person mad at me in one of my mailing >lists. Turns out, this person was the owner of the mailing list! Well now >I'm stuck, knocked out of the list. The owner can not see any of my mail, >no matter how hard I try. I need some ideas to eather get through to her, >or really fuck up the mailing list. > >Any ideas? Learn to spell, write a really poignant suicide note, and then cut off your head with a chainsaw. That'll make her sorry. Joseph Block <jpb(a)miamisci.org> "We can't be so fixated on our desire to preserve the rights of ordinary Americans ..." -- Bill Clinton (USA TODAY, 11 March 1993, page 2A) PGP 2048bit-Fingerprint: F8 A2 A5 15 56 42 9B 16 3F BD 57 0F 8A ED E3 21 No man's life, liberty or property are safe while the legislature is in session.

1 0

Re: New Encryption Software-Encrypt Image & Text Files (fwd)
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

Has anyone suggested that these folks at Antelope do a merger with IPG? Inquiries can be forwarded to matchmakers(a)snake-oil.org... Jonathan

1 0

e$'s (mini-rant)
by jeff＠Molasar.BlackMagic.Com 17 Dec '03

17 Dec '03

<begin mini-rant> The Internet Economy Must Be Grass Roots (or, why can't we mint coins YET ?) Just a few thoughts. Being a small business, here are some of the things we THOUGHT we'd be able to do by now with anonymously transferable digital tokens (e$'s) that I'm amazed we still can't do. 1) Issue tokens backed by services our site offers, or the services of our consultants, etc. Obviously, this isn't intended for general use (though we certainly wouldn't care if the currency was traded to organizations who would accept it for it's value)- it's intended to be traded with those people on the net that we do business with on a regular basis, rather like a ledger system, but slightly different (Even an online system that wasn't anonymous, a ledger, would be better than what's out there right now, which is NOTHING). 2) Run our own mint- obviously, it's to our advantage to run the mint, we want to make sure it's secure, it's responsible for keeping value in OUR COINS, something of great importance to our reputation. Businesses want to issue all kinds of currencies- state currency is only ONE FORM of value. We want to mint coins and distribute them freely in some cases, to advertise our services, to attract new customers, etc. We want to mint "coupons" that have the same effect. We want to mint coins that are actually licenses for use of products that we want to distribute, licenses people can TRADE, licenses that hold their value past site-by-site use. We want to be able to issue coins that we can optionally expire, optionally have anonimity, and optionally can or can't be transferred (some uses of these token systems are not served well by anonimity or by transferability). The possibilities are only endless if there is a transport, if there is a mechanism. Not in theory, but in PRACTICE. When I played with the Magic Money software, my only thought was "YES!" but then it "went away" ? It went away because it was difficult to use, which I'm sure would have been resolved (obviously, it would have needed extensions for network transport with email transport as an option but not a necessity). It went away because the inventor of the original scheme holds the patents (which I have no problem with, obviously, but aren't there any competeing ideas ? or does the inventor plan to "let" us mint our own currencies in the future ?). That this mechanism is being restricted to some "higher purpose" of a universal cash system, beginning (and ending I suspect) with backing by state currency makes me down right mad. There are a million and one uses for this mechanism that nobody has even THOUGHT OF yet, and there are plenty that people HAVE thought of- but the mechanism isn't available to the public, it's being used instead in a very narrow way. And in my Not So humble opinion, the way to Internet Economy isn't from the top anyway, it's from the people who provide the value in the first place, it's from the businesses who desperately want to get moving but feel their hands are tied. I have communicated with every author of "e$" type systems that I know of, and they all had very big plans for their systems, were all looking for sponsorship and talking to banks, and everyone of them completely FAILED to even ANSWER email from me when I asked when we could use their mechanisms for minting our own currencies and running our own mints on the Internet (I take that back, one of them answered, they just said, in a word, "no"). And I find that ANNOYING, mostly because it's just putting things off-- years now and we're not much closer to "Internet Economy" than we were when we started. It's gotta be grass roots, it's gotta be free (or cheap), and most importantly, it's gotta be SOON. History has show in endless repetition, that the only standards on the Internet are free standards. The Web would have never taken off if both the thing that "lets the user access the system" (the client) and the thing that "allows distribution of content" (the server) hadn't been available freely-- and the mint software in any of the proposed token systems are just that, content distributing servers. Every single person on this planet is a business. All good things start with the individuals (especially on the net, as we've seen OVER and OVER). The world is full of things that were "good", but were too propietary, they fill the backrooms of many a code shop. In the words of a very common-sensical post I saw just a few days ago, "... because of a Betamax attitude, I'll follow the market to VHS." The only thing lacking right now is a VHS to follow, but beware, the need is so high, there will be one ... In short, give us the mechanism! Once it's available, sit back and watch the net soar ... just like it always does ... The most recent application of this type of mechanism that I saw, or at least it could have been an application for it if there WAS a mechanism, was a group of organizations that wanted to trade certain types of information among themselves-- they wanted it to be based on merit, that is, those individuals/organizations who PROVIDE data also GET data from the system. It was a perfectly contained closed economy that desperately needed a token system as it's heart, but alas, there wasn't one. Trying to remain patient. <end mini-rant> Woowoo! Spring is here! :) Jeff. -- Simply Be.

