- cypherpunks-legacy - lists.cpunks.org

anonymous proxy server in 100 lines of Perl (fwd)
by Martin Hamilton 17 Dec '03

17 Dec '03

I'm sure this could be squeezed onto one line. Sheesh - comments even! :-) Martin ------- Forwarded Message From: Randal Schwartz <merlyn(a)stonehenge.com> To: libwww-perl(a)ics.UCI.EDU Subject: anonymous proxy server in 100 lines of Perl Date: 20 Nov 1996 20:21:43 -0700 No cookies. No referer. No From. All we need is a dozen of these around the planet. :-) Gisle, thanks. You truly are "the wizard of aas". :-) And yes, this is the code for the next Web Techniques magazine column. #!/home/merlyn/bin/perl -Tw use strict; $ENV{PATH} = join ":", qw(/usr/ucb /bin /usr/bin); $|++; ## Copyright (c) 1996 by Randal L. Schwartz ## This program is free software; you can redistribute it ## and/or modify it under the same terms as Perl itself. ## Anonymous HTTP proxy (handles http:, gopher:, ftp:) ## requires LWP 5.04 or later my $HOST = "localhost"; my $PORT = "8008"; sub prefix { my $now = localtime; join "", map { "[$now] [${$}] $_\n" } split /\n/, join "", @_; } $SIG{__WARN__} = sub { warn prefix @_ }; $SIG{__DIE__} = sub { die prefix @_ }; $SIG{CLD} = $SIG{CHLD} = sub { wait; }; my $AGENT; # global user agent (for efficiency) BEGIN { use LWP::UserAgent; @MyAgent::ISA = qw(LWP::UserAgent); # set inheritance $AGENT = MyAgent->new; $AGENT->agent("anon/0.07"); $AGENT->env_proxy; } sub MyAgent::redirect_ok { 0 } # redirects should pass through { ### MAIN ### use HTTP::Daemon; my $master = new HTTP::Daemon LocalAddr => $HOST, LocalPort => $PORT; warn "set your proxy to <URL:", $master->url, ">"; my $slave; &handle_connection($slave) while $slave = $master->accept; exit 0; } ### END MAIN ### sub handle_connection { my $connection = shift; # HTTP::Daemon::ClientConn my $pid = fork; if ($pid) { # spawn OK, and I'm the parent close $connection; return; } ## spawn failed, or I'm a good child my $request = $connection->get_request; if (defined($request)) { my $response = &fetch_request($request); $connection->send_response($response); close $connection; } exit 0 if defined $pid; # exit if I'm a good child with a good parent } sub fetch_request { my $request = shift; # HTTP::Request use HTTP::Response; my $url = $request->url; warn "fetching $url"; if ($url->scheme !~ /^(http|gopher|ftp)$/) { my $res = HTTP::Response->new(403, "Forbidden"); $res->content("bad scheme: @{[$url->scheme]}\n"); $res; } elsif (not $url->rel->netloc) { my $res = HTTP::Response->new(403, "Forbidden"); $res->content("relative URL not permitted\n"); $res; } else { &fetch_validated_request($request); } } sub fetch_validated_request { my $request = shift; # HTTP::Request ## uses global $AGENT ## warn "orig request: <<<", $request->headers_as_string, ">>>"; $request->remove_header(qw(User-Agent From Referer Cookie)); ## warn "anon request: <<<", $request->headers_as_string, ">>>"; my $response = $AGENT->request($request); ## warn "orig response: <<<", $response->headers_as_string, ">>>"; $response->remove_header(qw(Set-Cookie)); ## warn "anon response: <<<", $response->headers_as_string, ">>>"; $response; } ------- End of Forwarded Message

