- cypherpunks-legacy - lists.cpunks.org

Netscape bugs bounty
by & E. Metzger 17 Dec '03

17 Dec '03

I am among the first people to be sarcastic about things Netscape has done (I believe I originated the joke about the extra money from the Netscape IPO being used to build a structure large enough to house Marc Andreessen's ego), but I think this sniping about the Bugs Bounty is silly. They are finally starting to try to do the right thing and take problems, especially security problems, with their software seriously and not sweep them under the rug. Cut them some slack. It might not be perfect, but they are moving in a good direction. Perry

1 0

Next EFF-Austin General Meeting : Cryptography (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Japan-CIA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Japan-CIA Tokyo (AP) -- Japan said that its relations with Washington could be seriously damaged if a report that the CIA spied on Japanese representatives at auto talks proves true. The New York Times reported Sunday that the CIA eavesdropped on conversations between Japanese negotiators and automakers during the talks in Geneva this year, reporting the results daily to U.S. Trade Representative Mickey Kantor. According to the report, Kantor was provided with summaries of conversations between Japanese bureaucrats and executives from Toyota Motor Corp. and Nissan Motor Co. Toyota called the alleged eavesdropping ``unthinkable,'' but refused to comment further.

1 0

Illegally canceled articles on Microsoft Security Bugs
by anonymous＠replay.com 17 Dec '03

17 Dec '03

(A copy of this message has also been posted to the following newsgroups: alt.security, comp.os.ms-windows.apps.misc,comp.os.ms-windows.win95.misc,alt.religion.scientology,news.admin.net-abuse.misc,comp.protocols.smb,comp.os.ms-windows.advicacy,comp.os.ms-windows.networking.tcp-ip) -----BEGIN PGP SIGNED MESSAGE----- Could somebody please tell me who illegally canceled my article <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu>, referenced in the followup article below, as well as several other articles I posted this morning? It was cross-posted to several groups, but I don't think it should have triggered any spam-cancelers, and I see nothing in news.admin.net-abuse.misc. I'd find the cuplrit myself, but Stanford only saves the last 100 or so messages in control. See the rather prominent blinking link on the Web page below for the other PGP-signed article that was canceled. Thanks in advance. Followups set to news.admin.net-abuse.misc. Don't bother canceling this article, my friend. By the way, the other articles were saved and emailed as well. - -rich jabba(a)deathstar.stanford.edu and other accounts moderator of a certain list http://rescomp.stanford.edu/~llurch/innocuous/faq.html PGP key available on MIT server and via finger -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIHC9oND7LjhcPQ9AQHTZgQAxGQZGTFDrzUTfyWCuLTUP2VbIp6IwK/Y NJjy7ke4rgZH+bjegb1h2ig/lALEhnX4+uhurhDJ0wq6du2p5V/DUlsNHCcWvotL GHyd/ZLzXGq6OYRoPijUHAdDBPD2wWIdAfsYNiTgv3iezBJL+2cCq/YLiPd22KyF MROQwF05Hoc= =1K2B -----END PGP SIGNATURE----- I will be charitable and assume that it was someone else I've pissed off (lord knows there's several), and not someone working directly for Microsoft or the Church [spit] of Scientology, who were both maligned in the canceled posts. In article <petrichDGID4I.5GG(a)netcom.com>, petrich(a)netcom.com (Loren Petrich) wrote: > Newsgroups: > alt.security,comp.os.ms-windows.apps.misc,comp.os.ms-windows.win95.misc > Path: > nntp.Stanford.EDU!news.Stanford.EDU!agate!howland.reston.ans.net!newsfeed.internetmci.com!news.sprintlink.net!noc.netcom.net!netcom.com!petrich > From: petrich(a)netcom.com (Loren Petrich) > Subject: Re: More Microsoft Security Bugs > Message-ID: <petrichDGID4I.5GG(a)netcom.com> > Organization: NETCOM On-line Communication Services (408 261-4700 guest) > References: <llurch-1510951157410001(a)tip-mp3-ncs-3.stanford.edu> > Date: Sun, 15 Oct 1995 21:02:42 GMT > X-Original-Newsgroups: > comp.os.ms-windows.win95.misc,alt.security,comp.os.ms-windows.apps.financial,comp.os.ms-windows.apps.utilities,comp.os.ms-windows.apps.word-proc,comp.os.ms-windows.apps.misc,alt.fan.bill-gates,comp.os.ms-windows.advocacy,alt.destroy.microsoft,comp.os.ms-windows.nt.admin.misc > Lines: 9 > Sender: petrich(a)netcom2.netcom.com > Xref: nntp.Stanford.EDU alt.security:21764 > comp.os.ms-windows.apps.misc:13757 comp.os.ms-windows.win95.misc:38436 > My favorite example of such a bug is in BOB's password protection. > If you mistype it 3 times, it will ask if you want another one. The only > defender of this "feature" has been -- get this -- JoanieDearest (at > least if memory serves me correctly). > -- > Loren Petrich Happiness is a fast Macintosh > petrich(a)netcom.com And a fast train > Visit my ftp site; its address is (in WWW syntax): > ftp://ftp.netcom.com/pub/pe/petrich

