- cypherpunks-legacy - lists.cpunks.org

[RANT] Mr. Scruffy versus Mr. Neat
by mpd＠netcom.com 17 Dec '03

17 Dec '03

"E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> writes: > One interesting phenomenon is the in-migration of neats > into formerly scruffy-only domains. For instance, take a > look at the third, fourth, and fifth international > conference proceedings on genetic algorithms. You've got > scruffies who are just doing what feels right and seeing if > it works (my viewpoint) and mathematicians/neats who are > trying to derive what _should_ work the best. The scruffy/neat competition has been around for a long time in the hard sciences as well. Good examples are the competing notions used by mathematicians and physicists for doing differential geometry, calculus of variations, and field theory, and the physicists who think physicists can do chemistry better than chemists can. Ultimately, there tends to be a merger of notations and approaches. The big Misner, Wheeler, Thorne book on Gravitation, for instance, presented everything both from the view of the physicists, who like to write everything as algebraic equations in terms of components of geometric objects with respect to a basis, and the view of mathematicians, who like abstract maps between abstract geometric objects, and terms like tangent spaces, exterior products, and germs. Usually the scruffies get great results using formal manipulation that horifies the neats, and then the neats come in and do the rigorous proofs that demonstrate that everything the scruffies did was valid. This was certainly the case in quantum mechanics as well, where questionable formal manipulation got the right answers for many years before a rigorous theory of unbounded linear transformations on Hilbert spaces was developed. Indeed, physicists happily computed commutators and anti-commutators of such operators blithely unaware of their domains and ranges long before the equivalent definitions in terms of one parameter Lie groups or projection valued measures were known. While Java is currently a scruffy invention and has yet to recieve the official blessing of the neats, there are a number of things that speak in its favor. First, object-oriented runtime structures such as those used by Java have pretty much been researched to death in various other venues, such as APL, APL2, Smalltalk, and the MIT Lisp Machine project. It is not likely that we will discover some previously unknown mode of corruption in such systems, and defensively coding interpreters for these kinds of languages and verifying them to prove that they contain no errors which could result in the violation of container boundaries is a well-developed art. This doesn't mean that such systems are free of bugs, of course, but it does mean that they are free of the type of really cute bugs that allow users to trick the machine into executing arbitrary machine instructions, or into making disingenuous requests to the kernel. Second, there is quite a bit of experience on the part of OS designers in meeting various levels of MIL Specs for security, and with the standard techniques, such as audit trails, authentication, and ACLs, which are commonly employed to implement the features required. So although the neats have not yet given Java their blessing, it is extremely unlikely we won't manage to create an environment which can safely run untrusted Java code, and filter the program's requests for system services in a way which will block and log any attempts to do nasty things, both for the Applet model, and for more general applications. A prior poster suggested that in the absence of formal proofs of correctness, flaws permitting the exploitation of covert channels and other such things in a language such as Java were "a certainty." I think the situation is more complicated than this suggests, and while I probably wouldn't want an artificial heart with Java software today, I think a lot of the worries will resolve themselves as time passes, and the things we are all discussing are implemented.

