- cypherpunks-legacy - lists.cpunks.org

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 09:21 AM 2/9/96 -0500, Tim Philp wrote: > Private individuals are not what I was refering to. I am more >concerned about corporations who hold information about me and release it >to the highest bidder. When it comes to individual versus corporate >rights, I am clearly on the side of the individual. Remember that there's a major difference between "corporations" and "business"; you seem to be mixing them up. A corporation is a legal fiction that treats a cooperative effort by one or more people as if it were a person in itself, and normally involves limiting the liability of the corporation's investors by putting it all on the fictional person. A business is what one or more people do to make money. Most corporations are businesses, though not all. Governments can legitimately tell corporations what to do because that's part of the price of the legal fiction; a government can't abuse a corporation because you can't beat up a legal fiction, though it can say "Poof! You're not a legal fiction any more", and conversely, if the people who own the legal fiction don't like what the government's telling it to do, they can dissolve it. (Governments also enjoy regulating non-corporate businesses, but they're no longer on solid moral ground.) > I have also not suggested some form of prior restraint that would >require government access to computers. I simply suggest that should a >violation occur, that I have the right of civil and criminal law as a >recourse to both compensate me for my loss of privacy as well as deter >future damage. A company knowing that civil and criminal penalties could >result from a violation would take extra care to ensure the security of >my data. How are you going to _know_ that a "violation" occurred, if company A tells company B your address or favorite liquor? Only by having access to the records of both companies. Getting that through the courts, for only the parts of their information relevant to you, is better than blanket permission for the government to rummage through their files, but after the first lawsuit lets investigators in, everything they've got is clam bait anyway. It's still major privacy violation - for the company whose machines are being violated, and for the non-suing individuals whose data is also on those machines. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

Re: the shit hitting the fan (fwd)
by Anonymous 17 Dec '03

17 Dec '03

>It's during times like these that you learn more about your fellow >c'punks than you need to ... You're correct. I had no clue that the Cypherpunks were such a shitty group. >On Fri, 4 Dec 1998, Jim Choate wrote: > >> Forwarded message: >> >> > Date: Sat, 5 Dec 1998 06:00:13 +0100 >> > From: Anonymous <nobody(a)replay.com> >> > Subject: the shit hitting the fan >> >> > LA has 1e7 people who shit about a kilo per day. Compute the volume of that >> > after a week. >> >> It's not the raw volume that's critical but rather the percentage of the >> average personal space per inhabitant versus how much to store a weeks >> worth. For the average person storing a weeks worth of solid waste in a >> platic bag with bleach, lye, or similar material is reasonable. >> >> I've gone on long duration camping trips of about a weeks length and the >> storing and portage costs are not excessive (having a boat or horse helps >> move it around). FlushMonger

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

At 06:28 AM 2/9/96 -0500, Duncan wrote, regarding the appallingly invasive British Privacy Act: >Computer bureaux which process personal data for others or allow data users >to process personal data on their computers must also register. Their >register entries will contain only their name and address. > >Data users and computer bureaux who should register but do not, are >committing a criminal offence, as are those operating outside the >descriptions contained in their register entries. In these cases the >Registrar regularly prosecutes. The penalty for non-registration can be a >fine of up to =A35,000 plus costs in the Magistrates Courts, or an= unlimited >fine in the Higher Courts." Ouch - does this mean that if you offer shell accounts, you either have to contractually limit the processing your users may do, or be fined as a criminal for not registering? #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com= +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

