- cypherpunks-legacy - lists.cpunks.org

John Gilmore the fascist cocksucker
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

Priority: normal X-mailer: Pegasus Mail for Windows (v2.31) John Gilmore is a fascist cocksucker Sandy Sandfort is a censorous motherfucker John Gilmore is a fascist cocksucker Sandy Sandfort is a censorous motherfucker John Gilmore is a fascist cocksucker Sandy Sandfort is a censorous motherfucker John Gilmore is a fascist cocksucker Sandy Sandfort is a censorous motherfucker Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: Netscape rewards are an insult
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Jeff Weinstein <jsw(a)netscape.com> wrote: > David A Wagner wrote: > > I do think their ``bug bounty'' system is an improvement -- at least > > they're showing some concern for security, and beginning to admit > > that outside review of security-critical code is...well...critical. > > The whole bug bounty thing is an experiment. We have no idea how > valuable it will be, but we thought it would be worth trying. As we > gain more experience with it, we will probably evolve it. Mr, Weinstein: Is your comment about the "Bugs Bounty" program an official comment, that you have "no idea how valuable" it will be?? Shall I give you a clue, as to how valuable the discovery of a flawed algorithm might be?? How valuable do you think the ability to download an entire geo-physical company's 3-D seismic data base is, while some company temp is looking at a pretty picture of Moo Goo Gai pan, or downloading a recipe for goat-cheese salad with ginger and macadamia nuts?? Why not admit that the whole Bugs Bounty program was a sham. Nothing more than a quickly slapped together public-relations program, that tried to create an appearance that Netscape had a pro-active business plan. Is it because there WAS no plan, whatsoever?? Why not admit that you were forced to take action and show that you were "doing something" following the crack of the Netscape browser that was supposed to protect sensitive information such as credit-card transactions. And why not admit that what you did was raid a couple of left over press kits, and take out some shirts and cups and throw together a damage control program. Your so-called "Bugs Bounty" program. Is it because, a program that says that anyone who reports a "bug" in your two billion dollar software wouldn't be rewarded -- no, they would be entered into a draw where they _might_ could get a chance to win a cup or a shirt?? Or they might receive a $1,000 reward as long as they agree to a waiver of all their rights, and agree that by reporting the problem to Netscape and entering the "Bugs Bounty" contest, that their report would: "become Netscape's property to be used at Netscape's sole discretion" Is it because, this simply doesn't pass the giggle test?? And is demonstrative of such a cavalier internal attitude and approach to security that it can only be characterized as the grossest of misconduct? I'm certain that even the marketing people must have burst into peals of laughter at that one. Why not admit that Netscape never thought that anyone would find anything at all?? Why not admit that Netscape thought that they could weasal out of the Berkeley crack, with a nice little pat on the head to the kids who found it?? Why not admit that not only did Netscape not have an action plan for "bugs" prior to the "Berkeley crack", but doesn't have any action plan following it. Why not admit that none of the cocky boys at Netscape had even considered what would be done if there was an easily exploitable critical design flaw in the algorithm. And now that someone took Netscape up on its challenge, and simply said that the emperor has no clothes, now that someone hasn't just discovered a "bug" like the "Berkeley crack" but has demonstrated that the Netscape algorithm is fatally flawed, by posting the exploitation algorithm, now what?? Good God, I asked for clarification from Netscape last Thursday, and Netscape hasn't bothered to even return my email from almost a week ago. And, after posting the exploitation algorithm last week -- on Friday the Thirteenth -- there has been nothing but public relations huff-and-puff. Clearly, no one performed adequate top-down / bottom-up analysis at Netscape. And both the internal and external review process were woefully inadequate. Or to steal a line from Jonathan Swift, in Gulliver's Travels. Are you, "a most ingenious Architect who had contrived a new Method for building Houses, by beginning at the Roof, and working downwards to the Foundation ..." and then done nothing else, but issue press-releases to hype and promote Netscape stock in some self-centered attempt to help out your "friends" on Wall Street. >> Still, I do agree that they really oughta be employing true experts >> to carefully evaluate their system, if they wanna claim anything about >> its security. > > We are doing that to. We are paying outside consultants to review >everything related to security. Oh yep, I bet you're paying them. I wonder ... are you paying them in shirts or migs, for their white-wash review?? And will the report from the external review become "Netscape's sole property to be used at the sole discretion of Netscape". Which consultants are you going to get, Mister (unofficial, off the record speaking personally, not speaking for the Company) Netscape spokesperson?? Who? AT&T?? AT&T has security people. The phone company, has very good security people. And the phone company is supposed to have good quality control, (ISO-9000 or TQM or something ...) yet AT&T's own internal security review missed this gaping gash in Netscape browser software. Even now, AT&T is using this software internally within its business units and is ACTIVELY recommending a co-branded version of it to its worldwide customers. Has Netscape informed AT&T about this?? I'm sure that Netscape has piled their best people into their Falcon and are busily jetting them around the world signing confidentiality agreements and retaining every possible outside consultant. Entering into agency agreements to keep the lid on the biggest international news story since the Tylenol or Perrier poisoning. I wonder who Netscape will get to sign?? Who's going to lend their name, so that Netscape can say that "we're working closely with Jerry Lewis" or something similar to solve our security problems. But Mr.Lewis can't go public with what he knows, can he?? Even if he knows that Netscape is fatally flawed. Mr. Lewis will be a Netscape agent at that point, won't he?? And he'll be bound by the terms of his confidentiality agreement, even if the company is actively strategically misrepresenting his confidential report. Who's going to be left after Netscape hires all these outside consultants?? Who do you hire?? Euro-Mickey, Minny and Donald Duck?? Captain Kangaroo?? Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

