- cypherpunks-legacy - lists.cpunks.org

News from the Front (July Issue)
by news＠sldc.ffg.com 17 Dec '03

17 Dec '03

An update to our customers and friends on happenings at ----------------------------------------------------------------------- F O R E F R O N T - Taking the Chaos out of the 'Net http://www.ffg.com Newsletter 7/23/97 ----------------------------------------------------------------------- Contents: I. News from the 'Front II. Hot Tip III. Special Offer ----------------------------------------------------------------------- I. News from the 'Front ForeFront enrolls hundreds in FREE e-mail course! ForeFront unveils its Internet Research Course, the first of ForeFront's free e-mail courses helping Internet users become more productive. - http://www.ffg.com/courses/internetresearch.htm WebSeeker Special Editions Released! In addition to searching the Web, WebSeeker Legal Research Edition searches over 35 search engines specific to the Legal Profession. Get your own >online legal assistant now! - http://www.ffg.com/seeker/lre.htm TechSeeker searches over 100 online technical resources, including the popular online press, standard search engines, and Usenet Newsgroups. Let TechSeeker find the technical information you need right now! - http://www.ffg.com/seeker/techseeker.html GrabNet update released online! - http://www.ffg.com/grabnet/ GrabNet, ForeFront's amazing bookmarking tool, allows you to quickly and easily organize everything of interest you come across, web page, graphics, or text! A must have for anyone compiling online information. Brother's newest Printers now come with ForeFront's Internet Products! - http://www.ffg.com/press/05_97brother.html ForeFront Introduces MCSE Self-Study Course! - http://www.ffg.com/press/05_97MCSE.html Now you can easily prepare to become a Microsoft Certified Software Engineer, the hottest certification around! ForeFront Streamlines NetWare Administration with ConsolePro! - http://www.ffg.com/press/5-97ConsolePro.html Tame your Netware Network directly from the Server! ----------------------------------------------------------------------- II. Tip o' the Day Tired of Downloading Lots of Files you don't want with WebWhacker? WebWhacker 3 only downloads what you want! If you are tired of using precious disk space up with useless files downloaded by WebWhacker, then you need WebWhacker 3's Content Filters! With these filters you can choose not to download any files with certain file extensions, files that are too large, or secific MIME types. For example you could choose to only download .WAV files and not .AU if you had Windows 95 and not a Macintosh, and only if the files were less than 100KB in size. There is no end to the filter combinations you can use! To use the Content Filters, click the Content Filters... button on the second step of the URL Subscription Wizard or view the Filters Tab of a URL's Properties. If you don't have WebWhacker 3 then buy it now! - http://www.ffg.com/whacker/ If you have an earlier version of WebWhacker then upgrade now! - http://www.ffg.com/whacker/wwupgrade.html ----------------------------------------------------------------------- III. Special Offer FREE GrabNet! ForeFront would like to offer you, our V.I.P.'s, the new version of GrabNet, for FREE! All you need to do is purchase a copy of WebSeeker! With this dynamic duo you can find and organize everything of interest on the Internet! Take advantage of this opportunity at http://store.ffg.com/seeker_special/ ----------------------------------------------------------------------- This newsletter is only sent to those who requested the newsletter and those who downloaded, registered, or evaluated our software. If you wish to unsubscribe from the ForeFront newsletter mailing list, please visit http://www.ffg.com/press to Unsubscribe.

