- cypherpunks-legacy - lists.cpunks.org

CDA Court Challenge: Day #1
by Declan McCullagh 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- The CDA Challenge, Day #1 ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- March 21, 1996 PHILADELPHIA -- In the shadow of the Liberty Bell in downtown Philadelphia, the future of online liberty is being decided. I arrived halfway through the first day of the hearing in our lawsuit challenging the Communications Decency Act. Overall, it went well, though there were a few surprises, like a series of computer crashes and the Department of Justice's embrace of the rhetoric of crusading anti-porn activist Catharine MacKinnon. But most importantly, the judges are engaged in the case. CDT installed a T1 line, which is the first time a courtroom has had a live net-connection -- judges tend to insist on paper. When Ann Duvall of SurfWatch demoed the web and her software this afternoon, the judges paid attention, asked questions, and were proud when they figured out the concept of a hierarchy of pages on a web site. Her demonstration wasn't without problems. The Macintosh laptop she used to demonstrate Netscape and SurfWatch crashed three times as Duvall tried to click on the Philadelphia Phillies web site. (A great idea, though -- at least one judge appeared interested in the team.) Jonah Seiger and the other CDTers fixed the problem quickly, but then net.latency prevented Duvall from accessing the Louvre or Playboy web sites. Penthouse worked properly, though: "Blocked by SurfWatch." As I'm typing this, I saw a mention that a local television station, WCAU News 10, is going to broadcast a special on the hearing early tomorrow morning. Today's press corps included CNN, CBS, NBC, the Washington Post, the New York Times Online, the Philadelphia Inquirer, the Los Angeles Times, and plenty of local reporters. The most interesting witness might have been Dr. William R. Stayton, a psychologist and sex therapist who testified that minors were not necessarily harmed by sexually-explicit materials. Stayton is an American Baptist minister, and holds faculty appointments at LaSalle and the University of Pennsylvania. The DoJ's only female attorney present cross-examined Stayton, spinning her arguments around a twisted MacKinnon-esque logic that I've never heard even from honorary net.mascot Senator James Exon. Seems as though she wasn't just trying to establish that nekkid photos are *harmful to minors* -- she was trying to establish that they're *harmful to women.* She asked questions like: "Do these pictures depict a healthy view of women as sexual beings?" "Do you believe the pictures are a factor in leading minors to view women as sex objects?" "Do you believe that these pictures are part of a socialization process that depicts women as sex objects?" Stayton rallied, replying: "There's nothing inherently harmful about letting a six-year old view these images." Undaunted, DoJ counsel continued, quoting from the Attorney General's 1986 Commission on Pornography, page 343, entered into evidence as exhibit 80. Seems as though that section talks about how nonviolent and nondegrading sexual materials are still harmful to minors. Chris Hansen from the ACLU on redirect asked: "Why is it not harmful for minors to access sexual materials?" Stayton: "We are born sexual beings... Our children are bombarded with sexuality on all sides... 50% of kids are sexually active by 15-16 years old. 85% are active by 18." To illustrate their point, the DoJ showed the judges and Stayton examples of dirty pictures taken from the Internet, complete with URLs. The pictures were _not_ hardcore; they seemed to consist of solo naked women in various lewd and explicit poses. The DoJ did this to demonstrate the types of _nonobscene_ materials available online that they would be unable to prosecute without the CDA. I would report in more detail on the types of images, but as I and members of the press started to page through the exhibit book after the hearing, someone from the DoJ came over and told us we weren't allowed to look at them "since they weren't available to the public." I argued with him, and he maintained that since they weren't _entered into the record_ then the public had no right to see them. How odd that the Feds are unwilling to divulge the URLs of the dirty pix they use in their case! I also met Cathy Cleaver, who's the director of legal studies for the Family Research Council, and a strong supporter of the CDA. She says she thought the hearing went well for her side. I politely disagreed. By the end of the day, the judges might have been starting to "get it." When Kiyoshi Kuromiya testified about his Critical Path AIDS Project web site, which carries safe sex information, the judges grilled him about the number of minors in the USA with HIV. Later, one Patricia Warren from Wildcat Press: "Is it easier to create an ezine than a magazine?" Another asked her if "gay and lesbian information is likely to be censored?" Tomorrow morning Professor Donna Hoffman of Vanderbilt University will testify. (She was instrumental in debunking Marty Rimm's fraudulent cyberporn study. <http://www.cs.cmu.edu/~declan/rimm/>) Stay tuned for more reports. ----------------------------------------------------------------------------- The DoJ's case has been rescheduled to April 12th and April 15th. For more information and breaking updates, check out: http://fight-censorship.dementia.org/top/ Other relevant web sites: http://www.eff.org/ http://www.cdt.org/ http://www.aclu.org/ -----------------------------------------------------------------------------

