- cypherpunks-legacy - lists.cpunks.org

New Credit Rating System Coming [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > NEW CREDIT RATING SYSTEM ON HORIZON > > graphic February 5, 1998 > Web posted at: 2:38 p.m. EST (1938 GMT) > > NEW YORK (AP) -- Within months, retailers will be able to use a new > computerized credit-rating system to decide not only whether they'll > take your check or debit card, but how big a check you can write. > > Banks will be able to use the system to determine whether they will > let you open a checking account, and what kind of fees you will pay. > > Deluxe Corp., the nation's biggest check printer, has joined Fair, > Isaac & Co., a credit scoring company, and Acxiom Corp., a data > warehouse, to create the system for rating a merchant's risk of > accepting checks and debit cards. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Re: the best justice money can buy --Lessig (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 5 Feb 1998 08:23:58 -0800 (PST) > From: mark(a)unicorn.com > Subject: Re: the best justice money can buy --Lessig > Of course there's a free-market remedy for Microsoft; eliminate copyright. If > anyone can copy Microsoft software for free, it would be forced to compete > on real benefits rather than installed base. If there were no copyright nobody would have any reason to market software or much else for that matter. I would predict that much of the technology and infrastructure we have now wouldn't exist. It would also stiffle creativity and new methodologies because there would be no profit in it to recoup development costs. Those who would survive in such a market would be the 800-lb gorillas because only they would have the resources to squash the smaller companies. Free markets monopolize. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

10 14

Another Linus market observation...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Another Linux market observation that would indicate that the total impact of Linux is going to be less than what we as Linux supporters would want is the literature that has arisen about Linux. In particular the count of monthly magazines. Linux has a roughly 6M user market penetration yet there is only a single Linux specific magazine available. In the comparative markets of C64 and Amiga there were several (eg Amiga World, Info, Compute!) magazines. Even today there are at least 3 Amiga magazines on the market yet that machine hasn't been actively manufactured in over 2 years. Why is the Linux magazine market limited to The Linux Journal? And what does that mean for the long term strength of the market (and by extension the hurdles other OS's would face in the future)? ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

GNU market penetration...
by Jim Choate 17 Dec '03

17 Dec '03

Hi, I have a question, after going to the GNU homepage (www.gnu.org) I have not been able to find out the numbers of how many if any corporate subscribers and participants to the GNU Foundation. Is there anyone out there who might have a pointer to this information, or better yet is an actual participant in the GNU heirarchy and can discuss these and related issues? Thanks. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

Software Reverse Engineering
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Hi All - I've recently been disassembling some software written by idiots who never heard of operating systems other than messy-windows, so that I can re-implement it on my favorite platform (and fix numerous bugs). I know many of you have done work in this area so maybe you can give me a few tips. I ran the program and traced its execution, which quickly showed what parts were significant, and it's pretty easy to figure out what the relevant functions are and what they do. I was able to recompile sections of the code into my own program and make it work without too much difficulty. What is bugging me is this: The program contains huge amounts of 'junk code' such as the following (disassembled with gdb): movl 0x7c58c,%eax movl %eax,0xffffffa8(%ebp) movl 0xffffffa8(%ebp),%eax movl %eax,0x7c590 movl 0x7c590,%eax movl %eax,0xffffffa8(%ebp) movl 0xffffffa8(%ebp),%edx This segment of code accomplishes nothing execpt to move the same value around into different locations, which are never again read. At least half of the instructions consist of similiar garbage, writing data into locations that are never read, duplicating constants, copying values that are never used, and so on. The only thing saving the program from running out of memory is that the programmer mostly used static buffers, only sparingly doing dynamic allocation. I'm quite surprised that I haven't found any buffer overruns or security holes yet. So, does anyone have reccomendations of what is the best way to seperate the wheat from the chaff, so to speak? I can use the program as is, but the sheer amount of junk tends to make it run slowly, so I'd much prefer to completely rewrite it.

1 0

Laptop TEMPEST
by Jim Choate 17 Dec '03

17 Dec '03

Hi, Doesn't the FCC have to test the RF emissions of all laptops as well as monitors for sale as Class A and Class B in the US? Shouldn't that material be available? I searched the main site, www.fcc.gov, but didn't find anything regarding this. I sent a request for instructions on how to obtain the emissions test results on computer monitors and laptops for commercial and non-commercial use, foia(a)fcc.gov. If anyone actualy knows of the location I would be much obliged if you would pass it along. ____________________________________________________________________ | | | The most powerful passion in life is not love or hate, | | but the desire to edit somebody elses words. | | | | Sign in Ed Barsis' office | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

