- cypherpunks-legacy - lists.cpunks.org

Microsoft Internet Announcements Thursday, December 7, 1995
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "A day that will live in infamy." Anyone have the exact time that Bill will begin speaking? I think it would be "neat" if we timed the release of a complete rewrite of the win95netbugs FAQ (with a new security section), improvements to the hackmsoft page, and other stuff for 15 minutes after Bill begins. The win95netbugs FAQ, version 4.00.950, will be posted to the following places tomorrow morning (I'll probably be up all night): http://www-leland.stanford.edu/~llurch/win95netbugs/faq.html [canon URL; multiple load-balancing SPARCServers] http://www-dccs.stanford.edu/NetConsult/Win95Net/faq.html [use this if you have an old Sun DNS server that barfs on the www-leland lbnamed tricks] news.answers, comp.answers, comp.protocols.tcp-ip.ibmpc, and several higher-traffic groups (this will be the first approved and rtfm-archived posting; the news-answers folks got back to me last week). I'll probably create the throwaway w95netbugs(a)aol.com for posting purposes. gopher://quixote.stanford.edu/1m/win95netbugs An email autoresponder to be named later (finger this account in the morning). An ezine or three to be named later. - -rich -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMMXlBY3DXUbM57SdAQFnzwP/ZaFJsyz7H/uViPAetTiaBnLxvgZBFmiE mURZdUHU7vVPZ1cIjdO2j0ARoulwQvzXUywezTHusIBGgbxdMf0/NpErpAbFktvA /A7uBGo38scSaYIATLpMEMx8aomoeDiwRxUyzXTCAaRnBHfHf0l0/egDUYPWnK3D ZTF1cFzv+jA= =cHCp -----END PGP SIGNATURE-----

1 0

Re: Solution for US/Foreign Software?
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>At 8:06 AM 12/6/95, jim bell wrote: > >>>"Crypto hooks," basically the scheme you are proposing, were thought of by >>>the authorities and are not a bypass of the crypto export laws. >>>--Tim May >> >> >>I'm not saying they are a "bypass" of the laws. Rather, I'm saying that >>if the goal is to: >> >>1. Let companies like Netscape make foreign sales. >> >>2. Still comply with the letter of the law. >> > >And I'm saying that your proposal does NOT comply with the letter of the >law. There's no point in arguing this, as the facts are clear. Consult the >ITARs and the previous discussions here and elsewhere on the practice of >leaving "hooks" that crypto modules can later be attached to. NO! You didn't read my commentary carefully enough. These "hooks" (your words) will, in effect, already be connected to encryption software weak enough to make NSA happy. You know, 40 bit keys or something like that. But instead of being in one large file, embedded into a program, it'll be TWO files. Simple programming change. Everything that implements/defines/limits the encryption to 40 bits will be in the smaller file. This really isn't a "hook," it's an internal connection between two portions of the same program. (actually, it wouldn't need to be in two separate files; a file which implements a patch for the first file would work great.) It'll be exportable, because its key size is "acceptable." At the time the export license is requested, the replacement module to increase key size probably won't even exist, in order to avoid giving the USG an excuse to deny the export license. After the license is obtained, the replacement module is written and shipped to domestic users. I fully realize the USG won't "like" this kind of thing. But if they are trying to take the position that certain kinds of encryption software CAN be exported, and some can't, they're going to have to approve SOME programs for export, using criteria which at least pretend to be objective. In view of the nearly limitless possibility of patches, how would YOU distinguish between programs?

1 0

Re: GAK Flap Happening at a Good Time--Journalists Read!
by tien＠well.sf.ca.us 17 Dec '03

17 Dec '03

Sameer wrote: There was no Netscape (or RSADSI, for that matter [an RSADSI employee showed up, but it was on his own time]) representative at the recent Bernstein hearing in SF. I think that shows how much they really care. Actually, this is not entirely correct. An attorney for a firm which is outside counsel (crypto-related) to Netscape did attend the Bernstein hearing. Lee Tien

1 0

Re: Use of PGP as an export?
by tien＠well.sf.ca.us 17 Dec '03

17 Dec '03

Actually, the ITAR contains specific provisions for "defense services," and it is possible to "export" "defense services." Lee Tien From: Bill Stewart <stewarts(a)ix.netcom.com> Date: Sat, 02 Dec 1995 19:24:24 -0800 Subject: Re: Use of PGP as an export? At 09:09 PM 12/2/95 -0800, Ted Cabeen <cabeen(a)netcom.com> wrote: >I think this has been brought up before, but I could only find one reference >to it in the archives and it wasn't too helpful, so I'll ask again. If a >university provided a copy of PGP for use on their unix machines and a >non-resident, non-citizen *used* the copy of PGP on the server, but did not >download it onto their own machine, but instead just ran PGP on the server >alone, would it be a violation of the ITAR? My school is interested in >putting a copy of PGP on the university server and wants to know if they >should somehow restrict access to citizens and legal residents only. Thanks. That's not giving technical data to the foreigner, that's providing a service; the ITAR doesn't seem to restrict that. It's not an especially secure way to operate, but that's an inherent problem with multi-user systems or file servers. One way to implement it that would be only mildly insecure would be to put PGP on a file server, with execute-only permissions; users of client machines still could be attacked by somebody faking out NFS, but they wouldn't have to send their passphrases across the net the way they would in a telnet session. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281 Lee Tien Attorney tien(a)well.sf.ca.us (510) 525-0817 voice (510) 525-3015 fax