1 0

Re: A MODEST PROPOSAL
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 7:03 AM 3/20/96 -0800, Sandy Sandfort wrote: >(Did I get the style right?) C'punks, if you feels as I do, >please take a few moments to sign up for the LIST OF SHAME? >Let's show Bill, Bruce, Matt and all the others what most >Cypherpunks really think about them and Mr/Ms Anonymous. Please add my name. I don't abandon my friends when I disagree with them. Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Ecash API about to be released
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

With the Ecash API due to be released within a matter of days, I would welcome anyone on this list interested in building applications on top of such an API to contact me. The API will determine the calls to a libecash that DigiCash will provide. Try to send emails that contain "I would like to code..." and please don't send the ones that contain "it would be nice if someone coded..." :-) -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

No Subject
by Blake Wehlage 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie) <jwilk(a)iglou.com> President of Revolution Software Quote- Does whiskey count as beer? -Homer Simpson

1 0

Re: Tim's friend's mildly retarded son
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"asgaard(a)sos.sll.se" "Asgaard" 15-MAR-1996 14:06:44.11 >The reason FDA has not approved this drug is most probably because >it does not make mildly retarded boys less retarded. But of course, Actually, there is some evidence that nootropics do work. I've been doing a literature review on the subject (soon to be a full meta-analytic review if I can find the proper statistics for combining multiple results from the same study), and there is some evidence for them working... slightly. The lack of FDA approval can be described as being due to a combination of three factors: A. Most sucessful studies of such drugs have been on healthy individuals. (For instance, vasopressin only appears to work on those whose brains are reasonably intact in the portion that deals with memory; I find this unsurprising). However, the FDA refuses to approve drugs for the purpose of enhancement of normal humans. (They have the excuse that it's against their charter). They even include the decline of IQ with aging in this category, unless it's profound or associated with other problems. B. Most of the known to work nootropics, etcetera are beyond the patent period. Thus, the well-researched ones tend not to be profitable for a company to work on getting through the FDA. Instead, they're developing new ones... often with a concentration (as with hydergine) on drugs to treat senile dementia or other categories that the FDA _will_ approve. C. The FDA is notoriously conservative. I'm generally willing to trust anything they pass as safe and (at least marginally) effective, but that's because they're completely anal-retentive about the whole business. Anything they're willing to pass without serious political pressure (of the types mentioned in another post) is OK... it's just that they don't pass a lot of stuff that is OK. This topic's relevance to Cypherpunks, aside from the confirmations that you mentioned, is low... aside from that it's of interest to Extropians such as myself and Tim May. -Allen

