From jimbell at pacifier.com  Sat Jun  1 00:45:28 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 1 Jun 1996 15:45:28 +0800
Subject: "Anonymity is bad," says a source who wishes to remain anonymous
Message-ID: <199606010435.VAA24130@mail.pacifier.com>


At 07:27 PM 5/31/96 -0700, Timothy C. May wrote:

>In both cases--and these were not the first such cases I've seen--a source
>"who wishes to remain anonymous" is announcing just how bad and dangerous
>crypto, anonymity, remailers and stuff like that are.
>
>"But the official, speaking on condition of anonymity, insisted that any
>computer system that did not include a way for authorities to decipher data
>would 'pose very costly and time-consuming problems' for law enforcement
>officials."

But Tim, you know he is absolutely and literally correct!  It will, indeed, 
cause SERIOUS problems for those law-enforcement officials.  It'll put'em 
out of a job, at the very least.  Termination.  Possibly with extreme prejudice.

Seriously, however, for once I'd like to see some reporter pursue this kind 
of allegation with the person they're talking to.  He should ask, "what 
percentage of existing crime could be accomplished more effectively with 
good encryption that the cops can't break."  The truthful answer is, "not 
too damn much!"  

It seems to me that official-types must be thinking overtime about this kind 
of thing, because we're getting so much out of them along these lines.  
They're scared, for sure.


Jim Bell
jimbell at pacifier.com





From adamsc at io-online.com  Sat Jun  1 00:56:34 1996
From: adamsc at io-online.com (Chris Adams)
Date: Sat, 1 Jun 1996 15:56:34 +0800
Subject: Ok, what about PGP (was: MD5 collisions)
Message-ID: <199606010433.VAA21006@toad.com>


On 29 May 1996 19:03:04 pdt, wlkngowl at unix.asb.com wrote:

>I poked around the pgp.h and pgformat.txt files in the PGP 2.6.2
>distribution.  There *are* designator bytes for the hash (and cipher)
>algorithms, hash size, etc.
>
>It seems quite doable to add support for SHA-1 signatures (and possibly key
>generation for encrypting secret keys?).
>
>Adding 3DES (and maybe Luby-Rackoff-SHA, assuming it hasn't been cracked
>recently at the Fast Software Conf.... more info?!?) would be nifty too...
>unless, of course, there's meaning to the Real Soon Now that PGP3 folx
>claim.

How about a NSA-stomper option that would use all-of-the-above? For the truly paranoid (or 
owners of Pentium-Pro 200Mhz multi-processor machines

Also, what's the verdict on IDEA? Is there a switch yet that would allow straight RSA? 
(with the obvious speed decrease...)

>I'd work on the hack now (and just might...) but I'm stuck stranded in the
>United States. :(
I've always wondered what it says about a country that is afraid to let its citizens work 
on privacy... 
/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From shamrock at netcom.com  Sat Jun  1 01:10:33 1996
From: shamrock at netcom.com (Lucky Green)
Date: Sat, 1 Jun 1996 16:10:33 +0800
Subject: Statistical analysis of anonymous databases
Message-ID: <v02120d02add5829399c2@[192.0.2.1]>


At 0:56 6/1/96, Alan Horowitz wrote:
>> In medical research, third party audit, i.e., the Department of Health and
>> Human Services, is often required. A simple pseudonym picked by the patient
>> won't do.
>
>   It's not clear to me that the second sentence follows from the first.

HSS needs to verify that the researcher didn't just make up the data. The
Department therefore has to be able to audit the results of the study by
contacting a small subset of the participants directly. How can the
Department contact the participants if they are known only under their
nyms? No, pseudonymous remailers are not a valid answer. All this has to be
done without requiring any type of email/Internet access. US Mail only.


Disclaimer: My opinions are my own, not those of my employer.

-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.







From alanh at infi.net  Sat Jun  1 01:10:50 1996
From: alanh at infi.net (Alan Horowitz)
Date: Sat, 1 Jun 1996 16:10:50 +0800
Subject: Statistical analysis of anonymous databases
In-Reply-To: <v02120d14add55f5f9a05@[192.0.2.1]>
Message-ID: <Pine.SV4.3.91.960601005207.7211D-100000@larry.infi.net>




> In medical research, third party audit, i.e., the Department of Health and
> Human Services, is often required. A simple pseudonym picked by the patient
> won't do.

   It's not clear to me that the second sentence follows from the first.

   All the time, in medical or official identification situations 
(clearances,  weapons permits, etc) I'm asked how tall I am. I can't 
remember ever being measured. Thus, the answer I give about my height, 
might as well be "made up" by me.

I guess they do have to bother measuring homocide victims - they can't 
talk......





From WlkngOwl at unix.asb.com  Sat Jun  1 01:14:22 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sat, 1 Jun 1996 16:14:22 +0800
Subject: FTC online workshop on privacy
Message-ID: <199606010555.BAA24442@unix.asb.com>


On 23 May 96 at 7:46, Declan B. McCullagh wrote:
[..]
> More to the point, the left and the right come together on privacy issues.
> 
> Remember the Christian Coalition's take on national ID cards? "Mark of
> the Beast!" (Does anyone have an original cite for this? I also recall
> the CC opposing Clipper...)

There was actually a pretty good special on the 700-Club when Clipper 
first came out (at least from a transcript posted on the comp.org.eff 
newsgroup).

Yep. They were against it.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From WlkngOwl at unix.asb.com  Sat Jun  1 01:27:16 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sat, 1 Jun 1996 16:27:16 +0800
Subject: The Political Map [NOISE?]
Message-ID: <199606010555.BAA24446@unix.asb.com>


On 23 May 96 at 9:45, Bill Frantz wrote:

> This is because any analysis of political opinion that tries to reduce it
> to a one dimensional metric is ipso facto wrong.  Two dimensions gives you
> a much better match.  (Try personal freedom on one axis and economic
> freedom on the other.)  I suspect the more dimensions you include, the
> better you analysis will be.

Just two dimensions?

I'd be cautious of the personal freedom scale, since many groups 
aren't consistently in one place there.  Certain groups assign 
priorities to some freedoms over others, as well as who those 
freedoms apply to, etc.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From WlkngOwl at unix.asb.com  Sat Jun  1 01:35:23 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sat, 1 Jun 1996 16:35:23 +0800
Subject: The Anti-Briefing...
Message-ID: <199606010555.BAA24461@unix.asb.com>


On 24 May 96 at 10:12, Peter Wayner wrote:

> I'm sure the "Briefing" is quite impressive and it includes
> several strong arguments for government surveillance. There are
> bound to be more than a few kids that are alive today thanks to
> eavesdropping and the quick thinking of folks in FBI, NSA et al.
> 
> That being said, I'm sure that there is also an "anti-Briefing"
> that can be given that illustrates that the huge cost of
[..]

So where did J.Edgar Hoover's infamous "Blue Files" go?
Then again, what about the alleged pictures of him wearing a dress 
and going down on his (male) companion?

It seems invoking the name of L.Ron Hoover and the Church of 
Applientology does plenty for an 'anti-briefing'.

> redesigning the phone system and forcing businesses and people
> to operate without protection. Here are some examples from the
> recent press that I think are good arguments for why strong
> crypto won't change the status quo.

On the contrary.  Much of the status quo needs to be changed.

[..]
> Some might argue that if weak crypto can save one child's life
> than it is worth it. This is a strong, sentimental argument, but

Worth what? Ruining his life when he becomes an adult? Or preventing 
him from ever becoming an adult?


--Mutant Rob.


 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From bogus@does.not.exist.com  Sat Jun  1 01:41:00 1996
From: bogus@does.not.exist.com ()
Date: Sat, 1 Jun 1996 16:41:00 +0800
Subject: No Subject
Message-ID: <199606010545.WAA16309@netcom.netcom.com>


yes




-- 
Love,
Qut at netcom.com





From bogus@does.not.exist.com  Sat Jun  1 02:00:35 1996
From: bogus@does.not.exist.com ()
Date: Sat, 1 Jun 1996 17:00:35 +0800
Subject: No Subject
Message-ID: <199606010453.VAA05321@netcom.netcom.com>


! >                   Copyright 1996 The New York Times Company
! >                                      ^^^^^^^^^^^^^^ 
! >            Report Warns of Security Threats Posed by Computer Hackers
! >                                     ^^^^^^           ^^^^^^^^ ^^^^^^^
! >            [W] ASHINGTON -- Government investigators warned
! >            Wednesday that computer hackers cruising the
! >                                            ^^^^^^^^
! >            Internet posed a serious and growing threat to national
! >            ^^^^^^^^            
! >            security, with the Pentagon suffering as many as 250,000
! >                                                             ^^^^^^^
! >            "attacks" on its computers last year.
! >            ^       ^
! > 
! > 
! > -- 
! > Love,
! > Qut at netcom.com
! > 
-- 
Love,
Qut at netcom.com





From bogus@does.not.exist.com  Sat Jun  1 02:02:16 1996
From: bogus@does.not.exist.com ()
Date: Sat, 1 Jun 1996 17:02:16 +0800
Subject: No Subject
Message-ID: <199606010614.XAA20292@netcom.netcom.com>


gui is jw unix i ns


















From tcmay at got.net  Sat Jun  1 02:32:24 1996
From: tcmay at got.net (Timothy C. May)
Date: Sat, 1 Jun 1996 17:32:24 +0800
Subject: "The 666 Club"
Message-ID: <add534800202100435ab@[205.199.118.202]>


At 1:27 AM 6/1/96, Deranged Mutant wrote:
>On 23 May 96 at 7:46, Declan B. McCullagh wrote:
>[..]
>> More to the point, the left and the right come together on privacy issues.
>>
>> Remember the Christian Coalition's take on national ID cards? "Mark of
>> the Beast!" (Does anyone have an original cite for this? I also recall
>> the CC opposing Clipper...)
>
>There was actually a pretty good special on the 700-Club when Clipper
>first came out (at least from a transcript posted on the comp.org.eff
>newsgroup).
>
>Yep. They were against it.

I saw a videotape of this episode of "The 700 Club," in November 1992.

Pat Robertson and his co-anchor were worked up about (and against) Clipper.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From ogren at cris.com  Sat Jun  1 04:27:17 1996
From: ogren at cris.com (David F. Ogren)
Date: Sat, 1 Jun 1996 19:27:17 +0800
Subject: Where does your data want to go today?
Message-ID: <199606010706.DAA29049@darius.cris.com>


-----BEGIN PGP SIGNED MESSAGE-----

Me:
> >Using a random IV also limits the effectiveness of using known
> >headers for "known plaintext" attacks.  Also note that a good block
> > cipher isn't that vulnerable even to "known plaintext" attacks.

Bill Frantz: 
> I don't think this is true given a brute force attack.  Let me
> assume DES-CBC as a specific system.  Let us assume that the
> plaintext is:
> 
<snip>

> The brute force system decrypts the first, and second blocks (8
> bytes each) of the cyphertext, XORs them, and compares the result
> with "PKZIP2.1".  If the comparison is equal it has the key.
> 
> If we eliminated the header and just started with the compressed
> data, then the brute force system would have to decrypt and
> decompress enough of the data to run statistical tests.  The cost of
> the additional decryptions, decompression, and statistical tests
> substantially raise the cost of the brute force attack.

I will concede that having a known header, such as a PKZIP header,
does weaken a crypto to certain degree, but I still believe that it is
not a significant problem.  Here's why:

1. If the best attack against the crypto system is to brute force
attack (having to decrypt two blocks per key) I don't consider that a
weakness. Assuming you are using IDEA or another 128 bit key algorithm
and if everyone in the world owned two computers, each powerful enough
to make a million attacks a second, and they all decided to cooperate
in cracking your key it would still take (on average) until the next
ice age to complete this attack.  Admittedly DES wouldn't hold up
nearly as well, but if you are using straight DES you have bigger
concerns than the occaisional known plaintext attack.

2. Known plaintext is something that you have to assume that your
enemy has at least occaisional access to.  Lots of messages have known
beginnings and endings.  Sure it would be nice to reduce the amount of
known plaintext, but I think there are much more significant concerns.

3. The disadvantages of not having the headers.  The headers are
there for a reason: to communicate that the following file is in a
specific format.  Without the headers, you have to use another secure
channel to communicate what file type is being transmitted.

Again, I concede that a crypto system would be more secure if no
known plaintext was ever transmitted, such as compressed file
headers.  But this minor loss of security is nearly inescapable and
also relatively insignificant.

David F. Ogren
ogren at concentric.net
PGP Key ID: 0xC626E311
PGP Key Fingerprint: 24 23 CD 15 BF 8D D1 DE  81 71 84 C8 2C E0 4B 01
(public key available via server or by sending a message to
ogren at concentric.net with a subject of GETPGPKEY)


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMa/qu/BB6nnGJuMRAQH8MAP/epcVGiS+9U1aWs1diuiVsMSjellYRjNm
p9huFrzT9eaBrfVz0MI2yhZ8IWNctDWznQdmtcmdRKoFm5Knfu+vIyKH6oILplyB
dgfPsSh3R/pJKXs2hD4q8PgE+laaTyFZyW1MqPbAjlKUS/T1w9bhL3lQnsrKZPf+
Qyxa19Vlya0=
=sHIE
-----END PGP SIGNATURE-----





From bqm1808 at is.nyu.edu  Sat Jun  1 04:35:57 1996
From: bqm1808 at is.nyu.edu (Brendon Macaraeg)
Date: Sat, 1 Jun 1996 19:35:57 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <1.5.4.32.19960601090003.006cec9c@is.nyu.edu>


hi Tim and all:

Been lurking on this list for about a month
and find it really interesting. I'm still working
my way through the FAQ from the talk.politics.crypto
newsgroup to get up to speed, but have been
using PGP for about six months now.
I've been toying with starting an anon-remailer
as well....that Quickremail program looks
cool...anyone install and run it yet?

I think Tim's post relates to the idea
that we're living in a society that finds
it acceptable to monitor our movement
of all sorts. Not just physical, but --for lack of
a better word-- virtual as
well. By that I mean, organizations both
large and small have the means to track
our purchases and activities --generally, any
activity that is logged or leaves a data/paper trail
says something about us and creates a virtual
persona-- and using
such info. to make inferrences about
our lifestyles. 

Just the other day I had a heated talk
with someone about drug tests in the workplace.
She said they're fine. Frankly, I am against them. 
Take your jar and shove it. "Life, Liberty, and 
the Pursuit of Happiness" implies a right
to privacy.  That's why I started using PGP
and want to make an effort to keep up on 
topics related to keeping my life private
and shielded from those who would like otherwise.

What will employers want to know
next? What movies I rent? What books and magazines
I read? What else do I do on my freetime that
may or may not be "unacceptable"?
I  worry that our personal lives are becoming
more and more regulated by government,
regulation that allows employers and other
institutions to rationalize their privacy-invading actions
and that's why I too find Clinton's push for 
a state-instituted curfew disturbing as well.
What next? Will my employer start telling me
I have to be home by 11 p.m. so I can be
a happier, more productive worker?

-B



At 07:08 PM 5/31/96 -0700, you wrote:
 
>
>As I said, should such curfews become widespread, children will of course
>need forms of age identification, and this opens yet another door for
>universal I.D. cards. And for "travel papers."
>
>Maybe it would be easier to just put a tattoo on their arms--especially as
>the younger generation is so into tattoos these days. "Pappieren, bitte.
>Macht schnell!"
> >
=====================================================
                                    Brendon Macaraeg
               http://www.itp.tsoa.nyu.edu/~brendonm 
    Finger macaragb at acf2.nyu.edu for my PGP Public Key






From rah at shipwright.com  Sat Jun  1 05:44:22 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Sat, 1 Jun 1996 20:44:22 +0800
Subject: Cassidy's Sacremento Bee article.
In-Reply-To: <Pine.3.89.9605312321.A10893-0100000@world.std.com>
Message-ID: <v03006f01add5c56be57f@[199.0.65.105]>


As I said here before, cypherpunk (and DCSB founder) Peter Cassidy, who did
an article in the last Wired on the Bernstein case, just did a story on the
NSA's involvement in the digital telephony bill in this Sunday's Sacremento
Bee.

Pete says,

> I spoke with an editor at the BEE. The story takes up most of the front
> section of the FORUM section. Headline screams:
> SILENT COUP IN CYBERSPACE
> US Intelligence Agencies Threaten Businesses and Personal Privacy.

Since this story is also supposed to hit the wires, it would be interesting
if it goes anywhere else...

Cheers,
Bob Hettinga



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From rah at shipwright.com  Sat Jun  1 06:01:24 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Sat, 1 Jun 1996 21:01:24 +0800
Subject: Paper about legal aspects of electronic cash
Message-ID: <v03006f05add5cbd1666a@[199.0.65.105]>



--- begin forwarded text


From: "Simon Schlauri" <schlauri at pobox.com>
To: "ecash at digicash.com" <ecash at digicash.com>
Date: Sat, 01 Jun 96 11:56:48
Reply-To: "Simon Schlauri" <schlauri at pobox.com>
Priority: Normal
Subject: Paper about legal aspects of electronic cash
Sender: owner-ecash at digicash.com
Precedence: bulk

Hello all

I'm a law student at the University of Zurich, Switzerland. During the last
months I've been
working on an paper about legal aspects of electronic cash, in which
DigiCash's ecash is one
of the two main models I examined. The main part of the paper consists of a
thesis on the
qualification of ecash as an analogy to bank cheques or private banknotes
based on digital
documents. The paper contains a large list (40 items) of further
literature, too.

This paper is now available via Internet at the following Address:
http://www.inf.ethz.ch/department/IS/ea/iur/1996/Arbeiten.html with a link
to the file
ftp://ftp.inf.ethz.ch/pub/org/ti/ga/Patru/legal/1996/schlauri.ar.ps

(PostScript, 36 pages, about 370K. The paper is written in German.)

I'm looking forward to your comments.

Regards

Simon Schlauri


______________________________
Simon Schlauri
St.Gallen, Switzerland

schlauri at pobox.com
http://www.pobox.com/~schlauri

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From nobody at REPLAY.COM  Sat Jun  1 06:10:52 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Sat, 1 Jun 1996 21:10:52 +0800
Subject: Find Article.  (Hack China?!?)
Message-ID: <199606011027.MAA29937@basement.replay.com>


Posted in alt.privacy.....

In article <4oo7dj$3am at sunrise.pku.edu.cn>
deezxl at sunstation2.tsinghua.edu.cn (HOME_Xuelong Zhu) writes:
From: deezxl at sunstation2.tsinghua.edu.cn (HOME_Xuelong Zhu)
Subject: Find Article.
Date: 1 Jun 1996 01:46:27 GMT

Please tell me where I can find the WWW site or FTP site with many articles
(thesis,all kinds of paper,etc) about date security and cryptology.

please send your answer to deezxl at tsinghua.edu.cn
Thank you very much. 

--





From jya at pipeline.com  Sat Jun  1 06:45:36 1996
From: jya at pipeline.com (John Young)
Date: Sat, 1 Jun 1996 21:45:36 +0800
Subject: NYT on NRC Report
Message-ID: <199606011049.KAA14185@pipe2.t1.usa.pipeline.com>


   The New York Times, May 31, 1996, p. D2. 
 
 
   White House Challenged on Data Security 
 
   By John Markoff 
 
 
   The United States Government should immediately relax 
   export controls on electronic data coding products and 
   allow the computer, software and telecommunications 
   industries to set data security standards, a new report 
   urged yesterday. 
 
   The report, commissioned by Congress and prepared for the 
   National Research Council of the National Academy of 
   Sciences, stands in direct opposition to existing Clinton 
   Administration proposals for data security standards and 
   for linking the relaxation of export controls to the 
   adoption of such standards. The report calls for the 
   widespread commercial adoption of technologies used to 
   prevent illegal wiretapping of computer data, telephone, 
   cellular and other wireless communications. The National 
   Research Council provides science and technology advice 
   under a Congressional charter. 
 
   The report also states that despite creating potential 
   problems for law enforcement agencies by making it easier 
   for criminals to shield their communications from 
   Government wiretappers, cryptography would also help 
   prevent crime by sheltering communications and electronic 
   transactions from the prying eyes of electronic 
   interlopers. 
 
   "Without information security, computer crime in this 
   country will rise very rapidly," said Kenneth W. Dam, the 
   chairman of the panel that prepared the report. Mr. Dam, 
   Deputy Secretary of State during the Reagan Administration, 
   is also professor of American and foreign law at the 
   University of Chicago. 
 
   The report, industry executives said, is likely to become 
   a key weapon in the battle between the Federal Government 
   and industry and civil liberties groups. 
 
   "It echoes things we have been saying for some time," said 
   Jim Bidzos, chief executive of RSA Data Security Inc., a 
   developer of computer security software. "The next 
   battleground is going to be Capitol Hill because the 
   Administration isn't going to give up easily." 
 
   In particular, the report takes issue with Administration 
   efforts to force the use of data-scrambling systems using 
   "escrowed" keys that would let law enforcement and 
   intelligence agencies use built-in backdoors to read coded 
   information. 
 
   Cryptography, once used only by spies and the military, has 
   become an increasingly vital technology for insuring 
   security in electronic commerce and personal privacy. It 
   relies on the use of mathematical formulas to scramble 
   electronic information so that it cannot be read without 
   the proper digital "key." 
 
   Key escrow systems like those proposed by the 
   Administration in its Clipper chip program would split the 
   key and have trusted third parties like the Treasury 
   Department hold parts of it, making it possible for law 
   enforcement agencies to generate keys without consulting 
   the sources of the data. 
 
   As recently as two weeks ago, the Administration was 
   pushing for key escrow coding approaches to data 
   scrambling. A draft White.House policy paper has proposed 
   linking relaxation of export controls to systems that 
   included key escrowing. The recent paper also indicated 
   that the Government was willing to accept "self-escrow" 
   systems for some large corporations that would allow them 
   to to hold all parts of the keys. 
 
   Critics of key escrow management technology note that it 
   can be abused by agencies that wish to exceed their 
   surveillance authority and that the technology is 
   vulnerable to a single point of failure. If a so-called 
   master key is stolen, they say, the entire coding system 
   can be compromised. 
 
   Because strong cryptography would complicate the mission of 
   United States intelligence agencies, the Federal Government 
   currently places tight controls on the export of software 
   and hardware that offer stronger cryptographic protection 
   than 40-bit keys. Such keys are made up of a binary number 
   that is 40 digits long. Computer experts have shown that 
   40-bit keys are vulnerable to attacks. 
 
   The report released yesterday, "Cryptography's Role in 
   Securing the Information Society," calls for dropping stiff 
   export controls on products that use the Data Encryption 
   Standard, which relies on a 56-bit key and offers stronger 
   protection against computerized attacks than a 40-bit key. 
 
   [End] 
 
 
 
 
 






From gary at systemics.com  Sat Jun  1 08:29:33 1996
From: gary at systemics.com (Gary Howland)
Date: Sat, 1 Jun 1996 23:29:33 +0800
Subject: Backdoor in RSA Discovered
Message-ID: <199606011216.OAA15537@internal-mail.systemics.com>


Hi,

Here is an example of a PGP key that has been generated, but with
a secret backdoor.  It is not possible by looking at the generated
key to see that it has a backdoor.

The key generation code contains Mallets public key.  When generating
a key, the upper bytes of N are set to an encrypted factor of N.
The encryption is done using Mallets public key, so only Mallet
can retrieve the factor from N.

I think this example demonstrates the need not only for having key
generation source code (which is required anyway in order to verify
the quality of the random number generator), but also for being able
to compile and link this source, since without this ability it is too
easy to have such a backdoor in the system  (yes, the code could be
reversed engineered, but this can be made very difficult by having
self modifying code etc.)

There does however appear to be one way to assure the user that
this trickery is not going on.  This can be done by generating
"vanity keys", that allow the user to specify a phrase that
will appear in the PGP ascii key.  If this were done, then there
would be little room left in N to store details about its factors.


Here is a working example of this backdoor:



This is Mallets secret key (passphrase "xyzzy"):

	Type bits/keyID    Date        User ID
	sec   496/5D925633 1996/06/01  Bill Klinton <bill at whitehouse.gov>
	-----BEGIN PGP SECRET KEY BLOCK-----
	Version: 2.6.2
	
	lQD5AjGwJnsAAAEB8M6FnxIdQZrORfKlb6/l74S6YUT0GQHvzrioiXJoRd2gnAAs
	e99C/XPKZShiylm+nu5UD8zDBBtcoiBdklYzAAURAQxi1EDMl1u+Aew7e7bKTY6c
	l/RAUacgZ9zbL1tl96kxQucLrt8l6Sz11EOmnV9eDZdf1LYG9jg5WbLvNGqpmzyY
	PlNKBJn/7gD4hu3YUt9caDyY5/X2ASMaL40gb1y1YZxjbTbB4Xjd8wD4+Iv9qhEQ
	fLjeYi+iUhnNkMtPyeg/+TR6rdP/c42UXAD2mqW0VuM8wiib0nbwfXwC0SlJveLG
	UwNOgRIujTwS7k35tCJCaWxsIEtsaW50b24gPGJpbGxAd2hpdGVob3VzZS5nb3Y+
	=oOrI
	-----END PGP SECRET KEY BLOCK-----

The key consists of the following:

	n:	ce859f121d419ace45f2a56fafe5ef84ba6144f41901efceb8a889726845dd
		a09c002c7bdf42fd73ca652862ca59be9eee540fccc3041b5ca2205d925633
	e:	11
	d:	0c25fa4c5c12eafd132c6415a0ef68713823d6e12ea5c2cfecbe9eac607c94
		75d1b60c2a3aef89438692326d70d88080317b0cd04432d5a0230de572e819
	p:	d2640ede17e8c05545aa9ecfd5154f934021e4ef8ef22a248abe0ab3f1aaed
	q:	fb4ada7f960c9a8ab23010ff4936a9a2db834346694979c72f90296cff419f



This is Joe's PGP key (passphrase is "xyzzy"):

	Type bits/keyID    Date        User ID
	sec  1024/D0351D23 1996/06/01  Joe Sixpack <joe at aol.com>
	-----BEGIN PGP SECRET KEY BLOCK-----
	Version: 2.6.2

	lQHgAjGwKUIAAAEEAIBG2pH3rabYMSWhVjcnG8v9HVU4vwtBuBysnvuJI4PvjV3o
	+YnuFD+x3aF8O52jgpBTllAxhndDSPUXQaj+sXEGDkV0Nq8RCZ02usaj24ogn0+S
	KW9ej8GgWL8EmlP1H1Qrv39/qz1VSqvxczCLYoRetHETR0JirwcMj9fQNR0jAAUR
	AYwvF+QHqifbA/4oAli05pLm0QlkbOqimdm4QS3OC1r9kdqvO88GF5nj9EgLm1a+
	svRThXiO586Udi1UkSXvM60o4nz6tGASavgc7X8JaL/B2yOcMH9gF6CN6zabiyAb
	anrJe06IuKH3980GoQ2Sp1sssFHqxgper1ga3STmUVj/dQBjaFUI1qwDkwIAnRPO
	F7qIopIcEhnxW1OXcv0/9Afhugy3ERbGZwTaaw2fAiiyD41FpkbOUbao8D5Vkndr
	y6h2LEC7P5iwfdAF3AIAPz/2nRuZAnyNrA4ESvryyHMejwsz9BAkok+MT2z2E85W
	h8laL76yok5DZz56bRqH2gyQkPR5Rx3hnLx+fqL45gIAzy3CkdR77yw8bXUH8/Av
	azYh0m4KzEsw8P1a10YkVxP8xiTbqYbN0lmzOrdWlEW6dZjkx5q67vt1op7hDtqW
	LJwYtBlKb2UgU2l4cGFjayA8am9lQGFvbC5jb20+
	=evl9
	-----END PGP SECRET KEY BLOCK-----

The key consists of the following:

	n:	8046da91f7ada6d83125a15637271bcbfd1d5538bf0b41b81cac9efb89
		2383ef8d5de8f989ee143fb1dda17c3b9da382905396503186774348f5
		1741a8feb171060e457436af11099d36bac6a3db8a209f4f92296f5e8f
		c1a058bf049a53f51f542bbf7f7fab3d554aabf173308b62845eb47113
		474262af070c8fd7d0351d23
	e:	11
	d:	2d462f06576a771f2067a25aaa0dcd934a46968c7fa99eb97388381c8a
		c13d9fd78a8e7630ae617fe46c571cc9bf2aa68d4aad85b7206653fba1
		cbf90e78026398a33f3a99dd4ced780f9bd854b2560f5cd9c6113ab837
		7443d9e946a3c2c74989f26f775635cd6ebd8a665e0885e28c60d714b3
		c9981c0ff09fa561a7d7d8f1
	p:	804e00dc8ea1c0a55c2f5a5b14fdb05f84ecb1c5d1463562925637624e
		6f1d945adbc4ed2cb4dd266f8f9c59f6c07d7b3d3ee20328bfdf12f54f
		654256a63e01
	q:	fff1bc1c496fa118c2307c31498f3b403df9d9dd77b91295a3191d5a26
		924d8ff276696adeb344ca6cbeddb976fa387b64697f12b8a8dec43d4e
		2b561e00a323

If we look at bytes 1-63 of n:

	46da91f7ada6d83125a15637271bcbfd1d5538bf0b41b81cac9efb892383ef
	8d5de8f989ee143fb1dda17c3b9da382905396503186774348f51741a8feb1

and decrypt this using Mallets private 'd', we get

	4e00dc8ea1c0a55c2f5a5b14fdb05f84ecb1c5d1463562925637624e6f1d94
	5adbc4ed2cb4dd266f8f9c59f6c07d7b3d3ee20328bfdf12f54f654256a63e

which you can see is Joe's P without the leading 0x80 and trailing 0x01



Here is the code (in Perl) that generated Joe's key.
This code contains only Mallets public key.

	my $bits = 512;	# Bits in p and q, not in n

	#
	#	Set up Mallets public key
	#
	my $me = new MPI 17;
	my $mn = restore MPI pack("H*", "ce859f121d419ace45f2a56fafe5ef84ba6144f41901efceb8a889726845dda09c002c7bdf42fd73ca652862ca59be9eee540fccc3041b5ca2205d925633");

	#
	# Note - first byte is 0x80,
	# first bit of second byte is zero
	# to ensure that P is less than Mallets n
	#
	my $p;
	do {
		$p = randomSpecial($bits, "100000000", "00000001");
	} while (!isPrime($p));

	#
	#	Now encrypt P for Mallet
	#
	my $ss = $p->save();	
	substr($ss, 0, 1) = '';	# Remove high and low bytes
	substr($ss, -1, 1) = ''; # since we know what they are
	my $tmp = restore MPI $ss;
	my $s = new MPI;
	MPI::mod_exp($s, $tmp, $me, $mn);
	$s = restore MPI pack("C", 128) . $s->save() . pack("C", 1);

	my $tmp = new MPI;
	my $q = new MPI;

	MPI::lshift($tmp, $s, $bits);
	MPI::add($tmp, $tmp, new MPI 256);	# To prevent Q being too large
	MPI::div($q, new MPI, $tmp, $p);

	do {
		$q->inc();
	} while (!isPrime($q));


	my $e = new MPI 17;
	my $sk = RSAKeyGen::deriveKeys($p, $q, $e);

	#
	#	Save our key
	#
	my $passphrase = "xyzzy";
	my $skc = new SecretKeyCertificate($sk, $passphrase);

	my $fos = new FileOutputStream("secring.pgp");
	my $dos = new DataOutputStream($fos);

	$skc->saveToDataStream($dos);

	my $id = new UserIdPacket 'Joe Sixpack <joe at aol.com>';
	$id->saveToDataStream($dos);



This is the code to recover P from Joes public key
(Mallet's private key is required)

	#
	# Mallets secret key
	#
	my $mn = restore MPI pack("H*", "ce859f121d419ace45f2a56fafe5ef84ba6144f41901efceb8a889726845dda09c002c7bdf42fd73ca652862ca59be9eee540fccc3041b5ca2205d925633");
	my $md = restore MPI pack("H*", "0c25fa4c5c12eafd132c6415a0ef68713823d6e12ea5c2cfecbe9eac607c9475d1b60c2a3aef89438692326d70d88080317b0cd04432d5a0230de572e819");

	my $rp = new MPI;
	my $pe = restore MPI substr($sk->n()->save(), 1, 62);
	MPI::mod_exp($rp, $pe, $md, $mn);	# Decrypt



Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06 





From aba at dcs.ex.ac.uk  Sat Jun  1 08:30:23 1996
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sat, 1 Jun 1996 23:30:23 +0800
Subject: opinions on book "The Truth Machine"
In-Reply-To: <add49ffc03021004e128@[205.199.118.202]>
Message-ID: <199606011153.MAA00654@server.test.net>



Tim May <tcmay at got.net> wrote:
> At 7:06 AM 5/31/96, Timothy C. May wrote:
> >It sounds like a "make.money.fast.by.promoting.this.book" scam to me.

If you mean myself, this had not occured to me and I assure you I have
no connections with the author, and no interest in promoting sales of
his book.

There is no charge to read the book on line -- and I for one wouldn't
buy a paper book I have electronic copy for.  I saw the URL posted (by
the author of the book judging by the From line) in
talk.politics.crypto and read it on line.

The only "charge" for reading is to fill in short questionaires as you
read.

> It was truly bad stuff. Terribly written, confusing no character
> development except in a cartoonish way.

The writing style wasn't great, and I'd agree there were plenty of
flaws, but what I was interested in was cypherpunks opinions on the
technology, rather than the quality of the book, or making money for
the author!  This was my reason for making the post to cypherpunks.
Admitedly it was 5am when I made the post (having just finished
reading said book) and I didn't explain myself... lets try again:

The interesting technologies touched on were:

- cheap video used by everyone to record their own lives

This has been talked about in cyperpunks in the past, and from that
discussion I seem to remember that there was talk of a trial with
police in some area of the US wearing mini-cams to protect them from
claims of police brutality.

- the book has video streams transmitted in real time to some database
(state run? I'm not sure it was clear, also no mention of encryption).

If it was an option to have video stored in the device itself
encrypted or transmitted to a data haven encrypted, I don't see
anything wrong with that so long as it's voluntary and nothing to do
with government.

That government might have a go at mandating a "voluntary" video
survielance set up doesn't seem that unrealistic in the current
political climate.  Having just read your post on curfews my response
was what the fuck, are you serious?  It totally amazes me that public
opinion has got to the stage that something like this would be
accepted.  Sounds like a military dictatorship.  Children first,
adults next?  The level of peoples paranoia about reducing crime at
any cost has been severely underestimated.  Surely that's way out of
line constitutionally?

The price and the storage technology for a tamper resistant storage
device linked to a CCD at cheap commodity price hasn't quite come
about yet.  When it gets cheap enough, I think this could become
called for -- children first perhaps as the curfew.  Random police
searches asking you what your business is.

- wide use of accurate lie detectors

the book has everyone wearing a wrist communicator / lie detector /
video recorder.  If someone wants to walk around with a light that
will flash if they tell a lie, again that's there problem.  It would
be kind of fun to see politicians required to wearing one.  But as
Sandy pointed out the `national security' and the need to lie to the
people for the benefit of the people might be bought up as a reason to
defend dishonest politicians.

the book talks about 100% accurate lie detectors with no
qualifications which is obviously nonsense, I'm not sure what success
current lie detectors have, but there would no doubt be lots of
problems.  People are able to fool current lie detectors, and as I
understand it the detectors look for subtle physical signs of
distress, changes in skin conductivity caused by distress, and some
are able to lie without suffering any distress.  It seems reasonable
that use of a wider range of sensory devices as input, and more
sophisticated analysis of the signals could improve on reliability of
the current lie detectors.

Interesting questions arise if they become accurate enough that they
can be used to supplement or even replace much of the legal system.
The state mandated requirement of people to routinely submit to lie
detector tests is of course totally unacceptable, but if you get to
the stage of having curfews (still amazed at that) and the police are
legally allowed to ask you to submit to a lie detector test asking a
few more questions during the random spot check seems likely.

For instance I have been stopped by the police four times late at
night driving home, as I live some distance from the university.  The
questions are basically what is your business (ie what are you doing
so late at night), and then they get you to take in your papers to the
police station within 1 week which is an inconvenience.  Also the
practice over here seems to be to do a spot check on the state of the
vehicle, quick visual inspection of the tires with flashlight, check
on the lights, do they all work -- dip / full, indicate.  Also at the
same time they ask for ID.  On one of the occasions the officer asked
what an object inside the car was (it was on the floor beteen the seat
and the door well and visible with the door open) -- a wheel wrench (2
foot wrench and socket), I said it was a wheel wrench, and he made a
comment that he had thought it was something to hit someone with.
Jeez.  It would have been a pretty good object to hit someone with as
far as that goes, but it has also proved a remarkably useful object
for changing a flat tyre.

I'm not sure where I would stand on this legally, but I have so far
resisted the temptation to tell them it's none of their business.

While we're on the topic of the increase in the police state
mentality: in the UK recently as the result of some nut shooting up a
school, gun laws are due to get stricter yet.  They are I think
talking about making it law that all target pistols must be kept at
the gun club (whereas currently you can take them home to clean (but
not shoot)).

Also they are actually talking about restricting the sale of replica
guns.  What'll they do now recall childrens toys which are too
realistic?  Idiots.

Adam





From jwilk at iglou.com  Sat Jun  1 09:23:21 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sun, 2 Jun 1996 00:23:21 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <m0uPqIz-00035RC@mail.iglou.com>


At 07:08 PM 5/31/96 -0700, Timothy C. May wrote:
>Cypherpunks,
>
>This is off-topic for the list, but I want to share it anyway. It touches
>on issues of increasing police surveillance, and also touches on the issue
>of "age credentials" (in the sense that how else is a cop who stops a young
>person for "curfew violation" to determine if a violation has occurred when
>most 14- and 15-year-olds carry no driver's licenses?)
>
>The "curfew" meme is spreading quickly, with Clinton calling for a federal
>curfew, at least in cities, and Dole trying to outdo him with even more
>draconian curfew laws. Many communities already have them, including San
>Jose, New Orleans, and other large cities. And my own community, Santa Cruz
>County, ironically begins a curfew program on Saturday, tomorrow.
>
>I wrote this item for our local newsgroup, scruz.general, announcing that
>"my household" will not abide by this law. I didn't come out and say "my
>kids" would not abide by it, inasmuch as I have no kids. So I elliptically
>referred to "parents and guardians"...after all, my sister visits with her
>husband and son, and in theory I could be the guardian of this kid. And
>friends bring their kids.
>
>My point is to send a "warning" to the Sheriff's office that at least some
>households think this crackdown on the movements of children is
>unacceptable. Children have the right to travel, especially as the parents
>permit it, without being stopped, questioned, forced to state their
>destinations, and, if the answers don't satisfy the cop, taken into
>detention at some children's equivalent of a "drunk tank."
>
>(Some purists claim that children are exempted from normal constitutional
>protections, such as the right of free association, the right to be free
>from unwarranted searches and seizures, the right of free speech, etc.
>Especially this comes up in debates about rights in public schools (speech,
>locker searches, movements are controlled, etc.). But I think a public
>school environment is a dramatically different situation, whatever one
>thinks of these claims about rights, from a kid walking on a public street.
>To claim that such a child may be stopped, interrogated, taken to a
>detention center, without a crime having been committed, is a clear
>violation of his or her rights.)
>
>As I said, should such curfews become widespread, children will of course
>need forms of age identification, and this opens yet another door for
>universal I.D. cards. And for "travel papers."
>
>Maybe it would be easier to just put a tattoo on their arms--especially as
>the younger generation is so into tattoos these days. "Pappieren, bitte.
>Macht schnell!"
>
>Here's what I sent in to scruz.general tonight:
>
>
>So Santa Cruz begins its own fascist crackdown on the free movements of
>persons. The "curfew" begins Saturday night.
>
>Allegedly these persons are children, but it is up to parents and
>guardians to control the movements of their children or charges in public
>places, NOT the function of the police to detain these children or
>charges. (Initially a "warning," but the child's name is recorded in
>police data bases....if the child is detained a second time, he or she may
>face detention time, community service, fines on the parents or guardians,
>and so forth.)
>
>ANNOUNCEMENT: I am responsible for the children in my household or in my
>custody or guardianship. Not the cops. Not the Sheriff. Not the CAMP
>helicopters. Not the narcs. Not the vice squad. Not anyone but me.
>
>I am instructing those in my household or who visit to IGNORE all
>interrogations by cops. I am telling them not to let the cops search their
>bags, not to let the cops ask where they are going, not to let the cops
>demand that they give a reason for being out. If they pick up people from
>my household, I expect the children to remain silent and to just fill up
>the god-damned jail cells until I eventually raise a ruckus and (maybe)
>pick them up.
>
>If some kids are out and about and making mischief, the cops should
>concentrate on catching _those_ children! Don't immobilize all kids  for
>the sake of supposedly cutting down on the activities of the perps. As
>with so many do-gooder laws, the effect will largely be felt on the "good"
>kids and will be ignored or evaded by the "bad" kids.
>
>As to the claims that children have no valid reason to be out after 9, or
>11, or whatever, this is not for anyone but the parents and guardians to
>decide. The god-damned cops are not the ones to decide what a valid reason
>for being out is.
>
>(I have heard that "religious worship," a la "Midnight Mass," is one of
>the valid reasons for a child to be out after curfew. Fine, religion is
>then the stated reason those in my household are out! I will tell them to
>tell any nosy cops or Sheriff's Deputies that they are worshippers of
>Baal, and Baal requires them to be out to appreciate the darkness. If the
>cops claim this is "not a valid religion," I will recite to them the First
>Amendment of the U.S. Constitution, where it says: "Congress shall make no
>law respecting the establishment of religion or prohibiting the free
>exercise thereof.")
>
>I moved to the rural part of Santa Cruz, Corralitos, to escape this
>fascist and socialist nonsense, and now I find it primarily the
>Sheriff-dominated parts of this county which will now claim to tell
>parents and guardians they no longer control their children.
>
>Fuck this.
>
>--Tim May
>
>--
>Boycott "Big Brother Inside" software!
>We got computers, we're tapping phone lines, we know that that ain't allowed.
>---------:---------:---------:---------:---------:---------:---------:----
>Timothy C. May              | Crypto Anarchy: encryption, digital money,
>tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
>W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
>Licensed Ontologist         | black markets, collapse of governments.
>"National borders aren't even speed bumps on the information superhighway."
>
>
>
>

Timothy, 

For the first time in my life I agree with you. I am 13 and the cop here a
assholes. I have been caught about 13 times, yelled at me called my parents
who could give a rat's ass. I feel spend tax payer's money on more cops to
catch the bastard who kill people, not on the kids who just like to take a
walk with my girlfriend. Or when I'm going to the corner store to buy a
6-pack. A 6-pack of coke. Well as the old saying goes, fuck this and
everything that has to do with it!!!!!!!!   
          
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage     Gaa- 3.69
<jwilk at iglou.com>         Record- 2-4-4
Age- 13                   Final Standings- 2nd Place (Beat in Championship)
President & Founder:                   
Revolution Software       "I have the fastest glove in the east!"
Profanity Software        "Hackers never stop hacking they just get caught"
VSoft

My life- Rarely eat or sleep, Hack til' 7:00a, goto school, play goalie
til' 5:00p, hack til' 7:00a
Hank Aaron- d:-)!-<   Pope- +<:-)   Santa Claus- *<:-) Yo Mama- :-0

Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From ravage at ssz.com  Sat Jun  1 09:39:01 1996
From: ravage at ssz.com (Jim Choate)
Date: Sun, 2 Jun 1996 00:39:01 +0800
Subject: Remailer chain length?
Message-ID: <199606011336.IAA11002@einstein.ssz.com>



Hi Scott,

Forwarded message:

> Subject: Re: Remailer chain length? 
> Date: Fri, 31 May 1996 14:55:58 -0500
> From: Scott Brickner <sjb at universe.digex.net>
> 
> >If this is strictly true, why not simply run several instances of a remailer
> >on the same machine. Then randomly chain them prior to sending them off
> >site. This would be a lot cheaper and faster than trying to convince
> >hobbyist to set it up or businesses to to use their profit & legal council.
> 
> Because it's not strictly true.  Implicit in traffic analysis is looking
> at the "envelopes" of the traffic.  Since this means intercepting those
> envelopes, once you've put your monitor on the first remailer at a site,
> you've probably gotten all the rest at the site for free.
> 
> I don't think multiple remailers at the same site help anything.
> 

I agree completely. If traffic analysis is going to be done on a single box
it isn't going to matter how many remailers are there.  The monitor will
simply grab them all. At this point it simply maps them thusly:


      incoming message > remailer #1 > .... > remailer #n > outgoing


That this really maps to is obvious:


      incoming message > remailer #1-#n > outgoing


The only thing this does is increase the number of valid entries in the
From: field. Succesful traffic analysis does not require that the From:
field contain only a single item. As a matter of fact it makes no difference
what the headers contain unless the body is put in some kind of envelope for
final delivery. Why? Because all one has to do is look at the body of the
text which will not have changed. This leads to a simple model, based on a
physical remailer:

        1. Physical remailer receives an evelope addressed to them.
        2. They open it and find a $1 money order (for paying the remailer)
           and another envelope with another delivery address on it.
        3. Remailer puts $1 in bank and the interior letter in the mail.

To convert this to electronic means:

        1. Remailer receives a email that is encrypted except for the
           header.
        2. Remailer decrypts mail (ie removes the outer envelope) and
           find three items, block of encrypted data (ie inner envelope)
           with header to next site and e$ token for $1.
        3. Remailer sends the data on its way.

There are a couple of points to be made.

        1. No traffic is handled in the clear except for the header to
           the current destination all others are nested in encryption.
        2. Remailer chaining is handled entirely by the customer
           (ie customer addresses the envelopes)
        3. $1 is the smallest amount normaly accepted as a fee for a
           valid contract.
        4. Remailer can't look at data because there is no way to find the
           correct sequence of keys to unlock the nested encryption.
        5. Automaticaly limits spamming unless a remailer allows cloning
           AND all recipients share a commen private key.
        6. It maps 1:1 onto the physical remailer model with the same limits
           on information at each stage. This allows one to directly apply
           the current history of precedence involving anonymity and
           physical remailers.

Under todays current legal and social structure this is the only model that
will prevent remailers from being held accountable for their traffic and at
the same time provide enough income to keep legal protection at hand. Note
that I am not saying you still can't be brought brought up on charges,
simply that you (as a remailer) now have the structure in place to fight it
succesfuly.

This is the basic model that the Austin Cypherpunks are working on at the
currrent time. The big problem we have right now is determining if the body
is actualy encrypted. We have done some basic tests of encryption-spoofing
using pgp and it is looks to be a thorny problem. It simply is not trivial
to look at a block of characters and determine if they are actualy
encrypted. You can't rely on the wrapper around the data put there by the
encryption program because this can be kept intact and the data changed. As
long as the checksum matches it all looks the same. Even if the test is done
with a dictionary  this won't help because rsa does not guarantee that once
the data is encrypted that the output would be gibberish, sort of like the
"All the monkeys in the world typing create Shakespeare" story. It is
completely feasible (though unlikely) for the encrypted text to be something
meaningful in some language or another.


                                                      Jim Choate






From ravage at ssz.com  Sat Jun  1 09:43:25 1996
From: ravage at ssz.com (Jim Choate)
Date: Sun, 2 Jun 1996 00:43:25 +0800
Subject: Fairness, Justice, and Cypherpunks (fwd)
Message-ID: <199606011349.IAA11019@einstein.ssz.com>



Hi Tim,

Forwarded message:

> Date: Tue, 28 May 1996 13:55:36 -0700
> From: tcmay at got.net (Timothy C. May)
> Subject: Fairness, Justice, and Cypherpunks
> 
> Several recent messages have raised issues about "ownership of
> information," "compilation of dossiers," and the (putative) imbalance
> between personal power and corporate power (which some think justifies
> denying corporations certain basic rights or Constitutional protections).
> 

Businesses (and government) have no rights under the Constitution and should
enjoy no rights under the Constitution. Rights are the sole purvue of real live
human beings (ie individuals) and not groups or paper individuals (stupidest
idea I have ever seen in the legal field). It is not reasonable to support
a motion which allows a group to have the same or possibly more rights than
the individuals that make it up.

Business should not get the right to vote, they should be completely
prohibited from being involved in politics even to the point of making
contributions to politicians. Eisenhower once warned this country of the
military-industrial complexes threat, we have ignored it to date.


                                                    Jim Choate






From jya at pipeline.com  Sat Jun  1 12:32:15 1996
From: jya at pipeline.com (John Young)
Date: Sun, 2 Jun 1996 03:32:15 +0800
Subject: NRC Report, 7, 8
Message-ID: <199606011617.QAA01878@pipe2.t1.usa.pipeline.com>


   Part III   Policy Options, Findings and Recommendations 
 
 
   Chapter 7  Policy Options for the Future 
 
      http://pwp.usa.pipeline.com/~jya/nrc07.txt  (124 kb) 
 
 
   Chapter 8  Synthesis, Findings and Recommendations 
 
      http://pwp.usa.pipeline.com/~jya/nrc08.txt  (134 kb) 
 
 
   ---------- 
 
   14 (quite meaty) Appendices later today. 
 
 
 
 
 





From tcmay at got.net  Sat Jun  1 13:02:21 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 2 Jun 1996 04:02:21 +0800
Subject: opinions on book "The Truth Machine"
Message-ID: <add5bca103021004314e@[205.199.118.202]>


At 11:53 AM 6/1/96, Adam Back wrote:
>Tim May <tcmay at got.net> wrote:
>> At 7:06 AM 5/31/96, Timothy C. May wrote:
>> >It sounds like a "make.money.fast.by.promoting.this.book" scam to me.
>
>If you mean myself, this had not occured to me and I assure you I have
>no connections with the author, and no interest in promoting sales of
>his book.

No, Adam, I certainly was not implying you are profiting from this in any
way. Maybe the "make.money.fast" description was a poor one...what I meant
to imply is that the book is being advertised widely (I've seen half a
dozen announcements of it), and it reminds me of either the Craig Shergold
or make.money.fast posts, not sure which.

>The writing style wasn't great, and I'd agree there were plenty of
>flaws, but what I was interested in was cypherpunks opinions on the
>technology, rather than the quality of the book, or making money for

The main technology, "the truth machine," is so bogus as to be boring.

>The interesting technologies touched on were:
>
>- cheap video used by everyone to record their own lives

A better treatment of this is in David Brin's "Earth."

>That government might have a go at mandating a "voluntary" video
>survielance set up doesn't seem that unrealistic in the current
>political climate.  Having just read your post on curfews my response
>was what the fuck, are you serious?  It totally amazes me that public
>opinion has got to the stage that something like this would be
>accepted.  Sounds like a military dictatorship.  Children first,
>adults next?  The level of peoples paranoia about reducing crime at
>any cost has been severely underestimated.  Surely that's way out of
>line constitutionally?

We agree. I once jokingly wrote a post about "position escrow," and I now
fear it is not so far off. ("The Positional Update Tracking Zoner (PUTZ)
meets law enforcement's legitimate needs, with proper court authority, to
track the movements of citizen-units.")

However, what you say below about being required to explain your movements
to cops who stop you on the highway and then present "papers" to them
within one week is truly horrifying, far beyond anything we yet have here
in these beknighted states:

>For instance I have been stopped by the police four times late at
>night driving home, as I live some distance from the university.  The
>questions are basically what is your business (ie what are you doing
>so late at night), and then they get you to take in your papers to the
>police station within 1 week which is an inconvenience.  Also the
...

!!!

Glad I don't live in Britain.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From anonymous-remailer at shell.portal.com  Sat Jun  1 13:24:31 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sun, 2 Jun 1996 04:24:31 +0800
Subject: Optimism re NRC Cryptography Report
Message-ID: <199606011703.KAA10297@jobe.shell.portal.com>


At 07.40 AM 5/31/96 -0700, tcmay at got.net wrote:

>Unless laws are passed very quickly to outlaw the things we are involved
>with, including such things as superencryption, steganography, anonymous
>remailers, and digital money, I think we will "win the race to the fork in
>the road." The "fork in the road" being the point at which the changes are
>unstoppable.

How fast is very quickly?






From cea01sig at gold.ac.uk  Sat Jun  1 13:58:36 1996
From: cea01sig at gold.ac.uk (Sean Gabb)
Date: Sun, 2 Jun 1996 04:58:36 +0800
Subject: Paper about legal aspects of electronic cash
In-Reply-To: <v03006f05add5cbd1666a@[199.0.65.105]>
Message-ID: <Pine.SUN.3.93.960601184045.5168F-100000@scorpio.gold.ac.uk>


On Sat, 1 Jun 1996, Robert Hettinga wrote:
> 
> (PostScript, 36 pages, about 370K. The paper is written in German.)
> 
> I'm looking forward to your comments.

I wish I could read German well enough to use the paper.  Will it be
translated into English?

While writing, I have a short paper of my own on money laundering and
digital cash.  It's at:

http://www.gold.ac.uk/~cea01sig/monlaund.htm

Sean Gabb.






From markm at voicenet.com  Sat Jun  1 13:59:16 1996
From: markm at voicenet.com (Mark M.)
Date: Sun, 2 Jun 1996 04:59:16 +0800
Subject: Ok, what about PGP (was: MD5 collisions)
In-Reply-To: <199606010433.VAA21006@toad.com>
Message-ID: <Pine.LNX.3.93.960601133031.291A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Thu, 30 May 1996, Chris Adams wrote:

> On 29 May 1996 19:03:04 pdt, wlkngowl at unix.asb.com wrote:
> 
> >I poked around the pgp.h and pgformat.txt files in the PGP 2.6.2
> >distribution.  There *are* designator bytes for the hash (and cipher)
> >algorithms, hash size, etc.
> >
> >It seems quite doable to add support for SHA-1 signatures (and possibly key
> >generation for encrypting secret keys?).
> >
> >Adding 3DES (and maybe Luby-Rackoff-SHA, assuming it hasn't been cracked
> >recently at the Fast Software Conf.... more info?!?) would be nifty too...
> >unless, of course, there's meaning to the Real Soon Now that PGP3 folx
> >claim.
> 
> How about a NSA-stomper option that would use all-of-the-above? For the truly
> paranoid (or 
> owners of Pentium-Pro 200Mhz multi-processor machines

Using 3DES and SHA does not decrease speed that much (it may even be faster).
Both of them are very secure algorithms.

> 
> Also, what's the verdict on IDEA? Is there a switch yet that would allow straight RSA? 
> (with the obvious speed decrease...)

Why would you want to use straight RSA?  IDEA is as strong as a 3000-bit RSA
modulus.  So far, the only known way to crack IDEA is to brute-force the key
space.  RSA relies on the fact that it is assumed to be difficult to factor
large numbers.  If an efficient way is discovered to factor very large moduli,
then RSA is basically worthless.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMbB/n7Zc+sv5siulAQHJuQP/dxToToctPbfjBQE7j1sjO214kVK9TtLX
9mwRuoDppxVhMPATr3k7tdlw+COFPOQZgf0bog+RpCW+iTjlmug6tr56rkTRdUod
AJ0mR11MfQ6yNasPz81WxQracdc48ZXBFEaZYBKFCZRVAoK434dVM3slBtNVCvOn
znHMlt+W9yU=
=fvbq
-----END PGP SIGNATURE-----





From cea01sig at gold.ac.uk  Sat Jun  1 14:00:34 1996
From: cea01sig at gold.ac.uk (Sean Gabb)
Date: Sun, 2 Jun 1996 05:00:34 +0800
Subject: I told you so
In-Reply-To: <199605311928.PAA07729@jekyll.piermont.com>
Message-ID: <Pine.SUN.3.93.960601183545.5168D-100000@scorpio.gold.ac.uk>


On Fri, 31 May 1996, Perry E. Metzger wrote:

> 
> I retract the following story, it was told to me by a contractor 
> who attended a MBONE group meeting on the MBONE, where the story 
> originated:
> 

I'm greatly heartened by retractions.  Anyone who retracts so promptly
shows a commitment to truth that I admire - and that also inclines me to
believe whatever that person does not retract.  I wish it were a more
common thing.

Sean Gabb.






From watson at tds.com  Sat Jun  1 14:28:32 1996
From: watson at tds.com (watson at tds.com)
Date: Sun, 2 Jun 1996 05:28:32 +0800
Subject: NRC Cryptography Report: The Text of the Recommendations
In-Reply-To: <199605302304.QAA14424@jobe.shell.portal.com>
Message-ID: <Pine.SOL.3.91.960601105449.3487C-100000@mailman.tds.com>


Anybody know who the NRC is and whether they have any influence with anyone?

Dave





From WlkngOwl at unix.asb.com  Sat Jun  1 15:01:08 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 2 Jun 1996 06:01:08 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <199606011838.OAA21114@unix.asb.com>


On 31 May 96 at 19:08, Timothy C. May wrote:

> This is off-topic for the list, but I want to share it anyway. It touches
> on issues of increasing police surveillance, and also touches on the issue

Not really too off topic at all, considering the surveillance state 
and GAK relate very much to what we're doing here.

An aside: at the University I used to attend, there were field trips 
to this small museum on the campus by elementary school children, who 
apparently regarded the motion detectors for the automatic doors as 
being cameras which they'd happily wave hello to.  Images of Huxley's 
Brave New World intermingled with Warhol's 15-minutes-of-fame stewed 
up with Orwell here....

> of "age credentials" (in the sense that how else is a cop who stops a young
> person for "curfew violation" to determine if a violation has occurred when
> most 14- and 15-year-olds carry no driver's licenses?)

Since when are we now to carry ID everywhere. And of course the local 
police will (as usual) be selective about who they stop to ask about 
directions.

Also note that a reasonable exception will be for kids to go to work 
or school-related activities (institutional), but nothing 
non-institutional such as a party at a friend's house (drugs or no 
drugs), band practice, etc. etc.

> The "curfew" meme is spreading quickly, with Clinton calling for a federal
> curfew, at least in cities, and Dole trying to outdo him with even more
> draconian curfew laws. Many communities already have them, including San
> Jose, New Orleans, and other large cities. And my own community, Santa Cruz
> County, ironically begins a curfew program on Saturday, tomorrow.

Some communities here in Long Island have them. Others have fought 
them, and I think a couple of attempts were struck down by courts. 
Also a blurb in the local papers about police not wanting the curfew 
here, believing it to be a waste of their time or unnecessary... 
(I'll have to dig the article up; I only rememebr it wasn't 
reassuring.)

[..]
> (Some purists claim that children are exempted from normal constitutional
> protections, such as the right of free association, the right to be free
> from unwarranted searches and seizures, the right of free speech, etc.
> Especially this comes up in debates about rights in public schools (speech,
> locker searches, movements are controlled, etc.). But I think a public

A problem indeed. Children grow up used to the surveillance society 
and don't mind it when they become adults.  Imagine a whole 
generation coming of age being told they are "criminals".  Things 
will be very "interesting" (in the Chinese fortune cookie sense) 
during the next 10-20 years...

> As I said, should such curfews become widespread, children will of course
> need forms of age identification, and this opens yet another door for
> universal I.D. cards. And for "travel papers."

...or they'll stay at home and net surf.  Beware the Four (or six?) 
Horsemen...

Rob.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From perry at piermont.com  Sat Jun  1 15:07:37 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 2 Jun 1996 06:07:37 +0800
Subject: I told you so
In-Reply-To: <Pine.SUN.3.93.960601183545.5168D-100000@scorpio.gold.ac.uk>
Message-ID: <199606011803.OAA17188@jekyll.piermont.com>



I did NOT write what you are attributing to me. I was quoting someone else. 

Please be more careful with your attributions.

.pm

Sean Gabb writes:
> On Fri, 31 May 1996, Perry E. Metzger wrote:
> 
> > 
> > I retract the following story, it was told to me by a contractor 
> > who attended a MBONE group meeting on the MBONE, where the story 
> > originated:
> > 
> 
> I'm greatly heartened by retractions.  Anyone who retracts so promptly
> shows a commitment to truth that I admire - and that also inclines me to
> believe whatever that person does not retract.  I wish it were a more
> common thing.
> 
> Sean Gabb.
> 
> 





From vince at offshore.com.ai  Sat Jun  1 16:03:32 1996
From: vince at offshore.com.ai (Vincent Cate)
Date: Sun, 2 Jun 1996 07:03:32 +0800
Subject: Arms Trafficker Page Made CNN!
Message-ID: <Pine.LNX.3.91.960601150934.6641A-100000@offshore>




The Offshore Information Services Arms Trafficker page made
CNN Computer Connection just moments ago.  :-)

The page:

    http://online.offshore.com.ai/arms-trafficker/

 is now famous.  :-)

  --  Vince





From asgaard at sos.sll.se  Sat Jun  1 16:11:28 1996
From: asgaard at sos.sll.se (Asgaard)
Date: Sun, 2 Jun 1996 07:11:28 +0800
Subject: Statistical analysis of anonymous databases
In-Reply-To: <v02120d02add5829399c2@[192.0.2.1]>
Message-ID: <Pine.HPP.3.91.960601202706.4656A-100000@cor.sos.sll.se>


On Fri, 31 May 1996, Lucky Green wrote:

> HSS needs to verify that the researcher didn't just make up the data. The
> Department therefore has to be able to audit the results of the study by
> contacting a small subset of the participants directly. How can the
> Department contact the participants if they are known only under their
> nyms?

The evaluation of medical, and other, research is based on trust.
Some scientific journals are more trusted than others. Some research
institutions/heads of institutions are more trusted than others.
Original medical data are very rarely checked by outsiders, and if they
are the participating physical entities (patients) are never involved.
Verifying studies by other groups are usually needed before anything
is taken for a truth. So, in medical research in general, de-identified
data are perfectly useful.

In long-term epidemiological research identities are a big plus, though,
but for another reason than checking for scientific cheating. F ex,
the addition of a life-time SSN to peoples' credit cards would make it
possible in 50 years, when the 20-year old's of today start dying, to
compare causes of death with the items in the grocery store data banks
of today, finally deciding the cholesterol controversy (and other
things to make us live longer).

The Swedish National Medical Registry, where all diagnoses and surgical
procedures relating to hospital stays are entered, was de-identified
(except for year of birth) in 1993, by order from the Bureau of Data
Inspection. The epidemiologists haven't been able to sleep since, and
now there is a legislative initiative to enter full identities (our
infamous Person Numbers) again. I think it will pass.

In the discussions of this legislative initiative it has become
public knowledge that the database isn't even encrypted, and those
responsible for it see no need for changing this, since it's not
publically available. Epidemiologists are usually as naive as they
come.


Asgaard









From tcmay at got.net  Sat Jun  1 17:05:20 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 2 Jun 1996 08:05:20 +0800
Subject: Fairness, Justice, and Cypherpunks (fwd)
Message-ID: <add5fbe8040210040f04@[205.199.118.202]>


At 1:49 PM 6/1/96, Jim Choate wrote:

>Businesses (and government) have no rights under the Constitution and should
>enjoy no rights under the Constitution. Rights are the sole purvue of real live
>human beings (ie individuals) and not groups or paper individuals (stupidest
>idea I have ever seen in the legal field). It is not reasonable to support

This may come as a surprise to newspapers, which are corporations for the
most part, and other publishing companies. Here we thought the First
Amendment covered them.

Apparently not. The government of the U.S. may freely tell "Time" magazine
what to right, may tell "Wired" what official slant to put on a story, and
what images "Playboy" may not publish.

Oh, and the various religious institutions are clearly not covered, either,
as they are groups. While _individuals_ are free to worship as they please,
they'd better not form a church or synagogue, lest the government give them
instructions on what to do.

And the Fourth Amendment and other amendments don't cover small businesses,
large corporations, etc., so the cops are perfectly free to knock the doors
down, enter whenever they wish, force companies to quarter troops, seize
property without due process,....

Is this what you're saying is the case, or is this what you want to be the case?

--Tim May



Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From dbell at maths.tcd.ie  Sat Jun  1 17:13:02 1996
From: dbell at maths.tcd.ie (Derek Bell)
Date: Sun, 2 Jun 1996 08:13:02 +0800
Subject: [Off-Topic] "Curfews"
In-Reply-To: <add4f01401021004d019@[205.199.118.202]>
Message-ID: <9606012134.aa29661@salmon.maths.tcd.ie>


	I agree with Tim May on this - it's a draconian solution to crime.
I've heard claims made that it reduces crime - I wonder if that's true and if
so, would that still be true in the long term.

	A quick web search produced a case of a teenager who broke the law
talking to a friend outside her own family's home. I guess that it wouldn't be
wise to allow a child to use a telescope outside - there goes astronomy.

	The hardest hit will probably be homeless children - especially those
who have run away from abuse - they'll be getting a criminal record if they're
caught a few times during curfew.

	Derek





From fletch at ain.bls.com  Sat Jun  1 17:30:34 1996
From: fletch at ain.bls.com (Mike Fletcher)
Date: Sun, 2 Jun 1996 08:30:34 +0800
Subject: Interesting forum on CSPAN
Message-ID: <9606012058.AA24962@outland.ain_dev>


	Was channel surfing last night while MST3K was in a commercial
and wound up watching a panel on CSPAN from the World Economic Forum
on "Technology & Security".  The pannelists were Nicholas Negroponte
from MIT's Media Lab, John Barlow from the EFF, a Mike Nelson from the
White House (no relation to MST3K's :), and two other people whom I
can't for the life of me remember their names (one was from a security
consulting firm, and the other was a lawyer from something like the
"Bristol Group").  It was 3am, so sue me. :)

	I missed the first few minutes, but there was a bunch of
administration encryption policy bashing from all sides.  Nelson kept
saying that the administration wanted to support "good strong
encryption" and they wanted to be able to say (paraphrasing) "We think
this is good.  Use this."  (Trust us, we're from a TLA. :) He also
kept saying that (again, paraphrasing) "most encryption out there is
no good".  Which begs the question then why are they wanting to ban
its use and export.  Negroponte kept bringing up the point that their
policy was based on the (flawed, as we all believe) assumption that no
one outside the US could create good crypto.

	Other topics that were touched on were intellectual property
rights and e$.  It was interesting that the lawyer person agreed to a
good extent with a lot of the remarks Barlow made.  Overall it was
pretty interesting (and not just to watch the White House guy squirm
as his premises were invalidated out from under him :).  CSPAN
usually replays stuff like this at odd times during the weekend so
you might want to keep your eyes peeled.

---
Fletch                                                     __`'/|
fletch at ain.bls.com  "Lisa, in this house we obey the       \ o.O'    ______
404 713-0414(w)	     Laws of Thermodynamics!" H. Simpson   =(___)= -| Ack. |
404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43  U      ------





From jlasser at rwd.goucher.edu  Sat Jun  1 17:39:30 1996
From: jlasser at rwd.goucher.edu (Moltar Ramone)
Date: Sun, 2 Jun 1996 08:39:30 +0800
Subject: NRC Cryptography Report: The Text of the Recommendations
In-Reply-To: <199605311725.KAA21348@mail.pacifier.com>
Message-ID: <Pine.SUN.3.91.960601170005.12262B-100000@rwd.goucher.edu>


On Fri, 31 May 1996, jim bell wrote:

> >This is then followed with a couple of pages of justification for why
> >this relaxation of the export policies should be allowed.  Much is made
> >of the fact that people will be more likely to use 56 bit encryption than
> >the 40 bit which is currently allowed.  (This is an example of the
> >perspective issue I mentioned above.)  However, nowhere is it stated why
> >more than 56 bits is not OK, and why it is necessary to forbid repeated
> >use to increase confidentiality.  There is not one word of discussion of
> >this proviso.
> 
> A very curious omission!  It seems to me that if they're trying to explain 
> any sort of limits on encryption, they should focus carefully on WHY those 
> limits should exist, and why, exactly, those limits should be selected at 
> any particular level.

The way it was explained in the press conference is that 56 bit DES was 
their feeling about what business needed now, and that 56 bit DES was 
_not_ a once-and-for-all stopping point, but just an example of "industry 
needs" etc.