just repeating
by Perry E. Metzger 17 Dec '03

17 Dec '03

In response to the several mail messages I got asking why I'd posted my "robot" message here, I just want to say yet again that Ed Carp was the one who forward it to cypherpunks. The mail headers in the message, which I reproduce below, make this obvious. The mail went from me to Carp, with appropriate "for" portions of the Received: headers indicating that the mail was destined for him, and somehow mysteriously moved from Carp's machine to toad.com -- the only possible source being Ed forwarding the thing since his name was all over the previous hops. Don't blame me, folks. Now, can we get back to cryptography? Pretty-please? Perry Received: from toad.com by geech.gnu.ai.mit.edu (8.6.12/8.6.12GNU) with SMTP id UAA13412; Thu, 8 Feb 1996 20:41:19 -0500 Received: by toad.com id AA13518; Thu, 8 Feb 96 17:33:50 PST Received: from dal1820.computek.net by toad.com id AA13512; Thu, 8 Feb 96 17:33:36 PST Received: (from erc@localhost) by dal1820.computek.net (8.7/8.6.10) id UAA24985 for cypherpunks(a)toad.com; Thu, 8 Feb 1996 20:33:49 -0500 Received: by dal1820.computek.net (Linux Smail3.1.28.1 #52) id m0tkcB9-0009AzC; Thu, 8 Feb 96 14:38 EST Received: from mail6.netcom.com (ecarp(a)mail6.netcom.com [192.100.81.142]) by dal1820.computek.net (8.7/8.6.10) with SMTP id OAA29375 for <erc(a)dal1820.computek.net>; Thu, 8 Feb 1996 14:38:49 -0500 Received: by mail6.netcom.com (8.6.12/Netcom) id LAA28210; Thu, 8 Feb 1996 11:37:54 -0800 Received: from jekyll.piermont.com by mail6 (8.6.12/Netcom) id LAA28165; Thu, 8 Feb 1996 11:37:44 -0800 Received: from localhost (perry@localhost) by jekyll.piermont.com (8.7.3/8.6.12) with SMTP id OAA08993 for <ecarp(a)netcom.com>; Thu, 8 Feb 1996 14:35:10 -0500 (EST) Message-Id: <199602081935.OAA08993(a)jekyll.piermont.com> X-Authentication-Warning: jekyll.piermont.com: Host perry@localhost didn't use HELO protocol To: ecarp(a)netcom.com From: "Perry's Mail Filter" <perry(a)piermont.com> Subject: In Re: Re: Reasons in support of crypto-anarchy WAS Re: Why am I (fwd) In-Reply-To: Your message of "Thu, 08 Feb 1996 13:29:41 CST." <199602081929.OAA28586(a)dal1820.computek.net> Date: Thu, 08 Feb 1996 14:35:10 -0500 Sender: owner-cypherpunks(a)toad.com Precedence: bulk X-UIDL: 823831065.014 I am sorry, but your message with the Subject: Re: Reasons in support of crypto-anarchy WAS Re: Why am I (fwd) was rejected by Perry Metzger's mail filter and will not be read by him. This is likely because Perry decided to place you on his reject list. Perry tends to clean out his filter lists every six months, so you may be able to send him electronic mail again sometime in the future. If you absolutely need to contact Perry, please use means other than electronic mail, or ask a third party to contact him on your behalf. You will not receive further copies of this notice. Perry's Mail Filter

1 0

DoJ investigates CIA [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > X-within-URL: http://www.cnn.com/US/9812/05/cia.hughes.ap/ > JUSTICE INVESTIGATING CIA FOR POSSIBLE CRIMINAL VIOLATIONS > > CIA Graphic December 5, 1998 > Web posted at: 1:38 p.m. EST (1838 GMT) > > WASHINGTON (AP) -- The Justice Department is conducting an > obstruction-of-justice investigation of CIA officials who passed along > to a satellite contractor sensitive information about a Senate > investigation into technology transfers to China. > > Government officials reached late Friday said the criminal > investigation centers on information passed by the intelligence agency > to Hughes Electronics Corp., maker of both commercial and spy > satellite systems. > > At issue is whether that information compromised a Senate Intelligence > Committee investigation into allegations that Hughes and other U.S. > companies violated federal export laws by sharing restricted > technology with China as part of commercial satellite export deals. [text deleted] ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

pgp disk
by Anonymous 17 Dec '03

17 Dec '03

At 03:05 AM 12/5/98 +0100, Anonymous wrote about some new product: >If the source code isn't available, don't trust it. That's a good general >rule. Where is the source for pgpfone?