1 0

PGP key spoofing
by christopher＠nescio.zerberus.de 17 Dec '03

17 Dec '03

Hello, everybody, (Please note that I sent this to several mailinglists at once. I am not subscribed to cypherpunks any longer, so I won't see any replies there.) I think I have realized a serious flaw in PGPs key-handling. This may lead to people using and signing bogus keys despite the usual security measures. The problem is that PGP fails to differentiate between two keys sharing the same 64-bit-Key-ID. It is not a real problem to generate a key with a given key-ID (just take a prime, invert the desired key-ID modulo this prime and look for another prime whose lower bits are the same as in the number you just calculated), so the following attack would be possible: - Get the real key you wish to mimic. - Generate a fake key with the correct IDs. - Send your bogus key to a person of which you know that - This person does not have the correct key yet. - This person is going to meet the correct key's owner. If the owner of the correct key does not give a fingerprint, but rather a disk with the correct key to the person you are trying to fool, his or her pgp won't ring alarm bells when reading the key (apart from possibly a failed signature), but rather will tell him the key is already there. He will then, most probably, sign the bogus key without any further thought. Therefore, you should *always* check the fingerprint, even if you got the real key, at least if it has no valid signature from its alleged owner. -- Christopher Creutzig # Im Samtfelde 19 # D-33098 Paderborn # V+49-5251-71873 # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # Sammele Vorschläge zur Rettung vom Genitiv.

1 0

Warning: could not send message for past 4 hours
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

********************************************** ** THIS IS A WARNING MESSAGE ONLY ** ** YOU DO NOT NEED TO RESEND YOUR MESSAGE ** ********************************************** The original message was received at Mon, 2 Mar 1998 14:14:28 -0500 (EST) from ts35-10.homenet.ohio-state.edu [140.254.114.193] ----- The following addresses had transient non-fatal errors ----- <Remove(a)rmjent.com> ----- Transcript of session follows ----- 451 <Remove(a)rmjent.com>... rmjent.com: Name server timeout Warning: message still undelivered after 4 hours Will keep trying until message is 5 days old Reporting-MTA: dns; chemistry.mps.ohio-state.edu Arrival-Date: Mon, 2 Mar 1998 14:14:28 -0500 (EST) Final-Recipient: RFC822; Remove(a)rmjent.com Action: delayed Status: 4.4.3 Last-Attempt-Date: Mon, 2 Mar 1998 19:02:17 -0500 (EST) Will-Retry-Until: Sat, 7 Mar 1998 14:14:28 -0500 (EST) To: Remove(a)rmjent.com From: cypherpunks(a)toad.com Date: Wed, 02 Jan 1980 01:47:53 -0500 Reply-To: cypherpunks(a)toad.com

1 0

Re: A funny story [noise]
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

>... someone had left thier keys in the door lock. > So being the good cypherpunk that I am I jumped out and grabbed the >keys from the lock, then knocked on the window. The passenger rolled >down the window and accepted the keys back. Much to my surprise the >passenger was none other than Whitfield Diffie. Let me get this straight. You performed a key exchange with Whitfield Diffie? His keys were publicly available, and you securely transferred them back again? What a concept! Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

Re: NT's C2 rating
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:21 AM 3/21/96 -0800, David Loysen <dwl(a)hnc.com> wrote: >>The fine print says its insecure as soon as its connected to a network. >Ain't nothing fine about that print. An operating system or piece of >hardware may be C2 certifiable. But only a complete system in a specific >configuration can be certified as C2 compliant. The way I read the orange >book, no system with a network connection can ever be C2. A system with a network connection _can_ be C2 or higher rated - *if* it can adequately verify that it knows who its users are. That's hard, but it's doable, if it restricts access to a limited set of users, and has enforcement mechanisms to support it. For instance, connection over an encrypted, crypto-authenticated LAN which can enforce session ownership or trustably label all data packets could work; you'd typically do that with some kind of wrapper over IP or TCP and a bullet-proofed OS interface. It's far cleaner if you can do networking in user space rather than the kernel; I think the UUCP-equipped configurations for AT&T's B1-rated System V/MLS were part of the rated configuration, though it's been a while since I've been near that world. It's also easier if you limit each system (or at least level) to one local user per machine so machine ID tells you user ID. Compartmentd Mode Workstations were just coming out when I last did that stuff, so I don't know quite how much of the Red Book they implement, but they had goals of supporting networked above-B1 computing. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0