What this really means is that they were too chicken to mention PGP.

Jon Lasser
----------
Jon Lasser (410)532-7138                         - Obscenity  is a crutch  for
jlasser at rwd.goucher.edu                            inarticulate motherfuckers.
http://www.goucher.edu/~jlasser/
Finger for PGP key (1024/EC001E4D)               - Fuck the CDA.






From WlkngOwl at unix.asb.com  Sat Jun  1 17:52:01 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 2 Jun 1996 08:52:01 +0800
Subject: (Fwd) Developers Directory
Message-ID: <199606012208.SAA24097@unix.asb.com>


I got the following 'junk' email so I bit.  They asked for updated 
descriptions of software that I've thrown on the net, along with 
shareware/freeware/GPL/comm. ratings, etc.  Also violence ratings... 
I set all my source codes to "Gruesome" <insert cheesy emoticon here>

Interesting to see what proggies of mine they listed and what they 
didn't.

--Mutant Rob

------- Forwarded Message Follows -------
Date:          Sat, 1 Jun 1996 15:21:29 -0600
From:          Author Database Maintenance <authors at exodus.pht.com>
Subject:       Developers Directory

Dear Author,

We're building a public database called the "Developer's Directory" which
contains information about authors of shareware/freeware programs.
We'd like to include you and some information about your programs. 

We'd sure appreciate it if you'd visit our website and help
us fill in some info.

  http://pacific.pht.com/  [ my info deleted ;]

Since this system is still in the testing phase, we'd like to hear your
comments and suggestions.  Please send them to:
authors at pht.com

Thank you!

Koji Ashida



---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From jamesd at echeque.com  Sat Jun  1 18:04:55 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Sun, 2 Jun 1996 09:04:55 +0800
Subject: WSJ on "IRS-bashing"
Message-ID: <199606012148.OAA24297@dns1.noc.best.net>


At 04:01 PM 5/29/96 -0700, Rich Graves, who lives in a parallel 
universe where political correctness is no threat to liberty, 
and the FBI and BATF no threat to law abiding people wrote:
> any such law
> would be invalidated by R.A.V. v. St. Paul. The only exceptions are
> restrictions on "fighting words" that meet the tests in Chaplinsky v. New
> Hampshire and "hostile working environment" discrimination, which I assume
> is what you're talking about, in some elliptical way.

When I was looking for a house in Oregon, I pointed at the map and asked the 
real estate lady "Why are houses in this area cheap".  She did not give a 
straight answer I pressed her, and then she then started asking me 
questions that indicated she suspected I was an agent provocateur 
from the government trying to entrap her into revealing forbidden information.
I eventually discovered that the area in question was occupied predominantly 
by people of a particular ethnic group, but she was forbidden to tell me this 
information.  This explanation of the price disparity did not occur to me 
until she started feeling me out to see if I was a cop.

But Rich Graves does not regard that sort of thing as any violation on
freedom of speech.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From reagle at MIT.EDU  Sat Jun  1 18:22:34 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Sun, 2 Jun 1996 09:22:34 +0800
Subject: NRC Cryptography Report: The Text of the Recommendations
Message-ID: <9606012215.AA24993@rpcp.mit.edu>


At 10:55 AM 6/1/96 -0700, watson at tds.com wrote:
>Anybody know who the NRC is and whether they have any influence with anyone?

        They have influence in that their reports have a fair amount of
credibility with the extra boost of NAS's "scientific authority." If one
wanted to distinguish what they do with what the OTA did for instance, one
could say that while the OTA generally had a very smart/competent staff (and
had a turbulent, poorly managed history and political troubles) the NRC has
the strength in that it is non-governmental and has the shroud of
"scientific neutrality" about it it could hope to pull from its parent
organization, the NAS.

        The NAS and NRC have interesting histories, the NAS was an honorary
society that had some fundings for it snuck into an appropriations bill back
in 1863, but generally it was not supported by the government aside from
specific "contract" studies which the Congress might ask for. The NRC (known
as the NDRC) was created as an advisory council under NAS to help the
government with munitions research and development during WWI. Since, they
conduct hoc scientific/policy studies to investigate a topic on Congress's
behalf. Their "Realizing the Information Future" that came out a couple of
years ago was highly regarded. 

For history on these topics I recommend:

Hunter Dupree, Sciene in the Federal Government: A History to 1940, Harper &
Row, 1974.

Bruce L. R. Smith, American Science Policy Since World War II, Brookings
Institution, 1990.

>From their WEB page:

National Research Council

   NRC Logo

   The National Research Council was organized by the National Academy of
   Sciences in 1916 to associate the broad community of science and
   technology with the Academy's purposes of further knowledge and
   advising the federal government. Functioning in accordance with
   general policies determined by the Academy, the National Research
   Council has become the principal operating agency of both the National
   Academy of Sciences and the National Academy of Engineering in
   providing services to the government, the public, and the scientific
   and engineering communities. The National Research Council is
   administered jointly by both Academies and the Institute of Medicine.
   Dr. Bruce M. Alberts is the chairman of the National Research Council.


_______________________
Regards,            Real generosity toward the future lies in giving 
                    all to the present. - Albert Camus
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From WlkngOwl at unix.asb.com  Sat Jun  1 18:51:11 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 2 Jun 1996 09:51:11 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
Message-ID: <199606012311.TAA25220@unix.asb.com>


There was a story on CNN about how anonymous people on IRC (and other 
commercial online chats) giving stock tips is a Bad Thing (tm).  
Actually had some guy saying that a law should ban anonymous 
discussions of stocks online.

Yeesh. What ever happened to caveat emptor?  (Like a recommendation 
on IRC is automatically more trustworthy than overhearing a 
conversation in a public bathroom?)

--Mutant Rob.
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From medea at alpha.c2.org  Sat Jun  1 19:11:12 1996
From: medea at alpha.c2.org (Medea)
Date: Sun, 2 Jun 1996 10:11:12 +0800
Subject: NRC Cryptography Report: The Text of the Recommendations
Message-ID: <199606012130.OAA00695@infinity.c2.org>


Dave Watson wrote:

>Anybody know who the NRC is and whether they have any influence >with anyone?

Dave,

  Maybe the following article might answer your question....

Medea

+++++++++++++++Forwarded Article+++++++++++++++++++

          WASHINGTON (Reuter) - Cryptography, the art and science of secret writing, has long been the province of soldiers, rulers
and spies. But a study for Congress released Thursday said the U.S. government should promote widespread commercial use of such tricks to curb theft of computer data, wireless communications and other electronic information.
          A committee of the National Research Council, which gives science and technology advice under a congressional charter, said a broad use of cryptography would help the United States in many ways including making banking and telecommunications networks more secure and giving individuals greater privacy.
          In a report requested by Congress, the panel said no law should bar the manufacture, sale or use in the United States of any form of encryption -- mathematical formulas to scramble
electronic data to thwart eavesdroppers. Largely siding with
industry in a long tug-of-war with law enforcement officials, it
also said export controls on encryption technologies should be
"progressively relaxed but not eliminated."
          The Clinton administration and its predecessors have
blocked the export of powerful cryptography, fearing it would
hinder officials in thwarting terrorism and counter-espionage.
          Committee chair Kenneth Dam, a law professor at the
University of Chicago, acknowledged that the spread of
encryption technologies would make some law enforcement and
spying tougher for the United States.
          "But the many benefits to society of widespread commercial and private use of cryptography outweigh the disadvantages," he said in a statement accompanying the report, entitled "Cryptography's Role in Securing the Information Society".
          The administration wants to set up government-approved
repositories that keep copies of mathematical keys for decoding
encrypted information so officials can lift the veil on secret
communications if granted a court order.
          Industry executives and privacy advocates strongly oppose such "escrowed" encryption, arguing that reliable coding
technology is critical for commerce and for privacy in the
information age and on the Internet, the worldwide collection of
computer networks.
          In its study, the committee said U.S. policy should take account of national security concerns but should be driven more by market forces than by law.  "Since the committee believes
that widespread deployment and use of cryptography are in the
national interest, it believes that national cryptography policy
should align itself with user needs and market forces to the
maximum feasible extent," it said.






From jya at pipeline.com  Sat Jun  1 19:12:09 1996
From: jya at pipeline.com (John Young)
Date: Sun, 2 Jun 1996 10:12:09 +0800
Subject: NSCP, PRZ Hit NRC Crypto Rec
Message-ID: <199606012246.WAA00647@pipe3.t1.usa.pipeline.com>


   Netscape (WSJ) and PRZ (Globe) say the NRC crypto 
   export recommendations don't go far enough. 
 
   ---------- 
 
   Wall Street Journal, May 31, 1996, p. B5. 
 
 
   U.S. Strategy Should Promote Computer Codes 
 
      Panel Says a Free Market Is Best Policy, Urges Easing of 
      Export Curbs 
 
   By John J. Fialka 
 
 
   Washington -- The federal government should promote rather 
   than discourage widespread commercial use of powerful codes 
   that can protect electronic communications, a panel 
   sponsored by the National Research Council recommended. 
 
   The government also should relax its export controls on 
   such codes, according to the 16-member panel, which 
   included a mix of business, academic and government 
   experts. The NRC is an affiliate of the National Academy of 
   Sciences, a private, nonprofit organization that advises 
   the government on scientific matters. 
 
   Encryption coding software scrambles computer data by using 
   mathematical formulas that can't be read if intercepted. 
   Only personnel with the correct "keys" can access the data. 
 
   More Study Needed 
 
   The NRC study, which took 18 months to complete, calls for 
   greater trust in freemarket demands for protection and less 
   reliance on the U.S. National Security Agency and the 
   Federal Bureau of Investigation to set the nation's code 
   policy. It said the two agencies' recent promotion of 
   "escrowed encryption," in which the government would hold 
   a mathematical key to unlock codes, requires further study 
   because it poses liability risks and introduces weakness 
   into information protection systems. 
 
   Kenneth W. Dam, a University of Chicago law professor who 
   headed the panel, said changes are needed to counter "an 
   explosion of computer-based crime" and other forms of 
   espionage that threaten U.S. companies' ability to protect 
   proprietary information, especially overseas. 
 
   By promoting the use of more-elaborate codes, U.S. 
   law-enforcement agencies would be better prepared to ward 
   off hacker or terrorist attacks on the nation's electric 
   power grid, banking and telecommunications systems and its 
   air-traffic control networks, he added. 
 
   Potential Problems 
 
   Mr Dam said the widespread use of encryption by private 
   business is "inevitable" and the government must "recognize 
   this changing reality." 
 
   The report noted that the FBI has argued for years that its 
   law-enforcement efforts would be hampered if drug cartels 
   and other organized criminals began using codes that 
   couldn't be deciphered. Courtordered wiretaps, a major tool 
   used to break organized-crime cases, could become useless, 
   the FBI has contended. 
 
   Edward Schmults, general counsel for GTE Corp. and a former 
   deputy attorney general during the Reagan administration, 
   said he and other panel members believe the FBI and other 
   law-enforcement agencies would be helped more than hurt if 
   legitimate businesses were better protected. "It's a 
   balancing issue," he said. 
 
   Spokesmen for the FBI and NSA referred questions to the 
   White House, where an official said the Clinton 
   administration disagrees with the panel's recommendation to 
   relax export controls and wants to continue to explore the 
   use of escrows by private industry to keep the keys to 
   powerful codes. "We have equities to protect that the 
   people who wrote the NRC report do not," he said. 
 
   The administration, he said, still wants to review the 
   export of more powerful codes on a case-by-case basis. The 
   use of private, third-party escrows, he said, might be one 
   way to protect the secrecy of companies while allowing 
   federal agents with court orders access to code keys. 
 
   New Markets Would Open 
 
   The panel called for the U.S. to permit the export of codes 
   containing a "56-bit" Data Encryption Standard algorithm. 
   The algorithm, or formula, was developed by the National 
   Bureau of Standards in 1975 and is 65,000 times tougher to 
   break than current "40-bit" codes that are permitted for 
   unlicensed exports. 
 
   The panel estimated its recommendations would open up new 
   markets for information security products, possibly 
   increasing software-industry revenue "many tens of billions 
   of dollars." Until now, export controls tended to set 
   industry standards for a level of protection because 
   companies were reluctant to use different systems for 
   domestic and international applications. 
 
   Jeffrey Treuhaft, director of security at Internet software 
   giant Netscape Communications Corp., welcomed the report, 
   but said exports shouldn't be limited to 56-bit keys. That 
   would still blunt the competitive edge of U.S. software 
   vendors, given that code-cracking computer power is 
   multiplying, he said. 
 
   "The U.S. has a lead right now and these arcane policies 
   from the Cold War are giving U.S. industry cement shoes to 
   compete with foreign competitors," Mr. Treuhaft said. "We 
   can't run as fast as they ean." 
 
   - Jared Sandberg in New York contributed to this article. 
 
   [End] 
 
---------- 
 
   The Boston Globe, May 31, 1996, p. 36 
 
 
   Panel criticizes US government's encryption stand 
 
      'Net, cell phone security at stake, National Research 
      Center says 
 
   By Hiawatha Bray 
 
   The Clinton administration's efforts to limit the sale of 
   software that generates coded messages, already unfire from 
   Congress and civil libertarians, is now facing criticism 
   from a committee of the National Academy Sciences. 
 
   The National Research Center, which gives science and 
   technology advice under a congressional charter, yesterday 
   said the government should promote the commercial use of 
   encryption software to help cut down on the theft of 
   computer data and other electronic communications. 
 
   Law enforcement officials and intelligence agencies are 
   worried about the development of cheap encryption grams, 
   for fear it could become impossible to intercept a 
   mobster's telephone call or read an enemy spy's electronic 
   mail messages. 
 
   But the center's report says that encryption software is 
   essential for businesses and individuals who need to 
   transmit confidential data using the Internet or cellular 
   telephones. 
 
   "On balance, the advantages of more widespread use of 
   cryptography outweigh the disadvantages," the report says. 
 
   Encrypted messages can easily be read by someone with the 
   correct code "key." Without this key, it can take centuries 
   of computer analysis to decode a message. The longer the 
   key, the tougher it is to break the code. 
 
   Under current federal law, US companies cannot export 
   encryption programs that use keys longer than 40 bits. 
   Computer experts say that 40-bit encryption systems are 
   easy to break, and provide little security. 
 
   As a result, many software companies that sell their 
   products worldwide do not build in sophisticated encryption 
   features. Industry experts say that this costs them 
   millions of dollars in sales, as customers in foreign 
   countries buy encryption software made outside the United 
   States. 
 
   The report urges a change in the federal law, to allow sale 
   of an encryption system called DES that uses 56-bit keys. 
   "Except in some very specialized situations, it gives 
   adequate security," said council chairman Kenneth Dam, a 
   law professor at the University of Chicago. 
 
   The report also urges the administration to abandon efforts 
   to force businesses and individuals to use "key escrowed" 
   encryption software. Under this plan, companies could use 
   encryption, keys of any length, but only if the keys were 
   held in escrow, and could be made available to the 
   government. 
 
   The council urges the federal government to adopt key 
   escrow to prove that the system is trustworthy. The report 
   argues that many businesses will voluntarily adopt such a 
   plan to guard against the loss of its encryption keys. 
 
   A prominent critic of encryption policy was less than 
   thrilled by-the council report. "It doesn't go far enough," 
   said Philip Zimmermann, inventor of the Pretty Good Privacy 
   encryption program. 
 
   Zimmermann scoffed at the idea that DES encryption is 
   secure enough for use by businesses. "It can be broken in 
   seconds by the NSA [National Security Agency]," Zimmermann 
   said. "All major governments can break DES. In fact, any 
   Fortune 500 company can afford a machine that can break 
   DES." 
 
   But even if DES were secure enough, Zimmermann said he 
   opposes any restrictions on the export of encryption 
   software. 
 
   [End] 
 
 





From nobody at REPLAY.COM  Sat Jun  1 19:58:32 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 2 Jun 1996 10:58:32 +0800
Subject: Hello there!Re: Where does your data want to go today?
Message-ID: <199606020009.CAA03429@basement.replay.com>


Someone who claimed to be David F. Ogren said on Sat, 1 Jun 1996:

> > The brute force system decrypts the first, and second blocks (8
> > bytes each) of the cyphertext, XORs them, and compares the result
> > with "PKZIP2.1".  If the comparison is equal it has the key.

> I will concede that having a known header, such as a PKZIP header,
> does weaken a crypto to certain degree, but I still believe that it is
> not a significant problem.  Here's why:

Why not simply use two session keys, and encrypt the headers with one 
while encrypting the actual data with the other? That seems to solve both 
problems, except that more CPU cycles are required.






From jya at pipeline.com  Sat Jun  1 21:20:52 1996
From: jya at pipeline.com (John Young)
Date: Sun, 2 Jun 1996 12:20:52 +0800
Subject: NRC Report, Appendices
Message-ID: <199606020123.BAA11417@pipe3.t1.usa.pipeline.com>


   Appendices A-D: 
 
      http://pwp.usa.pipeline.com/~jya/nrca-d.txt  (187 kb) 
 
   With images of Tables D.1 and D.2 for Appendix D: 
 
      http://pwp.usa.pipeline.com/~jya/nrcd1.jpg  (101 kb) 
      http://pwp.usa.pipeline.com/~jya/nrcd2.jpg  (118 kb) 
 
 
   Appendices E-N: 
 
      http://pwp.usa.pipeline.com/~jya/nrce-n.txt  (199 kb) 
 
 
   ---------- 
 
   Thanks to DN. 
 
   ---------- 
 
                         APPENDICES 
 
   A  Contributors to the NRC Project on National Cryptography 
      Policy 
 
   B  Glossary 
 
   C  A Brief Primer on Cryptography 
 
   D  An Overview of Electronic Surveillance: History and 
      Current Status 
 
 
   E  A Brief History of Cryptography Policy 
 
   F  A Brief Primer on Intelligence 
 
   G  The International Scope of Cryptography Policy 
 
   H  Summary of Important Requirements for a Public-Key 
      Infrastructure 
 
   I  Industry-Specific Dimensions of Security 
 
   J  Examples of Risks Posed by Unprotected Information 
 
   K  Cryptographic Applications Programming Interfaces 
 
   L  Laws, Regulations, and Documents Relevant to 
      Cryptography 
 
   M  Other Looming Issues Related to Cryptography Policy 
 
   N  Federal Information Processing Standards 
 





From markm at voicenet.com  Sat Jun  1 21:23:03 1996
From: markm at voicenet.com (Mark M.)
Date: Sun, 2 Jun 1996 12:23:03 +0800
Subject: Compressed data vulnerable to known-plaintext?
In-Reply-To: <199606020009.CAA03429@basement.replay.com>
Message-ID: <Pine.LNX.3.93.960601212148.1195A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Sun, 2 Jun 1996, Anonymous wrote:

> Someone who claimed to be David F. Ogren said on Sat, 1 Jun 1996:
> 
> > > The brute force system decrypts the first, and second blocks (8
> > > bytes each) of the cyphertext, XORs them, and compares the result
> > > with "PKZIP2.1".  If the comparison is equal it has the key.
> 
> > I will concede that having a known header, such as a PKZIP header,
> > does weaken a crypto to certain degree, but I still believe that it is
> > not a significant problem.  Here's why:
> 
> Why not simply use two session keys, and encrypt the headers with one 
> while encrypting the actual data with the other? That seems to solve both 
> problems, except that more CPU cycles are required.

An easier solution would be to just strip of the headers.  If the header is
always the same, then it is redundant.  If it varies, then it cannot be used
as known-plaintext.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMbDtYrZc+sv5siulAQETVQP8DtIyI+pKr/cP7dNrQbnCeqSL+Dzu24ZR
4IL6FdaxYaGNQsT+GYBh1iFW++V1mtnyx8JNKKZ7huiLIMKqp1Iw+92q+tc+4T/o
Owd8a70Ld4rT6ma0pZOskLzLZCov4FitSfYKAonIsTYiMenmsYwo/rz6tdzKHPrg
oM6wdHfv1hg=
=fhBX
-----END PGP SIGNATURE-----





From winn at Infowar.Com  Sat Jun  1 21:28:11 1996
From: winn at Infowar.Com (winn at Infowar.Com)
Date: Sun, 2 Jun 1996 12:28:11 +0800
Subject: Class III InfoWar
Message-ID: <199606020133.VAA17985@mailhost.IntNet.net>


Feel Free To Distribute Widely:

Class III Information Warfare: Has It Begun?

The June 2, 1996 Sunday Times from London front page headline reads:
"City Surrenders to L400 million Gangs"

And HERF Guns, Electromagnetic Pulses and sophisticated logic bombs may be 
responsible.

At InfoWarCon II, Montreal Canada, I made reference to investigations I was 
conducting regarding concerted and organized attacks on up to 43 financial 
institutions in Europe and the US; an example of Class III Information Warfare. 
This issue of London Sunday Times brings a glimpse of the story that will 
eventually be told.

The first attack in my files dates to January 6, 1993. A trading house in London 
was blackmailed into paying L10million to unknown extortionists who demonstrated 
they could crash the company's computers at will. The next incident in the Times 
article is also in my files: January 14, 1993 where similar demonstrations and 
demands were made for this time L12.5Million. And so is the next, January 29, 
1993 and another L10Million siphoned off by the bad guys. According to my 
figures and those in the Times article, hundreds of millions of pounds have been 
paid ransom in what is clearly an example of Class III Information Warfare.

According to officials in Washington, Whitehall, London, City of London Police, 
the National Security Agency, Kroll Associates, Bank of  England and others (in 
the article) the threats are credible. The attackers have the clear ability to 
bring trading and financial operations to a halt - exactly when they say they 
will. "Banks, brokerage firms and investment houses in America have also 
secretly paid ransom to prevent costly computer meltdowns and a collapse in the 
confidence  among their customers," sources said in the article.

The article discussed the advanced information warfare techniques used by the 
perpetrators. "According to the American National Security Agency (NSA), they 
have penetrated computer systems using 'logic bombs' (coded devices that can be 
remotely detonated), electromagnetic pulses and 'high emission radio frequency 
guns' which blow a devastating electronic 'wind' through the computer systems." 
[For a complete description of HERF Guns (coined by Schwartau in 1990), see 
"Information Warfare: Chaos on the Electronic Superhighway," Thunders Mouth 
Press, 1994] 

The perpetrators have also left encrypted messages, apparently bypassing the 
highest security levels of the systems, leaving messages such as "Now do you 
believe we can destroy your computers?" The NSA and other officials believe that 
four gangs are involved; probably one from the US and probably one from Russia. 
But, because the crimes are international, national borders still prevail, 
making investigation more difficult. Investigations and official inquiries have 
been in progress for some time according to the article.

Now, for a few things you will not see in the articlem, but will hopefully [if I 
am lucky] come out in the near future. The number of attacks is way above 40. 
They have been known about for almost three years, but only recently have people 
been willing to come out of the closet and discuss this highly sensitive issue 
with the media. Long briefs and analyses of these events have been submitted to 
high level officials and select business persons for at least a year, but to no 
avail. [Security by obscurity reigns all too often.] Banking is not the only 
industry that has been attacked and the attacks have been spread around Europe 
as well as Australia.

As an industry many of us have said that the only way something will really be 
done is if we experience a Computer Chernobyl [Peter Neumann Phrase as I recall] 
or as I first said in Congressional Testimony, An Electronic Pearl Harbor. Are 
these events the harbinger of strong reaction by the community at large? As 
events unfold and more information is permitted to be disseminated over the next 
few days and weeks, we will see.

We have essentially solved the issues of confidentiality and integrity. But, I 
have maintained that the real problem is going to be Denial of Service. These 
events are unfortunate, but clear examples of that reality. 

A Bank of England official also said of the incidents, "it is not the biggest 
issue in the banking market."  Hmmm. I have to think about that.



Peace
Winn

		        Winn Schwartau - Interpact, Inc.
		        Information Warfare and InfoSec
		       V: 813.393.6600 / F: 813.393.6361
			    Winn at InfoWar.Com






From frissell at panix.com  Sat Jun  1 21:52:00 1996
From: frissell at panix.com (Duncan Frissell)
Date: Sun, 2 Jun 1996 12:52:00 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <2.2.32.19960602015920.00b2dfb8@panix.com>


At 07:08 PM 5/31/96 -0700, Timothy C. May wrote:
>(Some purists claim that children are exempted from normal constitutional
>protections, such as the right of free association, the right to be free
>from unwarranted searches and seizures, the right of free speech, etc.

I'm afraid that some courts have explicitly held that "the child does not
have a right to liberty but only a right to custody."  That is old law,
however.  Kids have lost many rights recently too including gun rights, etc.

>So Santa Cruz begins its own fascist crackdown on the free movements of
>persons. The "curfew" begins Saturday night.

Of course curfew laws only control the inarticulate and scruffy.  Well
dressed children (coat and tie for the boys dress or suit for the girls) who
can claim that they are out doing tons of protected things like work and
school and worship and political campaigning and "trying to save street
children for Jesus" will not be picked up.  They can also say things like
"Ossifer, I'm peaceably assembling to petition the government for redress of
grievances.  It's in the First Amendment.  You could read about it and
everything."  

Home schooled children face this problem frequently and can usually find
something to say.  Kids older than 15 or so can claim to be "emancipated
minors."  Parents can emancipate their children by signing a simple
declaration to back up this claim.  A good idea in any case.  You don't want
to be accused of "owning slaves just like Thomas Jefferson."  Parents can
also give their kids blanket notes of permission to be out on the streets.

DCF

"Whose children never got stopped by cops because at 14 they passed for 21.
Clothing and bearing alone can do it."






From sandfort at crl.com  Sat Jun  1 21:56:35 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Sun, 2 Jun 1996 12:56:35 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
Message-ID: <2.2.32.19960602015403.0070d0a0@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

At 06:44 PM 6/1/96 +0000, Deranged Mutant wrote:

>There was a story on CNN about how anonymous people on IRC (and other 
>commercial online chats) giving stock tips is a Bad Thing (tm).  
>Actually had some guy saying that a law should ban anonymous 
>discussions of stocks online.
>
>Yeesh. What ever happened to caveat emptor?  (Like a recommendation 
>on IRC is automatically more trustworthy than overhearing a 
>conversation in a public bathroom?)

One of the oldest tricks for running a stock up (or down) is 
to put rumor teams on elevators in the financial district of
major cities.  All day long, they ride up and down elevators
having whispered, but not unintelligable, conversations about
the target company.  Of course, they "accidentally" drop what
sounds like important insider information.  Just think how
much more efficient the Net can be for such activities.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~









From anonymous-remailer at shell.portal.com  Sat Jun  1 22:15:58 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sun, 2 Jun 1996 13:15:58 +0800
Subject: Compressed data vulnerable to known-plaintext?
Message-ID: <199606020213.TAA00981@jobe.shell.portal.com>


Someone who claimed to be Mark M. said on Sat, 1 Jun 1996:

    (I said:)
> > Why not simply use two session keys, and encrypt the headers with one 
> > while encrypting the actual data with the other? That seems to solve both 
> > problems, except that more CPU cycles are required.
> 
> An easier solution would be to just strip of the headers.  If the header is
> always the same, then it is redundant.  If it varies, then it cannot be used
> as known-plaintext.

But then you still have the problem of identifying the contents.  If there
were no headers, one could not tell if the message was compressed using
ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor,
or even if it was left alone.  One could also not tell if the decryption
happened successfully.

( * Yes, I know tar is not compression. )






From daemon at anon.penet.fi  Sat Jun  1 22:34:41 1996
From: daemon at anon.penet.fi (daemon at anon.penet.fi)
Date: Sun, 2 Jun 1996 13:34:41 +0800
Subject: Reply to anonymous ping.
Message-ID: <9606020233.AA05600@anon.penet.fi>


Your code name is: an611909 at anon.penet.fi.






From tcmay at got.net  Sat Jun  1 22:38:32 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 2 Jun 1996 13:38:32 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <add64d13020210048815@[205.199.118.202]>


At 1:59 AM 6/2/96, Duncan Frissell wrote:

>Of course curfew laws only control the inarticulate and scruffy.  Well
>dressed children (coat and tie for the boys dress or suit for the girls) who
>can claim that they are out doing tons of protected things like work and
>school and worship and political campaigning and "trying to save street
>children for Jesus" will not be picked up.  They can also say things like

This, by the way, is the main thing that concerns certain civil rights
groups (including the Santa Cruz chapter of the ACLU). They say they'll be
monitoring enforcement patterns to see if more "children of color" are
picked up than their percentage in the population represents.

>"Ossifer, I'm peaceably assembling to petition the government for redress of
>grievances.  It's in the First Amendment.  You could read about it and
>everything."

Personally, I liked my "religious exemption" example. The Baal worshippers
can claim that they are engaging in their religion by grokking the
darkness. If picked up and held, they can claim they are "being held
without Baal."

>to be accused of "owning slaves just like Thomas Jefferson."  Parents can
>also give their kids blanket notes of permission to be out on the streets.
>

Most of the ordinances, including the one here, specifically state that
"blanket permission" by parents is not acceptable. They want _specific_
reasons for being out after curfew.

(It's this taking control from both the kids and their parents and putting
it in the hands of cops that really bugs me.)

By the way, if being out after curfew is breaking the law, can I make a
"citizen's arrest" of some of those nice young chicas in Watsonville?

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From markm at voicenet.com  Sun Jun  2 00:25:01 1996
From: markm at voicenet.com (Mark M.)
Date: Sun, 2 Jun 1996 15:25:01 +0800
Subject: Compressed data vulnerable to known-plaintext?
In-Reply-To: <199606020213.TAA00981@jobe.shell.portal.com>
Message-ID: <Pine.LNX.3.93.960602001039.2658A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Sat, 1 Jun 1996 anonymous-remailer at shell.portal.com wrote:

> But then you still have the problem of identifying the contents.  If there
> were no headers, one could not tell if the message was compressed using
> ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor,
> or even if it was left alone.  One could also not tell if the decryption
> happened successfully.

OK, I think I misunderstood.  You were talking about encrypting a file that
has already been compressed and I was talking about an encryption program that
would compress then encrypt.  In the latter case, headers would be completely
unnecessary, whereas in the former, they are necessary.  Generally, checksums
or parity bits are much better ways of checking if the decryption was
successful.  While this does make cryptanalysis easier, a known-plaintext will
not work.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMbEWH7Zc+sv5siulAQFA0gP9FMd68l1J8K12FDLkx5+p5j0TwrAlCLn0
cqSHVouOw2mhqk1LEgxMBPuI+6Vw2Bnzhj8QxDz7Qjjs98Jqu4p+4ky9FLzVn4vh
oGi2j/W0P1onLi4bSoq6u1SE8vPCNRresTox36DMWOMSN4Lxybx363xDx+8vD627
5D9n3fW5e/0=
=V+t3
-----END PGP SIGNATURE-----





From stevenw at best.com  Sun Jun  2 00:28:42 1996
From: stevenw at best.com (Steven Weller)
Date: Sun, 2 Jun 1996 15:28:42 +0800
Subject: RISKS: Pachinko card counterfeit background
Message-ID: <v01540b00add6d330aae6@[206.86.1.35]>



------------------------------

Date: Tue, 28 May 1996 22:09:28 +0900 (JST)
From: Chiaki Ishikawa <ishikawa at personal-media.co.jp>
Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15)

I would like to add some background as someone who has played in pachinko
parlors in Japan.  (The origin of the game of pachinko is rather vague.
Some say it is based on the ball game popular after the WW-II in U.S.A..
Anyway, it is a gambling business.)

The card in question acts as a kind of debit card inside the pachinko
parlors.  It was introduced a few years ago by an former police official,
with the expressed intention of keeping the money flow easy to track. (I
would say it was a ruse to make a few companies where the ex-police
officials can find jobs after retirement from the office. But I digress.)

The cards are sold to the pachinko parlors and the customers buy the cards
from the parlors, and obtain steel balls to play the game by inserting the
card into the slot next to the game machine.

Pachinko gambling works as follows.  When you win the game, the number of
steel balls in your possession increases and the customer can exchange the
balls with gifts.  (Therein lies a complication. Japanese law prohibits
gambling, and so exchanging the steel balls with real money is illegal.
*However*, first exchanging the balls with gifts, and then exchanging the
gifts with money at a third party outlet [which is quite likely to be
operated by the parlor owner] has been allowed by the police.) Speaking of
loophole! Some people do bring back the gifts to homes: depending on the
places, parlors carry game-boy cartridges, latest bestseller books, snack
food such as cookies, instant noodles, umbrella, purse, movie video tape,
music CD, to name a few as gifts. But if the customer wants to exchange
his/her win indirectly to money at the outlet, then he/she has to ask for
special gifts used essentially as money tokens by these establishments.
These are often a tiny gold/silver foil embedded in thin plastic slab, etc..
Each parlor/outlet pair uses different stuff. In my hometown, a special
brand of silk stocking was used as money token. This whole thing is a farce
in view of the anti-gambling law in Japan.)

Back to the card: the cards in question are used by two leading card
manufacturers. (There are another couple of late-entry companies whose cards
are not known to be attacked yet.) The card is based on the design done by
NTT Data.  NTT is the Japanese equivalent of old Ma Bell in the USA.  NTT
Data is a company that specializes in computer software integration,
communication and such.  I believe it designs the telephone card (debit card
used for pay-phone in Japan), too.

The pachinko card is the size of name card and plastic.  The details are not
published. To the best of my knowledge, I think there is a magnetic strip
that contains the card ID information such as its serial number and the
amount of debit money.

There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards.
(I said "were" because 10,000 yen and 5,000 yen cards are no longer
available.)

Attack method:

>From what I saw and read, the first card verification mechanism used by the
pachinko game machine was so primitive to defy rational explanation: each
time the card was used, a tiny hole was punched to indicate the amount left
in the card. As the customer uses the card, the position of the punched hole
on card shifts toward the zero position. Once there is a hole on the zero
position, the card is no longer usable.

The first simple attack as far as I can tell was to fill in the hole in the
card with tiny plastic (essentially the chaff produced when the hole is
punched was used to fill in the hole).  I am not sure if such simple attack
was possible, but it seemed possible really at the beginning with crude
modification of the magnetic data.

Then, of course, the magnetic information on the card was also modified in
more sophisticated ways when the card was used.

However, the bad people also learned and somebody stole the reader mechanism
and figure out the part of the magnetically-coded information: the result
was that bad people could buy the pristine 10,000 yen card and then uses up
to 2500 yen of the debit amount legally and then "re-fill" the card to 9500
yen worth, thus gaining 2000 yen for free again and again.  (Until 3000 yen
was used from the 10,000 yen card, the physical hole was not produced on the
card, and only the magnetic information was changed. Hence the mere
counterfeiting of the magnetic information was necessary to "revive" the
card. No physical re-filling of the card was necessary. Physically
re-filling the hole is easy to spot visually and was avoided by the bad
guys.)

[I have to confess that the exact amount involved in the counterfeiting
is a little uncertain. But the general idea still holds.]

Similar attack was possible with 5,000 yen card.

Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was
small compared with the risk, the bad guys didn't attack these cards until
lately.

Now the situation is that of cats and mouse.  New counterfeiting
methods and counter-measures follow each other in rapid succession.

I believe that the cloning of the card was also done. But I don't know the
details.

Now, the card companies and pachinko parlors stopped issuing 10,000 yen and
5,000 yen cards because the damage was so large.

Also, they have installed special readers to verify the validity of the card
by incorporating more vigourous checking not available on the readers next
to the game machine: it used to be that the cards sold could by used by any
pachinko parlors in Japan. Now cards sold elsewhere have to be verified with
this machine before used at a local game parlor. Cards sold at the local
parlor can be used without such checking.

Already, there are reports of counterfeit-card usage:

 - either the cards are so sophisticated that they can pass the enhanced
   reader.
 - Or the bad guys buy the cards locally and then use some of the
   debit amount and then bring the cards to their factory to re-fill
   and re-use it at the local store again and again.

The card companies have installed countermeasures in selected stores to the
cloning of the card by checking the serial number of the card and stopped
the operation of the whole game machines in the store if a card with the
serial number of the previously used (finished?) card is ever inserted into
the game machine.

Another simple method of fooling the reader was also reported about a month
ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the
most expensive card after 10,000 yen and 5,000 yen card are gone) and
rotates the strip to invert its direction and then reassembles the card
again using cement or something. To my surprise, it was reported to be
deemed valid by some readers (!?). Apparently some readers only check for
the position of the hole on fixed position and fooled to believe the card is
valid if the hole is not in the expected position, etc.. Once not so
rigorous readers are distributed, it is very difficult to upgrade all of
them in Japan, I guess.

The problem is complicated in that the counterfeiting only damages the card
company. The parlors report the amount of debit money used in their shops
and then compensated for the amount (less the small surcharge by the card
company.)  This means that every time the counterfeit card is used the card
company alone loses money and the local parlor doesn't lose.

There have already been reports of the owners of the pachinko parlors
involved in the usage of the counterfeit cards.  These bad owners allowed
the bad guys to use the counterfeit cards in their parlors and pass the used
debit amount to the card company and getting compensated.

In these cases, the bad guys bring back the money (by simply exchanging the
phony debit money into the steel balls, and then without playing (they can
play if they wish), exchange the steel balls to the special gifts, and then
exchange the gifts with money. [Usually, buying the steel balls and then
exchanging them with gifts, and subsequently with money leaves you less
money than you started with. The house always wins. In this case, the bad
guys started out with counterfeit debit money and ends up with real money,
so it is OK for the bad guys.] The parlor also gets the money for the used
debit money. So they win, too.  Only the card companies lose.

Counterfeiting probably has existed since the first money (or equivalent)
was ever invented.  But, it surprised me that NTT Data approached the whole
scheme so naively, especially since there have been reports of telephone
card counterfeiting in Japan before.  Some of the counterfeiting methods
reported seemed so simple, and I have a doubt whether NTT Data was serious
enough to deter counterfeiting.

At least, I can safely say they have underestimated the ingenuity of the
counterfeiters badly and didn't learn from the counterfeiting of telephone
cards very well.

Ishikawa, Chiaki  (family name, given name)
Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa at personal-media.co.jp

------------------------------

-------------------------------------------------------------------------
Steven Weller                      |  Technology (n):
                                   |
                                   |     A substitute for adulthood.
stevenw at best.com                   |     Popular with middle-aged men.







From blancw at accessone.com  Sun Jun  2 00:39:34 1996
From: blancw at accessone.com (blanc)
Date: Sun, 2 Jun 1996 15:39:34 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <01BB5005.1D2F0560@blancw.accessone.com>


From: 	Timothy C. May

Most of the ordinances, including the one here, specifically state that
"blanket permission" by parents is not acceptable. They want _specific_
reasons for being out after curfew.
...................................................................................

(sigh)

Once again, the individual is backed up against the wall and made to answer to the State ("specifically") for their behavior in the world of human action. 
("so who are you that I must explain myself to you?")

I was considering the inclination of the list membership to focus upon technological, rather than political, solutions to certain social problems.   Would a focus upon the idea of individual self-ownership & authority have any effect upon the State? 
(who *are* those people, anyway)

The State resorts to the use of forcible methods in order to keep their non-valuable citizens in line.  The citizens who feel themselves unfairly included resort to the use of technology to deal with impositions of the State upon them when their own ideas on morality are not accepted as legitimate.   

A lot of people talk about morality and justice, but really who gives a flip.  The place of these ideas in the everyday life of each person reduces to irrelevance in the face of all the ignorance and cynicism, and in consideration of the alternative technologies which can be used in place of reasoning, when reasoning makes no difference (when you can't force people to think, as often happens).

"I think it's time we re-evaluate the nature of our relationship".

     ..
Blanc









From stevenw at best.com  Sun Jun  2 00:40:30 1996
From: stevenw at best.com (Steven Weller)
Date: Sun, 2 Jun 1996 15:40:30 +0800
Subject: RISKS: Pachinko card counterfeiting update
Message-ID: <v01540b00add6cfd2c035@[206.86.1.35]>


------------------------------

Date: Tue, 28 May 1996 22:09:28 +0900 (JST)
From: Chiaki Ishikawa <ishikawa at personal-media.co.jp>
Subject: re: TILT! Counterfeit pachinko cards ... (Wayner, RISKS-18.15)

I would like to add some background as someone who has played in pachinko
parlors in Japan.  (The origin of the game of pachinko is rather vague.
Some say it is based on the ball game popular after the WW-II in U.S.A..
Anyway, it is a gambling business.)

The card in question acts as a kind of debit card inside the pachinko
parlors.  It was introduced a few years ago by an former police official,
with the expressed intention of keeping the money flow easy to track. (I
would say it was a ruse to make a few companies where the ex-police
officials can find jobs after retirement from the office. But I digress.)

The cards are sold to the pachinko parlors and the customers buy the cards
from the parlors, and obtain steel balls to play the game by inserting the
card into the slot next to the game machine.

Pachinko gambling works as follows.  When you win the game, the number of
steel balls in your possession increases and the customer can exchange the
balls with gifts.  (Therein lies a complication. Japanese law prohibits
gambling, and so exchanging the steel balls with real money is illegal.
*However*, first exchanging the balls with gifts, and then exchanging the
gifts with money at a third party outlet [which is quite likely to be
operated by the parlor owner] has been allowed by the police.) Speaking of
loophole! Some people do bring back the gifts to homes: depending on the
places, parlors carry game-boy cartridges, latest bestseller books, snack
food such as cookies, instant noodles, umbrella, purse, movie video tape,
music CD, to name a few as gifts. But if the customer wants to exchange
his/her win indirectly to money at the outlet, then he/she has to ask for
special gifts used essentially as money tokens by these establishments.
These are often a tiny gold/silver foil embedded in thin plastic slab, etc..
Each parlor/outlet pair uses different stuff. In my hometown, a special
brand of silk stocking was used as money token. This whole thing is a farce
in view of the anti-gambling law in Japan.)

Back to the card: the cards in question are used by two leading card
manufacturers. (There are another couple of late-entry companies whose cards
are not known to be attacked yet.) The card is based on the design done by
NTT Data.  NTT is the Japanese equivalent of old Ma Bell in the USA.  NTT
Data is a company that specializes in computer software integration,
communication and such.  I believe it designs the telephone card (debit card
used for pay-phone in Japan), too.

The pachinko card is the size of name card and plastic.  The details are not
published. To the best of my knowledge, I think there is a magnetic strip
that contains the card ID information such as its serial number and the
amount of debit money.

There were 10,000 yen, 5,000 yen, 3,000 yen, 2,000 yen, and 1,000 yen cards.
(I said "were" because 10,000 yen and 5,000 yen cards are no longer
available.)

Attack method:

>From what I saw and read, the first card verification mechanism used by the
pachinko game machine was so primitive to defy rational explanation: each
time the card was used, a tiny hole was punched to indicate the amount left
in the card. As the customer uses the card, the position of the punched hole
on card shifts toward the zero position. Once there is a hole on the zero
position, the card is no longer usable.

The first simple attack as far as I can tell was to fill in the hole in the
card with tiny plastic (essentially the chaff produced when the hole is
punched was used to fill in the hole).  I am not sure if such simple attack
was possible, but it seemed possible really at the beginning with crude
modification of the magnetic data.

Then, of course, the magnetic information on the card was also modified in
more sophisticated ways when the card was used.

However, the bad people also learned and somebody stole the reader mechanism
and figure out the part of the magnetically-coded information: the result
was that bad people could buy the pristine 10,000 yen card and then uses up
to 2500 yen of the debit amount legally and then "re-fill" the card to 9500
yen worth, thus gaining 2000 yen for free again and again.  (Until 3000 yen
was used from the 10,000 yen card, the physical hole was not produced on the
card, and only the magnetic information was changed. Hence the mere
counterfeiting of the magnetic information was necessary to "revive" the
card. No physical re-filling of the card was necessary. Physically
re-filling the hole is easy to spot visually and was avoided by the bad
guys.)

[I have to confess that the exact amount involved in the counterfeiting
is a little uncertain. But the general idea still holds.]

Similar attack was possible with 5,000 yen card.

Presumably the gain by attacking 3,000 yen, 2,000 yen and 1,000 yen card was
small compared with the risk, the bad guys didn't attack these cards until
lately.

Now the situation is that of cats and mouse.  New counterfeiting
methods and counter-measures follow each other in rapid succession.

I believe that the cloning of the card was also done. But I don't know the
details.

Now, the card companies and pachinko parlors stopped issuing 10,000 yen and
5,000 yen cards because the damage was so large.

Also, they have installed special readers to verify the validity of the card
by incorporating more vigourous checking not available on the readers next
to the game machine: it used to be that the cards sold could by used by any
pachinko parlors in Japan. Now cards sold elsewhere have to be verified with
this machine before used at a local game parlor. Cards sold at the local
parlor can be used without such checking.

Already, there are reports of counterfeit-card usage:

 - either the cards are so sophisticated that they can pass the enhanced
   reader.
 - Or the bad guys buy the cards locally and then use some of the
   debit amount and then bring the cards to their factory to re-fill
   and re-use it at the local store again and again.

The card companies have installed countermeasures in selected stores to the
cloning of the card by checking the serial number of the card and stopped
the operation of the whole game machines in the store if a card with the
serial number of the previously used (finished?) card is ever inserted into
the game machine.

Another simple method of fooling the reader was also reported about a month
ago. Essentially, it cuts out a long strip of the 3,000 yen card (now the
most expensive card after 10,000 yen and 5,000 yen card are gone) and
rotates the strip to invert its direction and then reassembles the card
again using cement or something. To my surprise, it was reported to be
deemed valid by some readers (!?). Apparently some readers only check for
the position of the hole on fixed position and fooled to believe the card is
valid if the hole is not in the expected position, etc.. Once not so
rigorous readers are distributed, it is very difficult to upgrade all of
them in Japan, I guess.

The problem is complicated in that the counterfeiting only damages the card
company. The parlors report the amount of debit money used in their shops
and then compensated for the amount (less the small surcharge by the card
company.)  This means that every time the counterfeit card is used the card
company alone loses money and the local parlor doesn't lose.

There have already been reports of the owners of the pachinko parlors
involved in the usage of the counterfeit cards.  These bad owners allowed
the bad guys to use the counterfeit cards in their parlors and pass the used
debit amount to the card company and getting compensated.

In these cases, the bad guys bring back the money (by simply exchanging the
phony debit money into the steel balls, and then without playing (they can
play if they wish), exchange the steel balls to the special gifts, and then
exchange the gifts with money. [Usually, buying the steel balls and then
exchanging them with gifts, and subsequently with money leaves you less
money than you started with. The house always wins. In this case, the bad
guys started out with counterfeit debit money and ends up with real money,
so it is OK for the bad guys.] The parlor also gets the money for the used
debit money. So they win, too.  Only the card companies lose.

Counterfeiting probably has existed since the first money (or equivalent)
was ever invented.  But, it surprised me that NTT Data approached the whole
scheme so naively, especially since there have been reports of telephone
card counterfeiting in Japan before.  Some of the counterfeiting methods
reported seemed so simple, and I have a doubt whether NTT Data was serious
enough to deter counterfeiting.

At least, I can safely say they have underestimated the ingenuity of the
counterfeiters badly and didn't learn from the counterfeiting of telephone
cards very well.

Ishikawa, Chiaki  (family name, given name)
Personal Media Corp., Shinagawa, Tokyo, Japan 142 ishikawa at personal-media.co.jp


-------------------------------------------------------------------------
Steven Weller                      |  Technology (n):
                                   |
                                   |     A substitute for adulthood.
stevenw at best.com                   |     Popular with middle-aged men.







From ezekiel at alpha.c2.org  Sun Jun  2 01:39:30 1996
From: ezekiel at alpha.c2.org (ezekiel at alpha.c2.org)
Date: Sun, 2 Jun 1996 16:39:30 +0800
Subject: No Subject
Message-ID: <199606020532.WAA28053@infinity.c2.org>



winn at Infowar.Com wrote:
> 
> The article discussed the advanced information warfare techniques used by the 
> perpetrators. "According to the American National Security Agency (NSA), they 
> have penetrated computer systems using 'logic bombs' (coded devices that can be 
> remotely detonated), electromagnetic pulses and 'high emission radio frequency 
> guns' which blow a devastating electronic 'wind' through the computer systems." 
> [For a complete description of HERF Guns (coined by Schwartau in 1990), see 
> "Information Warfare: Chaos on the Electronic Superhighway," Thunders Mouth 
> Press, 1994] 
> 

Thanks for the info (and for the excellent book, by the way).

Can you explain in little detail what are these logic bombs?

Also, why these institutions do not install protection from HERF radiation
and TEMPEST-type protection from information leaks? Do they think that
paying ransom is cheaper than all investment in IW-protection?

thanx





From nobody at REPLAY.COM  Sun Jun  2 02:22:15 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 2 Jun 1996 17:22:15 +0800
Subject: Riding online elevators  (Was CNN: Anonymous Stock Tips)
Message-ID: <199606020638.IAA15227@basement.replay.com>


In my mail this morning was this bit of spam, I never heard of this guy 
before, Likely scooped my mailing address from misc.invest.stocks.

-Newman

--Fwd--
>http://chancellor.stockpick.com
>
>I just got wind that Chancellor Group is reporting big quarterly earnings.
>SGA Goldstar is just sending out a "buy" recommendation.  I understand other 
>investment advisors are looking to recommend CHAG. The company has a 
>strong book value.  The short sellers need to cover.  This looks like a 
>good situation to me.  What do you think?  They are located at:
>
>http://chancellor.stockpick.com
>
>Bruce Keller, 203-869-8137
>
>To terminate from my Internet Investment Opportunities, Reply to  
>term at portlandweb.com with "remove" in the subject field. 






From hal9001 at panix.com  Sun Jun  2 02:41:59 1996
From: hal9001 at panix.com (Robert A. Rosenberg)
Date: Sun, 2 Jun 1996 17:41:59 +0800
Subject: Class III InfoWar
In-Reply-To: <199606020133.VAA17985@mailhost.IntNet.net>
Message-ID: <v03006f01add6d281719d@[166.84.254.3]>


At 21:33 -0400 6/1/96, winn at Infowar.Com wrote:


>The article discussed the advanced information warfare techniques used by the
>perpetrators. "According to the American National Security Agency (NSA), they
>have penetrated computer systems using 'logic bombs' (coded devices that
>can be
>remotely detonated)

Unless the definition has changed recently, a "logic bomb" is normally a
piece of code in a program that is triggered when a specific event occurs
(such as the programmer's name not appearing in a payroll file for a
designated period of time [which might trigger a salami round off routine
to start cutting checks 2 months after s/he is no longer working for the
company]).







From stewarts at ix.netcom.com  Sun Jun  2 02:50:16 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sun, 2 Jun 1996 17:50:16 +0800
Subject: Multiple Remailers at a site?
Message-ID: <199606020659.XAA25720@toad.com>


>I don't think multiple remailers at the same site help anything.

Assume Alice, Bob, and Carol are on abc.com and Xenu, Yak, and Zut
are on xyz.com.  Remailing between Alice, Bob, and Carol doesn't
make appear to make much difference, but it does reduce the damage
if one of the remailer's keys is compromised.  On the other hand,
mail from Alice -> Xenu -> Bob -> Yak -> Carol -> Zut adds traffic
to the system, and makes traffic analysis more difficult,
even if the Bad Guys are watching site abc.com and have stolen
Alice, Bob, and Carol's keys.

The other threat it helps with is that if XYZ.COM gets complaints
about that evil user Zut, she can kick her off (Bad Zut!)
and still leave Xenu and Yak alone; if the remailer service
were provided by the machine owner herself she might be directly liable.
#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Rescind Authority!






From WlkngOwl at unix.asb.com  Sun Jun  2 02:51:32 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 2 Jun 1996 17:51:32 +0800
Subject: Come to think of it (was Something that just crossed my mind....
Message-ID: <199606020734.DAA20016@unix.asb.com>


On 30 May 96 at 22:35, snow wrote:

> 	In some of the discussion on this list there has been some concern
> about the governments position on anonymous fund transfers. Well, maybe
> concern is incorrect. We _know_ (or should) what it is. They are dead set
> against it. 

Hm.

The more I think about it, the more that it seems foolish to be 
against anonymous payee systems.  Mainly because those who want it 
now (and who will want it in the future) and who have the resources 
will already have it.

As for catching tax-evaders, criminals, etc... for most the five 
BMWs, indoor heated pool and yacht should be enough attention for 
those who really want to know.  Of course the gov't isn't that 
interested in doing the legwork... better for them to have everything 
on a computer for easy data-crunching rather than do real footwork. 
(Can you say downsizing? Nah.... they'd put twice the savings into 
useless gadgets like attack helicopters to patrol minority 
neighborhoods with...)

Off the track, slightly:

It seems the effect that these laws have are to make it so only the 
very wealthy and connected (or perhaps incredibly ambitious and 
smart) have access to privacy and de facto loopholes in the law.
The only "criminals" who will be able to get away with anything are 
those who are already so well off (and possibly buddy-buddy with the 
Powers That Bee, Bzzt!).

[..]
> 	The discussion here seems to assume that business will accept, or
> even welcome the ability of it's customers to remain unknown, or nymknown.
> It is my position (until proven wrong--please) that larger business DON'T
> want anonymity. They _want_ to be able to track purchases and use of their
> product for several reasons. 

Good point. But many consumers want anonymity, or at least to control 
what information they give customers.  Many might even settle for 
pseudo-anonymity (ie, account number 123456 likes to buy product X, 
but whoever 123456 *is* is known only to 123456....).

[..]
> 	The questions that this raises are:
> 
> 	1) Am I full of shit. This is very possible. 

Everyone is at some time or another, unless you never eat.

[..]



--Mutant Rob. 

---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From WlkngOwl at unix.asb.com  Sun Jun  2 02:51:42 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 2 Jun 1996 17:51:42 +0800
Subject: Compressed data vulnerable to known-plaintext?
Message-ID: <199606020748.DAA20117@unix.asb.com>


On  1 Jun 96 at 19:13, anonymous-remailer at shell.port wrote:

[..]
> But then you still have the problem of identifying the contents.  If there
> were no headers, one could not tell if the message was compressed using
> ZIP, LHA, StuffIt, tar*, compress, gzip, Alice's Magical Supercompressor,
> or even if it was left alone.  One could also not tell if the decryption
> happened successfully.

Actually you could, since the actual encoding isn't random. It means 
something to the compressor.  And if you know something about 
compression algorithms you could probably make some good estimates. 
(I've seen some arguments that bit-wise a compressed file is easier 
to make a known plaintext attack against than an uncompressed text 
file...)

Try taking various small (but compressable) text files that are 
different and run them through compressors.  Ignore the usual 
compressor header information and look at a hex dump of the 
compressed data... think about it in terms of bits.  Look at the 
algorithm that encoded the data.

A good way to avoid known plaintext is to use a feedback mode with a 
random IV (from a good RNG!).  Not perfect, of course...

Rob.


 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From WlkngOwl at unix.asb.com  Sun Jun  2 03:00:15 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 2 Jun 1996 18:00:15 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <199606020741.DAA20077@unix.asb.com>


On  1 Jun 96 at 21:59, Duncan Frissell wrote:

> I'm afraid that some courts have explicitly held that "the child does not
> have a right to liberty but only a right to custody."  That is old law,
> however.  Kids have lost many rights recently too including gun rights, etc.

....which dates back to laws that said women and children were mens' 
possessions.  Very archaic.

A case from several years ago comes to mind.  Apparently a federal(?) 
court ruled that a 16-yr-old girl's parents were in the legal right 
to burn her krshna books and ban her from practicing it. [There was a 
protest in downtown SF sometime in 1989 or '90 about this.]

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From stewarts at ix.netcom.com  Sun Jun  2 03:15:22 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sun, 2 Jun 1996 18:15:22 +0800
Subject: How can you protect a remailer's keys?
Message-ID: <199606020659.XAA25725@toad.com>


Encryption is critical for protecting against traffic analysis,
but it's tough to protect a remailer's keys.  Unlike regular email,
where you can type the key in as you read it, remailers need to
run automatically once you set them up.  Some of the choices are:
- leave it around in plaintext with only Unix file protections
        (Ghio2 works this way - does Mixmaster?  My ghio2 version has it 
        compiled into the binary, and I try to delete it from source.)
- type it in to a long-running remailer process 
        (with human intervention to start)
- SSL-based remailers, where the web server handles crypto on
        a per-machine basis instead of per-remailer
- use unauthenticated Diffie-Hellman (either hanging off
        a TCP port somewhere instead of mail, or
        3 pieces of email)
- off-line or off-site remailer such as a POP3 winsock remailer
        that makes it Somebody Else's Problem, and separates
        the remailer's public interface from the working parts
- human intervention on every message (which may not be totally
        worthless for moderated news postings, if you want to
        take that approach to spam prevention.)

Anybody have any other approaches?  These are mostly weak,
annoying, or both.


#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Rescind Authority!






From bart at netcom.com  Sun Jun  2 03:48:11 1996
From: bart at netcom.com (Harry Bartholomew)
Date: Sun, 2 Jun 1996 18:48:11 +0800
Subject: Riding online elevators  (Was CNN: Anonymous Stock Tips)
In-Reply-To: <199606020638.IAA15227@basement.replay.com>
Message-ID: <199606020800.BAA15224@netcom2.netcom.com>


> 
> In my mail this morning was this bit of spam, I never heard of this guy 
> before, Likely scooped my mailing address from misc.invest.stocks.
> 
> -Newman
> 
> --Fwd--
> >http://chancellor.stockpick.com
> >
> >I just got wind that Chancellor Group is reporting big quarterly earnings.
> >SGA Goldstar is just sending out a "buy" recommendation.  I understand other 
    ...     
    No. Seems to have gone to all cypherpunks.  I've never heard of 
    misc.invest.stocks.

    b





From blancw at accessone.com  Sun Jun  2 04:06:01 1996
From: blancw at accessone.com (blanc)
Date: Sun, 2 Jun 1996 19:06:01 +0800
Subject: Riding online elevators  (Was CNN: Anonymous Stock Tips)
Message-ID: <01BB5023.866A2000@blancw.accessone.com>


From: 	Anonymous

In my mail this morning was this bit of spam, I never heard of this guy 
before, Likely scooped my mailing address from misc.invest.stocks.

-Newman
.....................................................................

No, I received it as well.   Must have taken names at addresses from the list.

     ..
Blanc


--Fwd--
>http://chancellor.stockpick.com
>
>I just got wind that Chancellor Group is reporting big quarterly earnings.
>SGA Goldstar is just sending out a "buy" recommendation.  I understand other 
>investment advisors are looking to recommend CHAG. The company has a 
>strong book value.  The short sellers need to cover.  This looks like a 
>good situation to me.  What do you think?  They are located at:
>
>http://chancellor.stockpick.com
>
>Bruce Keller, 203-869-8137
>
>To terminate from my Internet Investment Opportunities, Reply to  
>term at portlandweb.com with "remove" in the subject field. 









From frissell at panix.com  Sun Jun  2 07:06:09 1996
From: frissell at panix.com (Duncan Frissell)
Date: Sun, 2 Jun 1996 22:06:09 +0800
Subject: WSJ on "IRS-bashing"
Message-ID: <2.2.32.19960602111135.009e740c@panix.com>


At 04:01 PM 5/29/96 -0700, Rich Graves wrote:

>Fascinating. Could you provide citations to these laws so that people in
>this plane of reality might take a look at them? Over here, any such law
>would be invalidated by R.A.V. v. St. Paul. The only exceptions are
>restrictions on "fighting words" that meet the tests in Chaplinsky v. New
>Hampshire and "hostile working environment" discrimination, which I assume
>is what you're talking about, in some elliptical way.

Pittsburgh Press vs Pittsburgh Human Relations Commission (sex specific help
wanted advertizing outlawed).  Various Fair Housing Laws ("we don't rent to
your kind here" punishable by confiscation of property).  Civil Rights Act
of 1964 (verbal expressions of discrimination in the course of employment,
housing, or service in public accommodations punished in numerous ways).
Expressions of ill-will towards the President or members of his family
punishable as threats in circumstances where similar comments made about
anyone else would not be actionable.  

Note that work is a big part of most people's lives and there are
substantial governmental restrictions imposed on speech in the work place
with fellow employees and customers.  

DCF







From WlkngOwl at unix.asb.com  Sun Jun  2 08:16:44 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 2 Jun 1996 23:16:44 +0800
Subject: Riding online elevators  (Was CNN: Anonymous Stock Tips
Message-ID: <199606021259.IAA21895@unix.asb.com>


On  2 Jun 96 at 1:00, Harry Bartholomew wrote:

> > In my mail this morning was this bit of spam, I never heard of this guy 
> > before, Likely scooped my mailing address from misc.invest.stocks.
[..]
>     No. Seems to have gone to all cypherpunks.  I've never heard of 
>     misc.invest.stocks.

The only time I saw it was in that post... thankfully.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From jervin at server1.netpath.net  Sun Jun  2 10:59:52 1996
From: jervin at server1.netpath.net (John D. Ervin)
Date: Mon, 3 Jun 1996 01:59:52 +0800
Subject: No Subject
Message-ID: <199606021453.KAA11735@server1.netpath.net>


list
 
John D. Ervin
Also known as "Felix1" 
jervin at netpath.net







From cea01sig at gold.ac.uk  Sun Jun  2 11:55:38 1996
From: cea01sig at gold.ac.uk (Sean Gabb)
Date: Mon, 3 Jun 1996 02:55:38 +0800
Subject: I told you so
In-Reply-To: <199606011803.OAA17188@jekyll.piermont.com>
Message-ID: <Pine.SUN.3.93.960602164556.18416A-100000@scorpio.gold.ac.uk>




On Sat, 1 Jun 1996, Perry E. Metzger wrote:

> 
> I did NOT write what you are attributing to me. I was quoting someone else. 
> 
> Please be more careful with your attributions.
> 


Since I did not address my praise to you, I fail to see why you should
have any reason to be outraged by it.  However, let me record now for the
avoidance of ambiguity that I have never accused YOU of retracting any
falsehood.

Yours sincerely,

Sean Gabb.






From gregmi at galileo.mis.net  Sun Jun  2 12:16:06 1996
From: gregmi at galileo.mis.net (Greg Miller)
Date: Mon, 3 Jun 1996 03:16:06 +0800
Subject: Riding online elevators  (Was CNN: Anonymous Stock Tips)
In-Reply-To: <199606020800.BAA15224@netcom2.netcom.com>
Message-ID: <31b1c9a5.80296887@pop.mis.net>


On Sun, 2 Jun 1996 01:00:04 -0700 (PDT), you wrote:

>    No. Seems to have gone to all cypherpunks.  I've never heard of 
>    misc.invest.stocks.

	I never got a copy.  But it sounds like to good deal to me :)


"Randomness is in the eye of the beholder" --Numerical Recipes
gregmi at mis.net (Greg Miller)
http://grendel.ius.indiana.edu/~gmiller/





From minow at apple.com  Sun Jun  2 12:35:05 1996
From: minow at apple.com (Martin Minow)
Date: Mon, 3 Jun 1996 03:35:05 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
Message-ID: <v02140b02add76c92d750@[17.128.200.24]>


>
>One of the oldest tricks for running a stock up (or down) is
>to put rumor teams on elevators in the financial district of
>major cities.

It would be more efficient to talk about the rumor on a cellular
phone.  Probably make a nice sting scenario, too.

Martin Minow (who expects a cut of the reward money).
minow at apple.com







From minow at apple.com  Sun Jun  2 12:40:56 1996
From: minow at apple.com (Martin Minow)
Date: Mon, 3 Jun 1996 03:40:56 +0800
Subject: Java Crypto API questions
Message-ID: <v02140b01add765d5419c@[17.128.200.24]>


>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on
>the eagerly awaited (at least by this user) Java Crypto API.

Here are my notes (and between-the-lines observations) from the Java crypto
sesions (which were very well received). Watch the Java web sites for
transcripts from JavaOne sessions. (but I don't know if the BOF will be
available).

-- Security is *important* -- zero tolerance for security bugs.
   Gosling said in his keynote that it changes things when people
   send their bug reports to USA Today.
-- They're working with standards folk: W3C, IETF.
-- Clean, simple design, paying attention toll aspects of security
   design: language, virtual machine, components (libraries).
-- Adding digital signatures to code enables greater trust -- the
   user can allow an applet to "escape from the sandbox."
-- Policies = Assertions + Capabilities. That's what my notes
   say -- I think it means that the user can use a signature
   to authenticate the applet's author/publisher and allow it
   greater capabilities. For example, a stock trading applet
   might be granted the capability to access a stock price service
   (Dow Jones) *and* a stock trading service. The current applet
   model only allows remote connection to the site that distributed
   the applet.
-- Java will allow signing archives (a set of classes and resources).

-- Network-centered security: digital signatues, encryption, key exchange,
   hash, bignum, random number generators.
-- Packages (third-party applets) communicate with security packages
   through an abstract layer. There may be multiple packages.
-- They will provide a secure key storage (like Apple's PowerTalk
   today, I presume) where "all" of your keys are held under a
   a single password. Rogue applications (applets?) can't leak keys.
-- Feedback to security-api at java.sun.com.
-- There's a white paper on the verifyier on the sun web site.
-- They're writing a security policy for applications (applications
   function like "ordinary" Unix/Mac/whatever applications.
-- User preference to designate capabilities for signed/unsigned
   applets.

---- ---- ----
Notes from the security birds of a feather session
---- ---- ----

-- Need multiple security managers: if any say no, reject the request.
-- Servet, applet need different security managers.
-- Problem with firewalls: client accesses server via firewall via
   proxy servers. May not be able to open a URL directly.
-- Java Commerce API coming for payment functions.
-- Problem with foreign applet vendors: how can a non-US security
   class vendor certify a class to be used (outside the US).
   Currently, it must be imported and signed by Sun. But, then
   it can't be exported without a Commerce Department license.
   No (current) plans to establish a signing authority outside
   of the U.S.

Martin Minow
minow at apple.com








From test921148 at alpha.c2.org  Sun Jun  2 13:04:07 1996
From: test921148 at alpha.c2.org (test921148 at alpha.c2.org)
Date: Mon, 3 Jun 1996 04:04:07 +0800
Subject: premail manual info
Message-ID: <199606021630.JAA10996@infinity.c2.org>


Whopee! Just installed premail. But I have a Question on how to
use it. I need some Manual explaining how to use Premail
and what can I put into its Configuration-file. I use Version
0.43 of Premail. The perl Script is somewhat readable but it is
better if some User-manual was available.

Send Answers to test921148 at alpha.c2.org





From shabbir at vtw.org  Sun Jun  2 14:00:24 1996
From: shabbir at vtw.org (Voters Telecommunications Watch)
Date: Mon, 3 Jun 1996 05:00:24 +0800
Subject: INFO: Sen. Burns urges White House to follow NRC recommendations (6/2/96)
Message-ID: <199606021726.NAA27994@panix3.panix.com>


=============================================================================
          ____                  _              _   _
         / ___|_ __ _   _ _ __ | |_ ___       | \ | | _____      _____
        | |   | '__| | | | '_ \| __/ _ \ _____|  \| |/ _ \ \ /\ / / __|
        | |___| |  | |_| | |_) | || (_) |_____| |\  |  __/\ V  V /\__ \
         \____|_|   \__, | .__/ \__\___/      |_| \_|\___| \_/\_/ |___/
                    |___/|_|

       SEN. CONRAD BURNS URGES CLINTON TO REASSES ENCRYPTION POLICY AND
               ANNOUNCES HEARINGS ON THE ISSUE for 6/12/96

      REP. RICK WHITE (R-WA) SCHEDULED FOR HOTWIRED CHAT 6/5/96 9-10PM EST
      SEN. CONRAD BURNS (R-MT) SCHEDULED FOR HOTWIRED CHAT 6/11/96 10-11PM EST

                              Date: June 2, 1996

         URL:http://www.crypto.com/            crypto-news at panix.com
           If you redistribute this, please do so in its entirety,
                         with the banner intact.
-----------------------------------------------------------------------------
Table of Contents
        News
        Text of Sen. Burns' letter to President Clinton
        How to receive crypto-news

-----------------------------------------------------------------------------
NEWS

Sen. Conrad Burns (R-MT), principal co-sponsor of legislation to ease
restrictions on encryption, yesterday sent President Clinton a letter
urging the Administration to reassess its encryption policy in light
of a recent report by the National Research Council.