4 3

(fwd) Anonymous posters & Misinformation = Net pollution
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

Path: math.utexas.edu!news.dell.com!swrinde!cs.utexas.edu!uwm.edu!reuter.cse.ogi.edu!netnews.nwnet.net!news.u.washington.edu!mcdaniel From: mcdaniel(a)u.washington.edu (McDaniel) Newsgroups: talk.politics.misc,news.admin.policy Subject: Anonymous posters & Misinformation = Net pollution Date: 7 Aug 1994 08:13:45 GMT Organization: University of Washington Lines: 39 Message-ID: <32253p$220(a)news.u.washington.edu> NNTP-Posting-Host: stein4.u.washington.edu Keywords: misinformation disinformation propaganda net anon anonymous Xref: math.utexas.edu talk.politics.misc:239273 news.admin.policy:19179 The problem: Anonymous posters supplying pseudo-news reports or otherwise wasting bandwidth in groups more concerened with fact or atleast genuine concerns (such as political talk groups and sci groups.) The soultion: Limited anonymous posters to forums where accountability for what one says is of little concern (such as rec groups where applicable.) OR provide the owners of moderated groups with detailed accounts of the true identity of any anonymous poster who post to a serious newsgroup and make that procedure known to the would-be anonymous user. I attempted recently to secure the actual address of an anon poster who deliberetly spread misinformation concerning a non-existant U.S. Presidential Executive Order and a news-look-alike story dealing with proven falsehoods. Needless to say the administrator of the popular anon.penet.fi server has not been cooperative. I suggest that groups wishing to deal with issues based a little stronger in reality ban anonymous posters and encourage their posters NEVER to repeat information supplied by anonymous posters elsewhere. Some groups have already come to that same conclusion. I believe that anonymous posting is a valuable service in many forums. However, it seems that service is being abused in political and technical newsgroups. I suppose yet another solution would be to make widely known the general untrustability of anonymous posters in groups where truth and fact are paramount. But this letter should go a tiny ways towards that goal. Opinions? -McDaniel

1 0

(fwd) Re: Anonymous posters & Misinformation = Net pollution
by nzook＠math.utexas.edu 17 Dec '03

17 Dec '03

Path: math.utexas.edu!news.dell.com!swrinde!cs.utexas.edu!usc!rand.org!usenet From: Jim Gillogly <jim(a)acm.org> Newsgroups: talk.politics.misc,news.admin.policy Subject: Re: Anonymous posters & Misinformation = Net pollution Date: 7 Aug 1994 15:17:31 GMT Organization: Banzai Institute Lines: 51 Message-ID: <2o7sni$4!nb(a)bogus-site.org> References: <32253p$220(a)news.u.washington.edu> Reply-To: jim(a)acm.org NNTP-Posting-Host: mycroft.rand.org Keywords: misinformation disinformation propaganda net anon anonymous Xref: math.utexas.edu talk.politics.misc:239321 news.admin.policy:19182 In article <32253p$220(a)news.u.washington.edu>, McDaniel <mcdaniel(a)u.washington.edu> wrote: >The problem: Anonymous posters supplying pseudo-news reports or >otherwise wasting bandwidth in groups more concerened with fact >or atleast genuine concerns (such as political talk groups and >sci groups.) .. >Opinions? Since you asked: my opinion is that there are more non-anonymous posters supplying pseudo-news reports or otherwise wasting bandwidth in serious groups. For example, in sci.crypt one poster consistently posts off-topic flamebait, and others consistently take the bait; while there's widespread consternation and killfiling, so far as I know nobody's suggested retroactively moderating him. On the other side, a consistent anonymous poster has produced and released useful crypto and digicash code... I assume his/her identity is masked to avoid ITAR prosecution for sending crypto out of the US without a license. In short, anonymity isn't the problem: cluelessness is the problem. In sci.crypt we may to eventually get rid of off-topic posts by moderating. I would hope the moderators will let anything clueful through, whether it's anonymous or not. I'll point out in passing that an anonymous poster can build up a reputation the same way as anybody else simply by signing articles with the same PGP key each time -- I'd be more confident that a signed message is from Pr0duct Cypher (i.e. the same person who posted as Pr0duct Cypher <last> month) than that an unsigned one is from McDaniel... I could forge one of the latter in a trice. McDaniel also said: >applicable.) OR provide the owners of moderated groups with detailed >accounts of the true identity of any anonymous poster who post to >a serious newsgroup and make that procedure known to the would-be >anonymous user. This sounds challenging. Many of the for-profit services allow the users to pick their own net identity... it's a feature. Do you know the True Name of the person behind the account evidence(a)netcom.com? Do you think Netcom would cough it up without a court order? Either AOL or Delphi -- I forget which, now -- allows users to have several different identities for their Net traffic. How would <I> prove <my> identity to this moderator? Maybe by signing my application to post with my PGP key, which is in turn signed by somebody they trust? Seems quite difficult. <I> certainly wouldn't want that burden as a moderator. I suggest you devote your time to finding a way to suppress idiocy and cluelessness on the Net in general... and if you can have it in place before the fall quarter starts, that would be lovely. Jim Gillogly Trewesday, 15 Wedmath S.R. 1994, 15:17

