- cypherpunks-legacy - lists.cpunks.org

Re: PICS
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frantz(a)netcom.com" 12-APR-1996 22:58:59.49 >I had a chance for a brief look at the PICS protocol, and it seems to have >a lot of cypherpunks relevance. It includes features such as: > Multiple third party rating systems No problem. Although it looks like the CDA-replacement bill would essentially require using one with at least as great anti-minor censorship abilities. > Digital signatures This is a problem, unless one simply deletes the signature on modifying a message, and takes the deny-everything-to-minors approach. -Allen

1 0

carrick, Blowfish & the NSA
by Jerry Whiting 17 Dec '03

17 Dec '03

One reason we chose to use Blowfish as the basis for carrick is that it _is_ a new algorithm. One has to assume that the NSA et al. has tools optimized to crack DES and possibly IDEA/RSA. At least let's give them something else to sweat over. In the short term there's a high probability that a cross-platform Blowfish-based encryption toolkit will muddy the waters and make life interesting for us and a bit more challenging for them. We're shooting for a May 1 release for Windows with the Mac and DOS 6 weeks behind and VAX/Sun a month after that. We're aiming for the stars: encryption, time/date stamps, signatures, message digests, etc. all based on Blowfish. We're doing a core engine with APIs, a standardized file format, and extensability for other developers. We're very committed to making the spec including the API and file format VERY PUBLIC. Like I said, we're aiming high. So yes, if we're successful Blowfish should be taken more seriously. And yes, when I outlined the above to the NSA while asking for an export permit, I was met with silence on the phone. I can't wait to meet with them mid-May when they come out to visit. My sense is that some junior level person(s) looked at Blowfish when Bruce originally published it in Dr. Dobb's and that their report was filed away waiting for the day when someone actually used it in the real world. Our marketing tag ("Encryption software so good, the Feds won't let us export it.") may well become a self-fulfilling prophecy. But that's OK because having others adopt carrick is our real goal. Building up a strong U.S. user base is OK while we wrestle with the NSA over how big a key length we can export. Their initial response was that 40-bit keys were specific to RC2 and RC4 and that Blowfish was another kettle of fish (bad pun intended). Either way we're going to publish an extensive FAQ on carrick that should allow someone to not only work with carick but perhaps clone our efforts. IANAL but my understanding is that publishing such a document, with or without source code, and making it publicly available to non-U.S. citizens is perfectly legal. So NSA if you're reading this: This may be yet another example of locking the barn door after the genie is out of the bottle. Prohibiting us from exporting carrick the product is pointless if we're allowed to fully document carrick the API and file spec. Jerry Whiting jwhiting(a)azalea.com 1 800 ENCRYPT

8 13

WhoWhere is a Fucked-Up Operation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:29 PM 5/3/96, Patrick May wrote: >Rich Graves writes: > > For a good demonstration of why WhoWhere? is not necessarily the greatest > > thing since spice racks, look up "Louis Freeh," "Fuck You," "Asshole," > > "System Privileged User," and "Stephen Hawking." I keep telling them that > > they'd better remove this last, but they don't consider it a priority. > > If you want further evidence of their technical skills, look up >my name. I'm responsible for the corp(a)spe.com account. WhoWhere has >therefore decided that I am responsible for every "corp" account in >their database and has attached my name to each and every one. I >informed them of this several weeks ago but they are evidently not >interested in cleaning up their service. > > Being both socially and technically challenged, perhaps they want >your Fucking Statist input on obtaining a government grant for a >clue-free business. I agree with my namesake that WhoWhere is one incredibly fucked-up operation. I tried to add an entry for myself, and my entry has (after several days) not made it. (I tried to be truthful, including such things as "felon" for what I do...perhasp their Thought Police considered my entry a joke, suggesting that they must be applying their own judgment to entries.) I then figured that some of their "automatically generated" entries for "Timothy C. May" needed correction. Not suprisingly, the system asked for a password, so I was unable to correct their defective entries for me. Fuck em. Then burn the body. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Nobody's Business
by StanSquncr 17 Dec '03

17 Dec '03

In a message dated 98-03-15 05:10:13 EST, nobody(a)REPLAY.COM writes: << That was back in the days when Americans still knew how to make a big, high-powered car, but cypherpunks didn't use them to get to their computers because they weren't namby-pamby momma's boys like those godless commie A(h)OLs who get their peckers hammered on the cypherpunks list and then complain because they can't get off. >> It's always easy to tell who's nerves I touch, notice the "McCarthyism" - " ... commie ... ", you guys can't hide, you're too fucking stupid. Register and vote against Conservatives, Liberatarians and Republicans. And Nobody, call yourself for what you are, a "DittoHead" (ie: a "stupid, fucking moron"). Oh, but the REAL name for joker's such as "nobody"? He's a member of the "Know-nothing" movement. Look it up in a Dictionary. << Has anyone seen my shoes? I can't find my shoes... >> That's because you're a "stupid fucking moron." Stan

