- cypherpunks-legacy - lists.cpunks.org

Re: Freedom and Security
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: angels(a)wavenet.com (CyberAngels Director : Colin Gabriel Hatcher) >Site security is not at all the only problem. Are you not aware of spams >and scams going on all the time? Are you not aware that sexual predators >operate in IRC? Or that child pornography is a world wide trading game? >Have you never heard of email forgeries or impersonation? What about tthe >victims of harassment and hatred who don't know how to deal with it? What >about all the people who have never heard of killfiles? Who don't know how >to report a problem nor who to report it to? Haven't you ever been mail >bombed and wished you could find out who did it? I find it interesting that Mr. Hacher is claiming spams as a reason for CyberAngel activities. I had sent him several examples of spams, to which he replied with messages showing a distinct lack of knowledge (thinking I could filter out messages from the address - which was a mailing list to which I wish to subscribe, for instance). He then noticed my piece in CuDigest suggesting that spams and other Internet abuse would be something proper for the CyberAngels to be involved with - instead of the censorship they advocate. After noticing this, he wrote me back, told me that spams were not something that they were concerned with - they weren't a _real_ problem like pornography - and legally enjoined me not to send mail to the CyberAngels. (I would thus appreciate someone forwarding this mail to Mr. Hatcher; he is not visibly on the list. In case anyone is wondering, I forwarded _at most_ one copy of each message that I had received via email; I most certainly did not mailbomb him.) As has been previously pointed out, it is not possible for "sexual predators" to commit actual crimes - as opposed to utilizing freedom of speech and freedom of press - over the internet. There are four points that may be made regarding child pornography: A. What is defined as child pornography may vary from place to place. As an example, I believe the pornographic videos involving Traci Lords (who was below the age of 18 when they were made) are legal to posess in most of Europe. This difference is similar to that in ages for statutory rape; Mississipi, for instance has one of 12. (I view this as too low, in case anyone is wondering.) B. Even if something is claimed to be child pornography, it may not actually have involved the use of children. Makeup, plastic surgery, and digital editing are all involved in the creation of such faked child pornography; the latter two are advancing at a rapid rate. While the offering of such as "child pornography" is a variety of fraud if compensation is involved, somehow I doubt the CyberAngels would be much interested in getting someone prosecuted for it. C. As has been pointed out by others, even if actual child pornography is on the Net, it is not in and of itself doing any harm to children. It is the production of actual child pornography that does so. While it may be argued that giving child pornography a market value will encourage its production, two counterarguments may be made to this point. First, much of the sexually explicit images on the net are in violation of copyright; I do not believe that the CyberAngels are trying to get people prosecuted for this. Second, driving a market underground tends to raise prices - look at the Drug War; thus, any reduction in supply due to illegality of the market will simply compensate the producers more. D. As has been pointed out, the use of child pornography is a classic "Horseman" (of the Four). In other words, the CyberAngels are using child pornography as a red herring for their even more objectionable activities. >Maybe you feel like a veterano and can afford to look condesendingly at all >the thousands of fresh-faced netizens just arriving online and say "well if >they can't take the heat they should stay out of the fire" - but if we are >to call ourselves an emerging "community" then we must take responsibility >for our city, and that means caring about other people's problems. I have no objection to the CyberAngels assisting victims of alleged harrasment with such mechanisms as kill files; I have some doubt as to their technical ability in this area. I object, however, to their more proactive activities, such as "patrolling" and soliciting people to make complaints about usages of free speech ("harrassment"). These involve either attempts to cut off someone's Internet access at the ISP's level or, worse, attempts to attract governmental attention. The first may be the right of the ISP, unless it is governmental or has a previous contract agreement stating otherwise; it would still be preferable if others such as the CyberAngels were to learn the basic lesson of "mind your own business." Bringing goverment into the matter may both result in a violation of individual civil liberties and may result in increased governmental control over the Internet. As has been pointed out by others, the Cypherpunks are doing things to help other people on the Internet in areas such as mail forgery/impersonation and mail-bombing. (A properly run anonymous remailer will not forward a mail bomb any more than a properly run post office will.) I sincerely doubt whether the CyberAngels are actually doing anything about these problems as opposed to their fetish of pornography. >When your address is forged and you get flamed and bombed, or if you start >receiving anonymous death threats, your freedom is under threat. It's not >enough to say "Well I just turn off my monitor" >The Internet is a city - it needs 911 services and it needs Neighborhood >Watches. And neither professional law enforcement nor neighborhood watch >are by definition a threat to anyone's freedom. Freedom within the context >of Community does not and never has meant the freedom to kill your >neighbor, or rob someone, or rape someone, or harm someone. In the context >of the internet Community too, freedom is not the individual's right to do >whatever he or she likes - because then the Community is no longer free. By definition? Probably not... although it depends on the definition. Some implementations of such activities - such as the CyberAngels and their current and proposed activities - are such. Freedom is the right to do what will not trespass on another's freedom; I defy you to show how having pornography available, including "obscene" material, trespasses on the freedoms of others. I also defy you to show how having fully anonymous remailers available is a violation of anyone's liberties. >Freedom is under threat from two directions - from selfish individuals who >care little for the Community, and from the over zealousness of governments >who seek greater and greater control over individual thought and action. >The first step is to acknowledge that we have a problem within the Internet >Community - because if we don't address it responsibly then we have only >ourselves to blame when the governments try to take it over. We can face >our problems or we can deny that they exist. And how, pray tell, will bringing such alleged problems to the attention of government - as has been an activity of the CyberAngels - avoid increased governmental intervention? >By asking me the question: "What crime?" you are indicating to me that you >prefer denial. No. We have a disagreement about what is crime - what is an exercise of individual civil liberties, and what is a violation of them. >"Two people may disagree, but >that does not mean that one of them is evil" That depends on what they disagree. I believe we disagree in ways that include enough fundamental freedoms that calling you evil is proper from my viewpoint. -Allen