1 0

Draft OECD crypto guidelines on WWW
by Robin Whittle 17 Dec '03

17 Dec '03

I have obtained the OECD draft crypto guidelines from: http://www.quintessenz.at/Netzteil/OECD/index.html where they are a Word 6 file. I have converted them to HTML and put them at: http://www.ozemail.com.au/~firstpr/crypto/oecd_dr.htm This is probably not the absolute latest draft, but it is the best I can get. I think there is a lot of good material here, but they still seem wedded to the idea of key-recovery or some other means of governments accessing plaintext or keys. They seem to assume there will always be a copy of the key around the place somewhere. In general, in the future cryptographic exchanges will use fresh key-pairs for each session, so not even the user can get a copy of the private key. Maybe key-recovery techniques are designed to cope with this, but the question is why would anyone want to use such a system other than that the government (and some corporations aligned with the government) want them to? There is no reason why ordinary or criminal users should be interested in key recovery/escrow, or weakened key-spaces - what they need is simple to use, totally secure, end-to-end encryption. The whole aim is to make a bulletproof secure pipe that doesn't depend on any other data, technology or administrative actions. The draft guidelines have my comments at the start, including a suggested rewording of paragraph 88 which currently states that crypto systems *should* provide for lawful access to the plaintext/key. The OECD people do not seem to have considered the fact that criminals will wrap their material in a crypto system they can trust before putting it through the government mandated system that they don't trust. My comments include a more detailed discussion of this argument, particularly in the situation where criminals are communicating with non-criminals. In a nutshell, how is all the cost, risk, doubt and complication of key escrow/recovery etc. justified by its benefits for serious crime prevention/deterrence, when the great majority of criminals and a large number of ordinary private and commercial users will be applying their own strong encryption first? Does anyone know of writing that specifically tackles this question? This is a separate question from those about whether governments can be trusted, or about absolute rights to privacy etc. It is simply a cost/benefit analysis. To me the benefits for reducing serious crime seem slim indeed and the costs - not least the general feeling that people may be using daily a system specifically designed for tapping their communications - seem to be very high. - Robin . Robin Whittle . . http://www.ozemail.com.au/~firstpr firstpr(a)ozemail.com.au . . 11 Miller St. Heidelberg Heights 3081 Melbourne Australia . . Ph +61-3-9459-2889 Fax +61-3-9458-1736 . . Consumer advocacy in telecommunications, especially privacy . . . . First Principles - Research and expression - music, . . music industry, telecommunications . . human factors in technology adoption. . . . Real World Interfaces - Hardware and software, especially . . for music .

1 0

Any RC4 attacks?
by Jim & Carla Rogers 17 Dec '03

17 Dec '03

Schneier claims that RC4 has not yet fallen to crypanalytic attack. Assuming that a sufficient length key is used (>= 128 bits), have there been any successful attacks? Jim Rogers

1 0

Magic passwodr in BIOS?
by Kamil Golombek 17 Dec '03

17 Dec '03

Hi, yesterday I've read about so called "magic password" in AWARD BIOS. It was a surprise for me and I wasn't very happy that the way how to bypass this is so easy. But nevermind, I heve two questions about it. First, is there any way how to disabled "magic password" 589589 in AWARD BIOS? Second, does anobody know another "magic passwords" to various BIOSes? Thanks for your answers! ZERO

1 0

CAVE Table
by John Young 17 Dec '03

17 Dec '03

For clarity we've replaced the CAVE Table image in TR45.3 with HTML and ASCII versions. The tables are also at: http://jya.com/cavetable.htm

