- cypherpunks-legacy - lists.cpunks.org

Re: SAIC bought InterNic, but who is SAIC? A spook contractor!
by Chris Claborne 17 Dec '03

17 Dec '03

At 05:18 PM 9/28/95 -0700, John Gilmore wrote: >Forwarded-by: gordoni(a)base.com (Gordon Irlam) >SAIC's board members include Admiral Bobby Inman, former NSA head and deputy >director of the CIA; Melvin Laird, Nixon's defense secretary; and retired >General Max Thurman, commander of the Panama Invasion. Recently departed >board members include Robert Gates, former CIA director; William Perry, >current Secretary of Defense; and John Deutch, the current CIA director. >Current SAIC government contracts include re-engineering information systems >at the Pentagon, automation of the FBI's computerized fingerprint >identification system, and building a national criminal history information >system. I am not supporting the idea that SAIC is not annother govt mouthpiece or cover op but it is standard practice to hire retired workers from government that worked in the area that you want to sell services into. I know of a ex army colonel that used to work for a government contractor. I'm sure that he used his contacts to sell services to the government. You gotta love it! Don't trust S/MIME, it's supported by RSA (a govt mouth piece) and uses DES. ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

2 1

Final Roster/Reminder -- Bionomics Conference (fwd)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Here's a sign of the times> S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: 11 Oct 95 14:38:02 . . . Subject: Final Roster/Reminder -- Bionomics Conference Dear Friends, With a record number of 35 speakers and panelists (whew!), the program for the 3rd Annual Bionomics Conference has been finalized. Since our brochures were printed, we've added a number of interesting and thought-provoking individuals, including o Lew Perelman, author of "Hyperlearning" o Andrew Basile, author of "The SPA's Guide to Online Law" o Morley Winograd, author of "Taking Control: Politics in the Information Age" o Frank Gregorsky, former chief of staff to Cong. Newt Gingrich o Jim Griffin, Director of Technology at Geffen Records o Don Lavoie, Director, Program on Social & Organizational Learning, George Mason University o Irwin Glenn, Senior Systems Engineer, Netscape Communications o Pat McKim, Managing Partner, Practical Strategies o Cindy Cooke, Director, Democratic Leadership Council of CA o Dennis Miller, Associate Professor, Baldwin-Wallace College . . . What's more, for the truly tech-savvy, you can now pay for your conference attendance with Cybercash. Just check our web site (www.bionomics.org) . . . ^^^^^^^^^

1 0

anonymous web pages?
by Nelson Minar 17 Dec '03

17 Dec '03

Does any facility current exist to allow people to create anonymous web pages? After anonymous email and anonymous news postings, this is an obvious next step. It seems that it would be a fairly simple matter to write a program that would accept email containing a web page and the destination URL, do some checking, and then create (or update) the requested page. Require signatures and allow receiving mail via a remailer chain, and you've got secure anonymous web pages. The hard part would be finding a site that would be willing to serve anonymous pages. I don't understand the politics at various sites that allow anonymous remailers: maybe this isn't much harder? -- __ nelson(a)santafe.edu \/ http://www.santafe.edu/~nelson/ PGP key 9D719FAD Fingerprint 3B 9B 8E 58 1C 90 57 3E B7 99 ED 13 65 2E 0B 24

2 1

Re: SAIC bought ... [NOISE]
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 7:27 PM 10/11/95, Alan Horowitz wrote: >I used to work for SAIC. It's a legitimate beltway-bandito contractor. To >call it a cover op is sort of missing a point. The government hardly ever >does _anything_ itself (as, say, percentage of budget). Contractors are >the ones who do the dirty work in the trenches. It's not missing the point at all; what I find particularly alarming is this half-measure situation we increasingly find ourselves in, wherein the state farms out the drudgery of being a state but reserves to itself the prerogative to govern by obscure fiat. Institutions like SAIC aren't accountable in a way that gov't agencies at least theoretically are, yet the continuing existence of those agencies amidst this move toward privatization perpetuates this increasingly mythical idea of "accountability." If everything's going to go private, fine, whatever, let's make a go of it, and no one can tell me what software I can/can't use and how much I can/can't deposit, etc.; OTOH, if the USG wants to reserve the right to tell me what I can and can't do in these regards, then it had bloody well better submit to the "responsibility" that goes with that "right": accountability to the electorate. Why do you think the spooks make such prodigious use of cutouts? In part because it's an effective way of evading detection; and, unfortunately, oversight is a subset of detection. I'm sure SAIC does tons of perfectly legitimate contract work--but I'm equally sure that it does tons of covert work. And far too much covert work is covert for no other reason than it's stupid (read my lips: "exploding giant clams") or--in the case at hand--something that a rapidly growing sector of the electorate rightly regards with suspicion. Ted

1 0

Follow-up to sci.crypt posting that prompted NYT article
by rubin＠faline.bellcore.com 17 Dec '03