The findings contained in the NRC study, released at a briefing in
Washington DC on Thursday, raise serious questions about the rational
for the Administration's current approach to cryptography policy.  The
study states explicitly, "Current national cryptography policy is
not adequate to support the information security requirements of an
information society."

In his letter to the President, Senator Burns said that the NRC study
presents overwhelming evidence that the current approach to encryption
policy has failed.  Burns also pledged to hold hearings in the Senate
Commerce Committee on June 12 and 26.

The night before the hearings (June 11 at 10 pm ET), Senator Burns
will be live online at HotWired (http://www.hotwired.com/wiredside). Be
sure to save the date and stop by to talk with the Senator about his
efforts to encourage the widespread availability of strong encryption
and get a preview of the hearings on the Pro_CODE bill.

Information on Senator Burns' legislation, as well as information on the
NRC report, is available at http://www.crypto.com


                                DON'T FORGET!

Representative Rick White (R-WA) will be on HotWired Wednesday June 5th
at 9pm EST at http://www.hotwired.com/wiredside/  You can tune in and listen
to the chat with the RealAudio software (http://www.realaudio.com).  You can
ask questions of the Representative through a moderator and get real,
immediate responses.

-----------------------------------------------------------------------------
TEXT OF SEN. BURNS' LETTER TO PRESIDENT CLINTON

                              May 30, 1996

The President
The White House
Washington, D.C. 20500

Dear Mr. President,

I urge you to reassess the administration's position on cryptography
policy in light of the report released today by the National Research
Council,  "Cryptography's Role in Securing the Information Society."
The report was put together by the NRC Committee to Study National
Cryptography, which included members from across the spectrum of the
business, academic, defense and intelligence communities.  The fact
that such a diverse  roster of our brightest minds could achieve
consensus after taking two years to pore over the details of encryption
policy is remarkable, and their recommendations should be taken most
seriously.

The acronym of the report's title-CRISIS-is especially apt given the
massive economic and national security costs of the current policy,
which severely restricts the export of software containing strong
encryption.   As the report states, "Current national cryptography
policy is not adequate to support the information security requirements
of an information society.  Indeed, current policy discourages the use
of cryptography, whether intentional or not, and in so doing impedes
the ability of the nation to use cryptographic tools that would help to
remediate certain important vulnerabilities."  As the Chairman of the
NRC Committee to Study National Cryptography, Kenneth Dam, states in
the report "the crisis is a policy crisis, rather than a technology
crisis, an industry crisis, a law enforcement crisis, or an
intelligence-gathering crisis..."

The most recent version of the administration's policy, as reflected in
the draft white paper of the interagency working group on encryption,
unfortunately reveals a continuing commitment to government-imposed
mandates rather than private-sector solutions.  The proposal, which was
quickly dubbed "Clipper III" because of its close alignment with the
earlier rejected Clipper schemes, has the support of neither the
software industry nor the Net community.

Indeed, as the Committee noted, an essential flaw behind the
administration's policy is the continuing reliance on the national
security and law enforcement communities to drive the policy through
administrative diktat rather than open legislative action.   As the
report states, rather than vainly attempting to reign in the inevitable
widespread use of  strong encryption, the administration should be
actively promoting it.  The use of strong encryption has become vital
to both ensuring the privacy of individuals and fostering the growth of
the Global Information Infrastructure into the 21st century.  As for
the national security aspects of encryption policy, the report states
that cryptography can protect proprietary information and reduce
economic espionage.  In addition, strong encryption can protect
nationally sensitive information systems and networks against
unauthorized penetration.  Therefore, the use of strong encryption
serves to protect national security rather than hinder it.  Simply put,
"on balance, the advantages of more widespread use of cryptography
outweigh the disadvantages."


I further call your attention to specific recommendations by the Committee:

*National cryptography policy should be developed by the executive and
 legislative branches on the basis of open  public discussion and
 governed by the rule of law.

*No law should bar the manufacture, sale, or use of any form of encryption
 within the United States.

*Export Controls on cryptography should be progressively relaxed.

*The U.S. government should promote the security of the telecommunications
 networks more actively.

*The U.S. government should take steps to assist law enforcement and
 national security to adjust to new technical realities of the information
 age.

*Aggressive government promotion of escrowed encryption is not appropriate...

*The debate over national cryptography policy can be carried out in a
 reasonable manner on an unclassified basis.

*National cryptography policy  affecting the development and use of
 commercial cryptography should be more closely aligned with market forces.

A core recommendation of the Committee is that the administration
foster an open public debate so that a national consensus on
cryptography can be developed.  I agree wholeheartedly and hope that
the public hearings beginning on June 12 in the Commerce Committee's
Subcommittee on Science, Space and Technology, which I chair, will help
foster this process.  Many of the NRC's recommendations are reflected
in the "Burns Pro-CODE bill," S. 1726, which will be debated on that
date, with an additional hearing to be held on June 26.

Now that some of the best scientific and technical minds in the country
have essentially endorsed the position that business and policy
advocates have been taking for years, it's time for the administration
to come around as well.  In conclusion, I can only agree with the
Chairman Dam's statement:

We believe that our report makes some reasonable proposals for national
cryptography policy.  But a proposal for action.  What is needed now is
a public debate, using and not sidestepping the full processes of
government, leading to a judicious resolution of pressing cryptography
policy issues and including, on some important points, legislative
action.  Only in this manner will the policy crisis come to a
satisfactory and stable resolution.


                                        Sincerely,


                                                /s/


                                        Conrad Burns
                                        U.S. Senator


-----------------------------------------------------------------------------
HOW TO RECEIVE CRYPTO-NEWS

To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com)
or send mail to majordomo at panix.com with "subscribe crypto-news" in the body
of the message.
-----------------------------------------------------------------------------
End crypto-news
=============================================================================







From tcmay at got.net  Sun Jun  2 14:10:40 1996
From: tcmay at got.net (Timothy C. May)
Date: Mon, 3 Jun 1996 05:10:40 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
Message-ID: <add71e4c06021004bdfb@[205.199.118.202]>


At 4:30 PM 6/2/96, Martin Minow wrote:
>>
>>One of the oldest tricks for running a stock up (or down) is
>>to put rumor teams on elevators in the financial district of
>>major cities.
>
>It would be more efficient to talk about the rumor on a cellular
>phone.  Probably make a nice sting scenario, too.

An interesting example, but I'm having a hard time figuring out who has
committed a crime, even by SEC rules.

Namely, are the people "talking up" a stock committing a crime? Even if the
SEC forbids this (under defined circumstances and for defined persons, as
most of us are not covered by any such laws), how can talking over a
"putatively secure" cell phone be construed as talking up a stock?

And, how can someone who acts on overheard information--as in the elevator
example Sandy cited--be charged with any crime? Unless they are "insiders,"
covered by SEC rules about trading, they are free to act on essentially
anything they hear. "He who hesitates to act on inside information is
lost."

(To elaborate on this: I was never classified as an "insider" during my
time at Intel, and I certainly bought and sold the stock based on what
products and news I knew was coming out or what rumors I'd heard. Only a
select group of executives and staff in the specific departments generating
earnings announcements, auditing, etc., were covered. And senior executives
are covered by various rules about trading stocks. And family members and
friends may be covered, if they learn of "inside" (in the SEC sense)
information. But ordinary people, even employees of a company, are not
considered to be "insiders" and hence are not covered by insider trading
laws.)

So, the only way I can imagine the cell phone case leading to an insider
trading charge is if the cell phone users _knew_ that the cell phones were
not secure, and _planned_ to have their conversations overheard. The people
doing the intercepting could be charged under one of the laws covering
unauthorized interception of cell phone conversations, but probably not for
insider trading.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From jimbell at pacifier.com  Sun Jun  2 14:14:10 1996
From: jimbell at pacifier.com (jim bell)
Date: Mon, 3 Jun 1996 05:14:10 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <199606021726.KAA29200@mail.pacifier.com>


At 07:45 PM 6/1/96 -0700, Timothy C. May wrote:
>At 1:59 AM 6/2/96, Duncan Frissell wrote:
>
>>Of course curfew laws only control the inarticulate and scruffy.  Well
>>dressed children (coat and tie for the boys dress or suit for the girls) who
>>can claim that they are out doing tons of protected things like work and
>>school and worship and political campaigning and "trying to save street
>>children for Jesus" will not be picked up.  They can also say things like
>
>This, by the way, is the main thing that concerns certain civil rights
>groups (including the Santa Cruz chapter of the ACLU). They say they'll be
>monitoring enforcement patterns to see if more "children of color" are
>picked up than their percentage in the population represents.

This, the curfew situation, is yet another of the reasons I'd favor "playing 
hardball" with the government.  I'm very much against discriminatory 
enforcement, but on the other hand I don't think my liberty should be 
dependent on getting an organization like the ACLU to look out for and 
complain against discrimination against me. 
 
I feel if a group of left-handed albinos think the police are being too hard 
on left-handed albinos, they shouldn't have to convince the ACLU of this, 
and should be entitled and able to fight back effectively and prevent what 
they view as abuse.  True, such a situation may occasionally lead to abuses, 
but I strongly expect that those abuses will be far fewer than the current 
system.

Jim Bell
jimbell at pacifier.com





From ira at panix.com  Sun Jun  2 14:38:43 1996
From: ira at panix.com (ira)
Date: Mon, 3 Jun 1996 05:38:43 +0800
Subject: (no subject)
Message-ID: <31A9718A.5DD8@panix.com>







From jimbell at pacifier.com  Sun Jun  2 15:06:57 1996
From: jimbell at pacifier.com (jim bell)
Date: Mon, 3 Jun 1996 06:06:57 +0800
Subject: Java Crypto API questions
Message-ID: <199606021828.LAA01244@mail.pacifier.com>


At 09:30 AM 6/2/96 -0700, Martin Minow wrote:
>>Today, CP's own Marianne Mueller was scheduled to give a talk at JavaOne on
>>the eagerly awaited (at least by this user) Java Crypto API.

>---- ---- ----
>Notes from the security birds of a feather session
>---- ---- ----
>
>-- Need multiple security managers: if any say no, reject the request.
>-- Servet, applet need different security managers.
>-- Problem with firewalls: client accesses server via firewall via
>   proxy servers. May not be able to open a URL directly.
>-- Java Commerce API coming for payment functions.
>-- Problem with foreign applet vendors: how can a non-US security
>   class vendor certify a class to be used (outside the US).
>   Currently, it must be imported and signed by Sun. But, then
>   it can't be exported without a Commerce Department license.
>   No (current) plans to establish a signing authority outside
>   of the U.S.

We've heard this assertion before.  Why not import the software, generate a 
detachable signature, and then export the signature for re-attachment overseas?

Surely export of signatures isn't controlled (even arguably) by ITAR.

Jim Bell
jimbell at pacifier.com





From mpd at netcom.com  Sun Jun  2 15:43:27 1996
From: mpd at netcom.com (Mike Duvos)
Date: Mon, 3 Jun 1996 06:43:27 +0800
Subject: Insider Trading and Inside Information
Message-ID: <199606021915.MAA26734@netcom14.netcom.com>


tcmay at got.net (Timothy C. May) writes:

 > And, how can someone who acts on overheard information--as
 > in the elevator example Sandy cited--be charged with any
 > crime? Unless they are "insiders," covered by SEC rules
 > about trading, they are free to act on essentially anything
 > they hear. "He who hesitates to act on inside information is
 > lost."

 > (To elaborate on this: I was never classified as an
 > "insider" during my time at Intel, and I certainly bought
 > and sold the stock based on what products and news I knew
 > was coming out or what rumors I'd heard. Only a select group
 > of executives and staff in the specific departments
 > generating earnings announcements, auditing, etc., were
 > covered. And senior executives are covered by various rules
 > about trading stocks. And family members and friends may be
 > covered, if they learn of "inside" (in the SEC sense)
 > information.

The SEC, in cooperation with the courts, has been gradually
shifting the definitions of "insider" and "inside information" to
more all-encompassing ones.

It used to be that an insider was an officer of the company, or
someone with a fiduciary relationship to the firm, such as a
auditor or investment banker with which the firm did business.
Inside information was also similarly limited to a narrow
collection of material subject to regulatory restrictions on its
disclosure.

Nowdays "inside information" has been expanded to include
anything that the general public is not privy to, and "insiders"
can be almost anyone as well.

Indeed, the current definitions can subject to criminal sanctions
low level employees trading their company's stock on the basis of
rumors, or newspaper columnists trading in anticipation of
reaction to their published speculations.  It's not even safe to
trade on what formerly would have been known as "hot tips" any
more, unless the average person in the street had a mechanism to
access the information.

The legal theory behind all this is that anyone, no matter who
they are, trading on any publicly unavailable information, no
matter what it is, might be perceived as profiting at the expense
of the zillions of ordinary investors, whose continued playing of
the Stock Lottery^H^H^H^H^H^H^H Market the govermment and big
business definitely want to encourage.  Not to mention the huge
public support for the prosecution of anyone who the public
thinks has "gotten away with something" that Joe Six-Pack didn't
have the opportunity to do, and made a few bucks in the process.

If this trend continues, I won't even be able to take an Intel
janitor to lunch, and trade the stock based on his impression
that Andy Grove looked particularly happy while having his office
cleaned, without risking an "insider trading violation" should
the stock go up.

A new and interesting manifestation of the "Surveilance State."

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     mpd at netcom.com     $    via Finger.                      $






From WlkngOwl at unix.asb.com  Sun Jun  2 16:52:50 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Mon, 3 Jun 1996 07:52:50 +0800
Subject: Ok, what about PGP (was: MD5 collisions)
Message-ID: <199606022112.RAA27954@unix.asb.com>


On 30 May 96 at 1:26, Chris Adams wrote:

> How about a NSA-stomper option that would use all-of-the-above? For the truly paranoid (or 
> owners of Pentium-Pro 200Mhz multi-processor machines

Chances are that if the algorithms alone aren't "NSA-stompers", an 
all-of-the-above option won't be.

> Also, what's the verdict on IDEA? Is there a switch yet that would allow straight RSA? 
> (with the obvious speed decrease...)

That would actually be less secure. RSA may be PGP's weakest link.

Rob.
 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From mirele at xmission.com  Sun Jun  2 17:23:06 1996
From: mirele at xmission.com (Deana Holmes)
Date: Mon, 3 Jun 1996 08:23:06 +0800
Subject: penet to be compromised again? More Scientology lawsuit crap
Message-ID: <199606022055.OAA17534@xmission.xmission.com>


I just received some information on IRC channel #scientology that 
Julf Helsinghuis is being sued by $cientology *yet again* for a name.

Apparently this has to do with the deposition request to Homer Wilson 
Smith (lightlink.com).  Scamizdat #3 was posted through lightlink.com 
and the $cientologists have wanted for a long time to figure out who 
did it.  (Which is why they sued Grady Ward.)  Homer, in response to 
the deposition request, consulted his logs, and said that the 
original post came from penet.fi.  So $cientology has apparently gone 
to the Finns again to ask that Julf be forced to give up the name.

I'm appending a copy of the IRC log, as I'm too lazy to edit it down 
to particulars.  It includes the name of the police officer involved 
(Kaj Malmberg) as well as a Finnish newsgroup and article id for the 
whole story.  If someone knows Finnish and can give a rough 
translation, it would be terribly appreciated by a lot of people.

<enclosed IRC transcript>

<Ignatius> hi guys... do you have the latest news on Julf 
   Helsingius' case?
> Ig: what do you mean, latest news?
<Sherilyn> The julf case?
* Sherilyn didn;t know there _was_ a julf case...
<Ignatius> ok... copyright offences are crimes under Finnish 
   law, not torts. 
<Ignatius> Kaj Malmberg, the Finnish police officer who handles 
   the investigation of the copyrighted material through 
   penet.fi, posted an article to a domestic newsgroup today. 
<Sherilyn> Do you have the message-id and group name?
<Ignatius> the scienos have filed a motion at a local court in 
   Helsinki to force Julf Helsingius to give out the name of 
   the poster. 
<Ignatius> sherilyn, are you good at Finnish?
<Sherilyn> ig: lol!
<skaplin> Who posted what through penet??
<Ignatius> the hearing is scheduled for the beginning of next 
   week... perhaps already tomorrow. 
<Sherilyn> So was penet the server before lightlink in the 
   scamizdat case?
<Sherilyn> Homer gave them the name of the prior server, or was 
   going to 
*** skaplin changes topic to "Penet under attack...Again!"
<Sherilyn> Well this needs to be put out loud on groups where 
   people use penet
<skaplin> Ignatus: How good are you at translating?
<Sherilyn> Last attack on penet got the scientologists a very 
   bad rep
> Ig: We need that post.
> IN ENGLISH
> ASAP!
> even if it's a lousy translation.
<Sherilyn> This cop guy speaks English
<Sherilyn> Didn't he post in English to a.r.s.?
> Sheri: he may not want to post it on a.r.s
<Sherilyn> It's true, skap
<Ignatius> i don't know more than what I already mentioned. The 
   police officer didn't even mention Scientology; he just 
   mentioned that he was investigating a copyright offence. 
<Sherilyn> She would make a lovely domina
> sheri: you should see what I'm reading now :)
<skaplin> We're sure penet is under attack for a name though...
<Sherilyn> Bloody hell fire!
<Sherilyn> I have 6440 posts downloading!
<Ignatius> i'm writing an article to post to the ng:s, but it's 
   obvious we don't have all the bits of the puzzle yet. 
<skaplin> Want some kippers with your spam sheri?? :)
<skaplin> Ignatus: What newsgroup was it in?
> ig: please post it asap.
> also, send it to rnewman at cybercom.net.
<Ignatius> skap, sfnet.keskustelu.laki; <4os5bu$flp at idefix.eunet.fi> 
<Ignatius> the police officer, Kaj Malmberg, is at 
   kaj.malmberg at helsinki.poliisi.fi 

<end of transcript>

Deana Holmes
mirele at xmission.com






From alanh at infi.net  Sun Jun  2 17:23:21 1996
From: alanh at infi.net (Alan Horowitz)
Date: Mon, 3 Jun 1996 08:23:21 +0800
Subject: [Off-Topic] "Curfews"
In-Reply-To: <199606021726.KAA29200@mail.pacifier.com>
Message-ID: <Pine.SV4.3.91.960602171909.881E-100000@larry.infi.net>


I'm more concerned about the other side of the coin.

The next time there's street riots because a jury decided to think for 
itself, will the ACLU be issuing quota guidelines that mandate that all 
black arrestees above (percentage-of-population) be given a 
"get-out-of-jail-free-for-pulling-a-bystanding-trucker-out-of-his-cab-and 
slamming-his-head-with-bricks" card?





From minow at apple.com  Sun Jun  2 17:26:22 1996
From: minow at apple.com (Martin Minow)
Date: Mon, 3 Jun 1996 08:26:22 +0800
Subject: Java Crypto API questions
Message-ID: <v02140b04add7b4e6d800@[17.128.203.227]>


Jim Bell writes:
>>-- Problem with foreign applet vendors: how can a non-US security
>>   class vendor certify a class to be used (outside the US).
>>   Currently, it must be imported and signed by Sun. But, then
>>   it can't be exported without a Commerce Department license.
>>   No (current) plans to establish a signing authority outside
>>   of the U.S.
>
>We've heard this assertion before.  Why not import the software, generate a
>detachable signature, and then export the signature for re-attachment overseas?
>

I suspect (but don't have any direct knowledge) that strong crypto
classes are distributed after encryption by Sun's private key. The
corresponding public key is enbedded in the Java Class Loader and/or
virtual machine (or the security framework class -- I'm only speculating
here).

This means that "rogue" encryptors can't work under Sun's security
manager as they will be rejected as "unloadable"

Martin Minow
minow at apple.com









From ichudov at algebra.com  Sun Jun  2 18:26:23 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Mon, 3 Jun 1996 09:26:23 +0800
Subject: Fate of Ecash if RSA is cracked?
Message-ID: <199606022242.RAA19983@manifold.algebra.com>


Hello,

After reading Comm. of ACM and Schneier's book about ecash,
a question arose: what if the underlying public key cryptographic
scheme gets broken somehow? Suppose, for example, that someone
discovers an ultra-fast factoring algorithm or something like that.

What would happen with all ecash that's been issued? Of course
criminals would be able to forge large amounts of authentic-looking
ecash, so banks should not be honoring requests to convert e-cash into
real cash.

I apologize in advance is this question is silly, and will appreciate your
corrections.

	- Igor.





From jya at pipeline.com  Sun Jun  2 18:50:24 1996
From: jya at pipeline.com (John Young)
Date: Mon, 3 Jun 1996 09:50:24 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <199606022238.WAA16332@pipe2.t1.usa.pipeline.com>


This is the article Winn Schwartau cited to last night: 
 
---------- 
 
 
   The Sunday Times (London), June 2, 1996, pp. 1, 24. 
 
 
   City surrenders to L400m gangs [Insight column] 
 
 
   City of London financial institutions have paid huge sums 
   to international gangs of sophisticated "cyber terrorists" 
   who have amassed up to L400m worldwide by threatening to 
   wipe out computer systems. 
 
   Banks, broking firms and investment houses in America have 
   also secretly paid ransom to prevent costly computer 
   meltdown and a collapse in confidence among their 
   customers, according to sources in Whitehall and 
   Washington. 
 
   An Insight investigation has established that British and 
   American agencies are examining more than 40 "attacks" on 
   financial institutions in London and New York since 1993. 
 
   Victims have paid up to L13m a time after the blackmailers 
   demonstrated their ability to bnng trading to a halt using 
   advanced "information warfare" techniques learnt from the 
   military. 
 
   According to the American National Security Agency (NSA), 
   they have penetrated computer systems using "logic bombs" 
   (coded devices that can be remotely detonated), 
   electromagnetic pulses and "high emission radio frequency 
   guns", which blow a devastating electronic "wind" through 
   a computer system. 
 
   They have also left encrypted threats at the highest 
   security levels, reading: "Now do you believe we can 
   destroy your computers?" 
 
   The authorities have been unable to stem the attacks, which 
   are thought to onginate from the United States. In most 
   cases, victim banks have failed to notify the police. "They 
   have given in to blackmail rather than risk a collapse in 
   confidence in their security systems," said a security 
   director at one blue-chip merchant bank in the City. 
 
   A senior detective in the City of London police said: "We 
   are aware of the extortion methods, but the banking 
   community has ways of dealing with it and rarely reports to 
   the police." 
 
   European and American police forces have set up special 
   units to tackle the cyber criminals, who, Ministry of 
   Defence sources believe, have netted between L200m and 
   L400m globally over the past three years. But law 
   enforcement agencies complain that senior financiers have 
   closed ranks and are hindering inquiries. 
 
   Experts in the field of information warfare met in Brussels 
   last month to discuss defensive measures. Representatives 
   included Captain Patrick Tyrrell, assistant director of 
   computer information strategy at the Ministry of Defence; 
   General James McCarthy, professor of national security at 
   the US Air Force Academy; General Jean Pichot-Duclos, 
   director of the economic intelligence department of the 
   French Defence Council, and senior figures from the 
   civilian computer industries. 
 
   A separate closed meeting involving representatives from 
   Whitehall and the intelligence community was held to 
   analyse the 40 attacks on British and American financial 
   centres since 1993. A further secret seminar took place in 
   Washington this weekend. 
 
   Kroll Associates, the international investigating firm, 
   confirmed last week that it had acted for financial 
   institutions that have been blackmailed. "One of the 
   problems we face is that the potential embarrassment from 
   loss of face is very senous," said a spokesman in New York. 
   Kroll had evidence that firms in London and New York had 
   been targeted. "The problem for law enforcement is that the 
   crime is carried out globally, but law enforcement stops at 
   the frontier," he said. 
 
   Yesterday a Bank of England spokesman acknowleged the 
   threat from the extortionists: "We are aware of this. It 
   does exist. It is extortion and fraud." But the spokesman 
   also insisted: "It is not the biggest issue in the banking 
   market." 
 
   Scotland Yard is now taking part in a Europe-wide 
   initiative to catch the cyber criminals and has appointed 
   a senior detective from its computer crime unit to take 
   part in an operation codenamed Lathe Gambit. Such is the 
   secrecy that few details about the inquiry have emerged. 
 
   In America, the FBI has set up three separate units to 
   investigate computer extortion. 
 
   The NSA believes there are four cyber gangs and has 
   evidence that at least one is based in Russia. The agency 
   is now examining four examples of blackmail said to have 
   occurred in London: 
 
   + January 6, 1993: Trading halted at a broking house after 
   blackmail threat and computer crash. Ransom of L10m paid to 
   account in Zurich. 
 
   + January 14, 1993: a blue-chip bank paid L12.5m after 
   blackmail threats. 
 
   + January 29, 1993: a broking house paid L10m in ransom 
   after similar threats. 
 
   + March 17, 1995: a defence firm paid L10m in ransom. 
 
   In all four incidents, the gangs made threats to senior 
   directors and demonstrated that they had the capacity to 
   crash a computer system. Each victim conceded to the 
   blackmailers' demands within hours and tranferred the money 
   to offshore bank accounts, from which it was removed by the 
   gangs within minutes. 
 
   The techniques have varied. In London, criminals posing as 
   marketing firms have gained detailed knowledge of a 
   target's system by interviewing the heads of information 
   technology departments. In some cases, they have even 
   issued questionnaires to unsuspecting officials. Armed with 
   this information, they have been able to breach security 
   and leave encrypted messages warning of their capability. 
 
   The gangs are believed to have gained expertise in 
   information warfare techniques from the American military, 
   which is developing "weapons" that can disable or destroy 
   computer hardware. Some are also known to have infiltrated 
   banks simply by placing saboteurs on their payroll as 
   temporary staff. 
 
   Little is yet known about the identities of the gangs but, 
   according to the NSA, America is the main source of the 
   attacks. It believes that at least one other group 
   originates from Russia and has followed the movement of 
   money to the former Soviet states. 
 
   A spokesman for the Metropoiitan poiice said: "There is 
   potential for extortion from those purporting to know how 
   to damage computer systems. 
 
   "The computer crime unit liaises where necessary with its 
   Euro counterparts to discuss cross-frontier crimes." 
 
   One merchant bank director said yesterday: "You will never 
   get a financial institution to admit it has an extortion 
   policy, let alone that it has paid money to blackmailers." 
 
   ----- 
 
   Additional reporting: Peter Warren 
 
   [End] 
 
 
 
 
 
 





From sandfort at crl.com  Sun Jun  2 19:05:12 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Mon, 3 Jun 1996 10:05:12 +0800
Subject: [Off-Topic] "Curfews"
In-Reply-To: <199606020741.DAA20077@unix.asb.com>
Message-ID: <Pine.SUN.3.91.960602161127.4808B-100000@crl9.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,
	
On Sun, 2 Jun 1996, Deranged Mutant wrote:

> ....which dates back to laws that said women and children were
> mens' possessions.  Very archaic.

I've heard this claim for years.  While it may be true, I don't
recall anything in my legal training that would support it with 
respect to Anglo-American jurisprudence.  Can anyone provide a
citation (an original source, please, not some radical feminist
revisionist writings) that sheds light on this curious belief?


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~








From an633169 at anon.penet.fi  Sun Jun  2 19:12:38 1996
From: an633169 at anon.penet.fi (an633169 at anon.penet.fi)
Date: Mon, 3 Jun 1996 10:12:38 +0800
Subject: No subject
Message-ID: <9606022252.AA01540@anon.penet.fi>


replying to ping
--****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION***
Your e-mail reply to this message WILL be *automatically* ANONYMIZED.
Please, report inappropriate use to                abuse at anon.penet.fi
For information (incl. non-anon reply) write to    help at anon.penet.fi
If you have any problems, address them to          admin at anon.penet.fi





From aba at dcs.ex.ac.uk  Sun Jun  2 20:45:21 1996
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Mon, 3 Jun 1996 11:45:21 +0800
Subject: opinions on book "The Truth Machine"
In-Reply-To: <add5bca103021004314e@[205.199.118.202]>
Message-ID: <199606030014.BAA00330@server.test.net>



Tim May <tcmay at got.net> wrote:
> At 11:53 AM 6/1/96, Adam Back wrote:
> >Tim May <tcmay at got.net> wrote:
> [...] Maybe the "make.money.fast" description was a poor one...what I meant
> to imply is that the book is being advertised widely (I've seen half a
> dozen announcements of it), 

Ah .. I misunderstood, the ad is being spammed.  We have a truly awful
news feed which gets around 2 weeks of lag, at time of posting that
was the only one I'd seen.

> >The writing style wasn't great, and I'd agree there were plenty of
> >flaws, but what I was interested in was cypherpunks opinions on the
> >technology, rather than the quality of the book, or making money for
> 
> The main technology, "the truth machine," is so bogus as to be boring.

um, ok.  The presentation of it in the book was sketchy, and many of
his conclusions I felt shaky, but here's a few entries I think
plausible for lie detectors:

- travelling by car in the US a few years ago at a border check point
between two US states the border gaurds asked if anyone in the car was
not US, they made a point of looking you in the eye while questioning
you.  In conversation later it was suggested that they are trained to
observe and notice people who look nervous for some reason.  Seems
that if a technology was available to improve the reliability of quick
spot check questions they wouldn't have any compunction using it.

- drink driving breath tests (a real lie detector) to check if you
have been drinking.  No longer content with asking if you've been
drinking they ask, and then breathalize you.  In the UK it is an
offence to refuse a breath test if stopped whilst driving.

- some automation for `anything to declare?' questions at customs, a
lie detector, say put your hand on here, then `anything to declare?'

Just trying to think up some plausible examples of where it might one
day be legally required to take a lie detector test in the course of
your normal business.

> >- cheap video used by everyone to record their own lives
> 
> A better treatment of this is in David Brin's "Earth."

ta, will take a look.

> However, what you say below about being required to explain your movements
> to cops who stop you on the highway and then present "papers" to them

lest that was misleading: the documents required for presentation at
police station are insurance certificate, and MOT document
(roadworthiness certificate (another infringement of liberty in my
view, you are legally required to keep your vehicles in A1 condition,
and the strictness of the tests keeps creeping up)).  Explaining your
movements as I say I'm unsure of the legal position, but they ask you
anyway.

> !!!
> 
> Glad I don't live in Britain.

Well, we don't have curfews yet, but they're getting keen on security
video cameras lately, the university has a few even, on top of
buildings, the steerable variety, and with what I presume are IR spots
mounted on them.

Adam





From llurch at networking.stanford.edu  Sun Jun  2 20:55:42 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Mon, 3 Jun 1996 11:55:42 +0800
Subject: WSJ on "IRS-bashing"
In-Reply-To: <199606012148.OAA24297@dns1.noc.best.net>
Message-ID: <Pine.GUL.3.93.960602175255.21200B-100000@Networking.Stanford.EDU>


On Sat, 1 Jun 1996 jamesd at echeque.com wrote:

> At 04:01 PM 5/29/96 -0700, Rich Graves, who lives in a parallel 
> universe where political correctness is no threat to liberty, 
> and the FBI and BATF no threat to law abiding people wrote:
[...]
> But Rich Graves does not regard that sort of thing as any violation on
> freedom of speech.

One of these days I must meet this person that shares my name. I've never
seen him or her post to cypherpunks.

Duncan Frissell's message had some good points, but I get the odd sense
that he thought he was disagreeing with me.

Taken to private email again.

-rich






From adamsc at io-online.com  Sun Jun  2 21:28:20 1996
From: adamsc at io-online.com (Chris Adams)
Date: Mon, 3 Jun 1996 12:28:20 +0800
Subject: NSCP, PRZ Hit NRC Crypto Rec
Message-ID: <199606030145.SAA16749@toad.com>


>   The report noted that the FBI has argued for years that its 
>   law-enforcement efforts would be hampered if drug cartels 
>   and other organized criminals began using codes that 
>   couldn't be deciphered. Courtordered wiretaps, a major tool 
>   used to break organized-crime cases, could become useless, 
>   the FBI has contended. 

I've wondered the same thing about gun control efforts. Who are they worried about? 
Criminals. By definition, what is a criminal? One who breaks the laws.  Are they seriously 
thinking that a) criminals might stop doing things because they are illegal? (For shame - I 
was going to use PGP to protect my child pornography sources. Good thing I found out it was 
illegal before I did that!) and b) criminals would not be able to buy programmers/etc to 
secure *their* privacy if they felt it was needed?
/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From dlv at bwalk.dm.com  Sun Jun  2 21:51:40 1996
From: dlv at bwalk.dm.com (Dr. Dimitri Vulis)
Date: Mon, 3 Jun 1996 12:51:40 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <199606022242.RAA19983@manifold.algebra.com>
Message-ID: <N9BXoD32w165w@bwalk.dm.com>


ichudov at algebra.com (Igor Chudov @ home) writes:
> scheme gets broken somehow? Suppose, for example, that someone
> discovers an ultra-fast factoring algorithm or something like that.

This'll happen, probably sooner than later.

---

Dr. Dimitri Vulis
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From jwilk at iglou.com  Sun Jun  2 22:03:30 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Mon, 3 Jun 1996 13:03:30 +0800
Subject: [Off-Topic] "Curfews"
Message-ID: <m0uQOnZ-000388C@mail.iglou.com>


At 05:22 PM 6/2/96 -0400, Alan Horowitz wrote:
>I'm more concerned about the other side of the coin.
>
>The next time there's street riots because a jury decided to think for 
>itself, will the ACLU be issuing quota guidelines that mandate that all 
>black arrestees above (percentage-of-population) be given a 
>"get-out-of-jail-free-for-pulling-a-bystanding-trucker-out-of-his-cab-and 
>slamming-his-head-with-bricks" card?
>
>

Cool where can I get one of those?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage     Gaa- 3.69
<jwilk at iglou.com>         Record- 2-4-4
Age- 13                   Final Standings- 2nd Place (Beat in Championship)
President & Founder:                   
Revolution Software       "I have the fastest glove in the east!"
Profanity Software        "Hackers never stop hacking they just get caught"
VSoft

My life- Rarely eat or sleep, Hack til' 7:00a, goto school, play goalie
til' 5:00p, hack til' 7:00a
Hank Aaron- d:-)!-<   Pope- +<:-)   Santa Claus- *<:-) The Unabrower |:-)

Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From jya at pipeline.com  Sun Jun  2 22:12:37 1996
From: jya at pipeline.com (John Young)
Date: Mon, 3 Jun 1996 13:12:37 +0800
Subject: NRC Session Hiss
Message-ID: <199606030150.BAA27932@pipe2.t1.usa.pipeline.com>


   During the Q&A of the NRC public session, it was asked why 
   56-bit DES was selected as the standard of export over 
   other widely distributed programs such as PGP. 
 
   The panelists seemed to me uneasy in answering this. 
   Primarily their view was that DES was "ubquitious," well- 
   known and tested by use. 
 
   However, when pressed by later questioners on this topic, 
   they expanded their view: that if another, stronger, 
   program became "ubiquitous" -- in wide use -- they would 
   support it as the standard of export. When it was pointed 
   out that PGP now fit this definition, the panel merely 
   repeated the statement about ubiquity without specifically 
   affirming or denying the PGP claim. Their poker faces 
   seemed uniformly in place to dampen a potential 
   inflammatory topic. 
 
   Perhaps other attendees will amplify this odd demeanor, but 
   it seems to me that the panel was attempting to avoid 
   commenting one way or the other on PGP's worldwide ubiquity 
   for unstated reasons. 
 
   I wonder if this was a nudge to the audience that the 
   informal spread of unapproved encryption is the best way to 
   establish its ubiquity and thereby to set a new standard 
   for export, sort of under the noses of the authorities -- 
   as if PGP was exemplary. 
 
   Recall that this fits the Clinton administration's way of 
   getting around the Croatian arms embargo -- the "no 
   position" position of sidestepping legality. 
 
   Also, I wonder if the panel wants avoid an open conflict 
   with the administration, the LEAs and the security agencies 
   about PGP. (Or do they know something about PGP that we 
   don't know, or have been led to think they do?) 
 
   Peter Neumann had pointed out earlier that crypto was going 
   to be ubiquitous, and fairly soon, no matter what. He noted 
   that it is the NRC's recommendation that LEAs take the 
   "long-term, pro-active" view about this and get on with 
   developing other technologies, and training personnel in 
   them, to fight computer crime -- like traffic analysis, 
   packet trace, etc. -- and to accept that prohibiting and 
   cracking crypto is not effective. (This may have been 
   diversionary, but he seemed sincere.) 
 
   Perhaps the panel is agreeing the crypto genie is out of 
   the bottle, and are advising the authorities to recognize 
   that stronger and stronger crypto is going to become 
   ubiquitous, and it's time to move on to other, presumably 
   less ubiquitious, cyber-crime fighting technolgies. 
 
   Perhaps the committee was briefed on these technolgies, or 
   maybe some members are even developing them -- Mr. Neumann, 
   for example, in conjunction with Ms. Denning, et al. 
 
   Those who plan to attend the June 6 session might want to 
   pursue the "no position" position about PGP's ubiquity, and 
   why. Diversionary sop, say, to cover the promotion of non- 
   crypto invasion of privacy. 
 
   Further, it would be helpful to learn more about what the 
   the committee members were told about "long-term" cyber- 
   surveillance technologies in the pipeline. 
 
   What bothered me more than anything else about the session 
   was that individual privacy got such short shrift by 
   panelists and by the audience.  While there was a bit of 
   discussion on personal privacy protection, government and 
   business, and their mutual back-scratching, seemed to the 
   the primary focus. 
 
   Pretty Lousy Privacy appears to be in the works, judging 
   from what was not disclosed in the session (and in the 
   report) about two 800-pounders working in concert at 
   citizen data gathering, mining, selling, controlling, 
   dominating -- at the expense of individual privacy, and, 
   shout it, liberty. 
 
   Peter Neumann got to me when he described the "downside" of 
   anonymity, encryption and security: how can we know who are 
   the criminals if we don't for sure who is who and know for 
   sure who is doing what? Not a single panelist disagreed 
   with his statement about this, but then I heard only a few 
   snorts from the criminal-fraught-fed audience. 
 
   I kept mum. Jesus, who knows who was recording every 
   titter and hiss -- besides anonymous beside me and me. 
 
 
 
 
 
 
 





From tcmay at got.net  Sun Jun  2 23:18:39 1996
From: tcmay at got.net (Timothy C. May)
Date: Mon, 3 Jun 1996 14:18:39 +0800
Subject: opinions on book "The Truth Machine"
Message-ID: <add7a6c80002100492f6@[205.199.118.202]>


At 12:14 AM 6/3/96, Adam Back wrote:

>Well, we don't have curfews yet, but they're getting keen on security
>video cameras lately, the university has a few even, on top of
>buildings, the steerable variety, and with what I presume are IR spots
>mounted on them.

Today's newspaper (SJ Mercury News) carried a long article about
increasingly ubiquitous video surveillance cameras, and singled out the
U.K. as a place that is leading. Apparently even small villages have 50 or
more cameras scattered around...men have been arrested for urinating in
bushes outside pubs, caught by the infrared pickups (I hadn't thought about
the cameras being IR, but this makes sense, as a large fraction of street
crimes take place in dark or semidark areas).

The article claimed that the cameras and microphones are the latest in
surveillance technology, provided by the U.K. defense establishment.

Privacy advocates gave comments--they were predictably quite worried.

The links with crypto policy are of course apparent.

--Winston Smith


Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From mattt at microsoft.com  Sun Jun  2 23:32:57 1996
From: mattt at microsoft.com (Matt Thomlinson)
Date: Mon, 3 Jun 1996 14:32:57 +0800
Subject: Fate of Ecash if RSA is cracked?
Message-ID: <c=US%a=_%p=msft%l=RED-77-MSG-960603034514Z-7737@tide21.microsoft.com>


but probably not for decent RSA key lengths -- more probably the hashing
algorithm used will fall, with much the same consequences.

mattt

>----------
>From: 	dlv at bwalk.dm.com[SMTP:dlv at bwalk.dm.com]
>Sent: 	Sunday, June 02, 1996 6:49 PM
>To: 	cypherpunks at toad.com
>Subject: 	Re: Fate of Ecash if RSA is cracked?
>
>ichudov at algebra.com (Igor Chudov @ home) writes:
>> scheme gets broken somehow? Suppose, for example, that someone
>> discovers an ultra-fast factoring algorithm or something like that.
>
>This'll happen, probably sooner than later.
>
>---
>
>Dr. Dimitri Vulis
>Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013,
>14.4Kbps
>





From MELODYJAMES at delphi.com  Sun Jun  2 23:49:54 1996
From: MELODYJAMES at delphi.com (MELODYJAMES at delphi.com)
Date: Mon, 3 Jun 1996 14:49:54 +0800
Subject: Reminder on PBS Show
Message-ID: <01I5G8VNPC768WWQT1@delphi.com>


CYBER SECRETS (This week on Life on the Internet)

Law enforcement agencies say that in the wrong hands, email encryption
software called PGP (Pretty Good Privacy) threatens the public good. Check
out the online transcript, hyperlinks and live video stream of this week's
feature "Cyber Secrets" on the Life on the Internet web site.

      <http://www.pbs.org/internet/>

The program *Life on the Internet* is broadcast on Saturday mornings
in some areas.  Check your listings.





From tcmay at got.net  Sun Jun  2 23:56:28 1996
From: tcmay at got.net (Timothy C. May)
Date: Mon, 3 Jun 1996 14:56:28 +0800
Subject: "Insider Non-Trading" (Re: Insider Trading and Inside Information)
Message-ID: <add7aa1b010210045ad9@[205.199.118.202]>


At 7:15 PM 6/2/96, Mike Duvos wrote:

>The SEC, in cooperation with the courts, has been gradually
>shifting the definitions of "insider" and "inside information" to
>more all-encompassing ones.
...
>Nowdays "inside information" has been expanded to include
>anything that the general public is not privy to, and "insiders"
>can be almost anyone as well.
...

Indeed, the recent changes to U.S. Code 18503-666, have been dubbed the
"Insider Non-Trading Law."

What, you may ask, is "insider non-trading"?

Just as inside information may affect decisions to engage in a stock trade,
so too can insider information cause a decision _not_ to engage in a stock
trade!

Imagine that Trader Joe was planning to sell Security Dynamics short.
Perhaps with a direct short sale, or purchase of puts, or other variants.
However, he learns from his golfing partner, Jim Bidzos, that RSA Data is
about to be sold to SD for $250 million. Returning from his golf game, he
cancels his short plans. Voila, "insider non-trading."

The SEC tumbled to this some time ago, and now demands that all those who
are insiders, or who are married to insiders, or who are golfing buddies of
insiders register their trading intentions 90 days in advance of any
transaction. (This will increase to 120 days in 1997, and 180 days the
following year.)

This form of "intention escrow" ensures that insider information cannot be
used to cancel trades which were planned and then not pursued.

Key escrow, signature escrow, identity escrow, position escrow, and, now,
intention escrow. Welcome to the Escrow Society.

--Tim May

(P.S. Stu Brownstein, a Bay Area friend of mine, came up with this "insider
non-trading" joke several years ago. He once thought about writing a letter
to the "NYT" pointing out how insider trading laws must also imply insider
non-trading laws, but a Washington friend of his, he claims, told him not
to. "It may give the SEC ideas," he said.)




Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From shamrock at netcom.com  Mon Jun  3 00:09:54 1996
From: shamrock at netcom.com (Lucky Green)
Date: Mon, 3 Jun 1996 15:09:54 +0800
Subject: NRC Session Hiss
In-Reply-To: <199606030150.BAA27932@pipe2.t1.usa.pipeline.com>
Message-ID: <Pine.3.89.9606022140.A1546-0100000@netcom13>





On Mon, 3 Jun 1996, John Young wrote:

>    However, when pressed by later questioners on this topic, 
>    they expanded their view: that if another, stronger, 
>    program became "ubiquitous" -- in wide use -- they would 
>    support it as the standard of export. When it was pointed 
>    out that PGP now fit this definition, the panel merely 
>    repeated the statement about ubiquity without specifically 
>    affirming or denying the PGP claim. Their poker faces 
>    seemed uniformly in place to dampen a potential 
>    inflammatory topic. 

That PGP is ubiquitous is subject to discussion. PGP is widely available, 
but that doesn't mean that it is widely used. What percentage of email is 
PGP encrypted? Less than half a percent?

PGP was a failure in the mass market, regardless how popular it may be
with some subscribers of this list. The email encryption method that *will*
be ubiquitous and that will cause PGP to be used only by a relatively
small fringe is S/MIME. Within a few months, S/MIME will be on the
desktops of some 20 million people. It, not PGP is the future standard.

Of course S/MIME will default to 40 bit RC-4 and carry the signatures 
outside the encryption envelope. There is little doubt in my mind that 
the pannel will find it much easier to support than PGP.







From gregmi at galileo.mis.net  Mon Jun  3 00:11:21 1996
From: gregmi at galileo.mis.net (Greg Miller)
Date: Mon, 3 Jun 1996 15:11:21 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <199606022242.RAA19983@manifold.algebra.com>
Message-ID: <31b270f2.123131630@pop.mis.net>


On Sun, 2 Jun 1996 17:42:49 -0500 (CDT), you wrote:

>What would happen with all ecash that's been issued? Of course
>criminals would be able to forge large amounts of authentic-looking
>ecash, so banks should not be honoring requests to convert e-cash into
>real cash.

	As I understand it, ecash shouldn't be withdrawn until shortly before it
is spent.  If the RSA algorithm is broken, then then banks could refuse the
withdrawal (and depositing) of money as ecash.  The remainder of the money in
each users' account would have to be withdrawn through conventional methods.

	Of course all the outstanding (between withdrawl and deposit) ecash
could be a problem.
"Randomness is in the eye of the beholder" --Numerical Recipes
gregmi at mis.net (Greg Miller)
http://grendel.ius.indiana.edu/~gmiller/





From ichudov at algebra.com  Mon Jun  3 01:05:37 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Mon, 3 Jun 1996 16:05:37 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <N9BXoD32w165w@bwalk.dm.com>
Message-ID: <199606030447.XAA22063@manifold.algebra.com>


Dr. Dimitri Vulis wrote:
> 
> ichudov at algebra.com (Igor Chudov @ home) writes:
> > scheme gets broken somehow? Suppose, for example, that someone
> > discovers an ultra-fast factoring algorithm or something like that.
> 
> This'll happen, probably sooner than later.
> 

Hm, how about using two public-key algorithms simultaneously (ie,
providing signatures made using two algorithms with each coins)?  This
way, if one algorithm gets broken, there would be supposedly enough time
to make a transition to another method or at least honor the issued ecash.

Just curious.

Another question: what happens to the ecash issued by a bank if it's
secret keys get stolen?

Thanks,

	- Igor.





From remailer at 2005.bart.nl  Mon Jun  3 01:16:17 1996
From: remailer at 2005.bart.nl (Senator Exon)
Date: Mon, 3 Jun 1996 16:16:17 +0800
Subject: Something that just crossed my mind. Sorry.
Message-ID: <199606030519.HAA08335@spoof.bart.nl>



At 10:01 AM 5/31/96 -0700, Sandy wrote:
>At 10:35 PM 5/30/96 -0500, snow wrote:
>
>>It is my position (until proven wrong--please) that larger business DON'T
>>want anonymity. They _want_ to be able to track purchases and use of their
>>product for several reasons. 

Let me first claim that I am an employee of a "larger business."  Not that unless someone tracks me through the remailers is there any proof of that, but accept for now that it's not outside of the realm of possibility.

I wish I could prove you wrong.  I can inform you that you are correct, actually.  There are large retail companies that track sales data on credit card account numbers and cardholder names in direct violation of any contract you may have with American Express (and possibly Visa and others, I have not seen those contracts).  The data they capture is pretty impressive.  I'm sure most of you probably get a direct mailing or two from them every now and then, based on your shopping habits.

>Two quick answers:
>
>1)      What big business wants and what it would be
>        willing to accept in order to make sales, are
>        two different things.  While demographic data
>        are nice, an more robust economy full of big
>        spenders is better.

And demographic data on big spenders is worth more than anonymous cash from people who buy packages of gum.  Much more.

The best part of the equation is that the big spenders are giving up the demographic information for free, every time they hand over a credit card.  You even filter out the gum-buyers because gum-buyers use cash, which you don't track.

An economy of big spenders is worthless unless they're in your store.  The cards give evidence of who spends in your store, so you target your advertisements accordingly.

>2)      Big businesses are made up of individuals.
>        Most individuals would still prefer to have 
>        their own privacy preserved even if they would 
>        prefer less privacy for others.  

All it takes is one well-positioned executive who values profits more than his own privacy to say "Capture this personal data" and that data gets captured, regardless of who gets fired complaining about it.  Trust me.  And I value my job more than I value your privacy, which is why this is going out through a remailer.

I also shop only with cash, here and elsewhere.  Double-blinded e-cash will be the only way to go, if it ever is the way to go.






From tcmay at got.net  Mon Jun  3 01:20:13 1996
From: tcmay at got.net (Timothy C. May)
Date: Mon, 3 Jun 1996 16:20:13 +0800
Subject: opinions on book "The Truth Machine"
Message-ID: <add7c25b030210040f9c@[205.199.118.202]>


At 12:14 AM 6/3/96, Adam Back wrote:
>Tim May <tcmay at got.net> wrote:
>> At 11:53 AM 6/1/96, Adam Back wrote:
>> >Tim May <tcmay at got.net> wrote:
>> [...] Maybe the "make.money.fast" description was a poor one...what I meant
>> to imply is that the book is being advertised widely (I've seen half a
>> dozen announcements of it),
>
>Ah .. I misunderstood, the ad is being spammed.  We have a truly awful
>news feed which gets around 2 weeks of lag, at time of posting that
>was the only one I'd seen.

And I thought my newsfeed was bad!

Do an Alta Vista (or DejaNews, etc.) search of "The Truth Machine" and
you'll find about 300 articles on Usenet about it.

However, about 95% of them are from jhalpe at ix.netcom.com, the author of
this media event novel or from ivypress at ix.netcom.com, his vanity
publisher.

(Actually, maybe Ivy Press is not a vanity publisher. Maybe Ivy Press is
what might me dubbed a "Cantwell and Siegel publisher.")

And the groups this was posted to....mama mia! This is why I was irked that
this spam was leaking into the Cypherpunks group as well.

But no harm done, and it demonstrates another example of how the Net is
being used for such advertising. Imminent death of the Net predicted--news
at 11.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From WlkngOwl at unix.asb.com  Mon Jun  3 02:48:57 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Mon, 3 Jun 1996 17:48:57 +0800
Subject: The Elevator Problem
Message-ID: <199606030719.DAA26321@unix.asb.com>



This may be old hat, but an earlier post (around the time the Kocher 
RSA-timing attack came out) to the list asked about the "Elevator 
Problem", where two parties who think they share the same secret want 
to confirm it on an open channel.  I came up with an idea for a 
protocol but never got around to posting it, and dropped off the list 
briefly... so pardon me if this is already touched upon.

Alice and Bob are in a crowded place and want to confirm they share a 
secret.

Each picks a couple of random numbers, b and i.  The secret P is 
hashed i times, something like:

  H_0(P) = H(P,0)               [H can be something like SHA-1...]
  H_i(P) = H(H_i-1(P), i)

They then tell each other bit b of H_i(P).

This is repeated a number of times to make random guessing very 
unlikely.

If all bits match, they agree that they share the secret (we assume 
neither wants to lie but discover if the other knows the secret).

Since this is a mutual protocol, an eavesdropper who listens in 
shouldn't be able to spoof Alice or Bob.  Or maybe Alice and Bob can 
agree never to reuse combinations of b and i anyway (or they can 
append a counter to the secret, so that combinations of b and i never 
give the same values).

Could be useful for implementing as a remote login?


Comments?



Rob.

---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From ravage at ssz.com  Mon Jun  3 03:31:20 1996
From: ravage at ssz.com (Jim Choate)
Date: Mon, 3 Jun 1996 18:31:20 +0800
Subject: IR Cameras
Message-ID: <199606030534.AAA13745@einstein.ssz.com>



Forwarded message:

> Date: Sun, 2 Jun 1996 20:19:34 -0700
> From: tcmay at got.net (Timothy C. May)
> Subject: Re: opinions on book "The Truth Machine"
> 
> Today's newspaper (SJ Mercury News) carried a long article about
> increasingly ubiquitous video surveillance cameras, and singled out the
> U.K. as a place that is leading. Apparently even small villages have 50 or
> more cameras scattered around...men have been arrested for urinating in
> bushes outside pubs, caught by the infrared pickups (I hadn't thought about
> the cameras being IR, but this makes sense, as a large fraction of street
> crimes take place in dark or semidark areas).

Here in Austin, TX there is at least 1 IR camera located at the top of the
police building downtown (8th & IH-35). Many intersections have stoplight
synchronized cameras for getting license plates of red light runners (eg N.
Lamar & 51st). I know the output of the cameras is cabled off-pole (can see
the cables) to a NEMA style box. Don't know the format from there. It would
be no technological leap to buy cable channels and mux the pictures back to a
centralized site. This city is lousy with cable and fiber and the city
bought in from the get-go with a project called I-Net in the mid-80's.

                                                     Jim Choate







From timd at consensus.com  Mon Jun  3 03:46:50 1996
From: timd at consensus.com (Tim Dierks)
Date: Mon, 3 Jun 1996 18:46:50 +0800
Subject: The Elevator Problem
Message-ID: <v02140b01add8416384e0@[206.170.39.104]>


At 7:50 PM 6/2/96, Deranged Mutant wrote:
>Alice and Bob are in a crowded place and want to confirm they share a
>secret.
>
>Each picks a couple of random numbers, b and i.  The secret P is
>hashed i times, something like:
>
>  H_0(P) = H(P,0)               [H can be something like SHA-1...]
>  H_i(P) = H(H_i-1(P), i)
>
>They then tell each other bit b of H_i(P).
>
>This is repeated a number of times to make random guessing very
>unlikely.
>
>If all bits match, they agree that they share the secret (we assume
>neither wants to lie but discover if the other knows the secret).

It doesn't seem to me like it needs to be this complex. Here's a couple of
protocols I can think of:

For a secret S:

Alice and Bob generate and exchange random nonces. Then they calculate the
HMAC of S using the other's nonce as the MAC secret. They exchange HMACs
and each verify that their peer has correctly calculated the HMAC given the
secret and the nonce.

 - or -

Each of Alice and Bob hash S and use the result as a symmetric encryption
key; they then attempt to exchange messages. If they can exchange messages,
they must have arrived at the same key, and thus be using the same S. To
avoid replay attacks, exchange nonces and use them as a part of the key
calculation.

Note that neither of these reveals that you know S unless your peer knows
S; noone who doesn't know S can determine if Alice or Bob actually know S
or if they're using some other faked value (except for analysis of the
repercussions of the exchange).

 - Tim

Tim Dierks  --  timd at consensus.com  --  www.consensus.com
Head of Thing-u-ma-jig Engineering, Consensus Development







From hayden at krypton.mankato.msus.edu  Mon Jun  3 04:23:04 1996
From: hayden at krypton.mankato.msus.edu (Robert A. Hayden)
Date: Mon, 3 Jun 1996 19:23:04 +0800
Subject: Security of PGP if Secret Key Available?
Message-ID: <Pine.ULT.3.91.960603023229.6519B-100000@krypton.mankato.msus.edu>


-----BEGIN PGP SIGNED MESSAGE-----

About once a week we get some lame-o flame bait posted to 
alt.security.pgp or this mailing list or somewhere abotu some hole in 
PGP.  We further say with fairly good reliability that they are bogus, 
get a light chuckle, and then go back to dealing with the real issues.

However, I got to wondering about the security of PGP assuming somebody 
trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have 
it on my personal computer, and somebody gets my secret key, how much 
less robust has PGP just become, and what are appropriate and reasonable 
steps to take to protect this weakness?

Thanks


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: PGP Signed with PineSign 2.2

iQCVAwUBMbJ5xTokqlyVGmCFAQGcAgQAvjFdZ+YLdQGxDHcT+GOwP82BSwiTYlaQ
F9RV8L+radCK/SyeLnEtoodkKVqpcsItIQ/JJ44FOAmnsBLljuWqbhZMl8G8+uCB
pcpkXpre83CwoM6qDKkCEyqCiMxq857ioCoqb+WRNJYbb++muVBDHADVzGoGOjLg
cvIMxnnXF3c=
=tnTb
-----END PGP SIGNATURE-----
 
____           Robert A. Hayden      <=> hayden at krypton.mankato.msus.edu
\  /__     Finger for Geek Code Info <=>    Finger for PGP Public Key
 \/  /           -=-=-=-=-=-                      -=-=-=-=-=-
   \/        http://krypton.mankato.msus.edu/~hayden/Welcome.html

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GED/J d-- s:++>: a- C++(++++)$ ULUO++ P+>+++ L++ !E---- W+(---) N+++ o+
K+++ w+(---) O- M+$>++ V-- PS++(+++)>$ PE++(+)>$ Y++ PGP++ t- 5+++ X++
R+++>$ tv+ b+ DI+++ D+++ G+++++>$ e++$>++++ h r-- y+**
------END GEEK CODE BLOCK------






From WlkngOwl at unix.asb.com  Mon Jun  3 05:18:46 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Mon, 3 Jun 1996 20:18:46 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <199606030902.FAA27168@unix.asb.com>


On  2 Jun 96 at 21:15, Lucky Green wrote:

> That PGP is ubiquitous is subject to discussion. PGP is widely available, 
> but that doesn't mean that it is widely used. What percentage of email is 
> PGP encrypted? Less than half a percent?

In part because it's not well integrated with mailers.  That could 
change with a PGP3 DLL.

PGP isn't only used for email:

 o files distributed over the net that are PGP-signed
 o signed email
 o non-emailed file distributions (over BBS, or physical
    transfer of disks)
 o personal storage (though other utilities are better-suited
    for that than PGP)
 o related utilities that make use of PGP-keys (HPack
    archiver)

The reasons PGP hasn't become widely used are because of it's lack of 
user-friendliness and poor integration into other tools, irregardless 
of S/MIME.

Rob.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From apache at quux.apana.org.au  Mon Jun  3 05:27:08 1996
From: apache at quux.apana.org.au (TT)
Date: Mon, 3 Jun 1996 20:27:08 +0800
Subject: The decline and fall of Australia
Message-ID: <Pine.LNX.3.91.960603181731.604E-100000@quux.apana.org.au>


Just in case people on this list were under any delusions that Australia   
part of the free world get a load of this...
 
**begin press release**                      
                       
                       Hon. J.W. Shaw, QC, MLC
         Attorney-General and Minister for Industrial Relations
------------------------------------------------------------------------
Level 20, Goodsell Building,                    Facsimile  (02) 228 7301
Chifley Square, Sydney NSW 2000                 Telephone  (02) 228 8188

------------------------------------------------------------------------

 PAEDOPHILIA SHOULD NOT BE ENCOURAGED BY THE INTERNET


The Attorney General Mr Jeff Shaw, QC, MLC, today explained the draft
internet regulation legislation to members of the internet community who
had apparently misunderstood the plans.

"Despite their protests, those who support total freedom on the internet
have yet to explain to me why material involving paedophilia should be
readily available and encouraged on the internet", he said.

"Those who assert that the proposals are a knee jerk reaction are
completely wrong and appear to have been totally uninterested in the issue
until very recently.  For on 7 July 1995, a consultation paper on internet
regulation was released both on the World Wide Web and in paper form.

"That 'Consultation paper on the Regulation of On-Line Information
Services,' has now been available from the Federal Attorney General's
Department for almost a year.

"When it was released, submissions were requested, and 121 submissions
were received by the closing date of 1 September 1995.

"Following unanimous endorsement of the proposals by all Attorney's
General, the NSW Parliamentary Counsel drafted legislation based on the
discussion paper and the consultation process.  This legislation will be
discussed by the Standing Committee of Attorney's General in July.

"Those protesting about the proposed offences and penalties are
conveniently ignoring half the story - the fact that the draft legislation
creates broad defences that encourage compliance with approved codes of
practice or the taking of reasonable steps to ensure the proscribed
behaviour does not occur.

"Why should a Government not prosecute a service provider who supplies the
Internet to schools, yet refuses to install appropriate firewalls to
screen out material involving explicit sex and violence or child sexual
abuse?

"The broad defences recognise, as I do, the impossibility of monitoring
all data that goes through service providers systems, but encourage
providers to maintain maximum awareness, not maximum ignorance, about the
material disseminated.

"Criminal sanctions are only aimed at operators and users who culpably
breach the standards that are set out regarding material that they transmit
or advertise, or those who fail or refuse to exercise any effective
controls over material that is publicly available through their information
services.

"For example, people who have objectionable material placed on their
bulletin board without their knowledge could argue that they are not liable
as they had obtained undertakings from users that certain types of material
would not be posted or posted inappropriately.  They may also be able to
demonstrate that they had conducted random checks of material available
through their information service.

"I do not believe that the community condones the easy availability of
material encouraging paedophilia and other sexual abuse.  The impossibility
of absolute regulation does not justify a complete failure to do what we
can to meet reasonable concerns.

"I would hope that organisations like the Electronic Frontiers Association
are interested in assisting the State and Federal Governments formulate
workable proposals that will protect children while allowing adults
freedom of expression on the internet.  If they in fact are, detailed
proposals about how this could be best achieved would be useful."

**end**

As to that last para I think u could read..."cos we have no bloody idea
what we are doing or how to achieve this all on our lil lonesomes"

Thank the gods for cypherpunks..






From jsw at netscape.com  Mon Jun  3 06:09:04 1996
From: jsw at netscape.com (Jeff Weinstein)
Date: Mon, 3 Jun 1996 21:09:04 +0800
Subject: Java Crypto API questions
In-Reply-To: <Pine.SUN.3.91.960531114414.23205A-100000@rwd.goucher.edu>
Message-ID: <31B2ADA5.577D@netscape.com>


Andrew Loewenstern wrote:
> 
> Moltar Ramone writes:
> >  Probably.  But they won't be able to export the signed 3DES
> >  package :) It leaves foreign vendors in trouble, is where.
> 
> Sun can export the signature though.  The vendor already has the package,
> they just need the sig/cert...

  Not likely.  Sun will probably be required to agree not to do this
as a condition of exporting software with "pluggable crypto".  Software
with hooks for crypto functions is treated the same as the actual crypto
as far as the ITAR is concerned.

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw at netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.





From jya at pipeline.com  Mon Jun  3 07:41:19 1996
From: jya at pipeline.com (John Young)
Date: Mon, 3 Jun 1996 22:41:19 +0800
Subject: PRY_ing
Message-ID: <199606031105.LAA22382@pipe2.t1.usa.pipeline.com>


   6-3-96. NYP: 
 
   "As privacy grows scarcer on the Internet, people finally 
   start to take notice." Denise Caruso column. 
 
      Tomorrow, the Federal Trade Commission's Bureau of 
      Consumer Protection is sponsoring a public workshop in 
      Washington called "Consumer Privacy on the Global 
      Information Infrastructure." The F.T.C.'s intention is 
      to find out how much consumers and the industry really 
      know about critical privacy issues created by what it 
      calls "the emerging on-line marketplace," and to look at 
      various ways to protect personal data. 
 
      Privacy on data networks is a complex issue. It includes 
      thorny questions about anonymity -- who should be 
      allowed to be anonymous in network interactions, and 
      under what circumstances -- and the red-hot debate over 
      digital encryption, which can protect private 
      communication and transactions from all prying eyes, 
      including the Government's. 
 
   PRY_ing 
 





From jwilk at iglou.com  Mon Jun  3 08:42:32 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Mon, 3 Jun 1996 23:42:32 +0800
Subject: The Elevator Problem
Message-ID: <m0uQXfA-00037hC@mail.iglou.com>


At 02:50 AM 6/3/96 +0000, Deranged Mutant wrote:
>
>This may be old hat, but an earlier post (around the time the Kocher 
>RSA-timing attack came out) to the list asked about the "Elevator 
>Problem", where two parties who think they share the same secret want 
>to confirm it on an open channel.  I came up with an idea for a 
>protocol but never got around to posting it, and dropped off the list 
>briefly... so pardon me if this is already touched upon.
>
>Alice and Bob are in a crowded place and want to confirm they share a 
>secret.
>
>Each picks a couple of random numbers, b and i.  The secret P is 
>hashed i times, something like:
>
>  H_0(P) = H(P,0)               [H can be something like SHA-1...]
>  H_i(P) = H(H_i-1(P), i)
>
>They then tell each other bit b of H_i(P).
>
>This is repeated a number of times to make random guessing very 
>unlikely.
>
>If all bits match, they agree that they share the secret (we assume 
>neither wants to lie but discover if the other knows the secret).
>
>Since this is a mutual protocol, an eavesdropper who listens in 
>shouldn't be able to spoof Alice or Bob.  Or maybe Alice and Bob can 
>agree never to reuse combinations of b and i anyway (or they can 
>append a counter to the secret, so that combinations of b and i never 
>give the same values).
>
>Could be useful for implementing as a remote login?
>
>
>Comments?
>
>
>
>Rob.
>
>---
>No-frills sig.
>Befriend my mail filter by sending a message with the subject "send help"
>Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
>        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
>Send a message with the subject "send pgp-key" for a copy of my key.
>
>
Its a good thought, I never even thought about it, but it should work.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage     Gaa- 3.69
<jwilk at iglou.com>         Record- 2-4-4
Age- 13                   Final Standings- 2nd Place (Beat in Championship)
President & Founder:                   
Revolution Software       "I have the fastest glove in the east!"
Profanity Software        "Hackers never stop hacking they just get caught"
VSoft

My life- Rarely eat or sleep, Hack til' 7:00a, goto school, play goalie
til' 5:00p, hack til' 7:00a
Hank Aaron- d:-)!-<   Pope- +<:-)   Santa Claus- *<:-) The Unabrower |:-)

Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From m5 at vail.tivoli.com  Mon Jun  3 10:48:35 1996
From: m5 at vail.tivoli.com (Mike McNally)
Date: Tue, 4 Jun 1996 01:48:35 +0800
Subject: Sun pushing SKIP for intranets and java
In-Reply-To: <199605272346.TAA08318@jekyll.piermont.com>
Message-ID: <31B2E2E3.5D1A@vail.tivoli.com>


Perry E. Metzger wrote:

> If thats true, its a remarkably bad idea. The IP security layer isn't
> anywhere near the layer where you should be doing things like signing
> Java applets.

I think that the SKIP stuff would be intended to protect on-the-wire
marshalled objects when using the CORBA or RMI stuff to do inter-VM
method invocation.  The signature stuff is a whole 'nuther enchilada.

(I assume, Perry, that you weren't at the fabulous JavaOne thing last
week, because I didn't notice anyone spontaneously combusting from all
the hype :-)

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
       m5 at tivoli.com * m101 at io.com          *
      <URL:http://www.io.com/~m101>         * suffering is optional





From jya at pipeline.com  Mon Jun  3 11:23:50 1996
From: jya at pipeline.com (John Young)
Date: Tue, 4 Jun 1996 02:23:50 +0800
Subject: Newsweek on Crypto
Message-ID: <199606031301.NAA29204@pipe2.t1.usa.pipeline.com>


   Newsweek, June 10, 1996, pp. 49-55. 
 
 
   Scared Bitless 
 
      The arcane world of cryptography used to be the 
      exclusive realm of spies. Now it's everybody's business 
      -- to the chagrin of the government. 
 