1 0

Patent Fight Could Add to Cost of Inter
by Alan Pugh 17 Dec '03

17 Dec '03

By KATHLEEN SAMPEY Associated Press Writer NEW YORK (AP) _ A little-known patent could raise the cost of doing business over the Internet for companies selling software, video or other digital products delivered online. E-Data Corp. of Secaucus, N.J., is suing 17 companies, including McGraw-Hill and CompuServe, to collect licensing fees on the patent, which protects downloading of encrypted digital information. A court hearing is scheduled Dec. 6 in New York on the company's claims. Analysts said the patent will not significantly restrain Internet commerce, but would raise the cost of doing business on the Internet and cause headaches for small start-up companies. Some companies, including Adobe Systems and VocalTec, have grudgingly paid the licensing fee. Others intend to fight it. ``We believe it's important to draw a line in the sand and make them prove infringement,'' said CompuServe spokeswoman Gail Whitcomb. ``We think their claim is way too broad.'' Arnold Freilich, E-Data's president, said the company bought rights to the patent in 1994. He won't disclose how much the company has made from it, but said it covers digital products such as text, software, images, music and video transmitted through phone lines to customers. Companies that take orders for products over the Internet, then ship them by mail would not be affected. The patent was first issued in 1985 to Charles Freeny Jr. Freeny, an electrical engineer, held the digital encryption patent until 1989. Unable to make money on it, he sold it for about $100,000 to a company called Avedas Corp. ``I didn't foresee the Internet,'' he said. Avedas couldn't make money from it either and has since gone out of business. By 1994, when E-Data bought the patent for $290,000, the World Wide Web had come of age, and so had the possibility of enforcing the patent, which expires in 2003. Peter Tracy remembers making the acquaintance of U.S. Patent No. 4,528,643. His East Haven, Conn.-based company, MicroPatent, operates a Web site where users can search and download patent and trademark information for 25 cents a page. On March 22, he received a packet from E-Data saying his company might be infringing on the patent. He could either pay a fee based on the percentage of his Web site profits, or be sued. ``I felt like I had been sucked into (a) bottomless pit,'' he said. MicroPatent agreed to pay the licensing fee, which Tracy will not disclose. The cost of the annual fees range from 1 percent to 5 percent of sales under $1 million, according to David Fink, E-Data's attorney. For sales over $1 million, the rate is determined on an individual basis, he said. Several cases already have been dismissed because either defendants paid the fees or they were found not to be in violation, he said. Cases against Dun & Bradstreet, Decision Support and Meca Software were dismissed. Company representatives either could not be reached or refused comment. IBM spokesman Fred McNeese declined comment on questions about E-Data or the licensing fees. But companies such as McGraw-Hill are anticipating the December court hearing. ``We fail to see anything that we do in our businesses that infringes on this patent,'' said McGraw-Hill spokesman Steven Weiss. ``We've asked them continually what we've been doing, and E-Data has not told us _ aside from accusing us. ``We have no plans to pay them anything,'' he said. But Freilich said the patent is specific in its description of encrypted digital data, which is how many companies have sold such information since 1994. For example, a customer orders a digital product over the Internet, and pays for it through the Internet with a credit card. These types of transactions are not all that new, as in CompuServe's case. But once the product has been downloaded to the customer's terminal, an encryption code is provided by the seller to unlock the encryption, thereby allowing the customer to use the product. It is this added step that Freilich said the patent describes. Today's network organization also makes the patent enforceable, he said. In 1985 when the patent was granted, there was no such thing as an addressable computer or the Web. ``The technology has brought us to the point where anyone's computer terminal is addressable, where encryption is commonplace and that has led to the enforcement of this patent,'' Freilich said. Scott Smith, analyst at Jupiter Communications, predicted the case would not dampen Web commerce. ``I think it's a blip on the radar,'' he said. ``It may hurt some of the start ups. But larger companies face this kind of thing all the time. They'll be able to shake it off.'' While some may accuse E-Data of trying to stifle Internet commerce, Fink sees his client's efforts merely as a means to cash in on a legitimate, far-sighted investment. ``Besides,'' he said, ``3 cents on the dollar will not put any company out of business.'' AP-DS-11-19-96 2327EST * * * END OF DELIVERY * * *