1 0

How Does Fortezza Work?
by Alan Tu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi all, I am writing an article to help people understand the technical and practical issues surrounding the key escrow debate. Can someone tell me how the Fortezza chip works. I have a 1993 document which is incomplete. Is the session key K still encrypted with the unit key U? And is that whole thing encrypted, with the serial number, with the family key F? I'd appreciate some more current info. You will be credited in my article. Alan Tu -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: Requires PGP version 2.6 or later. iQCVAwUBM9zSwZezmBrl2RXhAQEF3AP+Nw3xwRh+fwxXtNDIK8Eo0BiZiyHNnKHo vyPqe/V3OrK6k3U9iHAiajCodpvQpb6uaPE+YiKwymtLdzEqUp2AcxubV9/7XIk1 cKrdsTEvBFMnPV0DN0H3UFqPivsJJ3beRifAjP07xOUiiw7b0dyiDFwPnyNLm40w BRl2Dvxv5Ow= =tDzB -----END PGP SIGNATURE----- Type Bits/KeyID Date User ID pub 1024/E5D915E1 1997/04/27 Alan Tu <atu5713(a)compuserve.com> Alan Tu <102534.2165(a)compuserve.com> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i Comment: Requires PGP version 2.6 or later. mQCNAzNivkwAAAEEALdGUXD3j+RioIirVG46N6LaGD3YMMVVT5Mjwr5JojQsDICy 856I06Ugo/Fqid2A/os7v/gwE+Sj/WhMERgTsTejUZtsucTpS9sae+cc27Fjjq1l hOnqcLZqnHDDNyn3+jesVFPLnRlSoHbmcBK1XDW/SJT1anZz55ezmBrl2RXhAAUR tCBBbGFuIFR1IDxhdHU1NzEzQGNvbXB1c2VydmUuY29tPokAlQIFEDOguk6Xs5ga 5dkV4QEBBF8D/1B0ePqlMavWEUMP0uTmyvWFI7jooAcih6uHZFo2u+u3EzE2Is8X EoLHg39DhjleTHPu6TnGsWIiwDYEslzYeVw/Cglx6eliYIr/qs7peEywuhtZsEFH ln6yR9IE6rX3b3GCvPSQ5uPhXWrd2kWaZvG4rQ4Oj1m3yTrFaPRqCBPvtCRBbGFu IFR1IDwxMDI1MzQuMjE2NUBjb21wdXNlcnZlLmNvbT6JAJUDBRAzyUJWl7OYGuXZ FeEBAc4TBACT8gLtyE0C8NBGs9aDa9kHfeNzN8VbNfUpoOiWi4duAAZFiAt/e+ji J2BUMLIY8kzm2WX4mVzpKYjvea5TtHeQgbESV1HVZ5k7abENMUYz5nSMloOE+bb+ XRzgGgFF3htGXDJNywlLNgoYi5vTMT0pbGlCzOu215Cc4mFls2w1iA== =CM85 -----END PGP PUBLIC KEY BLOCK-----

1 0

Home Sweet Home!
by admax＠elan-vital.com 17 Dec '03

17 Dec '03

Hi, I was wondering if you would like a FREEoverview of a home business which can bring you both PERSONAL and FINANCIAL FREEDOM. If so, please reply with the word "freedom" in the subject header and I will send it right away. Sincerely, Dan Askew "Free at Home" Home Business Owner 801-325-5204 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ We belong to the Direct Email Advertisers Association and the On-line Marketers Association. Both of these organizations promote professional and responsible use of email marketing. If you need bulk email services, accounts, resources, flame-proof emailing, or any of a host of services, go to: http://www.thehitman.com Type "askew" in the "who referred you" field. P.S. Should you prefer not to receive notices, please reply with the word "remove" in the subect header. Thank you.

1 0

How Does Fortezza Work?
by Alan Tu 17 Dec '03

17 Dec '03

Please send replies to atu5713(a)compuserve.com -----BEGIN PGP SIGNED MESSAGE----- Hi all, I am writing an article to help people understand the technical and practical issues surrounding the key escrow debate. Can someone tell me how the Fortezza chip works. I have a 1993 document which is incomplete. Is the session key K still encrypted with the unit key U? And is that whole thing encrypted, with the serial number, with the family key F? I'd appreciate some more current info. You will be credited in my article. Alan Tu -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: Requires PGP version 2.6 or later. iQCVAwUBM9zSwZezmBrl2RXhAQEF3AP+Nw3xwRh+fwxXtNDIK8Eo0BiZiyHNnKHo vyPqe/V3OrK6k3U9iHAiajCodpvQpb6uaPE+YiKwymtLdzEqUp2AcxubV9/7XIk1 cKrdsTEvBFMnPV0DN0H3UFqPivsJJ3beRifAjP07xOUiiw7b0dyiDFwPnyNLm40w BRl2Dvxv5Ow= =tDzB -----END PGP SIGNATURE----- Type Bits/KeyID Date User ID pub 1024/E5D915E1 1997/04/27 Alan Tu <atu5713(a)compuserve.com> Alan Tu <102534.2165(a)compuserve.com> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i Comment: Requires PGP version 2.6 or later. mQCNAzNivkwAAAEEALdGUXD3j+RioIirVG46N6LaGD3YMMVVT5Mjwr5JojQsDICy 856I06Ugo/Fqid2A/os7v/gwE+Sj/WhMERgTsTejUZtsucTpS9sae+cc27Fjjq1l hOnqcLZqnHDDNyn3+jesVFPLnRlSoHbmcBK1XDW/SJT1anZz55ezmBrl2RXhAAUR tCBBbGFuIFR1IDxhdHU1NzEzQGNvbXB1c2VydmUuY29tPokAlQIFEDOguk6Xs5ga 5dkV4QEBBF8D/1B0ePqlMavWEUMP0uTmyvWFI7jooAcih6uHZFo2u+u3EzE2Is8X EoLHg39DhjleTHPu6TnGsWIiwDYEslzYeVw/Cglx6eliYIr/qs7peEywuhtZsEFH ln6yR9IE6rX3b3GCvPSQ5uPhXWrd2kWaZvG4rQ4Oj1m3yTrFaPRqCBPvtCRBbGFu IFR1IDwxMDI1MzQuMjE2NUBjb21wdXNlcnZlLmNvbT6JAJUDBRAzyUJWl7OYGuXZ FeEBAc4TBACT8gLtyE0C8NBGs9aDa9kHfeNzN8VbNfUpoOiWi4duAAZFiAt/e+ji J2BUMLIY8kzm2WX4mVzpKYjvea5TtHeQgbESV1HVZ5k7abENMUYz5nSMloOE+bb+ XRzgGgFF3htGXDJNywlLNgoYi5vTMT0pbGlCzOu215Cc4mFls2w1iA== =CM85 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: CPAC, XtatiX, and the Censor-State
by Mike Duvos 17 Dec '03