   By Steven Levy 
 
      [Photo] Loosen up: Sen. Conrad Burns says the United 
      States should ease the export rules on crypto software 
 
 
   On the face of it, the issue of cryptography -- the 
   technology that employs secret codes to protect information 
   -- seems more suited to math class than "The McLaughlin 
   Group." Yet this once esoteric subject has wound up in the 
   center of a Beltway controversy, complete with 
   congressional infighting, lobbyists, entrenched government 
   agencies, blue-ribbon reports and even a bit of 
   presidential politics. This sudden spotlight on what was 
   previously the domain of deep-black spy stuff turns out to 
   be a good thing, because in the Information Age crypto 
   policy is more than an abstraction: it could provide the 
   difference between security and vulnerability, or even 
   between life and death. Unfortunately, choosing the right 
   policy is not a given, and there the controversy lies. 
 
   Here's the problem: we're increasingly entrusting 
   information to computers -- everything from confidential 
   medical records to business plans to money itself. But how 
   can we provide security so that these data will be 
   protected from eavesdroppers, thieves and saboteurs? The 
   answer hinges on cryptography. By scrambling the 
   information into digital codes, it allows only those 
   entrusted with the keys to decipher those files to see 
   them. Some hot-shot cryptographers have developed systems 
   that can provide all of us with unprecedented security, 
   automatically coding and decoding in such a way that we 
   won't have to know it's there. (We can even have our phone 
   calls encoded something Prince Charles might have 
   appreciated.) Silicon Valley would love to set such a 
   system in motion. It not only would generate revenues, but 
   would also address the main problem that's keeping the 
   Internet from fulfilling its potential as a center of 
   commerce: security. 
 
   Problem solved? Not quite. Law-enforcement and 
   national-security agencies view this prospect with dread. 
   Legal eavesdroppers, like FBI wiretappers and National 
   Security Agency snoopers, couldn't make sense of 
   intercepted transmissions. They warn that we could miss 
   indications of a terrorist act, like a nuke smuggled into 
   Manhattan. In addition, drug dealers, child pornographers 
   and garden-variety thugs could mask their activities with 
   a mere mouse click. 
 
   Even before the Clinton administration took office, the NSA 
   and FBI presented those nightmare scenarios to the 
   transition team. The Clintonites were scared bitless. They 
   vowed to make sure that the worst didn't happen. They 
   understood that cryptography should be put to general use 
   -- but only if it were altered in such a way that the 
   government could, if necessary, get access to secret 
   messages, using a new technology known as "key escrow." The 
   best-known of those schemes was the ill-fated Clipper Chip, 
   and subsequent systems haven't caught on. (Yet another was 
   presented two weeks ago.) Until then they would maintain 
   the strict export controls that treat crypto software as 
   powerful munitions. That's right -- Uncle Sam regards that 
   copy of Netscape you downloaded as sort of a Stinger 
   missile. 
 
   But now the government position of slowing down the flow of 
   crypto is under increasing attack. Software companies 
   complain that regulations cost them money and hold down 
   innovation. Privacy groups complain that the controls reek 
   of Orwell's "1984." Congress is demanding changes. Bob Dole 
   wants to make it an issue. And on Thursday came what Sen. 
   Conrad Burns, a Montana Republican, called "the nail in the 
   coffin" of the Clinton crypto policy: a report by the 
   National Research Council that clearly rebukes the 
   administration's position. Despite the Clinton-Gore attempt 
   to protect us against the abuse of cryptography, says the 
   Congress-commissioned report, our safety is at risk -- 
   because the lack of cryptography has weakened our security. 
 
   Under particular attack are the regulations that limit the 
   strength of exported software like IBM's Lotus Notes, 
   mostly by mandating that the keys that encode and decipher 
   the information not exceed 40 bits (the longer the key, the 
   stronger the protection). Often, domestic users have to 
   settle for this crippled crypto: since software companies 
   are loath to release two versions of their products, they 
   simply choose to offer the weaker, approved-for-export 
   version. 
 
   Meanwhile, foreign companies have no such restrictions, and 
   U.S. companies maintain they are losing sales. Congress has 
   taken up their case; bills introduced by Sen. Patrick 
   Leahy, Rep. Bob Goodlatte and Burns all would relax the 
   export rules. "These bills are pro-privacy, pro-jobs and 
   pro-business," says Leahy. While prospects for passage are 
   slim, the fact that a sizable number of legislators are 
   defying intelligence and law-enforcement agencies is itself 
   significant. 
 
   Crypto policy is even finding its way into the presidential 
   campaign. On a visit to Silicon Valley, Bob Dole was 
   alerted to the problem by Netscape CEO Jim Barksdale. He 
   also saw a chance to chip away at Clinton's support in the 
   high-tech world. Dole not only cosponsored the Senate bills 
   but issued a neo-cypherpunk statement charging that "the 
   administration's big brother proposal will literally 
   destroy America's computer industry." 
 
   The NRC report, entitled "Cryptography's Role in Securing 
   the Information Society," stands as the most serious 
   challenge to current policy. It is drenched in credibility: 
   its 16 authors include former attorney general Benjamin 
   Civiletti, onetime NSA deputy director Ann Caracristi, 
   privacy expert Willis Ware and cryptographer Martin 
   Hellman. The panel was briefed by all sides of the issue, 
   including some classified sessions with government 
   officials. Despite the group's diversity, it reached 
   consensus: "Widespread commercial and private use of 
   cryptography is inevitable in the long run and ... its 
   advantages, on balance, outweigh its disadvantages." 
 
   The NRC made some specific recommendations. The government 
   should stop building a system around the umproven 
   Clipper-style technology. The export regulations should be 
   relaxed, specifically permitting free export of the 
   well-tested Data Encryption Standard, which uses a 56-bit 
   key. (While some argue for even bigger keys, this is a 
   significant jump. The increase in key size alone means that 
   theoretically it will be more than 65,000 times harder to 
   crack a code.) Perhaps the strongest rebuke came with the 
   rejection of the "if you only knew" defense. The committee 
   concluded that informed decisions on crypto could be made 
   without access to classified material. 
 
   If the NRC advice was followed, would criminals hide 
   nefarious activities behind a digital wall of gibberish? 
   Quite possibly, admits the committee -- but without action 
   to promote crypto, we are increasingly dependent on a 
   computer-controlled world with insufficient protection. 
   "We're encouraging a world that supports greater 
   confidentiality -- but we think it's worth the risk," says 
   panelist Ray Ozzie, creator of IBM's Lotus Notes. The 
   committee cited security breaches like the recent raid on 
   Citicorp by Russian hackers, and warned that without 
   crypto, we are more vulnerable to "information warfare" 
   threats -- endangering operations like the 
   air-traffic-control system. 
 
   The government's response? "We do care about the security 
   of information, but we need to do it in a way that does not 
   diminish law enforcement," says an administration official. 
   "People writing academic reports can take chances. But when 
   you are the policeman, you have to err on the side of 
   protecting people." 
 
   The question is, which approach provides the most 
   protection? The NRC report undercuts the government's 
   position at a time when many were already beginning to 
   question it. On May 21, 11 senators sat down in a bugproof 
   room for a classified briefing, presumably designed to make 
   them rethink their proposals. But, said Leahy, "no one 
   seemed to change their mind." Looks like they've cracked 
   the code. 
 
   [Two photos] 'Pro-privacy, pro-jobs, pro-business': Sen. 
   Patrick Leahy (right) and Lotus Notes creator Ray Ozzie 
   think strong codes will make a stronger economy 
 
   _________________________________________________________ 
   [Box] 
 
   Sending Messages In Private 
 
   Cryptography makes it possible to turn intelligible words 
   into a hodgepodge of letters, numbers and symbols, keeping 
   them out of the hands of cybersnoops. 
 
   [Illustration: computer  > key > encrypted message > key > 
   computer.] 
 
   To send a private message through a network, a cryptography 
   program is used to "lock" the message -- making it 
   unreadable to anyone who intercepts it. 
 
   The program generates a secret, digital key when it 
   scrambles the message. The receiver then uses the key to 
   translate the message back into plain text. 
 
   _________________________________________________________ 
 
   [End] 
 
   Thanks to SL and Newsweek. 
 
 
 
 
 
 





From jmoll at acquion.com  Mon Jun  3 12:13:36 1996
From: jmoll at acquion.com (Joseph L. Moll)
Date: Tue, 4 Jun 1996 03:13:36 +0800
Subject: Floating Point and Financial Software
Message-ID: <2.2.32.19960603141003.006ebeb4@mail.acquion.com>



I have seen monetary items represented as integers, with the software
assuming that the last two digits are actually the "cents" part of the
float.  There are still round off problems with this scheme, but the
calculations are much faster since they are integers.
---
Joseph L. (Joe) Moll -- Network and Communications Engineering
mailto:jmoll at acquion.com http://www.acquion.com  phone:864-281-4108
ACQUION, Inc.  Greenville, SC  USA -- Specialists in Electronic Commerce
disclaimer:  This email is not to be considered official correspondence
---






From raph at CS.Berkeley.EDU  Mon Jun  3 12:19:47 1996
From: raph at CS.Berkeley.EDU (Raph Levien)
Date: Tue, 4 Jun 1996 03:19:47 +0800
Subject: List of reliable remailers
Message-ID: <199606031350.GAA01754@kiwi.cs.berkeley.edu>


   I operate a remailer pinging service which collects detailed
information about remailer features and reliability.

   To use it, just finger remailer-list at kiwi.cs.berkeley.edu

   There is also a Web version of the same information, plus lots of
interesting links to remailer-related resources, at:
http://www.cs.berkeley.edu/~raph/remailer-list.html

   This information is used by premail, a remailer chaining and PGP
encrypting client for outgoing mail. For more information, see:
http://www.c2.org/~raph/premail.html

   For the PGP public keys of the remailers, finger
pgpkeys at kiwi.cs.berkeley.edu

This is the current info:

                                 REMAILER LIST

   This is an automatically generated listing of remailers. The first
   part of the listing shows the remailers along with configuration
   options and special features for each of the remailers. The second
   part shows the 12-day history, and average latency and uptime for each
   remailer. You can also get this list by fingering
   remailer-list at kiwi.cs.berkeley.edu.

$remailer{"extropia"} = "<remail at miron.vip.best.com> cpunk pgp special";
$remailer{"portal"} = "<hfinney at shell.portal.com> cpunk pgp hash";
$remailer{"alumni"} = "<hal at alumni.caltech.edu> cpunk pgp hash";
$remailer{"c2"} = "<remail at c2.org> eric pgp hash reord";
$remailer{"penet"} = "<anon at anon.penet.fi> penet post";
$remailer{"flame"} = "<remailer at flame.alias.net> cpunk mix pgp. hash latent cut post reord";
$remailer{"mix"} = "<mixmaster at remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?";
$remailer{"replay"} = "<remailer at replay.com> cpunk mix pgp hash latent cut post ek";
$remailer{"ecafe"} = "<cpunk at remail.ecafe.org> cpunk mix";
$remailer{"amnesia"} = "<amnesia at chardos.connix.com> cpunk mix pgp hash latent cut ksub";
$remailer{'alpha'} = '<alias at alpha.c2.org> alpha pgp';
$remailer{"lead"} = "<mix at zifi.genetics.utah.edu> cpunk pgp hash latent cut ek";
$remailer{"treehole"} = "<remailer at mockingbird.alias.net> cpunk pgp hash latent cut ek";
$remailer{"exon"} = "<remailer at remailer.nl.com> cpunk pgp hash latent cut ek";
$remailer{"vegas"} = "<remailer at vegas.gateway.com> cpunk pgp hash latent cut";
$remailer{"haystack"} = "<haystack at holy.cow.net> cpunk mix pgp hash latent cut ek";
catalyst at netcom.com is _not_ a remailer.
lmccarth at ducie.cs.umass.edu is _not_ a remailer.
usura at replay.com is _not_ a remailer.

Groups of remailers sharing a machine or operator:
(c2 alpha)
(flame replay)
(alumni portal)

Use "premail -getkeys pgpkeys at kiwi.cs.berkeley.edu" to get PGP keys
for the remailers. Fingering this address works too.

Note: The remailer list now includes information for the alpha
nymserver.

Last update: Mon 3 Jun 96 6:47:19 PDT
remailer  email address                        history  latency  uptime
-----------------------------------------------------------------------
replay   remailer at replay.com              ********+***     6:17  99.89%
vegas    remailer at vegas.gateway.com       ** * *--****    37:04  99.82%
amnesia  amnesia at chardos.connix.com       ------------  3:52:31  99.74%
flame    remailer at flame.alias.net         -----++---++  1:25:32  99.74%
exon     remailer at remailer.nl.com         +***#- * *+*     5:48  99.33%
ecafe    cpunk at remail.ecafe.org           ####+**##*#*     1:17  99.31%
alpha    alias at alpha.c2.org               *+ +++-++**+    45:57  99.26%
c2       remail at c2.org                    +- ++.-+++++    57:37  99.24%
haystack haystack at holy.cow.net            +*-***#+# ##    10:00  98.62%
penet    anon at anon.penet.fi               _-. .___ --  40:43:38  97.37%
extropia remail at miron.vip.best.com        -----------   9:35:17  97.17%
alumni   hal at alumni.caltech.edu           *#-+##* -##     15:58  95.46%
mix      mixmaster at remail.obscura.com     .--++--+++-   2:29:31  94.30%
portal   hfinney at shell.portal.com         *#-+##*# ##     17:14  93.19%
lead     mix at zifi.genetics.utah.edu       +++++++++++     36:51  92.05%
treehole remailer at mockingbird.alias.net    - .--.-.-    8:47:35  90.83%

   History key
     * # response in less than 5 minutes.
     * * response in less than 1 hour.
     * + response in less than 4 hours.
     * - response in less than 24 hours.
     * . response in more than 1 day.
     * _ response came back too late (more than 2 days).

   cpunk
          A major class of remailers. Supports Request-Remailing-To:
          field.
          
   eric
          A variant of the cpunk style. Uses Anon-Send-To: instead.
          
   penet
          The third class of remailers (at least for right now). Uses
          X-Anon-To: in the header.
          
   pgp
          Remailer supports encryption with PGP. A period after the
          keyword means that the short name, rather than the full email
          address, should be used as the encryption key ID.
          
   hash
          Supports ## pasting, so anything can be put into the headers of
          outgoing messages.
          
   ksub
          Remailer always kills subject header, even in non-pgp mode.
          
   nsub
          Remailer always preserves subject header, even in pgp mode.
          
   latent
          Supports Matt Ghio's Latent-Time: option.
          
   cut
          Supports Matt Ghio's Cutmarks: option.
          
   post
          Post to Usenet using Post-To: or Anon-Post-To: header.
          
   ek
          Encrypt responses in reply blocks using Encrypt-Key: header.
          
   special
          Accepts only pgp encrypted messages.
          
   mix
          Can accept messages in Mixmaster format.
          
   reord
          Attempts to foil traffic analysis by reordering messages. Note:
          I'm relying on the word of the remailer operator here, and
          haven't verified the reord info myself.

   mon
          Remailer has been known to monitor contents of private email.
          
   filter
          Remailer has been known to filter messages based on content. If
          not listed in conjunction with mon, then only messages destined
          for public forums are subject to filtering.
          

Raph Levien





From warlord at MIT.EDU  Mon Jun  3 12:21:00 1996
From: warlord at MIT.EDU (Derek Atkins)
Date: Tue, 4 Jun 1996 03:21:00 +0800
Subject: Security of PGP if Secret Key Available?
In-Reply-To: <Pine.ULT.3.91.960603023229.6519B-100000@krypton.mankato.msus.edu>
Message-ID: <199606031411.KAA01253@toxicwaste.media.mit.edu>


> However, I got to wondering about the security of PGP assuming somebody 
> trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have 
> it on my personal computer, and somebody gets my secret key, how much 
> less robust has PGP just become, and what are appropriate and reasonable 
> steps to take to protect this weakness?

The security of the PGP system is based around the security of the PGP
private (secret) key.  The security of the secret key is based on two
things: 1) The bits in the secring, and 2) the user pass phrase.  An
attacker needs both 1 and 2 to compromise a secret key.  Posession of
only one of them is not enough.  It doesn't matter how big your key
is.  It could be 384 bits, it could be 2048 bits.  You still have the
same two walls protecting your key.

If someone has read your secring file, that means they only have to
get your pass phrase.  This gives an attacker something to go for.
Once they obtain your pass phrase as well, your key is compromised.

If, however, they obtain your secret keyring but they CANNOT obtain
your pass phrase, you are still safe.  It just means you have one fewer
walls surrounding your secret key.

I always assume that someone has compromised my secret keyring, in
that someone has obtained a copy of it.  So I spend most of my "time"
(granted, it's not a lot) trying to protect my pass phrase.  I have a
fairly long pass phrase, more than 40 characters, and I make sure I
KNOW (not believe, KNOW) the path the bits take from the keyboard to
the CPU -- and I make sure that path is secure.  Otherwise I don't run
PGP at that time.

Since I have a laptop, that makes my life much easier -- I
cut-and-paste my PGP mail over to the laptop and run PGP there.
>From the laptop I can send mail out directly.

I hope this answers your question,

-derek





From kevin.jessup at mail.mei.com  Mon Jun  3 12:30:09 1996
From: kevin.jessup at mail.mei.com (Kevin Jessup)
Date: Tue, 4 Jun 1996 03:30:09 +0800
Subject: Java Crypto API questions
Message-ID: <01I5GTVSACW299NQKT@meipws.mis.mei.com>


Jeff Weinstein <jsw at netscape.com> wrote...

>  Not likely.  Sun will probably be required to agree not to do this
>as a condition of exporting software with "pluggable crypto".  Software
>with hooks for crypto functions is treated the same as the actual crypto
>as far as the ITAR is concerned.
>
>	--Jeff

Just WHAT is a "hook" for crypto??  ;-) I've read about the
Microsoft crypto API, other such hooks and the "ban on
hooks", but who says a "hook" must be so "generic".

With things such as the "component object model" stuff
Microsoft is pushing and similar technologies in the UNIX
world, I can still see "hooking" to crypto.  Though perhaps
more on an application-specific basis and not so "generically".

I acknowledge that crypto which is nearly "invisible" to the
end-user will make it more widespread, and thus the need
for a generic API.

Politicians and technology: like oil and water.

--                             "Rest enough for the individual man - [but] too 
Kevin Jessup                   much or too soon and we call it Death.  But for 
software engineer                  MAN, no rest and no ending.  He must go on, 
Marquette Medical Systems           conquest beyond conquest...and when he has 
http://www.mei.com               conquered all the depths of space and all the 
PGP Email preferred            mysteries of time, still he will be beginning." 
kevin.jessup at meipws.mis.mei.com               -- H.G. Wells, Things To Come  






From perry at piermont.com  Mon Jun  3 13:16:15 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 04:16:15 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <add71e4c06021004bdfb@[205.199.118.202]>
Message-ID: <199606031523.LAA05288@jekyll.piermont.com>



Timothy C. May writes:
> Namely, are the people "talking up" a stock committing a crime?

Possibly.

> And, how can someone who acts on overheard information--as in the elevator
> example Sandy cited--be charged with any crime? Unless they are "insiders,"
> covered by SEC rules about trading, they are free to act on essentially
> anything they hear.

No, I'm afraid they aren't. Under the rules, if you have nonpublic
information, even if you are not a corporate officer, you are an
insider for purposes of "insider trading" and your trades are illegal.

Don't go to Tim for advice on steering clear of the SEC's enforcement
people.

> (To elaborate on this: I was never classified as an "insider" during my
> time at Intel, and I certainly bought and sold the stock based on what
> products and news I knew was coming out or what rumors I'd heard. Only a
> select group of executives and staff in the specific departments generating
> earnings announcements, auditing, etc., were covered.

Only they were covered by the rules that require registration of all
trades, you mean. You are completely confusing two uses of the word
"insider".

> But ordinary people, even employees of a company, are not
> considered to be "insiders" and hence are not covered by insider trading
> laws.)

Follow Tim's advice and wind up in jail. I can give people specific
cases if they like.

Securities laws are extremely complex, extraordinarily broad, and
subject to extremely flexible interpretation. I would suggest not
attempting to skate a fine line near them -- the ice is very thin.

Perry





From jthomas at gateway.webwon.com  Mon Jun  3 13:55:14 1996
From: jthomas at gateway.webwon.com (RHS Linux User)
Date: Tue, 4 Jun 1996 04:55:14 +0800
Subject: Java Crypto API questions
In-Reply-To: <31B2ADA5.577D@netscape.com>
Message-ID: <Pine.LNX.3.91.960603111342.11161A-100000@gateway.webwon.com>




On Mon, 3 Jun 1996, Jeff Weinstein wrote:

> Andrew Loewenstern wrote:
> > 
> > Sun can export the signature though.  The vendor already has the package,
> > they just need the sig/cert...
> 
>   Not likely.  Sun will probably be required to agree not to do this
> as a condition of exporting software with "pluggable crypto".  Software
> with hooks for crypto functions is treated the same as the actual crypto
> as far as the ITAR is concerned.

When Microsoft announced their crypto API, they also announced that their 
signatures on crypto modules would be export-restricted.  According to 
e-mail I received from a Microsoft employee on the project, the act of 
signing was considered a "defense service" under ITAR, so exporting the 
signature would somehow be performing defense services for foreign 
persons.  It makes slightly less sense to me than the rest of the crypto 
export restrictions do, but I guess that's the deal that Microsoft worked 
out with the Feds in order to be allowed to do a crypto API at all.

Joe





From jimbell at pacifier.com  Mon Jun  3 13:56:35 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 4 Jun 1996 04:56:35 +0800
Subject: Java Crypto API questions
Message-ID: <199606031521.IAA12484@mail.pacifier.com>


At 02:17 AM 6/3/96 -0700, Jeff Weinstein wrote:
>Andrew Loewenstern wrote:
>> 
>> Moltar Ramone writes:
>> >  Probably.  But they won't be able to export the signed 3DES
>> >  package :) It leaves foreign vendors in trouble, is where.
>> 
>> Sun can export the signature though.  The vendor already has the package,
>> they just need the sig/cert...
>
>  Not likely.  Sun will probably be required to agree not to do this
>as a condition of exporting software with "pluggable crypto".  Software
>with hooks for crypto functions is treated the same as the actual crypto
>as far as the ITAR is concerned.

But you haven't explained why somebody can't export JUST the signature.  You 
know, import the software, have Sun sign it domestically, strip off everything that isn't a 
signature, and export the signature.  Append it to the un-imported code 
outside the country.

Jim Bell
jimbell at pacifier.com





From apache at quux.apana.org.au  Mon Jun  3 14:18:59 1996
From: apache at quux.apana.org.au (TT)
Date: Tue, 4 Jun 1996 05:18:59 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
In-Reply-To: <199606030902.FAA27168@unix.asb.com>
Message-ID: <Pine.LNX.3.91.960604005849.2051A-100000@quux.apana.org.au>


On Mon, 3 Jun 1996, Deranged Mutant wrote:

> On  2 Jun 96 at 21:15, Lucky Green wrote:
> 
> > That PGP is ubiquitous is subject to discussion. PGP is widely available, 
> > but that doesn't mean that it is widely used. What percentage of email is 
> > PGP encrypted? Less than half a percent?
> 
> In part because it's not well integrated with mailers.  That could 
> change with a PGP3 DLL.

I think that is the main reason PGP is not more common place. If it was 
seamlessly integrated with Windows software such as mailers I am sure it 
would be used widely. It will be interesting to see if this develops.

 
> PGP isn't only used for email:
> 
>  o files distributed over the net that are PGP-signed
>  o signed email
>  o non-emailed file distributions (over BBS, or physical
>     transfer of disks)
>  o personal storage (though other utilities are better-suited
>     for that than PGP)
>  o related utilities that make use of PGP-keys (HPack
>     archiver)
> 
> The reasons PGP hasn't become widely used are because of it's lack of 
> user-friendliness and poor integration into other tools

I think it is actually easy to use, although granted others may not; but 
that people tend not to use it as a matter of course (and it is my belief 
this is a desireable thing) due too the time taken to manually sign mail 
or sign and encrypt. Lets face it the average user has trouble with a 
dos command prompt and until there is a point and click emailer easily 
available most people just won't try PGP for email. It would also raise 
the general awareness of PGP and encryption and privacy issues I hope as 
it is my experience that outside the dedicated and the interested, very 
few have even heard of PGP or realise that their email may be read easily 
by persons other than the intended recipient. If this should occurr the 
horse would have bolted as far as any attempts at government outlawing 
its use; by and large; or at the very least would make it impossible to 
pass laws banning PGP without the public at large realising that they 
might possibly be loosing something which at the moment I doubt many 
would having never used encryption for email.


-- 
   .////.   .//    Charles Senescall            apache at quux.apana.org.au
 o:::::::::///                                         apache at gil.com.au
>::::::::::\\\     Finger me for PGP PUBKEY           Brisbane AUSTRALIA
   '\\\\\'   \\    http://quux.apana.org.au/~apache/ 






From perry at piermont.com  Mon Jun  3 14:41:40 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 05:41:40 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <N9BXoD32w165w@bwalk.dm.com>
Message-ID: <199606031601.MAA05367@jekyll.piermont.com>



Dr. Dimitri Vulis writes:
> ichudov at algebra.com (Igor Chudov @ home) writes:
> > scheme gets broken somehow? Suppose, for example, that someone
> > discovers an ultra-fast factoring algorithm or something like that.
> 
> This'll happen, probably sooner than later.

Why do you assume that? There are plenty of problems that are
provably not solvable in non-exponential time even if P=NP. What makes
you think this one is going to be solved?

.pm






From jeffb at sware.com  Mon Jun  3 15:22:54 1996
From: jeffb at sware.com (Jeff Barber)
Date: Tue, 4 Jun 1996 06:22:54 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606031523.LAA05288@jekyll.piermont.com>
Message-ID: <199606031507.LAA15317@jafar.sware.com>


Perry E. Metzger writes:

> Timothy C. May writes:

> > And, how can someone who acts on overheard information--as in the elevator
> > example Sandy cited--be charged with any crime? Unless they are "insiders,"
> > covered by SEC rules about trading, they are free to act on essentially
> > anything they hear.
> 
> No, I'm afraid they aren't. Under the rules, if you have nonpublic
> information, even if you are not a corporate officer, you are an
> insider for purposes of "insider trading" and your trades are illegal.

> > (To elaborate on this: I was never classified as an "insider" during my
> > time at Intel, and I certainly bought and sold the stock based on what
> > products and news I knew was coming out or what rumors I'd heard. Only a
> > select group of executives and staff in the specific departments generating
> > earnings announcements, auditing, etc., were covered.
> 
> Only they were covered by the rules that require registration of all
> trades, you mean. You are completely confusing two uses of the word
> "insider".

IANAL, but I think you must be wrong about this, Perry.  If this were
the case then, as an employee of company XYZ, I would never be permitted
to buy XYZ stock (which is clearly not the case) since I *always* have
information that others outside the company do not (about staff changes,
product plans and such).  I suspect the deciding factor must have to do
with the ability to execute actions which have substantial direct effects
on the stock price (i.e. buying a company, declaring dividends, having a
massive downsizing, etc.).


-- Jeff





From mark at unicorn.com  Mon Jun  3 15:39:08 1996
From: mark at unicorn.com (Rev. Mark Grant, ULC)
Date: Tue, 4 Jun 1996 06:39:08 +0800
Subject: [Noisy] More curfews (was Re: opinions on book "The Truth Machine")
Message-ID: <Pine.3.89.9606031621.A13492-0100000@unicorn.com>


On Sat, 1 Jun 1996, Adam Back wrote:

> political climate.  Having just read your post on curfews my response
> was what the fuck, are you serious?  It totally amazes me that public
> opinion has got to the stage that something like this would be
> accepted.

Interesting that the day after you posted this the front-page of the UK's
major newspapers carried a story about the Labour party proposing
precisely the same thing in the UK. Of course the cops already have
surveillance cameras all over the place. 

> I'm not sure where I would stand on this legally, but I have so far
> resisted the temptation to tell them it's none of their business.

I tried it a few weeks ago when they stopped me for a random breath test
(illegal as far as I know) after following me for three miles while I
scrupulously obeyed the law. They originally claimed that they had stopped
me randomly, because "that's what I pay them for", but when I questioned
the legality they decided that I'd crossed the centerline while passing a
parked car and therefore must be drunk (even though my car was too wide to
not cross the line). In other words, I don't think they care about the
legal issues. Still, I suppose it's better than being stopped for "driving
at 2:30 in the morning" again. Hmm, who said the UK didn't have a curfew
already? 

> They are I think
> talking about making it law that all target pistols must be kept at
> the gun club (whereas currently you can take them home to clean (but
> not shoot)).

Gun-thieves will love that one. Why steal them one at a time when you can 
steal twenty or thirty in one go?

	Mark "Out of Europe in a few more days" Grant







From norm at netcom.com  Mon Jun  3 15:50:03 1996
From: norm at netcom.com (Norman Hardy)
Date: Tue, 4 Jun 1996 06:50:03 +0800
Subject: Fate of Ecash if RSA is cracked?
Message-ID: <add8d6a4070210044ee4@DialupEudora>


At 8:01 AM 6/3/96, Perry E. Metzger wrote:
>Dr. Dimitri Vulis writes:
....
>> This'll happen, probably sooner than later.
>
>Why do you assume that? There are plenty of problems that are
>provably not solvable in non-exponential time even if P=NP. What makes
>you think this one is going to be solved?
>
>.pm

The "Idea Futures" forum has established odds on this. The current odds are
currently 60% that a 1024 bit number will be factored by 2010 and 30% that
a 512 bit number will be factored by 1997.

See <http://if.arc.ab.ca/IF.shtml> for Idea Futures and
<http://if.arc.ab.ca/bin/summary> for odds for various questions.







From hwh6k at fulton.seas.virginia.edu  Mon Jun  3 15:59:42 1996
From: hwh6k at fulton.seas.virginia.edu (Henry Huang)
Date: Tue, 4 Jun 1996 06:59:42 +0800
Subject: Security of PGP if Secret Key Available?
Message-ID: <199606031648.MAA31489@fulton.seas.Virginia.EDU>


On Jun 3,  2:36, "Robert A. Hayden" wrote:
> However, I got to wondering about the security of PGP assuming somebody 
> trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have 
> it on my personal computer, and somebody gets my secret key, how much 
> less robust has PGP just become, and what are appropriate and reasonable 
> steps to take to protect this weakness?

If someone else has your secret key, it's safe to assume you're toast. ;)
Better a new key and revocation certificate before the forgeries start
(or before someone ELSE does before you ... <shudder>).

More specifically, if you've failed to assign a passphrase to your
secret key, you ARE toast, because anyone can just pick it up and use
it.

If you did use a passphrase, it becomes a question of breaking either
the passphrase, or the IDEA algorithm used to encrypt your secret key.
It's usually a lot easier to break the passphrase than it is to brute
force IDEA.

See the PGP Passphrase FAQ
(http://www.stack.urc.tue.nl/~galactus/remailers/passphrase-faq.html)
and Arnold Reinhold's page (http://world.std.com/~reinhold/papers.html)
for more details.

-H





From perry at piermont.com  Mon Jun  3 16:07:12 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 07:07:12 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606031507.LAA15317@jafar.sware.com>
Message-ID: <199606031632.MAA05439@jekyll.piermont.com>



Jeff Barber writes:
> IANAL, but I think you must be wrong about this, Perry.

Nope, I'm not.

> If this were the case then, as an employee of company XYZ, I would
> never be permitted to buy XYZ stock (which is clearly not the case)
> since I *always* have information that others outside the company do
> not (about staff changes, product plans and such).

Funny, that, ain't it.

Well, yes, as I noted, the law is very broad, and selectively
enforced. However, yes indeed -- if you know that Secure Ware is
introducing SuperBozo 2000 next week by virtue of your employment, and
you know it will drive up the stock price, and SuperBozo 2000 is a
deep dark secret, and you load up on shares in the expectation of
making money from that rise, you are indeed cruising for a visit from
the friendly boys at Stock Watch.

> I suspect the deciding factor must have to do
> with the ability to execute actions which have substantial direct effects
> on the stock price (i.e. buying a company, declaring dividends, having a
> massive downsizing, etc.).

There is no real deciding factor other than what a jury will buy. The
law is very broad and extremely vague. It is selectively enforced. A
lot of what is and isn't a violation is based entirely on
prosectorial discretion.

Welcome to the world of securities regulation, where you live under a
government of men, not of laws, and SEC edicts, er, no-action letters
are needed before you sneeze because everything you do every day is
probably a crime somehow.

Perry





From shamrock at netcom.com  Mon Jun  3 16:21:01 1996
From: shamrock at netcom.com (Lucky Green)
Date: Tue, 4 Jun 1996 07:21:01 +0800
Subject: Java Crypto API questions
Message-ID: <v02120d04add8d2c68a13@[192.0.2.1]>


At 2:17 6/3/96, Jeff Weinstein wrote:

>> Sun can export the signature though.  The vendor already has the package,
>> they just need the sig/cert...
>
>  Not likely.  Sun will probably be required to agree not to do this
>as a condition of exporting software with "pluggable crypto".  Software
>with hooks for crypto functions is treated the same as the actual crypto
>as far as the ITAR is concerned.

Then how can Sun claim that their system is
1. Exportable
2. Does RC-4 and DES?

The Java Crypto AIP presentation slides that are available on Sun's website
clearly make both claims.

Unfortunately, the feedback address that Sun provides in the slides is
unknow to their mailserver (at least it was last week) and no further
information seem to be avaiable about their "public and open" policy.

Confused,

Disclaimer: My opinions are my own, not those of my employer.

-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.







From ses at tipper.oit.unc.edu  Mon Jun  3 16:21:16 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Tue, 4 Jun 1996 07:21:16 +0800
Subject: Java Crypto API questions
In-Reply-To: <199606031521.IAA12484@mail.pacifier.com>
Message-ID: <Pine.SOL.3.91.960603131147.5466B-100000@president.oit.unc.edu>


On Mon, 3 Jun 1996, jim bell wrote:
> 
> But you haven't explained why somebody can't export JUST the signature.  You 
> know, import the software, have Sun sign it domestically, strip off everything that isn't a 
> signature, and export the signature.  Append it to the un-imported code 
> outside the country.

Ancillary device... It's pretty clear cut.

Simon






From shamrock at netcom.com  Mon Jun  3 16:28:49 1996
From: shamrock at netcom.com (Lucky Green)
Date: Tue, 4 Jun 1996 07:28:49 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <v02120d03add8d1062108@[192.0.2.1]>


At 21:33 6/2/96, Deranged Mutant wrote:

>The reasons PGP hasn't become widely used are because of it's lack of
>user-friendliness and poor integration into other tools, irregardless
>of S/MIME.

I concur. It is that lack of integration that gave S/MIME the space to grow
in. Now it is too late to achieve the market dominance that PGP should have
achieved long ago. S/MIME *will* be the email encryption standard used by
Joe Sixpack.


Disclaimer: My opinions are my own, not those of my employer.

-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.







From sandfort at crl.com  Mon Jun  3 16:32:53 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Tue, 4 Jun 1996 07:32:53 +0800
Subject: DEMOGRAPHICS v. ANONYMITY
Message-ID: <2.2.32.19960603171454.00717340@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

At 07:19 AM 6/3/96 +0200, "Senator Exon" wrote:

>... demographic data on big spenders is worth more than
>anonymous cash from people who buy packages of gum.  Much 
>more.

A true, but irrelevant.  The correct dichotomy is between
demographic data on big spenders and anonymous big spenders.
Yes, it would be nice to have demographics on everyone, but
demographics are secondary to sales.

>An economy of big spenders is worthless unless they're in 
>your store.  The cards give evidence of who spends in your 
>store, so you target your advertisements accordingly.

Of course, there are other ways to get demographics and 
other ways to target advertising and other ways to get
big spenders into your store.

>I also shop only with cash, here and elsewhere.  
>Double-blinded e-cash will be the only way to go, if it 
>ever is the way to go.

And I bet they don't turn down your cash just because it
contains no demographic data.  Thus demonstrating the 
pragmatism of the market with regard to anonymity.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







From perry at piermont.com  Mon Jun  3 16:37:46 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 07:37:46 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <add8d6a4070210044ee4@DialupEudora>
Message-ID: <199606031810.OAA05553@jekyll.piermont.com>



Norman Hardy writes:
> At 8:01 AM 6/3/96, Perry E. Metzger wrote:
> >Dr. Dimitri Vulis writes:
> ....
> >> This'll happen, probably sooner than later.
> >
> >Why do you assume that? There are plenty of problems that are
> >provably not solvable in non-exponential time even if P=NP. What makes
> >you think this one is going to be solved?
> 
> The "Idea Futures" forum has established odds on this. The current odds are
> currently 60% that a 1024 bit number will be factored by 2010 and 30% that
> a 512 bit number will be factored by 1997.

Thats totally different from a high speed polynomial time factoring
algorithm. Thats saying we can factor bigger numbers with
time. Exponential growth still holds, however.

.pm





From br at doppio.Eng.Sun.COM  Mon Jun  3 16:46:35 1996
From: br at doppio.Eng.Sun.COM (Benjamin Renaud)
Date: Tue, 4 Jun 1996 07:46:35 +0800
Subject: Java Crypto API questions
Message-ID: <199606031746.KAA01680@springbank.eng.sun.com>


Martin Minow (minow at apple.com) writes:

[...]

|-- Policies = Assertions + Capabilities. That's what my notes

Policies are statements like:

"code endorsed by any one of the following signatures (say three of 
my friends) can access the public part of my file system"

This is hard. It's probably not going to make it in the first release.
The simple first pass is to say "code signed by x, y, and z" can do 
whatever it wants.

|-- Feedback to security-api at java.sun.com.

The alias had some trouble over the week-end. It should be working
fine now.

-- Benjamin





From vile at apdg.com  Mon Jun  3 16:57:34 1996
From: vile at apdg.com (Kurt Vile)
Date: Tue, 4 Jun 1996 07:57:34 +0800
Subject: "Insider Non-Trading" (Re: Insider Trading and InsideInformation)
In-Reply-To: <add7aa1b010210045ad9@[205.199.118.202]>
Message-ID: <9606031802.AA12382@smile.apdg.com>




tcmay at mail.got.net  wrote:

>The SEC tumbled to this some time ago, and now demands that all
>those who are insiders, or who are married to insiders, or who are
>golfing buddies of insiders register their trading intentions 90
>days in advance of any transaction. (This will increase to 120 days 
>in 1997, and 180 days the following year.)

Those intentions in all likelyhood will not be binding...When I  
used to work for Swiss Bank Corp, the SEC demanded that any person  
who was privy to trading information (basically everyone) had to  
file for approval before making a transaction.  This approval was  
non-binding. I don't think the SEC has the power to mandate that a  
entity commit to a trade 180 days before the trade is suppose to  
happen, after all the instrument the entity is registering their  
intent to make a trasaction in; could have something horrible happen  
to it within 180 days (apple could blow up their headquarters for  
example)

The SEC may however have the power to request a reason for your  
decision not to make the transaction.  Which seems like it would be  
alot of work, since their are tons of and tons of approvals that get  
made.  (I know alot of people who would make a request to trade  
something, not do a trade, but have another request become active  
when the original request expired (they give you a 2 week window or  
so))

--Kurt





From bruce at aracnet.com  Mon Jun  3 17:06:58 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Tue, 4 Jun 1996 08:06:58 +0800
Subject: PGP's ubiquity (was Re: NRC Session Hiss)
Message-ID: <2.2.32.19960603182730.006afff8@mail.aracnet.com>


At 09:15 PM 6/2/96 -0700, Lucky Green wrote:

>That PGP is ubiquitous is subject to discussion. PGP is widely available, 
>but that doesn't mean that it is widely used. What percentage of email is 
>PGP encrypted? Less than half a percent?

Much, much less than that. I get about five hundred messages a day. On the
average day, none of them are PGP-encrypted. On the average _week_, none of
them are PGP-encrypted. And by virtue of having a PGP key signed and on the
servers, I'm better prepared to send and receive such mail than at least
99.9% of the net.population.

>PGP was a failure in the mass market, regardless how popular it may be
>with some subscribers of this list. 

True, and important. 

In one sense it doesn't matter how good a security system is if a manageable
set of people are the only ones using it. There are only a few thousand IDs
in the key servers, and vast majority of those, I'd guess, are like me in
not using PGP routinely. But even if we were, the institutions of the State
have experience in the long-term surveillance of groups quite a bit larger
than us.

This is where I think some forms of cyber-elitism fail. So I've got access
to darned good tools. The State has numbers and resources, and memes about
how the masses do right when they acquiesce, on its side. 

We are not, I think, particularly secure in an environment where the very
fact of using secure tools stands out from the herd. But what the herd needs
are good tools with good simple front ends, and a) those who design the
tools generally don't care about the herd and so do nothing to get outside
the crypto ghetto and b) those in a position to design the front ends
generally have more immediately rewarding things to do or don't know about
the tools themselves.

Five years ago I was quite optimistic about strong security as an important
element in bringing about the post-statist society I desire. Now I'm
pessimistic. I just don't see signs of the stuff spreading sufficiently. And
while S/MIME has interesting features (based on what I've read so far), the
default 40-bit setup is basically no protection at all. And I know just how
hard it is to get people comfortable using non-default features.

--
Bruce Baugh
bruce at aracnet.com
http://www.aracnet.com/~bruce






From tcmay at got.net  Mon Jun  3 17:17:16 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 4 Jun 1996 08:17:16 +0800
Subject: Crypto APIs Considered Harmful
Message-ID: <add87a9e090210045cd0@[205.199.118.202]>


A typo when I wrote:


2. Eliminates a reason for controlling the distribution and export of
browsers, mailers, newsreaders, etc. Imagine the glum reaction of the NSA
when they realize that they can't control these programs, because the
"crypto hooks" are only the hooks to basic message payloads...and they
control these.
                                                   ^
                                                  *can't*

I meant to include the "can't."

A Web browser with no hooks for crypto absolutely will not be
export-controlled. But if users in Slovakia and Beninia can _see_ the
messages, as they of course can, then crypto programs they supply
themselves can of course see and act on the messages. (Copying to a
clipboard, for example, and lots of other ways.)

No way the NSA can control that.

Concentrating on integrating crypto tightly into commercial programs is
playing the NSA's game.

--Tim May


Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From br at doppio.Eng.Sun.COM  Mon Jun  3 17:33:05 1996
From: br at doppio.Eng.Sun.COM (Benjamin Renaud)
Date: Tue, 4 Jun 1996 08:33:05 +0800
Subject: Java Crypto API questions
Message-ID: <199606031855.LAA01849@springbank.eng.sun.com>


|Unfortunately, the feedback address that Sun provides in the slides is
|unknow to their mailserver (at least it was last week) and no further
|information seem to be avaiable about their "public and open" policy.

In the actual talk, I said "will be public and open", that is when we
actually announce the policy it will be public and open. The things
that are certain about it is that it will be constrained only by export
considerations, and that we'll sign competitors' packages.

I am hoping that I can get a spec document for the API ready by the end
of the month. By then we will have more details regarding the export
stuff. In the meantime, I'll see if we can get an interim FAQ
together.

The security-api at java.sun.com address should be working now. 

-- Benjamin





From bruce at aracnet.com  Mon Jun  3 17:39:13 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Tue, 4 Jun 1996 08:39:13 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <2.2.32.19960603182733.006b6250@mail.aracnet.com>


At 04:33 AM 6/3/96 +0000, Deranged Mutant wrote:

>In part because it's not well integrated with mailers.  That could 
>change with a PGP3 DLL.

I have a growing feeling that PGP 3 is never going to happen. Or that if it
does, it will happen only after the passage of more draconian anti-privacy
laws, and the guys working on it will be forced to include sundry backdoor
stuff or drop it altogether.

I suspect someone could do quite nicely by going ahead and developing a
2.6.2 or 2.6.3 DLL.

--
Bruce Baugh
bruce at aracnet.com
http://www.aracnet.com/~bruce






From frantz at netcom.com  Mon Jun  3 17:40:31 1996
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 4 Jun 1996 08:40:31 +0800
Subject: Fate of Ecash if RSA is cracked?
Message-ID: <199606031845.LAA26772@netcom7.netcom.com>


At  5:04 AM 6/3/96 +0000, Greg Miller wrote:
>On Sun, 2 Jun 1996 17:42:49 -0500 (CDT), you wrote:
>
>>What would happen with all ecash that's been issued? Of course
>>criminals would be able to forge large amounts of authentic-looking
>>ecash, so banks should not be honoring requests to convert e-cash into
>>real cash.
>
>        As I understand it, ecash shouldn't be withdrawn until shortly before
>it
>is spent.  If the RSA algorithm is broken, then then banks could refuse the
>withdrawal (and depositing) of money as ecash.  The remainder of the money in
>each users' account would have to be withdrawn through conventional methods.
>
>        Of course all the outstanding (between withdrawl and deposit) ecash
>could be a problem.

Banks running Digicash might be able to credit you account for cash on your
disk using the same mechanisms they use to recover your ecash after a hard
disk crash.  You shouldn't need too much electronic identification since
the only result is to move money to yourself.


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From jimbell at pacifier.com  Mon Jun  3 17:48:37 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 4 Jun 1996 08:48:37 +0800
Subject: Java Crypto API questions
Message-ID: <199606031915.MAA25368@mail.pacifier.com>


At 11:20 AM 6/3/96 -0400, RHS Linux User wrote:
>
>
>On Mon, 3 Jun 1996, Jeff Weinstein wrote:
>
>> Andrew Loewenstern wrote:
>> > 
>> > Sun can export the signature though.  The vendor already has the package,
>> > they just need the sig/cert...
>> 
>>   Not likely.  Sun will probably be required to agree not to do this
>> as a condition of exporting software with "pluggable crypto".  Software
>> with hooks for crypto functions is treated the same as the actual crypto
>> as far as the ITAR is concerned.
>
>When Microsoft announced their crypto API, they also announced that their 
>signatures on crypto modules would be export-restricted.

That doesn't mean that they are, LEGALLY, export-restricted.  Microsoft 
can't generally bind third parties to agreements with the government.  Even 
in circumstances where it might appear that they can enter into an agreement 
with a customer, Microsoft is sufficiently big that any terms it forces on 
customers are automatically suspect of being oppressive, especially if there 
is no valid business reason for a particular restriction.  Besides, a 
violation of any such agreement is merely a violation of an agreement with 
Microsoft, not the USG.   It is unlikely Microsoft is going to take 
individual customers of their customer to court for violation of some 
no-export agreement.

>  According to 
>e-mail I received from a Microsoft employee on the project, the act of 
>signing was considered a "defense service" under ITAR, so exporting the 
>signature would somehow be performing defense services for foreign 
>persons. 

Even if it is arguable that the signing of a piece of software constitutes a 
"defense service," that service is performed for somebody, domestically, who 
delivers that software to Microsoft.  Once that software is signed, the 
"defense service" is over and done with.  At that point, you merely have an 
object, a signature, which cannot encrypt or decrypt data.  It is even less 
useful than a microprocessor or RAM at facilitating encryption.

 It makes slightly less sense to me than the rest of the crypto 
>export restrictions do, but I guess that's the deal that Microsoft worked 
>out with the Feds in order to be allowed to do a crypto API at all.

I think you've hit the nail on the head:  The Feds were well aware that 
Microsoft had plenty of money to challenge them in court, and they would 
almost certainly have lost.  So the Feds gave in on the API issue, and in 
exchange Microsoft agreed to publicly state that "the signatures on crypto 
modules would be export-restricted."  Doesn't make it so.

Jim Bell
jimbell at pacifier.com





From tcmay at got.net  Mon Jun  3 17:52:13 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 4 Jun 1996 08:52:13 +0800
Subject: Crypto APIs Considered Harmful
Message-ID: <add86d220702100431c8@[205.199.118.202]>



There are obviously lots of snags and restrictions being imposed on crypto
APIs. "Hooks for crypto" lead to trouble of various sorts.

Well, we've talked about this before, but I'll say it again:

* For now and for the foreseeable future, maybe the focus should be on
better and more efficiently integrating crypto (e.g., straight PGP) with
the _contents_ of programs (e.g, the innermost pure text blocks, such as
what you are now reading). The integration can be done separately and
orthogonally from the basic crypto package, just as PGP did.

* This is largely, in my opinion, what made PGP so popular. Whether one had
a PC. a Mac, an Amiga, various flavors of Unix, etc., one could send and
receive messages with PGP to other users, regardless of their platforms or
their choice of mailers, editors, word processors, newsreaders, or
browsers. This was because PGP was a "payload-centric" (to coin a phrase)
program.

* PGP did not need to know any details of the message headers, MIME sorts
of stuff (though a MIME field for PGP exists, as I understand it). Thus,
there were no "hooks" in PGP for specific mailers, editors, etc., except
things people added later.

* Better integration is needed between crypto and mailers, editors, Web
browsers, but then this runs smack into the "crypto API" issue. (It also
narrows the richness of applications, in the sense that if a lot of work
goes into "Netscape 4.x with S/MIME," as a likely example, then there are
fewer combinations of crypto + tools.)

Thus, it seems to me that we gain more overall leverage, and more
flexibility, and less hassle from the ITAR folks, if more of the focus is
kept on the "crypto API" it is essentially impossible to control: the
message payload.

So long as ASCII (or Unicode, increasingly) message blocks can be handled
by a variety of editors, mailers, news programs, browsers, etc., it will be
impossible to stop users from using crypto on these blocks.

But if crypto is tied to specific browsers, mailers, etc., this gives the
NSA and ITAR office a way to impose limits.

I think there are a _lot_ of advantages to maintaining orthogonality, to
_not_ more tightly integrating crypto with mailers and browsers.

Sure, it would be very nice if hooks existed. But the fact is that this
gives the NSA an avenue for restricting export of programs (e.g.,
Netscape), and such restrictions may cause companies like Netscape to
compromise by giving _everyone_ a "weaker-but-more-tightly-integrated"
crypto package.

I would rather have a "strong-as-I-wish-but-loosely-integrated" package!

(Greater convenience can be handled on a platform-by-platform basis,
possibly easier than trying to get industry-wide compliance with a crypto
API spec. Thus, on the Mac it is possible to have macros or scripts which
take a received message (from whatever source and with whichever mailer,
browser, etc.), process the message block, and return the result to another
window or as a file. MacPGP mostly works this way, and other enhancements
exist as well. At no point was the basic spec for PGP affected, and no
"crypto API" was needed....since the fact that we can _see_ and _read_
messages is in fact the crypto API!)

* Disadvantages of Not Having Crypto APIs in Popular Packages

1. Many users, especially those just getting on the Net, want "all-in-one"
turnkey programs. Not having crypto APIs built into Netscape Navigator, for
example, will reduce the number of users of crypto. (On the other hand, if
most new users are using Navigator 4.x "now with extra strong 47-bit
crypto," they at least get into the habit of using crypto and can
"graduate" up to crypto packages external to Navigator, so maybe it won't
be a disaster for Netscape to offer NSA-approved crypto APIs, so long of
course as external packages can access the message blocks freely.)

2. Not having APIs may affect digital commerce, as robust systems involving
many transfer points should have robust links to message internals, and not
rely on something so potentially prone to error and glitches as a bunch of
macros and scripts. (Can be done, but having a bunch of Macs and PCs
communicating with a bunch of clipboard macros...ugh!)

* Advantages of Not Having Crypto APIs in Popular Packages

1. Separates the development of strong crypto from the development of
browsers, mailers, etc. (I'm not saying Netscape, for example, is
developing the algorithms, but by including integrated crypto they are
automatically in the loop on developments...and maybe it would be better if
they weren't.)

2. Eliminates a reason for controlling the distribution and export of
browsers, mailers, newsreaders, etc. Imagine the glum reaction of the NSA
when they realize that they can't control these programs, because the
"crypto hooks" are only the hooks to basic message payloads...and they
control these.

3. Orthogonality and independent development means the _best_ crypto (PGP,
S/MIME, whatever...) can be combined with whichever mailers and browsers
people want to use. Netscape users will not be limited to S/MIME, for
example, with its strange notions of where the signatures belongs, or its
default key size.

4. In some sense, the "basic data structure" of nearly all personal
communications _is_ the basic ASCII (or Unicode, rich MIME, etc.) message.
At least for the things most _personal_ users are now sending. (I
acknowledge that business users have needs for richer data structures. As
noted in Disadvantage #2, running a commerce system (think of SWIFT) with
macros and scripts reaching into message blocks...shudder! But business
users can work out separate plans.)

5. Finally, placing more of a focus on the messages and not on crypto APIs
for currently popular programs like Microsoft Explorer and Netscape
Navigator makes better use of scarce programming resources. And it is, in
my opinion, a more "grassroots" and "cypherpunkish" thing to do than to try
to work with large corporations to integrate tools into their programs.

(The NSA would clearly rather have crypto tools tightly integrated into
popular programs, despite what some have said. It gives them control and
it's easier for them to jawbone Netscape and Microsoft than a million
users.)

Obvious points. But in light of all the recent moves to limit deployment of
crypto by limiting the "crypto API" approaches, it's useful to remember
that for most applications, the message payload is perfectly suited for
carrying digital signatures, encrypted blocks, etc.

They can't stop the messages, can they?

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From unicorn at schloss.li  Mon Jun  3 18:05:22 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 4 Jun 1996 09:05:22 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606031507.LAA15317@jafar.sware.com>
Message-ID: <Pine.SUN.3.91.960603150424.8479C-100000@polaris>


On Mon, 3 Jun 1996, Jeff Barber wrote:

> Perry E. Metzger writes:
> 
> > Timothy C. May writes:
> 
> > > And, how can someone who acts on overheard information--as in the elevator
> > > example Sandy cited--be charged with any crime? Unless they are "insiders,"
> > > covered by SEC rules about trading, they are free to act on essentially
> > > anything they hear.
> > 
> > No, I'm afraid they aren't. Under the rules, if you have nonpublic
> > information, even if you are not a corporate officer, you are an
> > insider for purposes of "insider trading" and your trades are illegal.
> 
> > > (To elaborate on this: I was never classified as an "insider" during my
> > > time at Intel, and I certainly bought and sold the stock based on what
> > > products and news I knew was coming out or what rumors I'd heard. Only a
> > > select group of executives and staff in the specific departments generating
> > > earnings announcements, auditing, etc., were covered.
> > 
> > Only they were covered by the rules that require registration of all
> > trades, you mean. You are completely confusing two uses of the word
> > "insider".
> 
> IANAL, but I think you must be wrong about this, Perry.  If this were
> the case then, as an employee of company XYZ, I would never be permitted
> to buy XYZ stock (which is clearly not the case) since I *always* have
> information that others outside the company do not (about staff changes,
> product plans and such).  I suspect the deciding factor must have to do
> with the ability to execute actions which have substantial direct effects
> on the stock price (i.e. buying a company, declaring dividends, having a
> massive downsizing, etc.).

Incorrect.
The deciding factor is the court's determiniation of whether the 
information was "material non-public information."  As the question of 
materiality is vague, subjective and subject to whim, even a low level 
employee is risking time and fines.  Often materiality has exactly zero 
to do with what effect it may have on stock price.

There is a simple solution to avoiding liability.  Don't trade in your 
own company's stock.

You make the case that it is somehow shocking to think that an employee 
wouldn't be able to buy stock in their employer.  Such restrictions have 
existed for decades.  Why are you so stunned?

> 
> 
> -- Jeff

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From perry at piermont.com  Mon Jun  3 18:08:54 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 09:08:54 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <Pine.SUN.3.91.960603150424.8479C-100000@polaris>
Message-ID: <199606031918.PAA05670@jekyll.piermont.com>



Black Unicorn writes:
> Incorrect.
> The deciding factor is the court's determiniation of whether the 
> information was "material non-public information."  As the question of 
> materiality is vague, subjective and subject to whim, even a low level 
> employee is risking time and fines.  Often materiality has exactly zero 
> to do with what effect it may have on stock price.

Mr. Unicorn has it exactly right.

> There is a simple solution to avoiding liability.  Don't trade in your 
> own company's stock.

In reality, of course, you are fairly safe so long as no one is
looking for your head and you aren't trading based on company
secrets. However, in theory, its possible to prosecute almost anyone.

> Such restrictions have existed for decades.  Why are you so stunned?

I guess this is all obvious to wall streeters like me, who live day to
day with yellow xeroxed sheets being mass distributed to all employees
informing us of the names of 150 companies that the firm has had
peripheral dealings with recently that we aren't allowed to trade for
some indeterminate period of time. People who don't live in regulatory
paranoia land often just don't get that the SEC's regulatory authority
is broad, based on very vague statutes, and capriciously
applied. Thats reality, folks. I suppose since most people have never
experienced it they don't understand what it's like....

Perry





From WlkngOwl at unix.asb.com  Mon Jun  3 18:29:55 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 4 Jun 1996 09:29:55 +0800
Subject: Security of PGP if Secret Key Available?
Message-ID: <199606032026.QAA08222@unix.asb.com>


With the MD5 collisions, can it be shown that plaintext passphrases 
are more likely to map to certain hashes than others? (And hence IDEA 
key search space reduced?)

Just speculation.

Rob.

On  3 Jun 96 at 2:36, Robert A. Hayden wrote:

[..]
> However, I got to wondering about the security of PGP assuming somebody 
> trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have 
> it on my personal computer, and somebody gets my secret key, how much 
> less robust has PGP just become, and what are appropriate and reasonable 
> steps to take to protect this weakness?



 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From frissell at panix.com  Mon Jun  3 18:36:38 1996
From: frissell at panix.com (Duncan Frissell)
Date: Tue, 4 Jun 1996 09:36:38 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
Message-ID: <2.2.32.19960603200355.0075cc58@popserver.panix.com>


At 11:23 AM 6/3/96 -0400, Perry E. Metzger wrote:

>No, I'm afraid they aren't. Under the rules, if you have nonpublic
>information, even if you are not a corporate officer, you are an
>insider for purposes of "insider trading" and your trades are illegal.

Though if I trade based on my non public knowledge that the Gray Aliens will strike at Midnight on 31 December 1999, I am probably safe.  Doesn't the non-public knowledge have to have been generated or concern internal company information (or the intentions of a publisher or buyer concerning the company).  If info that is too far removed is included then any stock analysis system would be illegal.

Note BTW that the Feds lost almost all of the '80s insider trading cases that actually went to trial.  They only won 2 or 3 that went through the full trial and appeals process.  That is a very poor record since prosecutors usually have an 80-90% success rate in criminal trials. 

>Securities laws are extremely complex, extraordinarily broad, and
>subject to extremely flexible interpretation. I would suggest not
>attempting to skate a fine line near them -- the ice is very thin.

And like most federal criminal procedures based more on hype than reality.  One should emulate the head of Princeton Securities who showed up for settlement negotiations with the Feds wearing a "Shit Happens" baseball cap.  All charges dismissed on appeal.  

I do think though that many actual "inside traders" are pretty dumb since it is not hard to trade securities anonymously.

DCF







From perry at piermont.com  Mon Jun  3 18:41:49 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 09:41:49 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606031918.PAA15670@jafar.sware.com>
Message-ID: <199606032029.QAA05821@jekyll.piermont.com>



Jeff Barber writes:
> I trust it won't stun you to find that many, many large and even small
> corporations -- including my current employer [*NOT* SecureWare, BTW,
> despite the email address] -- actually encourage their employees to buy
> stock by offering stock purchase plans as a benefit of employment.

Yup. Indeed, its perfectly legal and even common to trade in the stock
of your own company, even if you are a corporate officer. HOWEVER,
that doesn't mean that you are safe against insider trading charges.

> So perhaps Tim over-simplified by saying that there were no limits on
> what ordinary employees could do.  OTOH, it seems that Perry also
> over-simplified by flatly stating that Tim's trades while an Intel
> employee were "illegal".

First of all, I never said that Tim's trades were illegal -- indeed, I
never mentioned Tim except to say that following his advice didn't
seem like a particularly safe course to take. Second of all, I can't
comment on whether Tim's trades were within the letter of the law or
not. Indeed, it would be difficult even if one knew all the
circumstances since the definition of "material non-public
information" is so hard to pin down.

The point of all this was not that one shouldn't participate in the
employee payroll stock purchase plan. The point was that a random
person on the street who gets told a 'hot tip' is probably subject to
the insider trading laws, never mind that he wasn't an employee or
what is conventionally thought to be an "insider".

Perry





From raph at cs.berkeley.edu  Mon Jun  3 18:41:53 1996
From: raph at cs.berkeley.edu (Raph Levien)
Date: Tue, 4 Jun 1996 09:41:53 +0800
Subject: NRC Session Hiss
In-Reply-To: <199606030150.BAA27932@pipe2.t1.usa.pipeline.com>
Message-ID: <31B34402.3B2C@cs.berkeley.edu>


Lucky Green wrote:
> That PGP is ubiquitous is subject to discussion. PGP is widely available,
> but that doesn't mean that it is widely used. What percentage of email is
> PGP encrypted? Less than half a percent?

   Full agreement here. Further, nothing that the PGP people are doing 
seems likely to fundamentally change this fact.

> PGP was a failure in the mass market, regardless how popular it may be
> with some subscribers of this list. The email encryption method that *will*
> be ubiquitous and that will cause PGP to be used only by a relatively
> small fringe is S/MIME. Within a few months, S/MIME will be on the
> desktops of some 20 million people. It, not PGP is the future standard.

   Yes.

> Of course S/MIME will default to 40 bit RC-4 and carry the signatures
> outside the encryption envelope. There is little doubt in my mind that
> the pannel will find it much easier to support than PGP.

   Actually, this is the case in the current standard, but in the next 
one, it might change.
   I'll try to bring cypherpunks up to date - the debate is still 
happening on the smime-dev mailing list.

   A couple of weeks ago, one of RSA's consultants in Washington got what 
appears to be approval for certain relaxation of the export rules for 
S/MIME. The rules themselves apply to S/MIME only. They are also quite 
confusing, mostly because capabilities for message sending and message 
receiving are so asymmetric. I'll try to briefly summarize the 
characteristics of exportable S/MIME clients here.
   Signature generation is quite good - signatures can be generated and 
verified at 2048 bits. This applies both to messages and certificates. The 
limitations apply to encryption only.
   Basically, an exportable S/MIME client can transmit messages up to 
1024/40 bit RSA/RC2 (or RSA/DES), and receive messages up to 512/64 bit 
RSA/RC2 (or RSA/DES, but in the latter case I would imagine it's actually 
restricted to 512/56 because of the keysize of DES). Note that the 
asymmetry actually points in different directions for the public and 
symmetric keysizes.
   Most users of exportable clients will want to generate separate RSA 
keys for signatures and encryption, otherwise signatures would be limited 
to 512 bits.

   In any case, the fact that RSA keysizes are linked to symmetric 
keysizes is _extremely_ good news. It means that that it is possible to 
tell whether the recipient is an export version or not. If the keysize is 
512 bits or less, the default algorithm should be 64-bit RC2. Otherwise, 
it should be 168-bit Triple-DES. If you work it out, you'll see that this 
policy will not cause any interoperability problems. For example, if the 
default encryption algorithm were simply changed to Triple-DES, then 
export clients would be unable to read the message at all.

   I'm pushing to get this policy codified in the S/MIME implementation 
guidelines and also widely implemented. If this happens, there really 
wouldn't be much point in trying to keep PGP alive.

   Of course, the division into export and domestic versions would still 
probably ensure that most of the clients in the field were restricted to 
export-grade, but I think it's likely that the population of non-export 
clients will far exceed that of PGP, so it's progress in any case. Also, 
if S/MIME catches on, it creates a fabulous opportunity for a company 
outside the US to market good S/MIME clients.

Raph





From jwilk at iglou.com  Mon Jun  3 19:01:59 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Tue, 4 Jun 1996 10:01:59 +0800
Subject: Idea 'bout banning the internet
Message-ID: <m0uQg3B-00038WC@mail.iglou.com>


What if in the future a country banned the internet and all things that had
to deal with it (ie-  telnet, irc). It would be  the "underground" thing.
Just a thought, it would really suck! As I think about it it is impossible
or is it???? Hell the usa cant even ban porn let alone the whole thing. They
could ban it like they did fizzies. Hey there making a comeback did you here
now they have nutrasweet in them. If you know what fizzies are than your
pretty kewl. I'm only 13 and love then they are the drink of the future!!!!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage     Gaa- 3.69
<jwilk at iglou.com>         Record- 2-4-4
Age- 13                   Final Standings- 2nd Place (Beat in Championship)

President & Founder:
                   
Revolution Software       "I have the fastest glove in the east!"
Profanity Software        "Hackers never stop hacking they just get caught"
VSoft

My life- Rarely eat or sleep, Hack til' 7:00a, goto school, play goalie
til' 8:00p, hack til' 7:00a
Hank Aaron- d:-)!-<   Pope- +<:-)   Santa Claus- *<:-) The Unabrower |:-)

Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring

Personal Quote- Mr Plow, thats my name, that name aguin is Mr. Plow 
-Homer Simpson
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From hoz at univel.telescan.com  Mon Jun  3 19:05:55 1996
From: hoz at univel.telescan.com (rick hoselton)
Date: Tue, 4 Jun 1996 10:05:55 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
Message-ID: <199606032018.NAA03658@toad.com>


>Perry E. Metzger writes: 

>> Timothy C. May writes:

Suggestion #1: 
Never get your legal advice from cypherpunks newsletter.

Suggestion #2:
If you absolutely can't resist going against Suggestion #1, 
then listen carefully to Perry.

As just a lowly programmer around here, I have often been told 
that I would be breaking the law if I trade on some piece of 
information before it becomes public.  I am not such an "insider" 
that I must register my trades 90 days in advance.  I've read the 
actual statute. (though I am not a lawyer and, these days, even 
lawyers don't know what a law means until the final verdict)

You might also want to ask Ivan Boeskey(sp?).  I think he's out of 
Federal prison by now.  He's the guy that cut a deal with the Feds 
to give him time to sell a few billion dollars worth of stock before 
being arrested, so that he could pay his fine.  Once he was arrested, 
the value of those stocks fell.  It looks to me like he and the Feds 
traded on inside information so that he could pay his fine for trading 
on inside information.  He still went to jail, and he had enough money 
for good lawyers.  Imagine what would happen to me!








>IANAL, but I think you must be wrong about this, Perry.  If this were
>the case then, as an employee of company XYZ, I would never be permitted
>to buy XYZ stock (which is clearly not the case) since I *always* have
>information that others outside the company do not (about staff changes,
>product plans and such).  I suspect the deciding factor must have to do
>with the ability to execute actions which have substantial direct effects
>on the stock price (i.e. buying a company, declaring dividends, having a
>massive downsizing, etc.).
>
>
>-- Jeff
>






From jeffb at sware.com  Mon Jun  3 19:07:26 1996
From: jeffb at sware.com (Jeff Barber)
Date: Tue, 4 Jun 1996 10:07:26 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <Pine.SUN.3.91.960603150424.8479C-100000@polaris>
Message-ID: <199606031918.PAA15670@jafar.sware.com>


Black Unicorn writes:

> Incorrect.
> The deciding factor is the court's determiniation of whether the 
> information was "material non-public information."  As the question of 
> materiality is vague, subjective and subject to whim, even a low level 
> employee is risking time and fines.  Often materiality has exactly zero 
> to do with what effect it may have on stock price.
> 
> There is a simple solution to avoiding liability.  Don't trade in your 
> own company's stock.
> 
> You make the case that it is somehow shocking to think that an employee 
> wouldn't be able to buy stock in their employer.  Such restrictions have 
> existed for decades.  Why are you so stunned?

I trust it won't stun you to find that many, many large and even small
corporations -- including my current employer [*NOT* SecureWare, BTW,
despite the email address] -- actually encourage their employees to buy
stock by offering stock purchase plans as a benefit of employment.  They
even make it convenient by deducting purchases from one's paycheck.

Presumably then, we ordinary employees are so in-the-dark that any
non-public information we do hold is considered non-material?

So perhaps Tim over-simplified by saying that there were no limits on
what ordinary employees could do.  OTOH, it seems that Perry also
over-simplified by flatly stating that Tim's trades while an Intel
employee were "illegal".