2 1

[NOISE] Hackers soundtrack
by Simon Spero 17 Dec '03

17 Dec '03

Update on an old thread... Apparently it was released last week in England, so it may be available in some import racks. Simon

2 1

IP: Clear and present danger: FIGHT AGAINST NATIONAL ID CARD
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

From: "A.C." <angie(a)computerhut.net> Subject: IP: Clear and present danger: FIGHT AGAINST NATIONAL ID CARD Date: Thu, 01 Oct 1998 01:22:50 -0700 To: ignition-point(a)majordomo.pobox.com >>http://www.house.gov/barr/p_doj.html >> >> >September 17, 1998 BARR TAKES FIGHT AGAINST NATIONAL ID CARD TO HEARINGS, SPEARHEADS EFFORT WITH GRASSROOTS GROUPS WASHINGTON, DC -- At a news conference before a hearing on federal attempts to establish a national identification system, U.S. Representative Bob Barr (GA-7) released the following statement. The hearings, which will be held later today by the Government Reform and Oversight Committee's Subcommittee on National Economic Growth, Natural Resources, and Regulatory Affairs, will focus on this issue. "One of the most precious liberties Americans possess is the ability to live their lives without a big-brother government, with vast power, looking over their shoulders at every opportunity. Our federal government is already too powerful, too expensive, and too intrusive. We should be working to reduce its size and cost, rather than expanding it. "Our Founding Fathers intended to create a system with division of power between three branches of government and between the state and federal governments in order to protect our rights. These moves to centralize power in the executive branch of the federal government by establishing a national identification card system represent an effort to disrupt the balance of power that has served our nation so well for so long. We must put a stop to these initiatives, begun in 1996 when legislation authorizing a national i.d. was snuck into an omnibus spending bill with no debate, public input, or vote, before it is too late to do so." "I thank all of the groups that have been involved in this effort for their continued support. I also appreciate the willingness of State Representative George Grindley (R-Marietta) and others to take time away from their jobs and families to testify this morning. These hearings are part of a continuing effort by Barr and others to stop several recent intrusive government proposals. He has introduced legislation to stop federally-mandated standardization of state drivers' licenses, end a move to create a national health identifier, and led the effort to halt FBI moves for new wiretapping authority and the ability to track cellular phone users and lawful gun owners. Barr, a former United States Attorney, serves on the House Judiciary and Government Reform Committees. --30-- BACK TO PRESS RELEASES BACK TO MEDIA INFORMATION BACK TO MAIN PAGE > ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer **********************************************