RE: GPL & commercial software, the critical distinction (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Thu, 08 Oct 1998 06:56:06 -0700 > From: "James A. Donald" <jamesd(a)echeque.com> > Subject: RE: GPL & commercial software, the critical distinction (fwd) > Then your argument that free markets lead to monopoly collapses. No it doesn't. > You cannot have monopoly (in the sense of the power to extract monopoly of > profits) except by state intervention as has been proven by experience time > and time again. Examine history with an unbiased eye. > You have been unable to provide any examples of monopolies except those > created by state intervention, such as the railaways, and those existent > soley in your fevered imagination, such as the garment industry. Incorrect. I have listed several examples (eg meat-processing in the 1920's) where the resultant involvement of the government came *AFTER* (not before as you claim) there was evidence of wide spread abuse of the consumer and the employee of those producters. ____________________________________________________________________ The seeker is a finder. Ancient Persian Proverb The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Re: FYI: More on WebTV security
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: dstoler(a)gptmail.globalpac.com Mime-Version: 1.0 Date: Tue, 13 Oct 1998 05:38:59 -0700 To: Pablo Calamera <pablo(a)microsoft.com>, rah(a)shipwright.com, mac-crypto(a)vmeng.com From: dstoler(a)globalpac.com (dstoler) Subject: Re: FYI: More on WebTV security Cc: jimg(a)mentat.com Dear all, This message discusses Microsoft's recent press release where they announce unlimited 128 bit RC4 export approval for WebTV users in Japan and the UK with no key escrow. They announce secure email between WebTV users in addition to security for financial services, web shopping, etc. http://www.microsoft.com/presspass/press/1998/Oct98/EncryptionPR.htm (See the end of this message for key paragraphs of the press release.) I rarely post messages on the crypto mailing lists. I am sufficiently disturbed by Microsoft's recent WebTV press release that I feel compelled to comment. The press release implies that there is secure end-to-end email between two WebTV customers. Perhaps I am overly cynical, but I am guessing that they are using SSL (TLS) from a web based email application on the client to WebTV's servers. I presume email data is decrypted at the servers, then re-encrypted to the recipient when she uses the WebTV client to read email. This approach would allow access to private email at the servers by WebTV employees or law enforcement agencies. Note the careful use of the phrases "unauthorized party" and "without posing undo risks to national security and law enforcement" in the press release. I believe that WebTV's email security is directly coupled to their ability to establish and enforce good security policy within their operation and the trustworthiness of the employees who have access to sensitive data. I am concerned that carefully constructed wording of Microsoft's press release implies stronger email security than really exists. I hope I am wrong. David Stoler Key paragraphs from Microsoft's press release: WebTV Networks has been granted the first export license to use strong 128-bit encryption for any user and any application in Japan and the United Kingdom. So, for example, an e-mail message with personal information sent from a WebTV subscriber in Japan to a second WebTV subscriber in Japan will be sent securely because there is no known technology by which an unauthorized party could intercept and decipher it. Therefore, as part of the WebTV Network, the WebTV-based Internet terminal (starting at under $100) is now the most secure communications device available from a U.S. company. "WebTV Networks' export approval is a significant step for industry and reflects the U.S. government's commitment to promoting e-commerce abroad," said William Reinsch, U.S. undersecretary for export administration. "The WebTV Network provides secure communications for its customers and partners without posing undue risks to national security and law enforcement." --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

4 4

DOJ procedures relating to Clipper Chips and key escrow
by Mike Godwin 17 Dec '03

17 Dec '03

One of the interesting passages comes at the end of the DOJ memo about obtaining Clipper keys pursuant to an interception: "These procedures do not create, and are not intended to create, any substantive rights for individuals intercepted through electronic surveillance, and noncompliance with these procedures shall not provide the basis for any motion to suppress or other objection to the introduction of electronic surveillance evidence lawfully acquired." What this means, apparently, is that keys or communications obtained through noncompliance with these procedures are nevertheless considered to be "lawfully acquired." No suppression of evidence. No civil suit. In other words, "if we break our rules, tough." --Mike

2 2

Hidden WebTV signatures
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

For those of you who don't read sci.crypt, Robert Ames <gnome(a)istar.ca> has posted an article in which he observes that all WebTV posts contain an X-WebTV-Signature: line containing base64-encoded data. For samples of WebTV-generated posts, try the alt.weemba newsgroup, which is filled with WebTV-user drool (caution: remember to employ protection when exposting your mind to the content of the messages). Some samples: X-WebTV-Signature: 1 ETAsAhQDqtur/jfleJ2CDOnNrVoeyALEQAIUOQyCBbzjx5HHfxeMERDgCjztXOU= X-WebTV-Signature: 1 ETAtAhUAmCCzQt+Tqt6fNX+L9+gDCECaqQkCFA0YCPz5tk85mUgq7iX/u4vWvOgG These decode into ASN.1-encoded DSA signatures, eg: 1 30 45: SEQUENCE { 3 02 21: INTEGER : 00 98 20 B3 42 DF 93 AA DE 9F 35 7F 8B F7 E8 03 : 08 40 9A A9 09 26 02 20: INTEGER : 0D 18 08 FC F9 B6 4F 39 99 48 2A EE 25 FF BB 8B : D6 BC E8 06 : } for the second one. The key isn't included in the header, presumably the @webtv.net address can be tied to the hardware which contains some hardcoded DSA key. I wonder if WebTV users know they're signing each message they send? Peter.

1 0