2 1

Re: Why I Don't Read SF Much Anymore
by Ken Kirksey 17 Dec '03

17 Dec '03

>The problem with straight SF for me is that computers and networks have >changed the future so much that (in the words of the motto of the SF >Writer's Association) The Future Ain't What It Used to Be. The science >fictional futures of my childhood are now dead as doornails. I still enjoy some of the "old stuff", but not in the same way that I did when I was younger. I read those works as period pieces now. There is a certain romance in the Gersnbackian view of the future that I enjoy, especially in contrast to the Grim and Gritty (TM) "reality" of most modern and post-modern SF. I still find Heinlein's juveniles to be fun reads, probably for this reason. Ditto for Edgar Rice Burroughs's Mars books. >And I can't >enjoy contemporary SF that doesn't include a healthy dose of computers and >networking. Computers and networking may not be central to the story the author is trying to tell. And with the way things are going, computers and networking will become (some would say already have become) such an integral part of the culture that they don't warrant special attention. Kinda like airplanes, automobiles, television, radio, microwave ovens, cellular phones, ad infinitum. Computer Networks were a new and nove idea when _Shockwave Rider_ was written, but now with every car and cereal commercial on TV promoting a web site as well, it's not all that exciting anymore. As far as keeping up with current SF, I, like others, don't seem to make as much time to read as I used to. I rely on Gardner Dozios' annual _Year's Best Science Fiction_ anthology to keep me up to date and introduce me to new writers. I've always enjoyed the stories he's chosen, some more than others, and he's introduced me to some great writers that I probably wouldn't have heard about otherwise: Greg Egan, Connie Willis, and Terry Bisson, to name a few. Judging from your comments, I think you'd like Greg Egan, especially his novel _Permutation City_. Ken

1 0

ROB_not
by John Young 17 Dec '03

17 Dec '03

11-21-96. NYP: "Treasury Report Will Oppose Federal Taxes on Internet Sales" Issues of key escrow, digital cash, anonymous transactions, and identifying where in the world transactions occur. Feds claim they differ from greedy states who want to rob the Net golden goose. The report will be posted to www.ustreas.gov for comment. (Not there yet at 10:30 EST.) ----- http://jya.com/robnot.txt ROB_not