1 0

microcurrency proposal
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

recently James Donald wrote some well-thought-out/reasoned comments on digital currency and microcurrency. I've been talking about microcurrency for many years on this list, and am quite chagrined lately at how long it is taking to actually materialize. I would have thought it would be available, for web pages especially, by now. the new scaled-back goals of Digicash are disappointing, but a good reality check. musing over all this is leading me in the following direction. a few months ago or so I posted info about a company that was doing a plugin for netscape that allowed some small currency transactions. I don't know what happened to this company-- does anyone remember who it was, or their web site? but I think this is a very promising approach. a company can create a plugin that would support microcurrency charges for web page hits very easily. here's how: the plugin interacts with any site that has enabled it. it sends a code to the site using a protocol. the site returns pages only upon a valid transaction request. for regular browsers without the plugin, the message is, "sorry, this page costs $.01, please download so-and-so plugin". people are very willing to download plugins to look at pages. people download plugins just to look at animation boxes. surely they will be willing to download them to serve up entire pages/content. how would the cash charge work? when the person gets the plugin, they give the plugin company their credit card number. the company takes care of the problem of accruing micro charges, keeping track of transactions/bills, and billing the credit card in large amounts. contesting a charge would tend to happen very rarely (because of the small charges, it is barely worth the effort), but the system could still support this. the problem is trying to transfer money to various individuals if their microcharge accounts have a net positive value instead of negative (in which case they would be charged their credit card at the end of the month). how do you transfer this money? one possibility is sending a check at the end of every month, or quarter, somewhat similar to the Amazon associates program. another possibility is figuring a way to credit a credit card account. this can be done, but from what I understand it is "frowned upon" by the companies. I have always wondered if the "powers that be" have intentionally tried to enforce this so that credit cards cannot turn into a cash transfer mechanism. of course, I'm leaving the issue of taxes out of this, but the microcharge company could be a point of collection for them. notice that none of what I am proposing above requires any new infrastructure whatsoever, except a little programming into a plugin. the distribution of the plugin is partly solved in that plugins are already distributed all over the net and understood by end-users. such a plugin could rapidly become the standard for "microcurrency" and be a wedge that might be the creation of a whole new industry within an industry. i.e. microcurrency on the web, very much the way Netscape virtually singlehandedly created the entire industry of the web within the existing internet. the door is wide open. such a company could be a very lucrative endeavor if handled very delicately and carefully, navigating the minefield of glitches that are surely to be present (many of which have prevented it from happening to date) as I understand, the digicash software was not in fact in plugin form for a browser. this is a pretty serious handicap imho. the technique of turning it all into a browser plugin based on the existing credit card system seems to me to be the crucial element that could make it happen.