1 0

detweiling
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I've been studying "detweiling" in old archives as this issue is raised here every so often. imho the lesson of detweiler has nothing to do with detweiler, but in fact more to do with his targets. effective "detweiling" would be impossible if it were not for the large egos of his quarry. he selects his targets carefully based on the size of their egos, presses their obvious buttons, and stands back to watch the fireworks ensue. the larger the ego, the more easy it is to do this. (i.e. larger fireworks/provocation ratio). detweiler took a lot of pride in how much reaction he could get with just a few posts or barbs. he is not really apparently responsible for ever actually mailbombing the cpunk list from what I can tell. he believed he was perfecting the art of playing with people's egos. a sort of depraved cyberspatial psychology experiment. the amusing thing about "detweiling" is the way that it is something like a bad, self-perpetuating virus among those with big egos. detweiler took great glee in starting the virus wherein these people with big egos blame all their obvious personal problems on him (i.e. atrocious lack of interpersonal skills). since the virus propagates not because of any action on his part, but because of the inherent psychology of those with big egos, it continues on this list even though there seems to be no evidence that Detweiler has had anything to do with this list for perhaps over a year. the cypherpunks is a rabid breeding ground for this detweiler virus, because of the vast array of throbbing egos. the flamewars are routine because of the immature psychology of many posters, esp. the more "prominent" ones. even anonymous or pseudonymous posters defend themselves because of their large egos, and those with big egos feel they have to defend themselves against anonymous or pseudonymous accusations, or take intermittent jabs at whatever hapless pseudonym-of-the-week is thought to be detweiler. imho from what I have seen (which is admittedly not everything, as the detweiler stuff is rather endless), detweiler is not really destructive in himself. but he is an amazing catalyst to those that already have destructive tendencies within themselves, and he tweaks them into erupting. in a sense it is almost a public service in helping people with big egos temporarily relieve their "painful flareups". but I see no sign that he has been anywhere near the list for a long, long time, and I think all the ranting and scapegoating of him is quite strong evidence of all the big egos and small minds that litter this list. there is nothing new about detweiler's approach. there was a classic greek who was put to death for the same reason: not provoking people by calling them names, so much as asking them questions that embarrassly exposed all their ego problems. his name was called "socrates" and he was put to death for refining his art beyond that which was tolerated by a power structure largely populated by those with the ego problems (power structures are always dominated by these types, it is like flies and dead meat, or moths and flames). the joke of course may be that detweiler could have been dead for a long time, and people here would still be blaming him for their problems. perhaps we have a new convenient substitute for Satan in the cyberspace age. "the detweiling made me do it." (hee, hee). "projection" was identified by freud in another century as a basic device of the ego, a pity that few in our modern era are aware-- or perhaps it is not such a pity from detweiler's perspective. <g> (p.s. I imagine quite a few people will accuse "me" of being detweiler. I assure you my amusement will at least exceed or match that which detweiler ever obtained.)