2 1

Best Digital Signature Lib from a WEB server
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Can anyone recommend a signature implementation for cgi/forms? For instance, someone registers on a WEB site and gets a signed receipt back. (No cookies or such, because the receipt will be show to 3rd party members.) I'm thinking in terms of self-labeling and PICS like work. The PICS Label Syntax and Communication Protocols mentions that Jim Bidzos has agree to allow RSAREF to be available to PICS developers at no cost. Has anyone tried this, or actually implemented a scheme like this? _______________________ Regards, I, man, am regal; a German am I Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Crisis in the Burg: the 100GB Bug
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Resent-Date: Thu, 24 Sep 1998 14:47:22 -0400 X-Authentication-Warning: qnx.com: localhost [127.0.0.1] didn't use HELO protocol To: 0xdeadbeef(a)substance.abuse.blackdown.org Subject: Crisis in the Burg: the 100GB Bug Date: Thu, 24 Sep 1998 14:29:38 -0400 From: glen mccready <glen(a)qnx.com> Resent-From: 0xdeadbeef(a)substance.abuse.blackdown.org X-Mailing-List: <0xdeadbeef(a)substance.abuse.blackdown.org> archive/latest/212 X-Loop: 0xdeadbeef(a)substance.abuse.blackdown.org Precedence: list Resent-Sender: 0xdeadbeef-request(a)substance.abuse.blackdown.org Forwarded-by: nev(a)bostic.com Forwarded-by: Dave Del Torto <ddt(a)lsd.com> Forwarded-by: Victor Milan, FBNS Forwarded-By: Charles Reuben <buytexas(a)swbell.net> EXPERTS WARN OF THREAT FROM 100GB BUG Firebringer News Service (FBNS) - Experts warned today of a new and deadly threat to our beleaguered civilization: the 100GB Bug. As most people know, McDonald's restaurant signs show the number of hamburgers the giant chain has sold. That number now stands at 99 billion burgers, or 99 Gigaburgers (GB). Within months or even weeks, that number will roll over to 100GB. McDonald's signs, however, were designed years ago, when the prospect of selling one hundred billion hamburgers seemed unthinkably remote. So the signs have only two decimal places. This means that, after the sale of the 100 billionth burger, McDonald's signs will read "00 Billion Burgers Sold." This, experts predict, will convince the public that, in over thirty years, no McDonald's hamburgers have ever in fact been sold, causing a complete collapse of consumer confidence in McDonald's products. The ensuing catastrophic drop in sales is seen as almost certain to force the already-troubled company into bankruptcy. This, in turn, will push the teetering American economy over the brink, which, finally, will complete the total devastation of the global economy, ending civilization as we know it, and forcing us all to live on beetles. "The people who know -- the sign-makers -- are really scared of 100GB," one expert said. "I don't know about you, but I'm digging up a copy of THE FIELD GUIDE TO NORTH AMERICAN INSECTS and heading for the hills." ### reported by Victor Milan, FBNS forward freely, please attribute --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Lolitas and Cyber Angels
by mpd＠netcom.com 17 Dec '03

17 Dec '03

(CyberAngels Director : Colin Gabriel Hatcher) writes: > Child pornographers encrypt their hard drives so that law > enforcement cannot gather crime evidence - that is certainly > a state of greater security for the pornographer, but it > does not improve our Community, and as child pornography > increases, the law is by definition broken more and more, > and so the Community becomes less free than before. This is silly on several levels. First, given that a finite amount of resources are available to combat the sexual exploitation of children, law enforcement should concentrate their resources on the production of such material, and not on the incidental evidence of its production long after the fact, and in a context completely unrelated to any economic link back to the original producers. Someone who has an encrypted file on their hard drive from some motheaten child porn magazine published 20 years ago is no more guilty of the exploitation of the models portrayed than someone who downloads the Simpson crime scene photos from alt.binaries.pictures.tasteless is guilty of killing Nicole and Ron. If anything, such a picture is little more than historical documentation of a bygone era and an expensive distraction for police officers who might better spend their time. Indeed, if encryption inhibits the ability of the government to create exceptions, based solely on irrational public hysteria, to the First Ammendment right of citizens to communicate amongst themselves on any subject, including via the use of visual material, then encryption is serving a valuable purpose. Now before anyone accuses me of advocating a thriving market in child porn, let me say that I have no objection at all to laws which set a minimum age for working as a performer in the sex industry, and to enthusiastic prosecution of individuals who violate those laws. I just think the police should concentrate their resources on real children experiencing real abuse, and leave their prurient interest in the contents of libraries and other peoples computers behind when they go to work. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