1 0

Cryptography in France
by Thomas Hennes 17 Dec '03

17 Dec '03

This is my first post to the cypherpunks mailing list. I've been monitoring it for a little while now, and I would like to initiate a thread on the sorry state of public crypto in France, and would much much appreciate feedback, comments and thoughts on the following. It is no secret that public crypto here in France is a fucking joke. For those of you who aren't up-to-date with French gov't policy on the subject, let me state the simple: Public use of crypto (and esp. STRONG crypto) is *outlawed* in France. This mere fact gives us (the French) the dubious achievement of being rated along with the likes of China, Iran, Iraq and former USSR, to name a few. Now remember, this comes from a country that labels itself as the "Home country of the Human Rights", yet denies its citizen access to the technical means of ensuring REAL privacy. A much-needed privacy, considering the phone-tapping scandal that rocked France two or three years back (then-prez Miterrand himself had ordered that a whole bunch of people --novelists, journalists, politicians, artists and various other intellectuals-- have their phone tapped and their conversations recorded, without any legal permission to do so. Even an uncle of mine was placed on such a list.). I _do_ believe that a strong case --legally, economically and philosophically-- could be made for the legalization of strong public crypto in France. And I am also confident that we are moving toward a de facto use of strong crypto in everyday life. There are several legal points that could force the French gov't to give some slack on crypto regulation. The first one is, of course, the process of building Europe (I am not so naive as to believe this will be a success, but it WILL provide us with some legal power to wield). Of all nations being part of the EEC, France is the only one that enforces such restrictions on public crypto. But, and this is my point, French gov't has made a big fuss about standardization of regulation throughout EEC and its participants, and when it comes to crypto, I believe they've put their foot in their mouth!! ;-) Second legal point: arguing the moral point of freedom of guaranteed privacy. Outlawing public crypto *might* be unconstitutional, considering that the French constitutions have always been built around the anarchists revolutionaries of 1789 declaration of human rights. The gov't will counter with 'Raison d'Etat' and need for terrorist surveillance, but this is the same as saying weapon sales should be prohibited to keep thugs away from weapons. Thugs *always* manage to get weapons, and terrorists *always* manage to escape surveillance and plant bombs in our streets and metro system. Economically, the case could be made for public crypto by underlining the importance of internet economics. It is a stated and definitive fact that e-cash cannot exist without cryptographic means. Now if the general public hasn't got access to strong crypto, why would they risk dealing in e-cash??? Thus France would be left out of an immense -and as of now virgin- commercial market, which in the near future would mean commercial death. And that's not counting all the employement opportunities that would be, one can speculate, created by the flourishing of web commercial ventures. Ironically, Netscape has been granted by the French gov't an 'extraordinary' license to use cryptography in their Navigator software (even though it's the lame, 40-bit export key size). Which means that, as of now, the one and only company that WOULD technically allow French citizens to engage in electronic commerce is a foreign company... So on one hand we have the French gov't making a huge fuss about 'Cultural Exception' when the subject at hand is protecting the French TV and movie business --which nobody actually gives a damn about--, and on the other hand, the very same gov't not only regulates against strong public crypto, but when it finally gives in a little, it's to the profit of a foreign company.. Next thing you know, France is going to equip all its phones with the Clipper chip so that the NSA can listen in on, say, Airbus trade secrets.. Can you get any dumber than this? The last economically sound point relates to competition. By forbidding strong public crypto, France has seriously hampered the ability of French cryptologists to move forward technically, since they receive much less feedback than, say, their scandinavian or US counterparts. And I believe that, in the long term, strong public crypto WILL prevail --I AM optimistic (or is that naive?). So all the French gov't is doing here is denying would-be French companies to deal competitively in the crypto market, which I am sure will explode with the coming of electronic commerce. My last arguments are of the philosophical/moral/political order. Politics in France have reached an all-time low at the end of 14 years of Socialism (some may disagree on this, but this is MY belief). Corruption is now widespread, at every levels of the public administration, and at all 'rays' of the political spectrum. Politicians now have more privileges than the royalty used to have just before the revolution of 1789, when the laws and budgets were more deftly controlled by house representatives than they are nowadays. Politicians nowadays live as a microcosm, in an enclosed glasscase, protecting each other regardless of ideology or political faith. They act as superior-class citizens where they were meant to be representative of the people, the citizens that mandated them as such. So I believe that strong crypto is not only a right, but a mean that every citizen should use against the preponderance of such a privileged class, in order to make the French motto 'Liberte Egalite Fraternite' something else than an obsolete joke. I'm not an anarchist, nor am I illuminated. I'm a regular guy with a regular job. I'm simply tired of all these self-proclaimed important people that live in the fast lane with MY taxes. And crypto would be a mean for me to combat them more efficiently and to bring back some of that much-needed social equilibrium. And, the hell with it, I want GUARANTEED PRIVACY. On Monday 18 Nov. Greg Broiles wrote: >ICF is "International Cryptography Framework". > >The press release includes quotes from US and >>French<< government officials >indicating that the new system will meet their needs. Man, this spells T-R-O-U-B-L-E ... ;-) Thomas Hennes aie-rd(a)pobox.oleane.com PS: I would've loved to CC this thing to Chirac or PM Juppé, but neither of them have actual e-mails, which tells you a lot about the interest they have in net-business...

1 0

Mass-market crypto phones
by Clay Olbon II 17 Dec '03

17 Dec '03

A while back, Eric Blossom posted a URL for a mass-market, phone encyrption device (http://www.comsec.com/) The point of this post is to posit a scenario based on the implications of this product. This is speculation based on where I think such products should be heading. I think we need to keep a couple of goals in mind. The first, is to get encrypting phones (or phone add-ons) into Wal-mart, K-mart, etc (where probably most Americans now buy their phones). The prices need to be low enough that people will want to buy them (<$100?). Is this technically feasible? The comsec device from the above URL already demonstrates the needed capability. Is the cost target possible? My guess is soon, given the lowering costs and increasing capabilities of current processors. The second goal needs to be to push a similar product for cell-phones. I think this will be perhaps an easier sell, given the higher initial cost for these phones, and their reduced security. Perhaps a home device could be sold with the cell-phone as a package deal, so that communications with the "home base" (i.e your office, home, etc) would be secure. With the rapid growth in cell-phone sales, selling a package such as this might ensure a larger user-base of home devices. Given that these goals are met, I think widespread use of crypto over phone lines would become almost inevitable. However, the fun part would be the introduction of such products. The FUD coming from police, the government, etc. would be amazing to behold. Clay ******************************************************* Clay Olbon olbon(a)ix.netcom.com engineer, programmer, statistitian, etc. **********************************************tanstaafl

3 2