2 1

PGP out of RAM
by SINCLAIR DOUGLAS N 17 Dec '03

17 Dec '03

It seems PGP has been too successful. I downloaded the entire keyring from keys.pgp.net; it's almost 9Mb of ASCII armour. However, I can't get PGP for DOS to process the files. It, understandably, gives me an Out Of Memory error. Is there any sneaky way of getting around this, barring the obvious switch to PGP for Linux? It seems PGP is constrained to the basic DOS 640Kb, or 704Kb if I remove my VGA card.

1 0

Re: Netscape question transformed
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Fri, 13 Oct 1995, Derek Atkins wrote: > > Why would a compony like Netscape jeapordise themselves by > > even letting out a beta version so hackers have time to find bugs > > before the full version is released. Don't take me wrong I have only > > been on the net fer a little over a year and Love Netscape. And If I > > knew what I was Doing I would love to help them..... > > I don't think that this can jeopardize a company... I agree. I don't think it can jeopardize the company either. After all, we're talking about a company that has a market capitalization of more than TWO BILLION US DOLLARS. Two Billion Dollars can buy a lot of talent. Even if Netscape has to spend $100 Million on this problem, that sum represents only 5% of Netscape's total market capitalization. I'm certain that Netscape has established a crisis control centre which is manned and readied. That a proper spin control program has been implemented, and that a reasonable firm like Skadden Arps has been retained. And I'm confident, that Netscape is drawing not only on its own resources but that it's drawing on those who share Netscape's interests. Even if Skadden doesn't let you past security without a seven figure retainer, I'm sure that if one of those nice boys from Morgan Stanley, ... someone with snazzy Princeton ties ... maybe one of the ones who orchestrated the Netscape IPO calls over to Skadden, Arps, Slate, Meagher & Flom, I'm sure that one of those fellows will have their call returned by any partner at Skadden. They're professional that way. > What would you > rather see? A company makes a beta release for people to attempt to > break, fixes the bugs, and then releases a better product? Or would > you rather see a company release a product, tell people it is secure, > and then get bitten by numerous holes in it? Well, I'm not sure that I'd want to make any representations or imply any warranties whatsoever. > From a PR perspective, it sounds much better to take the first tact. > Similarly, you will get a better product using the first method. > Using the second method, NOT beta-testing your product, has a greater > chance of jeopardizing a company. At least if they put out a beta, if > the press calls, they can say "this is nor our final product -- we > wanted to let people give it a try and find problems, so that we can > fix them before we start shipping". We aren't just talking about a pre-alpha (Netscape beta) product. We are speaking of something else here. We're talking not only about a problem in their NEW code, we're talking about a very big problem in the middle of their EXISTING code. A huge security hole in the code that everyone is and has been running -- from 850,000 Deutsche Telecom customers, throughout AT&T's internal organization and throughout their worldwide customers, and god only knows how many individuals in the United States and abroad. This is an extremely serious software design issue. It is equivalent to designing and then building a house and forgetting to include any plumbing, and no one really noticing, and no one really saying anything about it. And when someone like Joan Rigdon calls from the Wall Street Journal, I hope that Netscape doesn't try to snow her. She's been up and down the street ... and probably knows all about snow. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Forged cancels of posts critical of Microsoft, *apparently* through internetmci.com or nasa.gov