-- Jeff





From froomkin at law.miami.edu  Mon Jun  3 19:14:14 1996
From: froomkin at law.miami.edu (Michael Froomkin)
Date: Tue, 4 Jun 1996 10:14:14 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606031523.LAA05288@jekyll.piermont.com>
Message-ID: <Pine.SUN.3.93.960603170014.1502D-100000@viper.law.miami.edu>


On Mon, 3 Jun 1996, Perry E. Metzger wrote:

[...]
> Securities laws are extremely complex, extraordinarily broad, and
> subject to extremely flexible interpretation. I would suggest not
> attempting to skate a fine line near them -- the ice is very thin.

Damn good advice, if you ask me.

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin at law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's warm and humid here.






From shamrock at netcom.com  Mon Jun  3 19:19:44 1996
From: shamrock at netcom.com (Lucky Green)
Date: Tue, 4 Jun 1996 10:19:44 +0800
Subject: Crypto APIs Considered Harmful
Message-ID: <v02120d09add8f90a2a56@[192.0.2.1]>


At 11:06 6/3/96, Timothy C. May wrote:

>So long as ASCII (or Unicode, increasingly) message blocks can be handled
>by a variety of editors, mailers, news programs, browsers, etc., it will be
>impossible to stop users from using crypto on these blocks.

I agree. But it really doesn't matter. The goal of the governments is not
to stop people that are willing to operate a crypto program on blocks of
text. That goal would be impossible to achieve. The goal of the governments
is to ensure that once Joe Sixpack clicks "Encrypt Mail" in Netscape or MS
Mail, the resulting cyphertext can still be read, though not by Joe
himself. It is *because* PGP operated on blocks of text and did not provide
a decent API that Joe (and even Tim May) are still not encrypting the bulk
of their email.

PGP isn't being used, because it lacks the API. S/MIME doesn't lack the API
and is therefore being supported by all the major players.

>But if crypto is tied to specific browsers, mailers, etc., this gives the
>NSA and ITAR office a way to impose limits.

Crypto should not be tied to specific browsers and mailers. Nor should it
be tied to a specific program such as PGP. That's why hooks and APIs are
crucial to gaining market acceptance.

[...]
>Obvious points. But in light of all the recent moves to limit deployment of
>crypto by limiting the "crypto API" approaches, it's useful to remember
>that for most applications, the message payload is perfectly suited for
>carrying digital signatures, encrypted blocks, etc.
>
>They can't stop the messages, can they?

Of course not. Nor do they want to. A little leakage around the edges is
fine, as long as the masses don't adopt strong crypto. And that is a given,
thanks to PGP's lack of modularity.

I am not just slamming PGP. It is not the only CP "friendly" software that
was implemented in an outdated, application-centric way. This was fine some
four years ago, when people were still using DA/Font Mover to install fonts
on their Mac, but it isn't today.

Today's realities of software development and customer expectations require
that secondary functionality (in this example, sending and receiving mail
is the primary functionality) such as encryption, message encoding, etc.
are completely transparent and fully integrate in the software that
provides the primary functionality. How many of you are still using
UUencode (the stand-alone program) when emailing someone a binary file? How
many of you are using the "Attach File" button in your mailer? How many
more people are sending binary files via email now that you can click
"Attach File" than did back when you had to use UUencode? I rest my case.


Disclaimer: My opinions are my own, not those of my employer.

-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.







From anonymous-remailer at shell.portal.com  Mon Jun  3 19:33:13 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Tue, 4 Jun 1996 10:33:13 +0800
Subject: Surveillance Cameras
Message-ID: <199606032014.NAA22221@jobe.shell.portal.com>


Tim May wrote:

>Today's newspaper (SJ Mercury News) carried a long article about
>increasingly ubiquitous video surveillance cameras, and singled out the
>U.K. as a place that is leading. 

There was a news report on this a couple of months ago.  In addition to
the government surveillance cameras, when there's a major crime in the U.K. 
the cops have started collecting all the security tapes from offices, gas 
stations, railway stations, etc, etc in the surrounding area and scanning 
them to try to find the culprits.  The interesting things that they said 
were :

	1. The cameras only reduce crime rates locally, as the criminals
	   simply move to areas without cameras.
	2. The real criminals (e.g. IRA bombers) know how to disguise 
	   themselves well enough that the cameras cannot easily be used 
	   to identify them.
	3. The cameras are often pointed in the wrong direction, not
	   switched on or aren't recording.  A good example is the London
	   club which was bombed a year or so back.  The bomber walked
	   up to the entrance and placed the bomb directly in view of
	   the security camera.  It was switched off at the time ...
	4. Even when people are recorded, the resolution is often too
	   poor to identify them.

So it appears that the cameras are great for arresting people who urinate 
in bushes, but useless for catching real criminals. 

Alice de 'nonymous ...
 
                                  ...just another one of those...
 
 
P.S.  This post is in the public domain.
                  C.  S.  U.  M.  O.  C.  L.  U.  N.  E.
 






From assassin at gladstone.uoregon.edu  Mon Jun  3 19:33:48 1996
From: assassin at gladstone.uoregon.edu (assassin at gladstone.uoregon.edu)
Date: Tue, 4 Jun 1996 10:33:48 +0800
Subject: Arms Trafficker Page Made CNN!
Message-ID: <01I5H4HBQ11I8WW2JK@OREGON.UOREGON.EDU>


Do you have the cnn story on .../arms-trafficker/?
Just what mention of it was made?
-A.





From Clay.Olbon at dynetics.com  Mon Jun  3 19:44:06 1996
From: Clay.Olbon at dynetics.com (Clay Olbon II)
Date: Tue, 4 Jun 1996 10:44:06 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <ADD8D05B-64C27@193.239.225.200>



On Mon, 3 Jun 1996, TT <apache at quux.apana.org.au> wrote:
>I think it is actually easy to use, although granted others may not; but 
>that people tend not to use it as a matter of course (and it is my belief 
>this is a desireable thing) due too the time taken to manually sign mail 
>or sign and encrypt. Lets face it the average user has trouble with a 
>dos command prompt and until there is a point and click emailer easily 
>available most people just won't try PGP for email. 

Most people I have encountered don't use PGP because of the initial
learning curve, more than the overall ease of use.  I work in a small
office that is separate from corporate HQ.  I have been trying for over a
year to convince people to use PGP for intra-office communication.  What I
have found is that for people within the office, it is fairly easy -
hands-on instruction works well.  Convincing folks at HQ has been a royal
pain however.  Most of the problem appears to be the "you mean I have to
learn new software?" variety.  Once I have coached someone over the
"knowledge hump" (often by phone), they tell me that using pgp is pretty
easy.  <disclaimer> We use Eudora Light for the Mac, YMMV </disclaimer>. 
The trick is convincing the user that the benefits associated with using
pgp are greater than the initial pain.  This is something I have only
accomplished with a few people.  

This educational process will continue to be the stumbling block for
widespread use until there is truly seamless encryption.  My fear is that
seamless encryption will be weak; witness the widespread use of 40bit
Netscape and the supposedly 40bit default behavior for S/MIME.  I think
that export controls are a driver towards weak defaults.

OK, that last part was a WA tangent from my "ease of using pgp" thread. 
It's late and I'm hungry.  Sue me.

	Later,
	Clay


---------------------------------------------------------------------------
Clay Olbon II            | Clay.Olbon at dynetics.com
Systems Engineer         | ph: (810) 589-9930 fax 9934
Dynetics, Inc., Ste 302  | http://www.msen.com/~olbon/olbon.html
550 Stephenson Hwy       | PGP262 public key: on web page
Troy, MI 48083-1109      | pgp print: B97397AD50233C77523FD058BD1BB7C0
                     TANSTAAFL
---------------------------------------------------------------------------






From frantz at netcom.com  Mon Jun  3 20:09:37 1996
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 4 Jun 1996 11:09:37 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
Message-ID: <199606032229.PAA17614@netcom7.netcom.com>


At  3:18 PM 6/3/96 -0400, Perry E. Metzger wrote:
>Black Unicorn writes:
>> There is a simple solution to avoiding liability.  Don't trade in your 
>> own company's stock.
>
>In reality, of course, you are fairly safe so long as no one is
>looking for your head and you aren't trading based on company
>secrets. However, in theory, its possible to prosecute almost anyone.

I hope insider trading never applies to the Company Stock Purchase plan or
Stock Options.  Otherwise they will kill the goose that lays Silicon
Valley's golden egg.  (I am always paranoid when the rules are vague and
the penalties draconian.)


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From unicorn at schloss.li  Mon Jun  3 20:35:05 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 4 Jun 1996 11:35:05 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606031918.PAA05670@jekyll.piermont.com>
Message-ID: <Pine.SUN.3.91.960603183738.20627A-100000@polaris>


On Mon, 3 Jun 1996, Perry E. Metzger wrote:

> > There is a simple solution to avoiding liability.  Don't trade in your 
> > own company's stock.
> 
> In reality, of course, you are fairly safe so long as no one is
> looking for your head and you aren't trading based on company
> secrets. However, in theory, its possible to prosecute almost anyone.

Both points conceeded.

> > Such restrictions have existed for decades.  Why are you so stunned?
> 
> I guess this is all obvious to wall streeters like me, who live day to
> day with yellow xeroxed sheets being mass distributed to all employees
> informing us of the names of 150 companies that the firm has had
> peripheral dealings with recently that we aren't allowed to trade for
> some indeterminate period of time. People who don't live in regulatory
> paranoia land often just don't get that the SEC's regulatory authority
> is broad, based on very vague statutes, and capriciously
> applied. Thats reality, folks. I suppose since most people have never
> experienced it they don't understand what it's like....

For facinating discussions of why insider trading is actually good for 
the market, See e.g., Henry Manne, Insider Trading and the Stock Market 
(1966); Michael P. Dooley, Enforcement of Insider Trading Restrictions, 66 
Va.L.Rev 1 (1980); James D. Cox, Insider Trading and Contracting: A 
Critial Response to the "Chicago School," 1986 Duke L.J. 628 (1986); 
Kenneth E. Scott, Insider Trading: Rule 10b-5, Disclosure and Corporate 
Privacy, 9 J. Legal Stud. 801 (1980); Dennis W. Carlton & Daniel R. 
Fischel, The Regulation of Insider Trading, 35 Stan.L.Rev 857 (1983).

I'll sum up the general arguments for and against insider trading if 
there is enough interest.

> Perry

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From shamrock at netcom.com  Mon Jun  3 20:35:42 1996
From: shamrock at netcom.com (Lucky Green)
Date: Tue, 4 Jun 1996 11:35:42 +0800
Subject: NRC Session Hiss
Message-ID: <v02120d0badd919d1ddb3@[192.0.2.1]>


At 15:58 6/3/96, Raph Levien wrote:

>   Basically, an exportable S/MIME client can transmit messages up to
>1024/40 bit RSA/RC2 (or RSA/DES), and receive messages up to 512/64 bit
>RSA/RC2 (or RSA/DES, but in the latter case I would imagine it's actually
>restricted to 512/56 because of the keysize of DES). Note that the
>asymmetry actually points in different directions for the public and
>symmetric keysizes.

What will be the maximum keysize for a domestic encryption client? It it is
larger than 1024 bits, there will be interoperability problems with foreign
clients. If the domestic client is limited to 1024 bits, it would set a bad
precedence, since it would effectively require that the encryption key is
smaller than the largest signature key.


Disclaimer: My opinions are my own, not those of my employer.

-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.







From unicorn at schloss.li  Mon Jun  3 20:38:26 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 4 Jun 1996 11:38:26 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <add71e4c06021004bdfb@[205.199.118.202]>
Message-ID: <Pine.SUN.3.91.960603144035.8479A-100000@polaris>


On Sun, 2 Jun 1996, Timothy C. May wrote:

> At 4:30 PM 6/2/96, Martin Minow wrote:
> >>
> >>One of the oldest tricks for running a stock up (or down) is
> >>to put rumor teams on elevators in the financial district of
> >>major cities.
> >
> >It would be more efficient to talk about the rumor on a cellular
> >phone.  Probably make a nice sting scenario, too.
> 
> An interesting example, but I'm having a hard time figuring out who has
> committed a crime, even by SEC rules.
> 
> Namely, are the people "talking up" a stock committing a crime? Even if the
> SEC forbids this (under defined circumstances and for defined persons, as
> most of us are not covered by any such laws), how can talking over a
> "putatively secure" cell phone be construed as talking up a stock?

If it's in relation to a tender offer, they are in deep.  (As, for 
example, if they were hiking up price to deter a hostile aquisition).

[...]

> (To elaborate on this: I was never classified as an "insider" during my
> time at Intel, and I certainly bought and sold the stock based on what
> products and news I knew was coming out or what rumors I'd heard. Only a
> select group of executives and staff in the specific departments generating
> earnings announcements, auditing, etc., were covered. And senior executives
> are covered by various rules about trading stocks. And family members and
> friends may be covered, if they learn of "inside" (in the SEC sense)
> information. But ordinary people, even employees of a company, are not
> considered to be "insiders" and hence are not covered by insider trading
> laws.)

Incorrect.

I direct you to Dirks v. Securities and Exchange Commission, 463 U.S. 646 
(1983).

Specifically footnote 14:

"Under certain circumstances, such as where corporate information is 
revealed legitimately to an underwriter, accountant, lawyer, or 
consultant working for the corporation, these outsiders may become 
fiduciaries of the shareholders....  When such a person breaches his 
fiduciary relationship, he may be treated more properly as a tipper than 
a tipee...."

This circumstance is classically refered to as a "footnote 14 insider."

It has been held to apply to lower level employees within the corporation 
who "knowingly trade based on material non-public information acquired by 
virtue of their position within the company."

After 1983, Mr. May may have committed a crime.

The case against Mr. May would be strengthened if a court were to accept 
a misappropriation theory.  (In short, that the employee used information 
intended for corporate purposes [development, etc.] in order to trade 
stock for his gain).  Misappropriation theory, where it is accepted, 
fills in the needed "fraud" element in rule 10b-5 which would impose 
liability on a trader and which is otherwise absent in the case of an 
employee trading as Mr. May has indicated.  While misappropriation theory is 
waning, it is not entirely dead.

Remember that restrictions on senior management as per trading in the 
company's stock are to prevent director and corporate liability.  No one 
cares much if a lower level employee gets zapped because it doesn't open 
the door for greater corporate liability like it would for senior 
management.  Further, you don't want to have to circulate a memo to the 
whole company as to when trading is restricted.  That would be asking for 
trouble.

Be sure to distingiush between corporate policy with regard to 
employee trading and legality.

> So, the only way I can imagine the cell phone case leading to an insider
> trading charge is if the cell phone users _knew_ that the cell phones were
> not secure, and _planned_ to have their conversations overheard. The people
> doing the intercepting could be charged under one of the laws covering
> unauthorized interception of cell phone conversations, but probably not for
> insider trading.

Or if they were artifically hiking up the price to defend against or 
interefere with a tender offer.

> --Tim May

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com







From andrew_loewenstern at il.us.swissbank.com  Mon Jun  3 20:48:28 1996
From: andrew_loewenstern at il.us.swissbank.com (Andrew Loewenstern)
Date: Tue, 4 Jun 1996 11:48:28 +0800
Subject: Java Crypto API questions
In-Reply-To: <199606031746.KAA01680@springbank.eng.sun.com>
Message-ID: <9606032248.AA00623@ch1d157nwk>


Benjamin Renaud br at doppio.eng.sun.com writes:
>  Policies are statements like:
>
>  "code endorsed by any one of the following signatures (say
>  three of my friends) can access the public part of my file
>  system"
>
>  This is hard. It's probably not going to make it in the first
>  release.  The simple first pass is to say "code signed by x,
>  y, and z" can do whatever it wants.

Good thing Sun is spending millions pushing a brand-new language down our  
throats so we can do nothing we couldn't already do.  After all the hype  
about security, security models, and sandboxes we get signed applets that can  
do anything.  What a let-down.

Currently, the only safe way to run untrusted Java code is to not run it.   
This probably isn't going to change (see cpunks archives for reasons).  If  
Sun cannot prevent untrusted code from doing nasty things, how can they  
prevent code empowered with certain capabilities from doing things they are  
not certified to do?  It now seems that all the effort, time, and money to  
move towards Java over another OO language was a waste in a way since it no  
longer appears to have any security advantages.  Ignoring security, Java is  
not a bad language at all, but it still has distinct disadvantages over some  
of the possible alternatives (mainly immaturity, no dynamic message  
invocation, interpreters still not ready for prime-time).

I wonder if Borland realizes that instead of putting so much time, effort,  
and money into someone else's product, Java, they could have just implemented  
signed Delphi code and gotten basically the same thing.  I guess they didn't  
think of it in time.


You have to hand it to Sun/JavaSoft's marketing team, though.  While others  
have tried, few have been so successful at creating an "industry standard"  
from nothing.  Indeed, the only reason left to use Java is "because everyone  
else is into it..."


andrew





From perry at piermont.com  Mon Jun  3 20:55:00 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 11:55:00 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <2.2.32.19960603200355.0075cc58@popserver.panix.com>
Message-ID: <199606032022.QAA05790@jekyll.piermont.com>



Duncan Frissell writes:
> Though if I trade based on my non public knowledge that the Gray
> Aliens will strike at Midnight on 31 December 1999, I am probably
> safe.

I'm not so sure. If you got access to advance information on
Department of Commerce or Agriculture reports and traded futures based
on them you'd be in sheep dip. I would suggest checking carefully
before trading that way.

On the other hand, it is not against U.S. law to trade non-US
securities, do foreign exchange transactions, etc, based on non-public
information.

> If info that is too far removed is included then any stock analysis
> system would be illegal.

Heh heh heh heh heh.

The laws are vague and are arbitrarily and capriciously
applied. Technical violations happen constantly. One of the mechanisms
of control the SEC has at its disposal is the fact that almost anyone
in the business they choose to target can probably be thrown in jail
for something or other.

> Note BTW that the Feds lost almost all of the '80s insider trading
> cases that actually went to trial.  They only won 2 or 3 that went
> through the full trial and appeals process.  That is a very poor
> record since prosecutors usually have an 80-90% success rate in
> criminal trials.

If you are talking about the trials associated with the Boesky affair,
most defendants plead guilty rather than face multiple lifetimes in
jail. A few defendants were aquitted at trial.  However, convictions
for insider trading are not particularly rare.

Perry





From frissell at panix.com  Mon Jun  3 21:57:03 1996
From: frissell at panix.com (Duncan Frissell)
Date: Tue, 4 Jun 1996 12:57:03 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
Message-ID: <2.2.32.19960603223725.009fda80@panix.com>


At 05:01 PM 6/3/96 -0400, Michael Froomkin wrote:
>On Mon, 3 Jun 1996, Perry E. Metzger wrote:
>
>[...]
>> Securities laws are extremely complex, extraordinarily broad, and
>> subject to extremely flexible interpretation. I would suggest not
>> attempting to skate a fine line near them -- the ice is very thin.
>
>Damn good advice, if you ask me.
>
>A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)

However, it is becoming a deregulated industry.  Like all the rest.

DCF






From alanh at infi.net  Mon Jun  3 22:10:12 1996
From: alanh at infi.net (Alan Horowitz)
Date: Tue, 4 Jun 1996 13:10:12 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <199606022242.RAA19983@manifold.algebra.com>
Message-ID: <Pine.SV4.3.91.960603173332.27162B-100000@larry.infi.net>


US SEcret Service was always on top of criminal counterfeiting. I make 
that "criminal" distinction becaue there is allegedly a phenomenon of  
low-intensity-warfare going on, with Iran sponsoring more-or-less perfect 
counterfeits of hundred dollar bills.

Criminal counterfeiting was a dangerous game. Secret Service pretty much
knew every individuial/company who was involved in bona fide use of the
relevant papers, inks, engraving/printing equipments, etc., and anyone
ordering any of this stuff from the very limited number of suppliers, was
placed under watch. It's a small world out there, kids.





From br at doppio.Eng.Sun.COM  Mon Jun  3 22:19:48 1996
From: br at doppio.Eng.Sun.COM (Benjamin Renaud)
Date: Tue, 4 Jun 1996 13:19:48 +0800
Subject: Java Crypto API questions
Message-ID: <199606040113.SAA02369@springbank.eng.sun.com>




|>  This is hard. It's probably not going to make it in the first
|>  release.  The simple first pass is to say "code signed by x,
|>  y, and z" can do whatever it wants.
|
|Good thing Sun is spending millions pushing a brand-new language down our  
|throats so we can do nothing we couldn't already do.  After all the hype  
|about security, security models, and sandboxes we get signed applets that can  
|do anything.  What a let-down.

Just to clarify a couple of things. We're not pushing anything down
your throat. You are still perfectly free to use Visual C++ if that is
what you prefer. A statement to the effect of "is probably not going to
make it in the first release" means the following things:

- If we can, we will make it happen (in some form) in the first release.
We're just trying to set expectations realistically.

- We think that the ability to let applets have free reign is
useful,and since that is easier, we are certain to put it in the first
release.

- No matter what we do, we must address some very thorny issues of key
management and user trust model, so doing this will be useful. 

|Currently, the only safe way to run untrusted Java code is to not run it.   
|This probably isn't going to change (see cpunks archives for reasons).  If  
|Sun cannot prevent untrusted code from doing nasty things, how can they  
|prevent code empowered with certain capabilities from doing things they are  
|not certified to do?  It now seems that all the effort, time, and money to  
|move towards Java over another OO language was a waste in a way since it no  
|longer appears to have any security advantages.  Ignoring security, Java is  
|not a bad language at all, but it still has distinct disadvantages over some  
|of the possible alternatives (mainly immaturity, no dynamic message  
|invocation, interpreters still not ready for prime-time).

The important thing to remember is that we're not going to come out
with an implementation and claim to have solved the capabilities model
problem.

We're taking a first step at using signatures with Java for security
purposes, but this is only a first step. We remain fully committed to
finer and more powerful security models. Note that an application
written to the Java platform will be able to implement security
policies based on digital signatures which are not fully permissive.

Cheers,
-- Benjamin





From m5 at vail.tivoli.com  Mon Jun  3 22:26:22 1996
From: m5 at vail.tivoli.com (Mike McNally)
Date: Tue, 4 Jun 1996 13:26:22 +0800
Subject: Java Crypto API questions
In-Reply-To: <199606031746.KAA01680@springbank.eng.sun.com>
Message-ID: <31B37DBA.5C8B@vail.tivoli.com>


Andrew Loewenstern wrote:

> >  This is hard. It's probably not going to make it in the first
> >  release.  The simple first pass is to say "code signed by x,
> >  y, and z" can do whatever it wants.
> 
> Good thing Sun is spending millions pushing a brand-new language down our
> throats so we can do nothing we couldn't already do. 

How can you do this currently?  (With applets in browsers, I mean.)

> After all the hype about security, security models, and sandboxes we get
> signed applets that can do anything.  What a let-down.

Well, it's not perfect, but I hold out the hope that real support for some
capability assignments can be provided by the time a serious infrastructure
of certificate authorities of some sort can develop.

Note also that this is not only a Sun issue; Netscape has to support it
all too.  Currently, note that the HotJava browser already allows some
configuration to the Security Manager that Netscape doesn't.

> Currently, the only safe way to run untrusted Java code is to not run it.
> This probably isn't going to change (see cpunks archives for reasons).  If
> Sun cannot prevent untrusted code from doing nasty things, how can they
> prevent code empowered with certain capabilities from doing things they are
> not certified to do? 

Huh?  They're explicitly saying that they won't make any attempt to prevent
signed applets from doing anything they want to do, if you tell the thing
that you trust a particular certificate.  Thus, you are now able to grant
complete trust to an applet with a given certificate.  You can't readily
do that now.

This means that if you trust the certificate system itself, then allowing
an applet from Borland or Microsoft or IBM to do whatever it wants to your
machine is about the same risk as allowing a program on CD-ROM from Borland
or Microsoft or IBM to do whatever it wants to your machine.

> It now seems that all the effort, time, and money to
> move towards Java over another OO language was a waste in a way since it no
> longer appears to have any security advantages. 

I think you need to explain this; it seems to have nothing to do with
the issue at hand.

> I wonder if Borland realizes that instead of putting so much time, effort,
> and money into someone else's product, Java, they could have just
> implemented signed Delphi code and gotten basically the same thing.  I 
> guess they didn't think of it in time.

Based on the state of the Borland Java stuff I've seen, I wouldn't have 
very high expectations in the Delphi department.

> You have to hand it to Sun/JavaSoft's marketing team, though.  While others
> have tried, few have been so successful at creating an "industry standard"
> from nothing.  Indeed, the only reason left to use Java is "because everyone
> else is into it..."

And for some applications (webish ones included or not) that's actually
a very good reason.  Business is business.

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
       m5 at tivoli.com * m101 at io.com          *
      <URL:http://www.io.com/~m101>         * suffering is optional





From drosoff at arc.unm.edu  Mon Jun  3 22:27:17 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Tue, 4 Jun 1996 13:27:17 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <1.5.4.16.19960603232043.4907661e@arc.unm.edu>


Quoted text originated from tcmay at got.net

-----BEGIN PGP SIGNED MESSAGE-----

At 07.45 PM 6/1/96 -0700, you wrote:

>Personally, I liked my "religious exemption" example. The Baal worshippers
>can claim that they are engaging in their religion by grokking the
>darkness. If picked up and held, they can claim they are "being held
>without Baal."

Isn't that a little far afield to go for a pun? :)

>Most of the ordinances, including the one here, specifically state that
>"blanket permission" by parents is not acceptable. They want _specific_
>reasons for being out after curfew.

"To whom it may concern:
My son, David Rosoff, is out of our house on this June 3, 1996, Monday night,
to party with friends, cruise Central Avenue, and partake of the spores that
grow of the earth.

Signed,

A. Parent"

>(It's this taking control from both the kids and their parents and putting
>it in the hands of cops that really bugs me.)

"Me too." (Standard non-AOL disclaimer applies.)

>By the way, if being out after curfew is breaking the law, can I make a
>"citizen's arrest" of some of those nice young chicas in Watsonville?

No comment. :) Really.

- -------------------------------------------------------------------------------
David Rosoff (nihongo o chiisaku dekimasu)                  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
- ---
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbNtGBguzHDTdpL5AQGK3QQAhX6CSiEr3z8puAhwDYlbayF7dBEUMtsk
DygPCjL2lJ5d//WrEZxKm6ku/PoDDF9NcGqKBlHhuMYzCfEkOzdcv1idQ6lrWoua
ONM3fdGSJt46qplX4UuSQSyLhKqvAwaijw7QDPCAedEFJsVVBPaDT1vpxDOFdylO
UJBwLDjYa4k=
=+KQb
-----END PGP SIGNATURE-----






From qut at netcom.com  Mon Jun  3 22:28:13 1996
From: qut at netcom.com (qut at netcom.com)
Date: Tue, 4 Jun 1996 13:28:13 +0800
Subject: No Subject
Message-ID: <199606040046.RAA17821@netcom6.netcom.com>


ncr terminals are the most 31173 D0Dz





From jimbell at pacifier.com  Mon Jun  3 22:31:13 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 4 Jun 1996 13:31:13 +0800
Subject: Java Crypto API questions
Message-ID: <199606032326.QAA09260@mail.pacifier.com>


At 01:13 PM 6/3/96 -0400, Simon Spero wrote:
>On Mon, 3 Jun 1996, jim bell wrote:
>> 
>> But you haven't explained why somebody can't export JUST the signature.  You 
>> know, import the software, have Sun sign it domestically, strip off everything that isn't a 
>> signature, and export the signature.  Append it to the un-imported code 
>> outside the country.
>
>Ancillary device... It's pretty clear cut.


Sure about that?  Is a microprocessor an "ancillary device"?  A DRAM module? 
 A hard disk?  How about an operating system, which stores and retrieves 
data for an encryption program?  How about a BIOS?  What about a keyboard?  
A video display?  I think that any definition of "ancillary device" which is 
so broad as to include signatures just about has to include any any of these 
things too, but it won't be considered such because the government has 
already lost the battle on hardware exports.

A signature is just that:  A signature.  It doesn't encrypt or decrypt.  It 
doesn't even ALLOW the system it's in to encrypt or decrypt, because there 
are numerous encryption programs written that have no need for such a 
signature.  If no program existed which _used_ that signature, nobody would 
think twice about exporting it.

The fact is, it is LEGAL to import encryption code into the US.  It is LEGAL 
to generate an hash of that code, and it is LEGAL to export that hash.  To 
believe otherwise is to broadly expand the scope of export laws far beyond 
what they were intended to mean.

Jim Bell
jimbell at pacifier.com





From drosoff at arc.unm.edu  Mon Jun  3 22:31:39 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Tue, 4 Jun 1996 13:31:39 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <1.5.4.16.19960603232047.490713e0@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

At 10.23 AM 6/2/96 -0800, jim bell <jimbell at pacifier.com> wrote:

>This, the curfew situation, is yet another of the reasons I'd favor "playing 
>hardball" with the government.  I'm very much against discriminatory 
>enforcement, but on the other hand I don't think my liberty should be 
>dependent on getting an organization like the ACLU to look out for and 
>complain against discrimination against me. 

Are you then also in favor of killing, ruthlessly and brutally, not to
mention somewhat randomly, both the police and the ACLU?

- -------------------------------------------------------------------------------
David Rosoff (nihongo o chiisaku dekimasu)                  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
- ---
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbNx2xguzHDTdpL5AQE6bgQAreE5ikGCKxsyjue0fEcKWtmmGU6o2WiU
zTXD2Py8y395NVQFuSlrnWSJ4eKmIpePv1oZjgd7sE9wcpKjhHwHq2Fs/ZmsdEb2
CZxPY1qexpxolo0k8uFNbWvqxs/3ieOa0BzE7jmp0jyopejq2OjXheE1v3zGGKtt
OBSb4vADydw=
=X8Zs
-----END PGP SIGNATURE-----






From joelm at eskimo.com  Mon Jun  3 22:38:14 1996
From: joelm at eskimo.com (Joel McNamara)
Date: Tue, 4 Jun 1996 13:38:14 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <199606040047.RAA12318@mail.eskimo.com>


Well for crypto-novices that use Windows, I'm hoping life will get a whole
lot easier.

I'm putting the finishing touches on the next release of Private Idaho
(http://www.eskimo.com/~joelm/pi.html).  Aside from some new "power-user"
options (working with Lance to support a DOS version of Mixmaster), the next
release is going to be targeted at all those folks who are intimidated by
PGP.  This includes features like an auto-install app, expert and novice
modes, and a series of wizards for stepping the user through common tasks
(I'm sure the name "wizards" is trademarked by MS, so they won't be called
that).  Also included will be something called PGP QuickStart.  This utility
will hand-hold a user through the entire process of downloading PGP from the
Net, and installing and configuring it.

I just wrote an essay for one of the on-line magazines on "unintentional
crypto-elitism."  One of my points was that decent crypto technology is now
in place, and one of the next evolutionary steps towards wide-scale
acceptance is implementing simple and easy user interfaces.  Developers of
public domain and commercial crypto apps really need to take this to heart.

Joel

BTW - I'm guessing Private Idaho version 2.7 will be available within the
next two weeks.  Send me e-mail (joelm at eskimo.com) with PI_LIST as the
subject to get on the notification list (people on the list will be able to
download about a week or so before it goes into wide-scale release).






From unicorn at schloss.li  Mon Jun  3 22:43:11 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 4 Jun 1996 13:43:11 +0800
Subject: IR Cameras
In-Reply-To: <199606030534.AAA13745@einstein.ssz.com>
Message-ID: <Pine.SUN.3.91.960603192706.20627D-100000@polaris>


On Mon, 3 Jun 1996, Jim Choate wrote:

> 
> Forwarded message:
> 
> > Date: Sun, 2 Jun 1996 20:19:34 -0700
> > From: tcmay at got.net (Timothy C. May)
> > Subject: Re: opinions on book "The Truth Machine"
> > 
> > Today's newspaper (SJ Mercury News) carried a long article about
> > increasingly ubiquitous video surveillance cameras, and singled out the
> > U.K. as a place that is leading. Apparently even small villages have 50 or
> > more cameras scattered around...men have been arrested for urinating in
> > bushes outside pubs, caught by the infrared pickups (I hadn't thought about
> > the cameras being IR, but this makes sense, as a large fraction of street
> > crimes take place in dark or semidark areas).
> 
> Here in Austin, TX there is at least 1 IR camera located at the top of the
> police building downtown (8th & IH-35). Many intersections have stoplight
> synchronized cameras for getting license plates of red light runners (eg N.
> Lamar & 51st). I know the output of the cameras is cabled off-pole (can see
> the cables) to a NEMA style box. Don't know the format from there. It would
> be no technological leap to buy cable channels and mux the pictures back to a
> centralized site. This city is lousy with cable and fiber and the city
> bought in from the get-go with a project called I-Net in the mid-80's.


Defense to all photo plate takers is best found in the back of Car and 
Driver in the form of a polarized plastic plate that is opaque at angles 
greater than about ten degrees.

> 
>                                                      Jim Choate
> 
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From drosoff at arc.unm.edu  Mon Jun  3 22:43:46 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Tue, 4 Jun 1996 13:43:46 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <1.5.4.16.19960603232038.32a74aee@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

At 09.59 PM 6/1/96 -0400, Duncan Frissell <frissell at panix.com> wrote:

>I'm afraid that some courts have explicitly held that "the child does not
>have a right to liberty but only a right to custody."  That is old law,
>however.  Kids have lost many rights recently too including gun rights, etc.

I've known for a while that I have no rights as a minor. [ironic smilie]

>Of course curfew laws only control the inarticulate and scruffy.  Well
>dressed children (coat and tie for the boys dress or suit for the girls) who

I'll wear a suit if it means I won't get picked up ... :)

>can claim that they are out doing tons of protected things like work and
>school and worship and political campaigning and "trying to save street
>children for Jesus" will not be picked up.  They can also say things like
>"Ossifer, I'm peaceably assembling to petition the government for redress of
>grievances.  It's in the First Amendment.  You could read about it and
>everything."

You suggest that we minors stand up for ourselves? How odd. I'm sure no one
has ever thought of that before, President Clinton especially. Since any
nationally imposed curfew wouldn't have a leg to stand on in the first place,
this can only improve the situation.

>Home schooled children face this problem frequently and can usually find
>something to say.  Kids older than 15 or so can claim to be "emancipated
>minors."  Parents can emancipate their children by signing a simple
>declaration to back up this claim.  A good idea in any case.

This sounds interesting. What are the particulars of being an emancipated minor?

>"Whose children never got stopped by cops because at 14 they passed for 21.
>Clothing and bearing alone can do it."

I wish I were so lucky. At 15 I seem to pass for ... 12. I guess if the cops
read from right to left ...

- -------------------------------------------------------------------------------
David Rosoff (nihongo o chiisaku dekimasu)                  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
- ---
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbNsyxguzHDTdpL5AQGvfwP/f2PDE5JPiczwY/5EFt/ziT9UePbcxCV0
UCbYdkbl9hoNlMphUu+O+zneGntCVOIiEoPZLTpK35TYFgA/MCOQhuiCYnvbInMo
pZlmnTvyoUI1rkHTUzf2cHRg1+18ieJqDDqBqBb58ZxaLxxJ1crUDrL+QHC/QZE9
mAiLT9tnwgc=
=/+GV
-----END PGP SIGNATURE-----






From qut at netcom.com  Mon Jun  3 22:51:11 1996
From: qut at netcom.com (qut at netcom.com)
Date: Tue, 4 Jun 1996 13:51:11 +0800
Subject: No Subject
Message-ID: <199606040043.RAA17449@netcom6.netcom.com>


list cypherpunks





From WlkngOwl at unix.asb.com  Mon Jun  3 23:00:45 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 4 Jun 1996 14:00:45 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <199606040228.WAA17430@unix.asb.com>


On  3 Jun 96 at 11:27, Bruce Baugh wrote:

> Date:          Mon, 03 Jun 1996 11:27:33 -0700
> At 04:33 AM 6/3/96 +0000, Deranged Mutant wrote:
> 
> >In part because it's not well integrated with mailers.  That could 
> >change with a PGP3 DLL.
> 
> I have a growing feeling that PGP 3 is never going to happen. Or that if it

I'm soft-of having that feeling too.  Or what's going to happen is 
that enough people will get impatient and international versions will 
start to appear.

> does, it will happen only after the passage of more draconian anti-privacy
> laws, and the guys working on it will be forced to include sundry backdoor
> stuff or drop it altogether.

More likely drop it altogether, or be openly admit they were forced 
to include GAK (people will want the source, anyway).

> I suspect someone could do quite nicely by going ahead and developing a
> 2.6.2 or 2.6.3 DLL.

There's been talk.  But just talk.


Rob.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From nelson at crynwr.com  Mon Jun  3 23:03:08 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Tue, 4 Jun 1996 14:03:08 +0800
Subject: The problem with encryption, period.
Message-ID: <19960604020034.30122.qmail@ns.crynwr.com>


The problem with encryption is that 1) it takes effort, and so 2) you
must have a non-empty threat model.  With (2), you have to trust that
you're really encrypting, which takes 3) a certain sense of paranoia.

For most people, all three are lacking, which is why proposals like
s/mime are succeeding.  One button, no security, encryption.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From tcmay at got.net  Mon Jun  3 23:20:22 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 4 Jun 1996 14:20:22 +0800
Subject: 
Message-ID: <add8f03a0b02100404cb@[205.199.118.202]>


At 12:46 AM 6/4/96, qut at netcom.com wrote:
>ncr terminals are the most 31173 D0Dz

Kenneth, what is the frequency? Kenneth, what is the frequency?


--John Hinckley, First Disciple of AP









From perry at piermont.com  Mon Jun  3 23:22:19 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 14:22:19 +0800
Subject: Java
Message-ID: <199606040222.WAA06345@jekyll.piermont.com>



I've been rather hard on Java here lately.

I'd like to state, for the record, that I have nothing against the
folks at Sun. They are good, smart people, and I'm sure they mean
well and aren't in on some evil plot. However, that doesn't make Java
a good idea.

For at least twenty or more years, people have known that for the
ultimate in multimedia email or what have you all you would need to do
is make the recipient execute a program that you sent them. This
obviates all the questions of having to figure out what sort of things
you would want to send -- if you can execute a program, you can do
anything. Unfortunately, this is also so phenomenally obvious a
security problem that no one ever proposed it as anything more than a
joke -- until now.

Sun is, unfortunately, suffering from a substantial hubris problem. As
I have noted, the original Java applet security model and all the
followups have had exactly the same problem -- they depend on perfect
implementation of every element of the security model for the security
to work, instead of having the realistic and conservative assumption
that portions of the model will be misimplemented, and designing for
defense in depth.

Beyond that, however, they have created the ultimate hype
monster. Java is a neat idea looking for a good application. I use the
web all day long and I have yet to see a good use for Java. We have,
essentially, mortgaged our system security for almost nothing better
than the occassional gee whiz animation that could have been
implemented with a safe graphics description format instead of a
turing equivalent language.

Again, I don't hate the Sun people or hold any animosity towards
them. However, I will point out the lesson that any good student of
Greek Tragedies could tell you -- the gods punish hubris, and severely.

Perry





From ichudov at algebra.com  Mon Jun  3 23:22:36 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Tue, 4 Jun 1996 14:22:36 +0800
Subject: Anonymous stock TRADING (was Saw this on CNN: )
In-Reply-To: <199606032018.NAA03658@toad.com>
Message-ID: <199606040240.VAA31145@manifold.algebra.com>


rick hoselton wrote:
> 
> You might also want to ask Ivan Boeskey(sp?).  I think he's out of 

Boesky.

Which brings up another ignorant question: suppose that I am a 
corporate officer who does receive substantial "insider" information,
for example results of audits, before they become public. What would
prevent such an insider from creating a phony offshore trading company,
and sending orders to that company using cypherpunks technology? 

If we suppose that the agent executing trades (which may even be a
computer, afaik) is trustworthy, the methods to deliver trade orders are
reliable, the computers are protected from van eyck monitoring, and the
officer is not spending too much money openly, what is there to prevent
or prove such violations of the law?

For example, the trading computer can have pseudonym address
xyz at alpha.c2.org, forwarded through a chain of remailers to
place_order at offshore.com.xx, and the officer sends pgp signed and
encrypted trade orders to that address, again through remailers.  What
besides traffic analysis is there to stop such violations?

Thanks,

	- Igor.





From alc at trillion.demon.co.uk  Mon Jun  3 23:22:47 1996
From: alc at trillion.demon.co.uk (alc)
Date: Tue, 4 Jun 1996 14:22:47 +0800
Subject: Audit & Security reviews
Message-ID: <1578@trillion.demon.co.uk>


UNIX  and  DEC VMS Security Reviews

I would like to take this opportunity to tell you about two of our audit 
software tools, PCUA and PCDA.

PCUA and PCDA are PC based software tools designed to review the security of 
Unix or DEC computers using only the stand-alone PC in your office. There is no 
need for connections to the system, user-IDs or even a knowledge of computer 
security.  Simply obtain a copy (usually on a floppy disk) of key files from 
the system under review, load these onto your PC and let our tools do all the work.

These packages are ideal for use by auditors, security officers and computer 
system managers - anyone who takes computer security seriously.  The programs 
produce a wide variety of reports which show the findings, explain the 
implications of the problems and then make recommendations about how to improve 
security.  Reports range from a full, detailed report which is user-definable 
to a brief list of the problems found.

Both packages are evolving products and we continue to add new tests to them, 
as well as keeping up to date with the latest releases of the operating systems.  
If you would like further tests added, we would be pleased to include these in 
our next release.

To obtain more information or  demonstration disks then please contact us.

Thank you for taking the time to look through this email.


Alastair Coxall
Technical Director

TRILLION SOFTWARE Ltd
The Firs,  Broadwalk,  Cranleigh,  Surrey GU6 7LS,  England

Tel: +44 1483 274001   
Fax: +44 1483 274017   

Email: alc at trillion.demon.co.uk






From perry at piermont.com  Mon Jun  3 23:23:04 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 14:23:04 +0800
Subject: Java Crypto API questions
In-Reply-To: <199606040113.SAA02369@springbank.eng.sun.com>
Message-ID: <199606040200.WAA06306@jekyll.piermont.com>



Benjamin Renaud writes:
> >Good thing Sun is spending millions pushing a brand-new language
> >down our throats so we can do nothing we couldn't already do.
> >After all the hype about security, security models, and sandboxes
> >we get signed applets that can do anything.  What a let-down.
> 
> Just to clarify a couple of things. We're not pushing anything down
> your throat. You are still perfectly free to use Visual C++ if that is
> what you prefer.

Why, thank you. However, you haven't answered Mr. Lowenstern's point.

Once you start signing Java apps, and executing them based on the
trust implied in the signature, you really didn't need Java in the
first place. You could just download and execute programs of any sort.

Frankly, I really dislike the idea of my users downloading arbitrary
apps all day long onto their workstations and running them. I'm not
sure it really buys you too much, either, other than loss of security.

> - We think that the ability to let applets have free reign is
> useful,

Lots of things are useful. Security often "gets in the way". However,
as mature engineers operating in an environment where many users have
highly mission critical equipment, some of us try to be more
responsible than that.

> The important thing to remember is that we're not going to come out
> with an implementation and claim to have solved the capabilities model
> problem.
> 
> We're taking a first step at using signatures with Java for security
> purposes, but this is only a first step. We remain fully committed to
> finer and more powerful security models. Note that an application
> written to the Java platform will be able to implement security
> policies based on digital signatures which are not fully permissive.

Java's security has always lacked defense in depth, continues to lack
defense in depth, probably cannot be retrofitted to gain defense in
depth, and is likely going to continue to be periodically
penetrated. Java security continues to rely on the "all portions of
the system are perfectly implemented" model, which as I have
repeatedly noted in this forum is fundamentally flawed because humans
can never produce perfectly designed and implemented systems. A system
that was built to be failure tolerant would be better, but that isn't
what you have proposed.

I have a great fear. My great fear is that once you've solved the
obvious and stupid problems and hyped how Java has become secure
(which will doubtless make the stock market analysts happy), people
may start to trust Java, and then, without warning, one day the evil
applets on the web pages aren't going to be mere demonstrations any
more but are going to be real nasty things that do stuff like embezzle
money from your brand new funky ecash purse or whatever. At that
point, it will be way too late to do anything because of all the Java
crud pervading the net that all the users will insist on having access
to.

All this, mind you, to get fancy animation on web pages, and damn
little else worthwhile.

Perry





From declan at well.com  Mon Jun  3 23:25:51 1996
From: declan at well.com (Declan McCullagh)
Date: Tue, 4 Jun 1996 14:25:51 +0800
Subject: CWD: "Jacking in from the "One that Got Away" Port
Message-ID: <v01510105add95b2fda0a@[204.62.128.229]>


(By Brock Meeks / brock at well.com / Archived at http://www.cyberwerks.com/)


 CyberWire Dispatch // Copyright (c) 1996 //

 Jacking in from the "One that Got Away" Port:

 Washington, DC -- President Clinton call your spooks, get FBI Director
 Louis Freeh on the phone.   Tell them to order in pizza.  Bill, it's
 going to be a long night.   All your plans to hold the U.S. crypto
 market hostage have just been fucked... and you didn't even get kissed.

 A virtual tactical nuke was hurled into the arcane subculture of
 encryption technology Monday when RSA President Jim Bizdos revealed
 that his company's Japanese subsidiary had developed a monster chipset
 capable of scrambling voice and data real time with a so-called "key
 length" of up to 1024 bits.

 That key length stuff is just so much gibberish to those playing
 without a scorecard, so let me drill down on it for you.  Basically,
 the longer the key length, the harder it is for a message to be broken
 by "brute force" automated attacks.  Current U.S. laws prohibit the
 export of any encryption device with a key length longer than 40-bits,
 or roughly the equivalent of  Captain Crunch decoder ring. For hardcore
 math types, I'm told that a 1024-bit key length is 10 to the 296th
 power more difficult to break than 40 bits.

 Bizdos, speaking during lunchtime at the Electronic Privacy Information
 Center (EPIC) 6th Cryptography and Privacy conference, told how his
 Japanese based company, Nihon-RSA, developed a set of two chips capable
 of scrambling messages at a level that will make the spooks in the
 Puzzle Palace (the National Security Administration) cough up hair
 balls that would make the First Cat Socks envious.

 Bizdos seems to have found crypto's magic bullet;  a legit way to
 essentially give the finger to U.S. export laws for crypto product. For
 years now the White House has been locked into a kind of crypto war.
 The Administration insists that strong encryption products must not be
 exported for fear that "terrorists, child pornographers and drug
 barons" and a rabble of assorted "bad guys" would snag the technology
 and proceed to plot the destruction of the "World As We Know It"... or
 at least Western Democracy, if the inbred Iranians got in line first.

 The White House crypto-fascist team, led by the NSA, FBI and assorted
 military hawks, have offered braindead compromise plans, including
 three versions of the "Clipper Chip."  This is a plan whereby you can
 buy strong locks for your data with the simple caveat that when you buy
 and use the products, you have to put the decoding key "in escrow."
 This way if a law enforcement agency ever has the need to unscramble
 any of your messages -- without you knowing it -- they can simply ask
 for these escrowed keys and have them handed over.  Yes, even your
 local sheriff's department can ask for the keys.

 Now, the government promises it will use this power only for good and
 never for evil.  Honest, that's what they say.  Of course, the Justice
 Department, in writing the rules for getting the keys, totally absolves
 any law enforcement agency of all harm if this power is abused in any
 way. Oh.. and if that power is abused, the sheriff or the FBI or
 fucking Park Police for that matter,  can still use any "evidence" they
 gin up on you.  Honest, I'm not making any of this stuff up.

 So the battle has raged.   The industry has been loathe to develop such
 products only for the American market because the cost of producing
 essentially duplicate products for domestic and foreign markets just
 wouldn't be cost effective.

 So, you and I are stuck having to use some pretty tedious encryption
 technologies, such as PGP (Pretty Good Privacy), which is great, but
 tough to use.  Or we can use the Captain Crunch Decoder ring
 equivalents available off the shelf. In the meantime, other countries
 are happily making and distributing robust encryption technologies, at
 a possible loss of up to $60 billion for U.S. companies.

 In fact, it's a crime even to put a program like PGP on your laptop and
 go overseas.   The State Department calls that "exporting."  The
 government recently dropped a case against Phil Zimmermann, the
 inventor of PGP, after putting him through several hellish years in
 which they threatened to toss his ass in jail.  There Phil would  no
 longer be a threat to society at-large, but instead become a
 "girlfriend" for a 265 pound felon named Spike.   Phil's "crime"??
 That somehow his PGP app had been uploaded on to the Internet and
 whisked around the world.  Phil didn't do it, but the U.S. government
 cried "export violation," anyway, eventually telling him, "Oh, never
 mind."

 So Bizdos, tired of fighting the wars here, enlisted the help of the
 Japanese.   After setting up his Japanese unit, he hired a crack team
 of Japanese crypto experts who essentially "reverse engineered" the
 company's own U.S. crypto product, according to Kurt Stammberger, RSA
 director of technology marketing.  It was a brilliant move.   Bizdos
 can't be slammed by the State Department for violating crypto export
 laws because, well, he didn't export a damn thing, except some U.S.
 greenbacks, which of course, could have gone to U.S. cryptographers,
 but let's not quibble about jobs.

 Anyone want to kick around the subject of global competitiveness?

 What's happened here is the Japanese have now trumped the entire world
 on the crypto market.   What's more, Clinton's brain-dead allegiance to
 the FBI, et al., has now allowed the Japanese government, which still
 owns a large share of NTT, which owns a minority share of RSA's
 Japanese subsidiary, to have a lock on the world's strongest encryption
 technology.   Can you say "Remember the VCR"  or "Remember the
 Semiconductor" or how about "Thanks, Bill.  We're fucked."

 The boys in the Pentagon made a stink a few years ago when a Japanese
 company made a play for Fairchild, a top defense contractor.  It was
 feared that the Japanese, by swallowing up the U.S. company, would also
 gain access to technologies vital to the U.S. military.   The deal was
 squashed.  Natch... now it looks like the G.I.'s with the stars on
 their shoulders have just put their spit-shined combat boots up their
 own ass by supporting Clinton and his continued ban on crypto exports.

 "We truly have ceded this market Japanese companies," Bizdos said.
 "It's almost too late to turn it around."  Some 15 COUNTRIES have
 already placed orders for these chips, Bizdos said, adding that the
 Japanese will not build the chips with a key escrow function.

 EPIC Director Marc Rotenberg said he was told by a Japanese
 representative that the country's constitution wouldn't allow key
 escrow because it doesn't allow wire-tapping.  Umm... maybe the
 Japanese just don't have *really* bad guys like the FBI assumes we have
 here.

 What's more, Bizdos says the deal with NTT is "no coup."  He says the
 Germans and French "aren't far behind" in developing similar
 technologies.   The RSA bombshell "fuels the argument that this stuff
 can't be contained in our own borders," said PGP's Zimmermann.

 Just how the relationship between NTT and RSA works out isn't set,
 Bizdos acknowledged.  "They'll pay us a royalty for the chips they
 sell," he said. "We're working it all out."

 Meanwhile, from my office window here in DC I've already counted 17
 Domino's Pizza delivery bikes go screaming by on their way to the White
 House.  Through my telescope I can see the White House balcony;  it
 looks like Bill is sick, like he's just heard some "really bad news."
 And behind him, just inside the double-doors, on a persian rug placed
 there by Warren G. Harding, I think Socks the Cat has just coughed up a
 hairball... or maybe it was Louis Freeh.  From this angle, I just can't
 be sure.

 Meeks out...

 ------------

 Additional reporting by Declan McCullagh (declan at well.com)








From jeremey at forequest.com  Mon Jun  3 23:57:49 1996
From: jeremey at forequest.com (Jeremey Barrett)
Date: Tue, 4 Jun 1996 14:57:49 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <add8d6a4070210044ee4@DialupEudora>
Message-ID: <Pine.BSI.3.91.960603161453.20486C-100000@descartes.forequest.com>


On Mon, 3 Jun 1996, Norman Hardy wrote:

> At 8:01 AM 6/3/96, Perry E. Metzger wrote:
> >Dr. Dimitri Vulis writes:
> ....
> >> This'll happen, probably sooner than later.
> >
> >Why do you assume that? There are plenty of problems that are
> >provably not solvable in non-exponential time even if P=NP. What makes
> >you think this one is going to be solved?
> >
> >.pm
> 
> The "Idea Futures" forum has established odds on this. The current odds are
> currently 60% that a 1024 bit number will be factored by 2010 and 30% that
> a 512 bit number will be factored by 1997.
> 

True, but by that time I'll be able to use 2048 or bigger keys with the same
or better performance as 1024 bit keys now.  As long as factoring is
exponential, you can always make it impossible to factor your keys. 
And I think it will always be exponential.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Jeremey Barrett
Senior Software Engineer			jeremey at forequest.com 
The ForeQuest Company       			http://www.forequest.com/

   "less is more."
		-- Mies van de Rohe.

   Ken Thompson has an automobile which he helped design.  Unlike most
   automobiles, it has neither speedometer, nor gas gage, nor any of the
   numerous idiot lights which plague the modern driver.  Rather, if the
   driver makes any mistake, a giant "?" lights up in the center of the
   dashboard.  "The experienced driver", he says, "will usually know
   what's wrong."

		-- 'fortune` output






From gregmi at galileo.mis.net  Tue Jun  4 00:12:40 1996
From: gregmi at galileo.mis.net (Greg Miller)
Date: Tue, 4 Jun 1996 15:12:40 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <199606030447.XAA22063@manifold.algebra.com>
Message-ID: <31b3a6b6.17653093@pop.mis.net>


On Sun, 2 Jun 1996 23:47:32 -0500 (CDT), you wrote:

>Another question: what happens to the ecash issued by a bank if it's
>secret keys get stolen?

	The same thing that would happen if someone were to steal the keys to
the bank, and the combination to the vault.


"Randomness is in the eye of the beholder" --Numerical Recipes
gregmi at mis.net (Greg Miller)
http://grendel.ius.indiana.edu/~gmiller/





From tcmay at got.net  Tue Jun  4 00:14:16 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 4 Jun 1996 15:14:16 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <add8fe620f021004583b@[205.199.118.202]>


At 9:59 PM 6/3/96, Deranged Mutant wrote:
>On  3 Jun 96 at 11:27, Bruce Baugh wrote:
>
>> Date:          Mon, 03 Jun 1996 11:27:33 -0700
>> At 04:33 AM 6/3/96 +0000, Deranged Mutant wrote:

>> does, it will happen only after the passage of more draconian anti-privacy
>> laws, and the guys working on it will be forced to include sundry backdoor
>> stuff or drop it altogether.
>
>More likely drop it altogether, or be openly admit they were forced
>to include GAK (people will want the source, anyway).

I can't imagine _any_ set of circumstances which would cause Zimmermann,
Atkins (?), Plumb (?), and anyone else who might still be on the PGP
development team to include GAK.

After all, those heartwarming stories about Burmese rebels using PGP to
communicate using laptops in the jungles would then be replaced by:

"16 April 1998, A.P., Rangoon, Burma. Internal Security Minister Bopalong
Myanmoon announced today that rebel communications were intercepted and
decrypted two weeks ago with the cooperation of the International Key
Authority. As a result of this raid, 63 rebels were captured, tried, and
executed. Visiting Rangoon at the time, U.S. Attorney General Louis Freeh
was said to be satisfied that international key escrow was having such
positive effects."

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From llurch at networking.stanford.edu  Tue Jun  4 00:19:33 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Tue, 4 Jun 1996 15:19:33 +0800
Subject: [NOISE] rec.music.white-power failed 592:33033 FYI
Message-ID: <Pine.GUL.3.93.960603204158.28894B-100000@Networking.Stanford.EDU>


The official result, including the votetaker's explanation for the
extraordinary delay (which makes interesting reading), is in
news.announce.newgroups, Message-ID <833851386.24895 at uunet.uu.net>. Or for
people who only use Netscape: 

 http://ww2.altavista.digital.com/cgi-bin/news?plain at msg@31323 at news%2egroups
 news:833851386.24895 at uunet.uu.net

While I think I was one of the people presenting legitimate reasons for
voting no (as opposed to all the "VOTE NO ON NAZIS!" -- see news.groups
archives), I'm actually disappointed that there were only 592 yes votes. I'd
have expected more than the estimated 400 anti-censorship and spam-annoyance
reactions. 

I would urge people NOT to download the 3MB list of votes, as I haven't,
because the vast majority of voters had no clue what they were voting on. 
The majority probably thought it was a secret ballot. 

The poor votetaker definitely deserves a medal, but PLEASE don't send him
appreciative mail;  he's getting far too much already. 

Sent separately to fight-censorship and cypherpunks. Followup discussion, if
any, belongs in news.groups ONLY.

-rich






From WlkngOwl at unix.asb.com  Tue Jun  4 00:22:56 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 4 Jun 1996 15:22:56 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad??
Message-ID: <199606040435.AAA20775@unix.asb.com>


On  3 Jun 96 at 15:18, Jeff Barber wrote:

> I trust it won't stun you to find that many, many large and even small
> corporations -- including my current employer [*NOT* SecureWare, BTW,
> despite the email address] -- actually encourage their employees to buy
> stock by offering stock purchase plans as a benefit of employment.  They
> even make it convenient by deducting purchases from one's paycheck.
[..]

There's a difference between a) buying stock in your employer's 
company generally [above example] and b) buying stock in your 
employer's company because your department is working on something 
that will raise the stock value etc. etc.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From WlkngOwl at unix.asb.com  Tue Jun  4 00:25:19 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 4 Jun 1996 15:25:19 +0800
Subject: Idea 'bout banning the internet
Message-ID: <199606040432.AAA20740@unix.asb.com>


On  3 Jun 96 at 16:16, Blake Wehlage wrote:

> What if in the future a country banned the internet and all things that had
> to deal with it (ie-  telnet, irc). It would be  the "underground" thing.

Depends. If it were run by people like the Khmer Rouge than anybody 
who so much as knows how to use a pocket calculator is better off 
leaving the country.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From perry at piermont.com  Tue Jun  4 00:33:22 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 4 Jun 1996 15:33:22 +0800
Subject: Anonymous stock TRADING (was Saw this on CNN: )
In-Reply-To: <199606040240.VAA31145@manifold.algebra.com>
Message-ID: <199606040353.XAA06812@jekyll.piermont.com>



Igor Chudov @ home writes:
> Which brings up another ignorant question: suppose that I am a 
> corporate officer who does receive substantial "insider" information,
> for example results of audits, before they become public. What would
> prevent such an insider from creating a phony offshore trading company,
> and sending orders to that company using cypherpunks technology? 

Very little. However, there would be a noticable shift in the price of
the stock prior to the public information arriving. This would trigger
an investigation. There would be a very limited number of people able
to get at the inside information, so the pool of suspects would be
small (usually on the order of a dozen people or less), and if you,
say, wanted to spend your money, you might end up being caught.

In other words, anonymity works better when the "crime" isn't visible
to anyone watching the stock market and could be committed by more
than a handful of people.

Personally, I don't object to insider trading, but it can be hard to
get away with depending on circumstances.

Perry





From declan at well.com  Tue Jun  4 00:42:37 1996
From: declan at well.com (Declan McCullagh)
Date: Tue, 4 Jun 1996 15:42:37 +0800
Subject: Markoff in NYT on NTT/RSA chip
Message-ID: <Pine.3.89.9606032128.A10202-0100000@well>


Heh. You read it first in the CyberWire Dispatch Brock and I put out 
earlier tonight. :)

-Declan

---

Japanese Data-Scrambling Chip Renews Debate

      By JOHN MARKOFF
      
     
     
     
     
     W ASHINGTON -- Nippon Telegraph and Telephone Corp. has quietly
     begun selling a powerful data-scrambling chip set that is likely to
     undermine the Clinton administration's efforts to restrict the
     export of the fundamental technology for protecting secrets and
     commerce in the information age.
     
     The existence of the two-chip set, which will have broad potential
     application for local computer networks, the Internet and telephone
     switching networks, was disclosed in Washington in a speech Monday
     at a public policy workshop by the chief executive of RSA Data
     Security, a Silicon Valley-based company that has frequently dueled
     with the administration over its export-control policies.
     

[...]








From snow at smoke.suba.com  Tue Jun  4 00:47:18 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 4 Jun 1996 15:47:18 +0800
Subject: Something that just crossed my mind. Sorry.
In-Reply-To: <199606030519.HAA08335@spoof.bart.nl>
Message-ID: <Pine.LNX.3.93.960603221736.3849C-100000@smoke.suba.com>


On Mon, 3 Jun 1996, Senator Exon wrote:
> At 10:01 AM 5/31/96 -0700, Sandy wrote:
> >At 10:35 PM 5/30/96 -0500, snow wrote:
> >>It is my position (until proven wrong--please) that larger business DON'T
> >>want anonymity. They _want_ to be able to track purchases and use of their
> >>product for several reasons. 

> Let me first claim that I am an employee of a "larger business."  Not
> that unless someone tracks me through the remailers is there any proof
> of that, but accept for now that it's not outside of the realm of
> possibility. 

> I wish I could prove you wrong.  I can inform you that you are correct,
> actually.  There are large retail companies that track sales data on
> credit card account numbers and cardholder names in direct violation of
> any contract you may have with American Express (and possibly Visa and
> others, I have not seen those contracts).  The data they capture is
> pretty impressive.  I'm sure most of you probably get a direct mailing
> or two from them every now and then, based on your shopping habits. 

	Hell, I just paid off all my credit cards, and they are in the
process of decomposing. Credit is evil. Cash is much more difficult to
track, and it is much harder to spend much beyond your means when paying
cash.

> >2)      Big businesses are made up of individuals.
> >        Most individuals would still prefer to have 
> >        their own privacy preserved even if they would 
> >        prefer less privacy for others.  
> 
> All it takes is one well-positioned executive who values profits more
> than his own privacy to say "Capture this personal data" and that data
> gets captured, regardless of who gets fired complaining about it.  Trust
> me.  And I value my job more than I value your privacy, which is why
> this is going out through a remailer. 

	Also remember, people like to live. They like their children to
live. Governments are made of people, Governments start wars and get the
population to go along with it. 
	
	Bigger Corporations are like governments. 

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From dlv at bwalk.dm.com  Tue Jun  4 00:52:32 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Tue, 4 Jun 1996 15:52:32 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <Pine.SUN.3.91.960603144035.8479A-100000@polaris>
Message-ID: <mmaZoD50w165w@bwalk.dm.com>


Black Unicorn <unicorn at schloss.li> writes:
> I direct you to Dirks v. Securities and Exchange Commission, 463 U.S. 646
> (1983).

rev'g 681 F.2d 824 (D.C.Cir.1982), SEC. Rel #34-17480 (Jan 22, 1981).

> Specifically footnote 14:
>
> "Under certain circumstances, such as where corporate information is
> revealed legitimately to an underwriter, accountant, lawyer, or
> consultant working for the corporation, these outsiders may become
> fiduciaries of the shareholders....  When such a person breaches his
> fiduciary relationship, he may be treated more properly as a tipper than
> a tipee...."
>
> This circumstance is classically refered to as a "footnote 14 insider."
>
> It has been held to apply to lower level employees within the corporation
> who "knowingly trade based on material non-public information acquired by
> virtue of their position within the company."

The poor Dirks was a financial analyst who "received information from a
former vice president of Equity Funding that there was widespread fraud at
the company. Dirks confirmed this information with one current and several
former Equity Funding employees and communicated it to five investment
advisors. The five investment advisors sold or directed the sale of large
blocks of Equity Funding stock without disclosure of the information they
had received from Dirks. The SEC found that once Dirks had confirmed the
information by contact with a number of former insiders, it had a
reasonable probability of being true and was, for that reason, material
nonpublic information. The SEC also held that Dirks aided and abetted
violations of Section 10(b) on the part of the investment advisors who were
his tippees. The decision was upheld by the Court of Appeals but _reversed
by the Supreme Court on the grounds that the insider did not breach his
fiduciary duty by disclosure of the information because there was no benefit
to the insider, and thus Dirks did not breach any duty." I.e., Dirks got
away with it, after spending lots of $$$ on shysters.

IANAL, but I see a trend to let insiders get away with trading on material
non-public information in Chiarella v. U.S. (455 US 222 (1980)) followed by
Dirks.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From dlv at bwalk.dm.com  Tue Jun  4 00:59:38 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Tue, 4 Jun 1996 15:59:38 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <Pine.SV4.3.91.960603173332.27162B-100000@larry.infi.net>
Message-ID: <Ra6yoD47w165w@bwalk.dm.com>


Alan Horowitz <alanh at infi.net> writes:
> US SEcret Service was always on top of criminal counterfeiting. I make
> that "criminal" distinction becaue there is allegedly a phenomenon of
> low-intensity-warfare going on, with Iran sponsoring more-or-less perfect
> counterfeits of hundred dollar bills.

I wonder what would happen if someone posted PostScript code for printing
counterfeit money on a color printer? :-)

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From adam at homeport.org  Tue Jun  4 01:02:33 1996
From: adam at homeport.org (Adam Shostack)
Date: Tue, 4 Jun 1996 16:02:33 +0800
Subject: MOSS vs. S/MIME vs. PGP/MIME Matrix (fwd)
Message-ID: <199606040330.WAA26234@homeport.org>


----- Forwarded message from Rik Drummond -----

>From ietf-request at IETF.CNRI.Reston.VA.US  Thu May 30 09:26:53 1996
Message-Id: <v02130500add3465435b8@[199.184.212.213]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 30 May 1996 08:05:48 -0500
To: ietf-ediint at imc.org,
        Electronic Data Interchange Issues <EDI-L at uccvma.ucop.edu>,
        ietf at CNRI.Reston.VA.US
Sender: ietf-request at IETF.CNRI.Reston.VA.US
From: Rik Drummond <drummond at onramp.net>
Subject: MOSS vs. S/MIME vs. PGP/MIME Matrix
Source-Info:  From (or Sender) name not authenticated.


The EDI over Internet (EDIINT) working group will recommend standards which
facilitate "EDI interoperability over Internet  - Now" during the third
quarter of 1996.

Two of the many requirements are the implementation of encryption and
signature for EDI transactions using existing standards/products, such as:
MOSS, S/MIME, PGP/MIME and DMS.

These four standards/products "generally" fit the needs of the EDIINT
effort. We must choose those that best fit our requirements. A Comparison
Matrix compares the products/standards across over 30 technical and
business areas.  Please take time to contribute your expertise to the
effort by commenting on the existing information.

This matrix is the basis for determining which security
products/standards/algorithms to use for EDI over Internet. The matrix is
also a significant  tool for selling our final  recommendation to EDI
business product development management.

The comparison matrix is in html format at
http://ftp.sterling.com/edi/ietf-ediint/decision.html.


Thank you.

Rik Drummond
Chair EDIINT

------------------------------------------------------
|         Rik Drummond - The Drummond Group         |
|   5008 Bentwood Ct., Ft. Worth, TX 76132 USA  |
|        Voice: 817 294 7339    Fax: 817 294 7950     |
------------------------------------------------------


----- End of forwarded message from Rik Drummond -----

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From ichudov at algebra.com  Tue Jun  4 01:07:03 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Tue, 4 Jun 1996 16:07:03 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <Pine.BSI.3.91.960603161453.20486C-100000@descartes.forequest.com>
Message-ID: <199606040508.AAA01035@manifold.algebra.com>


Jeremey Barrett wrote:
> > The "Idea Futures" forum has established odds on this. The current odds are
> > currently 60% that a 1024 bit number will be factored by 2010 and 30% that
> > a 512 bit number will be factored by 1997.
> > 
> 
> True, but by that time I'll be able to use 2048 or bigger keys with the same
> or better performance as 1024 bit keys now.  As long as factoring is
> exponential, you can always make it impossible to factor your keys. 
> And I think it will always be exponential.

Actually factoring is not exponential even now. For Number Fiels Sieve 
method the number of operations is estimated as

N ~= exp(((1.923+O(1)) * (ln n)^(1/3) * ln ln n)^(2/3))

(taken from Schneier, A.C., page 256)

	- Igor.