1 0

IP: New ExecOrd: Computer Software Piracy
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Thu, 01 Oct 1998 15:50:05 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: New ExecOrd: Computer Software Piracy Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: US Newswire http://www.usnewswire.com/topnews/Current_Releases/1001-125.txt Clinton Issues Executive Order on Computer Software Piracy U.S. Newswire 1 Oct 14:10 Clinton Issues Executive Order on Computer Software Piracy To: National Desk, Technology Writer Contact: White House Press Office, 202-456-2100 WASHINGTON, Oct. 1 /U.S. Newswire/ -- The following was released today by the White House: EXECUTIVE ORDER - - - - - - - COMPUTER SOFTWARE PIRACY The United States Government is the world's largest purchaser of computer-related services and equipment, purchasing more than $20 billion annually. At a time when a critical component in discussions with our international trading partners concerns their efforts to combat piracy of computer software and other intellectual property, it is incumbent on the United States to ensure that its own practices as a purchaser and user of computer software are beyond reproach. Accordingly, by the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered as follows: Section 1. Policy. It shall be the policy of the United States Government that each executive agency shall work diligently to prevent and combat computer software piracy in order to give effect to copyrights associated with computer software by observing the relevant provisions of international agreements in effect in the United States, including applicable provisions of the World Trade Organization Agreement on Trade-Related Aspects of Intellectual Property Rights, the Berne Convention for the Protection of Literary and Artistic Works, and relevant provisions of Federal law, including the Copyright Act. (a) Each agency shall adopt procedures to ensure that the agency does not acquire, reproduce, distribute, or transmit computer software in violation of applicable copyright laws. (b) Each agency shall establish procedures to ensure that the agency has present on its computers and uses only computer software not in violation of applicable copyright laws. These procedures may include: (1) preparing agency inventories of the software present on its computers; (2) determining what computer software the agency has the authorization to use; and (3) developing and maintaining adequate recordkeeping systems. (c) Contractors and recipients of Federal financial assistance, including recipients of grants and loan guarantee assistance, should have appropriate systems and controls in place to ensure that Federal funds are not used to acquire, operate, or maintain computer software in violation of applicable copyright laws. If agencies become aware that contractors or recipients are using Federal funds to acquire, operate, or maintain computer software in violation of copyright laws and determine that such actions of the contractors or recipients may affect the integrity of the agency's contracting and Federal financial assistance processes, agencies shall take such measures, including the use of certifications or written assurances, as the agency head deems appropriate and consistent with the requirements of law. (d) Executive agencies shall cooperate fully in implementing this order and shall share information as appro-priate that may be useful in combating the use of computer software in violation of applicable copyright laws. Sec. 2. Responsibilities of Agency Heads. In connection with the acquisition and use of computer software, the head of each executive agency shall: (a) ensure agency compliance with copyright laws protecting computer software and with the provisions of this order to ensure that only authorized computer software is acquired for and used on the agency's computers; (b) utilize performance measures as recommended by the Chief Information Officers Council pursuant to section 3 of this order to assess the agency's compliance with this order; (c) educate appropriate agency personnel regarding copyrights protecting computer software and the policies and procedures adopted by the agency to honor them; and (d) ensure that the policies, procedures, and practices of the agency related to copyrights protecting computer software are adequate and fully implement the policies set forth in this order. Sec. 3. Chief Information Officers Council. The Chief Information Officers Council ("Council") established by section 3 of Executive Order No. 13011 of July 16, 1996, shall be the principal interagency forum to improve executive agency practices regarding the acquisition and use of computer software, and monitoring and combating the use of unauthorized computer software. The Council shall provide advice and make recommendations to executive agencies and to the Office of Management and Budget regarding appropriate government-wide measures to carry out this order. The Council shall issue its initial recommendations within 6 months of the date of this order. Sec. 4. Office of Management and Budget. The Director of the Office of Management and Budget, in carrying out responsibilities under the Clinger-Cohen Act, shall utilize appropriate oversight mechanisms to foster agency compliance with the policies set forth in this order. In carrying out these responsibilities, the Director shall consider any recommendations made by the Council under section 3 of this order regarding practices and policies to be instituted on a government-wide basis to carry out this order. Sec. 5. Definition. "Executive agency" and "agency" have the meaning given to that term in section 4(1) of the Office of Federal Procurement Policy Act (41 U.S.C. 403(1)). Sec. 6. National Security. In the interest of national security, nothing in this order shall be construed to require the disclosure of intelligence sources or methods or to otherwise impair the authority of those agencies listed at 50 U.S. 401a(4) to carry out intelligence activities. Sec. 