1 0

Re: Secret Clearance
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hal9001(a)panix.com" "Robert A. Rosenberg" 6-DEC-1995 12:50:58.52 The problem is that they are subject to blackmailed/bribed/subversion ONLY because the employer will use the info as an excuse for firing/restricting the employee. If someone has a "skeleton in the closet" such as being gay, so long as the employer does not discrimate against gays who INFORM the employer of their sexual orientation or if the employer does not care about the person being gay (ie: removes it a potential blackmail threat) there is no problem so far as I can see. It is only when there is something that is WORK RELATED which would affect the person's performance if not known that the question of a background check is relevant. ------------------- Unfortunately, this only works if one assumes that work is the only thing that is valuable in the person's life. Blackmail can easily be used against someone who is afraid of some information emerging to their family, for instance. This perspective still isn't an excuse for disallowing gays, however... the person who should be held responsible for such problems is the person who responds negatively to the revelation. In other words, if the person's family would react negatively to the person being gay, that's the family's problem, and should be treated as such. -Allen

1 0

unsuscribe
by Mary Rose 17 Dec '03

17 Dec '03

unsuscribe

1 0

News on Congressional Debate on Exon
by tcmay＠got.net 17 Dec '03

17 Dec '03

I just heard (12:15 EST) that the House has adopted language similar to the original Exon-Coates language in the Senate (as opposed to the White language, which was less restrictive in that it dealt with material that was "harmful" to children, interpreted to mean child porn). It looks like Internet Service Providers will soon be held liable for "indecent material" passed by their systems. I would expect most ISPs will drop the alt.binaries.* newsgroups as a first step, and maybe other groups as well. (Controlling Web page accesses is a much tougher problem, of course. so I wouldn't expect much action on this at first.) By the way, I recently discovered a new twist on "age credentials": the use of credit cards to prove age. One image site is asking for a "valid credit card number" to be given...not to use for charges, but just to do a quick verification (they claim a few minutes or less) that the card is valid and in the name of the person accessing their site. Some obvious security issue. An interesting twist, though. If the Exon Bill really does go into effect, and age limits on access are imposed, I'll be looking for what we've always joked about: the "Information Superhighway Driver's License." --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: PGP
by DANIEL CHARPENTIER 17 Dec '03

17 Dec '03

> you really ought to be more thoughtful about what and how you write on > the cypherpunks list... The how is referring to not double spacing isn't it. Sorry, I've been up for the last couple of days and didn't even realize it. What do you mean what I write about? > > anyway, the PGP code from MIT should compile on nearly all unix > machines. i'm not sure it will compile with a g++ compiler though. all > unix type machines should have uncompress, tar, (g)cc. just get the > source from MIT. I am not an idiot. I must have downloaded PGP from about 20 million different places. They are all either missing files, some times the darn code won't compile, or when I "tar xvf" half of the files bring up an error and the computer says it can not create the file. I'll try the address that you've sent. Hopefully I will have better luck. In the persuit of constructing a stable cryptographic program that uses PGP what features should be included. Obviously all of the ones that PGP has and encrypting/decrypting e-mail but what else?

1 0

Re: News on Congressional Debate on Exon
by Kevin S. Van Horn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- tcmay(a)got.net (Timothy C. May) wrote: > >I just heard (12:15 EST) that the House has adopted language similar to the >original Exon-Coates language in the Senate I consider it unlikely in the extreme that this passed without Gingrich's sanction. So I guess the Newt's much-publicized opposition to the Exon amendment was just a show. - --------------------------------------------------------------------------- Kevin S. Van Horn | Uncle Sam needs YOU! vanhorn(a)atext.com | But not vice versa. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMMYBmCoZzwIn1bdtAQE9lwGA1w4SUuzkxqcrIWu2EJq65rspqg7PVL6Y FcMbibELAnFrZOUKNVtQNXxtpfaItIGR =QI3W -----END PGP SIGNATURE-----

1 0

Re: Solution for US/Foreign Software?
by Rich Salz 17 Dec '03

17 Dec '03

You would not be allowed to export a browser where the crypto library is a dynamically-loaded library. If you wrote a "browser toolkit", you would have to take special care to hide even the names of the crypto functions in the library symbol table. If you want to do offshore crypto development, your best bet is to document the required interfaces and protocols in a publication which is available to anyone, as this is supposedly protected by the First Amendment. On the other hand, I encourage you to try to do otherwise. /r$

1 0