From vince at offshore.com.ai  Tue Jun  4 01:08:26 1996
From: vince at offshore.com.ai (Vincent Cate)
Date: Tue, 4 Jun 1996 16:08:26 +0800
Subject: Arms Trafficker Page Made CNN!
In-Reply-To: <01I5H4HBQ11I8WW2JK@OREGON.UOREGON.EDU>
Message-ID: <Pine.LNX.3.91.960604010944.2299E-100000@offshore>



On Mon, 3 Jun 1996 assassin at gladstone.uoregon.edu wrote:

> Do you have the cnn story on .../arms-trafficker/?
> Just what mention of it was made?

They played it again, so I got it on video tape.  They
were talking about the encryption export issue and then 
showed my page and said:

CNN
>But privacy advocates are complaining loudly on the Internet.
>This web site calls for civil disobedience by encouraging
>people to send this encryption program overseas illegally.


The arms trafficker page was shown on CNN computer connection  
about 3:05 pm Saturday June 1, 1996, and again at 4:05 am June 2.
 
At some point a full transcript of the show should be on:

http://www.cnn.com/TRANSCRIPTS/conn/

http://www.cnn.com/CNN/Programs/CompConn/



  -- Vince






From jeffb at sware.com  Tue Jun  4 01:08:34 1996
From: jeffb at sware.com (Jeff Barber)
Date: Tue, 4 Jun 1996 16:08:34 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606032029.QAA05821@jekyll.piermont.com>
Message-ID: <199606040227.WAA16036@jafar.sware.com>


Perry E. Metzger writes:

> Jeff Barber writes:

> > So perhaps Tim over-simplified by saying that there were no limits on
> > what ordinary employees could do.  OTOH, it seems that Perry also
> > over-simplified by flatly stating that Tim's trades while an Intel
> > employee were "illegal".
> 
> First of all, I never said that Tim's trades were illegal -- indeed, I
> never mentioned Tim except to say that following his advice didn't
> seem like a particularly safe course to take. Second of all, I can't
> comment on whether Tim's trades were within the letter of the law or
> not. Indeed, it would be difficult even if one knew all the
> circumstances since the definition of "material non-public
> information" is so hard to pin down.

In response to Tim's message wherein he described trading in Intel
stock while an employee there, you wrote (in message
<199606031523.LAA05288 at jekyll.piermont.com>):

> >                          Under the rules, if you have nonpublic
> > information, even if you are not a corporate officer, you are an
> > insider for purposes of "insider trading" and your trades are illegal.

Sorry if I misinterpreted this.


> The point of all this was not that one shouldn't participate in the
> employee payroll stock purchase plan. The point was that a random
> person on the street who gets told a 'hot tip' is probably subject to
> the insider trading laws, never mind that he wasn't an employee or
> what is conventionally thought to be an "insider".

OK.  The only point I want to make is that thousands of us do this to
some extent every year and the risk apparently isn't terribly high.
Each person who works for a large corporation has *some* "non-public
information" which helps them decide whether to participate in the
stock purchase plan next year.  (Obviously if I think the company's
going to tank, I won't buy any more shares.)  I haven't seen anyone
attempt to define "material" but I'll concede that it's vague enough
to be dangerous to anyone whose trades are large enough to attract
attention.


-- Jeff





From rah at shipwright.com  Tue Jun  4 01:11:46 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Tue, 4 Jun 1996 16:11:46 +0800
Subject: e$: Interbank Digital Cash Clearing, Better Living through
Message-ID: <v03006f01add9604894a2@[199.0.65.105]>



--- begin forwarded text


Date: Mon, 3 Jun 1996 21:03:16 -0400
To: Multiple Recipients of e$pam <e$pam at intertrader.com>
From: e$pam at intertrader.com (e$pam)
Reply-To: e$@thumper.vmeng.com
X-Comment: To unsubscribe, send an email to e$pam-request at intertrader.com
X-Comment: containing the command "unsubscribe e$pam"
Precedence: Bulk
Subject: e$: Interbank Digital Cash Clearing, Better Living through
X-orig-from: Robert Hettinga <rah at shipwright.com>

X-e$pam-source: owner-ecash at digicash.com

Forwarded by Robert Hettinga

-----------------------------------------------------------------------
X-Sender: rah at tiac.net
 Mime-Version: 1.0
 Date: Mon, 3 Jun 1996 17:34:31 -0400
 To: ecash at digicash.com
 From: Robert Hettinga <rah at shipwright.com>
 Subject: e$: Interbank Digital Cash Clearing, Better Living through
  Walletware, Microintermediation, Net.Currencies and ECM
 Sender: owner-ecash at digicash.com
 Precedence: bulk


-----BEGIN PGP SIGNED MESSAGE-----

 e$: Interbank Digital Cash Clearing, Better Living through Walletware,
 Microintermediation, Net.Currencies and ECM

 June 3, 1996
 Boston,Massachusetts


 People have asked me what I think about interbank digital cash clearing, and
 I say I'm all for it. Flippant comments aside, I'm not sure I can add
 anything to the discussion, but I'll take a shot at it.

 It's easy to argue that there's no real need right now for *on-net*
 interbank clearing, especially with online cash. If you handle the
 transactions right, the merchant just verifies and deposits cash as it comes
 in. This works especially well with the underwriter-as-internet-ATM-machine
 model I like to use in discussion. (I include that here only by reference,
 as I've beat it to death. The e$ home-page is http://thumper.vmeng.com/rah/
 ) If the trustee behind the underwriter is, well, trusted, to do deposits as
 well as withdrawls, then the "problem" of interbank clearing on the net
 itself goes away. Actually, we just translate it into "normal" world of
 book-entry banking transactions, and the trustee does the interbank clearing
 there. Same as it ever was.

 In this scenario, if the customer presents a certificate requiring change,
 the change can be issued in the same transaction as the deposit of the rest
 of the transaction's proceeds. Frankly, in a world of ubiquitous networks,
 this is clearly the way to go for merchants of any means whatsoever, because
 it's completely safe for them, and it doesn't matter who the underwriter of
 the cash is. With the proper level of software abstraction, it may not even
 matter what the cash protocol is.

 However, networks are a long way from ubiquitous, and that means offline
 transactions for a lot of cases. Fortunately, if we want to think about
 offline transactions, we can pilfer some more ideas from, as usual, the
 market for traveller's checks. When a merchant deposits a traveller's check,
 her bank clears it like any other check. That's possible because not only is
 the check secured, but it is hard to replicate. Most importantly, American
 Express offers a virtual guarantee of payment even if the checks are proven
 to be lost or forged, which speaks volumes about the susceptability of the
 system to any large-scale fraud.  However, in the unlikely event that AmEx
 goes out of business, the merchant, not the bank, would be left holding the
 bag, just like she would be with a bounced check. Obviously, the same thing
 happens with money orders, a market in which there are many more issuers.
 All banks issue money orders, but traveller's checks require large consumer
 marketing campaigns, so there are fewer underwriters of them.

 So, if it is possible to build linkages between digital cash and the
 checking system through the merchant's bank, we might have another solution.
 Fortunately, this is no problem. A merchant takes in various forms of
 off-line cash all day and deposits it electronically at the time she
 deposits her other money.  The bank validates, clears, and deposits the cash
 right there at the teller/ATM, through it's connections to the net. This is
 (barely!) analogous to what happens to a traveller's check or money order,
 which is deposited and sometimes physically flown to the issuer's bank to
 clear, and paid back to the depositor by fed wire to settle the transaction.
 Making change for the transactions themselves in this scenario is
 problematic, but the merchant can just hand back physical cash, just like
 she does with traveller's checks.

 An all-electronic variant on this "mixed-money" change method is for the
 merchant to hand back whatever digital-note change she has, regardless of
 who issued, and this implies a lot of preconditions, but it's not as scary
 as it looks, which we'll see in a little bit.


 Right now, when we talk about the need for interbank clearing, a lot of
 people seem to be talking about offline cash. As we saw, online clearing is
 pretty much a geodesic process, because you're connected straight to the
 underwriter of the cash you're using for the transaction under way. It's
 hard for me to see any need for on-net intermediaries for online cash, at
 least for the time being, because the trustee, the actual financial
 intermediary in the transaction, is hooked into the "physical" financial
 system of banks, ATM networks, and central-bank fund-wires. I'll talk about
 on-the-net financial intermediaries a bit later, though, and there might be
 one wild card, but I'm not sure.

 In the same way that I claim that certificate-based clearing and settlement
 is always going to be cheaper than book-entry methods, I think that offline
 cash is always going to be cheaper at the margin than online cash. The risk
 of offine transactions is always going to be double-spending, and that has
 to be traded against convenience, lower cost of not needing net access and
 the absolute anonymity you can get by not having to ever reveal yourself to
 even the underwriter of the digital cash in question. My claim of
 "marginally cheaper" for offline cash is strictly because of the lack of a
 net connection, but this cost-component will continue to fall into the
 forseeable future, so it will be less of an issue. Today, however, with only
 tens of millions of people on the net out of a world population in the
 billions, off-line digital cash has a significant cost advantage, and as
 long there's a bank with in a few transactions' proximity to the offline
 transaction in question, I think it can still be pretty safe to do offline
 digital cash transactions.  Precicely because we're only a transaction-hop
 or two from an on-line transaction, double spending is reduced to a physical
 phenomena at the smartcard-to-smartcard level, which is much easier to deal
 with. The hoary old bugbear people like trot out at times like this, that of
 a bajillion salami-slice transactions done simultaneously all over the net
 all at once, goes back under the bed -- or back into the monster closet --
 where it belongs. (Speaking of bugbears, remember, the problem of someone
 stealing a bank's key, and literally printing free money, is more a problem
 of issuing digital cash batches with expiry dates than anything else.  More
 to the point, the problem belongs to a single underwriter, and not to a
 robust market with many competing underwriters.)

 Anyway, the upshot of the double-spending problem is that it assumes a world
 of strictly offline transactions, which is almost as ludicrous as a world of
 strictly online transactions. ;-). Any robust and marketable system of
 digital cash will need to be able to do both.

 Like I said above, the transaction handling mechanisms are everything in a
 multi-underwriter, multi-trustee, and even multi-certificate-protocol
 regime. We need to have a set of standards for digital cash clearing and
 settlement which makes the actual issuer as transparent as possible to the
 transaction's participants. After all, that's what we have with checks. The
 bank the check's drawn on doesn't really matter. To a lesser extent, neither
 does the issuer of a traveller's check or money order. Who printed the check
 *certainly* doesn't matter.

 That's about where we want to be with digital cash. If I want to buy
 something from you with ecash, the last thing we should care about is the
 mechanics of the transaction, and *that* includes who the issuer of the cash
 is, who the trustee is who's going to do the interbank settlement out in the
 book-entry world, who the protocol designer is who invented the type of cash
 we're using, who the software developers were who developed my wallet and
 your register. None of that. We just want to settle the trade.  Better
 living through walletware.

 That means that we need think about multi-underwriter clearing from the
 outset, preferrably at the merchant level, and I'm sure that's what Digicash
 is moving towards.  Digicash's walletware and registerware, or anyone else's
 for that matter, should be able to transact business with ecash of any form,
 without discrimination. If I spend some ecash with you, your cash register
 should take any and all combinations of my Deutche-ecash, or my Twain-ecash,
 or my Finn-ecash, validate them online with their underwriters (whose
 responsibility for transaction clearing turnaround should make speed a major
 selling point to their customers), and hand me back change however I want
 it, choice of underwriter (or not) and all. In fact, if everything works
 out, and markets for digital cash underwriting become efficient and
 competitive, then *who* underwrites my ecash becomes less of an issue to me
 over time. One form of ecash is as good as another, because it all
 interoperates. So, if we assume that walletware takes different protocols,
 it seems that the dominant digital cash protocol would be that which
 operates best from the *underwriter's* standpoint, which is where it should
 be, since they're the ones whose reputations are being risked, "rented", as
 it were.


 Okay. Let's look quite a few years ahead, to a time when most money that
 comes onto the net stays here and just gets moved around, to digital bearer
 bonds, or to digital mutual fund certificates, or whatever. Let's say that
 Tatsuo Tanaka's scenario has come to pass. That is, because the money's not
 leaving the net as soon as the transaction takes place, like we've been
 talking about, the digital cash underwriters and trustees, most likely with
 the knowing collusion of users who want to pay lower purchase discounts,
 start "creating" money by issuing cash against fractional, instead of 100%
 reserves. More to the point, to follow Tanaka some more, a panic or two
 brought about by these shenanigans has caused the underwriters to police
 themselves by creating some kind of independent currency control for various
 associations of fractional-reserve underwriters, much in the same way that
 fractional reserve bank panics were handled prior to the advent of central
 banking. We may even have several full-blown internet currencies, controlled
 by currency boards of some kind. I'm not talking about nation-states, here,
 either. All of this could be done on a private basis. Real live private
 currencies, offered by an association of digital cash underwriters.

 This is a *long* way off, but do you see what I'm getting at here? What we
 end up with is an on-the-net interbank clearing system, doing just what the
 book entry system does now, only without governments or central banks in the
 middle. We have intermediaries in the form of a board which manages the
 quantity of a given private currency based on "foriegn" reserves, that is,
 the holdings in its member banks in the *other* currencies, which prevents
 monitary inflation, and that's one place where the "interbank" clearing
 takes place. In this environment, we also have currency hedgers and
 speculators, who make (or save) money by trying to figure out where
 currencies of various kinds are going to go relative to one another.  These
 days we have institutions moving large amounts of currencies around, doing
 insecure trades on secure networks. However, the technology of digital
 bearer certificates and ubiquitous public networks could enable a legion of
 very small autonomous entities to do the same kinds of activity that the big
 boys do now. So we don't get "disintermediation", which lots of people see
 right now with the merger of your local savings bank into a big
 conglomerate, or your local stockbroker getting bought or put out of
 business by a discount broker or mutual fund. We end up with
 "microintermediation".

 Actually, I've written about the same idea elsewhere, of underwriting "bots"
 providing ubiquitous auction markets for things like personal digital bearer
 bonds, etc., but in this case we have a bunch of trading 'bots making
 secondary markets in currency, hedging and speculating on price fluctuations
 for money, all like a bunch of microscopic George Soroses. Like George Soros
 and his famous takedown of the EU's exchange mechanism, these bots would be
 who actually "determine" the price of a given net.currency versus another,
 and not the net.currency boards at all.


 Okay. I've wandered way out here on a limb, and I'm going to climb off of it
 soon, before I either fall or someone cuts it off. :-). However, before I
 go, let's look at something which actually happened, and which may be a
 pointer to what could happen again soon, without too much trouble. I'm
 talking about ecm, or the electronic cash market trading list.

 Last summer, when I got back from my New Orleans trip, I was up in Montana
 hanging out while my wife was at an educator's conference, and Lucky Green
 sends me e-mail about having just sold, for cash, some of the demo
 "cyberbuck" certificates that Digicash was issuing at the time. I commented
 about this to cypherpunks, one thing led to another, and the next thing I
 knew, Rich Lethin had started up a mailing list and set up a protocol for
 trading these beta-certificates for cash over that list. He named the list
 ecm. (Send "info ecm" in the body of a message to majordomo at ai.mit.edu, if
 you want to see what the fuss was all about.) It was used sporadically up to
 the time when, you guessed it, Mark Twain came on line with *actual* digital
 cash, and people stopped trading beta-certificates altogether. I can't even
 remember what the last settlement price was, but it was pennies on the
 dollar. Actually, now that I remember  it, there was a period where the
 beta-certificates were traded for real Mark Twain ecash on someone's
 web-page and then announced on ecm, but things have pretty much gone
 moribund on ecm lately. I haven't seen a trade go across in many months.

 ECM is the "wild-card" exception to using the current banking system for
 interbank digital cash clearing. The one that I was talking about above,
 after I said we didn't really need an interbank clearing mechanism on the
 net itself.  If someone wanted "clear" these different versions of ecash on
 the net some day, they could just take positions in both the Finnish, Mark
 Twain, and eventually Deutchebank certificates, and run a little currency
 exchange operation for fun, and maybe profit, between the three by
 announcing their bid/ask prices on ecm in both certificates. Hint: buy low,
 sell high. :-). They could even do currency-speculation-by-proxy by taking
 different positions in these certificates if they wanted to. It may even be
 that someone could do this and make a living at it, someday, if enough
 digital cash was used on the net, particularly if they could do it cheaper
 than it would cost someone to "deposit" their cash, through an underwriter,
 into their own bank account.

 Would income or capital gains taxes be considered part of that deposit
 "cost"?  As Francis Urquart (RIP) used to say, "*You* might say that, but
 *I* couldn't possibly comment."


 Cheers,
 Bob Hettinga








 -----BEGIN PGP SIGNATURE-----
 Version: 2.6.2

 iQCVAwUBMbNaLPgyLN8bw6ZVAQHf6QP/aDY1bhj+ZaG/yTGqezDpnuYYn2Gp2lVE
 QTTb8z5e9CLWDRMfLCEsFYs8OoXaWNa6NWmDTnpM44NuDawzfqmywWV4RIUyTp1B
 /ArcruU7z1LiCJUFI8XByGwQiGKsqVRVaoybf2QXP2NGeNSYuYol8s6umcmznzbR
 cXqvCdBMW/s=
 =YW/2
 -----END PGP SIGNATURE-----

 -----------------
 Robert Hettinga (rah at shipwright.com)
 e$, 44 Farquhar Street, Boston, MA 02131 USA
 "If they could 'just pass a few more laws',
   we would all be criminals."    --Vinnie Moscaritolo
 The e$ Home Page: http://www.vmeng.com/rah/



--------------------------------------------------
The e$ lists are brought to you by:

Take Your Business Online with Intertrader Ltd, Edinburgh, U.K.
Visit http://www.intertrader.com or email info at intertrader.com

Making Commerce Convenient (tm) - Oki Advanced Products - Marlboro, MA
Value-Checker(tm) smart card reader= http://www.oki.com/products/vc.html

Where people, networks and money come together: Consult Hyperion
http://www.hyperion.co.uk                    info at hyperion.co.uk

See your name here. Be a charter sponsor for e$pam, e$, and Ne$ws!
See http://thumper.vmeng.com/pub/rah/ or e-mail rah at shipwright.com
for details...
-------------------------------------------------

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From unicorn at schloss.li  Tue Jun  4 01:34:09 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 4 Jun 1996 16:34:09 +0800
Subject: your mail
In-Reply-To: <199606040046.RAA17821@netcom6.netcom.com>
Message-ID: <Pine.SUN.3.91.960603233917.7894A-100000@polaris>


On Mon, 3 Jun 1996 qut at netcom.com wrote:

> ncr terminals are the most 31173 D0Dz


I think you mean 31337.

(eiite doesn't make much sense)

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From dlv at bwalk.dm.com  Tue Jun  4 01:40:18 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Tue, 4 Jun 1996 16:40:18 +0800
Subject: Anonymous stock TRADING (was Saw this on CNN: )
In-Reply-To: <199606040240.VAA31145@manifold.algebra.com>
Message-ID: <N6FZoD56w165w@bwalk.dm.com>


ichudov at algebra.com (Igor Chudov @ home) writes:
> Which brings up another ignorant question: suppose that I am a
> corporate officer who does receive substantial "insider" information,
> for example results of audits, before they become public. What would
> prevent such an insider from creating a phony offshore trading company,
> and sending orders to that company using cypherpunks technology?

If he doesn't report the income from the trades, the IRS may nail him.
If he does, then they'll look at what trades he did.

Interestingly, all this trading on inside information didn't use to be
a crime in the U.S. at one time, and is not a crime in most of the world.
Most non-Americans view access to material nonpublic information as one
of the job perks, just like the ability to sexually harrass one's secretary.

Interested cpunks should check out the book _International Investments_
by Bruno Solnik (0-201-56707-5). It doesn't talk about insider trading,
but it has some fascinating comparisons of market practices in different
countries, and some thoughts on the value of anonymity vs. reputation.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From dlv at bwalk.dm.com  Tue Jun  4 01:48:15 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Tue, 4 Jun 1996 16:48:15 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606032029.QAA05821@jekyll.piermont.com>
Message-ID: <P74yoD45w165w@bwalk.dm.com>


"Perry E. Metzger" <perry at piermont.com> writes:
> Jeff Barber writes:
> > I trust it won't stun you to find that many, many large and even small
> > corporations -- including my current employer [*NOT* SecureWare, BTW,
> > despite the email address] -- actually encourage their employees to buy
> > stock by offering stock purchase plans as a benefit of employment.
>
> Yup. Indeed, its perfectly legal and even common to trade in the stock
> of your own company, even if you are a corporate officer. HOWEVER,
> that doesn't mean that you are safe against insider trading charges.

High-level corporate officers have to file a special form with the SEC
whenever they trade the stock of their corporation. This information is
then publicly available. The Wall St. Journal reports monthly on large
insider trades reported to the SEC. I'm aware of at least one service (in
Florida) that takes the paper forms from SEC, does data entry, and sells
the data in computer-readable form.

Several studies showed something interesting:

a) If someone trades with the insiders, s/he'll have the same returns as
the market or worse;

b) If someone follows only the highest-level insiders (directors and CEO's)
as soon as their trades become known (which is about 4 weeks after the trade),
they'll generally beat the market.

This seems to indicate that a) insiders on the average are misguided,
b) highest level insiders do profit from their insider knowledge.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From grafolog at netcom.com  Tue Jun  4 02:08:37 1996
From: grafolog at netcom.com (jonathon)
Date: Tue, 4 Jun 1996 17:08:37 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <199606031507.LAA15317@jafar.sware.com>
Message-ID: <Pine.3.89.9606040351.A7487-0100000@netcom23>


	Jeff:

On Mon, 3 Jun 1996, Jeff Barber wrote:
> IANAL, but I think you must be wrong about this, Perry.  If this were

	Tim is calling any trade by an Insider, as being insider trading.
	Perry is saying anybody can do insider trading. 
	

> the case then, as an employee of company XYZ, I would never be permitted
> to buy XYZ stock (which is clearly not the case) since I *always* have

	An Insider may trade stock. s/he simply has to announce 
	their intention to do so 30 or more days beforehand.
	<< I probably have the number of days wrong, but it is 
	at least 30.  >> 

	From my little black legal dictionary:

	Insider:   Defined in Securities and Exchagnes Act.
		   15 USC 78p(a) ( 1964)

		   An insider is every officer and director of a 
		corporation and any person who owns more than
		ten percent of the stock of taht corporation.

	Insider Trading:   Buying or selling corporate stock by 
  			   by a corporate officer or other insider 
		who profits by his access to information not available
		to the public.  << Skip several paragraphs >> The prohibition
		against trading on inside inforamtion is enforced regardless
		of whether the trading is done by an insider, or by an
		unscrupulous investor who has been tipped off by an insider.

		*** end of legal defination ***

		I don't have legal citations, but I do remember a scandal
		in the sixties, involving secretaries passing information
		on to others, who were convicted of insider trading,
		amongst other things. << Not the secretaries, but those
		they passed information onto, were convicted. >>

		Then for those who believe that TV is real life, at
		least one episode of LA Law dealt with insider trading 
		--- a secretary << I think -- I don't watch TV >> was
		getting stock tips from an insider, and traded on that
		advice.  She hadn't a clue as to what she was doing,
		but made a pretty penny. And was arrested for Insider 
		Trading.  She didn't even know taht that was what she
		was doing.  << First aired three or four season's ago,
		I think.  >> 

        xan

        jonathon
        grafolog at netcom.com



**********************************************************************
*								     *
*	Opinions expressed don't necessarily reflect my own views.   *
*								     *
*	There is no way that they can be construed to represent      *
*	any organization's views.				     *
*								     *
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
*								     *
*       http://members.tripod.com/~graphology/index.html             *
*								     *
***********************************************************************







From gcjones at ix.netcom.com  Tue Jun  4 02:11:02 1996
From: gcjones at ix.netcom.com (gcjones at ix.netcom.com)
Date: Tue, 4 Jun 1996 17:11:02 +0800
Subject: Editorial on Crypto Policy -- 6/3/1996 Sacramento Bee
Message-ID: <1.5.4.16.19960603213652.224f84fa@popd.ix.netcom.com>


Thought y'all might find this interesting: 


Editorial in The Sacramento Bee, June 3, 1996
---------------------------------------------

THE VALUE OF ENCRYPTION

	In a report commissioned by Congress, the National Research Council has
injected some perspective into the noisy and often uncivil debate over
encryption of electronic communications.  Although the Clinton
administration shows no signs of heeding the NRC's advice, Congress will
find the NRC recommendations an excellent guide to national encryption policy.

	For years, the extremes in the debate over the administration's efforts to
restrict the use of encryption have focused on rival bogeys.  Intelligence
and law enforcement have warned of the specter of terrorist or criminal
groups able to use encryption to prevent detection by wiretapping.  In
reply, civil libertarians opposed to Clinton administration efforts to
promote an encryption standard that would leave government agencies with the
key to open up all communications to scrutiny have held up the specter of
"Big Brother."

	By contrast, the NRC panel -- which was chaired by Kenneth Dam, a deputy
secretary of state in the Reagan administration, and included a
distinguished group of former top law enforcement and Pentagon officials --
took a more nuanced approach.  The spread of encryption, the panel agreed,
will make it harder for spies and cops to listen in on enemies and signals.

	But the greater terrorist and criminal threat, it concluded, arises from
electronic networks vulnerable to tampering.  The law enforcement benefit
from the wider use of encryption to keep a terrorist hacker from shutting
down the air traffic control system or an electronic criminal from looting
bank transactions will outweigh the diminished utility of wiretapping.

	Thus, the panel recommends that national policy promote the use of
encryption to protect vital communications systems, such as voice and
cellular telephone systems, from intrusion by criminals.  To give businesses
and individuals confidence in encryption, standards and technology should be
driven by the market and by users, not by the government.  And because
current restrictions on the export of encryption software leave U.S. firms
abroad vulnerable and inhibit the use of the best encryption in U.S.
products, it also recommends relaxation of those controls.

	The burgeoning Internet and expanding wireless communications will be
essential to the economy's growth over the next generation.  But those
technologies can never achieve their full potential if commercial
transactions and personal communications are vulnerable to interception.
The NRC report makes plain that encryption is less of a problem than a
solution.  Its recommendations provide Congress with a guide to policy at a
time that the Clinton administration is paralyzed, its finger in the dike,
protecting against a technological flood that it cannot hope to control.

Copyright, 1996, The Sacramento Bee

--------------------------------
Glenn C. Jones

"If you're walkin' on thin ice, 
you might as well dance."
--------------------------------






From grafolog at netcom.com  Tue Jun  4 02:34:47 1996
From: grafolog at netcom.com (jonathon)
Date: Tue, 4 Jun 1996 17:34:47 +0800
Subject: DEMOGRAPHICS v. ANONYMITY
In-Reply-To: <2.2.32.19960603171454.00717340@popmail.crl.com>
Message-ID: <Pine.3.89.9606040436.A7487-0100000@netcom23>


On Mon, 3 Jun 1996, Sandy Sandfort wrote:

	Not Sandy, but somebody else wrote: 

> >I also shop only with cash, here and elsewhere.  
> >Double-blinded e-cash will be the only way to go, if it 
> And I bet they don't turn down your cash just because it
> contains no demographic data.  Thus demonstrating the 

	If that purchase is for more than $5K, they will turn
	down your cash, unless you also provide
	#1:	Your name
	#2:	Your Address
	#3:	Proof of Identity.

	Reason: 	 _current_ IRS Requirements. 

        xan

        jonathon
        grafolog at netcom.com



**********************************************************************
*								     *
*	Opinions expressed don't necessarily reflect my own views.   *
*								     *
*	There is no way that they can be construed to represent      *
*	any organization's views.				     *
*								     *
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
*								     *
*       http://members.tripod.com/~graphology/index.html             *
*								     *
***********************************************************************







From frantz at netcom.com  Tue Jun  4 02:47:31 1996
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 4 Jun 1996 17:47:31 +0800
Subject: Java
Message-ID: <199606040626.XAA09729@netcom7.netcom.com>


At 10:22 PM 6/3/96 -0400, Perry E. Metzger wrote:
>I've been rather hard on Java here lately.

I'll say.  You have also ignored some of Java's other features.  Machine
independence is probably the most important.  A nice, small, easy to learn
language is another.

[As an aside, when I attempted to compile Wai Dei's crypto lib 2.0 with the
Symantec Project Manager C++ compilers, none of the 3 would compile it. 
The one which generated the fewest errors had "internal error" on two
modules.  This problem occurs because C++ is such a large language, with a
number of obscure features which compiler writers don't always handle.  In
addition, C++ is in no way machine independent.  The simplest example is
that sizeof(int) is machine dependent.]
>
>...
>
>Sun is, unfortunately, suffering from a substantial hubris problem. As
>I have noted, the original Java applet security model and all the
>followups have had exactly the same problem -- they depend on perfect
>implementation of every element of the security model for the security
>to work, instead of having the realistic and conservative assumption
>that portions of the model will be misimplemented, and designing for
>defense in depth.

If you want defense in depth, run your Java interpreter in an OS
environment which limits the interpreter's access to only those resources
you wish it to access.

I get the impression that the environment you are concerned with is a bunch
of PCs running W95 or NT.  These OSs are fragile enough, particularly to
the denial of service attacks your users can not tolerate, that the only
way to approach safety is to only run software which has been approved by
an in-house testing authority.  Even with the in-house testing authority,
you really need a better OS to protect against testing failures.


>Beyond that, however, they have created the ultimate hype
>monster. Java is a neat idea looking for a good application. I use the
>web all day long and I have yet to see a good use for Java.

There have been discussions of crypto applications in Java.  Doing the
crypto on the user's system before sending data thru the net is a useful
application.  While, as a number of us have pointed out, there are problems
doing crypto with Java, it may be the easiest way to deliver strong crypto
quickly to Joe Websurfer.

In the long run, I hope to use Java to sell cycles.  Java has the advantage
in a cycle market that it is machine independent, and the Just In Time
compilers should make the performance reasonable.

Regards - Bill


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From shamrock at netcom.com  Tue Jun  4 03:03:15 1996
From: shamrock at netcom.com (Lucky Green)
Date: Tue, 4 Jun 1996 18:03:15 +0800
Subject: Java Crypto API questions
Message-ID: <v02120d15add98b67e218@[192.0.2.1]>


At 16:22 6/3/96, jim bell wrote:

>A signature is just that:  A signature.  It doesn't encrypt or decrypt.  It
>doesn't even ALLOW the system it's in to encrypt or decrypt, because there
>are numerous encryption programs written that have no need for such a
>signature.  If no program existed which _used_ that signature, nobody would
>think twice about exporting it.
>
>The fact is, it is LEGAL to import encryption code into the US.  It is LEGAL
>to generate an hash of that code, and it is LEGAL to export that hash.  To
>believe otherwise is to broadly expand the scope of export laws far beyond
>what they were intended to mean.

First, the ITAR are not laws, but regulations. Second, there are many that
believe that applying ITAR to crypto software is already expanding the
scope of the regulations far beyond what they were intended to mean.

Let us not forget that the ITAR were written to prevent the proliferation
of military technology. Applying them to mass market crypto software does
not aid this original goal in any way. At one point, the existing ITAR
began to be used to further a cause utterly unrelated to their original
intend: limiting the domestic market penetration of strong crypto systems.


Disclaimer: My opinions are my own, not those of my employer.

-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.







From jimbell at pacifier.com  Tue Jun  4 03:55:41 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 4 Jun 1996 18:55:41 +0800
Subject: CWD: "Jacking in from the "One that Got Away" Port
Message-ID: <199606040610.XAA02467@mail.pacifier.com>


At 10:19 PM 6/3/96 -0500, Declan McCullagh wrote:
>(By Brock Meeks / brock at well.com / Archived at http://www.cyberwerks.com/)
>
>
> CyberWire Dispatch // Copyright (c) 1996 //

> A virtual tactical nuke was hurled into the arcane subculture of
> encryption technology Monday when RSA President Jim Bizdos revealed
> that his company's Japanese subsidiary had developed a monster chipset
> capable of scrambling voice and data real time with a so-called "key
> length" of up to 1024 bits.

I don't mean to be overly critical, but why not provide for the possibility 
of longer keys?  The RSA key only has to be exchanged and decoded once per 
call, presumably, which suggests that there shouldn't be a problem to do 
2048-bit keys.  Admittedly, 1024 bits will be good for many years, but...

> That key length stuff is just so much gibberish to those playing
> without a scorecard, so let me drill down on it for you.  Basically,
> the longer the key length, the harder it is for a message to be broken
> by "brute force" automated attacks.  Current U.S. laws prohibit the
> export of any encryption device with a key length longer than 40-bits,
> or roughly the equivalent of  Captain Crunch decoder ring. For hardcore
> math types, I'm told that a 1024-bit key length is 10 to the 296th
> power more difficult to break than 40 bits.

I sure do wish they'd get things like this a bit more accurate...  Oh, well, 
I suppose it doesn't really matter...


Jim Bell
jimbell at pacifier.com





From WlkngOwl at unix.asb.com  Tue Jun  4 04:39:33 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 4 Jun 1996 19:39:33 +0800
Subject: CWD: "Jacking in from the "One that Got Away" Port
Message-ID: <199606040831.EAA12343@unix.asb.com>


On  3 Jun 96 at 22:19, Declan McCullagh wrote:

> (By Brock Meeks / brock at well.com / Archived at http://www.cyberwerks.com/)
>  CyberWire Dispatch // Copyright (c) 1996 //
>  Jacking in from the "One that Got Away" Port:
[..]
>  That key length stuff is just so much gibberish to those playing
>  without a scorecard, so let me drill down on it for you.  Basically,
>  the longer the key length, the harder it is for a message to be broken
>  by "brute force" automated attacks.  Current U.S. laws prohibit the
>  export of any encryption device with a key length longer than 40-bits,
>  or roughly the equivalent of  Captain Crunch decoder ring. For hardcore
>  math types, I'm told that a 1024-bit key length is 10 to the 296th
>  power more difficult to break than 40 bits.

Too bad he got caught up in the gibberish.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From apache at quux.apana.org.au  Tue Jun  4 04:44:13 1996
From: apache at quux.apana.org.au (TT)
Date: Tue, 4 Jun 1996 19:44:13 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
In-Reply-To: <Pine.LNX.3.91.960604005849.2051A-100000@quux.apana.org.au>
Message-ID: <Pine.LNX.3.91.960604163537.5315B-100000@quux.apana.org.au>


On Tue, 4 Jun 1996, TT wrote:
 
> I think it is actually easy to use, although granted others may not; but 
> that people tend not to use it as a matter of course (and it is my belief 
> this is a desireable thing) due too the time taken to manually sign mail 
> or sign and encrypt.

Correction: should read...it is my belief this is _not_ a desireable thing..

-- 
   .////.   .//    Charles Senescall            apache at quux.apana.org.au
 o:::::::::///                                         apache at gil.com.au
>::::::::::\\\     Finger me for PGP PUBKEY           Brisbane AUSTRALIA
   '\\\\\'   \\    http://quux.apana.org.au/~apache/ 






From poh at iss.nus.sg  Tue Jun  4 04:49:58 1996
From: poh at iss.nus.sg (Peter Oh Siu Wai)
Date: Tue, 4 Jun 1996 19:49:58 +0800
Subject: Greetings from Star+Globe
Message-ID: <199606040800.QAA24778@iss.nus.sg>


 Dear Sir/ Madam,

 Greetings from Star+Globe Technologies!

 Thank you for accessing & using our WinMASS. It is indeed our pleasure
 to bring you the multilingual world at your fingertips. To pursue our
 objective of delivering the best and most cost effective solution for all
 your multilingual computing needs, we appreciate your support and
 encouragement.

 May we take this opportunity to seek your views and suggestions on
 WinMASS, based on the Cyber Launch of May 15th, 1996 wherein you have
 registered.

  1.Did you have any problems while downloading WinMASS? Please specify.
  2.Have you tried and explored WinMASS?
  3.Is WinMASS informative and complete? did you find anything missing?
  4.With what application did you use WinMASS? were you satisfied?
  5.Have you used / using any other Multilingual Software?
  6.What is your working platform for Hardware and Software?
  7.What features do you like most about WinMASS?
  8.What additional features would you like to have?
  9.Do you have any specific querries that you would like us to answer?
 10.Any other valuable feedback is welcome.

 We want to improve our service to you. Your support and cooperation is
 highly desired and will be helpful to do our best.

 Thank you and look forward to receiving your valuable information at
 any of the following e-mail address:

         info at starglobe.com.sg
         sales at starglobe.com.sg
         venki at starglobe.com.sg

 Best Regards,

 Venki Char






From WlkngOwl at unix.asb.com  Tue Jun  4 05:55:12 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 4 Jun 1996 20:55:12 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <199606040833.EAA12366@unix.asb.com>


On  3 Jun 96 at 21:59, Deranged Mutant wrote:
[..]
> More likely drop it altogether, or be openly admit they were forced 
> to include GAK (people will want the source, anyway).

I retract the second part of that sentence.

*Sigh*

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From gary at systemics.com  Tue Jun  4 05:57:22 1996
From: gary at systemics.com (Gary Howland)
Date: Tue, 4 Jun 1996 20:57:22 +0800
Subject: CWD: "Jacking in from the "One that Got Away" Port
In-Reply-To: <v01510105add95b2fda0a@[204.62.128.229]>
Message-ID: <31B3F920.31DFF4F5@systemics.com>


> Current U.S. laws prohibit the
>   export of any encryption device with a key length longer than 40-bits,
>   or roughly the equivalent of  Captain Crunch decoder ring. For hardcore
>   math types, I'm told that a 1024-bit key length is 10 to the 296th
>   power more difficult to break than 40 bits.

No comment.

 
>   Bizdos seems to have found crypto's magic bullet;  a legit way to
>   essentially give the finger to U.S. export laws for crypto product.

Really?


>   In fact, it's a crime even to put a program like PGP on your laptop and
>   go overseas.   The State Department calls that "exporting."

Golly day!


>   After setting up his Japanese unit, he hired a crack team
>   of Japanese crypto experts who essentially "reverse engineered" the
>   company's own U.S. crypto product, according to Kurt Stammberger, RSA
>   director of technology marketing.

Hot dang!


>   It was a brilliant move.   Bizdos
>   can't be slammed by the State Department for violating crypto export
>   laws because, well, he didn't export a damn thing, except some U.S.
>   greenbacks, which of course, could have gone to U.S. cryptographers,
>   but let's not quibble about jobs.
 
>   Anyone want to kick around the subject of global competitiveness?
>
>   What's happened here is the Japanese have now trumped the entire world
>   on the crypto market.   What's more, Clinton's brain-dead allegiance to
>   the FBI, et al., has now allowed the Japanese government, which still
>   owns a large share of NTT, which owns a minority share of RSA's
>   Japanese subsidiary, to have a lock on the world's strongest encryption
>   technology.   Can you say "Remember the VCR"  or "Remember the
>   Semiconductor" or how about "Thanks, Bill.  We're fucked."

Yes, the guvmint is really stupid, huh?


Remind me not to subscribe to cyberwire ...


Serious point - what are the chances that the key generator has been
tampered with? (assuming the generation is done within the chipset).


Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06





From reply at remail.ecafe.org  Tue Jun  4 06:57:24 1996
From: reply at remail.ecafe.org (ECafe Anonymous Remailer)
Date: Tue, 4 Jun 1996 21:57:24 +0800
Subject: Gov. archives
Message-ID: <199606041107.LAA11420@avignon.hypereality.co.uk>


For anyone who hasn't already, check out http://csrc.nist.gov. There
is a ton of groovy government info on such things as:

Computer Systems Security and Privacy Board

NIST pubs and letters

Privacy forum archives

RISK forum archives

Software

Unix security info

Secure internet connections

Crypto module validation

Secure hash standard

NBS data encryption

Key escrow 

Computer security roles in NIST and the NSA

Secure telephone terminals

Too much other info to be listed!!!

Also, you can access them by ftp@  csrc.nist.gov, or access their BBS.
(cs-bbs.nist.gov)

Have fun.

Remember, Big Brother is watching! 

 






From jya at pipeline.com  Tue Jun  4 08:50:35 1996
From: jya at pipeline.com (John Young)
Date: Tue, 4 Jun 1996 23:50:35 +0800
Subject: NYT on NTT/RSA Chips
Message-ID: <199606041054.KAA14598@pipe2.t2.usa.pipeline.com>


Connecting Declan's three dots [...]: 
 
 
   The New York Times, June 4, 1996, pp. D1, D4. 
 
 
   Japanese Chips May Scramble U.S. Export Ban 
 
   By John Markoff 
 
 
   Washington, June 3 -- The Nippon Telegraph and Telephone 
   Corporation has quietly begun selling a powerful data- 
   scrambling chip set that is likely to undermine the Clinton 
   Administration's efforts to restrict the export of the 
   fundamental technology for protecting secrets and commerce 
   in the information age. 
 
   The existence of the two-chip set, which will have broad 
   potential application for local computer networks, the 
   Internet and telephone switching networks, was disclosed 
   here in a speech today at a public policy workshop by the 
   chief executive of RSA Data Security, a Silicon 
   Valley-based company that has frequently dueled with the 
   Administration over its export-control policies. 
 
   The executive, Jim Bidzos, said that his company was 
   negotiating with N.T.T., the giant telecommunications 
   concern, to resell the chips in the United States. Mr. 
   Bidzos also said that N.T.T. had already made sales in 15 
   countries, including in the United States to I.B.M. 
 
   "N.T.T. has done a lot of research and development work on 
   this product" he said. "There is clearly going to be a lot 
   of demand for their chips." 
 
   An executive at NTT America said that although there were 
   no restrictions on the export of cryptographic hardware or 
   software from Japan, his company was still anxious to 
   obtain software from RSA Data to use in its chips. That 
   software is still controlled by United States export law, 
   he said. 
 
   "We'd like to use this technology," said Junichi Kishigami, 
   director of NTT America, which is based in Mountain View, 
   Calif. "It is important to employ good international 
   standards." 
 
   Mr. Bidzos has been a vocal and longtime opponent of United 
   States export laws that prohibit the sale, without a 
   special license, of products that have powerful 
   data-scrambling capabilities. The Government's policy is 
   directed at limiting the spread of systems that could make 
   it more difficult for American intelligence and 
   law-enforcement agencies to conduct electronic 
   surveillance. 
 
   Such restrictions have been bitterly opposed in recent 
   years by American computer and telecommunications 
   companies; they have argued that the technology is already 
   widely available internationally and that manufacturers and 
   software developers in the United States are in danger of 
   losing markets to foreign competitors. The N.T.T. 
   technology would seem to support those contentions. 
 
   "The United States export controls are at risk from 
   Japanese competition," said Stewart Baker, a Washington 
   lawyer who is the former general counsel for the National 
   Security Agency. 
 
   The N.T.T. device also underscores fundamental differences 
   that exist between Japan and the United States on the issue 
   of privacy in the information age. 
 
   While United States officials have struggled to maintain 
   their ability to conduct electronic surveillance, Article 
   21 of Japan's Constitution specifically forbids 
   wiretapping. 
 
   "It's very interesting that the Japanese regard for privacy 
   in their Constitution translates into better cryptographic 
   technology," said Marc Rotenberg, director of the 
   Electronic Privacy Information Center, a Washington public 
   policy group and an organizer of today's workshop on data 
   scrambling. 
 
   Mr. Bidzos said that N.T.T.'s chips, which have been 
   developed and manufactured by a subsidiary, N.T.T. 
   Electronic Labs, were far more powerful than the so-called 
   Clipper chip, a data-scrambling system that the Clinton 
   Administration proposed for the nation's telephone system. 
 
   While the Clipper system has a built-in "back door" 
   intended to permit the F.B.I. to gain wiretap information, 
   the N.T.T. system has no such surveillance feature, It also 
   uses much stronger data-encryption algorithms than United 
   States export laws permit. 
 
   Those laws restrict the export of encryption systems which 
   employ digital "keys" of more than 40 bits in length. The 
   new N.T.T chips, however, are based on the United States 
   data encryption standard, which has a 56-bit key, and 
   actually triples the strength of that standard. Such a 
   scrambling system is believed to be beyond the capability 
   of the most powerful code-breaking system. 
 
   In addition to the "private" key system for scrambling 
   data, N.T.T. uses RSA Data's "public" key method to permit 
   computer users who have not previously exchanged 
   information to swap-private key information safely. The 
   N.T.T. system uses the RSA Data key, which is 1,024 bits in 
   length, also far stronger than the United States export 
   regulations permit. 
 
   "If there is anyone in the Government who hasn't already 
   seen the writing on the wall, here it is," Mr. Bidzos said. 
 
   He said that RSA Data had set up a small subsidiary in 
   Japan last year and that he was now negotiating with N.T.T. 
   to make a minority investment in that subsidiary in 
   exchange for N.T.T.'s gaining access to the RSA Data public 
   key technology. 
 
   The N.T.T. technology is at least partly the result of an 
   initiative by Japan's Ministry of International Trade and 
   Industry, which 18 months ago made a $120 million national 
   commitment to develop products to facilitate electronic 
   commerce. 
 
   "This is a major business opportunity that the Japanese see 
   clearly," said Deborah Hurley, an official at the 
   Organization for Economic Cooperation and Development, the 
   Paris-based international group. 
 
   RSA Data was acquired in April by Security Dynamics 
   Technologies Inc., a computer security company based in 
   Cambridge, Mass., in a stock deal valued at $250 million. 
   Mr. Bidzos said that the two companies had continued to 
   operate relatively independently. 
 
   [End] 
 





From perry at piermont.com  Tue Jun  4 10:49:13 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 01:49:13 +0800
Subject: Alan Coopersmith: BoS: Yet Another Java security bug
Message-ID: <199606041258.IAA08929@jekyll.piermont.com>



------- Forwarded Message

From: lady0065 at sable.ox.ac.uk (David Hopwood)
Newsgroups: comp.lang.java,comp.security.misc,comp.security.unix
Subject: Another Java security bug
Date: 2 Jun 1996 07:15:06 GMT
Organization: Oxford University, England
Lines: 30
Sender: david.hopwood at lmh.ox.ac.uk
Message-ID: <4orf1q$t6f at news.ox.ac.uk>

There is another serious security bug in the class loading code for all
currently available Java browsers:
    Netscape up to and including versions 2.02 and 3.0beta4 (except for
      Windows 3.x)
    Oracle PowerBrowser for Win32
    HotJava 1.0beta
    'appletviewer' from the Java Development Kit, up to and including
      version 1.0.2

Sun, Netscape, and Oracle have been sent details of the problem (which is
partly related to the ClassLoader attack found by Drew Dean et al in
March). The attack works by exploiting a design flaw in the mechanism that
separates JVM classes into different namespaces.

Using this bug, an attacker can bypass all of Java's security
restrictions. This includes executing native code on the client, with
the same permissions as the user of the browser. No preconditions are
necessary other than viewing the attacker's web page, and the process
can be made completely invisible to the victim.

The only way to avoid this problem at the moment is to disable Java. For
more information see
    http://ferret.lmh.ox.ac.uk/~david/java/bugs/

Further technical details will be posted when Sun, Netscape, and Oracle
release patches.

David Hopwood
david.hopwood at lmh.ox.ac.uk
http://ferret.lmh.ox.ac.uk/~david/

------- End of Forwarded Message






From declan at well.com  Tue Jun  4 10:54:09 1996
From: declan at well.com (Declan McCullagh)
Date: Wed, 5 Jun 1996 01:54:09 +0800
Subject: CWD: "Jacking in from the "One that Got Away" Port
In-Reply-To: <199606040610.XAA02467@mail.pacifier.com>
Message-ID: <Pine.3.89.9606040505.A13202-0100000@well>


Yeah, we fucked up here and are getting rightfully flamed.

A more accurate way to say this would be something like:

1024-bit RSA is as hard to crack as three nested iterations of 56-bit DES.
The key length for symmetric-key cryptosystems isn't comparable to the key
length for public key cryptosystems. 

And now that I'm at it, I'm now told that it was a Captain Marvel decoder 
ring.

Apologies, all.

-Declan


> > That key length stuff is just so much gibberish to those playing
> > without a scorecard, so let me drill down on it for you.  Basically,
> > the longer the key length, the harder it is for a message to be broken
> > by "brute force" automated attacks.  Current U.S. laws prohibit the
> > export of any encryption device with a key length longer than 40-bits,
> > or roughly the equivalent of  Captain Crunch decoder ring. For hardcore
> > math types, I'm told that a 1024-bit key length is 10 to the 296th
> > power more difficult to break than 40 bits.
> 
> I sure do wish they'd get things like this a bit more accurate...  Oh, well, 
> I suppose it doesn't really matter...
> 
> 
> Jim Bell
> jimbell at pacifier.com
> 





From perry at piermont.com  Tue Jun  4 11:21:19 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 02:21:19 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <199606040508.AAA01035@manifold.algebra.com>
Message-ID: <199606041254.IAA08918@jekyll.piermont.com>



Igor Chudov @ home writes:
> Actually factoring is not exponential even now. For Number Fiels Sieve 
> method the number of operations is estimated as
> 
> N ~= exp(((1.923+O(1)) * (ln n)^(1/3) * ln ln n)^(2/3))
> 
> (taken from Schneier, A.C., page 256)

The distinction between that and exponential is rather difficult for
most ordinary people to see, and in any case subexponential and
exponential are "practically the same" for purposes of this
discussion.

.pm





From unicorn at schloss.li  Tue Jun  4 11:31:02 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Wed, 5 Jun 1996 02:31:02 +0800
Subject: Anonymous stock TRADING (was Saw this on CNN: )
In-Reply-To: <199606040240.VAA31145@manifold.algebra.com>
Message-ID: <Pine.SUN.3.91.960604082925.19633A-100000@polaris>


On Mon, 3 Jun 1996 ichudov at algebra.com wrote:

> rick hoselton wrote:
> > 
> > You might also want to ask Ivan Boeskey(sp?).  I think he's out of 
> 
> Boesky.
> 
> Which brings up another ignorant question: suppose that I am a 
> corporate officer who does receive substantial "insider" information,
> for example results of audits, before they become public. What would
> prevent such an insider from creating a phony offshore trading company,
> and sending orders to that company using cypherpunks technology? 

The threat of discovery and punishment?
Your mileage may vary.

> If we suppose that the agent executing trades (which may even be a
> computer, afaik) is trustworthy, the methods to deliver trade orders are
> reliable, the computers are protected from van eyck monitoring, and the
> officer is not spending too much money openly, what is there to prevent
> or prove such violations of the law?

Paper trails, informants, corrupt foreign officials, plants, attacks on 
voice calls between the U.S. and the company, the internal corporate calls.

Anything that law enforcement is used to using.

It'd be the IRS that you had to really watch for.  SEC tends to give up 
on said programs.

I discuss concealing insider trading in my longish work on the subbject 
of asset concealing.

> For example, the trading computer can have pseudonym address
> xyz at alpha.c2.org, forwarded through a chain of remailers to
> place_order at offshore.com.xx, and the officer sends pgp signed and
> encrypted trade orders to that address, again through remailers.  What
> besides traffic analysis is there to stop such violations?
> 
> Thanks,
> 
> 	- Igor.

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From perry at piermont.com  Tue Jun  4 11:51:03 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 02:51:03 +0800
Subject: CWD: "Jacking in from the "One that Got Away" Port
In-Reply-To: <Pine.3.89.9606040505.A13202-0100000@well>
Message-ID: <199606041331.JAA09003@jekyll.piermont.com>



Declan McCullagh writes:
> The key length for symmetric-key cryptosystems isn't comparable to the key
> length for public key cryptosystems. 

You should have stuck with that.

> 1024-bit RSA is as hard to crack as three nested iterations of 56-bit DES.

Unknown. Cracking 3DES and 1024 bit RSA are both hard, but the
algorithms used for brute forcing both of them are very different. I
would say that making comparisons between them is probably in general
a bad idea, especially given that over long periods of time the
techniques used improve at different rates.

The conservative attitude is, in any case, always "encrypt until it
hurts and then back off a little bit."

Perry





From rah at shipwright.com  Tue Jun  4 12:00:22 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Wed, 5 Jun 1996 03:00:22 +0800
Subject: Paper about electronic cash and common currencies available
Message-ID: <v03006f06add9e3fc6e3a@[199.0.65.105]>



--- begin forwarded text


Sender: e$@thumper.vmeng.com
Reply-To: Wolfgang Roeckelein <wolfgang.roeckelein at wiwi.uni-regensburg.de>
Mime-Version: 1.0 (NeXT Mail 3.3 v118.2)
Precedence: Bulk
Date: Tue,  4 Jun 96 11:14:41 +0200
From: Wolfgang Roeckelein <wolfgang.roeckelein at wiwi.uni-regensburg.de>
To: Multiple recipients of <e$@thumper.vmeng.com>
Subject: Paper about electronic cash and common currencies available

Hello everybody,

our paper titled

"A Common Currency System for Spontaneous Transactions on Public Networks"

is available online under

http://www.whu-koblenz.de/~wolfgang/CommonCurrency/

Perhaps somebody might be interested.

Thank you for your attention,
  Wolfgang Roeckelein
---
Dipl.-Wirtsch.Inf.	Voice:	+49 941 943 2998
Wolfgang Roeckelein	Fax:	+49 941 943 4986
Uni Regensburg		E-Mail:	roeckelein at wi.whu-koblenz.de
Universitaetsstr. 31		Wolfgang.Roeckelein at wiwi.uni-regensburg.de
D-93053 Regensburg		(MIME and NeXTmail ok)
Germany			WWW:	http://www.whu-koblenz.de/~wolfgang/
GCM/B d-- s: a- C++ US+++$ UX+++ P+ L E? W++ N++ w-- O-(++) M+ !V PS++ PE
Y+ PGP(++) t+ 5? X? R+ tv b++ DI D++ G e+++>++++ h+ r++>% y? (Geek Code
V3.x)


--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From perry at piermont.com  Tue Jun  4 12:30:20 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 03:30:20 +0800
Subject: Java
In-Reply-To: <199606040626.XAA09729@netcom7.netcom.com>
Message-ID: <199606041306.JAA08943@jekyll.piermont.com>



Bill Frantz writes:
> At 10:22 PM 6/3/96 -0400, Perry E. Metzger wrote:
> >I've been rather hard on Java here lately.
> 
> I'll say.  You have also ignored some of Java's other features.  Machine
> independence is probably the most important.

Many languages are machine independent. Thats hardly a new feature.

> A nice, small, easy to learn language is another.

Scheme, anyone?

However, your point is taken. Java is a neat little language in many
ways. However, that isn't cause enough for literally fifty books on
the subject to be on display, including breathless ones proclaiming
"Tips from experienced Java programmers!" as if there are any in the
world at this point. There are dozens of cute little languages in the
world -- scheme, smalltalk, etc, etc.

I mean, with all the "Teach yourself Java in 21 days" and company
books coming out, you would think you were dealing witht he major
application programming language for the world instead of something
that at the moment is used for almost nothing more interesting than
fake scrolling LED sign applets.

> If you want defense in depth, run your Java interpreter in an OS
> environment which limits the interpreter's access to only those resources
> you wish it to access.

Since that doesn't exist, it isn't an option for my users. It is not,
in any case, my obligation to make Java secure. I'm not the one hyping
it.

> >Beyond that, however, they have created the ultimate hype
> >monster. Java is a neat idea looking for a good application. I use the
> >web all day long and I have yet to see a good use for Java.
> 
> There have been discussions of crypto applications in Java.

Useless, almost, for a web environment.

If you want to really put Crypto in netscape, the plugin facilities
and a good C compiler are a better tool, and C is 99% portable.

> While, as a number of us have pointed out, there are problems
> doing crypto with Java, it may be the easiest way to deliver strong crypto
> quickly to Joe Websurfer.

You could hand any websurfer a Netscape PGP plugin without much work
at all, and you could easily build it on lots of platforms. After all,
look at how many platforms that lowly C code like PGP runs on.

Perry





From bryce at digicash.com  Tue Jun  4 13:10:41 1996
From: bryce at digicash.com (bryce at digicash.com)
Date: Wed, 5 Jun 1996 04:10:41 +0800
Subject: cycle market
Message-ID: <199606041351.PAA21165@digicash.com>



-----BEGIN PGP SIGNED MESSAGE-----

I was trying to think what I would use a cycle market for.  The
only thing that I wait for more than a minute on currently is
compiling.  It might be quicker to ship my source code to a
remote compilation service with big pipes and big engines.
Considering that I've got a Pentium 120 on my desktop, though,
those would have be pretty big engines to make up for the time
lost in transmission of source and compiler output (both
compiler messages and object files.)


Just musing out loud.


Regards,

Bryce



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i
Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2

iQB1AwUBMbQ/d0jbHy8sKZitAQHRFgL/Ydkbb4ieFryq1ZRwAVPR0/gksKdVMJ88
rWXGmqpHh810mi1vqgEjWL3XSJL1ogoN6GXuvpZQufvN0ldShOr+fDiodYX6g53K
gK+6Z5WTUzTS6Wn1I/IGuSQ86Om4+JOg
=MQ0q
-----END PGP SIGNATURE-----





From cme at ACM.ORG  Tue Jun  4 14:00:20 1996
From: cme at ACM.ORG (Carl Ellison)
Date: Wed, 5 Jun 1996 05:00:20 +0800
Subject: (VTW) BillWatch #48
In-Reply-To: <199606040139.VAA21219@panix3.panix.com>
Message-ID: <v03006f02add9f38467c5@[168.143.8.144]>

A non-text attachment was scrubbed...
Name: not available
Type: text/enriched
Size: 1685 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/19960605/5cc651ea/attachment.bin>

From ncognito at gate.net  Tue Jun  4 14:13:20 1996
From: ncognito at gate.net (Ben Holiday)
Date: Wed, 5 Jun 1996 05:13:20 +0800
Subject: Asendmail v0.5beta
Message-ID: <Pine.A32.3.93.960603181502.59148A-100000@hopi.gate.net>



Okay, so i'm an idiot. :)  I ran out the door in such a hurry on friday
that I didn't bother to make the asendmail package globally readable.
Apologies to everyone who tried to get a copy and got a permission denied.

It is now really and truely available from:

http://www.infonex.com/~ncognito/asendmail.tar.gz

Sorry for the hassles. 









From maldrich at grci.com  Tue Jun  4 14:17:31 1996
From: maldrich at grci.com (Mark O. Aldrich)
Date: Wed, 5 Jun 1996 05:17:31 +0800
Subject: your mail
In-Reply-To: <199606040046.RAA17821@netcom6.netcom.com>
Message-ID: <Pine.SCO.3.93.960604095742.10472A-100000@grctechs.va.grci.com>


On Mon, 3 Jun 1996 qut at netcom.com wrote:

> ncr terminals are the most 31173 D0Dz
> 

Sheesh!  Come up with a better backwards/upside-down spelling of "elite," 
will ya?  "31173" is pretty lame (as, it would seem, are you), considering
you ought to be able to use extended and international character sets..... 

------------------------------------------------------------------------- 
|      Liberty is truly dead              |Mark Aldrich                 | 
|    when the slaves are willing          |GRCI INFOSEC Engineering     | 
|     to forge their own chains.          |maldrich at grci.com            | 
|        STOP THE CDA NOW!                |MAldrich at dockmaster.ncsc.mil | 
|_______________________________________________________________________| 
|The author is PGP Empowered.  Public key at:  finger maldrich at grci.com |
|    The opinions expressed herein are strictly those of the author     | 
|         and my employer gets no credit for them whatsoever.           | 
-------------------------------------------------------------------------






From ncognito at gate.net  Tue Jun  4 14:37:56 1996
From: ncognito at gate.net (Ben Holiday)
Date: Wed, 5 Jun 1996 05:37:56 +0800
Subject: Electronic Signature Act Of 1996
Message-ID: <Pine.A32.3.93.960604102759.21416A-100000@navajo.gate.net>


(Condensed from AP article)

Florida now recognizes electronic signatures as legal and binding. In
other words - its okay to sign it by modem.

The electronic Signature Act of 1996 passed the Legislature unanimously
and became law Friday. The law does not specify how an electronic document
must be signed, but it probably will mean coding the text and typed
signature so they cannot be changed by anyone other than the writer. 

California and Utah are the only other states that have laws recognizing
electronic signatures.







From nelson at crynwr.com  Tue Jun  4 16:43:12 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Wed, 5 Jun 1996 07:43:12 +0800
Subject: Where are the cryptographers going to come from?
Message-ID: <19960604152234.175.qmail@ns.crynwr.com>


 > >----- Forwarded Cyberia-L message (DAVID POST <postd at EROLS.COM>) -----< 

 > Someone else pointed to a recent story in the Economist, which
 > listed the leading encryption software/services companies
 > worldwide, each of which is Israeli.
 > 
 > Bidzos made the claim, and many others echoed, that the export
 > controls are in the process of doing nothing more than ceding a
 > potentially lucrative market to others, a market in which the US
 > might otherwise be expected to be the dominant player.  It may
 > even, in the eyes of some, be too late to undo this damage.

Not only that, but where are the cryptographers of the future going to
come from for the NSA to recruit?  Israel??  Oh right, foreign
nationals privy to our own highest secrets, give me a break.  Do they
intend to train them themselves?  If so, that's identical in principle
to universities granting tenure to their own graduates.  You get
inbred that way, so universities don't do that.

The principle behind crypto secrecy presumes that other people don't
have the secret.  Once they do, you only hurt yourself by trying to
keep a double-edged sword in the closet.  The NSA believes that they
can and should discard any amount of benefits of crypto in exchange
for avoiding any harm of crypto.  They are wrong.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From sinclai at ecf.toronto.edu  Tue Jun  4 16:58:22 1996
From: sinclai at ecf.toronto.edu (SINCLAIR DOUGLAS N)
Date: Wed, 5 Jun 1996 07:58:22 +0800
Subject: cycle market
In-Reply-To: <199606041351.PAA21165@digicash.com>
Message-ID: <96Jun4.111407edt.9324@cannon.ecf.toronto.edu>


Graphical rendering is one place where I might like a cycle
market.  Finite element simulation is another.





From Clay.Olbon at dynetics.com  Tue Jun  4 17:03:08 1996
From: Clay.Olbon at dynetics.com (Clay Olbon II)
Date: Wed, 5 Jun 1996 08:03:08 +0800
Subject: Java
Message-ID: <ADD9C79B-4063AD@193.239.225.200>


Bill Frantz <frantz at netcom.com> wrote:

>In the long run, I hope to use Java to sell cycles.  Java has the
advantage
>in a cycle market that it is machine independent, and the Just In Time
>compilers should make the performance reasonable.
>

Has anyone written a Java app to implement the Chinese Lottery?  Seems like
a natural way to do it.  A small cash prize might entice lots of folks to
let it run in the background...

	Clay

---------------------------------------------------------------------------
Clay Olbon II            | Clay.Olbon at dynetics.com
Systems Engineer         | ph: (810) 589-9930 fax 9934
Dynetics, Inc., Ste 302  | http://www.msen.com/~olbon/olbon.html
550 Stephenson Hwy       | PGP262 public key: on web page
Troy, MI 48083-1109      | pgp print: B97397AD50233C77523FD058BD1BB7C0
                     TANSTAAFL
---------------------------------------------------------------------------






From jya at pipeline.com  Tue Jun  4 17:23:37 1996
From: jya at pipeline.com (John Young)
Date: Wed, 5 Jun 1996 08:23:37 +0800
Subject: (Fwd) Crypto conference
Message-ID: <199606041439.OAA23122@pipe2.t1.usa.pipeline.com>


>----- Forwarded Cyberia-L message (DAVID POST <postd at EROLS.COM>) -----< 
 
 
I was at EPIC's annual crypto conference yesterday, and just thought I'd 
pass along my impressions. It was, as always, extremely interesting; EPIC 
does a terrific job at these things of getting a very diverse and
thoughtful 
collection of people with interests in crypto policy into the room
together, 
everyone from Whit Diffie and Phil Zimmermann and Eric Hughes to Scott 
Charney of DOJ and Bruce McConnell of the White House, people from the OECD

and the hardware/software community, etc. 
 
 
There were panels on key escrow, digital cash, international developments, 
and the Karn/Bernstein cases and other domestic policy developments.  To
me, 
the most striking feature of the event was what I felt was a new bite to
the 
complaints about export controls.  People have been complaining, needless
to 
say, about these for a while -- but the *economic* case for lifting
controls 
is now in the forefront of the discussion in a way that was not the case 
before, imho.  Indeed, there wasn't an enormous amount of talk about the 
*privacy* implications of encryption this time at all.  Jim Bidzos of RSA 
gave a very powerful talk at lunch, at which he unveiled two chips that are

now being mass produced by Nippon Telephone, one incorporating the 
Triple-DES algorithm, and one with the RSA public key algorithm.  Someone 
else pointed to a recent story in the Economist, which listed the leading 
encryption software/services companies worldwide, each of which is Israeli.

Bidzos made the claim, and many others echoed, that the export controls are

in the process of doing nothing more than ceding a potentially lucrative 
market to others, a market in which the US might otherwise be expected to
be 
the dominant player.  It may even, in the eyes of some, be too late to undo

this damage. 
 
 
Now, some of this may be exaggerated, special interest whining.  But 
there's an interesting hook here.  Many have talked about the importance of

control over "standards " in network industries, the importance of
obtaining 
an early dominant position in the market that can appropriate all of the 
network externalities waiting to be plucked out there.  [Mark Lemley has an

interesting discussion of this in a piece on antitrust on the Net -- Mark, 
is that out anywhere yet?]  Acting quickly to penetrate the market becomes 
critical, not just because markets change on "Internet Time," but also 
because the early entrants have a chance of establishing themselves as de 
facto standards and thereby extending their dominance over time.  This, one

can plausibly argue, is what is happening -- has happened? -- in this 
market.  It is more credible in these kinds of markets to argue, as Bidzos 
was arguing, that if government policymakers wait until there's actual 
evidence of damage, of "lost market share," to US companies, that it will
at 
that point already be too late to do anything about the damage. 
 
---------- 
 
[Second Cyberia-L message by David Post] 
 
 
One other interesting issue generated heated discussion -- as in yelling
and 
screaming between audience and panel -- at the EPIC conference.  Scott 
Charney of DOJ, who heads the US delegation to the OECD crypto guidelines 
conference, was subjected to pretty heated questioning about the
possibility 
that the US is trying to use the international forum as a way to move a 
particular policy agenda that is *not* being successfully peddled at home, 
and then to use the international support as a means of moving the domestic

policy debate in that direction.  Jamie Boyle of AU was particularly 
eloquent about this concern (I raised it too, less eloquently) -- I think
it 
fair to say that both of us had the copyright experience in the back of our

minds, where, many of us believe, the US has been pushing the "Lehman 
agenda" in international discussions as a way of presenting Congress with a

kind of fait accompli.  Charney vigorously denied that this was going on --

he strongly argued that since the OECD guidelines are non-binding (unlike, 
say, the treaty obligations being discussed in the copyright context), 
there's simply nothing wrong with discussing these clearly global issues 
with our international partners. It was, as they say in the press, a 
spirited exchange. 
David 
 
 
********************************* 
David G. Post, Georgetown University Law Center 
Postd at erols.com    202-364-5010 
Cyberspace Law Institute home page http://www.cli.org 
********************************* 
 
 
 
David 
********************************* 
David G. Post, Georgetown University Law Center 
Postd at erols.com    202-364-5010 
Cyberspace Law Institute home page http://www.cli.org 
*********************************





From brucem at wichita.fn.net  Tue Jun  4 17:24:21 1996
From: brucem at wichita.fn.net (Bruce M.)
Date: Wed, 5 Jun 1996 08:24:21 +0800
Subject: Cost of brute force decryption
Message-ID: <Pine.BSI.3.91.960604105230.14677A-100000@wichita.fn.net>



    Windows NT Magazine ran an article in their May 1996 issue titled 
"Secure Enterprise Email - How Safe is Your Mail System" that goes into 
matters of keeping company email private.  PGP and other means of 
encryption are mentioned along with the following:

	"If you can ensure secrecy either until no one cares about the 
information or so that cracking the code costs more than the information 
is worth, it's 'secure enough.'