by Richard Charles Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- These are the forged cancels for my articles critical of Microsoft. *Many Thanks* to the person who forwarded them to me; our server expires control way too fast. Somebody did an acceptable forge on the Message-ID, but the Path is quite wrong. Can anybody help me catch this fool? I'm somewhat out of my element here. The most serious posts are available on the Web at http://www-leland.stanford.edu/~llurch/win95netbugs/IP-Security-Bug.txt.asc, and on the gopher archive at gopher://quixote.stanford.edu/1m/win95netbugs. - -rich graves networking systems stanford university llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMIH0IIND7LjhcPQ9AQFojQP/UrB/Us1PK8ne1GnsFxqXXVCJpanEKciH p9wqVMfBJOTBdkYBHkuSHkdeaJfXz6QfEQYGZr6HIN/DD8A/VNOSB+dgCbBUYcOj 2/b+x+7CBfGvEsrbIVLxWl/Eua5pIcjWLLmfgYu3dCneDOqrXO9ehZSDg1JD9tTt Av6lQIxTuVM= =V+nf -----END PGP SIGNATURE----- [You always think of something after signing, don't you?] Also emailed to postmaster(a)internetmci.com and postmaster(a)news.msfc.nasa.gov. Was that right? Doesn't microsoft.com get its news feed from internetmci? OK, I'll Cc them, because I know they don't want anyone to believe that this was done by a Microsoft employee. The cancel for <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU>, only, is legitimate, and provides a very good comparison. I'm sure the forger studied it; so should we. Path: rand.org!usc!howland.reston.ans.net!swrinde!elroy.jpl.nasa.gov!sdd.hp.com! hplabs!unix.sri.com!news.Stanford.EDU!not-for-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin g.tcp-ip,comp.protocols.tcp-ip.ibmpc Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 15:55:40 -0700 Organization: Stanford University Lines: 1 Message-ID: <45mqpc$hn(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> was cancelled from within trn. Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo r-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.infosystems.www.browsers.ms-windo ws,comp.os.ms-windows.apps.winsock.misc,alt.winsock,comp.os.ms-windows.networkin g.tcp-ip,comp.protocols.tcp-ip.ibmpc Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 15:58:14 -0700 Organization: Stanford University Lines: 1 Message-ID: <45mqu6$iu(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> was cancelled from within trn. Path: rand.org!usc!howland.reston.ans.net!newsfeed.internetmci.com!news.msfc.nas a.gov!elroy.jpl.nasa.gov!sdd.hp.com!hplabs!unix.sri.com!news.Stanford.EDU!not-fo r-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: control,comp.protocols.tcp-ip.ibmpc,comp.os.ms-windows.networking.tc p-ip Subject: cmsg cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanfo rd.EDU> Control: cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.ED U> Date: 13 Oct 1995 16:00:48 -0700 Organization: Stanford University, CA 94305, USA Lines: 1 Message-ID: <45mr30$kh(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu cancel <Pine.ULT.3.91.951013145012.29858A-100000(a)Networking.Stanford.EDU> Path: rand.org!usc!math.ohio-state.edu!uwm.edu!lll-winken.llnl.gov!fnnews.fnal.g ov!unixhub!news.Stanford.EDU!not-for-mail From: llurch(a)Networking.Stanford.EDU (Richard Charles Graves) Newsgroups: comp.os.ms-windows.win95.misc,comp.os.ms-windows.win95.setup,comp.os .ms-windows.apps.winsock.mail,comp.os.ms-windows.apps.winsock.misc,comp.os.ms-wi ndows.apps.winsock.news Subject: cmsg cancel <45nvip$ab6(a)nntp.Stanford.EDU> Control: cancel <45nvip$ab6(a)nntp.Stanford.EDU> Date: 14 Oct 1995 02:32:23 -0700 Organization: Stanford University Lines: 1 Message-ID: <45o038$3ip(a)Networking.Stanford.EDU> NNTP-Posting-Host: networking.stanford.edu <45nvip$ab6(a)nntp.Stanford.EDU> was cancelled from within trn.