1 0

Re: y2k/gary north delusions (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: y2k/gary north delusions (fwd) > Date: Fri, 4 Dec 1998 18:46:17 -0600 (CST) > From: ichudov(a)Algebra.Com (Igor Chudov @ home) > > Paris and London had populations of over a million each and didn't have a > > sewer system. It was traditional for people to throw their chamber pots out > > into the street along with the offal from the various animals. > > Guess why they had those devastating epidemics. True enough, but that sort of stuff takes more than a week or two. The various cities could go around setting up port-a-potties and latrines in parks with plastic liners for easy removal, etc. It isn't nearly the civilization shaking event some would make of it. ____________________________________________________________________ Technology cannot make us other than what we are. James P. Hogan The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

3 2

PGP Disk
by Anonymous 17 Dec '03

17 Dec '03

>Has anyone had the chance to try out the new McAfee PGP disk? >It seems pretty straightforward, allowing for the creation of >encrypted "drives" using the CAST algorithm. Is anyone aware of >any security flaws with it? I'm sure somebody will check if they are bored some day. Where can we find the source code? If the source code isn't available, don't trust it. That's a good general rule.

1 0

.
by Anonymous 17 Dec '03

17 Dec '03

... > A few rules of thumb result from even cursory examination > of the likely environment: > ... > 5. Ultimately, the only way the remailers will provide > what might be described as Pretty Good Security will > be when we have software that maintains a regular > or random rate of messages to and from the remailer > cloud, a stream into which the meaningful messages > can be inserted with no visible change in traffic. > Until then, the best we can do is try to keep traffic > levels up, and to send and receive frequently enough > to frustrate end-to-end traffic analysis. Well, the existing remailer net doesn't make "Pretty Good" anonymity very feasible. I'd think something based on the general idea behind Crowds. (Furthermore, most remailer structures still can't erase some other security concerns -- 1: remailers acutally can be hacked or physically compromised 2: clients really can be screwed 3: etc. To help solve the first, you'd want a two-box setup doing remailing, with the security-critical stuff loaded on a box not directly connected to the Net with something 140-1ish to make tampering harder, a secure OS, etc. -- or, of course, you can scrap all that to get really big remailer count. To help solve the second problem, there needs to be a better web-of-trust setup -- that is, one which applies to code as well as keys. Those who wish to verify code get a .sig-verifying program from a trusted source then use a WoT to authenticate various facets of the program necessary for security. A solution to the third problem is expected RSN.) > > 6. Don't send anything that can have grave consequences. Remember the consequences to an adversary who uses its secret decoder ring, though: the more plausible it becomes that a certain source is being used for intelligence-gathering, the more likely it is that that source will promptly begin to run dry as the spied-upon realize that Something Got Broke. My advice, however, agrees with that of the other Anonymous. That is, unless you've really thought things out, think of an remailed message as merely .sigless, not anonymous. > > 7. Take names. Always take names. Some day... > > FUDBusterMonger > > It Ain't FUD til I SAY it's FUD!

2 1

Re: RC2 technical questions
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

On Fri, 02 Feb 96 10:02:37 PST, "baldwin(a)RSA.COM" wrote: > In a shameless attempt to move the discussion of RC2 into >a more technical arena, here are some interesting questions to >explore about RC2. > --Bob Odd. You're from RSA.COM... It would seem that you're better able to find these things out than the rest of us. Make that Alleged RC2, BTW. ;) I'm rather curious about implementing known plaintext attacks. The reliance on addition and anding doesn't make me feel too confident. For example, the ciphertext produced by the input of all zeros (plaintext) is basically the added/anded (with rolls) skey bytes. With a bit of probabilistic analysis one could work at determining the skey[] bytes. Weaknesses in the key expansion may help this further... Rob.

1 0