	"For example a 40-bit key takes about $10,000 worth of supercomputer 
time and two weeks to crack.  Although this key may be adequate to 
protect my checking account, it's probably not large enough for the 
accounts of a major corporation.

	"A slightly longer key of 56 bits requres millions of dollars to 
crack and should protect the information for years to come.  A 56-bit 
encryption key has 2^56-or 72 quadrillion-possible keys.  With 1,000 
computers, each trying 1,000,000 keys per second, trying them all would 
take 833 days.  On average, you find the key halfway through your search.

    I was curious as to what type of formula was used to determine these 
figures since it wasn't mentioned in the article.  Obviously, the speed 
of the computers, method of cracking and other such factors would be 
important to know.  Could anyone shed some additional light on this for 
me?  Thanks.

                    Bruce M. * brucem at feist.com
        ~---------------------------------------------------~
        "Knowledge enormous makes a god of me." -- John Keats






From perry at piermont.com  Tue Jun  4 17:27:52 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 08:27:52 +0800
Subject: Electronic Signature Act Of 1996
In-Reply-To: <Pine.A32.3.93.960604102759.21416A-100000@navajo.gate.net>
Message-ID: <199606041511.LAA09110@jekyll.piermont.com>



Ben Holiday writes:
> Florida now recognizes electronic signatures as legal and binding. In
> other words - its okay to sign it by modem.
[...]
> California and Utah are the only other states that have laws recognizing
> electronic signatures.

The lawyers here can correct me if I am wrong, but I get the
impression that under the common law, an ink signature is merely a
demonstration that a party assented to a contract, and except for
certain contracts (which usually require witnesses etc.) there is no
requirement in the law that a contract even be on paper. Given this, a
digital signature could probably, under existing common law, be used
as evidence of intent in a contract dispute just as a paper and ink
signature could be, except in cases like real estate transfers which I
already mentioned.

Perry





From raph at cs.berkeley.edu  Tue Jun  4 17:59:30 1996
From: raph at cs.berkeley.edu (Raph Levien)
Date: Wed, 5 Jun 1996 08:59:30 +0800
Subject: S/MIME key sizes
In-Reply-To: <v02120d0badd919d1ddb3@[192.0.2.1]>
Message-ID: <31B45529.747B@cs.berkeley.edu>


Lucky Green wrote:
> 
> At 15:58 6/3/96, Raph Levien wrote:
> 
> >   Basically, an exportable S/MIME client can transmit messages up to
> >1024/40 bit RSA/RC2 (or RSA/DES), and receive messages up to 512/64 bit
> >RSA/RC2 (or RSA/DES, but in the latter case I would imagine it's actually
> >restricted to 512/56 because of the keysize of DES). Note that the
> >asymmetry actually points in different directions for the public and
> >symmetric keysizes.
> 
> What will be the maximum keysize for a domestic encryption client? It it is
> larger than 1024 bits, there will be interoperability problems with foreign
> clients. If the domestic client is limited to 1024 bits, it would set a bad
> precedence, since it would effectively require that the encryption key is
> smaller than the largest signature key.

   There is no restriction on non-export keysize, as far as I know. Of 
course, if you do use a key larger than 1024 bits, then export clients 
can not encrypt to you. I don't consider this to be a serious 
limitation. I'd far rather see an error message of "cannot encrypt to 
client - your software is crippled" than "encrypting to recipient with 
super-duper 40-bit cipher". The more crippled the export version appears 
to be, the more pressure there is to upgrade to a non-export version.

   I object to the word "domestic" to refer to non-crippled encryption 
programs. I use "non-export" because that seems least likely to cause 
confusion. Keep in mind that clients developed outside the US are also 
non-crippled. The word "domestic" seems to unfairly exclude them.

Raph





From bdurham at metronet.com  Tue Jun  4 18:28:17 1996
From: bdurham at metronet.com (Brian Durham)
Date: Wed, 5 Jun 1996 09:28:17 +0800
Subject: Gov. archives - NSA
In-Reply-To: <199606041107.LAA11420@avignon.hypereality.co.uk>
Message-ID: <31B46EB2.4470@metronet.com>


Also interesting from a historical cryptography standpoint is the NSA
web site (which you probably already know about).

http://www.nsa.gov:8080/

Interesting information about Soviet one-time pad ciphers and about 
crypto-related documents from the WW2 era that are being declassified.
[I really want to see the picture of a Japanese purple cipher machine.]

But keep in mind, as with the previous post:

> 
> Remember, Big Brother is watching!
> 
> 

Brian Durham
bdurham at metronet.com





From ncognito at gate.net  Tue Jun  4 18:36:26 1996
From: ncognito at gate.net (Ben Holiday)
Date: Wed, 5 Jun 1996 09:36:26 +0800
Subject: Asendmail yet again
Message-ID: <Pine.A32.3.93.960604131256.53274A-100000@seminole.gate.net>



Ok so it isnt really and truely available.  The right URL should have
been: 

http://www.cyberpass.net/~ncognito

If that still isn't right then im gonna assume that god is giving me a
hint and go shoot myself in the head. 


Adios.






From declan at well.com  Tue Jun  4 19:53:50 1996
From: declan at well.com (Declan McCullagh)
Date: Wed, 5 Jun 1996 10:53:50 +0800
Subject: How to explain crypto?
Message-ID: <v01510100adda3101165c@[204.62.128.229]>


Brock, the crypto-challenged, humbly apologizes for his gaffe. He was
looking for a way to draw an understandable comparison of how much harder a
1024-bit implementation of RSA is to break than what current export
controls allow.

He's asking for suggestions on how in future articles he could word this so
a layman could understand it... Preferably something that could be said in
a few sentences. (Brock cops to the fact that it does an incredible
disservice to a complex topic. Remember, tho, he writes for a broad
audience with a way diverse range of understanding -- or misunderstanding,
as the case may be!)

For example, someone sent me this explanation:

  "The 1024 bit key is likely an RSA key, and is not comperable to a 40 bit
  symetric key.  From memory, 1024 bit RSA is about as hard to crack as 90
  bit symetric."

Is this a reasonable comparison?

-Declan







From jimbell at pacifier.com  Tue Jun  4 19:54:42 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 10:54:42 +0800
Subject: Java Crypto API questions
Message-ID: <199606041554.IAA23220@mail.pacifier.com>


At 11:52 PM 6/3/96 -0700, Lucky Green wrote:
>At 16:22 6/3/96, jim bell wrote:
>
>>A signature is just that:  A signature.  It doesn't encrypt or decrypt.  It
>>doesn't even ALLOW the system it's in to encrypt or decrypt, because there
>>are numerous encryption programs written that have no need for such a
>>signature.  If no program existed which _used_ that signature, nobody would
>>think twice about exporting it.
>>
>>The fact is, it is LEGAL to import encryption code into the US.  It is LEGAL
>>to generate an hash of that code, and it is LEGAL to export that hash.  To
>>believe otherwise is to broadly expand the scope of export laws far beyond
>>what they were intended to mean.
>
>First, the ITAR are not laws, but regulations. Second, there are many that
>believe that applying ITAR to crypto software is already expanding the
>scope of the regulations far beyond what they were intended to mean.

I agree.  Which is why I think any acquiescence by Microsoft on the subject 
of exportability of signatures is wrong.  Let the government press its case, 
if it wants to try.  Don't assist it, even rhetorically.

Jim Bell
jimbell at pacifier.com





From jimbell at pacifier.com  Tue Jun  4 20:12:37 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 11:12:37 +0800
Subject: NYT on NTT/RSA Chips
Message-ID: <199606041616.JAA24515@mail.pacifier.com>


At 10:54 AM 6/4/96 GMT, John Young wrote:
>Connecting Declan's three dots [...]: 
>   The New York Times, June 4, 1996, pp. D1, D4. 
>   Japanese Chips May Scramble U.S. Export Ban 
>   By John Markoff 
>   Washington, June 3 -- The Nippon Telegraph and Telephone 
>   Corporation has quietly begun selling a powerful data- 
>   scrambling chip set that is likely to undermine the Clinton 
>   Administration's efforts to restrict the export of the 
>   fundamental technology for protecting secrets and commerce 
>   in the information age. 

 
>   An executive at NTT America said that although there were 
>   no restrictions on the export of cryptographic hardware or 
>   software from Japan, his company was still anxious to 
>   obtain software from RSA Data to use in its chips. That 
>   software is still controlled by United States export law, 
>   he said. 


Maybe it's just me, but the solution to NTT's problem is obvious.  Even 
assuming that the export of this software would be against the law, why 
doesn't somebody simply violate that law?  RSA would publish that software, 
possibly encrypted with NTT's public key, on a public system protected 
against direct export.  "Somebody" would download it, write it to a floppy 
(taking care not to leave any fingerprints, and wetting both the stamp and 
the envelope with tap water, rather than licking them) and mail that floppy 
off to NTT in Japan.  (Naturally, you don't put a return address on that 
envelope.   The truly paranoid would first take that floppy to some store's 
PC section, and cross-load the data onto a floppy written by some other 
floppy drive.)

NTT finds that envelope in their mail, opens it, reads the floppy, decrypts 
the data, and say, "Wow!  It's the data we wanted to get!"  It verifies that 
the data is valid by emailing a copy back to RSA in America, who say, 
"Amazing!  Somebody has illegally exported our software!"

As far as I know, there is nothing wrong with NTT using this software even 
if it is assumed to have been exported illegally.  Obviously, NTT won't 
_ask_ for somebody to do this, because then the government will claim it was 
all a conspiracy, but that doesn't prevent NTT from being the beneficiary of 
somebody else's activities.




Jim Bell
jimbell at pacifier.com





From sandfort at crl.com  Tue Jun  4 20:15:41 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Wed, 5 Jun 1996 11:15:41 +0800
Subject: Electronic Signature Act Of 1996
Message-ID: <2.2.32.19960604165840.00725e30@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

At 11:11 AM 6/4/96 -0400, Perry E. Metzger wrote:

>...I get the impression that under the common law, an ink 
>signature is merely a demonstration that a party assented 
>to a contract, and except for certain contracts (which 
>usually require witnesses etc.) there is no requirement in 
>the law that a contract even be on paper...

The "Statute of Frauds" lists the exceptions and they cover
most important contracts.  I seem to recall that contracts
over a given amount or for interests in real property for 
periods of a year or more are covered.  I'm sure someone 
with current access to legal research resources will post
a better explanation.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







From frantz at netcom.com  Tue Jun  4 20:37:43 1996
From: frantz at netcom.com (Bill Frantz)
Date: Wed, 5 Jun 1996 11:37:43 +0800
Subject: cycle market
Message-ID: <199606041847.LAA22383@netcom7.netcom.com>


At 11:14 AM 6/4/96 -0400, SINCLAIR  DOUGLAS N wrote:
>Graphical rendering is one place where I might like a cycle
>market.  Finite element simulation is another.

Sinclair mentions some of my favorites.  Others are:

(1) Attacking RSA-nnn challanges.
(2) Brute forcing 56 bit keys to demonstrate that 1DES is obsolete.


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From jimbell at pacifier.com  Tue Jun  4 20:43:38 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 11:43:38 +0800
Subject: Export what's imported
Message-ID: <199606041824.LAA02369@mail.pacifier.com>


Recently, Senator Burns introduced that bill, S.1726, "ProCode."  Part of it 
had to do with changes in the export laws to allow export of things that are 
currently not allowed.

It occurs to me that this bill should be amended to say, explicitly, that 
any object or software which has ever been imported into the US can be 
legally exported. (Including multiple copies of software.)  It is 
particularly important that we do this now that the NTT encryption chip set 
has been announced.   Why?

Well, first, we CAN easily justify this.  The claim for export controls is 
that they restrict the access of encryption to various of the horsemen, out 
there.  But by definition anything which has ever been imported is already 
available outside the US, so it'll look rather silly if they try to control 
somebody from export that came from out of the country.

What are the benefits?  Maybe it'll destroy the entire 
crypto-export-regulation system.  Domestic software companies can simply set 
up a practice of buying all their crypto expertise from overseas.  If this 
happened over the long term this would be bad, but it won't because within a 
couple of years good crypto will be exported by American manufacturers based 
on foreign designs.  Pretty soon the export bans will become meaningless 
(even more so than they are today) and the pressure to remove the last 
restrictions will be enormous.

Jim Bell
jimbell at pacifier.com





From dhaskove at ucsd.edu  Tue Jun  4 20:57:45 1996
From: dhaskove at ucsd.edu (Dan Haskovec)
Date: Wed, 5 Jun 1996 11:57:45 +0800
Subject: Class III InfoWar: TST Article
In-Reply-To: <199606022238.WAA16332@pipe2.t1.usa.pipeline.com>
Message-ID: <Pine.SUN.3.91.960604122601.20280A-100000@sdcc10.ucsd.edu>


Here's the reply I got from a friend that I forwarded it to....


     and the verdict is... NetMYTH!  I checked the cite in the article on 
     cyberterrorism... no such article ran on 6/2/96 in the Times 
     (London)... nor, in fact, in any newspaper available on Nexis... 
     just thought I would let you know...

     

On Sun, 2 Jun 1996, John Young wrote:

> This is the article Winn Schwartau cited to last night: 
>  
> ---------- 
>  
>  
>    The Sunday Times (London), June 2, 1996, pp. 1, 24. 
>  
>  
>    City surrenders to L400m gangs [Insight column] 
>  
>  
>    City of London financial institutions have paid huge sums 
>    to international gangs of sophisticated "cyber terrorists" 
>    who have amassed up to L400m worldwide by threatening to 
>    wipe out computer systems. 
[...]





From jimbell at pacifier.com  Tue Jun  4 21:05:50 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 12:05:50 +0800
Subject: (VTW) BillWatch #48
Message-ID: <199606041724.KAA28886@mail.pacifier.com>


At 10:17 AM 6/4/96 -0400, Carl Ellison wrote:

>I was at the EPIC conference yesterday (6/3) -- where Whit Diffie, BTW, 
presented the same argument Steven Cherry gave in this BillWatch  -- but at 
the end of the EPIC conference we had Scott Charney of DoJ on a panel about 
what the OECD is doing (pushing Clipper internationally) and we kept going 
round with him on the administration's pushing of Clipper (N). [One attendee 
described this as "forum shopping" -- looking for a friendly place to push 
Clipper.]
>
>There were people battling him over his alleged representation of the USA 
at the OECD -- claiming he was misrepresenting the country by pushing 
Clipper.  His response was that the Executive is empowered to do all 
international meetings/negotiations/....
>
>After the meeting ended it hit me what the problem is and I mentioned it to 
PRZ.  We're complaining that the Executive has gone rogue -- is disobeying 
the will of the people.  PRZ likened it to Nixon's war in Cambodia.


I have a solution to that problem.


Jim Bell
jimbell at pacifier.com





From paul at ljl.COM  Tue Jun  4 21:14:59 1996
From: paul at ljl.COM (Paul Robichaux)
Date: Wed, 5 Jun 1996 12:14:59 +0800
Subject: Markoff in NYT on NTT/RSA chip
In-Reply-To: <Pine.3.89.9606032128.A10202-0100000@well>
Message-ID: <v03007101adda1bc74f88@[206.151.234.118]>


There are still a few unclear (to me) points about this story:

1. CWD says that RSA's Japanese subsidiary developed the chips. Markoff
says NTT did. It sounds to me like NTT is the more likely developer, since
they have a great deal of silicon design experience.

2. Markoff's story says that NTT doesn't have licenses to use RSA
technology (the quote from Junichi Kishigami), but the bit about safely
swapping private-key info makes me wonder if instead they're using DH-- the
patent for which expires next year. A telecom chipset could make productive
use of DH for key exchange at call setup.

3. Once you import an ITAR item, its export becomes controlled. Importing
the NTT chipset for use, say, in a Motorola cell switch (made in IL) would
seem to be problematic. Buying chips in Japan for shipment to Moto's phone
factories in Singapore and Malaysia, however, would appear to be OK. Under
the present export regs, it's not clear to me how many US manufacturers
would adopt this chipset since it doesn't give them any export relief. If
the NRC's recommendations are adopted, that still won't help, since
triple-DES is over their recommended limit.

The _good_ news is that US manufacturers could put these chipsets into
domestic-only products, and I sincerely hope they will.

-Paul


--
Paul Robichaux                    LJL Enterprises, Inc.
paul at ljl.com                      Be a cryptography user. Ask me how.







From vinnie at webstuff.apple.com  Tue Jun  4 21:21:01 1996
From: vinnie at webstuff.apple.com (vinnie moscaritolo)
Date: Wed, 5 Jun 1996 12:21:01 +0800
Subject: Info on DES crypto program
Message-ID: <v03006f01adda38e7aa44@[17.203.21.75]>


Hey all;

Does anyone have experience or comments about a product called Code Cryptor
from New Mexico Software. I belive it is yet another DES based product. tey
have a web page at:

http://www.swcp.com/cryptor/


"Rah's Samoan Attorney"

Vinnie Moscaritolo
------------------
"friends come and friends go..but enemies accumulate."
http://www.vmeng.com/vinnie/
Fingerprint: 4FA3298150E404F2782501876EA2146A







From owner-cypherpunks at toad.com  Tue Jun  4 21:30:23 1996
From: owner-cypherpunks at toad.com (owner-cypherpunks at toad.com)
Date: Wed, 5 Jun 1996 12:30:23 +0800
Subject: No Subject
Message-ID: <199606042003.NAA24707@toad.com>







From sandfort at crl.com  Tue Jun  4 21:31:53 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Wed, 5 Jun 1996 12:31:53 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <2.2.32.19960604193049.0072daf0@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

In a recent exchange, Carl Ellison wrote:

>After the meeting ended it hit me what the problem is and I 
>mentioned it to PRZ.  We're complaining that the Executive 
>has gone rogue -- is disobeying the will of the people.  
>PRZ likened it to Nixon's war in Cambodia.

To which Jim Bell replied:

>I have a solution to that problem.

My question for member of this list is:  When Bell finally
goes too far and they arrest or shoot him, how can we best
capitalize on his martyrdom?  Or in a more negative light,
what damage control will we need to do in that case?

Now I know that barking dogs rarely bite, but Jim may just
fool us and find his cajones.  In any event, the sort of 
yapping he is doing could itself be considered a crime that 
could attract the sort of negative attention he apparently 
craves.

Any suggestions?


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From gnu at toad.com  Tue Jun  4 21:37:04 1996
From: gnu at toad.com (John Gilmore)
Date: Wed, 5 Jun 1996 12:37:04 +0800
Subject: MELP: 2400 baud speech coding
Message-ID: <199606042031.NAA25407@toad.com>


Mixed-Excitation Linear Predictive encoding gives better speech
quality than CELP at half the data rate.  Encoding and decoding
together burn up more than 100% of a TMS320C3x digital signal
processor at 33MHz -- 64% to encode and 53% to decode.  I don't know
how it does on a Pentium or an Alpha.  If you have the MIPS at both
ends, this enables very robust encrypted speech across modem links to
the Internet.  John Walker's free SpeakFreely software
(http://www.fourmilab.ch/speakfree/windows/speak_freely.html; or
follow the link from there to the Unix version) is already doing
packet replication for high reliability, using the earlier LPC-10
algorithm.  (It doesn't implement MELP, though those on fast CPUs
could add it.)

I noticed an ad in EE Times that said, "MELP: The new Federal Standard
for 2400 bps Speech Coding", so I did a web search for it.  It
reportedly comes from Georgia Tech research.  Atlanta Signal
Processors has the exclusive license.  See
http://www.ti.com/sc/docs/dsps/softcoop/voc-13-1.htm.

	John Gilmore






From vznuri at netcom.com  Tue Jun  4 22:02:23 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Wed, 5 Jun 1996 13:02:23 +0800
Subject: biometric id
Message-ID: <199606042000.NAA14595@netcom19.netcom.com>



info on a biometric id utilizing crypto techniques.

------- Forwarded Message

Date: Fri, 31 May 1996 16:34:40 -0700 (PDT)
From: Phil Agre <pagre at weber.ucsd.edu>
To: rre at weber.ucsd.edu
Subject: biometric encryption

[A Canadian company called Mytec is marketing a biometric encryption
system that, as far as anybody can tell, is an important step forward
for privacy protection.  It is based on fingerprint recognition, but
it does not produce a representation of the fingerprint or recover the
identity of the fingerprint's owner.  Instead, it uses an optically
transformed version of the fingerprint to decrypt a text string that
could be, for example, the private key for a public-key cryptographic 
system such as RSA.  Provided that one trusts the Mytec box, this
would be a way to overcome many of the pragmatic hassles that would
otherwise accompany the privacy-enhancing technologies that David Chaum
and others have described.  For example, they have built their device
into a computer mouse, so that the computer will only generate your
digital signature, or permit your mail to be read, if you are holding
the mouse (or, I suppose, if you have been holding it very recently).
In this message, the president of Mytec responds to some common concerns
about his company's technology that arose in response to a query that
I sent to the Computer Privacy Digest.  He provides the company's web
URL for those who wish to know more.]

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
This message was forwarded through the Red Rock Eater News Service (RRE).
Send any replies to the original author, listed in the From: field below.
You are welcome to send the message along to others but please do not use
the "redirect" command.  For information on RRE, including instructions
for (un)subscribing, send an empty message to  rre-help at weber.ucsd.edu
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Date:       Fri, 31 May 96 11:06:44 EST
From: Computer Privacy Digest Moderator  <comp-privacy at uwm.edu>
To: Comp-privacy at uwm.edu
Subject:    Computer Privacy Digest V8#044

Computer Privacy Digest Fri, 31 May 96              Volume 8 : Issue: 044

- - ----------------------------------------------------------------------

Date: 29 May 1996 09:42:54 -0400 (EDT)
From: gtomko at noc.tor.hookup.net (George Tomko)
Subject: Re: Biometric Encryption

Dear Mr. Levine:

Subject:        Biometric Encryption

I have noticed a number of communications in your news group regarding
Biometric Encryption, especially some concerns about its use.  As one
of the developers of this technology, I would appreciate if the
attached response could be posted in the news group to provide people
with some answers and also to obtain feedback and discussion.

Kind regards.

George J. Tomko, Ph.D.

Several people commented on four concerns in using a finger pattern for
biometric encryption, namely:

1.      It's easy to get someone's fingerprints since they are left on
a vast number of everyday objects, such as drink cans and door handles;

2.      Muggers would start cutting off people's fingers when stealing
their cards;

3.      The crooks would forcibly hold down an individual's finger
against the biometric encryption authentication device to extract the
string coded by the individual's Bioscrypt; and

4.      If the finger used to code the Bioscrypt is damaged or
destroyed, then an individual will not have access to the files
associated with the Bioscrypt.

I will try to answer these concerns in order.  But, first, let me
define a Bioscrypt.  A Bioscrypt is a two-dimensional image of a string
or set of characters which can represent a PIN, encryption key or
pointer and which has been coded (encrypted) by the two-dimensional
information in a fingerprint pattern.  It has the following
properties:

- - -       it has no resemblance to the original fingerprint.
- - -       it cannot be reconverted to the original fingerprint.
- - -       if an optical image of the correct live fingerprint is transmitted
through the Bioscrypt, then the output light beam uniquely represents the
coded number.  By successfully decoding their Bioscrypt, the person also
confirms who they claim to be.

For purposes of the discussion below, it is important to note that the
optical authentication device is a coherent system and uses the phase
information in a finger pattern (complex domain) as a discriminating
parameter.

1.      "Picking up latent prints from door handles, etc."

To perpetrate a masquerade using a latent fingerprint of a legitimate
user is very difficult for the following reasons:

* The system requires a three-dimensional reconstruction of the
legitimate user's fingerprint because the height of the various
fingerprint ridges can modify the two-dimensional complex optical image
which is the input to the authentication device.  There is little
information in a two-dimensional latent print about the depth and the
height of grooves and ridges of the actual fingerprint.

* The three-dimensional reconstruction of the legitimate user's
fingerprint from a latent print would also need to duplicate the
approximate oil and moisture content of the skin, since this is one of
the factors which affects (modulates) the two-dimensional image read by
the system.  Quantifying this information from a latent print is very
difficult.  Even if it were, the three-dimensional reconstruction would
have to be made from a synthetic material which had the same oil and
moisture properties as the legitimate user's skin.  To use an oil/water
based solution to place on the input scanning window would be useless
since this would frustrate all of the light bouncing off the window and
would convey little or no useful information to the optical system.

* The reconstructed fingerprint would also need to be made from a
material with approximately the same elastic properties as the
legitimate user's finger skin.  During enrollment, and subsequently on
authentication attempts, the user slides a finger over the input
scanning window.  This action warps the skin and the corresponding
fingerprint pattern based on the elastic properties of the skin.
Within the population, warping can vary significantly based on age,
dryness of skin, etc. and is thus another unique aspect of the
individual's finger pattern.

2.      "Severing the finger to obtain access."

As already mentioned in some of the previous communications in this
newsgroup, measuring the temperature, humidity, pulse rate and even
heart rate to verify a live finger can be accomplished.  One of the key
factors, though, is after the finger is severed the elastic properties
of the skin change rapidly and thereby would not warp in the same
manner as a live finger pattern.  This would make a cadaverous finger
useless after a period of time.  (Can't find subjects to do a double
blind study though).

3.      "Crooks would forcibly hold down the finger."

By forcibly sliding an individual's finger against the biometric
encryption authentication device (reading device), the string coded by
the Bioscrypt can be extracted.  The string coded by the individual's
finger pattern Bioscrypt could then be used for a one-time access for
whatever purposes the string was intended.  However, assuming that the
individual is freed, he can then use his finger pattern to code a
completely different string to prevent repetitive access.

The system is robust in that it is very easy to change PINs, encryption
keys or computer pointers.  It was suggested in some of the messages
that a pass phrase be used in conjunction but, again, if an individual
is holding your finger down forcibly, to extend that to pointing a gun
to your head to divulge the pass phrase is not an extreme assumption.
There is no perfect security system out there and I doubt one will ever
be designed since it has to work with real human beings.  I suggest
that the goal is to provide privacy-enhancing technology that handles
the majority of the infringement cases and that, for exceptional
circumstances where extreme privacy and security must be guaranteed, we
combine the biometrics (something you are) with the pass phrase
(something you know) and a token (something you have).  If the
combination of those three doesn't do it, then at this stage of
technological evolution, nothing will cut it.

4.      "Losing or damaging a finger with the result of not being able
to access the Bioscrypt and related files."

One of the properties of optical processing is that composite patterns
can be made and thereby used to make the Bioscrypt.  Accordingly, more
than one finger could be used or a finger and a proprietary pattern
(which one keeps hidden away somewhere).  Of course, there is a
penalty.  The more patterns one uses, the smaller the signal to noise
ratio of the system.  The system is currently designed to give signal
to noise ratios in the order of 10 to 12 dB and thereby significant
degradation can still occur which would allow comfortably two to three
patterns to be superimposed in the same Bioscrypt.

If you are interested, more information can be gained by accessing
Mytec's web page at http://www.mytec.com.

- - --
George J Tomko
Mytec Technologies Inc.
Toronto, Ontario

- - ------------------------------

End of Computer Privacy Digest V8 #044
******************************


- ------- End of Forwarded Message


------- End of Forwarded Message






From sjb at universe.digex.net  Tue Jun  4 22:02:34 1996
From: sjb at universe.digex.net (Scott Brickner)
Date: Wed, 5 Jun 1996 13:02:34 +0800
Subject: Multiple Remailers at a site?
In-Reply-To: <199606020659.XAA25720@toad.com>
Message-ID: <199606042040.QAA15977@universe.digex.net>


Bill Stewart writes:
>>I don't think multiple remailers at the same site help anything.
>
>Assume Alice, Bob, and Carol are on abc.com and Xenu, Yak, and Zut
>are on xyz.com.  Remailing between Alice, Bob, and Carol doesn't
>make appear to make much difference, but it does reduce the damage
>if one of the remailer's keys is compromised.  On the other hand,
>mail from Alice -> Xenu -> Bob -> Yak -> Carol -> Zut adds traffic
>to the system, and makes traffic analysis more difficult,
>even if the Bad Guys are watching site abc.com and have stolen
>Alice, Bob, and Carol's keys.

Wait a minute.  More traffic should make analysis easier, since traffic
analysis is mostly statistical work on the source and destination (not
necessarily "from" and "to").  A bigger sample makes more reliable
results.

For traffic analysis, I don't know *who* sent the message (it was,
after all, anonymized), but I do know a site which transmitted it and
one which received it, the time it was transmitted, and maybe its
size.  Multiply this times a whole bunch of messages, and I can infer
information about "common interests" between those sources and
destinations.

The delays and mixing done by remailers make it harder by
disassociating the true sender from the true receiver.  If a remailer
were to ignore this step, the analyst can deduce from the two data
points

    "message a, source A, destination RemailerX, time t, size s"
    "message b, source RemailerX, destination B, time t+0.001s, size s"

that there's some connection between A and B.  The more such evidence,
the stronger the connection.  If the remailer does a good job with
the delays and shuffling, then it becomes difficult for the analyst
to match message a with message b, leaving him with what he already
knew (that A and RemailerX have a common interest, as to B and RemailerX,
but the interests may be wholly unrelated).

Multiple remailers on the same machine increases the resolution of
the address information, at best, improving the analysts ability to
make connections.  The same traffic load going to a single remailer
at the site makes the analyst's job harder.

>The other threat it helps with is that if XYZ.COM gets complaints
>about that evil user Zut, she can kick her off (Bad Zut!)
>and still leave Xenu and Yak alone; if the remailer service
>were provided by the machine owner herself she might be directly liable.

Hmm.  Nothing really stops the machine owner from creating a personal
anonymous account to run the remailer.  When someone complains, shut it
down and create a new one.  There isn't yet a law which requires that
the owner be able to identify the user.  This affords the same
protection that multiple users does.





From cme at cybercash.com  Tue Jun  4 22:04:45 1996
From: cme at cybercash.com (Carl Ellison)
Date: Wed, 5 Jun 1996 13:04:45 +0800
Subject: CWD: "Jacking in from the "One that Got Away" Port (fwd)
Message-ID: <2.2.32.19960604194607.0031e8dc@cybercash.com>



>(By Brock Meeks / brock at well.com / Archived at http://www.cyberwerks.com/)
>
>
> CyberWire Dispatch // Copyright (c) 1996 //
>
> Jacking in from the "One that Got Away" Port:
>
> Washington, DC -- President Clinton call your spooks, get FBI Director
> Louis Freeh on the phone.   Tell them to order in pizza.  Bill, it's
> going to be a long night.   All your plans to hold the U.S. crypto
> market hostage have just been fucked... and you didn't even get kissed.
>
> A virtual tactical nuke was hurled into the arcane subculture of
> encryption technology Monday when RSA President Jim Bizdos revealed
> that his company's Japanese subsidiary had developed a monster chipset
> capable of scrambling voice and data real time with a so-called "key
> length" of up to 1024 bits.

Brock,

        you have probably heard by now -- this is wrong.

        The chip set was developed by a subsidiary of NTT called NEL.
That's much worse, of course, than if it had been an RSA subsidiary.

 - Carl

+--------------------------------------------------------------------------+
|Carl M. Ellison          cme at cybercash.com   http://www.clark.net/pub/cme |
|CyberCash, Inc.                              http://www.cybercash.com/    |
|207 Grindall Street           PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 |
|Baltimore MD 21230-4103       T:(410) 727-4288     F:(410)727-4293        |
+--------------------------------------------------------------------------+






From jimbell at pacifier.com  Tue Jun  4 22:07:15 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 13:07:15 +0800
Subject: Where are the cryptographers going to come from?
Message-ID: <199606042100.OAA11210@mail.pacifier.com>


At 03:22 PM 6/4/96 -0000, nelson at crynwr.com wrote:
> The NSA believes that they
>can and should discard any amount of benefits of crypto in exchange
>for avoiding any harm of crypto.  They are wrong.

I think the truth is even more revealing.  We can hypothesize that 
allowing widespread use of good crypto has many advantages and just a few 
disadvantages.  However, those disadvantages may almost all accrue to 
government and its employees, and very few to ordinary citizens.   This 
means that talking up the disadvantages of good encryption is doubly 
fraudulent, because the audience they should be trying to convince (ordinary 
folks) doesn't realize that the disadvantages generally don't apply to them. 
 And of those few crimes against ordinary citizens where crypto might play a 
role, that role will almost always be to PREVENT the crime rather than allow 
it.

Jim Bell
jimbell at pacifier.com





From droelke at rdxsunhost.aud.alcatel.com  Tue Jun  4 22:11:43 1996
From: droelke at rdxsunhost.aud.alcatel.com (Daniel R. Oelke)
Date: Wed, 5 Jun 1996 13:11:43 +0800
Subject: cycle market
Message-ID: <9606042028.AA08650@spirit.aud.alcatel.com>


> 
> I was trying to think what I would use a cycle market for.  The
> only thing that I wait for more than a minute on currently is
> compiling.

Just try doing some large graphical operations - especially 
raytracing/rendering type stuff, or heavy graphical analysis
of a set of image data.  Fractal drawing falls in this realm as well.
Then try doing some ASIC simulation, or finite element analysis.

In this group it also goes without saying that there are also things 
like factoring large numbers that a cycle market would be ideal for.

Dan
------------------------------------------------------------------
Dan Oelke                                  Alcatel Network Systems
droelke at aud.alcatel.com                             Richardson, TX






From unicorn at schloss.li  Tue Jun  4 22:18:01 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Wed, 5 Jun 1996 13:18:01 +0800
Subject: Electronic Signature Act Of 1996
In-Reply-To: <2.2.32.19960604165840.00725e30@popmail.crl.com>
Message-ID: <Pine.SUN.3.91.960604155003.8159A-100000@polaris>


On Tue, 4 Jun 1996, Sandy Sandfort wrote:

> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>                        SANDY SANDFORT
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> C'punks,
> 
> At 11:11 AM 6/4/96 -0400, Perry E. Metzger wrote:
> 
> >...I get the impression that under the common law, an ink 
> >signature is merely a demonstration that a party assented 
> >to a contract, and except for certain contracts (which 
> >usually require witnesses etc.) there is no requirement in 
> >the law that a contract even be on paper...
> 
> The "Statute of Frauds" lists the exceptions and they cover
> most important contracts.  I seem to recall that contracts
> over a given amount or for interests in real property for 
> periods of a year or more are covered.  I'm sure someone 
> with current access to legal research resources will post
> a better explanation.

Section 2-201 of the Uniform Commercial Code (UCC) provides:

(1) Except as otherwise provided in this section a contract for the sale of 
goods for the price of $500 or more is not enforceable by way of action 
or defense unless there is some writing sufficent to indicate that a 
contract for sale has been made between the parties and signed by the 
party aginst whom enforcement is sought or by his authorized agent or 
broker.

[...]

(3) A contract which does not satisify the requirements of subsection (1) 
but which is valid in other respects is enforceable:

(a) If the goods are to be specially manufactured for the buyer and are 
not suitable for sale to others in the ordinary course of the seller's 
business and the seller, before notice of repudiation is received and 
under circumstances which reasonably indicate that the goods are for the 
buyer, has made either a substantial beginning of their manufacture or 
commitments for their procurement; or

(b) If the party against whom enforcement is sought admits in his 
pleading, testomony or otherwise in court that a contract for sale was 
made, but the contract is not enforceable under this provision beyond a 
qualtity of goods admitted; or

(c) With respect to goods for which payment has been made and accepted or 
which have been received and accepted (See section 2-606).

*end

Note:  This only applies to the sale of GOODS.  Not all states follow the 
UCC exactly.  Note also that the term "good" is a term of art which has a 
complex and non-intuative meaning.

Is it a sale of goods?  (If yes, has the forum adopted the UCC?  If no, 
then is there a state Statute of Frauds to look to?)
If it's not a sale of goods, well, then you have piles of contracts 
reading to do.

In short:  While it is safest to provide for contracts larger then $500 
in writing, there are many ways that contracts can be formed for millions 
of dollars without a drop of ink or scrap of paper.  (Promisory Estoppel 
comes to mind).


>  S a n d y

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From frantz at netcom.com  Tue Jun  4 22:19:55 1996
From: frantz at netcom.com (Bill Frantz)
Date: Wed, 5 Jun 1996 13:19:55 +0800
Subject: Markoff in NYT on NTT/RSA chip
Message-ID: <199606042119.OAA07875@netcom7.netcom.com>


At 12:08 PM 6/4/96 -0500, Paul Robichaux wrote:
>2. Markoff's story says that NTT doesn't have licenses to use RSA
>technology (the quote from Junichi Kishigami), but the bit about safely
>swapping private-key info makes me wonder if instead they're using DH-- the
>patent for which expires next year. A telecom chipset could make productive
>use of DH for key exchange at call setup.

They could use RSA for key exchange outside the USA because RSA is only
patented in the USA.  With a license for RSA they could also sell them in
the USA.  My reading of the New York Times article is compatible with the
view that Jim Bidzos is driving a hard bargin for such a license. 
(However, the article does say that NTT has already sold chips to IBM in
the US.  I guess you can sell, but not deliver, until you get the license.)

Obviously if you are outside the USA, you will buy your equipment from
Japan Inc.  US manfactures will be frozen out.  (However the US can still
compete for the Chinese market since such privacy will be illegal there
:-). )


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From steven at echonyc.com  Tue Jun  4 22:28:52 1996
From: steven at echonyc.com (Steven Levy)
Date: Wed, 5 Jun 1996 13:28:52 +0800
Subject: Class III InfoWar: TST Article
In-Reply-To: <Pine.SUN.3.91.960604122601.20280A-100000@sdcc10.ucsd.edu>
Message-ID: <Pine.SOL.3.91.960604163240.338A-100000@echonyc.com>


If it's a myth, it's quite an elaborate one. On Saturday night I was 
interviewed by the BBC about this.  The producer read the entire article 
to me, telling me in was on the front page of the Times. (My comments 
were not about the specific story, but the underlying security issues.) I 
don't think he was making it up.

Maybe the London Times isn't on Nexus.

Steven

On Tue, 4 Jun 1996, Dan Haskovec wrote:

> Here's the reply I got from a friend that I forwarded it to....
> 
> 
>      and the verdict is... NetMYTH!  I checked the cite in the article on 
>      cyberterrorism... no such article ran on 6/2/96 in the Times 
>      (London)... nor, in fact, in any newspaper available on Nexis... 
>      just thought I would let you know...
> 
>      
> 
> On Sun, 2 Jun 1996, John Young wrote:
> 
> > This is the article Winn Schwartau cited to last night: 
> >  
> > ---------- 
> >  
> >  
> >    The Sunday Times (London), June 2, 1996, pp. 1, 24. 
> >  
> >  
> >    City surrenders to L400m gangs [Insight column] 
> >  
> >  
> >    City of London financial institutions have paid huge sums 
> >    to international gangs of sophisticated "cyber terrorists" 
> >    who have amassed up to L400m worldwide by threatening to 
> >    wipe out computer systems. 
> [...]
> 





From vznuri at netcom.com  Tue Jun  4 22:40:16 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Wed, 5 Jun 1996 13:40:16 +0800
Subject: whitehouse web incident, viva la web revolution
Message-ID: <199606041959.MAA14492@netcom19.netcom.com>



here's an interesting message about a white house aide pressuring
HotWired to change their link pointing to a rant page about Clinton.

it reminds me of a recent court decision in which a school tried
to shut down a student's web page that he had done on his own
time and referred to his school and other teachers.

it used to be, "freedom of the presses only belongs to those who
own a press". actually this still is, except now it only costs
$20/mo to own a worldwide "cyberspace press" via web pages.

hence what we get are interesting new social situations reminiscent
of the tension that surrounded Martin Luther's posting of the 99
theses in the middle ages. you have people who had controlled
the situation suddenly put off balance by a new medium. 

the power of information dissemination is rather significant,
and the web is the most sophisticated information dissemination 
technology ever invented by man. I expect it to have very far-reaching
social ramifications. we have barely scratched the surface..

cpunks are very interested in things like anonymity to save
oneself from the government. another approach is to simply
crow-bar the government in any way you can, whenever possible,
to make it better serve your interests. web pages have this
intrinsic power-- they're like a subtle, invisible crow bar that can
influence the world via public opinion. could there be a day
when nobody sees a need to hide from a government, because it
is so uninvasive?

------- Forwarded Message

From: "Steve Wingate" <steve at linex2.linex.com>
Date: Sat, 1 Jun 1996 20:27:28 -0700
Subject: (Fwd) WH Censorship of Web Sites (Attempted)


- - ->  SearchNet's   snetnews   Mailing List

- - ------- Forwarded Message Follows -------
Date:          Sat, 1 Jun 1996 20:38:12 -0500 (CDT)
To:            cs at oak.oakland.edu
From:          ed at athenet.net (Edward Immler)
Subject:       WH Censorship of Web Sites (Attempted)

The Skeleton Closet (at http://www.realchange.org) provides a site for
those things presidential candidates would rather not discuss.  They
cover all candidates and include a link to our current Prez.  I've
included the link below.  

Looks like this was quietly reversed, the offender sent on (to a nice
job), and nothing in the national media.

Clipper, V-chip, and now plain-old intimidation.  The WH is working
hard to control your info.

Ed
*********************************************************************


[Mr. Tall Skeleton2]   Bill Clinton's Skeleton Closet   [Mr. Tall
Skeleton]

                           [Picture of Clinton]

News Flash: White House Suppresses Skeleton Closet

In a shocking blunder, the White House successfully put pressure on
Hotwired Magazine to stop linking President Clinton's name to this
very web page. This was all done behind the scenes -- we had no idea
until we read Brock Meek's Netizen column of April 30th.

The White House official involved, David Lytel, was in charge of
creating the popular Clinton White House web site. He recently left
the White House, and is working for a private web page consultant. At
a conference, he attacked Netizen for being cynical and unfair, citing
the Skeleton Closet link. Meeks, in response, noted that Hotwired had
removed the link after receiving official pressure from the White
House. In Hotwired's "Threads" discussion, another Hotwired employee
admitted that they had been "intimidated" by receiving email from the
"whitehouse.gov" domain early in Netizen's infancy, and said she
regretted that they caved in.

Lytel's argument -- that it was "dishonest" to link Clinton's name to
a page criticizing him -- is silly of course. Apparently, he thinks
the only "honest" link is one that goes to a person's own web page, no
matter how self- serving it is. More to the point, this is a terrible
precedent. As far as we know, it is the first attempt by any American
government to squelch part of the Internet for nakedly political
reasons. (The attack on adult material online, while obviously
political, has legitimate issues -- or at least a reasonable excuse --
behind it.) And doing it privately, behind closed doors, makes it even
worse.

If we were simply seeking publicity, we'd run to Republican
politicians (who desperately need an issue) and hope they try to use
it. But that would be hypocritical. It's exactly that kind of partisan
misuse of legitimate scandals that we are trying to make obsolete here
- - -- because it muddles legitimate issues (like White House censorship
of critics) in stupid, partisan manipulation. We're trying to contact
the White House directly, to get them to disavow Lytel's actions.
We'll let you know what happens.

Update: White House Backs Down, Sort Of.

We challenged the White House to confirm or deny that Lytel pressured
Hotwired, to disavow his actions if true, and commit to a policy of
avoiding this type of censorship.

Within two days, they replied as follows:

"Date: Fri, 03 May 1996 17:06:49 -0400 (EDT)
From: WEBMASTER (WEBMASTER at a1.eop.gov)
Subject: RE: White House WWW Comments
To: webmaster (webmaster at realchange.org)
Posting-Date: Fri, 03 May 1996 17:09:00 -0400 (EDT)

It is our policy not to interfere with the content of other WEB
sites."

We'll take that as an admission that Lytel was out of line, and a
solid commitment to doing the right thing in the future. Of course,
they didn't live up to that policy before, and words are cheap.

- - ----------------------------------------------------------------------
- - ---- And now, on with the Clinton's Skeleton Closet page.

What can we say about Bill and Hillary that hasn't been said before?
Clinton's scandals are covered in such loving detail by his enemies
that we are providing you with links to various Clinton scandal pages.
Eventually, we will boil it all down and sort out the really good dirt
from the crazy stuff, but there's JUST SO MUCH to wade through!

The frustrating thing about Clinton's scandals is that the press
focuses on two-bit scandals of little importance, such as Whitewater
and this ridiculous travel office "scandal", while ignoring much more
significant dirt, such as the Mena, Arkansas contra supply and drug
operation (see link below), Hillary's $100,000 commodity profit from a
$1,000 investment, and a new charge -- that a federally funded
educational operation in New York paid her $100,000, for who knows
what.

And no one (save a few voices on the left) are protesting Clinton's
hugely successful fundraising and favors for people who have provided
it, including the Tyson Chicken empire. Running against Gramm, Dole
and Alexander, this isn't likely to be an issue, but it is a major
fault of the President.

Political Favors for Campaign Contributors

Though his administration floundered at first, Clinton has quickly
learned one aspect of Washington -- how to raise money from business
interests. He has set records in fund-raising, eclipsing even Dole's
huge haul (though not by much.) Of course, if Dole was President he
would no doubt regain the lead.

And some contributors seem to think their money is well spent. For
example, Clinton raised over a quarter million dollars from ADM, Bob
Dole's major benefactor, and pushed through a regulation benefiting
them mightily.

On the other hand, 2 Arkansas firms that formerly bankrolled Clinton
(and received help from his administration) have switched their
support to Dole -- both Tyson Chicken and Stephens investment brokers
apparently figure Dole gives a better return per contribution dollar,
or is more likely to win.

Money and Favors: Archer Daniels Midland

For example, he has received at least $270,000 from Archer Daniels
Midland corporation, the agricultural giant famous for spreading money
among various influential people, from Bob Dole to National Public
Radio. Just days after Clinton received a $100,000 check in June 1994,
his administration ordered that 30% of gasoline sold in American's 9
most polluted cities contain ethanol based additives by 1996 (as
opposed to cheaper methanol.)

Archer Daniels makes 60% of US ethanol for gas, and none of the
methanol. Bob Dole, who receives even more money from Archer Daniels
and its president, actually supported the Clinton Administration's
mandate, even while arguing against Clinton's health care proposal for
nearly identical federal mandates. (Courts have block Clinton's 30%
rule, saying he lacked power to favor ethanol over methanol.)

$100,000 for Hillary from an Educational Foundation

This allegation just came out January 10, so bear with us on it's
sketchiness. New York state's new Attorney General Dennis Vacco (a
Republican) is investigating a $100,000 in payments to Hillary or the
Rose Law Firm from the National Center on Education and the Economy, a
charity that was in Rochester New York and has since moved to
Washington, DC

Hillary was on their board, as were Mario Cuomo and Ira Magaziner, but
no other board members were paid. The justification is that Hillary
was paid to carry out some programs. When this story came out a month
ago, Vacco announced he was asking for contracts with Hillary or the
Rose Law Firm and a description of any work she actually did. Nothing
more has come of it, which -- in an election year - indicates that
nothing substantial has turned up.

- - ----------------------------------------------------------------------
- - ---- Try these links, but use a grain of salt; some of the sources are
pretty marginal.

Disgraced Clinton Administration Officials

Yahoo's Whitewater Scandal Page

Mena, Arkansas: Contra & Drug Smuggling Center?

Nick Chase's Mena, Arkansas and Whitewater pages.

Quotes

"I'm someone who has a deep emotional attachment to 'Starsky and
Hutch.' " -- Bill Clinton, 1996

"I don't think [Bill Clinton] is fooling around anymore. Nor do I
think he will. I read that Hillary threw a lamp at him. ... You know
something? I think she did." -- Ann Landers

Sources

"Primary Colors", by 'Anonymous', 1996

Wall Street Journal, in general, and in particular:
....January 12, 1996 pA14
....January 8, 1996 pA1
....December 18, 1995 pA16
....December 29, 1995 pA1
....March 23, 1995 p A1
....February 22, 1995 p A1
....January 13, 1995 p A12

"The Mena Coverup", Micah Morrison, Wall Street Journal, October 18,
1994 p A18

"The Real Cost of Ethanol" and "Dwayne's World", Dan Carney, Mother
Jones, January, 1995

"Aides Saw Political Threat In Clinton Loans From '90", Jeff Gerth,
New York Times, May 6, 1995 p7

"Ann Landers Repents For Slurring The Pope", Associated Press,
December 1, 1995

"Blocking the Box", Rick Marin, Newsweek, March 11, 1996

"NY Official Probes Payment to Mrs. Clinton", Associated Press,
January 12, 1996

BACK TO SKELETON CLOSET

Paid for by Real People For Real Change PAC and not authorized by any
candidate or candidate's committee.

Real People For Real Change is registered with the Federal Election
Commission as a non-affiliated, independent political action
committee.

Copyright 1996 Real People For Real Change PAC
  *******************************************************************
  *Edward F. Immler                      Lawrence Chemists          *
  *ed at athenet.net                        are Free Radicals          *
  *                                                                 *
  *Lawrence University '95                                          *
  *Interests: HAZMAT, EPA/OSHA Compliance, SARA III, Wastewater     *
  *DISCLAIMER: Opinions are mine...unless someone else agrees       *
  *******************************************************************



Anomalous Images and UFO Files
http://www.linex.com/ufo/

- - -> Send "subscribe   snetnews " to majordomo at alterzone.com
- - ->  Posted by: "Steve Wingate" <steve at linex2.linex.com>

- ------- End of Forwarded Message


------- End of Forwarded Message






From vznuri at netcom.com  Tue Jun  4 22:43:59 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Wed, 5 Jun 1996 13:43:59 +0800
Subject: Java
In-Reply-To: <199606041306.JAA08943@jekyll.piermont.com>
Message-ID: <199606042058.NAA19741@netcom19.netcom.com>



maybe Java is about a generation gap in programming languages...??

>Bill Frantz writes:
>> At 10:22 PM 6/3/96 -0400, Perry E. Metzger wrote:
>> >I've been rather hard on Java here lately.
>> 
>> I'll say.  You have also ignored some of Java's other features.  Machine
>> independence is probably the most important.
>
>Many languages are machine independent. Thats hardly a new feature.

you don't get it, as others have pointed out repeatedly. you conveniently
ignore Frantz' points about the well-known difficulties of porting C. there
is a big difference in what is conneted by the word "portable". 
if it take a zillion different makefile rules to create the "same"
program on different machines, is that "portable"? isn't that
defeating the purpose somewhat? c is "sort of" portable. it is
"in theory" portable. Java is portable "in theory and practice".

>However, your point is taken. Java is a neat little language in many
>ways. However, that isn't cause enough for literally fifty books on
>the subject to be on display, including breathless ones proclaiming
>"Tips from experienced Java programmers!" as if there are any in the
>world at this point. There are dozens of cute little languages in the
>world -- scheme, smalltalk, etc, etc.

a little clue to you Perry, there are so many Java books because there
is such a huge market for them. I always thought you were an 
anarchocapitalist and in favor of "letting the market decide". in a
sense you are arguing with the market, it seems, in much the same
way a liberal might say, "why are all you greedy businessmen hyping
your railroads so much?!?!?"  however I fully grant you that Java has been
the most hyped computer language on the planet. (but then again, I
didn't hear you whining when Intel started their "intel inside" 
campaign). I think what you are seeing is that people are excited
by the possibilities. the public has grasped the message behind Java,
which at this point is more about potentialities. its like saying,
"who is the next marc andreesson?" 

the problem appears to be simply that you are annoyed that other people are
excited about java, and you seem not to like excitement. you don't
like hype. well, personally, I think the hype is pretty damn amusing.
the world couldn't have given the slightest damn about geek computer
programmers say 5 years ago, but after the internet and Netscape, Yahoo,
and Java it's suddenly incredibly trendy. I think its quite enjoyable.
I suppose if I was over 40 and worked in a conservative wall street firm,
I'd have a totally different view. maybe Java is all about a generation
gap in computing. hey!! the first language that the "older generation"
hates. sounds like a good reason to go after it, sort of like rock-n-roll
and Woodstock suddenly being aged and uncool.

>I mean, with all the "Teach yourself Java in 21 days" and company
>books coming out, you would think you were dealing witht he major
>application programming language for the world instead of something
>that at the moment is used for almost nothing more interesting than
>fake scrolling LED sign applets.

actually, the quality is not all that great in all of them, I agree. 
I thought for example Van Der Linden's "Just Java" is a pretty weak one. 
it has paper airplane instructions in parts of it. but hey, maybe
again its a generation gap thing. I bet I would have really enjoyed
the book and thought it "way cool" in my teens. <g>

>Since that doesn't exist, it isn't an option for my users. It is not,
>in any case, my obligation to make Java secure. I'm not the one hyping
>it.

no, but you are the one ranting at it. why? it is not Java's 
obligation to make OSes more secure either!!! @#$%^&*


>You could hand any websurfer a Netscape PGP plugin without much work
>at all, and you could easily build it on lots of platforms. After all,
>look at how many platforms that lowly C code like PGP runs on.

look at the complicated PGP makefiles. count how many MAN MONTHS of additional
testing and work is required merely to deal with the makefiles. count
how many BUGS are due to improper compilations. count how hard it
is to track this kind of thing. count how hard it is to test your
makefiles not given that you have all the zillion different environments
you are supporting immediately available for testing.

every language is about tradeoffs. if you continue to say that C
is better than Java for just about anything, then you clearly are
not saying anything very relevant based on most people's opinions.

why am I arguing with you on this? because while you are usually
a pretty sensible person, you are really way off
base on this one. the world requires a mix of conservatism and
imagination. you've got the conservatism down totally, but the
imagination part you are lacking, and hence your criticism of
java. PM, imagine yourself at the invention of the LAN, or the PC,
or the C language. what would you have said to the designers? 
"you are all boneheads!! what you are doing can't be done!! you
are wasting your time!!"  do you think perhaps that every useful
computing tool that can be invented has already been invented?
hee, hee.








From perry at piermont.com  Tue Jun  4 22:46:20 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 13:46:20 +0800
Subject: PM's Java Envy
In-Reply-To: <199606042033.NAA17694@netcom19.netcom.com>
Message-ID: <199606042232.SAA09572@jekyll.piermont.com>



"Vladimir Z. Nuri" writes:
> PM returns to rant on Java after being mowed down by most people
> her. why? I think he has some more ulterior problems with Java
> than those that he cites. for Perry, ranting at java reveals
> certain psychological characteristics of his profile.

Detweiler, just because you see lots of psychiatrists during your days
in the sanitarium doesn't mean you qualify as one.

Perry





From frantz at netcom.com  Tue Jun  4 22:56:25 1996
From: frantz at netcom.com (Bill Frantz)
Date: Wed, 5 Jun 1996 13:56:25 +0800
Subject: Java
Message-ID: <199606042119.OAA07878@netcom7.netcom.com>


At  9:06 AM 6/4/96 -0400, Perry E. Metzger wrote:
>Bill Frantz writes:
>> I'll say.  You have also ignored some of Java's other features.  Machine
>> independence is probably the most important.
>
>Many languages are machine independent. Thats hardly a new feature.
>...
>However, your point is taken. Java is a neat little language in many
>ways. However, that isn't cause enough for literally fifty books on
>the subject to be on display, including breathless ones proclaiming
>"Tips from experienced Java programmers!" as if there are any in the
>world at this point. There are dozens of cute little languages in the
>world -- scheme, smalltalk, etc, etc.

I guess I tend to react to the Java hype with bemusement rather than
horror.  I enjoy joking with the clerks at Computer Literacy Bookstore
about the "Java book of the day".  However, unlike so much of the
industry's over hyped marketing, with Java there is actually something
worth while hidden under the massive hype.

Java appears to have a chance of being adopted widely in the industry.  We
can discuss until the cows come home why Smalltalk, Scheme etc. have not
achieved wide usage.  I suspect it may be a combination of unfamiliar
syntax, licensing issues, version compatibility issues, and the inability
to do low level programming.  These issues may also hit Java, but for now
it is the nicest language around with a bandwagon behind it.  If it
replaces Basic, that will be a significant step forward.
 

>I mean, with all the "Teach yourself Java in 21 days" and company
>books coming out, you would think you were dealing witht he major
>application programming language for the world instead of something
>that at the moment is used for almost nothing more interesting than
>fake scrolling LED sign applets.

I agree that all the hype has been about applets.  However there is one
common non-applet Java application that shows that significant applications
can be written in Java.  That application is the Java compiler itself.  If
you are running on a Sun system, you can do real applications today.  (On
the Mac you are still in the "applet jail", but I haven't opened the latest
Java environment that arrived on my desk last month, so I may be obsolete.)


>> If you want defense in depth, run your Java interpreter in an OS
>> environment which limits the interpreter's access to only those resources
>> you wish it to access.
>
>Since that doesn't exist, it isn't an option for my users. It is not,
>in any case, my obligation to make Java secure. I'm not the one hyping
>it.

I thought this was the effect the Unix people get when they run
applications such as firewall code in a "chroot jail".  Perhaps Netscape
could make you happy by having its Unix based browsers run Java applet
interpreters in such a jail.  (I don't know, Unix is an imperfectly spoken
foreign language to me.)


>You could hand any websurfer a Netscape PGP plugin without much work
>at all, and you could easily build it on lots of platforms. After all,
>look at how many platforms that lowly C code like PGP runs on.

Why don't we have one of these now?  (N.B. not a rhetorical question)


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From mark at unicorn.com  Tue Jun  4 23:31:06 1996
From: mark at unicorn.com (Rev. Mark Grant, ULC)
Date: Wed, 5 Jun 1996 14:31:06 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <Pine.3.89.9606042126.A15786-0100000@unicorn.com>


On Tue, 4 Jun 1996, Dan Haskovec wrote:

> Here's the reply I got from a friend that I forwarded it to....
>      and the verdict is... NetMYTH!  I checked the cite in the article on
>      cyberterrorism... no such article ran on 6/2/96 in the Times
>      (London)... nor, in fact, in any newspaper available on Nexis...
>      just thought I would let you know...

Hate to tell ya, but I read this article on Sunday on the front page of a
real, physical, paper copy of the Sunday Times. Now admittedly I read it
in a film studio so they might have faked it, but that would be some
strange coincidence.

	Mark






From warlord at MIT.EDU  Tue Jun  4 23:53:39 1996
From: warlord at MIT.EDU (Derek Atkins)
Date: Wed, 5 Jun 1996 14:53:39 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
In-Reply-To: <199606040228.WAA17430@unix.asb.com>
Message-ID: <9606041912.AA01215@bill-the-cat.MIT.EDU>


> > I have a growing feeling that PGP 3 is never going to happen. Or that if it
> 
> I'm soft-of having that feeling too.  Or what's going to happen is 
> that enough people will get impatient and international versions will 
> start to appear.

Unfortunately the 80-20 rule is hitting the PGP development team
really hard.  We had 80% of the code done about 6 months ago, and it's
been taking a LONG time to get the other 20% up to speed.  This is a
COMPLETE re-write of the whole system, from scratch, from the bottom
up (and top down).  It was NOT a small feat, and it takes time.  As it
is I feel rushed to get it out the door.

I know that I need to make the API document available, and I'm working
to do that.  But I have to offset the time I spend coding to the time
I spend working on the API document(s) to the time I spend jumping
through hoops to make the PGPlib project happen.  The more time I
spend working on one part, the longer it takes for the other parts to
happen.

So, would you rather see a document right away, or code released
sooner?  Take your pick and let me know. :)

-derek





From weidai at eskimo.com  Wed Jun  5 00:09:29 1996
From: weidai at eskimo.com (Wei Dai)
Date: Wed, 5 Jun 1996 15:09:29 +0800
Subject: C++
In-Reply-To: <199606040626.XAA09729@netcom7.netcom.com>
Message-ID: <Pine.SUN.3.93.960604142353.15547E-100000@eskimo.com>


> [As an aside, when I attempted to compile Wai Dei's crypto lib 2.0 with the
> Symantec Project Manager C++ compilers, none of the 3 would compile it. 
> The one which generated the fewest errors had "internal error" on two
> modules.  This problem occurs because C++ is such a large language, with a
> number of obscure features which compiler writers don't always handle.  In
> addition, C++ is in no way machine independent.  The simplest example is
> that sizeof(int) is machine dependent.]

It's true that C++ is large and has many features, some obscure.  But the
fact is most of those features are actually very useful.  I suspect many
experienced C++ programmers do not like Java even though Java looks a lot
like C++ because they are so used to having those features in C++.  Take a
look at Victor's earlier post on this subject.

Portability is certainly one of the big problems of C++.  But it can be
done and should become easier in the future as the compilers standarize. 
If anyone has trouble compiling Crypto++, please send me a report so I can
help you figure out workarounds.  Also, send bug reports to the compiler
company if you think there are bugs in the compiler.

Wei Dai







From unicorn at schloss.li  Wed Jun  5 00:10:35 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Wed, 5 Jun 1996 15:10:35 +0800
Subject: Saw this on CNN: Anonymous Stock tips over IRC as bad???
In-Reply-To: <mmaZoD50w165w@bwalk.dm.com>
Message-ID: <Pine.SUN.3.91.960604164615.11159B-100000@polaris>


On Mon, 3 Jun 1996, Dr.Dimitri Vulis KOTM wrote:

> Black Unicorn <unicorn at schloss.li> writes:
> > I direct you to Dirks v. Securities and Exchange Commission, 463 U.S. 646
> > (1983).
> 
> rev'g 681 F.2d 824 (D.C.Cir.1982), SEC. Rel #34-17480 (Jan 22, 1981).

[...]

> his tippees. The decision was upheld by the Court of Appeals but _reversed
> by the Supreme Court on the grounds that the insider did not breach his
> fiduciary duty by disclosure of the information because there was no benefit
> to the insider, and thus Dirks did not breach any duty."

I'm not sure where you got this quote.  Probably a commentator who knows 
jack about securities regulation.  They reversed because the SECs 
conclusion was expansive even with respect to Chiarella, which it 
implied it was following:  "Where 'tippees' - regardless of their 
motiviation or occupation- come into possession of material 'information 
that they know is confidential and know or should know came from a 
corporate insider,' they must either publically disclose that information 
or refrain from trading"  21 SEC Docket 1401, 1407 (1981).

> I.e., Dirks got
> away with it, after spending lots of $$$ on shysters.

I'm not sure I agree with your read of the facts here at all.

You failed to mention that Dirks called the Wall Street Journal with his
findings in an effort to expose the massive frauds at three times and was 
ignored each time.  (William Blundell was the Journal reporter).

Dirks began to tell everyone under the sun about his own first hand 
investigations (he visited Equity Funding in LA and talked to officers 
and employees) only after he was repeatedly ignored by the Journal and 
other publications (which refused to believe that Equity was twisted as a 
pretzel).  Neither Dirks nor his firm ever held interests in Equity Funding.

As word spread of the fraud, Equity funding lost half its value in two 
weeks.  California impounded Equity's records and revealed the fraud 
officially.  Finally, the SEC (who Dirks had also yelled at and been 
ignored by) filed a complaint (3 weeks later) and the Journal Published a 
story (front page April 2, 1973).

It was then, and amid criticism of the SEC, that a complaint was filed 
against Dirks and the SEC found Dirks had aided and abetted violations of 
section 17(a) of the Securities Act of 1933, rule 10b and 10b-5 among 
others.  After a massive stink, the SEC backed off and stated that Dirks 
"played an important role in bringing [Equity Funding's] massive fraud to 
light," 21 SEC Docket at 1412.  The SEC elected to drop charges, and only 
censured Dirks.

Dirks wasn't buying this bill of goods (it seemed to have the tendency to 
repeatedly destroy his career) and instead and appealed to the Court of 
Appeals for the District of Columbia Circuit to clear his good name.  
(No fines or restrictions were imposed on Dirks, they merely held him out 
to be a crook in public).  The District Court entered against Dirks and he 
appealed to the Supreme Court which reversed.

Easy to demonize the defendant when you don't have all the facts.

> IANAL,

Apology accepted.

> but I see a trend to let insiders get away with trading on material
> non-public information in Chiarella v. U.S. (455 US 222 (1980)) followed by
> Dirks.

An odd analysis considering both Chiarella and Dirks simply refine the 
defintion of insider instead of allowing the SEC to designate it.

> ---
> 
> Dr.Dimitri Vulis KOTM
> Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com








From unicorn at schloss.li  Wed Jun  5 00:12:03 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Wed, 5 Jun 1996 15:12:03 +0800
Subject: On the Hill: Child Porn "Morphing"
Message-ID: <Pine.SUN.3.91.960604163805.11159A-100000@polaris>



Hearings on the hill over the child pornographer horseman:

"Morphing" seems to be the latest buzzword for putting childrens faces on 
the bodies of adult models in sexually explicit poses and seems to have 
attracted enough attention to warrant congressional attention.

Interesting that the media is playing this up as a "net" deal.  (As if 
somehow it were impossible to do without the all powerful and evil internet.

I'd like to see exactly how they word the proposed prohibitons.  What 
constitutes "child" when the face painted on is pure artistry?  Will we 
see a simple and strict prohibition over modifiying sexually explicit 
pictures to make them appear to be of younger models (whatever their 
apparent age may be)?  Will we see a subjective test as to what is "child 
looking" enough?

Silliness.  All silliness.

Prediction:  Some manner of law will be on the books (Or perhaps passed, but 
unsigned) before the election attempting to prohibit some form of this 
activity.  Certainly Clinton is not going to veto such a bill before the 
election, which is doubtlessly when the right is going to try to push it 
through.  (Can they streamline it enough to get a vote in time?)

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From perry at piermont.com  Wed Jun  5 00:16:09 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 15:16:09 +0800
Subject: Markoff in NYT on NTT/RSA chip
In-Reply-To: <199606042119.OAA07875@netcom7.netcom.com>
Message-ID: <199606042249.SAA09659@jekyll.piermont.com>



Bill Frantz writes:
> (However, the article does say that NTT has already sold chips to IBM in
> the US.  I guess you can sell, but not deliver, until you get the license.)

IBM already has an RSA license, so perhaps that could cover it for IBM
use.

.pm





From perry at piermont.com  Wed Jun  5 00:17:33 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 15:17:33 +0800
Subject: Java
In-Reply-To: <199606042058.NAA19741@netcom19.netcom.com>
Message-ID: <199606042238.SAA09594@jekyll.piermont.com>



"Vladimir Z. Nuri" writes:
> >Many languages are machine independent. Thats hardly a new feature.
> 
> you don't get it, as others have pointed out repeatedly. you conveniently
> ignore Frantz' points about the well-known difficulties of porting
> C.

Who said anything about C, Detweiler. Smalltalk. Scheme. Postscript. 
There are dozens of them out there. All of them are totally machine
independent. You could run Smalltalk images byte for byte identical on
large numbers of different processors years and years and years
ago. Byte codes aren't new either -- Smalltalk's virtual machine, PSL
and others had them decades ago.

The rest of your comments are equally silly.

Perry





From tcmay at got.net  Wed Jun  5 00:20:46 1996
From: tcmay at got.net (Timothy C. May)
Date: Wed, 5 Jun 1996 15:20:46 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <adda2c40020210044527@[205.199.118.202]>


At 7:30 PM 6/4/96, Sandy Sandfort wrote:

>To which Jim Bell replied:
>
>>I have a solution to that problem.
>
>My question for member of this list is:  When Bell finally
>goes too far and they arrest or shoot him, how can we best
>capitalize on his martyrdom?  Or in a more negative light,
>what damage control will we need to do in that case?
>
>Now I know that barking dogs rarely bite, but Jim may just
>fool us and find his cajones.  In any event, the sort of
>yapping he is doing could itself be considered a crime that
>could attract the sort of negative attention he apparently
>craves.
>
>Any suggestions?

As we've all learned from our studies of quantum cryptography, the answer
lies in Bell's Theorem. As we know, Bell's Theorem says that if a Bell is
ever removed in one place, another Bell appears someplace else
instantaneously.