2 1

Re: Excluding articles from DejaNews
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:38 AM 3/23/96, Rich Graves wrote: >I just noticed this in their FAQ, dated February 20th: > > Q: I don't want my Usenet articles to appear in Deja News. What do I do? > A: We have implemented a feature whereby if your article contains an > X-Header looking like > > X-No-Archive: Yes > > your article will be excluded from our database forever. > >Anyone know if other search engines support this? I think such a standard >would be a Good Thing. Of course there will be the odd private archive, >and of course some nastyfolks might grep Usenet just for X-No-Archive >headers, but this is a good step for casual alt.support - type privacy. Even facetiously, count me as one of the "nastyfolks." If someone has made comments to the entire Usenet, any search engine which purports to index articles on the Usenet and does not index _all_ articles is misleading its customers. (Being a market sort of person, I'll let market forces work. I don't user DejaNews at this time, and now don't expect to. My preferred search engine, Alta Vista, catches even posts marked "X-No-Archive: Yes", which I count as A Good Thing.) I don't think the security-through-obscurity approach is a good thing. It is the security that ostriches have. If folks don't want their words haunting them, they should either say nothing or use anonymizing services. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: Excluding articles from DejaNews
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:48 AM 3/23/96, Rich Graves wrote: >AltaVista doesn't index web sites that follow the Robots Exclusion >Standard. Does that mean you won't use AltaVista anymore, either? I didn't say that an indexing policy is the determinant of my using it or not, only that DejaNews looks less attractive than it did before (which wasn't very attractive anyway, compared to AV...your mileage may vary, so I won't be engaging in Search Engine Wars). >Agreed, anyone really concerned about their privacy should be using >anonymity/pseudonymity, but a temporary hidey-hole is a Good Thing. Well, I mostly disagree with this point. It gives the poster the _comforting illusion_ of privacy, when in fact the Real Threat (tm) is that the search engines of 2-5 years from now will trivially uncover all of the "asides" (to use Rich's term) made in rec.music.white-power and alt.sex.cypherpunks. It is the searches done several years from now that will no doubt be of greatest concern to job seekers, professors seeking tenure, and candidates for political office. No matter the "no archive" headers, somebody will archive it. Thus, spiders will find it. This is the "ostrich effect" I was referring to. The illusion of security. >But I can think of a lot of reasons you might want to post something >under your real name, or your regular pseudonym -- gaining the benefit of >your good (or bad) reputation, mostly -- but on the other hand, you don't >want that post archived. It's called an "aside." The point is that just because one or more sites is not archiving the traffic does not mean that other sites are not. Look at the parallels to cancellation: some sites strongly believe that "cancellation" is a bogus concept, that once a message has gone out it is part of the overall feed. (I concur with this view, and, if I ran a site, would not honor so-called "cancellations.") >For example, I might want to say, "Tim May is a big fat idiot because of >what he just said." I do want to say that, publicly, under my name and It created a best-seller for Al Franken..... >address, but for various reasons, I don't want that saved in the >archives. Since X-Headers are readable by most newsreaders, and are in Well, what you _want_ and what you're gonna git are not necessarily the same thing. I expect some sites are going to advertise that they archive and/or index _all_ public traffic, becoming a "site of record." >OK, you've convinced me that this isn't a privacy thing, really, but I >think is a valid and useful thing. What's the alternative, really? If I At the risk of repeating myself: -- some people will want to request "no archives" (for "asides" and "off the record" comments. -- some sites will honor these requests. -- other sites will not. -- that at least one site keeps the traffic and makes indices available is sufficient to negate the effect of requesting "no archives." -- the practical effect will be initially to make a search for the "no archive" words _slightly_ more difficult, but not practically so...in spiderspace, the distances are compressed and a search will still turn up the words. >want to say something, now, are you going to tell me that I don't have >the right to request that you not take my comments on the record? That >sounds sort of totalitarian. I either have to create a new, unique nym on "Totalitarian"? You spoke publically, in this example, and I remembered your words. What is totalitarian about this? Trying to purge uttered words is the hard thing to do, actually. >the fly, in which case my comments lose anything associated with my name, >or I have to keep my comments to myself. Recognizing "Well, the full >context is recorded too, you can defend youself with that" only makes it >worse, really. > >Just thinking out loud, my thoughs being recorded for posterity on >hks.net and Exon-knows where else... Indeed, the storage densities and net connections that are coming will make your words here trivially searchable by your daughter in her third-grade class in 2005. Maybe on her handheld terminal. (And she'll probably be most interested in the words that Daddy thought to label as "no archives," as you yourself presaged in an earlier message. Those are likely to be the juicier things to read.) --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

2 1

Re: NT's C2 rating
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 5:11 PM 3/22/96 -0600, Rick Smith wrote: >The big deal is that few vendors have tried to get NCSC evaluations. We walked KeyKOS a long way down the path to a B2 rating. Our investors refused to fund the estimated $1 million it would cost to do all the paperwork. They felt there was no market for NCSC secure systems. Perhaps others felt the same way. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

3 2