- cypherpunks-legacy - lists.cpunks.org

rise and fall...
by Black Unicorn 17 Dec '03

17 Dec '03

Some time ago on the list someone mentioned a book "Rise and Fall of the Nation State." Can someone confirm author/title information for me? --- "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information

1 0

Re: PC disk wipe software
by Bill Stewart 17 Dec '03

17 Dec '03

>There has been considerable discussion on the MCIP list about how most >*Mac* programs that purport to do this, like Burn, for example, leave stuff >over in disk blocks. My understanding is that this is not a trivial >problem, and it occurs in MUSH-DOS as well.... Doing it _right_ is not a trivial job. Consider disk controllers that map out bad blocks so the OS never needs to see them - if you're trying to remove highly classified data, the fact that Diskwipe won't ever see them might be a serious problem, even if it is close enough for government work. For a more realistic scenario, consider Stacker and other disk-compression software; you don't know what physical blocks the file was written on, or whether overwriting the logical blocks of the file will actually write to the same physical blocks. In some cases you can assume that it probably won't. You also can't expect to write large blocks of 1s or 0s over the disk, because disk compression will turn them into small blocks with run-lengths or equivalent. (Writing PRNG random noise will do, or you can generate counter-based patterns that may work, or do something cryptographically strong if you want to take the time.) #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

2 1

Java=?
by Daniel Miskell 17 Dec '03

17 Dec '03

Being a newcomer to this list, and having read a lot of java-related messages without understanding them fully, could comeone explain to me exactly what java *is*? Thanks for your time, ahead of time. DMiskell(a)envirolink.org --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________ "Oh $HI+, here comes a flock of pushers - 'Jungle Edition.'" -Mortifer Nex, playing peek-a-boo in the trees "If you've got the coordinance, we've got the ordinance to blow up the loved ones who blow you off!" -Uncle Dan's Thermonuclear Explosives, Unlimited

1 0

Baltimore security conference, opening session
by Mike Rose 17 Dec '03

17 Dec '03

I attended the opening session of the National Computer Security Conference this morning. Actually it's been renamed to "Info systems something-or-other", but I don't recall what. The opening session is NIST's opportunity to take center stage, which they did. The most interesting information to come out of the session was that the govt is still pushing very hard for key escrow. Most of the speakers mentioned key escrow, and talked about the need for business and govt to compromise to meet the needs of law enforcement blah blah blah. The "distinguished awardee" is Dennis Branstad, his speech was read by Steven Walker. In it, Branstad claimed that key escrow is a great gift being provided by the government to the private sector, and that companies want it a lot. Stuart Katzke from NIST said that "our" goal (where "our" is computer security professionals) is to deploy secure systems, but he believes that "we" often lose sight of that goal. Said that govt and industry need to find compromises so that both can meet their goals and get systems deployed. I belive he mentioned export laws and key escrow as areas for potential "compromises", but am not certain; if not stated it was implied. My interpretation is that he claims those who object to key escrow are getting in the way of deploying secure systems. Someone, I don't recall who, pointed to the european "interest" in key escrow, saying other govts might not allow systems to be deployed without key escrow, thus key escrow was a good thing. Mike

1 0

Netscape & Fortessa
by Michael G. Reed 17 Dec '03

17 Dec '03

All- I remember there was some talk about Netscape adding Fortessa support on here a couple of days ago, so I thought I'd share this. Marc Andreessen (president of technology for Netscape Communications) made a presentation today at the 18th National Information Systems Security Conference about Fortessa support within Netscape 2.0 to be shipping Beta Q2 '96 and final the second half of '96 (I haven't seen an official press release, but he more or less said they were announcing it today). From his description, it looks like they are going to place the Fortessa drivers right in the SSL layer bypassing the software subsystem that currently exists in favor of the hardware (the software subsystem would still be utilized for non-Fortessa sessions). He also commented that this was possibly a lead-in to other hardware subsystems in the future. General reaction (at least in my immediate vicinity in the lecture hall) was quite positive -- looks like Fortessa is gaining even more momentum (Oracle had a talk about Fortessa support immediately after Netscape). I wonder when Microsoft & company will jump on the bandwagon? :-) -Michael (The above statements are my opinions and do not necessarily represent the opinions of the Department of Defense, the US Navy, or the Naval Research Laboratory.)

4 3

Re: java security concerns
by Rich Salz 17 Dec '03

17 Dec '03

>> >By the way, I suggest that Sun should offer a large money prize for >> >the first significant security hole found the Java implementation. Its >> >a tiny price to pay for security. I notice that netscape just announced that they're doing this.