1 0

(fwd) Information Infrastructure Project
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"rre(a)weber.ucsd.edu" 1-MAY-1996 00:50:15.50 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Mon, 29 Apr 1996 17:21:36 EST >From: Tim Leshan <LESHAN(a)ksgrsch.harvard.edu> To: IIPLIST(a)ksgrsch.harvard.edu Subject: Workshop Announcement and Call for Papers Information Infrastructure Project Harvard University Commercial Internet Exchange Association (CIX) Internet Society COORDINATION AND ADMINISTRATION OF THE INTERNET Workshop Announcement and Call for Papers This is a first announcement and call for papers and proposals for a workshop to be held at the John F. Kennedy School of Government, Cambridge, MA, USA, on September 8-10, 1996. The workshop will address issues in the international coordination and management of Internet operations. We are seeking papers which address the economic, organizational, legal and technical issues in migrating to internationally sanctioned, industry-supported processes and institutions. What should a fully internationalized Internet look like, and how do we get there from here? Topics to be explored in the workshop and resulting publication include: - policy and management issues concerning: network addresses domain names routing policy settlements interconnect points intercontinental connectivity quality of service standards - legal and institutional structures for supporting core Internet functions; - institutions and policies needed to ensure the future scalability and extensibility of the Internet; - technical and implementation issues presented by heterogeneous national information policies; - the need for data in support of Internet planning, including issues of how data should be collected and maintained; - coordination needed for the deployment of new technology; - international crisis management for the Internet. Although the Internet is already substantially privatized, certain essential functions -- notably the domain name registry, network number assignment, and the routing arbiter -- are still funded by the U.S. Government. Unlike the local telephone exchange, these integrative services are managed by third parties, contributing to an open competitive environment which has helped enable rapid growth of the Internet. Rapid growth, commercialization, and internationalization are putting stress on current institutions and procedures -- which are neither self-sustaining nor officially recognized at the international level. The National Science Foundation plans to phase out support for core administrative services and for international connections, just as it has withdrawn support for production-level backbone services. Conflicts over tradenames and number assignments suggest that international legitimacy is needed for domain name and network number management. Beyond support for essential functions, there are many practical and policy issues where some greater degree of coordination or institutional leadership may be desirable. For example, how can the implementation of new technology and protocols be expedited? What common definitions and guidelines should exist to describe network performance? Should the functions performed by current Internet institutions (such as the Internic, RIPE, APNIC, and the IANA) be brought into a more robust international infrastructure, and if so, how? To what extent are multilateral peering arrangements and settlements needed to encourage continued growth and competition in the Internet access industry? The conference will engage scholars, practitioners and policy makers in examining and discussing these issue. It will bring together stake-holders, academics and individual leaders within and beyond the Internet community to help define the future institutional infrastructure of the Internet. Workshop papers will be revised and edited following the workshop for publication by MIT Press as part of the Harvard Information Infrastructure Project series. Potential participants are encouraged to submit papers that can be developed and revised for publication (copyright assignment is not required). Please send an abstract by June 15, 1996, for review by the program committee. Please direct papers, proposals, and requests for future mailings to: James Keller Information Infrastructure Project Kennedy School of Government, Harvard University 79 JFK Street Cambridge, MA 02138 617-496-4042; Fax: 617-495-5776 jkeller(a)harvard.edu The Harvard Information Infrastructure Project is a project in the Science, Technology and Public Policy Program at the John F. Kennedy School of Government, with associated activities at the Kennedy School's Center for Business and Government and the Institute for Information Technology Law and Policy at Harvard Law School. This event and publication are funded in part by a grant from the National Science Foundation, Division of Networking and Communications Research and Infrastructure.

1 0

Re: Why I dislike Java. (was Re: "Scruffies" vs. "Neats")
by Hal 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" <perry(a)piermont.com> > > The Web is the universal marketplace these days. Being unable to use > the web is the equivalent of being unable to use the phone. I have > research analysts at large trading houses begging for > Netscape. Unfortunately, these people have a need for top notch > security, because vast amounts of money are at stake. > [...] > Unfortunately, when the same machine runs Netscape so the > trader can read the UUNet/MFS merger press release and also has the > big shiny red "trade!" button on some application, you get nervous. Aren't you holding Java to a higher standard than ordinary applications? If your traders run any software at all on their machines there is the risk of harm. The Netscape binary itself could be hacked to do bad things. Likewise with any other software they run. Wouldn't it be safer to run a Java applet than a typical program from the net? At least applets run in an environment which is designed to restrict the harm they can do. In OS's like Windows 95 there are no such restrictions on programs. Take a specific example: Mixmaster. This is a client for the remailer network. It is reasonably well suited to being implemented as a Java applet given the current restrictions on the language. If you had a choice between downloading and running the client as a program on your PC, versus loading and running it as an applet, which would you prefer? Or if you would do neither, how would you go about acquiring this functionality? Would you forego it forever, or would there come a time, say if no one else reported problems, that you would be willing to run one or the other? What I am really trying to get at is how you balance the risks that come automatically when you interact with the net against the benefits you get by doing so. You have chosen a certain point on the risk-reward continuum, one for which Java applets are apparently on the too-risky side. So I am wondering what principles you use to decide where a proposed application falls. Hal