1 0

RE: robo remailer RE: robo remailer
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

nobody(a)REPLAY.COM (Anonymous) wrote: > Is the remailer "robo(a)c2.org" a PGP remailer? > In the remailer-list, it is not listed as such and yet it has a > public PGP key (dated 5/7/95)? Also, is it robo or ROBO, or > doesn't the case matter? >From what I heard last week, the remailer operator's account at c2.org expired and was cancelled, thus the remailer is down. Previously, it had been a full-fledged cypherpunk-type remailer, with Type II (Mixmaster) capabilities, to boot. Such are the uncertainties of using remailers. What would have been nice, of course, would have been for Sameer (sameer(a)c2.org) or whoever runs Community Conexxion, to post a bulletin here giving everyone a few days' notice before pulling the plug on this remailer. Undoubtedly, people are still chaining through it and wondering why their messages/posts are not showing up. NOTE: People with anon reply blocks from alpha.c2.org that chained through robo need to replace them, or risk lost messages!

2 1

Bug Bounty [noise]
by Alan Olsen 17 Dec '03

17 Dec '03

Something I noticed about the Netscape Bug Bounty that seems to not have been mentioned here... "Linux users need not apply." (Check the rules as to which versions qualify and see what I mean.) | Visualize whirled keys | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - Black Art | Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

2 1

transaction costs in anonymous markets
by Wei Dai 17 Dec '03

17 Dec '03

Some people have predicted (advocated?) frictionless capitalism, which will be brought about by the use of digital technology to reduce transaction costs. However, in anonymous markets these costs may be quite high. Two main components of transaction cost in an anonymous market will be the cost to maintain anonymity and the cost to evaluate reputations. Maintaining anonymity requires that communications be done through special untraceable protocols. The current state-of-art (i.e. RemailerNet) adds several hours of transmition time to each message to achieve effective untraceability. Contract negotiation, for example, becomes very difficult under these circumstances. Untraceable communications also use up more computing and communications resources. Although remailers don't yet charge any money to pass along messages, this is sure to change in the future. Unless the structure of the Internet is completely redesigned, untraceable messages will always cost more than traceable ones, although I hope this cost difference can be reduced through technical advances. The second big part of transaction cost in an anonymous market is reputation evaluation. Of course, normal, everyday transactions require reputations to be evaluated. However, more effort and cost will be expanded on these evaluations in an anonymous market because the effects of misevaluations will be much more damaging. Reputations must be constantly reevaluated, as pseodonyms are easily transfered. Since no good theories of reputation currently exist, these evaluations are difficult to automate. Perhaps theoretical advances can make these evaluations easier and/or more accurate. However there does not appear to be any major research effort in this area. If these costs remain high, but anonymous markets develop regardless, it will be interesting to see how these costs affect the structure of the markets. Will special protocols for contract negotiations develop to minimize the number of round-trip messages? Will each market be dominated by a few big entities because people can't keep track of reputations of many smaller players? But then how will these big entities be organized? Wei Dai

3 2