- cypherpunks-legacy - lists.cpunks.org

Re: Today's hearing (Re: Dorthy Denning is a boot-licking fasicist!!!)
by snow 17 Dec '03

17 Dec '03

> at 06:34 AM, snow <snow(a)smoke.suba.com> said: > > Well, it's been said before, you are know by the company you keep. > <sigh> well after my survivalist training & military training in the '80's > I thought I was well prepaired for those dam Ruskies. Seems the way things > are going I am going to need them for those dam Americans. Who Knew Some people kinda suspected it would happen. I mean, when I was in the military, and I looked at the goons I was serving with, I realized what the enemy was. Petro, Christopher C. petro(a)suba.com <prefered for any non-list stuff> snow(a)smoke.suba.com

1 0

DSP's & crypto
by Tim Scanlon 17 Dec '03

17 Dec '03

About a year or 2 ago I read some stuff in sci.crypt about some people doing encryption stuff, I belive with DES, using DSP chips, I am interested in finding the folks who were working on it, or related code. If anyone out there has that sort of info I would appreciate some pointers in their direction. Thanks, Tim Scanlon

1 0

Re: Star Trek: First Contact
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

On Wed, 27 Nov 1996, The Deviant <deviant(a)pooh-corner.com> wrote: > >On Wed, 27 Nov 1996, Dr.Dimitri Vulis KOTM wrote: > >> Mark Allyn 206-860-9454 <allyn(a)allyn.com> writes: >> >> > Are any of the characters in the new Star Trek gay? >> >> The bold guy who plays Captain Picard is very gay in real life. >> (He probably hated all those love episodes with women :-) >> > >Patrick Stewart is married, isn't he? So was Rock Hudson. Let's not forget that in the '50s, Liberace sued (successfully! - and collected significant monetary damages!) "Confidential" magazine for implying that he was homosexual. Not that it makes any difference at all.

1 0

desecration
by captain.sarcastic 17 Dec '03

17 Dec '03

http://www.christiangallery.com/digest.html

1 0

Winn Sings on NPR
by Robert Hettinga 17 Dec '03

17 Dec '03

As I write this, Winn Schwartau and a guy from RAND are riffing (at great length) on NPR about InfoWar FUD. ChingChing! I love it when that cash register rings... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Virtual Assassins & lethal remailers
by TJHARDIN＠delphi.com 17 Dec '03

17 Dec '03

Subject: Re: Virtual assasins and lethal remailers (Doug Cutrell) doug(a)OpenMind.com writes >>TJHARDIN(a)delphi.com writes: >>Adam is absolutely right.... Even if a killer is so anonymous that she can't >>be linked to a given crime by the employer who will talk 99.9% of the time >>any pressure is applied, she must still continue to accept various >>contracts. >>The police would then set up one of their stings & "hire" her anonymously >>for another job & snatch the killer up when she attempts to fullfill this >>contract. Likewise, the very first offer of employment may well be of this >>sort. >Once again (and hopefully for the last time!), I reiterate that it is the >person *placing* the contract who is at zero risk (except for the risk of >losing their digital cash). Stings can be set up to catch the killer, but >providing the person doing the hiring trusts no one but himself, there is >no risk to him. To the extent that there is *any* risk to this person, the >goals of crypto anarchy have not been met. This pertains to every >conceivable security leak that might affect the person placing the >contract. >Doug Sorry to have to repost on this, I only meant to make a brief point. To the following --> >the person *placing* the contract... is at zero risk To this entire point I must say Au Contraire!The person at greatest risk *is* the person placing the contract. This is the employer whom I said would fold under pressure 99.9% of the time. If the police are still around,they will use the classic investigatory method of cui bono? Who benefits? Who has motive?This was Adam's point & the one I was emphasizing. Even if the payment is untraceable, the police have often succeeded in bluffing suspects into confessing to crimes for which strong suspicions existed, but evidence proving guilt was entirely lacking. This will not change as human nature will not fundamentally change. As far as the assassin being unable to link the employer to the crime, or know who hired her, this is fine in theory, but it is likely that she two will ask the same question regarding the job, cui bono? & coming to the same conclusion. When arrested later for some other offense, merely providing law enforcement with the time, place, victim, & payment for various jobs will be enough to convict or scare most employers into confessing. After all the impatient heir will no longer be able to claim that Uncle Scrooge was a tragic victim of random violence. Now I know the idea is to reach a state where police forces no longer exist. But let's be realistic. -Publicly Supported- morality or Political Correctness Cheka's such as we know today will hopefully cease to exist, but it is extremely likely that Private Police squads will be hired by individuals & groups for protection & revenge. Such units/individuals have a long history in this country, & I knew (verrry casually- we frequented the same Houston New Wave hangout, Rudyard's in the early 80's) a hired killer named David West who was tripped up by a femme fatale hired by a private dick named Clyde Wilson who was hired by the victims' other daughters to get at the daughter who arranged their parents' murders. The case was solved entirely by these private cops & only turned over to HPD for arrest & prosecution. I am sure that if no HPD or State of Texas existed, the "good" daughters would have paid Clyde Wilson for more than just investigation. Actually, the natural condition of humans in anything more complicated than a small scale subsistence bands seems to be not living under powerful states, but rather private armies, condottieri, vendettas, etc. This was the state of affairs in the Italian Renaisance & which one of us would choose the deadly dull certainties of the Middle Age's dogmatic fideism over the brilliant explosion of that great liberation of the human spirit & potential? No one reads Aquin-ass- anymore or even knows who he was but the Borgias, Machiavelli, & Michelangelo are still remembered, read with profit, & restored...respectively even now. tjh 2.61 available

