- cypherpunks-legacy - lists.cpunks.org

Re: Employer Probing Precedents?
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:12 PM 12/28/95 -0800, Tim May wrote: >However, corporations aren't given the luxury of disassociating themselves >from the actions of their employees. (Contract workers are a further issue, >and the issue of whether they supply their own tools/computers, workspace, >etc., enters in.) I think this point about "contract workers" is going to become a lot more interesting as people move away from the traditional "employee for life" model and towards working at home/telecommunity, or working as subcontractors/consultants, etc. Further, it's becoming more common for employees to own their own communcations tools, and bring them to work. Arguments about a right to eavesdrop as being derived from workplace property ownership don't seem to work where an employee is talking on their personal cell phone, getting/sending messages on the SkyTel two-way pager that they pay for, using their laptop/Newton/PDA to get/send E-mail (using their private ISP/POPmail provider mailbox), and so forth. The concerns (about disclosure of secrets or wasting of time) raised to justify the invasions of employee privacy are still present, of course, but not the convenient "it's not your phone so you have no privacy" excuse. Employee/contractor ownership of work tools (or non-work related communication tools in the workplace) is probably going to get even more interesting; recent Ninth Circuit decisions re copyright law and licensing agreements have been sharply restricting the right of software licensees to allow third parties to use the licensed software. (e.g., _MAI v. Peak_ and _Triad Systems_, see http://darkwing.uoregon.edu/~gbroiles/triad for more on this and pointers to other analysis and the opinions themselves) I think this may lead to software licenses (or hardware ownership) which follows employees from home to work, and from job to job. Employees may get a credential from Microsoft, or Borland, or Mathematica or Word Perfect saying that they're allowed to be using a set of software tools; professionals will probably pay for those credentials themselves, or have them paid for as a fringe benefit of employment. An easy connection is to training related to the "software-right" - the licensor would also certify that the employee has been subjected to X hours of training and knows at least Y buzzwords and Z fancy tricks relating to the software. Retired or unemployed workers may work in a "black market", using software they're trained on but not licensed/certified for, logging on with the credentials of licensed users who have died recently or are sleeping. (Similar to the network of unlicensed uninsured under-the-table contractors, framers, electricians, drywall installers, etc., who exist at the fringes of construction activity.) And so on. >I maintain that my employees are beholden to me as to what they run on >their computers. They can always choose not to work for me. (And the same >applies to hotels, actually. Were a hotel to have stringent rules on >in-room behavior, such as the YMCAs and religious retreat hotels have, then >customers have little right to complain about bed checks, mixed sex bans, >etc. That most hotels have no such rules says more about where the >Schelling points are than it does about the efficacy of rules and laws. Subscribers to the Coase theorem would suggest that (modulo transaction costs) it doesn't matter who is initially assigned the right to determine whether or not surveillance will occur - the party who most values that right will bargain for it in the end. Then again, that party may lose something in exchange - and that's what makes this interesting. (And, I think, much too complex to simply be dismissed as a matter of "property rights". Then again, property looks to me like something that law creates, not something which exists pre-law which law is created to protect. YMMV.) I'd rather see the right to control surveillance assigned to employees, and let employers pay extra for it if they think it's necessary to their business situation. (Some might argue that this is the current situation, or at least that surveillance is something that market participants bargain over. My impression is that the current situation is legally murky absent a clear statement re "we're going to monitor you on the phone and search your briefcase when you enter and leave" and that a clear resolution re the legal baseline of surveillance would be useful to bargainers. And if we were to set a baseline for further bargaining, I'd rather see it set to favor employees.) -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

