- cypherpunks-legacy - lists.cpunks.org

New Netscape RNG
by Ray Cromwell 17 Dec '03

17 Dec '03

I just glanced at the new Netscape RNG source. I don't really see anything bad, but I haven't analyzed it. However, I'm curious as to why variables like the username or the language locality are used as sources of entropy. These seem to provide almost nil. The username is going to be pretty much constant. In fact, even the current directory which is used as a seed can't provide more than a few bits of entropy. In all probability, the user name will usually be the same, and so will the current directory (and how many directories are there? 65,000 would only give you 16 bits of entropy, assuming you get a directory listing from the machine) I'm thinking from the standpoint of someone gathering data on someone or some server to mount a specific attack. a "most common directories on the macintosh" file for instance could be used to attack the current directory method. Using those sources probably can't hurt, they just seemed like odd choices, "grasping for straws" so to speak. Nevertheless, I would like to commend Netscape for releasing the source code for public review. You guys are clearly an intelligent company, in both your current developments, but also the way you have handled this bad press. -Ray p.s. i hope you guys do a good internal review of your code to remove buffer overflow bugs

3 3

Feinstein for governor! Good news for the US, bad news for CA
by Declan McCullagh 17 Dec '03

17 Dec '03

*26 CALIFORNIA: LAYING THE GROUNDWORK FOR NOT RUNNING? Sen. Dianne Feinstein (D), in a "rare interview regarding her political future, spoke glowingly of the chance to return home" as the state's next gov., calling it a "very attractive" possibility. "At the same time, Feinstein said she enjoys her work in the Senate more than ever before and that her 'effectiveness can grow on a national level'" if she remains in DC. Throughout the 45-minute interview with the San Francisco Chronicle, Feinstein "appeared deeply torn over her choice. Despite the urgings of some fellow Democrats to speed her decision, Feinstein said it may be several months before she declares her intentions. ... The key conflict appears to be Feinstein's interest in becoming governor versus her reluctance to endure a grueling campaign." Were she to run, Feinstein said the "cornerstone of her campaign would be a plan to fundamentally restructure elementary education." At the same time, Feinstein "sees her effectiveness building in the Senate": "I actually like the Senate much more now than I did initially. I'm more accustomed to its eclectic proceedings and rules and think I can work on both sides of the aisle." The legal filing deadline to enter the 6/2/98 primary is 2/9/98, "and Feinstein said that if she chooses to run, she could wait until the last moment to file." Feinstein "brushed aside the notion that uncertainty surrounding her candidacy is freezing the field": "It's unrelated to me. There's plenty of time. ... It is important at this stage that there be a strong Democratic governor with a sense of where this state needs to go. And it doesn't necessarily have to be me" (Sandalow, 9/12).

1 0

New Developments in Fascist Mind Control
by The Real Guy 17 Dec '03

17 Dec '03

I have some amazing news to report! After considerable research, I have developed two technological tools which can be used to manipulate and control the minds of practically all living humans. One tool serves the purpose of seizing control of the individual's attention and putting them into a hypnotic state of consiousness where they can be manipulated into a narrow mind-set. The other tool is designed to store and analyze a wide range of data about every aspect of an individual's life, in order to enhance the effectiveness of the first tool. While I initially had worries that these two tools might possibly be used by people with bad intentions to seize control of mankind and enrich themselves beyound belief, I found, after closer study, that the two tools I have invented already exist, and have not been used for these evil ends, to date. Since TV's and Computers have not been abused, so far, in an attempt by those greedy for power and money to manipulate the people into a position where they can be enslaved and oppressed, I feel that there is no possibility of this happening in the future, despite the ravings of a few wild-eyed conspiracy theorists. I mean, get real, eh? The Real Guy

1 0

Netscape closes up 1 3/8 today!
by tomw＠orac.engr.sgi.com 17 Dec '03

17 Dec '03

In article <DF84AJ.41K(a)sgi.sgi.com>, carolann(a)censored.org (Censored Girls Anonymous) writes: > Lookit that! 416 trades and 11 times there was more > buying pressure than selling pressure.. > The rumors of bug fix are outweighing the facts of the crack! > I am totally amazed! But think company insiders are probably > supporting the stock. Holding up better than ascii armor, it is. I think it probably has more to do with the fact that the name "Netscape" has been on the front page of every major newspaper in the US. I guess bad press is better than no press at all. And the press hasn't even been that bad. -- Sure we spend a lot of money, but that doesn't mean | Tom Weinstein we *do* anything. -- Washington DC motto | tomw(a)engr.sgi.com