1 0

Is Dr Fred Cohen a Loon???
by Anonymous User 17 Dec '03

17 Dec '03

Trolling for Flames(just another anonymous poster destroying the 'net) :) The Subject says it all... I believe Fred suffers from a severely inflated ego and suffers from the "false expert" syndrome detailed by various self-help orgs... what say you fred?? Another anon poster destroying the integrity of the net

7 12

Re: Sun speaks out - but not to the cypherpunks
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Todd Glassey <todd(a)lgt.com> writes: > Pardon the flame but I really have just about heard enough of this BS... No one needs to listen to anything if they don't want to, Todd, but I think that some things need saying none the less. I think the old saying is: You can lead a horse to water, but you can't make him think, or something like that ... >>This response came from Sun to Risks: >> >>> Date: Mon, 16 Oct 1995 21:22:40 -0700 >>> From: Caveh.Jalali(a)eng.sun.com (Caveh Jalali) >>> Subject: Re: Risks in Java >>> >>> If we are going to "analyze" java security, let's keep in mind that >>> there is an important distinction between the language (java) and the >>> machinery which runs the java program. Hmm, this is a very interesting prespective, coming from Sun Engineering as it were. The company that says that the Network is the machine, or somesuch. I always thought that security consisted of everything: hardware, software, and wetware. (Or it did the last time, I checked my handbook.) Admittedly this is a horrible inconvenience, especially when it comes to security. >>> Java is a general-purpose programming language along the lines of C/C++. >>> So, there is no doubt that its expressive power overwhelms our >>> theoretician's abilities to predict java-programs behavior -- this is >>> where we start getting into the halting problem, computability and other >>> black magic. Basically, i don't think we can "trust" programs >>> written in any *useful* programming language. >> >>Read: We can't trust Java programs. This may well be true. But sloppy design, design which ignores the most basic difficulties cannot be brushed away by simply saying that "it exceeds theoretician's predictive abilitiies." That simply doesn't cut it. "Ignoring the obvious" is simply that. It's a planned process of "ignoring the obvious". One example of this that should serve as a useful case study is a recent problem which was brought to the Canadian public's attention just this week, on a program called the Fifth Estate. The CBC (Canadian Broadcasting Corporation) detailed a software code problem in one of AECL's (Atomic Energy of Canada Limited's) instruments which deliver penetrating radiation. The software which controlled the radiation dose, would periodically override the oncologist's calibration and deliver a radiation dose 100 times what was prescribed. This software "bug" literally killed wherever the machine was in use. A simple hardware solution engineered into the product as part of a redundancy check program would not only have saved many lives, but could have confirmed that there were serious code deficencies. A redundancy program which AECL did NOT have. Then again AECL did not consider that it had to mathematically prove it's code either. So I guess, they "ignored the obvious" not once, but twice. A simple lesson can be learned here, one which I believe is applicable to Java. If your parameters are going to be that you cannot trust your production code, then you MUST engineer on that basis, that the production will not be trustworthy, rather than simply crying like Chicken Little, that mission critical applications must simply "live with" engineered inferiority. Or alternatively, another lesson could be pulled out: To avoid this problem, ensure that your code is mathematically provable or utilize appropriate hardware overrides. Case study, #2: Netscape. During their code design, they assumed that all servers on a network were trustworthy and would continue to be trustworthy. They designed their product on that basis. In fact, over time the very opposite will be true. As an exploitation algorithm propogates, the significant percentage of servers which are NOT trustworthy will begin to grow exponentially. The true assumption which Netscape should have started with is a simple one, and is the only assumption that ANY production house can start with: that the network has a reliable transport mechanism, one which will route around damage. That's it. Any other assumptions are poor design and engineering and are demonstrative of a misunderstanding of the environmental conditions in which the engineered product is expected to perform. >Dr. Fred, you seem to spend a lot of engery slamming Java and HotJava. Are >you unaware that the HotJava Platform is the first generation pass at an >inline extensible GUI