6 6

Re: once again
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:02 PM 4/30/96 -0400, Perry E. Metzger wrote: >I fully understand that Java is a general programming language and can >do I/O. However, "Safe" Java subsets, like the ones used for writing >applets or presumably the ones that would be needed for markets in CPU >cycles, do not do i/o. One could add i/o to the suite, but that would >be dangerous. If I were as worried about Java security as Perry is, I would still consider running Java (or C or C++) programs as part of certain markets in CPU cycles because I would trust their source. (IMHO, much better than trusting every web page I access.) A single example. I could see a network-wide factoring attack on the key NSA uses to GAK the extra bits in Lotus Notes. Such an effort would run a single program, which would be available in source. Depending on the details, I could either compile the program locally, or down load a signed copy of the object code/class file. The same argument applies to rendering e.g. Toy Story. This restriction does not provide for CPU cycle markets in arbitrary programs, but I think that a significant market could still develop under this limit. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Freedom and security
by jim bell 17 Dec '03

17 Dec '03

At 08:51 PM 4/30/96 -0700, CyberAngels Director : Colin Gabriel Hatcher wrote: >Jim Ray wrote > >> Freedom is already diminishing at an alarming pace. >>That is why cypherpunks spread crypto, and why Libertarians like >>me rant. Freedom does not increase through more laws. > >Nor does freedom increase through less laws or no laws. I disagree. Plenty of laws do not increase freedom, nor leave it at its former level. They decrease freedom. Moreover, they usually do it without increasing the level of "security" of the ordinary citizen. > Freedom increases >as respect and care for one another increases. Meanwhile, since we do not >live in utopia, all societies at a certain level of economic development >and of a certain size of population require law and law enforcement to >protect citizens from predators. If all the government did was to "protect citizens from predators" the government would be dramatically smaller than it is today. >The Internet is beyond the stage of small communities exercising informal >social controls (peer pressure). It's now a major industrial city and will >develop law, law enforcement and government, whether anyone likes it or >not, Ya wanna play "chicken"? > not least because the Community will always respond to crime by trying >to protect itself. Which "community"? > And the crime is already here. Does the amount of crime which is demonstrably on the Internet, today, actually justify the interest shown by government agencies? Or, more likely, they are merely using whatever crime exists to foist regulations and control for their own hidden agenda? > The idea that the >Internet is not controlled is IMHO one of the biggest myths around. It's >like a large group of people are still living in some far-off utopian rural >paradise. Does anyone really doubt the extent of State control and power >across the Net? To whatever extent that exists, it will be stopped. > My point is that this is inevitable. I have different opinions about what is "inevitable." But I won't get into that right now. > The Internet is a >mirror of the rest of the world, not a new form of society, and I fail to >understand why anyone should be surprised that that is the case. Maybe it really _IS_ a "new form of society"? Maybe that's exactly why the government-and-control-types are terrified. Let it alone a few more years and it'll come back and destroy the control they currently have. > >.... laws only breed more laws, which always lead to >>less freedom. > >I disagree with this statement. I do not believe that laws breed more laws >nor that laws lead to less freedom. I believe bad laws compromise freedom >(eg CDA) while good laws protect freedom. Could you be more specific? And why is the government passing bad laws? Could it be that their goal is not more freedom, but is in fact less? And why should you do anything to support the government that's passing those bad laws? >>Good. Join us in spreading cryptography around, and security will >>bloom (along with freedom). > >Cryptography enhances and protects privacy, which does not inevitably lead >to greater security. Security for the sender, yes, in that no one else can >read the message, but security for the Community? Doesnt that depend what >the message said? I don't think it does. Cumulatively, we're better off if everybody has unbreakable security, because it'll assist the ordinary citizen more than it would assist a hypothetical criminal. > The technology itself is neutral. But government is not neutral. > Child pornographers >encrypt their hard drives so that law enforcement cannot gather crime >evidence - that is certainly a state of greater security for the >pornographer, And less work for agents of the government to do. That's what terrorizes them! > but it does not improve our Community, and as child >pornography increases, the law is by definition broken more and more, and >so the Community becomes less free than before. Laws being broken does not equate to less freedom. The presence of those laws is what produces less freedom. > And that's not the tyranny >of government but the tryanny of criminals. I think the ordinary citizen has far more to fear from the government than the criminals. For one thing, it is the actions of the government (by passing victimless-crime laws) which actually put a great deal of profit into crimes. >I do in fact support cryptography for personal security, not least because >I can ensure that my messages are authenticated. CyberAngels PGP public >key will be up on our new website opening very soon. I've had enough of >people forging my email. Well, then stop sending any. Or get your head straight on this "freedom thing." People will view you as being dangerous if you keep talking the way you have been. Jim Bell jimbell(a)pacifier.comJim Bell jimbell(a)pacifier.com