7. Law Enforcement Activities. Nothing in this order shall be construed to require the disclosure of law enforcement investigative sources or methods or to prohibit or otherwise impair any lawful investigative or protective activity undertaken for or by any officer, agent, or employee of the United States or any person acting pursuant to a contract or other agreement with such entities. Sec. 8. Scope. Nothing in this order shall be construed to limit or otherwise affect the interpretation, application, or operation of 28 U.S.C. 1498. Sec. 9. Judicial Review. This Executive order is intended only to improve the internal management of the executive branch and does not create any right or benefit, substantive or procedural, at law or equity by a party against the United States, its agencies or instrumentalities, its officers or employees, or any other person. WILLIAM J. CLINTON THE WHITE HOUSE, September 30, 1998. -0- /U.S. Newswire 202-347-2770/ 10/01 14:10 Copyright 1998, U.S. Newswire ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: Is the .to (Tonga) domain completely rogue and should beremoved?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 1 Oct 1998 15:57:48 -0400 Reply-To: egullich(a)tonic.to Originator: com-priv(a)lists.psi.com Sender: com-priv(a)lists.psi.com Precedence: bulk From: egullich(a)tonic.to (Eric Gullichsen) To: Multiple recipients of list <com-priv(a)lists.psi.com> Subject: Re: Is the .to (Tonga) domain completely rogue and should be removed? X-Comment: Commercialization and Privatization of the Internet This is an official reply to Barry Shein <bzs(a)world.std.com> who recently cross-posted to inet-access(a)earth.com, nanog(a)merit.edu, domain-policy(a)lists.internic.net, and com-priv(a)psi.com under the Subject heading: Is the .to (Tonga) domain completely rogue and should be removed? As TLD admin for the .TO ccTLD, I thought Mr. Shein's posting deserved a reply. --------------------------------------------------------------------- Mr. Shein: I am the hostmaster and Administrative, Technical and Zone Contact at Tonic, the top level domain name registration authority for the .TO country code (http://rs.internic.net/cgi-bin/whois?to5-dom) Since June 1997, our automated domain name registry at http://www.tonic.to has been facilitating the registration of .TO names as a service to the global Internet community. Neither Tonic nor IANA policy requires the registered owner of a .TO name to be physically situated in the Kingdom of Tonga. >We've been having increasing problems with one or more porn sites in the >.to domain promoting itself by massive spamming of >AOL customers using one of our domains in their From: header thus causing >both complaints to us and thousands of bounces >from AOL due to bad AOL addresses in their spam lists. We are sorry to hear that you have been having problem with SPAM involving a .TO domain, and wish to draw your attention to the fact that .TO is the *only* top level domain we know of with an explicit antispam policy. We at Tonic feel strongly about spam, and believe it to be theft of service, and a very bad thing for the net in general. It is our policy to terminate the registration of a domain name involved in spam, after warning the domain name holder to cease unsolicited bulk mailings that involve a .TO name. >From our FAQ (at http://www.tonic.to/faq.htm) Q: I'm a spammer. Is a .TO domain something I should use? Tonic feels very strongly that the sending of unsolicited bulk email ("spamming") constitutes theft of service, and we do not condone the use of .TO domain names for this purpose. If we receive complaints that a .TO domain name has been used for this purpose, we will advise the domain owner of the complaint and request that they desist from this activity. Tonic reserves the right to remove any .TO name registration if a name is used as a source of spam, or an address to which to reply to such bulk mail solicitations. We have had to delete a number of .TO domains for egregious SPAM and will continue to do so in the cases where a stern warning fails to solve the problem. Please send a copy of any SPAM involving a .TO domain name to: hostmaster(a)tonic.to and we will warn the spammer and/or terminate the domain name registration. >Looking at the .to domain I can't help but notice it's heavily laden with >what appear to be porn sites (sexonline.to, come.to, >xxxhardcore.to, etc.) The .COM domain is no less "heavily laden" with porn sites. You will note that sexonline.com and xxxhardcore.com are names registered with the InterNIC. The come.to site is a free web redirection site supporting more than 100,000 customers. Furthermore, Tonic is a domain name registry, not a content censor. >In support of this assertion I want to show you an SMTP conversation with >what claims to be the Consulate of the >Government of Tonga in San Francisco (This San Francisco office is listed >as an official Tongan contact point for visas etc by >the US State Dept): > >world% telnet sfconsulate.gov.to 25 > >Trying 209.24.51.169... >Connected to sfconsulate.gov.to. >Escape character is '^]'. >220 colo.to SMTP ready, Who are you gonna pretend to be today? VRFY postmaster >500 Bloody Amateur! Proper forging of mail requires recognizable SMTP >commands! The primary nameserver for .TO is physically located at the Consulate of Tonga in San Francisco. On all our machines, we run the Obtuse smtpd/smtpfwdd SMTP store and forward proxy (http://www.obtuse.com/smtpd.html) to secure our port 25 and thereby prevent 3rd party mail relaying. Your reasoning as to why its responses to incorrect SMTP commands constitutes evidence that the .TO domain is "negligent", "mismanaged" and "an attractive resource for criminal activities" is ironically incorrect. In fact, having an *unsecured* port 25 open to mail relaying would be negligent. Best regards, - Eric Gullichsen Tonic Corporation Kingdom of Tonga Network Information Center http://www.tonic.to Email: egullich(a)tonic.to --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