FW: your financial transactions posting (fwd)
by Light Ray 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 29 Dec 1995 00:02:50 -0800 From: Bud Aaron <bud(a)checkmaster.com> To: "'privacy(a)ftc.gov'" <privacy(a)ftc.gov> Cc: "'hwg-business(a)daft.com'" <hwg-business(a)daft.com> Subject: FW: your financial transactions posting ---------- From: Greg Metcalfe[SMTP:biosphere@proaxis.com] Sent: Thursday, December 28, 1995 9:35 PM To: bud(a)checkmaster.com Subject: your financial transactions posting Bud, I've seen some well thought out messages in the commercial transactions listserver, but you are the first that I've seen with real numbers. Would you do us all a favor and make sure that you get some of this information to the privacy(a)ftc.gov discussion? I hope I'm not impertinent for asking. But numbers are probably our only hope. The gov has never really been into quantitative thinking... TIA --- Greg Metcalfe | The secret is getting E-mail biosphere(a)proaxis.com | enough sleep. URL http://www.proaxis.com/~biosphere | Usually. The following is a copy of the information mentioned above: The following article is quoted directly from Bank Technology News "Are Internet Security Fears Unfounded? Just how safe is the Internet? Pretty darn safe, according to Forrester Research, Inc., Cambridge, MA. Forrester predicts Internet fraud will occur far less frequently than current rates of fraud with cellular telephones, toll calls and credit cards (see chart). Cellular telephone fraud costs the phone industry almost $20 per $1000 in revenue, Forrester says, and toll-call fraud eats up $16 per $1000 in revenue. Meanwhile, credit-card fraud cost MasterCard almost $1.50 per $1000 in revenue in 1993. In contrast, Forrester says companies can expect to lose only $1 per $1000 of transactions on the Internet. Forrester's contentions on the safety of the Internet are backed up by some of the judges in this year's Best of the Newest bank technology survey. While many of the judges expressed concern over security issues, quite a few were also confident that the Internet will become a stalwart transaction system. See page one for further analysis of all the newest banking technologies." The chart accompanying this article shows the fraud levels in graphic form. You folks keep making drafts as a collection system seem more and more attractive. The fact that drafts MUST be deposited (not just cashed) and that the bank is going to want to know the depositor quite well means that tracking is excellent. The requirement added by the FTC that those whose accounts are being drafted must be notified by mail makes the system even safer. Let me add this - some level of security is obviously needed but regardless of the level of security, fraud will occur. All of these arguments for high levels of security remind me of the need for virus protection. Yes, virus attacks are real but virus protection vendors certainly make money by raising greater fear than may be realistic. Bud Aaron bud(a)checkmaster.com http://www.checkmaster.com/internetchecks/ The privacy list is run automatically by the Majordomo list manager. Please mail questions/problems to owner-privacy(a)ftc.gov