17 Dec '03

In alt.cypherpunks, Censorship Suck <FBI(a)Sucks.NSA> writes: > That's pretty bad, when there's not even any sex. Yes. Most of these Web pages are not even political or sexual in nature, but cute boys anywhere on the Net these days cause the Fundies to have Grand Mal seizures. > My previous suggestion was to create "virtual" WWW sites > (when necessary, possibly as a stop-gap measure when there > is a censorship attack). I read your earlier post, and find the notion of hosting Web sites on Usenet intriguing. Tim has always pointed out that Usenet already exists as a persistent uncensorable repository of virtually everything, and that applications (eg BlackNet) needing such a facility should simply use the existing one. > By virtual, I mean by posting to USENET, probably encrypted, > with the decryption key following a couple days later. > It involves considerable development for either a newsreader > or preprocessor, but then, the work is implied. A > "gathering" design is necessary. Conceptually, seamlessly extending the Web over Usenet is not complicated. Each document could be posted as a single PGP conventionally encrypted article, with some reasonable convention for encryption keys and message ids that would enable links to be followed. Browsers could be modified to maintain a open connection to an NNTP server, and to fetch and decrypt articles specified by an nntp:<message-id> link in lieu of using http. Suppose I post my favorite banned Web pages to alt.anonymous.messages on a weekly basis, and distribute browser plug-ins and patches to enable Usenet to host Web content. I forsee the following glitches. First, as anyone who has posted a large number of articles to Usenet knows, many servers will only get a subset of them. Second, policy for article expiration is site-specific, and can be made to depend on a number of parameters. Posting once a week may be fine for some servers, and not for others. Third, it is only practical to employ Usenet to host static Web content. This rules out Web-based chat boards, and other such politically interesting content, as well as anything that is cgi-bin based. Fourth, Web content on Usenet will be in an easily identified format and trivial to filter out at local sites. > Because you are exactly right: the ISPs can be attacked, > regardless of the fault-tolerant design of the Internet. > Some version of the above tool WILL route around "damage" > attempts. > Interesting, that this would in part require cryptography. > Would the government go so far as to try and outlaw crypto > posts to USENET? Good luck. Odder things have happened. > Someone should make a complete list of all the > contacts/emails involved in contacting ISPs to get them to > censor. There may be something to learn. (sort of a traffic > analysis deal) It's the "usual suspects." We know who they are, and they are making no attempt to keep their activities secret. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch(a)zipcon.com $ via Finger $ {Free Cypherpunk Political Prisoner Jim Bell}

2 3

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Timmy May's 16Kb brain's single convolution is directly wired to his rectum for input and his T1 mouth for output. That's 16K bits, not bytes. Anal intercourse has caused extensive brain damage. \ o/\_ Timmy May <\__,\ '\, |