1 0

Re: Lotus Notes 24-bit sellout
by jim bell 17 Dec '03

17 Dec '03

At 09:21 AM 4/12/96 -0700, Jerry Whiting wrote: > >When Ray Ozzie announced the work reduction sellout at the RSA conference, >both he and Ms Denning (whom I spoke with about it later) mentioned that >there was something else in Lotus Notes 4 besides the 40+24 bit compromise. > >My thought is that the NSA gave them something else in exchange for the >mandatory escrow scheme they're all talking about publicly. Perhaps some >other crypto code the NSA had lying around unused. > >So looking for a common 24-bit subkey may reduce Notes' key to a 40-bit >brute force exercise but the 40+24 is probably not ALL that's in Notes 4. > >Definitely a deal with the Devil. Given that we're talking about IBM, not >Lotus none of this surprises me given IBM's Lucifer/DES history with spook >input years ago. Then again to be fair, I don't know if the 40+24 deal >was cooked up before or after the IBM/Lotus merger. What about the following idea, which I think might have been indirectly discussed a few months ago. Let's suppose "you" agreed with the NSA to limit their effort to 40 bits, and put 24 bits at the beginning of the file. The code to do this could be separated and highlighted and identified publicly, and a software patch could be engineered by somebody to NOP this stretch of code to death. The result is that those 24-bits simply don't appear; you've already gotten the export license. The NSA doesn't have any real reason to complain: _ANY_ program can be modified by suitably changing object code bit patterns. An even smaller change would be to put the number of bits to expose ("24") in a byte value ("00011000"), one that will be zeroed by a patch later on. I guess I'm not really suggesting this; I think that even appearing to come to some arrangement with the NSA is wrong. However, it would be an excellent way to give the finger to the NSA, because there is no way that they can ensure that a given program is "finagle-proof."

1 0

cyherpunks archive
by Kris Steven Shannon 17 Dec '03

17 Dec '03

I can't get access to the cypherpunks archive at berkeley Is there a mirror site anywhere? (I don't have FTP access but have been using ftpmail(a)doc.ic.ac.uk) Any suggestions very welcome! Thanx. -- Kris Shannon <kss01(a)cs.uow.edu.au> 1st year Bachelor of Computer Science.

1 0

Re: Digital Cash Escrow
by jim bell 17 Dec '03

17 Dec '03

At 08:51 PM 4/11/96 -0400, Jean-Francois Avon wrote: >Does anyone, especially in Canada, ever noticed that them or their local net >friends had their snail mail opened? > >A friend of mine has his regularly opened; he complained to Canada Post >three times, but it stills goes on AFAIK. He is pissed off at me, convinced >that the forwarding of Jim Bell's AP related articles is what justified the >mail opening. Actually, he does not even reply to my e-mails anymore. >We used to be great friends... >Neither of us ever engaged in any subversive activities or are involved in >illegal actions. It seems that FUD got him. ...sigh... It does sound like the guy is overreacting a bit. However, I don't know much about Quebec politics; with that close vote recently on separation, perhaps they are getting nervous about things. Is he in Quebec? I can say, however, that I've never gotten any kind of "official" feedback on the subject, not that I really expect it. I've gotten a few inquiries which on the surface appear to be innocuous, but which I suspect have hidden motives. This could be a little hidden official research, or maybe just self-motivated individuals trying to do a "good deed." It doesn't matter; my idea doesn't need any secrets in order to be successful.