17 Dec '03

Yesterday, a New York Times article cited a posting by several graduate students at Berkeley about the insecurity of the Internet. We found the sci.crypt posting very interesting and relevant because we spent a good portion of the summer working to address the same problem. Namely, detection of the malicious (or other) modification of an executable in transit over an untrusted network. In particular, we believe that our system could be used to solve the NFS problem mentioned in the posting from Berkeley. Our paper can be accessed at ftp://thumper.bellcore.com/pub/rubin/stretch.ps Avi Rubin <rubin(a)bellcore.com> Trent Jaeger <jaegert(a)eecs.umich.edu>

1 0

Re: [NOISE] was Re: java security concerns
by madden＠mpi-sb.mpg.de 17 Dec '03

17 Dec '03

> Rather than trying to prove a program to be correct (which I agree is doomed > to failure for the forseeable future for all but trivial programs) I disagree: automatic program verification has come along in leaps and bounds, largely due to the current research impetus in safety critical systems. Various sorting programs, bin-packing programs, to mention but a few, have all been successfully auto. verified (and these are non-trivial programs, which form the building-blocks of even less trivial "industrial-sized" programs). Indeed, the technology has been extrapolated to the automatic verification of electronic circuits, compilers, schedule problems and computer configerations (all w.r.t. a user's specification). The real problems lie with specifying the program/problem correctly in the first place (so-called specifications capture), and with automatic program *synthesis* from specifications (which, in mathematical theorem proving terms, presents the problem of creating existential objects, as opposed to just verifying that they do the right job). I do, however, agree with the need/desire for a greater diversity of program properties which can be automatically checked. Regards, Peter ================================================================= Dr Peter Madden, Email: madden(a)mpi-sb.mpg.de Max-Planck-Institut fuer Informatik, Phone: (49) (681) 302-5434 Im Stadtwald, W-66123 Saarbruecken, Germany. Fax: (49) (681) 302-5401 =================================================================

2 1

MITM evasion MITM evasion
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

Two years ago, I pointed out that getting a single message past the man in the middle isn't good enough; you have to convince your readers that the key they received on one channel is more accurate than the key they're receiving on all the other channels. But if they'll believe that, they may also believe the man in the middle's announcement that the key in your name on all the keyservers is wrong, and the correct key is the one he's putting out. Can't win either way, but it's still important to get the key out. My current key is 0x54696D4D; the fingerprint is 4D 65 44 75 53 61 21 2F 41 73 55 64 85 6D 21 7F. .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

3 2

Re: Pointer to 10/9/95 EE Times Article
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:30 PM 10/11/95, Anonymous wrote: >"According to the group's moderator, who prefers to remain anonymous, > `The most important means to the defense of privacy is encryption. > Cypherpunks are therefore devoted to cryptography. They wish to learn > about it, to teach it and to implement it.'" > >Ok, since when is the Cypherpunk's mailing list moderated? > >It is apparent that the author, Larry Lange, has never studied the >list closely or he would know how amusing this sounds... > >(Geez, if he had ever read one of Tim May's posts on the subject... :-) I have a theory about this. First, I recognize the style of the quote, as no doubt many of you do. Second, my guess is that the reporter contacted the person being quoted, asked "What is your role?," couldn't interpret the answer given, and so used the only term he understood. Namely, leader or moderator. Anarchies are tough for hierarchical minds to grasp. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: NYT on Internet Flaws
by patrick＠Verity.COM 17 Dec '03

17 Dec '03

> From: "K. M. Ellis" <kelli(a)zeus.towson.edu> > > This one is _really ripe_ for a response to the editor. Ideas? > > We could start something off-list if there are several interested in > co-authoring. > I'd love to see something in there about most commercial sites being behind firewalls without nfs access across the firewall. This greatly reduces the risk from the nfs problems. If you get your binary via nfs from a trusted host inaccessible from the internet, then if you have this problem management can handle it as an employee problem;) There are ways to make secure firewalls, it's fairly well understood. Sometimes people point to things like the hack Mitnick did last Christmas, but his attack took advantage of a couple of things a security expert shouldn't have allowed, first and foremost two machines were accesible from the internet, and one of them trusted root logins from the other without a password:( I could write something up about it if you'd like. Patrick _______________________________________________________________________ / These opinions are mine, and not Verity's (except by coincidence;). \ | (\ | | Patrick J. Horgan Verity Inc. \\ Have | | patrick(a)verity.com 1550 Plymouth Street \\ _ Sword | | Phone : (415)960-7600 Mountain View \\/ Will | | FAX : (415)960-7750 California 94303 _/\\ Travel | \___________________________________________________________\)__________/

8 10

Cylink license fees
by cman＠communities.com 17 Dec '03

17 Dec '03

I just received a very informative package of information from Bob Fougner at Cylink, which, in addition to a copy of the relevant patents and hardcopy of the materials available on their web page, contains a "limited time offer" to license their patents in one of three ways: 1) Practice of DH Key exchange & DSS: $50,000 2) Right to use & distribute RSA: $62,500 3) Ulimited field of use to practice public key: $75,000 Those interested in obtaining this information should probably fax him at 408-735-6642 with a request for the info. Much of the information is available online at: http://www.cylink.com. Obviously, anyone wishing to practice RSA would also need to get a license from RSADSI. Also, it is my impression that are claiming Hellman-Merkle as the precursor patent to RSA, which means that this situation will prevail at least through late 1997, not early 1997 (when Hellman-Diffie expires.)

1 0