1 0

y2k problem *serious*
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

some people have talked about the y2k problem here, the "year 2000 problem". as programmers know, is the name given to the glitches that are caused by software malfunctioning because it only used 2 characters for the date field. I have mentioned that I think government agencies are going to be particularly hard-hit by this situation. I envisioned delays in payments etc. of something like a few weeks or so. however some recent new data and analysis by someone named Gary North causes me to rethink my position. it's somewhat alarmist, but he's got some excellent evidence. he believes the year 2000 problem is vastly more serious than anyone has realized. he thinks it may even lead to bank panics and instabilities in the entire worldwide economic system. he quotes Yourdon, a very respectable software professional, who talks about the domino effect in software such that even if parts of it are fixed, the erroneous sections can cause the system as a whole to fail. I suspect that we will be seeing some major, major news events related to y2k over the next year, all the way up to 2000. more info on this perspective can be found at www.garynorth.com this will be an incredibly important issue for virtually all programmers in the information field. (some cryptoanarchists here might rejoice at the potential here for mass social disruptions. may you live in interesting times.) The Yourdon Report Vol. 1, No. 4, June 1997. © Copyright 1997 by Cutter Information Corp. The Personal Consequences of Year 2000 Dear Colleague, Where will you be on New Year's Eve, 1999? If you're involved in the computer field in any way, there's a high likelihood that you'll be frantically working on the last-minute details of a year-2000 project. Yes, I know, not everything is written in COBOL and not every hotshot Java programmer is interested in the problem. But if you're an application programmer who normally develops business applications in Visual Basic, PowerBuilder, Smalltalk, or COBOL, there's a good chance that your organization will give you a temporary assignment to help out with converting mission-critical systems that are too important to fail. If you're a new-age Java programmer in a Silicon Valley startup company, maybe you'll be able to ignore the whole thing; but for many of the people who write software, 1998 and 1999 will be the years of year-2000 death march projects. I assume that anyone who reads this newsletter is familiar with the basics of the year-2000 problem; I won't bore you with a repetition of the details, or how we managed to get ourselves into this state. What I do want to talk about is the notion that it's our organizations that got themselves into this state, and that we have to make sure we distinguish between the problems and demands of our organizations, versus the problems and demands of our own lives and the lives of our families and friends. First, let's deal with the basic moral issue of culpability and responsibility. As you well know, there are some enormous legacy mainframe systems that will fall over and collapse on January 1, 2000, unless a thorough, expensive, and time-consuming effort is made to make them year-2000 compliant. But it's highly unlikely that you wrote the original code for those systems; indeed, the original programmers are probably long gone, maybe even dead. Or, ironically, those programmers may have been promoted: They may be your boss, or your boss's boss, or the CIO of the whole shop. In the rare case where you actually worked on the applications that now require year-2000 maintenance, chances are that nobody paid attention 15-20 years ago if you recommended that the date be coded with a four-digit year field. You were told how expensive memory was, and that none of these systems would last through the 1970s, or the 1980s, or the 1990s. In other words, with very, very few exceptions, the year-2000 problem is not your fault. Maybe we should have been smarter 20 years ago, and maybe we should have staged a mass revolt when our business users told us that they didn't want to spend the money for an extra two bytes of storage every time a date field was required within an application. Maybe they didn't really understand the significance of the short-term tradeoff that we made on their behalf. But after all, it was their money and their systems. In any case, there's a good chance that you can look at yourself in the mirror and honestly say: It's not my fault. Perhaps you feel that, as a member of a more-or-less professional category of "knowledge" workers, we all share collective responsibility for letting society get itself into the year-2000 dilemma. After all, what if mechanical engineers told us that a flaw in their calculations would lead to bridges and buildings falling over and crashing on January 1, 2000? What if they collectively shrugged their shoulders and said, "Well, it's not our fault. Newton, Galileo, and Einstein made a few miscalculations in their basic laws, and we just realized the problem." From that perspective, none of us really wants the IT community to end up with a huge black eye, or with the blame for having caused a massive economic and social disruption associated with year-2000 software problems. I'm willing to contribute some time and energy to help solve the problem. I'm willing to say, "Well, it doesn t really matter whose fault it is at this point. The most important thing is to fix the problem, and then move on." But what if the problem cannot be fixed? What if January 1, 2000, arrives and half of your company's software has not been converted? What if your