3 3

New release (v1.3.2) of CFS encrypting file system available
by Matt Blaze 17 Dec '03

17 Dec '03

[Perhaps this isn't the best time for me to post this here; apologies in advance if this sparks another flame fest. -matt] Source code for the latest version (release 1.3.2) of CFS, the Cryptographic File System, is now available upon request for research and experimental use in the US and Canada. CFS pushes encryption services into the Unix(tm) file system. It supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. You must have "root" access to install CFS. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze. "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps.) and in Matt Blaze. "Key Management in an Encrypting File System", Proc. Summer '94 USENIX Tech. Conference, Boston, MA, June 1994. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfskey.ps.) Version 1.3 of CFS also includes ESM, the Encrypting Session Manager. ESM provides shell-to-shell encrypted sessions across insecure links and requires no OS or network support. It is useful for typing cfs passphrases when logged in over the network. ESM needs RSAREF 2.0 to compile and is tested only on SunOS and BSDI. ESM is the first released part of a suite of session encryption tools that are described in Matt Blaze and Steve Bellovin. "Session-layer Encryption." Proc. 1995 USENIX Security Workshop, Salt Lake City, June 1995. (PostScript is available from ftp://research.att.com/dist/mab/sesscrypt.ps) The new version of CFS differs from the version described in the papers in a few ways: * The DES-based encryption scheme has been strengthened, and now provides greater security but with the online latency of only single-DES. * Support for the smartcard-based key management system is not included and a few of the tools are not included. * An impoved key management scheme now allows chaning the passphrase associated with a directory. * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. * User-contributed ports to a number of additional platforms. * Hooks for adding new ciphers. * 3-DES, MacGuffin, and SAFER-SK128 encryption options. * Timeout options allow automatic detach of encrypted directories after a set time or period of inactivity. CFS is distributed as a research prototype; it is COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if the system deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. The software was developed under SunOS and BSDI, and there are also unsupported user-contributed ports available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really can't promise to provide any technical support at all, beyond the source code itself. We also maintain a mailing list for CFS users and developers; subscription information is included with the source code. Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994, 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please read to the end of this message and then send email to: cfs(a)research.att.com DO NOT REPLY DIRECTLY TO THIS MESSAGE. You must include a statement that you are in the US or Canada, are a citizen or legal permanent resident of the US or Canada, and have read and understand the license conditions stated above. Be sure to include an email address in a US- or Canada-registered domain. The code will be sent to you via email in a "shar" shell archive (a little over 300K bytes long).

1 0

Re: Only accepting e-mail from known parties
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 25, 1995 14:53:19, 'Adam Shostack <adam(a)lighthouse.homeport.org>' wrote: > The basic problem is that (personal) spam is a social, not a >technical problem. If someone wants to annoy you via the internet, >they can do so. You can raise the cost of their annoying you, but you >need to be careful not to make it difficult to talk to you. > I agree in many ways. On a personal level, I am far more interested in the *social* are of this form of privacy. It is more a problem of the data-hermit than privacy. And in a society increasingly generating narcissistists, I see the problem getting worse. Negroponte of the MIT Media Lab can sing the praises of the personal e-newspaper with personal filters to cut out everything uninteresting while culling the world new feeds for desired information. I see this feeding into the narcissitism problem. E.G. Imagine two people who "feel" that members of the other gender are "only interested in one thing." Each wakes up in the morning and looks at their personal e-paper. She reads nothing of particularly nasty rapes, serial rapists at large, rapists who have been convicted, and rapists who an uncaring pro-male system has let out to rape again (i.e. been found not guilty). He reads nothing of particularly nasty robberies of men by women, serial robberies by prostitutes, female robbers who have been convicted, and robbers who an uncaring pro-female system has let out to rob again. Both believe that their custom filtered feeds are the *real* events going on in the world and are far more accurate than any non-customized news feed. I hope nobody takes this as a generic attack on the privacy issues that the list is devoted to. I am a great supporter of privacy and pro-privacy tek. But I see myself as a realist on privacy issues, not as a privacy-utopian or a privacy-dystopian. We live in a post-Faustian world. It is divided into two groups of people. First are those who understand the post-Faustian character and devote themselves to getting used to it and even having fun with the new opportunities while understanding that the new world also generates new problems (like furthering data-narcicism). Second are those classic-reactionary forces (from all parts of the political spectrum) who whine about how the post-Faustian world is personally unfair to them and how everybody in the world has a personal obligation to them to move the world back to its pre-Faustian origins. --tallpaul PS to Tim May: I understand your posts on material that is off-topic. I usually agree with your posts. But I see the issues I discussed above as far more on topic (even if highly mediated) than, say, the ongoing discourse on the differences between an Army Captain and a Navy Captain.