1 0

Re: [LONG] Churchill Club: 20th Anniversary PK Crypto
by frantz＠netcom.com 17 Dec '03

17 Dec '03

> Paul Raines, Project Manager, United States Postal Service described > ... The post office brings four things that private > industry can't: ... (2) ... well established reputation, ... > (4) it can act as a trusted third party. > >Oh. Well that's good to know. > > --MarkM I just report them like I hear them. They are priced higher than Verisign too. Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Re: no-cost DH?
by Ted Garrett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: perry(a)piermont.com, cypherpunks(a)toad.com Date: Wed May 01 02:16:17 1996 Sorry, Perry. This time you are wrong. Cylink is giving away their Passport Gold SDK (Security Development Kit). Period. I've just recieved the documentation on the SDK itself, and am expecting shipment of the SDK itself about the middle of May. I was skeptical myself when I read the first post regarding this SDK being released to the public for free, so I called up Cylink. They promptly connected me with Peter Bolton <mailto:pbolton@cylink.com>, who has been very helpful in getting this SDK into my hot little hands. Included is, and I quote: "We hold the world-renowned Diffie-Hellman patent used in public key encryption. While developing our industry-leading encryption acceleration engines, we also developed a full suite of services for Diffie-Hellman-based key exchange, government-sanctioned Data Encryption Standard (DES) encryption algorithms, Digital Signature Standard (DSS) document signatures, and the complementary functions you need to incorporate data security into your product. And it's available to you for free: a no-cost toolkit and royalty free license." This is the second paragraph of the fax I received from Cylink after my following up on the free SDK offer. From the rest of the fax, it seems that provisions are included in the SDK for DH, DES, DSS, and SHA. X.509 appears to be in the works. The SDK is purported to interoperate with the Cylink products based on the Secure Enterprise Architecture Stack. I'm pretty dad-blamed excited about this one, boys. I was trying to wait till I was sure to say anything on the list. I'm sure. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMYcBs81+l8EKBK5FAQEfhQf+LJAytjAhEOoD0ai6K0liuyDQkWuMmAxq z5H5KzNXBQn0F+r2ukVEPsX0Ocgfbqp5fo5lRp+hDegM9KRz+MulSmVXEQSdbUPi 6cfq7c0/HhHNkuaJK8xeTOvDlquYLmnDPJJ6KxAcTQvh3ssRJMo9YYWXIF/YlX/J fVZunnwMY9xmIggOfoXIV6ZZvkAUsumA6EgGbKggm2HMh5X4ukWDb3qW2RkKDTlr 8pM8SPRs4IEJFzoXA1FAXafePm1tA2PXhLeOKmwjjZ4R58L6Y4l+eRRsNXIkUGrD 8iY7QUbozhTyTyzRMGzv21g2cOHmfmLblKfJsNQYWFX5yKctla7qyA== =TklH -----END PGP SIGNATURE-----

3 2