organization collapses as a result? At that point, where does your responsibility lie? The interesting thing about this is that almost every organization could have fixed its year-2000 problem if it had begun addressing the problem in 1995 or before. But if the year-2000 conversion team is just forming now, in mid-1997, then the conversion almost certainly won't be finished when New Year's Eve rolls around two years from now. And that part of the problem is the fault of senior management, which was too busy worrying about other issues to focus on the biggest software project of all time. Let me stop for a moment and address a basic point: Many software professionals believe that the year-2000 problem will be somewhat annoying, and somewhat expensive to fix, but they can't bring themselves to believe that it could be a major, fundamental problem. It's like asking the residents of Southern California if they really believe that they're going to wake up one day and find that the San Andreas Fault has finally ruptured, and that California is now an island floating in the general direction of Hawaii. "We've lived with plenty of earthquakes, and some of them have been pretty serious," these folks will tell you. "Someday, the Big One will hit, but I really can't believe it's going to happen this year, or next year, or the year after." So here's the question: Do you believe the year-2000 problem is going to be really serious? Do you think it could shut down telephone service, banking systems, and airline systems for a few days, or a few weeks, or even a few months? I've been thinking about all of this during the last several months, and I'm becoming increasingly worried about the "ripple effect" problems that will be difficult to anticipate, and almost impossible to avoid. It won't be the end of civilization, but the year-2000 problem could indeed trigger a depression on the scale of the Great Depression in the U.S. during the 1930s. For example, consider XYZBank, which has 300 million lines of legacy code. Assume that XYZ has the time and resources to convert 200 million lines, and it has done a triage to ensure that the mission-critical systems are converted. That leaves 100 million lines of unconverted code that won't run at all, or will spew out gibberish. Since this unconverted code is associated with noncritical systems, it won't have a fatal impact on XYZ though it could incur a nontrivial cost. My real concern is that the applications XYZ considers noncritical might be very critical to some of XYZ's customers, partners, suppliers, etc. So it's quite possible that XYZ's failure to convert some of its software will cause little, tiny ABCWidget Company to go bankrupt, which causes slightly larger DEF Corp. to fold, and so on. Meanwhile, XYZ can't operate entirely alone; without electricity, phone service, and water, the offices can't function; without transportation services, none of its employees can come into work, and none of its customers can visit the bank to transact business. Let's assume for a moment that these basic utilities do continue operating properly after January 1. But what if the Federal Reserve Bank, S.W.I.F.T., and all the other banks that XYZ interacts with are having problems? What if XYZ's ability to print monthly bank statements depends on PQRPaper Corp. supplying laser-printing paper on a "just in time" basis? And what if PQR has a staff of three overworked programmers who maintain an ancient legacy system written in assembly language? If PQR stops shipping paper, then XYZ stops sending bank statements. Not forever, perhaps just for a month or two, but that's enough to cause a lot of confusion. There's also going to be a lot of confusion resulting from bugs injected into the converted programs. If XYZBank converts 200 million lines of code between now and December 31, 1999, then there will be an enormous amount of testing, and with that much code it's inevitable that some bugs will slip through. Maybe not fatal bugs that delete the database or shut down the bank's systems, but perhaps the kind of bug that will send incorrect monthly statements to 100,000 of the bank's 3 million customers. A problem like this might not be noticed until January 31, or when the year-end statements are produced on December 31, 2000. The problem with 100,000 incorrect statements is that it will generate 100,000 angry phone calls. Indeed, officials at the Social Security Administration (SSA) are quoted as saying that if the SSA has a 1% error rate in its retirement checks and other benefits, it will lead to somewhere between 43 and 50 million phone calls, starting the day after the checks are mailed. If the problem isn't resolved right away, then those people are likely to call back the next day, and the day after that, and the organization is likely to be in a state of paralysis. Back to the banks again: Do I really think that Citibank, Chase, Chemical, and BankAmerica (along with all the huge Japanese and European banks) are going to shut down on January 1, 2000? No, of course not. But I won't be surprised if the XYZSavings and Loan in South Poobah discovers that it can't process deposits and withdrawals for a week or two. That problem might cause a run on the bank, or an outright bank failure, and similar problems are likely to occur for a number of other small organizations as well. General Motors (GM) won't go bankrupt, but ABCWidget and PQR Paper could. Indeed, if ABCWidget goes bankrupt, it could cause serious problems for large companies like GM. Suppose ABC is one of the 100-odd companies that supply parts for GM cars and the widgets manufactured by ABC are an essential element of the transmission