1 0

(no subject)
by dawg＠frontier.wilpaterson.edu 17 Dec '03

17 Dec '03

hi. i'd like some info. thanks.

1 0

Re: Lotus Notes RSA Implementation Question
by Charlie Kaufman/Iris 17 Dec '03

17 Dec '03

>If anyone on the list has knowledge of the following items, I would be >very gratefull. > >1) What is the key size used by the USA licensed version? > Notes V3 (the one currently deployed) uses 512 bit RSA keys in both the USA and exportable versions. Notes V4 (currently in Beta) uses 512 bit RSA keys for encryption in the exportable version and bigger keys for signatures in all versions and for encryption in the USA version. I'm not sure I'm allowed to say what the key size will be ahead of the product shipping. >2) Considering RC4 is a proprietary scheme, have there been any >concerted efforts to validate it's strength or lack of? If so, could >you give a pointer to any documents I could review. > There has been considerable discussion of the security of RC4 on this list, and some subtle (i.e. worrisome but not disasterous) weaknesses have been found. Lotus Notes' use of RC4 is not subject to the weaknesses disclosed to date because it does not encrypt recognizable plaintext with the first few bytes of the RC4 stream. >...Bob Glassley > --Charlie Kaufman (charlie_kaufman(a)iris.com)

3 2

Re: Who needs time vaults anyway?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>An application that I've seen is financial data, more specifically >MBS payment info. In the real world, there's a trustee/nominee of some sort who does this. What's that to keep that from happening on the net, just like our much maligned (guy's gotta make a living, fer chrissake!) assassination-payoff escrow agent... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

5 4

Hakim Bey mention of gvm't crypto policy
by Jon Lasser 17 Dec '03

17 Dec '03

This is a very brief excerpt from a Hakim Bey piece available at http://www.t0.or.at/hakimbey/boundary.htm, dealing with... well... lots of stuff, actually. Including stuff talked about on the list. I recommend the entire piece highly. Jon -------------------------------------------- Knowledge itself can be seen as a kind of virus. On the psychological level this perception manifested recently as a panic about "computer viruses", and more generally about computer hacking -- boundary violations in cyberspace, so to speak. The government wants access to all computer cypher-codes in order to control the "Net", the InterNet, which might otherwise spread everywhere, transmitting secrets, even secrets about "abuse" and kiddy porn -- as if the Net were a disease, rather than simply a free exchange of information. America's immune system can't take "too much knowing" (or whatever T.S. Eliot's lame-ass phrase was); America must be "protected" from penetration by foreign chaos cabals of evil hackers (who might look just like you and me) -- borders must be imposed. ---------------------------------------------- ------------------------------------------------------------------------------ Jon Lasser <jlasser(a)rwd.goucher.edu> (410)494-3072 Visit my home page at http://www.goucher.edu/~jlasser/ You have a friend at the NSA: Big Brother is watching. Finger for PGP key.

1 0

Re: credit card conventional wisdom
by Rich Salz 17 Dec '03

17 Dec '03

>There is in fact a distinction between "card present" and "card not present" >transactions. AMEX cards for example have an extra group of four digits which >are not part of the embossed card number. They are used as additional >verification to prove that a card is present. So the run-it-through-the-mechanical-device is treated as card not present? /r$

4 5

REMINDER: PARTY! Nov. 18th, sponsored by Community ConneXion
by sameer 17 Dec '03

17 Dec '03

Subject: REMINDER: PARTY! Nov. 18th, sponsored by Community ConneXion Here's a little reminder: We're having a party in a little over a week. I hope you can make it. Community ConneXion: the Internet Privacy Provider is having a party! We're partying to celebrate the spread of privacy on the net, through the increased security of internet products, as well as the growth of our services. (Many new services and new features on existing services will likely be announced before the party. Stay tuned.) We're inviting all our customers and other potentially interested parties, which includes you, if you've received this note. So please join us, and send a copy of this invitation to anyone else you may know who would be interested in attending. Where: Icon Byte Bar & Grill 299 9th Street (at Folsom) SF CA 94103 When: Sat. Nov. 18 1995 7:00 PM This is a good chance to meet and network with the people who are making privacy on the internet a reality. Find out more about the HackNetscape and HackMicrosoft contests. Learn about our specialized web services, found nowhere else but at Community ConneXion. Hear about the anonymous and psuedonymous servers here and what we're doing to improve them. There will be catered snacks and a no-host bar.

1 0