1 0

Revocation of Zimmermann's fossil key
by Philip Zimmermann 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To whom it may concern: I have revoked my oldest PGP key, keyID FF67F70B, user ID "Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu>" which should no longer be used. Instead, use my newer key, keyID C7A966DD, with user ID "Philip R. Zimmermann <prz(a)acm.org>" The new key has been distributed with all PGP versions since version 2.3a in 1994. My old email address at the sage site will soon disappear, so I'm revoking my old key. I keep getting mail at my old address at sage because people get that old address from my old key. I can't just revoke my old userID, so I have to revoke the whole key to get people to stop using it. Below is my revocation certificate, which I created shortly after I generated my new key in 1994. Please discontinue the use of my old key and my old email address. Note that this revocation does not imply that my old key has been compromised. -Philip Zimmermann prz(a)acm.org Here's my old public key with the revocation certificate... - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAipt8iwAAAEEALGKgLblEQCfcZEiQ+jBFnw5g0B+o16GMPssYBKI7bWgjGbB DqnkQoMGagNJpcG5tX2bKpJdegi01Sp22QOMpZbdrv/KXRWHp/JjrNLAZHp9B+nl osbRrPLhGZZA/OgyU6D2GsGnMDcTacPD43wo1g+RUpDv+UjMr+J13g7/Z/cLAAUR iQCVAgUgLIUrAOJ13g7/Z/cLAQHThQP+NtEJ2yPCXPA+Em45HDWQLwb3X0AM61K0 Mt0Woq54eaC1U5A03oVqV5wEPM6mfrhH18FB6NwO5eROKOdXY1xz7nCggJ9eYfoX ZH6wfXCqGFSB4oLJU97nFHrqvh69IYSrrlKM/dJ29F5CKVxJApstpnRmfHddrZLP yfR2y6dxGeW0LFBoaWxpcCBSLiBaaW1tZXJtYW5uIDxwcnpAc2FnZS5jZ2QudWNh ci5lZHU+ =9UCt - -----END PGP PUBLIC KEY BLOCK----- Here's my new public key, generated in May 1994... - -----BEGIN PGP PUBLIC KEY BLOCK----- mQCNAiv8ZoAAAAEEAKc4d45hN5qFM79nWGLkrGWputWmtdxJk0BZEbi0kNRbJBC2 p10ASImd//cCDwLR2alBUSt8O2WGik9PBZgthjMOenoDmzKiG8BkE9AFKonyxvD2 lDnqbydXi+YQmOTsWSw4jTTSb3cflhVkf8hVUVpMFQThafV0CmV5hLjHqWbdAAUR tCJQaGlsaXAgUi4gWmltbWVybWFubiA8cHJ6QGFjbS5vcmc+iQCVAgUQLB48XPTK AIGN5yLZAQHWtwP/RBiLPN4dnt8sm9qZtK0HPYV0hfdZ4IiSfR0V52uKKMQsIrBJ x2c5Z2vurBLeKkh8Oecf/X+Zh2mEenrymR/urBCf8xGQnyTPew4t/3IQ5KXsqi2b uOTysk9Pkk+cqxZTEXJQWixB3fVKrCkR02xbWcRXQ/pPs0ObOE4VLtQT1G2JAGAC BRAsHUvayj2h/YZap/MBAcRRAliFU3EgFQdOGkC2nCupBAitm/R6CkKtayTZHQrd e5I/pCY0bGUc6alEnSuqZUyA9HC1fMg0iqsqM4vrQ6PZr2qV0IXDY4miyYNRJyKJ AJUCBRAr/GdG4nXeDv9n9wsBAYr/BACh4r3DZsq9IOy2mcd+0D0qKV0Ymb887Lw0 KjIBKLmUIqXUw2Rbn8bAnr+GF0qGE61oAHdSSN7pLROmfjl7nMVaODXHOxYuLHAn HZ0Z/AQsLc5U055Pm6rQ5lKrSaL4z9mEKJTWM9hQDYMZpH4oAC8hIz+apYH+/hBj ZR9w7AKluw== =1jM9 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOOo+WV5hLjHqWbdAQHhaQP/SW02cLbkAtHq6cdNHtcJ4YqSlKqxumyR BYpjKrNatLiVAFQP8njiLRFqPi8rgf6809nnQETIVcyt3BzURakyJLd4UuL3vvqD lluyGdj9MoaQiQkWIbBMADFdNGFDvRCQkcxhS78hHwXSY7viCSWNnfCdJcpaFNCk QPfqPsMErMo= =uH7K -----END PGP SIGNATURE-----