system. Because of the lean manufacturing system used throughout U.S. industry today, there's a good chance that GM doesn't have an inventory of widgets; ABC is supposed to deliver the appropriate number of new widgets to the GM plant every day. To ABC's surprise, its computers fail on January 1, 2000, and its widget production line shuts down. A week later, GM's production line grinds to a halt until it can find a replacement widget manufacturer. Meanwhile, GM's factory workers are furloughed without pay. By now, I'm sure you get the drift of my concerns. The interesting thing is that while software professionals and systems analysts are well-equipped to understand the reasons why the software could fail, and the possible consequences of those failures, they prefer to deny it. I wasn't aware of this until I watched Peter de Jager's year-2000 presentation at our recent Summit 97 conference, which ended with a question to the audience: "How many of you really believe these problems will occur?" To my surprise, a significant number of people raised their hands to indicate they did NOT believe that serious year-2000-related failures would occur. They couldn't disagree with any of the technical points that de Jager raised, just as you probably won't find anything fundamentally wrong with my arguments here. But de Jager's audience, and many of the people reading this newsletter, don't want to believe things could be this bad. "Surely," people will argue, "companies will find a way to solve this problem." Given our track record for normal software projects over the past 30 years, this argument borders on hysterical optimism. More likely, it's cognitive dissonance: If the facts disagree with the conclusions you were hoping for, then ignore the facts. What does all of this have to do with your job? Well, first you need to realize that a "denial of reality" may be taking place within your own organization today. Has your CEO or board of directors made a public commitment that all of the organization's systems will be year-2000 compliant, and that there is a detailed plan for coping with the organization's non-year-2000-compliant vendors, suppliers, customers, etc.? Do some arithmetic: If your company has 100 million lines of code in its application portfolio, then as of June 1, it would need to convert more than 100,000 lines of code per day, every day, in order to finish the job on time. Do you see the plans, the people, the tools, and the management commitment to make that happen? If not, what will be the impact on your job? Chances are that your company will go into panic mode sometime in 1998, halt all of its development work, and assign everyone in the IT department to work on year-2000 conversions. When I say everyone, I mean everyone. Secretaries will be drafted into the testing effort, and the managers will be expected to begin writing COBOL code. Is that the kind of environment, with everyone putting in double overtime, that you want to work in? And if the year-2000 conversion isn't finished on time, who will be blamed? You can be sure there will be lawsuits; are you sure you'll escape the wrath of the lawyers? If your company's year-2000 problems are very severe, what happens if it goes bankrupt? Will you be able to get another job? (An even more interesting question: At that point, will anyone want to admit that he or she is a programmer, or will it be a social stigma after January 1, 2000?) If you're out of work for six months, do you have enough money in the bank to support your family? Speaking of banks, what if your savings account is in XYZSavings and Loan of South Poobah? If depositors begin to worry about XYZ's year-2000 compliance in late 1999, will they begin withdrawing all of their money? If they do, will you be able to withdraw your money on January 3, 2000? Indeed, given the delicate balance of the fractional reserve system used by banks, it doesn't take a very large percentage of panicky customers to cause a bank run. The worst-case scenario in this area is pretty scary -- it might not be just the XYZSavings and Loan that suffers a bank run, but the big banks too. If the banks close for more than a couple of days, then how does the government collect taxes? If the government can't collect taxes, what happens to the value of its bonds, T-bills, and other financial instruments? Meanwhile, how many non-year-2000-compliant railroad and trucking companies will it take to disrupt the transportation infrastructure? While you're thinking about this, keep in mind another aspect of the lean manufacturing system -- the average grocery market, especially in urban areas, has to be restocked every 72 hours. I don't have answers for all of these questions, and I spend a portion of each day wanting to believe that none of these crises will occur. But I can't find a way to deny the possibility that they could occur, not exactly in the way I've described, but as a series of domino-effect problems that ripple through society. And if my software experience allows me to anticipate some of this, then your experience should provide similar insights. Think about this, and try very hard to avoid the cognitive dissonance problem. If the problem is anywhere near as bad as I think it could be, then you have to think very carefully about your loyalties and priorities. Will your employer get first call on your loyalty, or will it be your family and loved ones? On January 1, 2000, will you be at your keyboard, still converting two-digit year fields? Think about this now, while things are still calm. It won't be so easy two years from now. Ciao! Ed Internet: ed(a)yourdon.com Web site: http://www.yourdon.com