harness. Underline the total concept "extensible GUI >harness". This includes a series of tool functions to *help* perform secure >messeging (like those supplied iun Netscape 2.0/Java.), but because of the >enormity of the task and the number of facets on the face of this gem it >will be some time before the final versions of the first generation will be >available. I can't speak for "Dr. Fred", but I always worry when people start to refer to something as a "gem", and start talking about the "enormity of the task". Especially if an engineer starts talking in such lyrical, flowery prose. Enormous tasks always lead to complexity which can never be solved by simple linear thinking. And the engineer from Sun is right, that it will be some time before first generation products are available. (This will certainly be the case if "mathematical proofs" become mandatory as part of an ACT in Action plan. ) >No one else had been working on this piece of technology before SMCC >started their effort. From the word floating about the SMCC labs they >didn't even know what they had. > >So rather than slamming them, SMCC, or their PR folks for Well, I'd rather that marketers stick to marketing AFTER a product development cycle is completed. Generally, you would think (hopefully) that people who are technologists, just *might* have a better knowledge of what they have, (or don't have) wouldn't you? Maybe?? Or maybe not ... After all you wouldn't want some kid, some little snotty brat, some kid who started playing around well over a decade ago -- when he was in his teens -- as a projadmin on one of Honeywell's Multiplexed Information and Computing Service beasts showing you up for your temerity? Or would you cry about the "kid" slamming you? >I hope that you understand my point?. The net/net is that OLTP needs to be >scaleable to be a saleable commodity and without the ability to do >"java-ish" like local applets... There is no clean way to do this, Well if we're gonna bottom line it, and talk turkey, and leave Chicken Little back at the table, skewered as it were, I'll extend a helping hand. The net/net is really, really simple, a product that doesn't perform as advertised is not a saleable commodity. No one buys cars which don't start or cans that leak. Sure you can have a body by Pininfarina or one by Alcan but if the engineering isn't there under that beautiful skin then you don't have ANYTHING TO OFFER FOR VALUE. >As an aside - What blows my mind is the number of cycles people spend >bitching and moaning about Java itself rather than working to create a >better solution. Well. It's just not my responsibility to create a solution. And I have a tendancy not to "bitch and moan". I might be one sarcastic castrating SOB, but bitchy and moany is not something I'm routinely accused of. I simply have a reputation for a degree of frankness. Nothing personal is meant by it. I'm actually a very nice person. Truly.;-I >I just want to say "Get a clue. Moan about something that is important and >pertinent to the technologies at hand". > > >These comments are my own - Appreciated. And I mean that with sincerity that your comments are appreciated. I understand that each person here DOES express their individual opinions. Sometimes some very strong opinions. Myself included. Generally, wallflowers will not find comfort on this list. We'll recommend that those people should stick to writing browser programs. Oops, scratch that last thought ... >Sincereley, >Todd Glassey >todd(a)lgt.com Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: Photuris Primality verification needed
by Hilarie Orman 17 Dec '03

17 Dec '03

> Recently, someone asked for a smaller prime of only 512-bits for speed. > This is more than enough for the strength of keys needed for DES, 3DES, > MD5 and SHA. Perhaps this would be easier to have more complete and > robust verification as well. Depending on what you think of the strength of those algorithms, the 512-bit mod p system may not be strong enough. The *strength* of 512-bit mod p DH systems is only about 56 bits. You need 1024-bit primes for a *strength* of 80 bits. In contrast, the 155-bit elliptic curve in the Photuris draft has a strength of about 76 bits.

1 0

Re: [NOISE] Re: 800_ape [FUQ Win95 List]
by Rich Graves 17 Dec '03

17 Dec '03

> On Sat, 4 Nov 1995, Rich Graves wrote: > > > I'm putting together a "Windows 95 Frequently Unanswered Questions File." This little P.S. attracted a lot of attention in private email. FYI, it's now available at: gopher://quixote.stanford.edu:70/0R1400265-1416663-/win95netbugs and in the newsgroups. It's short. Several points are of interest, if not direct relevance. Point D.8., apparent bugs in handling of longints, if confirmed, could have beaucoup crypto relevance. For the record, I hadn't noticed the acronym, but I like it. A lot. -rich

1 0