Re: Dorothy Denning attacks Leahy's crypto bill
by Bill Stewart 17 Dec '03

17 Dec '03

Hey, wait, are Jim Bell and I supposed to be in fairly complete agreement on something? :-) At 12:09 AM 3/20/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >At 09:45 PM 3/19/96 -0800, Declan McCullagh wrote: ... >>From: denning(a)cs.cosc.georgetown.edu (Dorothy Denning) >"Far easier"? That's an odd statement, because the export of encryption is >easy with or without restrictive laws. How much trouble is a "criminal or >terrorist" going to risk by violating a few measly export laws? It probably would make it much easier for Designated Scary People to use crypto without having to take special precautions. If IPv6 security was part of the standard Microsoft Win2000 networking stack (ok, without major botches, and with a convenient user interface :-), and PGPphone came on the Soundblaster N+1 installation disk, all those tax-evaders and pharmaceutical wholesalers and, and, and father-rapers could talk to their accountants in private and chat with each other about tax-evadin' and father-rapin' and _crime_, and it'd be much harder to Federalize their money and arrest their clients. And a lot of that probably won't happen if Microsoft and Soundblaster have to make domestic and international versions of their software. >>I am concerned that the proposed legislation responds only to a loud >>cry for assistance and is not the reasoned and practiced position of >>our multinational corporations. Well, certainly not the position of MNCs who are big players in the military-industrial complex. But what's this _our_ terminology? In particular, cryptography offers the only technical defense against the ability of computers to centralize and correlate information from many sources, which is one of the primary threats to personal privacy today, and MNCs are generally supportive of centralizing any information they can. >> At the International Cryptography >>Institute, which I chaired in September 1994 and 1995, our discussions >>did not find that this unrestricted distribution of encryption >>technology was required to satisfy business objectives. Well, I'd expect not. It wasn't exactly an unbiased crowd; there were a couple people there on Our Side, but it was largely people who agreed with Dr. Denning on the political objectives, and the business contingent included companies like TIS which _sell_ so-called escrow software. > >Notice that we've already established that this bill in no way produces an >"unrestriction distribution of encryption technology." Wish it did, but it >doesn't. Yeah. >>The Commerce/NSA study did acknowledge that the existence of foreign >>products claiming strong encryption could have a negative effect on >>U.S. competitiveness. However, by allowing encryption services to be >>sold separately from the applications software that uses them, CAPIs >>will make it extremely unlikely that general-purpose software will be >>substantially effected by export controls. Which side is Dr. Denning _on_ here? At present, software using CAPIs is not exportable under the ITAR, since the CAPI is a "component of a munitions system"; is she now advocating legalized export of software using government-approved CAPIs only? >Notice that she seems to be making policy for the government, yet again. She seems to have been the big public advocate of it for years.... >>Export controls are often blamed for the lack of security in our public >>infrastructure. Sure - the fact that Microsoft Office built-in file protection isn't even up to RC4/40 standards isn't primarily the fault of export controls, but the lack of a clearly defined official export standard doesn't _help_ them make a business case for including good encryption. >>Encryption policy is a difficult and often emotional issue. > >It's only emotional because of malicious and counter-productive efforts by >government, and government suck-ups like Denning. She certainly hasn't helped, and she's aided and abetted and provided assistance to the folks like Freeh who want to stop free speech and privacy, but it's also emotional because many of us really don't want our privacy compromised and our freedom of speech restricted. The Bill of Rights isn't perfect, but it's far better than what the government is using today, and it's got provisions like the 9th and 10th amendments to remind readers that it's just a set of examples of civil rights, not an exhaustive inventory. >>I will be pleased to meet with you and the committee for comment and >>questioning, or to assist in any way I can with the development of a >>balanced approach to encryption legislation. I've always enjoyed discussing issues with people who offer an outrageously extreme set of proposals, then back off to a still offensive level and call it "balanced". The status quo already gives too much effective power to the government, and she's proposing to give in where it the alternatives are unenforceable and strenghten her position where there's new power to be seized. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissible." - US government statement on China... "SigFiles of Unusual Size? I don't believe they exist!"

1 0