1 0

How to hold a key signing party?
by jpb＠miamisci.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've never attended a key signing party so I'd like to get some input on the most effective way to run one. What I have in mind is to have everyone who is planning on attending send me their key and its fingerprint. I'll collate the lot and print enough copies of the list of names/fingerprints so that once everyone shows up, each person can get a handout. Everyone presents ID showing who they are and reads off their fingerprint so the attendees can check them on their handout. Afterwards, I'll email all attendees the keys so they can sign them and mail them back to me. Once I receive the signed keys, I'll redistribute them back to the owners & attendees. This seems like a lot of work, which I don't mind, but if there is a more efficient method, I'd like to know about it. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMHrs/mGnwFiC3O2NAQGmMgf/SMeupR1BLe63riBNQklOGgGrLm+7yW3d cqR42cdHnfxGLjy9Jwp+kmN1mHMf+EA+VIEZGC98Q0ZzwGzAnlibXmBOCHuC+6u2 ofRGLXtOB8WKJlJ2uXNjAeeOQcCEaRXmgbPhtqgb2YH7zcsiFRWMjpTi3MwLylXv Vb7SIgayVKuGEx2h43xH0ChjJuyzsdJgRtW5G0e/oBjxcOpdtNrnj4zHmFqu9R/M o4NN/W1S2unF3nvJmZkpKQT7EdVbRFHjdS/RfSqTcqf+WF+yXCo2NnUkdUat5uJh QB1CpIn7Zpw/HZiAp5r87GFy0SiKvwS4QPpsvhIaCa0NGoNqqjhXUg== =Jvxf -----END PGP SIGNATURE----- signoff 2048bit-Fingerprint: 74 64 C7 6F 51 72 36 3D 87 75 F9 F5 2A F6 8F 74 ------------------------------------------------------------------------ Help Phil! email zldf(a)clark.net or see http://www.netresponse.com/zldf

3 2

Re: Certificate proposal
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:46 PM 10/9/95, Hal wrote: >Bill Stewart <stewarts(a)ix.netcom.com> writes: .... >>also a signed attribute statement from the Bank's key that it's a bank, etc. >>The meaning of the certificates changes a bit, but there's still a certificate >>from the bank binding Alice's Key to Alice's Bank Account. > >I can see using keys with attributes in this way, for credentials or as >other forms of authorization. But what about for communications privacy? >What is the attribute that tells you that using this key will prevent >eavesdropping? For communication, the only credential Alice needs to ensure that only Bob can read her message is that she uses Bob's public key. If "Bob the Key" reads it, presumably it was "Bob the Person" who read it. (Again, Bob the Key = Bob the Person to many of us. If Bob the Person has let his private key out, so that Chuck the Person is also able to read the Bob the Key stuff, etc., then of course cryptography cannot really handle this situtation.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

11 24

truth in advertising: Netscape 1.1 on security
by Travis Corcoran 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Message-Signature-Date: Tue Oct 10 11:34:39 1995 This may be old news, but I don't recall seeing it on the list... In version netscape -version Netscape 1.1N/export, 20-Apr-95; (c) 1995 Netscape Communications Corp. I ran 'strings' on the binary, and only got one "about.*security" reference. entering it as an URL about:security yields the ironically humorous (when you consider all of the security bugs): Whatchew talkin' 'bout, Willis? - -- TJIC (Travis J.I. Corcoran) http://www.openmarket.com/personal/tjic/ Member EFF, GOAL, NRA. opinions (TJIC) != opinions (employer (TJIC)) "Buy a rifle, encrypt your data, and wait for the Revolution!" PGP encrypted mail preferred. Ask me about gnuslive.el for emacs. -----BEGIN PGP SIGNATURE----- Version: 2.6 Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMHqSl4JYfGX+MQb5AQFLKwP/RDsLzLxZkB18uSlV9lxp9nJ6uRilYYAE m1gv4KKmtNnWLowlrr605iv1L7DUvQTRpGKANcLZDEsKZFYnjT/VBSN+/Jnoe6GX VFNiSALrvX/IZjxf8FQ2xfyBYWF7J/DxTWP3QHjW9hc06Sx2fzCHdn4HItAteDwr aWO8dM3XYzY= =8udJ -----END PGP SIGNATURE-----

2 1

Re: PC disk wipe software
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199510091318.JAA24166(a)jekyll.piermont.com>, perry(a)piermont.com ("Perry E. Metzger") wrote: > I thought I'd ask here, since its related to a lot of the stuff people > have written for the PC platform in these parts. I need to securely > wipe a bunch of data from an MS-DOS hard drive, so that it can't be > recovered. Are there any readily available utilities for this? Will > any of them selectively erase only data that isn't allocated to > existing files? Whatever you use, check its claims with a disk editor. None of the various wipe utilities for the Mac that I am aware of (Norton, Burn) work as advertized. They all invariably fail to wipe the slackspace at the end of allocated, but not fully used blocks. Consequently, several kB of data left behind in said slackspace by previously deleted files will be missed on your average drive. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMHmgGioZzwIn1bdtAQFEsQF8CYfksEosFfBJoQckOM390b7CBeupCtrf T2Var/yEUwuT5lxH7xJ6y9p69wfaljtz =Hkkv -----END PGP SIGNATURE-----

2 1