1 0

Encryption Discrimination from Sun
by mpd＠netcom.com 17 Dec '03

17 Dec '03

I was just browsing through the rules for the million dollar contest just announced by Sun Microsystems to encourage the writing of killer applets in Java, Sun's new architecture- independent program format. The URL is http://javacontest.sun.com/rules/index.html in case anyone is interested. While reading the contest rules, I found the following one particularly interesting... "No entries may include encryption as a feature or part of an applet." This was made even more curious by the later revelation that one of the criteria for judging entries was... "The applet should be able to transfer information from one point to another, with no possibility of interception or other interference during the process." Doubtless the reason Sun nixed encryption is because this is an international contest, and they did not want to deal with legal hassles involving international borders and different laws in every country. Nonetheless, they seem to have missed an excellent opportunity to encourage the migration of privacy software into the new realm they are creating. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

2 1

Re: corporate bashing
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Fred seems to have been slipping through my filters in recent days. Though I usually trash any message containing a reference to him, I thought that this latest escalation into the ionosphere of net-sillies begs to be brought to heel... On 24 Dec 95 at 17:20, Fred Cohen wrote: > and that anonymity should be used as an escape from > responsibility for what they do and say. If you want to > remain free to speak your mind, you have to become > responsible in at least two ways: > > 1 - You must top slandering people. > 2 - You must stop using anonymity as a way to avoid being > responsible. > > When I say must, I am not intending to mean anything less. > If the cypherpunks continue to do these two things, they will > rapidly find that they are doing more to destroy all of our > rights to free speech in the Internet than they ever did to > encourage freedom of expression. There are several things wrong with this, but first, just on the surface: Fred has now dropped his cyberdrawers and stands before us displaying the ugly engine of his manhood, the handle by which he maintains a grip on his pointless existence. He reveals himself to be yet another in that small, tired parade of self-appointed lightning rods -- people with so little of import in their lives that they have to resort to trolling for what they can claim are offenses against them, then flex the borrowed, imagined musculature of mindless law to rise in self-righteous threats of exercise of vindictive wrath. This is worse than "My big brother will kick your ass!" It is like a 90-pound weakling going to the beach with a large but retarded cousin in tow. The idea is to troll to get sand kicked in his face, then to point to the drooling cousin and use him as a lever to gain and exercise control over the hapless dupes of the ruse. Freds have existed on BBS's, and before the technological age in most small clubs and societies. In the Internet they show up in newsgroups and on mailing lists, and when crossed they ALWAYS descend to threats of legal action. So predictable, so utterly dull and unimaginative, they are like the party guest who has that inappropriate laugh, who doesn't seem to notice that pairs of people are together, who approaches people oddly and, in the end, makes a scene and reveals himself to be a complete fruitcake. Unmoderated fission looking for a place to fulminate. Fred, you've come to the wrong place. If you want to be ignored, just pack your terminal and stay home with the sitcoms. Noone asked you to interject your trolls and threats here. You invited yourself, and whatever you are suffering is of your own creation. Speaking of Freds brings me to a more interesting aspect of this nonsense: How do we know there is only one Fred? Fred doesn't sign his messages... oh-oh. This attack of deja vu feels like I've had it before. Why do I get the feeling that Fred is about to embarrass himself terribly by blurting out some of the poison that fills his soul? Let him who hath not slandered cast the first suit. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMN8TVEjw99YhtpnhAQFDngH/cTzEDHzxYZ7Z9jOmoALxaIdxpgpvlIr+ /zsZndz1KfQlqUunH5i7YsJS7tm/XOsrRcWQgKQEr9WaI8wRgrqh5g== =Hl/v -----END PGP SIGNATURE-----

3 2