1 0

Latest in Factoring
by Alan Tu 17 Dec '03

17 Dec '03

Jeff Lawrence wrote: >>>>> Well, my opinion is only one of many, but I just finished installing PGP 5.5 and it allows both RSA keys (max of 2048) as well as DS/DHH keys (max of 4096). Most keys I'm seeing these days are running at 2048, so 1024 could be considered as "below average". Just my $0.02 <<<<< First, I do have a 2048 RSA key I generated with 2.6.3ix, but its in hibernation and not on a key server, yet. (g) Second, what is 5.5 compared to 5.0? Let alone 5.5.3 as displayed in your key block? Third, I think its arrogant that PGP Inc. (and many many other software companies) have left dos/win 3.x users behind. The people, like me, who still use DOS/Win 3.x obviously like it, not to mention people not in the USA. Then, because of the lack of conventional encryption, and other options not in pgp 5.0 (I don't know about 5.5), and because its not freeware (freeware doesn't fully support RSA), people on the Internet had reached the concensus that they weren't going to stop using pgp 2.6.xxxx. When I complained about 5.0, one person asked me if my 2.6.3ix version had stopped working. Anyway, I think that PGP Inc. should release a version of PGP for DOS that lets you generate longer keys, be it RSA or otherwise. Finally, there are a lot of people in other countries (where PGP has spread as widely as in the US, if not more so) who are not compatible with Win95 users using PGP 5.0 freeware. --Alan Tu Type Bits/KeyID Date User ID pub 1024/E5D915E1 1997/04/27 Alan Tu <atu5713(a)compuserve.com> Alan Tu <102534.2165(a)compuserve.com> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i Comment: Requires PGP version 2.6 or later. mQCNAzNivkwAAAEEALdGUXD3j+RioIirVG46N6LaGD3YMMVVT5Mjwr5JojQsDICy 856I06Ugo/Fqid2A/os7v/gwE+Sj/WhMERgTsTejUZtsucTpS9sae+cc27Fjjq1l hOnqcLZqnHDDNyn3+jesVFPLnRlSoHbmcBK1XDW/SJT1anZz55ezmBrl2RXhAAUR tCBBbGFuIFR1IDxhdHU1NzEzQGNvbXB1c2VydmUuY29tPokAlQIFEDOguk6Xs5ga 5dkV4QEBBF8D/1B0ePqlMavWEUMP0uTmyvWFI7jooAcih6uHZFo2u+u3EzE2Is8X EoLHg39DhjleTHPu6TnGsWIiwDYEslzYeVw/Cglx6eliYIr/qs7peEywuhtZsEFH ln6yR9IE6rX3b3GCvPSQ5uPhXWrd2kWaZvG4rQ4Oj1m3yTrFaPRqCBPvtCRBbGFu IFR1IDwxMDI1MzQuMjE2NUBjb21wdXNlcnZlLmNvbT6JAJUDBRAzyUJWl7OYGuXZ FeEBAc4TBACT8gLtyE0C8NBGs9aDa9kHfeNzN8VbNfUpoOiWi4duAAZFiAt/e+ji J2BUMLIY8kzm2WX4mVzpKYjvea5TtHeQgbESV1HVZ5k7abENMUYz5nSMloOE+bb+ XRzgGgFF3htGXDJNywlLNgoYi5vTMT0pbGlCzOu215Cc4mFls2w1iA== =CM85 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Guy Polis is a pedophile
by Information Security 17 Dec '03

17 Dec '03

Heh-heh-heh: it's so funny so see how high Dimitry jumps when he sees people being made aware of his body of work. > From: dlv(a)bwalk.dm.com > > I have perfected sucking my own cock! Call me for a video! Oh, Dimitry, we already know you are in love with yourself. ---guy And what a pathetic Net researcher... ;-)