1 0

Re: Any examples of mandatory content rating?
by jim bell 17 Dec '03

17 Dec '03

At 10:59 AM 4/13/96 -0400, Black Unicorn wrote: >On Fri, 12 Apr 1996, Timothy C. May wrote: > >> >> I'm interested in hearing about any _actual_ examples where a government >> body in the United States has mandated that intellectual property (roughly, >> written words, magazines, motion pictures, CDs, etc.) be "rated" or >> "age-labelled." Before anyone out there fires up his "Reply" and tells us >> about movie ratings, magazine warning labels, and the like, read on. > >Well, my examples aren't all going to be in the United States, or >strictly intellectual property, or 'age' based, but here: > >Age rated, I don't think there are many examples. General ratings exist. >The best place to look for this kind of thing is e.g., FAA safety >ratings on potential aircraft/aircraft part designs. > >While at first it may seem a bad example, It is a poor example. Aircraft parts are not "intellectual property." They are physical objects. Their design may be "intellectual property", but they are not being rated BECAUSE of their intellectual property. In fact, they would be rated for aircraft application even if nothing about their design or construction was patented, copyrighted, or was in any way restricted. >> So, if anybody's still reading this, I am interested in _any_ examples >> where intellectual content (as opposed to food or drug packaging, for >> example) is required to be labelled. >Still, governments are quite talented at making ratings schemes look >voluntary when practically speaking they are not. You know, it's amazing how you fail to ask and answer obvious questions when they arise! Why, exactly, should the government NEED to "make ratings schemes look voluntary when practically speaking they are not"? After all, you would love to take the position that the government has this authority anyway. Is it possible you're just afraid to admit that the government(s) doesn't have this authority? Is it possible to don't want to acknowledge that the government(s) try to force people do things it has no right to? >> Such examples might shed some light on how these various proposals for >> "labelling" of Net traffic might work. And absent such examples, might show >> just what a tough road lies ahead for those advocating such labelling. > >I think it will end up much like motion pictures. The net will be asked >to regulate itself under the threat of government regulation, which might >be an empty threat if the First Amendment rights are applied. Most >people will comply, it being easier than making a fuss. Sounds like wishful thinking on your part. See, unlike movies and TV shows, which are produced by a relatively tiny number of companies which are easily targetable, Internet content will be produced by hundreds of thousands or even millions of sources. Nobody will have to "make a fuss," they'll merely FAIL to rate their material. No fuss, just no rating. And there will be people out here who will excoriate anybody who complies with such a ratings system. There will be essentially no pressure on the smallest organizations, because there will be far too many of them to target. Besides, since there will be no enforceable standards they will not be targetable anyway. Over time, ever larger organizations will refuse to rate, if they ever did. Eventually, and probably immediately, the whole system would collapse. At that point, there will be no government "threat" to regulate, because everybody will realize that the system is working just fine without regulation. Everyone will see an unregulated Internet, and nobody will see a powerful need to regulate it.

2 1

Re: Watch your language, Shabbir.
by Rich Burroughs 17 Dec '03

17 Dec '03

At 08:34 PM 4/13/96 -0800, jim bell <jimbell(a)pacifier.com> wrote: >At 08:07 PM 4/13/96 -0400, s1113645(a)tesla.cc.uottawa.ca wrote: >> >>On Tue, 9 Apr 1996, jim bell wrote: >> >>> Look, very carefully, at the last paragraph quoted above. Mr. Safdar says, >>> "No reasonable person is objecting to the FBI's right to conduct a wiretap." >> >>That's right. Because no reasonable person thinks they can convince Congress >>or the Supremes otherwise. It isn't impossible, but energies are best spent >>elsewhere, like getting the Burns bill passed. > >But that's not entirely the issue. Mr. Safdar's wording is critical, >because it concedes FAR too much about what the government is assumedly >entitled to do. Below, you've admitted that everybody here believes in what >Mr. Safdar claims "no reasonable person" believes. [snip] No. Shabbir claims just what he said, AFAIK, that "no reasonable person is objecting..." A very different matter. What I believe and what I choose to object to through organized political initiatives may be two different things. If Shabbir's wording is so critical, why did you change it by adding "believes?" I don't believe government should be able to wiretap it's citizens, but I also don't think there's a snowball's chance in hell of taking that power away from the FBI. That's why I want strong crypto. There is a far greater chance of getting some decent crypto legislation enacted than of completely removing the FBI's authority to wiretap. It's a much more "reasonable" goal, in that sense. There are people much more deserving of cypherpunk scorn than someone who works as hard on these issues as Shabbir. It's pretty pathetic, Jim. Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

1 0

Re: Protocols at the Point of a Gun
by Bill Stewart 17 Dec '03

17 Dec '03

At 01:33 PM 4/12/96 -0500, Scott Brickner <sjb(a)universe.digex.net> wrote: >Actually, I expect configurations like yours to become more widespread >in the near future. There are a lot of cable-modem designs that >basically put an ethernet port on your cable box. This leads to the paradoxical situation where your cable TV company can deliver you motion picture images of sex and nudity on the TV channel, but it's highly illegal for them to send you the same material as data.... # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215

1 0