7 6

RE: Queries from a Cyper-newbie?
by Chris Avery 17 Dec '03

17 Dec '03

1. Thanks for the comments. I indeed meant "crackable" when I said "unencryptable", as you surmised. I'll learn. 2. I don't precisely know what it means to "change hashes" on RSA keys, though I get the drift. Where can I go for details? 3. I'll do the www.crypto.com thing, thanks for the pointer. This may be a critical last stand on the privacy of communications issue. What gets me is the blind arrogance with which govt "servants" assume that their (even if legitimate) pursuit of crime somehow excuses or justifies diminishing privacy rights for everyone else. There must be some kind of ratio: 1,000,000 rights diminished for 1 criminal activity detected? Doesn't make sense. Thnks. ---------- From: bennett_t1@popmail.firn.edu[SMTP:bennett_t1@popmail.firn.edu] Sent: Monday, July 28, 1997 5:35 PM To: Chris Avery Cc: cypherpunks(a)toad.com Subject: Re: Queries from a Cyper-newbie? -----BEGIN PGP SIGNED MESSAGE----- At 03:45 PM 7/28/97 -0700, you wrote: >Anybody willing to offer a bit of help to a cypher-newbie? I'm trying to sort out a few of the basics: Well as long as you ask like that instead of what most newbies do, such as try and subscribe by sending "Add me to the mailing list" to the list. >1. PGP 5.0 -- good software? It's better integrated for Mac Lusers and Windows 95ers. It is, however, flawed in some respects. >If not, what problems? Why to use DSS vs/ RSA keys? How is 5.0 different than 2.6.3i ? Which is better? 2.6.3i cannot use CAST, or (who would want to , it's DES!) Triple- DES. It does however, can use other hashes with RSA, thanks to someone's discovery on PGP-USERS. 2.6.3i is dos native, and complex. A shell integrates nicely, but it's still not the same. >2. Are emails encrypted using PGP 5.0 decypherable by PGP 2.6.3i (and vice versa?) Using RSA keys? ONLY using RSA keys. DSS/Diffie-Hellman support is being added to old PGP's. RSAREF is used in PGP 5.0 . MPILIB, Phil Zimmermann's original PGP RSA algorithm implementation is used in international versions. It's becuase of RSA's patent stuff. >3. I understand certain encryption s/w cannot be legally exported, I am aware that such s/w is nevertheless being used (and built) abroad. My queries: Is purely domestic use being threatened by the pending legislation? Is it already illegal to send an encrypted msg out of the US? If so, is it illegal to receive an encrypted msg from outside the US? Unless it is the "shitty 40 bit" type. It can be built abroad, for example, IDEA was made in switzerland, or something like that..., PGP 2.6.3i was made legally, I think. Domestic use is being threatened by Nazi Motherfuckers like Billy-Bob Clinton [spit], The FBI, and the NSA. Oppose them. Go to www.crypto.com and do some of the stuff there. Sending and recieving mail from the outside of the US *is legal*. >4. How strong is strong? My MS Explorer has the 128 bit encryption scheme to secure domestic financial transactions (such as credit cards). How "un-encryptable" is this? I read some recent postings here re difficulty of breaking 128 bit keys -- but this had reference to stronger methods of encryption than MS Explorer uses, right? So 128 bits is hard to break (umptyump years, terrawatts, etc.)? Then why does my PGP 5.0 software offer keys that are 768, 1024, etc. up to 4096 bits in length? Are these numbers on the same scale? Unencryptable? What the fuck are you talking about? If you mean crackable, let's just say it'd take several time the age of the Universe to crack it. The RSA keys are weaker than symmetric cyphers, unless we're talking about DSS/Diffie-Hellman keys with 4096bits. They are not on the same scale. >Any "strength" differences between RSA, DSS, and Diffie-Hellman? IS there some layman-understandable difference between these? Well, RSA's are patented and RSA is really anal with their patents. DSS/Diffie-Hellman keys are unpatented. You can change hashes on RSA keys (RIPEM160, MD5 [was broken already], and SHA-1). But to use those RSA's with older PGP's, use only MD5. >5. Is international data traffic somehow monitored (or monitorable) to detect encrypted traffic? It can be detected that you're using encryption. Breaking PGP is another thing. If any other cypherpunks want to correct me here, do so. -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBM9065B0+FhmmTrSJAQEdsgQAmRAJR7CxQCy4Wfny8YM6oJ3chLKnJCnA E45EElRsAVS8zyAWy06/ZJFG8XjInjgAzmx+fRvGoN0qHvObyFfrDMPML0w+405s cddgcApc0DfbjP8narKHVBQnbOhwuSjdDbwTbFF9F+EG0OkXewgYKXS/QnS11ov/ ofr4ooPGcr0= =rowH -----END PGP SIGNATURE-----