1 0

Re: GNU market penetration... (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Subject: Re: GNU market penetration... > Date: Sun, 8 Feb 1998 14:43:51 -0600 (CST) > From: ichudov(a)algebra.com (Igor Chudov @ home) > Jim Choate wrote: > > I have a question, after going to the GNU homepage (www.gnu.org) I have not > > been able to find out the numbers of how many if any corporate subscribers > > and participants to the GNU Foundation. Is there anyone out there who might > > have a pointer to this information, or better yet is an actual participant > > in the GNU heirarchy and can discuss these and related issues? > > The number of subscribers bears almost no relation to the number of users. Here is what I am thinking... - commercial success at larger commercial enterprises can be seen by looking at their gross orders of software. Consider that if a company decides they want to use Win95 and WinNT for their systems. Are they going to buy them one at a time? No, they are going to purchase either large quantities or site licenses. - Since GPL doesn't really support site licenses in the normal sense they won't be there to look at. In other words the total number of site licenses from corporations for software is a measure of its penetration. - Since GPL doesn't prohibit buying one copy and then making as many subsequent copies as you desire it is not likely that a given company is going to buy great quantities of GPL'ed software. What they'll do is have each department, through their own budget disbursement and orders, purchase such software as required. So we can expect to see one or more, but relatively few overall, purchases of software. Since this does not seem, to me anyway, to allow for a differentiation between one hacker purchasing the software in a comany or an entire department this also will not be a clear indication of penetration. - Large companies faced with the above situations and having committed to the continued survival of those sources of software will want to create a situation where they minimize their need to keep re-ordering software as its needed (expensive in people and process time) the reasonable thing is to subscribe for annual terms or similar programs. What I would like to know is what is the percentage of subscriptions by companies in regards to the total number of subscriptions of GNU software. I couldn't find any way to get this info on the www.gnu.org page. Since the question is at what point is current penetration of Linux into commercial entities as a standard business environment this seemed relevant. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0

practical annoyances from multi-level security?
by Simon Spero 17 Dec '03

17 Dec '03

Does anybody have any pet peeves and gripes about using systems with a compartmentalised security model- things that took ages to do even though they didn't really impact security, features that just got in the way or were too complicated to really use, etc? I'm currently working on a problem that seems to have some analogies to the compartmentalised problem, running code with various levels of trust were deliberate read-up and accidental write-down could be a breach. I've personally never used a system of this sort, but I've heard from friends in the RAF doing COM/SEC (more COM than SEC) that MLS can be a real pain at times. [for the truly paranoid, the RAF operates a network of communication satellites called Skynet :-)] Simon p.s. still no luck on the Hackers soundtrack - I did recognise a few prodigy tracks though (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

CAV_ein
by John Young 17 Dec '03

17 Dec '03

12-29-95. NYPaper: John Markoff page-ones Compuserve's cave-in to Reich sex law and the alt free-screeching for sex home censorship cave-in to rutting parents ashamed. CAV_ein

1 0

Chinese Cypherpunk quote [NOISE]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I see that some rants here are rubbing off on the folks who write chinese fortune cookies, In tonites dinner, The cookie said: The will of the people is the best law. I wonder if we can get a couple thousand cookies sent to Congress with that message? A.E.N. or to T.C.M..... Xmas_Troll

1 0

Re: Compuserve is Not "Censoring": Look to Governments for the Cause
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 28, 1995 23:30:19, 'tcmay(a)got.net (Timothy C. May)' wrote: > >I see a positive longterm trend toward people connecting through smaller, >more local services. > Quite correct. Not only does the internet radically change (at least perceptions) of space and time, it also is producing serious disequilibriums of scale in economics. Economy of scale states that until a farily high limit is reached, bigger enterprises tend to produce goods that are less expensive than those produced by smaller enterprises. Specialized handicraft production aside, the goods produced in larger enterprises also tend to be of higher quality. The disequilibrium here began with the development of the microprocessor as we see from the shift to the old centralized IBM iron to the microcomputers we're using today. Ditto certain aspects of network switching. Ditto DES moved from centralized hardware to decentralized software. We're seeing a growing dystopian world where national entities and non-governmental organizations all seek to enforce their particular cultural/political/economic/etc. biases on the global internet. I believe this process will continue for some period of time. At the same time we may (and I think likely will) see aspects of the net broken down into widely geographically separated locations that simultaneously have no more effect on end users than the floor at the central library on which the book we want resides. E.G. we'll use Denmark to get "alt.sex.granny.gum-jobs," ftp to Singapore for "/warez/microsoft/win99/hack/" and to the Turcos Islands for "data.finance.internal.morgan." We'll have all three open and on our monitor at the same time, passed through an second-level ISP in some small country that decides there's money in switching and will no more regulate data throughput than they would try to hold hotel keepers responsible for the content of the phone calls made by their tenants. --tallpaul

1 0