11 14

Save up to 75% on Int'l Calling !!
by callback＠t-1net.com 17 Dec '03

17 Dec '03

Save up to 75% on International Calling with Int'l Callback - Low international calling rates - Service and rates apply from almost any phone worldwide - For callers in the USA we have 1-800 access service, like calling card - Quality, reliable service - No sign-up fees, or monthly fees - Rates apply 24 hrs/day, 7 days per week - 6 Second Incremental Billing - Monthly call detail reports Here is a sample of some of our rates: (US$) - 24 Hour, 7 Day, Per Minute Rates TO COMPUTE THE RATE FOR CALLING FROM ONE COUNTRY TO ANOTHER, ADD THE RATES FOR EACH COUNTRY 30 Second Minimum - 6 Second Incremental Billing COUNTRY RATE COUNTRY RATE COUNTRY RATE ------- ---- ------- ---- ------- ---- Australia .19 Germany .27 Norway .29 Belgium .29 India .79 Singapore .27 Brazil .65 Japan .31 Sweden .19 China .89 Malaysia .57 Switzerland .29 Denmark .27 Netherlands .29 United Kingdom .15 France .27 New Zealand .27 USA-Mainland .08 *FOR CALLS MADE TO OR FROM THE CONTINENTAL USA, ADD 8 CENTS PER MINUTE ****** AGENTS NEEDED ALSO!!! ****** We are also looking for AGENTS to market our services worldwide. Attractive commission rates, and NO sign-up fees. _______________________________________________________________________ For SERVICE information, reply to this message and type "info" in the subject line. _______________________________________________________________________ _______________________________________________________________________ For AGENT information, reply to this message and type "agent" in the subject line. _______________________________________________________________________ Please include your full name. Thanks! /////////////////////////////////////////////////////////////////////////////// This Message was Composed using Extractor Pro Bulk E- Mail Software. If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. ////////////////////////////////////////////////////////////////////////////////

1 0

cypherpunks-e test
by Jim Choate 17 Dec '03

17 Dec '03

Hi, This is a test of the link betwee cypherpunks-e(a)hpt.org and ssz.com. Please don't reply unless you are on the cypherpunks-e list. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

Re: Defense against a class of programming bugs
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> > >Unfortunately, strdup is not posix compliant. If you want to use > >it and maintain portability, you'll have to write your own. > > Er, you're kidding, right? drand48 isn't in Posix either, for example. > Someone who runs on Motif and Mac has strdup as the least of their > worries. But just in case it's stopping anyone: > char *strdup(const char *x) { char *p; > return (p = malloc(strlen(x) + 1)) ? strcpy(p, x) : 0; > } Nah, I'm not kidding...I have to write code that runs on LOTS of platforms including macs, pcs, and lots of variants of Unix...I assume there's a lot of others that do as well...you have to make money where you can, and even with free software given out to the net, you want to make it portable as a matter of pride. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

1 0

List of US representitives
by Brian Gorka 17 Dec '03

17 Dec '03

Someone posted a list of US reps awhile back... Can someone forward me a copy? Thanks. Brian Gorka -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAy/oSvwAAAEEAKM8kn6GkjFgbWUHBXPOtiJuCrhEgMc0Hk8WqERu0aW9bfKN JLdl9iY0g+fDg9HgP6fX7MQx5svwsx4m9Dc7Uynwnm6Na6EKvjozRW7OR5zjf4Fi YYqQ45ZmuU8lokphPGpnl4IZTfC1eWGTAC3G8KmA34x8HQdSCUqS5+bitIhFAAUR tCNCcmlhbiBSLiBHb3JrYSA8Z29ya2FiQHNhbmNoZXouY29tPg== =S8nb -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Another Netscape Bug (and possible security hole)
by goedel＠tezcat.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Ray Cromwell writes: >> I've found a Netscape bug which I suspect is a buffer overflow and >> may have the potential for serious damage. If it is an overflow bug, >> then it may be possible to infect every computer which accesses a web >> page with Netscape. To see the bug, create an html file containing >> the following: > >Oh brother, this is unbelievable ! > >I'm using Netscape 1.1N under SunOS 4.1.2. > >It turns out that the same (or a similar) flaw resides in the Open Location >input routine -- perhaps this merely coincides with the code called when a >URL is clicked. Anyway, pasting a URL with an overlong domain name a la Ray's >example causes two things: > >(1) Part of the Open Location window widget, below the entry box, gets >overwritten onscreen with a portion of the entered URL. > >(2) Netscape crashes with a segmentation fault (no core dump that I can see). Netscape 1.1N on a powermac crashes hard on that url. If anyone wants to try it out, I've put up a simple page with the url at http://www.redweb.com/experiment/bug.html *warning* view the source before you click on strange links!!! I don't do PPC assembler, so I can't tell you what happened. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBgAwUBMGJysHIf3YegbdiBAQF/RAJWNVXvLgyPEjVVoGUNoX/AqKlIiT5Axmek +dCoGJy6CMcP7fq3rB+DAt+SziIaG2X+rUSLt8ih39TBjD1FLAKKsE/VhBHJrp+v pSoO =jfLP -----END PGP SIGNATURE-----

14 15

Re: Persistent Services Needed
by Erik E. Fair 17 Dec '03

17 Dec '03

One way to establish persistent services is to use the DNS for indirection: register a name for a service (or a set of services), which then point to servers of those services by a DNS name. If the service needs to move (hosts, net connections, etc), the only thing that changes is the DNS zone file and the references to the service through the name stay exactly the same. Hell, if your service requires no state information or can have replicated data (e.g. DNS, FTP, WWW), you can use "round robin" techniques with very low DNS RR TTL's to spread the service load over a bunch of widely distributed hosts. The NetBSD gang understand this principle: netbsd.org has several servers all over the place: E-mail to netbsd.org is handled at MIT. www.netbsd.org is served up by WWU.EDU ftp.netbsd.org is at CMU. Perhaps Eric Hughes can be prevailed upon to permit "privacy.net" to be used in this manner. Erik Fair

2 1