1 0

Will Spam For Food (Not Spam) / Re: Spare DigiCa$h? / Re: AN APPEAL TO THE HUMAN RACE
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I find it interesting that the cynical/sinister/paranoid cypherpunk list members seem to be the ones who are most able to predict the future trends of events on the Internet, particularly in areas which surround very major and very minor issues. The Tim May's and Declan McCullagh's shed interesting light on the future course of major events while the Monger's and Dog Boy's turn their precognitive abilities in the direction of the more mundane aspects of the Internet as a reflection of humanity/society. The "Spare DigiCa$h" post gave me pause to reflect how long it will be before technology is sufficiently developed that when we hit our <Pause> key, "CyberBums" will approach and offer to clean our video monitor with an oily rag. Will we be cursed for offering CyberBums a form of e$pare- change which cannot be spent on email-order wine? Will laws be passed which prevent CyberBums from approaching us for e$pare-change within two relay hops of an eCa$h site? Will CyberBums sort through our killfile dumpsters for eTra$h? Was it Kevin Mitrick whose conditions of probation required him to stay off the Internet and away from computers? Will the future bring laws which permit restraining orders against individuals accessing certain parts of the Internet? Sex offenders/sex sites; burglars/financial sites; pedophiles/children's sites? It seems to me that increasing regulations and laws surrounding the access and use of the Internet will require strict laws requiring the user to be able to show verification of identity/age/criminal history/ financial history/(approved government) reputation capital, and all manner of information to place us all in categories needed to monitor our compliance with laws and regulations. Once browsers are required by law to support a certain rating system and children manage to get around it, there will no doubt be laws passed requiring fascist monitoring of who is actually using the software.(And LEA's who demand that phone companies provide them with the ability to trace/locate cellular phone users will undoubtably want the same capabilities with Internet users, in a war against anonymity.) There will be no shortage of James Love's, Kent Crispin's and Hallam- Baker's to call for "reasonable compromise" in order to facilitate fascist censorship on things which we all "unambiguously" agree on (by _their_ way of thinking, of course). The only way to prevent the atrocities perpetrated upon our rights to freedom and liberty in physical space from becoming the norm in CyberSpace is to fight against the systems, the governments and the individuals who are striving to extend their fascist control by building ElectroMagnetic Curtains in CyberSpace, is to prepare now to fight against Electronic Oppression--to prepare for an Electronic Revolution--now. CyhperDog ~~~~~~~~~ {This post contains an Email Rating System classification of: Redundant Cowardly Anonymity.} (This means than an Anonymous Coward is posting in reference to one of his/her own posts under a second anonymous pseudonym.) -------------------------------- The first Anonymous Coward wrote: > amaninneeeedeer443553444(a)aol.com wrote: > > PLEASE HELP > > What follows is an example of the CyberBums predicted by one of the > list members some time back. This A(ssh)OL(e) is using his spambot to > "Spare change?" millions of people at a time and it turns out that > besides his required, basic tale of woe, that he also has the proverbial > parent who is dying from cancer. > > Don't send him any money. > Send *ME* money. I will use it to buy enough cheap wine to enable me > to throw up on my shoes. > (Wouldn't you rather send your hard-earened money to an honest drunk > than to a lying bum?) > > CyberBum > > ----- > > I WAS A SMALL BUSINESS OWNER IN THE ATLANTA AREA. I RAN THIS > > BUSINESS SUCCESSFULLY UNTIL ABOUT 60 DAYS AGO. AT THAT TIME, 2 > > SEPARATE COMPANIES FILED BANKRUPTCY AGAINST ME FOR A TOTAL OF > > $ 47,000. I COULDN'T SURVIVE THAT. > > > > CONSEQUENTLY, I WAS UNABLE TO PAY MY CREDITORS, MOST OF WHOM > > WERE FRIENDS. THEY HAVE FAMILY AS I DO AND I CAN'T LIVE WITH THE > > THOUGHT OF DOING TO THEM WHAT HAS BEEN DONE TO ME. I'VE SPENT > > MANY SLEEPLESS NIGHTS TRYING TO COME UP WITH A SOLUTION. I HAVE > > NO WHERE TO TURN EXCEPT TO MY FELLOW MAN. MY ONLY FAMILY IS > > MY FATHER. HE IS 74 AND SUFFERING FROM DIABETES AND PROSTATE > > CANCER. > > > > I HAVE SLOD EVERYTHING EXCEPT THE CLOTHES OFF MY BACK AND MY > > COMPUTER. AFTER THIS FINAL ATTEMPT FOR HELP, I WILL BE SELLING > > IT. > > > > I WANT TO BE HONORABLE, BUT I CAN'T DO IT ALONE. I WOULD NEVER DO > > THIS EXCEPT AS A LAST RESORT, BUT I KNOW THAT I WOULD HELP > > SOMEONE IF I COULD. > > > > WILL YOU HELP ME?? ANY AMOUT WOULD BE VERY MUCH APPRECIATED. > > THANK YOU > > > > W.E. HENDERSON > > P.O. BOX 486 > > SMYRNA, GEORGIA 30081

1 0

Re: NSA leak (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Ian Goldberg wrote: > >To: fight-censorship(a)vorlon.mit.edu > >Subject: NSA leak > > > >WASHINGTON (AP) - In a rare moment of openness bordering on glibness, > > >senior official at the super-secret National Security Agency was overheard > > >at a White House press conference concerning current bans on the export of > > >enryption technology saying, "It would not take any twelve times the age of > > >the universe to decrypt a 128-bit message. Thirty-three minutes is more > > >like it." > Uh-huh. Unless the Administration has granted a secret Executive Order > repealing the Laws of Physics for the NSA, the above statement, if true, > would imply one of the following things: > > 1. The NSA has a reversible computing machine with at least 2^128*128 bits > = 5.44*10^39 bytes = 4.95*10^27 TB of memory. > 2. Their cracker changes the state of 2^128 bits in 33 minutes. > 3. They have a quantum computer, or some alien technology, or something > else we know pretty much nothing about. This above is true when analyzed within the boundaries of current cryptographical theory, but has about as much meaning as would the discounting of Einstein's work by an old-school physicist. There was a rather bizarre post to the list a few months ago which layed out a conceptual schematic of new research being done in the area of encryption. Although the post was bizarre, the information it provided was not. As a matter of fact, it seemed to be wider in scope and more advanced in its application than the level currently achieved by NSA and related covert government organizations. {And although the 33 minutes quote may lean toward bragging, it is not off by much.} Research currently being done in the encryption field by those who do *not* tell contains a smattering of new mathematical theory and a significant quantity of analysis which is a close cousin to traffic analysis. The result is that a person using _all_ of the security and encryption capabilities of a strong crypto product is likely to have secure communications, but if they neglect to perform even one of the _minor_ security steps possible, then there is a crack in their communication which can be expanded to a size large enough to drive a tank through. LEA's are not battling to squelch the use of crypto that they cannot readily break--they are battling to slow the growth of strong encryption in order to maintain their current ability to break encryption which is commonly thought to be secure. D r . R o b e r t s > ~~~~~~~~~~~~~~~~~~~

1 0