Glad to be of help.

--Klaus! von Future Prime








From jya at pipeline.com  Wed Jun  5 00:25:46 1996
From: jya at pipeline.com (John Young)
Date: Wed, 5 Jun 1996 15:25:46 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <199606042153.VAA24301@pipe3.t1.usa.pipeline.com>


On Jun 04, 1996 12:29:02, 'Dan Haskovec <dhaskove at ucsd.edu>' wrote: 
 
 
>Here's the reply I got from a friend that I forwarded it to.... 
> 
> 
>and the verdict is... NetMYTH!  I checked the cite in the article on  
>cyberterrorism... no such article ran on 6/2/96 in the Times  
>(London)... nor, in fact, in any newspaper available on Nexis...  
>just thought I would let you know... 
 
 
Gosh, Dan, your friend may want to double-check. After reading Winn
Schwartau's post, I bought a copy of The Sunday Times here in NYC late
Sunday in which the article led at the top of the Front Page. 
 
 
Be glad to fax anyone a copy who may want such, ahem, verification. E-mail
me a number. 
 
 
However, I acknowledge that there is a chance that the TLAs, or Net
security/info war consultants (like Schwartau, et al) planted the article,
a fake to generate scare-funding and boost conference attendance. Or maybe
it's a classic Brit joke, a spoof  -- or a sting by the Intergalactic Net
Police. 
 
 
Strange terrorist ripoffs happen -- incredible IPOs, vaporware
millionaires, and such. 
 
 
 





From jwilk at iglou.com  Wed Jun  5 00:38:52 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Wed, 5 Jun 1996 15:38:52 +0800
Subject: Senator Exon & me
Message-ID: <m0uR7Nb-00037KC@mail.iglou.com>


I am not one to lash out at anyone but now I feel it is appropite to tell
the group what our very own Senator Exon has said to myself. If you do not
care then delete this e-mail but if you would like to hear what a senator
said to a 13 year old then read on. 

I will not put on the whole letter just the parts that I deem inapropite. 

He wrote:

I'm not flaming you. You might not even get flamed this time. But you will be.
This is just the kind of message which I hate. It is a waste of my time and
a waste of time for people who have a lot less time than I. Please wait for
a legitimate reason to post. I might patronize your age but I won't - I was a
13-year-old net kid once.

#1 If you really wanted to show just had balls (I hate to use the phrase but
I can't think of anything better) you wouldn't hide behide remailers.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring

He wrote:
I don't want to be around the first time you send your girlfriend(s)
e-mail. I predict an ass-kicking of MAJOR proportion.

#2 This is kinda an inside joke
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I really hate to waste your people times with my messages but aren't we all
on this mailing list to learn? I'm 13 hell, I bet there are people on the
list that are 5 times as old as me. I want to say that I really wanted to
talk to Senator Exon on an IRC channel but I can't seem to mail him due to
his cowerdness. I want to apologize to everyone that I may have said some
things things that were wrong in the past but I'm learning and hope to have
a great job in the computer indusrty (if there really are any). 

i will close saying that it was wrong that someone would creatique a 13 year
old's signatrure. I feel that is wrong but hell, I guess I just to young to
be a cyberkid. Thank you for hearing me out. :-)

Ps if you want the full letter e-mail me and i'll sent it to you.

Quoting my computer teacher at school- "The internet has its share of cool
people and its lamers. The lamers are your people on AOL, hacker wantabees
and your government officals"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage     Gaa- 3.69
<jwilk at iglou.com>         Record- 2-4-4
Age- 13                   Final Standings- 2nd Place (Beat in Championship)

President & Founder:
                   
Revolution Software       "I have the fastest glove in the east!"
Profanity Software        "Hackers never stop hacking they just get caught"
VSoft

My life- Rarely eat or sleep, Hack til' 7:00a, goto school, play goalie
til' 8:00p, hack til' 7:00a
Hank Aaron- d:-)!-<   Pope- +<:-)   Santa Claus- *<:-) The Unabrower |:-)

Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring

Personal Quote- Mr Plow, thats my name, that name aguin is Mr. Plow 
-Homer Simpson
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From tcmay at got.net  Wed Jun  5 00:43:22 1996
From: tcmay at got.net (Timothy C. May)
Date: Wed, 5 Jun 1996 15:43:22 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <adda35c8040210048255@[205.199.118.202]>


At 8:34 PM 6/4/96, Steven Levy wrote:
>If it's a myth, it's quite an elaborate one. On Saturday night I was
>interviewed by the BBC about this.  The producer read the entire article
>to me, telling me in was on the front page of the Times. (My comments
>were not about the specific story, but the underlying security issues.) I
>don't think he was making it up.

On the substance of Schwartau's claims about "HERF guns," I'm a bit
skeptical that this is a real threat _at this time_. I'll say more on this
later.

On some of the points raised by the article, some things don't compute. At
one point it is claimed that no one who in London (and presumably
elsewhere) would ever dare to comment on threats received or extortion
demands met. If so, how does the author know such threats have actually
been made? (I mean credible threats, not anonymous call-in threats, such as
bomb threats.)

I read Winn Schwartau's book, "Information Warfare," as preparation for
being interviewed for a BBC "Horizon" show called "The I-Bomb."
Coincidentally, a friend of mine who shall remain nameless was doing some
consultation work on this very issue (HERF guns, suitcase impulse sources,
etc.).

Magnetohydrodynamic RF sources--not to be confused with "electromagnetic
pulse" (EMP) from extraatmospheric nuclear blasts--can generate huge RF
fields in small packages, by focussing explosions in conjunction with coils
to launch the pulses.

So, why am I so skeptical? For a couple of reasons:

1. Conventional explosives work perfectly fine for a lot of sabotage
efforts. It is unlikely that a mysterrious van is likely to be parked next
to a London brokerage or computer firm in the City of London, given their
history of terrorism.

2. To be a credible threat, there usually needs to be some form of
"demonstration." I have heard of no such thing. Absent such a public
demonstration, I find it hard to believe that beancounters would OK the
giving away of hundreds of millions of dollars for a threat which is
abstract and hard to understand for laymen.

3. This recent story smacks of hype. I'm not saying Schwartau is hyping his
conferences and his book, and his consulting business, just saying it
strikes me as a hyped threat without direct confirmation.

So sue me. (On second thought, in this litigious society, please don't.)

--Tim May


Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From teddygee at visi.net  Wed Jun  5 00:51:49 1996
From: teddygee at visi.net (Ted Garrett)
Date: Wed, 5 Jun 1996 15:51:49 +0800
Subject: NYT on NTT/RSA Chips
Message-ID: <2.2.32.19960605005329.0076a668@mail.visi.net>


At 09:12 AM 6/4/96 -0800, someone claiming to be <jimbell at pacifier.com> wrote:

>Maybe it's just me, but the solution to NTT's problem is obvious.  Even 
>assuming that the export of this software would be against the law, why 
>doesn't somebody simply violate that law?  RSA would publish that software, 
>possibly encrypted with NTT's public key, on a public system protected 
>against direct export.  "Somebody" would download it, write it to a floppy 
(...)
>As far as I know, there is nothing wrong with NTT using this software even 
>if it is assumed to have been exported illegally.  Obviously, NTT won't 
>_ask_ for somebody to do this, because then the government will claim it was 
>all a conspiracy, but that doesn't prevent NTT from being the beneficiary of 
>somebody else's activities.

What is wrong with this is that, because RSA did not, in practice deliver
the software to NTT, they can have no expectation of payment.  Thus begins
a trumped up lawsuit in international court, and it will eventually cost
RSA more to collect on the sale than the sale was worth.  As many rock-solid
implementations of the RSA algorithms as are out there, all NTT has to do
is go to an FTP site in the netherlands.  Done deal.  But what about the
copyrights (which are still unclear) and the US patents?  NTT would not be
able to market their system in the US without losing face.

Not gonna happen.

Just my $.02...
--
PGP key available on the keyservers --
A wise man said that if one seeks to preserve his security by giving up
a measure of his freedom, he shall not have either one for long...
Dude's Dead.





From mccoy at communities.com  Wed Jun  5 01:01:08 1996
From: mccoy at communities.com (Jim McCoy)
Date: Wed, 5 Jun 1996 16:01:08 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <v02140b02adda8b4b956f@[205.162.51.35]>


Sandy writes:
>
> In a recent exchange, Carl Ellison wrote:
>
> >After the meeting ended it hit me what the problem is and I
> >mentioned it to PRZ.  We're complaining that the Executive
> >has gone rogue -- is disobeying the will of the people.
> >PRZ likened it to Nixon's war in Cambodia.
>
> To which Jim Bell replied:

Hmmm... time to fix my Jim Bell filter, this message seemed to have
gotten around it.

>
> >I have a solution to that problem.

Yes, I am sure Jim does.  Expect a few Treasury agents to visit
him in the near future regarding threats against the president,
they seem to be a little overzealous about this statute...
(a felony I believe...)

> My question for member of this list is:  When Bell finally
> goes too far and they arrest or shoot him, how can we best
> capitalize on his martyrdom?  Or in a more negative light,
> what damage control will we need to do in that case?

A movement is not complete until it has a few nuts who claim
you are not going far enough, only then does it have a chance
of being incorporated into the mainstream.  I would suggest
just ignoring him, and once he is arrested claim he was a plant
by the IRS :)

jim







From adam at homeport.org  Wed Jun  5 01:21:25 1996
From: adam at homeport.org (Adam Shostack)
Date: Wed, 5 Jun 1996 16:21:25 +0800
Subject: Info on DES crypto program
In-Reply-To: <v03006f01adda38e7aa44@[17.203.21.75]>
Message-ID: <199606050248.VAA29523@homeport.org>


They store keys in a TOKEN file.  They don't encrypt this apparently, 
"Never send unencrypted TOKENS on the internet."

Bad key management, if you ask me.

2 Versions, one with 40 bit keys (CMDF?) is $99, the other is 'more
expensive.'  An awful lot of money for plain old des.  Viacrypt PGP
for the mac is about $129.

Adam

vinnie moscaritolo wrote:

| Hey all;
| 
| Does anyone have experience or comments about a product called Code Cryptor
| from New Mexico Software. I belive it is yet another DES based product. tey
| have a web page at:
| 
| http://www.swcp.com/cryptor/

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From mccoy at communities.com  Wed Jun  5 01:23:25 1996
From: mccoy at communities.com (Jim McCoy)
Date: Wed, 5 Jun 1996 16:23:25 +0800
Subject: cycle market
Message-ID: <v02140b00adda538b7b78@[205.162.51.35]>


Bryce writes:
> I was trying to think what I would use a cycle market for.  The
> only thing that I wait for more than a minute on currently is
> compiling.

Tasks which are inherently parallel (preferably ones where the
various processes are loosly coupled and the need for inter-task
communication is low) are the first things that come to mind,
because advances in the speed of CPUs does not give you the same
advancement increment in solving these problems.  Some examples:

        -rendering and ray tracing
        -simulation
        -analysis of large datasets
        -genetic algorithms and genetic programming (something I am
         working on creating a "cycle market" for in my spare time)

The other class of tasks which could use such a market are those which
are limited more by bandwidth than by processor speed.  If the server can
be given many "heads" which can provide the service (with the back-end
processing done by cycle markets) then it is possible to make significant
gains in distributing the I/O load and getting around network latency by
creating server which is "virtually omnipresent."

jim







From perry at piermont.com  Wed Jun  5 01:24:42 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 5 Jun 1996 16:24:42 +0800
Subject: Java
In-Reply-To: <199606042119.OAA07878@netcom7.netcom.com>
Message-ID: <199606042241.SAA09606@jekyll.piermont.com>



Bill Frantz writes:
> >You could hand any websurfer a Netscape PGP plugin without much work
> >at all, and you could easily build it on lots of platforms. After all,
> >look at how many platforms that lowly C code like PGP runs on.
> 
> Why don't we have one of these now?  (N.B. not a rhetorical question)

I don't know. I suppose its because cypherpunks post stupid commentary
on non-cryptographic issues. Perhaps you should suggest it as a
project on CoderPunks.

> I thought this was the effect the Unix people get when they run
> applications such as firewall code in a "chroot jail".  Perhaps Netscape
> could make you happy by having its Unix based browsers run Java applet
> interpreters in such a jail.  (I don't know, Unix is an imperfectly spoken
> foreign language to me.)

Chroot isn't a real solution for this sort of application.

Perry





From nelson at crynwr.com  Wed Jun  5 01:25:36 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Wed, 5 Jun 1996 16:25:36 +0800
Subject: Multiple Remailers at a site?
In-Reply-To: <199606020659.XAA25720@toad.com>
Message-ID: <19960604232157.2053.qmail@ns.crynwr.com>


Scott Brickner writes:

 > If the remailer does a good job with the delays and shuffling, then
 > it becomes difficult for the analyst to match message a with
 > message b, leaving him with what he already knew (that A and
 > RemailerX have a common interest, as to B and RemailerX, but the
 > interests may be wholly unrelated).

Nope.  Not if each of them runs a remailer.  That's why mixmaster is
SO WONDERFUL.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From vznuri at netcom.com  Wed Jun  5 01:29:13 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Wed, 5 Jun 1996 16:29:13 +0800
Subject: PM's Java Envy
In-Reply-To: <199606040222.WAA06345@jekyll.piermont.com>
Message-ID: <199606042033.NAA17694@netcom19.netcom.com>



PM returns to rant on Java after being mowed down by most people
her. why? I think he has some more ulterior problems with Java
than those that he cites. for Perry, ranting at java reveals
certain psychological characteristics of his profile.

>For at least twenty or more years, people have known that for the
>ultimate in multimedia email or what have you all you would need to do
>is make the recipient execute a program that you sent them. This
>obviates all the questions of having to figure out what sort of things
>you would want to send -- if you can execute a program, you can do
>anything. Unfortunately, this is also so phenomenally obvious a
>security problem that no one ever proposed it as anything more than a
>joke -- until now.

so you agree, what they are trying to solve is the holy grail of
distributed computing, in some ways. but you start from a different
assumption-- that such a thing is a joke to even try. they are
forging ahead because they have started with the opposite assumption.

>Sun is, unfortunately, suffering from a substantial hubris problem. As
>I have noted, the original Java applet security model and all the
>followups have had exactly the same problem -- they depend on perfect
>implementation of every element of the security model for the security
>to work, instead of having the realistic and conservative assumption
>that portions of the model will be misimplemented, and designing for
>defense in depth.

true, but as I have reiterated here, there is nothing preventing
someone from creating an IMPLEMENTATION of Java that has the
"defense in depth" that you are always ranting about. why don't you
INVENT it??? such a thing is possible. Java is mostly a theoretical
construct: a language. implementations are left up to different
licensees. how else would you  propose handling it? surely the
NSA would have plenty of suggestions for putting a lock and
chain around ideas. the rest of us in the real world would like to
get some computing done.

I continue to believe that everything you are asking for could be
integrated into somebody's ingenious invention of a Java interpreter.
something that implements all the features of Java in a secure way.

notice, Perry, that if there was such a thing as a secure OS, you
could just stick your Java browser in it and not care at all. you
have your "redundant systems protection" if you already have a 
good OS. what? there aren't good OSes? well, why are you blaming
someone who is writing a computer language because their aren't
fully secure OSes?

wouldn't Java running on a Kerberos system come close to the kind
of security and redundancy you are proposing? such systems will
probably evolve in the future. but why is a problem outside
of java considered a problem of java itself by you? 

speaking of "hubris", I think it is you that is the most "full of it".
you don't seem to understand some simple conceptions, which I have
stated before in response to your ranting but you have never 
really replied to in the past:

1. NOBODY IS ASKING PERRY METZGER TO USE JAVA. people who ARE using
it may have different needs and demands than you have. who are you
to criticize all the people who have made an independent decision,
"java is what we want"?

2.  java threatens CONTROL by individuals over what they allow to
run on their machines. it's the old "mainframe vs. PC" problem all
over again. surprise!! pc's won. WHY? because people wanted to
get work done without going through an all-powerful MIS priesthood.
but surprise, some companies still are implementing a priesthood
around their PCs. Java will help break through such kinds of monopolies.
you are free to reject it, but you are getting a glimmer of understanding
that Java threatens the idea of monopolistic, monolithic control
over computing resources. the sysadmin with his own narrow interests
may no longer be the only one who has say over how company computing
resources are used.

3. no one is claiming Java is perfect. it will take years before
a high level of trust is established. no one is implementing all kinds
of incredibly sensitive applications in Java, YET. it is an evolutionary
process.

4. in evolutionary processes, you aren't trying to find nirvana or
utopia, or solve problems that no one has ever been able to solve.
you make an *incremental*step*. Java is precisely this very valuable
incremental step. I don't know why you continue to rant so endlessly
against it. NO ONE IS ASKING YOU TO USE IT. your comments are not very
valuable, either, considering that YOU ARE NOT USING IT. perhaps the
people who are USING IT are far more qualified to judge whether
it is fulfilling their needs, eh?

5. the world is very insecure right now in terms of computer security.
java is a step in the right direction. there are a bazillion places
it can be plugged into right now in which you get *better*security*
than what you had before by using it. now, I wouldn't recommend
placing it anywhere where you would have *less* security, but I 
trust designers of systems to have some sense about that. (yes,
there are a lot of bonehead designers in the world, but why do you
think it is a problem with Java exclusively? granted, the hype
machine is way out of control, and this can lead to improper uses
of the language, but there are still a lot of places where it
is useful).

6. if you could point to some EXAMPLES of people using Java that
shouldn't be, and ARE, then you will have a much better case.
but all you have at the moment is a nagging suspicion that all
kinds of people are using Java where it shouldn't be placed.

7. frankly I think you have "security envy" of pioneers who are
creating the next generation of cyberspace and didn't pay some
monstrous consulting fee to you in doing so. I think you would
have liked to have been behind Java, because it is the next
step in a field you feel you are an expert in, but instead it
appeared on the scene without you ever taking it seriously, and
you are increasingly pissed off that other people are taking
it seriously, and that your arguments, which at one point people
might have agreed with, are becoming less valid in the face of
reality as people begin to understand what java is for (and
not for!!).

8. criticizing something because it is not evolved is a bad
way to go. C started out as the most flimsy of languages. there
were serious bigtime problems with it. early compilers had 
ambiguities, etc. things get better. the way of the world is
evolution. the tools that *you* are using *now* could have
been criticized in their infancy as completely insufficient
for the jobs they were "aspiring" to. they *were*. things
like PCs were once the most disrespected "toys" on the planet.
and you criticize Java because it is "toylike"? beware, PM, 
because the toys of today become the tools of tomorrow.

>
>Beyond that, however, they have created the ultimate hype
>monster. Java is a neat idea looking for a good application. I use the
>web all day long and I have yet to see a good use for Java. We have,
>essentially, mortgaged our system security for almost nothing better

"we"??? hee, hee. someone who is the first to slash someone with 
claw-marks for using that term here among the Nihilists uses it himself.
there was absolutely no system of security prior to java for what it
is attempting to implement. the world is not going to end when everyone
starts playing with java applets. I agree that there should be some
serious question about where companies allow browsers with Java (or
browsers for that matter) to be run. but you have this kind of
siege mentality, "we're being invaded!! POUR DOWN THE HOT OIL!!"

>than the occassional gee whiz animation that could have been
>implemented with a safe graphics description format instead of a
>turing equivalent language.

a killer java app hasn't yet been written, imho and other. 
so what? why are you whining about it? again, no one is forcing you to use 
java. the killer app lies around the corner. the PC didn't start out
with excel written for it, and only an illtempered, impatient
bonehead would demand such a thing.

>
>Again, I don't hate the Sun people or hold any animosity towards
>them. However, I will point out the lesson that any good student of
>Greek Tragedies could tell you -- the gods punish hubris, and severely.

hee, hee. sounds like you speak from experience. reminds me of that
saying, "good judgement comes from experience and experience comes
from bad judgement". <g>







From adam at homeport.org  Wed Jun  5 01:32:39 1996
From: adam at homeport.org (Adam Shostack)
Date: Wed, 5 Jun 1996 16:32:39 +0800
Subject: Remailer chain length?
In-Reply-To: <199606011336.IAA11002@einstein.ssz.com>
Message-ID: <199606050357.WAA29773@homeport.org>


Jim Choate wrote:

| > I don't think multiple remailers at the same site help anything.
| > 
| 
| I agree completely. If traffic analysis is going to be done on a single box
| it isn't going to matter how many remailers are there.  The monitor will
| simply grab them all. At this point it simply maps them thusly:

|       incoming message > remailer #1 > .... > remailer #n > outgoing
| 
| 
| That this really maps to is obvious:
| 
| 
|       incoming message > remailer #1-#n > outgoing

	Analyzing the traffic through three remailers is more
difficult than analyzing the traffic through one.  One remailer with
three N messages per day is more secure than an equivilant remailer
with N mesasges.

[much good thought deleted.]

|         5. Automaticaly limits spamming unless a remailer allows cloning
|            AND all recipients share a commen private key.

	Or unless the remailer mails to a mail to news gateway.

|         6. It maps 1:1 onto the physical remailer model with the same limits
|            on information at each stage. This allows one to directly apply
|            the current history of precedence involving anonymity and
|            physical remailers.

	With physical remailers, you can open the inner envelopes and
read the message, leaving the end user to wonder where the post office
lost the message.  With 'real' remailers, the lost message can't be
read, only not delivered.


| This is the basic model that the Austin Cypherpunks are working on at the
| currrent time. The big problem we have right now is determining if the body
| is actualy encrypted. We have done some basic tests of encryption-spoofing
| using pgp and it is looks to be a thorny problem. It simply is not trivial
| to look at a block of characters and determine if they are actualy
| encrypted. You can't rely on the wrapper around the data put there by the

	I'm not sure I see why this matters?  If you check that the
message is not obviously readable, why not assume that its well
encrypted?  You're rarely required to contort yourself to ensure your
customers are obeying the law (weaponsmiths, cryptographers, and banks
excepted.)  

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From frissell at panix.com  Wed Jun  5 01:34:38 1996
From: frissell at panix.com (Duncan Frissell)
Date: Wed, 5 Jun 1996 16:34:38 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <2.2.32.19960605021224.00c9e1d8@panix.com>


At 12:29 PM 6/4/96 -0700, Dan Haskovec wrote:
>Here's the reply I got from a friend that I forwarded it to....
>
>
>     and the verdict is... NetMYTH!  I checked the cite in the article on 
>     cyberterrorism... no such article ran on 6/2/96 in the Times 
>     (London)... nor, in fact, in any newspaper available on Nexis... 
>     just thought I would let you know...

Not only is it visible in any copy of the Sunday Times available in NYC, it
is also on the Times' website at:

http://www.sunday-times.co.uk/news/pages/Sunday-Times/frontpage.html

Registration required.

DCF






From jimbell at pacifier.com  Wed Jun  5 01:41:20 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 16:41:20 +0800
Subject: MELP: 2400 baud speech coding
Message-ID: <199606050332.UAA03708@mail.pacifier.com>


At 01:31 PM 6/4/96 -0700, John Gilmore wrote:
>Mixed-Excitation Linear Predictive encoding gives better speech
>quality than CELP at half the data rate.  Encoding and decoding
>together burn up more than 100% of a TMS320C3x digital signal
>processor at 33MHz -- 64% to encode and 53% to decode.

Does this mean to convert to compressed data AND encrypt, or just converting 
to compressed bits?



>  I don't know
>how it does on a Pentium or an Alpha.  If you have the MIPS at both
>ends, this enables very robust encrypted speech across modem links to
>the Internet. 

I'd rather see thousands of Internet-phone users transmitting at 2400 bps 
than 28.8 kbps...

This is going to add to the telephone companies' woes:  They obviously don't 
want people to have access to nearly-free Internet-LD phone service, but 
their arguments for its regulation will be weaker when it is pointed out 
that the bit rate for compressed, encrypted Internet phone are 2400 bps as 
opposed to 64,000 bps for POTS.

Which raises another question:  When are Internet ISP's going to start 
acting as Internet-phone gateways?  Currently, you can't call somebody on 
POTS with Internet phone.  This would be solved if ISP's could install 
modems and software which did audio-synthesis/digitization on an outbound 
call, driven by the data received on the Internet, and sending the data back 
to the calling end.  Any guesses as to when this will be real?

Jim Bell
jimbell at pacifier.com





From proff at suburbia.net  Wed Jun  5 01:43:09 1996
From: proff at suburbia.net (Julian Assange)
Date: Wed, 5 Jun 1996 16:43:09 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
In-Reply-To: <9606041912.AA01215@bill-the-cat.MIT.EDU>
Message-ID: <199606050320.NAA21843@suburbia.net>


> So, would you rather see a document right away, or code released
> sooner?  Take your pick and let me know. :)
> 
> -derek

I'd rather see more good people working on it.


-- 
"Of all tyrannies a tyranny sincerely  exercised for the good of its victims  
 may be the most  oppressive.  It may be better to live under  robber barons  
 than  under  omnipotent  moral busybodies,  The robber baron's  cruelty may  
 sometimes sleep,  his cupidity may at some point be satiated; but those who  
 torment us for own good  will torment us  without end,  for they do so with 
 the approval of their own conscience."    -   C.S. Lewis, _God in the Dock_ 
+---------------------+--------------------+----------------------------------+
|Julian Assange RSO   | PO Box 2031 BARKER | Secret Analytic Guy Union        |
|proff at suburbia.net   | VIC 3122 AUSTRALIA | finger for PGP key hash ID =     |
|proff at gnu.ai.mit.edu | FAX +61-3-98199066 | 0619737CCC143F6DEA73E27378933690 |
+---------------------+--------------------+----------------------------------+





From sandfort at crl.com  Wed Jun  5 01:54:49 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Wed, 5 Jun 1996 16:54:49 +0800
Subject: LIMITED SF BAY AREA INTEREST
Message-ID: <Pine.SUN.3.91.960604201325.18451A-100000@crl14.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

Those of you who know Dana Drenkowski are invited to his 50th
birthday party on Saturday.  There is some conflict with the
monthly Cypherpunks meeting, but you could come late to the
party.  (It's in Golden Gate Park.)

If you would like to attending, let me know as soon as possible.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~





From ravage at ssz.com  Wed Jun  5 01:56:16 1996
From: ravage at ssz.com (Jim Choate)
Date: Wed, 5 Jun 1996 16:56:16 +0800
Subject: update 273 (fwd)
Message-ID: <199606050358.WAA01618@einstein.ssz.com>


Forwarded message:
>From physnews at aip.org Mon Jun  3 17:03:16 1996
Date: Mon, 3 Jun 96 14:06:02 EDT
From: physnews at aip.org (AIP listserver)
Message-Id: <9606031806.AA07182 at aip.org>
To: physnews-mailing at aip.org
Subject: update 273


PHYSICS NEWS UPDATE                         
The American Institute of Physics Bulletin of Physics News
Number 273  May 31, 1996    by Phillip F. Schewe and Ben Stein

SCHRODINGER'S CAT-ION: Physicists at NIST (Christopher
Monroe, 303-497-7415) have experimentally demonstrated the
principles of the famous Schrodinger's cat thought experiment with
a single beryllium ion. In a 1935 paper, physicist Erwin
Schrodinger proposed the cat paradox: put a cat inside a box, add
a container of poison gas which is activated by the decay of a
radioactive atom, and close the box.  Since the radioactive atom
obeys the rules of quantum mechanics and since therefore its state
is indeterminate until measured by an outside observer, opening the
box and observing the atom (a microscopic quantum system)
instantly determines the status of the cat (a decidedly macroscopic,
non-quantum concept).  The feline is neither alive nor dead until the
radioactive atom is measured by an observer. Although this thought
experiment is impossible to carry out for a number of reasons,
including the fact that the quantum properties of a system tend to
wash out in an object made of many atoms and molecules such as
a cat, the NIST physicists have demonstrated the basic principles
using a single beryllium ion.  The researchers trap the ion with
nonuniform electric fields and cool it to a near standstill.  Laser
pulses then cause the ion to oscillate as a combination of
wavepackets representing two different electronic states.  Additional
laser pulses push apart the two wavepackets to separations of as
much as 80 nanometers, a mesocopic-size scale far bigger than the
normal spatial extent of the ion.  So in this version of Schrodinger's
cat, the ion's electronic state (a quantum property) is linked to (or
"entangled" with)  a mesocopic-scale position (a non-quantum
property). By applying subsequent pulses that bring together the
wavepackets, the researchers detected interference patterns which
provided evidence of the original separation.  Measurements of
Schrodinger cat's states can provide information on how quantum
properties wane with the amount of physical separation between
quantum states.  (C. Monroe et al., Science, 24 May 1996.)

SUPERCONDUCTING TUNNEL JUNCTIONS (STJ), under
development as efficient detectors of x rays, can now also be used
as single-photon detectors at visible wavelengths.  In this regard
they will be welcomed by astronomers who increasingly record
incoming light with charge-coupled device (CCD) arrays.  In
contrast to the silicon-based CCDs, which are insensitive to a
photon's energy (one photon engenders one electron in the
detector), the niobium-based STJ's do discriminate as to energy
(one photon, depending on its energy, can generate thousands of
electrons).  Determining a photon's energy would allow
astronomers to forego filters, which lower the detector's overall
efficiency.  A STJ device developed by an Oxford-Cambridge-European Space Agency (Netherlands) collaboration can detect light
in the wavelength range 200-500 nm with a spectral resolution of 45
nm (this should improve to 20 nm or better).  The STJ can also
determine the photon's time of arrival at the millisecond level, a
property the would be handy for studying fast astronomical
processes such as pulsars.  (A. Peacock et al., Nature, 9 May
1996.)

PHYSICS BACHELOR'S DEGREES. Here are some highlights
from a new AIP report on 1994 degree recipients in the U.S.---the
annual number of degrees continues to decline slightly; more fresh
graduates are looking for jobs rather than heading for graduate
school; for those going on in their studies 89% receive financial
support; women constitute 17% of the degree recipients; median
starting salary was $27,000.  (Patrick Mulvey, 301-209-3076.)






From stevenw at best.com  Wed Jun  5 02:06:08 1996
From: stevenw at best.com (Steven Weller)
Date: Wed, 5 Jun 1996 17:06:08 +0800
Subject: [SF Bay Area] Steganography -- Peter Wayner Ph.D.
Message-ID: <v01540b00adda94e26f40@[206.86.1.35]>


Seen on the net:



AN EVENT AT COMPUTER LITERACY BOOKSHOPS

----------------------------------------------------------------------
CAN SECRETS BE STOPPED?
----------------------------------------------------------------------

A free presentation by Peter Wayner Ph.D.

Date:  Wednesday, June 19, 1996
Time:  6:30 p.m. - 8:00 p.m.

Location: Computer Literacy Bookshops
          2590 North First Street (at Trimble)
          San Jose
          (408) 435-1118

"Steganography" is the art and science of making information
disappear.
If you don't know where it is, you won't even know it exists.  If you
can't find it, you can't censor it.

Dr. Wayner will explore some of the basic ways that people are hiding
information by making it look like something else; such as innocent
ramblings or flames from a newsgroup or background noise in a
digitized
image or sound file.

Dr. Peter Wayner has a Ph.D. in Computer Science.  He has worked at
Xerox PARC and consulted widely on various topics, including computer
security.  His writing has appeared in popular fora like "BYTE"
magazine
and the "New York Times".  He is the author of "Agents Unleashed: A
Public Domain Look at Agent Technology" and "Digital Cash: Commerce on

the Net" and "Disappearing Cryptography".

DID YOU KNOW THAT OUR EVENTS ARE ALSO POSTED ON OUR WEB PAGE?
http://www.clbooks.com/

Stay tuned.  There are more events to come.

July 23
Programming Windows 95 with MFC
by Jeff Prosise

Events at our stores are always free.

Have suggestions about event topics?  Email them to:
eventca_info at clbooks.com

------------------------------------------------------------------------
If you would like to receive e-mail announcements for upcoming store
events, simply write to:

events_ca-request at clbooks.com (for events held at our California
stores)
events_va-request at clbooks.com (for events held at our Virginia store)
------------------------------------------------------------------------

If you have signed up for email announcements but have not received
any,
or wish to be removed from this list, please contact us.  We add names
by request only.

****************************************************
Computer Literacy Bookshops, Inc.

Cherrie C. Chiu
eventinfo_ca at clbooks.com
(408) 435-5015 x116

-------------------------------------------------------------------------
Steven Weller                      |  Technology (n):
                                   |
                                   |     A substitute for adulthood.
stevenw at best.com                   |     Popular with middle-aged men.







From ncognito at gate.net  Wed Jun  5 02:06:38 1996
From: ncognito at gate.net (Ben Holiday)
Date: Wed, 5 Jun 1996 17:06:38 +0800
Subject: How to explain crypto?
In-Reply-To: <v01510100adda3101165c@[204.62.128.229]>
Message-ID: <Pine.A32.3.93.960604185950.36410A-100000@seminole.gate.net>


Im quoting directly from the PGP manual from pgp2.6.2:

"People who work in factoring research say that the workload to
exhaust all the possible 128-bit keys in the IDEA cipher would
roughly equal the factoring workload to crack a 3100-bit RSA key,
which is quite a bit bigger than the 1024-bit RSA key size that most
people use for high security applications..."

If we take phil at his word, I would say that comparing 90bit symetric to
1024bit RSA would be a bit generous to RSA. 

On Tue, 4 Jun 1996, Declan McCullagh wrote:

>   "The 1024 bit key is likely an RSA key, and is not comperable to a 40 bit
>   symetric key.  From memory, 1024 bit RSA is about as hard to crack as 90
>   bit symetric."
> 
> Is this a reasonable comparison?
> 
> -Declan
> 
> 






From drosoff at arc.unm.edu  Wed Jun  5 02:07:01 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Wed, 5 Jun 1996 17:07:01 +0800
Subject: Security of PGP if Secret Key Available?
Message-ID: <1.5.4.16.19960605000219.3a8734e2@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

At 02.36 AM 6/3/96 -0500, Robert A. Hayden wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>
>About once a week we get some lame-o flame bait posted to 
>alt.security.pgp or this mailing list or somewhere abotu some hole in 
>PGP.  We further say with fairly good reliability that they are bogus, 
>get a light chuckle, and then go back to dealing with the real issues.
>
>However, I got to wondering about the security of PGP assuming somebody 
>trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have 
>it on my personal computer, and somebody gets my secret key, how much 
>less robust has PGP just become, and what are appropriate and reasonable 
>steps to take to protect this weakness?
>
>Thanks
>
>
>-----BEGIN PGP SIGNATURE-----
>Version: 2.6.2
>Comment: PGP Signed with PineSign 2.2
>
>iQCVAwUBMbJ5xTokqlyVGmCFAQGcAgQAvjFdZ+YLdQGxDHcT+GOwP82BSwiTYlaQ
>F9RV8L+radCK/SyeLnEtoodkKVqpcsItIQ/JJ44FOAmnsBLljuWqbhZMl8G8+uCB
>pcpkXpre83CwoM6qDKkCEyqCiMxq857ioCoqb+WRNJYbb++muVBDHADVzGoGOjLg
>cvIMxnnXF3c=
>=tnTb
>-----END PGP SIGNATURE-----

Once your secret key has been compromised, then all that prevents a Bad Guy
from reading your message is your secret key passphrase. (I believe that,
aside from grabbing keystrokes a la TEMPEST, the only way to get this passphrase
is by brute-forcing it, or maybe searching your house for the little piece
of paper that you may have written it on.) I have seen equations which claim
to compute the security of your passphrase and also passphrase generators - 
I don't know if either are any good, though.

- -------------------------------------------------------------------------------
David Rosoff (nihongo o chiisaku dekimasu)                  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
- ---
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." ----- "Ulysses", by Alfred, Lord Tennyson


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbTCmBguzHDTdpL5AQEH4gP/TT3myaSislU3En4xwaB2cWmYhCItlhL/
nhLZM4uxOHv87zsHjYIBrHEHxVHnYOaH/Kd7zSRPRB0ArTDIMP/ZtYISMUNhfSd2
bX+LNdASX9rbiD1Vfcvb/vw6nKlfvdz2WoeeTE/yqSeHjnE7+izEX4Xi/9mHB4s/
N9DDK16kgi4=
=snQo
-----END PGP SIGNATURE-----






From WlkngOwl at unix.asb.com  Wed Jun  5 02:20:58 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Wed, 5 Jun 1996 17:20:58 +0800
Subject: Java
Message-ID: <199606042334.TAA29203@unix.asb.com>


I'll add a few comments about the "Java hype monster"... it seems a 
good way for people to make money off of computing in ways they 
haven't before (and in ways which probably won't work anyhow).

A lot of the Java hype has been how one only needs a "network 
appliance" that logs in and uses remote applets which are instantly 
updated.  Less risk of software piracy, more phone bills and network 
membership fees, of course. (Nevermind other risks added in this sort 
of system).  It seems like a kind of cable-tv-for-the-internet.  
People will join a service that provides an array of applications. 
Network membership fees and phonebills... or maybe they'll use cable 
modems and it will be included with the cable bill on their 
JavaVision (tm) boxes?

On the plud side, though: C never did standardize graphical 
interfaces.  Notice most of the demos in the JDK are graphical?

Rob.

---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From drosoff at arc.unm.edu  Wed Jun  5 02:31:09 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Wed, 5 Jun 1996 17:31:09 +0800
Subject: hacked version of PGP - win95 long filenames
Message-ID: <1.5.4.16.19960605000224.3a874cf2@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

I suffer from the great misfortune of a dos computer, and despite my
anti-micro$oft efforts, I still am stuck, most of the time, with Windows
95. This OS assigns long filenames (the sensible kind, that is) to the
old-style eight-character and three-character separated by a dot. However,
they did it in such a way that old filenames still work. So if I have a 
file I want to encrypt, PGP will mess up this system.

oldname.txt -> oldname.asc

This is the normal way PGP would encrypt. However, f I have assigned the 
oldname.txt file a new file name under the win95 system, it will look
something like this.

"Old File" (oldfil~1.txt)

This conforms with the new scheme. If I PGP encrypt, this happens:

oldfil~1.txt -> oldfil~1.asc

Thus, the new filename is lost, both for the ciphered file, and for
the file once I decrypt. Is there a way (aside from not using long
filenames) such as a hacked version of PGP that has a workaround for
this problem? Also, is this an issue on the list of improvements for
future official versions of PGP?

===============================================================================
David Rosoff (nihongo o chiisaku dekimasu)  ------------->  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
===
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." <---- "Ulysses", by Alfred, Lord Tennyson

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbTExRguzHDTdpL5AQGo5QP/QqZw0PLK5/jNY42nbJ/VRrAj8g62FK7q
zxWMVbindqQZaOYRtNVHy28rzjkBy+ybzhWetmLgny4f2zdUFkTf5OgZ0r27oOGQ
93VmAK8FoMTBhtje3y4OjWc2uqqHWSYkhjZVYWVCxVcFL1GA6FMkIs8pnzqb5Ohy
ShWTgpaV6OM=
=SLEx
-----END PGP SIGNATURE-----






From jimbell at pacifier.com  Wed Jun  5 02:33:49 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 17:33:49 +0800
Subject: NYT on NTT/RSA Chips
Message-ID: <199606050231.TAA00162@mail.pacifier.com>


At 08:53 PM 6/4/96 -0400, Ted Garrett wrote:
>At 09:12 AM 6/4/96 -0800, someone claiming to be <jimbell at pacifier.com> wrote:
>
>>Maybe it's just me, but the solution to NTT's problem is obvious.  Even 
>>assuming that the export of this software would be against the law, why 
>>doesn't somebody simply violate that law?  RSA would publish that software, 
>>possibly encrypted with NTT's public key, on a public system protected 
>>against direct export.  "Somebody" would download it, write it to a floppy 
>(...)
>>As far as I know, there is nothing wrong with NTT using this software even 
>>if it is assumed to have been exported illegally.  Obviously, NTT won't 
>>_ask_ for somebody to do this, because then the government will claim it was 
>>all a conspiracy, but that doesn't prevent NTT from being the beneficiary of 
>>somebody else's activities.
>
>What is wrong with this is that, because RSA did not, in practice deliver
>the software to NTT, they can have no expectation of payment. 

No, the copyright is still valid, and NTT couldn't use the software without 
appropriate payment.

> Thus begins
>a trumped up lawsuit in international court, and it will eventually cost
>RSA more to collect on the sale than the sale was worth.  As many rock-solid
>implementations of the RSA algorithms as are out there, all NTT has to do
>is go to an FTP site in the netherlands.  Done deal.  But what about the
>copyrights (which are still unclear) and the US patents?  NTT would not be
>able to market their system in the US without losing face.

The purpose of the strategem I described is NOT intended to allow NTT to use 
software without paying.  NTT and RSA are probably on very friendly terms, 
anyway.  The purpose is to compartmentalize the illegality to an 
unidentifiable person, allowing NTT to use the software without having 
violated any law.


Jim Bell
jimbell at pacifier.com





From declan at well.com  Wed Jun  5 02:38:53 1996
From: declan at well.com (Declan McCullagh)
Date: Wed, 5 Jun 1996 17:38:53 +0800
Subject: Richard Stallman on RSA, Zimmermann, crypto
Message-ID: <Pine.3.89.9606041755.A5503-0100000@well>


Richard's comments below are very much worth reading. Also check out the
following URLs for back fight-censorship messages about the RSA/Zimmermann
conflict... 

MIT's Seth Finkelstein on RSA/Zimmermann history:
  http://fight-censorship.dementia.org/dl?num=639

Background on RSA's involvement with recent crypto legislation:
  http://fight-censorship.dementia.org/dl?num=1613
  http://fight-censorship.dementia.org/dl?num=1614
  http://fight-censorship.dementia.org/dl?num=2282

-Declan

---------- Forwarded message ----------
Date: Tue, 4 Jun 1996 20:18:05 -0400
From: Richard Stallman <rms at gnu.ai.mit.edu>
To: declan at well.com
Cc: rms at gnu.ai.mit.edu
Subject: Re: FW: CWD--Crypto Gets A Nuke (fwd)

As an opponent of Clipper--I debated Dorothy Denning on NPR once--I
was glad to read about the new Japanese encryption chip.

But that chip is not the right solution for most people who want to
use encryption.  For example, I'm considering using digital
signatures.  I don't need the high power that requires special
expensive hardware, and I would rather not have to buy it.  What I
would really like is free software, which I can run on an ordinary PC,
to do the job.

Unfortunately, there isn't any.  RSA Inc. made sure of that.

Zimmermann initially intended to release PGP as free software.  But
RSA Inc threatened him with a patent suit, and forced him to change
the distribution terms.  Now PGP in the US uses RSAREF, which is
restricted by a patent license to non-commercial use only.  In other
words, only hobbyists and academics can use it.  There is a commercial
version which is proprietary software, and apparently not many people
want it badly enough to buy it.

The version of PGP used outside the US is free software, but if you
use it within the US, RSA Inc. can sue you.

This is very bad for people who would like to use PGP.  But it is
worse than that.  It affects the political battle too.

PGP had a chance to create a constituency of Americans who demand the
right to use encryption.  If PGP had been allowed for use in business,
not just by hobbyists, we would have far more Americans who care
enough to fight against Clipper--and they would include businesses
which have the funds to influence legislators.  RSA Inc. prevented
this from happening, and did so for no reason except money.

Bidzos and Rivest would like to present themselves as the defenders of
our freedom to use encryption.  And it is true, they would like us to
be able to use encryption, as long as we are required to pay them for
doing so.  But when they had the choice of letting us use encryption
freely or stamping it out, they chose the latter.

I hope you won't portray them as heroes.








From loki at infonex.com  Wed Jun  5 02:39:36 1996
From: loki at infonex.com (Lance Cottrell)
Date: Wed, 5 Jun 1996 17:39:36 +0800
Subject: How can you protect a remailer's keys?
Message-ID: <addac392000210049493@[206.170.115.3]>


The best solution I could come up with (and was willing to write and use)
is to specify the passphrase on the command line argument to the compiler

make solaris -DPASS="foozooblue"

                -Lance

At 11:55 PM 6/1/96, Bill Stewart wrote:
>Encryption is critical for protecting against traffic analysis,
>but it's tough to protect a remailer's keys.  Unlike regular email,
>where you can type the key in as you read it, remailers need to
>run automatically once you set them up.  Some of the choices are:
>- leave it around in plaintext with only Unix file protections
>        (Ghio2 works this way - does Mixmaster?  My ghio2 version has it
>        compiled into the binary, and I try to delete it from source.)
>- type it in to a long-running remailer process
>        (with human intervention to start)
>- SSL-based remailers, where the web server handles crypto on
>        a per-machine basis instead of per-remailer
>- use unauthenticated Diffie-Hellman (either hanging off
>        a TCP port somewhere instead of mail, or
>        3 pieces of email)
>- off-line or off-site remailer such as a POP3 winsock remailer
>        that makes it Somebody Else's Problem, and separates
>        the remailer's public interface from the working parts
>- human intervention on every message (which may not be totally
>        worthless for moderated news postings, if you want to
>        take that approach to spam prevention.)
>
>Anybody have any other approaches?  These are mostly weak,
>annoying, or both.
>
>
>#                               Thanks;  Bill
># Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
># http://www.idiom.com/~wcs
>#                               Rescind Authority!

----------------------------------------------------------
Lance Cottrell   loki at obscura.com
PGP 2.6 key available by finger or server.
Mixmaster, the next generation remailer, is now available!
http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com

"Love is a snowmobile racing across the tundra.  Suddenly
it flips over, pinning you underneath.  At night the ice
weasels come."
                        --Nietzsche
----------------------------------------------------------







From WlkngOwl at unix.asb.com  Wed Jun  5 02:45:29 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Wed, 5 Jun 1996 17:45:29 +0800
Subject: Electronic Signature Act Of 1996
Message-ID: <199606042344.TAA29411@unix.asb.com>


On  4 Jun 96 at 10:33, Ben Holiday wrote:

> Florida now recognizes electronic signatures as legal and binding. In
> other words - its okay to sign it by modem.
> 
> The electronic Signature Act of 1996 passed the Legislature unanimously
> and became law Friday. The law does not specify how an electronic document
> must be signed, but it probably will mean coding the text and typed
> signature so they cannot be changed by anyone other than the writer. 
[..]

I've seen some legal arguments that an email message that reads 
"Bob, Sounds good--it's a deal. --Alice" can in some circumstances be 
as binding as an oral contract or a scribbled note, which is not 
meaningless though not as strong as a legal signed contract. As long 
as one can show Alice *did* write that, that it referred to a 
specific deal, etc. etc., it holds some legal weight.

But I'm no lawyer, and one should never trust legal advice form 
Usenet or the c'punks list.

Rob.
 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From ngps at technet.sg  Wed Jun  5 02:49:09 1996
From: ngps at technet.sg (Ng Pheng Siong)
Date: Wed, 5 Jun 1996 17:49:09 +0800
Subject: FOR WHOM THE BELL TOLLS
In-Reply-To: <2.2.32.19960604193049.0072daf0@popmail.crl.com>
Message-ID: <Pine.OSF.3.91.960605132750.13323H-100000@einstein.technet.sg>


On Tue, 4 Jun 1996, Sandy Sandfort wrote:
> Any suggestions?

Jim Bell has a solution to that problem. 

Sorry, couldn't resist. ;)

- PS
--
Ng Pheng Siong <ngps at pacific.net.sg> * Finger for PGP key.
Pacific Internet Pte Ltd * Singapore

'The meek will inherit the earth, after the rest of us have gone to the stars.'
							- alt.2600 poster






From bruce at aracnet.com  Wed Jun  5 02:55:52 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Wed, 5 Jun 1996 17:55:52 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <2.2.32.19960605054113.006e2b2c@mail.aracnet.com>


At 12:30 PM 6/4/96 -0700, Sandy Sandfort wrote:

>My question for member of this list is:  When Bell finally
>goes too far and they arrest or shoot him, how can we best
>capitalize on his martyrdom?  Or in a more negative light,
>what damage control will we need to do in that case?

I think there's a non-trivial chance that this list could be shut down and
anyone who's made interested sounds in the idea brought in to assist the
police in their inquiries.

Damage control will probably be a doomed cause. The media will end up with
selected quotes advocating crypto-anarchy and speaking in a disparaging tone
of those heroic men and women who keep nuts like us reined in, and the only
people who will hear a balanced account will be those who are already wholly
or partially immune to the propaganda mills.

Did I mention I've been feeling pessimistic about a bunch of this stuff lately?

--
Bruce Baugh
bruce at aracnet.com
http://www.aracnet.com/~bruce






From grafolog at netcom.com  Wed Jun  5 02:58:44 1996
From: grafolog at netcom.com (jonathon)
Date: Wed, 5 Jun 1996 17:58:44 +0800
Subject: FOR WHOM THE BELL TOLLS
In-Reply-To: <2.2.32.19960604193049.0072daf0@popmail.crl.com>
Message-ID: <Pine.3.89.9606050441.A8556-0100000@netcom13>


	Sandy:

On Tue, 4 Jun 1996, Sandy Sandfort wrote:

> goes too far and they arrest or shoot him, how can we best

	let him be a victim of his own success.

        xan

        jonathon
        grafolog at netcom.com


**********************************************************************
*								     *
*	Opinions expressed don't necessarily reflect my own views.   *
*								     *
*	There is no way that they can be construed to represent      *
*	any organization's views.				     *
*								     *
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
*								     *
*       http://members.tripod.com/~graphology/index.html             *
*								     *
***********************************************************************







From jimbell at pacifier.com  Wed Jun  5 03:01:23 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 18:01:23 +0800
Subject: Markoff in NYT on NTT/RSA chip
Message-ID: <199606050644.XAA14496@mail.pacifier.com>


At 03:46 AM 6/5/96 +0000, jonathon wrote:
>	paul:
>
>On Tue, 4 Jun 1996, Paul Robichaux wrote:
>> the NTT chipset for use, say, in a Motorola cell switch (made in IL) would
>> seem to be problematic. Buying chips in Japan for shipment to Moto's phone
>> factories in Singapore and Malaysia, however, would appear to be OK. Under
>
>	So the companies simply ship their _entire_ production 
>	facility offshore, to whichever country has no crypto 
>	export regulations.
>
>	<< Any guesses on just how long ITAR stays around, once
>	several companies announce they are terminating the employment
>	of 1000+ people, for work overseas, because of ITAR?  >> 
>
>	And doing all of their manufacturing offshore means they could
>	use Triple-DES, or BlowFish, or any other crypto algorithm.

I seem to recall an announcement recently that Senator Burns is going to 
have a hearing "soon" on his crypto bill.  If that's true, I think it would 
make a good publicity scene if somebody (if possible someone giving 
testimony) were to show up with one of these NTT encryption chips, wave it 
around a bit, and say "I can bring this chip into the country, why can't I 
take it out again?"

Even if you can't get ahold of the real chip, any multi-pin bug will 
probably do for the sound/video-bite.


Jim Bell
jimbell at pacifier.com





From grafolog at netcom.com  Wed Jun  5 03:09:11 1996
From: grafolog at netcom.com (jonathon)
Date: Wed, 5 Jun 1996 18:09:11 +0800
Subject: Markoff in NYT on NTT/RSA chip
In-Reply-To: <v03007101adda1bc74f88@[206.151.234.118]>
Message-ID: <Pine.3.89.9606050304.A8556-0100000@netcom13>


	paul:

On Tue, 4 Jun 1996, Paul Robichaux wrote:
> the NTT chipset for use, say, in a Motorola cell switch (made in IL) would
> seem to be problematic. Buying chips in Japan for shipment to Moto's phone
> factories in Singapore and Malaysia, however, would appear to be OK. Under

	So the companies simply ship their _entire_ production 
	facility offshore, to whichever country has no crypto 
	export regulations.

	<< Any guesses on just how long ITAR stays around, once
	several companies announce they are terminating the employment
	of 1000+ people, for work overseas, because of ITAR?  >> 

	And doing all of their manufacturing offshore means they could
	use Triple-DES, or BlowFish, or any other crypto algorithm.

        xan

        jonathon
        grafolog at netcom.com


**********************************************************************
*								     *
*	Opinions expressed don't necessarily reflect my own views.   *
*								     *
*	There is no way that they can be construed to represent      *
*	any organization's views.				     *
*								     *
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
*								     *
*       http://members.tripod.com/~graphology/index.html             *
*								     *
***********************************************************************







From dhaskove at ucsd.edu  Wed Jun  5 03:14:10 1996
From: dhaskove at ucsd.edu (Dan Haskovec)
Date: Wed, 5 Jun 1996 18:14:10 +0800
Subject: Class III InfoWar: TST Article
In-Reply-To: <Pine.SOL.3.91.960604163240.338A-100000@echonyc.com>
Message-ID: <Pine.SUN.3.91.960604231655.16402B-100000@sdcc10.ucsd.edu>


I stand corrected.... I wonder if this will be / has been picked up by 
any Stateside media?  It seems like something that might sell papers....


On Tue, 4 Jun 1996, Steven Levy wrote:

> If it's a myth, it's quite an elaborate one. On Saturday night I was 
> interviewed by the BBC about this.  The producer read the entire article 
> to me, telling me in was on the front page of the Times. (My comments 
> were not about the specific story, but the underlying security issues.) I 
> don't think he was making it up.
> 
> Maybe the London Times isn't on Nexus.
> 
> Steven
> 





From jimbell at pacifier.com  Wed Jun  5 03:17:54 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 5 Jun 1996 18:17:54 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <199606050507.WAA09930@mail.pacifier.com>


At 12:30 PM 6/4/96 -0700, Sandy Sandfort wrote:
> Carl Ellison wrote:
>>After the meeting ended it hit me what the problem is and I 
>>mentioned it to PRZ.  We're complaining that the Executive 
>>has gone rogue -- is disobeying the will of the people.  
>>PRZ likened it to Nixon's war in Cambodia.
>
> Jim Bell replied:
>
>>I have a solution to that problem.
>
>My question for member of this list is:  When Bell finally
>goes too far and they arrest or shoot him, how can we best
>capitalize on his martyrdom?  Or in a more negative light,
>what damage control will we need to do in that case?
>Now I know that barking dogs rarely bite, but Jim may just
>fool us and find his cajones.  In any event, the sort of 
>yapping he is doing could itself be considered a crime that 
>could attract the sort of negative attention he apparently 
>craves.

If there is any doubt that we _need_ a system to rid us of these sleazy 
politicians: I just saw tonight's PBS McNeil news hour, and they had two 
politicians on, one of which was promoting a re-emergence of the "Star Wars" 
missile defense system, which even under optimistic scenarios would cost 
hundreds of billions of dollars.

My solution is simpler and far less expensive: Target any political or 
military person at any level who is directly or indirectly in control of any 
offensive missile system (nuclear or otherwise), killing off as many as it 
takes until they cry "uncle" and destroy all of that hardware.  Probable 
cost of this persuasian?  A few hundred million dollars, at most.

Who is committing the crime, here?  Maybe, someday, you'll start really 
LISTENING to what I have to say.

ObCrypto?  Your motivations are quite opaque.  Maybe we can turn them into a 
cryptosystem?




Jim Bell
jimbell at pacifier.com





From WlkngOwl at unix.asb.com  Wed Jun  5 03:20:52 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Wed, 5 Jun 1996 18:20:52 +0800
Subject: Cost of brute force decryption
Message-ID: <199606050631.CAA01285@unix.asb.com>


On  4 Jun 96 at 10:58, Bruce M. wrote:

[..]
> 	"If you can ensure secrecy either until no one cares about the 
> information or so that cracking the code costs more than the information 
> is worth, it's 'secure enough.'
> 
> 	"For example a 40-bit key takes about $10,000 worth of supercomputer 
> time and two weeks to crack.  Although this key may be adequate to 
> protect my checking account, it's probably not large enough for the 
> accounts of a major corporation.
[..]

The figures look familiar.  No references around.  I'm not sure it would 
require a whole two weeks for 40-bits, though.  Possibly less than a 
day? (Or was that why you asked baout the figures?)

The "$10,000 worth of supercomputer time" is fuzzy.  One thing that's
left out is that once an organization already owns the equipment and 
has the money to spare, it may be worthwhile to crack things of less 
importance like personal checking info, email, etc.

Rob.


---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From tcmay at got.net  Wed Jun  5 03:23:30 1996
From: tcmay at got.net (Timothy C. May)
Date: Wed, 5 Jun 1996 18:23:30 +0800
Subject: Java
Message-ID: <adda454f07021004283a@[205.199.118.202]>



I find myself agreeing with nearly all the points about Java that Larry is
making, so something may be wrong....

At 8:58 PM 6/4/96, Vladimir Z. Nuri wrote:
...

>I suppose if I was over 40 and worked in a conservative wall street firm,
>I'd have a totally different view. maybe Java is all about a generation
>gap in computing. hey!! the first language that the "older generation"
>hates. sounds like a good reason to go after it, sort of like rock-n-roll
>and Woodstock suddenly being aged and uncool.

This can't be the whole story. I'm 44, and Java looks pretty damn exciting
to me, too. Not exciting to stand elbow-to-elbow and be trampled the crowds
at Moscone Center for Java One, but exciting enough to get the Metrowerks
Java compiler for the Mac and half a dozen or so of the Java books (some of
which are even pretty good--I most like "Core Java" and the Gosling book).

I don't have the energy or time to write a Detweiler-length article about
Java (though I think I did a month or so ago), but will say that I think
the security problems are, first of all, no worse vis-a-vis the language
itself than problems with any language.

For me, the main attraction of Java lies  not in the applets, but in the
Net-centric model that makes, in theory (and hopefully in practice) a
Macintosh roughly the equal of a Sun or SGI or Pentium. Until Java and
associated programs and tools appeared, I was seriously thinking about
getting a Pentium or Pentium Pro (shudder, even though I admire my former
employer and current stock benefactor, Intel) and putting Linux on it. Now
I feel more confident that the Mac is a viable competitor in a Net-centric
world. Java may be the Great Equalizer (something Sun may come to regret).

Perry has some valid points vis-a-vis the most naive uses of applets. Were
I the security manager of Morgan Stanley, I would certainly not want
traders downloading "kewl" applets and (possibly) causing Big Problems. So
what else is new?

Java as a language and as a platform-independent implementation is an
achievement. As for Scheme and Smalltalk, both mentioned by Perry, I have
both of these and of course neither has caught on a big way. I won't even
speculate about the many reasons.

And in some ways a more important comparison is to Perl and TCL, along with
more obscure languages like Python and REXX. The welter of Net-oriented
languages shows signs of  being much-simplified by the wide adoption of
Java. It will be interesting to watch the next several years of
developments.


-- Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From ichudov at algebra.com  Wed Jun  5 03:40:08 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Wed, 5 Jun 1996 18:40:08 +0800
Subject: Electronic Signature Act Of 1996
In-Reply-To: <2.2.32.19960604165840.00725e30@popmail.crl.com>
Message-ID: <199606050323.WAA09499@manifold.algebra.com>


Sandy Sandfort wrote:
> C'punks,
> 
> At 11:11 AM 6/4/96 -0400, Perry E. Metzger wrote:
> 
> >...I get the impression that under the common law, an ink 
> >signature is merely a demonstration that a party assented 
> >to a contract, and except for certain contracts (which 
> >usually require witnesses etc.) there is no requirement in 
> >the law that a contract even be on paper...
> 
> The "Statute of Frauds" lists the exceptions and they cover
> most important contracts.  I seem to recall that contracts
> over a given amount or for interests in real property for 
> periods of a year or more are covered.  I'm sure someone 
> with current access to legal research resources will post
> a better explanation.

[I AM NOT A LAWYER]

The following contracts are required to be in writing, in most states: 


1. A contract of an executor or administrator to answer
for a duty of the decedent (the executor-administrator
provision).

2. A contract to answer for debt or default of another (the suretyship
provision).

3. A contract made upon consideration of marriage (the marriage provision).

4. A contract for sale of goods worth more than $500 (the sales provision).

5. A contract for sale of an interest in land (the land provision).

6. A contract not preformable within a year (the one-year provision).

	- Igor.





From hugh at ecotone.toad.com  Wed Jun  5 03:49:49 1996
From: hugh at ecotone.toad.com (Hugh Daniel)
Date: Wed, 5 Jun 1996 18:49:49 +0800
Subject: LEGISLATIVE:  SHORT NOTICE! of a SF SCTB/NRC crypto policy hearing
Message-ID: <199606042329.QAA06008@ecotone.toad.com>


------- Start of forwarded message -------

Date: Fri, 31 May 96 18:12:00 EST
From: "CRYPTO" <crypto at nas.edu>
To: crypto at nas.edu
Subject: Public briefing on the NRC Crypto Policy report

     Please post widely.

     The Computer Science and Telecommunications Board (CSTB) of the
     National Research Council (NRC) has completed a congressionally
     mandated study of national cryptography policy.  The final report,
     Cryptography's Role in Securing the Information Society, was released
     to the public on May 30, 1996.

     Some members of the committee will conduct a public briefing on the
     report in
     Menlo Park, California at SRI International.  The briefing will be
     held in the Auditorium of the International Building from 10 to 11 am
     on  Wednesday, June.5.  The address is 333 Ravenswood Avenue, Menlo
     Park, California, 94025.  For more information about the briefing at
     SRI, contact Alice Galloway at 415-859-2711
     (alice_galloway at qm.sri.com).

     If you have suggestions about other places that the committee should
     offer a public briefing, please let me know (crypto at nas.edu or
     202-334-2605).

     A summary of the report ("Overview and Recommendations") is available
     through http://www2.nas.edu/cstbweb; the full publication will be made
     available when final printed copies of the book are available
     (probably around the beginning of August).

     If you wish to be kept informed of various other public activities
     regarding dissemination of this report, you can sign up for an e-mail
     list by visiting the web page
     http://www2.nas.edu/cstbweb/notifyme.html.

     I apologize to you for the short notice on this invitation, but hope
     that you will be able to attend.

                       Herb Lin
                       Senior Staff Officer
                       Study Director
                       CSTB/NRC Study of National Cryptography Policy
                       crypto at nas.edu

------- End of forwarded message -------





From cwe at it.kth.se  Wed Jun  5 03:51:17 1996
From: cwe at it.kth.se (Christian Wettergren)
Date: Wed, 5 Jun 1996 18:51:17 +0800
Subject: Class III InfoWar: TST Article
In-Reply-To: <Pine.SUN.3.91.960604122601.20280A-100000@sdcc10.ucsd.edu>
Message-ID: <199606050626.IAA05284@piraya.electrum.kth.se>



|      and the verdict is... NetMYTH!  I checked the cite in the article on 
|      cyberterrorism... no such article ran on 6/2/96 in the Times 
|      (London)... nor, in fact, in any newspaper available on Nexis... 
|      just thought I would let you know...

I've met Winn Schartau and a number of the people mentioned in the
article at a conference in Brussels about Information Warfare two
weeks ago.

I've also seen the article that is referred in the message from
Winn, and here is the URL for it.

http://www.sunday-times.co.uk/news/pages/Sunday-Times/stinwenws01016.html?1257332

Alternatively, you can access it through

http://www.the-times.co.uk/

going through a brief registration process etc.

Also, I've meet the journalist, Peter Warren, at the conference as
well. We even went for a beer! :-)

So, I'd definitively say there is too much real-world details
to it for me to believe it is a NetMYTH.

-Christian Wettergren,
 KTH/Teleinformatics
 Sweden.

PS. I'm not a netMYTH either, and I do exist. :-)





From loki at infonex.com  Wed Jun  5 04:05:59 1996
From: loki at infonex.com (Lance Cottrell)
Date: Wed, 5 Jun 1996 19:05:59 +0800
Subject: Multiple Remailers at a site?
Message-ID: <addac43501021004bb2c@[206.170.115.3]>


At 1:40 PM 6/4/96, Scott Brickner wrote:
>Bill Stewart writes:
>>>I don't think multiple remailers at the same site help anything.
>>
>>Assume Alice, Bob, and Carol are on abc.com and Xenu, Yak, and Zut
>>are on xyz.com.  Remailing between Alice, Bob, and Carol doesn't
>>make appear to make much difference, but it does reduce the damage
>>if one of the remailer's keys is compromised.  On the other hand,
>>mail from Alice -> Xenu -> Bob -> Yak -> Carol -> Zut adds traffic
>>to the system, and makes traffic analysis more difficult,
>>even if the Bad Guys are watching site abc.com and have stolen
>>Alice, Bob, and Carol's keys.
>
>Wait a minute.  More traffic should make analysis easier, since traffic
>analysis is mostly statistical work on the source and destination (not
>necessarily "from" and "to").  A bigger sample makes more reliable
>results.
>
>For traffic analysis, I don't know *who* sent the message (it was,
>after all, anonymized), but I do know a site which transmitted it and
>one which received it, the time it was transmitted, and maybe its
>size.  Multiply this times a whole bunch of messages, and I can infer
>information about "common interests" between those sources and
>destinations.
>
>The delays and mixing done by remailers make it harder by
>disassociating the true sender from the true receiver.  If a remailer
>were to ignore this step, the analyst can deduce from the two data
>points
>
>    "message a, source A, destination RemailerX, time t, size s"
>    "message b, source RemailerX, destination B, time t+0.001s, size s"
>
>that there's some connection between A and B.  The more such evidence,
>the stronger the connection.  If the remailer does a good job with
>the delays and shuffling, then it becomes difficult for the analyst
>to match message a with message b, leaving him with what he already
>knew (that A and RemailerX have a common interest, as to B and RemailerX,
>but the interests may be wholly unrelated).
>
>Multiple remailers on the same machine increases the resolution of
>the address information, at best, improving the analysts ability to
>make connections.  The same traffic load going to a single remailer
>at the site makes the analyst's job harder.
>
>>The other threat it helps with is that if XYZ.COM gets complaints
>>about that evil user Zut, she can kick her off (Bad Zut!)
>>and still leave Xenu and Yak alone; if the remailer service
>>were provided by the machine owner herself she might be directly liable.
>
>Hmm.  Nothing really stops the machine owner from creating a personal
>anonymous account to run the remailer.  When someone complains, shut it
>down and create a new one.  There isn't yet a law which requires that
>the owner be able to identify the user.  This affords the same
>protection that multiple users does.


The time correlation attack can be defeated by sending mail into the
remailer network with a period roughly equal to the propagation time of a
message through a chain. That way your messages correlate with absolutely
all receipts of all messages. That contains no information.

        -Lance


----------------------------------------------------------
Lance Cottrell   loki at obscura.com
PGP 2.6 key available by finger or server.
Mixmaster, the next generation remailer, is now available!
http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com

"Love is a snowmobile racing across the tundra.  Suddenly
it flips over, pinning you underneath.  At night the ice
weasels come."
                        --Nietzsche
----------------------------------------------------------







From frantz at netcom.com  Wed Jun  5 04:12:34 1996
From: frantz at netcom.com (Bill Frantz)
Date: Wed, 5 Jun 1996 19:12:34 +0800
Subject: On the Hill: Child Porn "Morphing"
Message-ID: <199606050531.WAA27734@netcom7.netcom.com>


At  4:45 PM 6/4/96 -0400, Black Unicorn wrote:
>"Morphing" seems to be the latest buzzword for putting childrens faces on 
>the bodies of adult models in sexually explicit poses and seems to have 
>attracted enough attention to warrant congressional attention.

The ability to use the faces of famous political people (e.g. Bill&Hillery
or Bob&Libby) in XXXX rated political satire probably has a wider market.


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From declan at well.com  Wed Jun  5 05:25:51 1996
From: declan at well.com (Declan McCullagh)
Date: Wed, 5 Jun 1996 20:25:51 +0800
Subject: Fight-Censorship Dispatch #12: CDA deathwatch, copyright update
Message-ID: <Pine.3.89.9606050013.A18013-0100000@well>



------------------------------------------------------------------------
                        Fight-Censorship Dispatch #12
-----------------------------------------------------------------------------
                          The CDA deathwatch begins
-----------------------------------------------------------------------------
         By Declan McCullagh / declan at well.com / Redistribute freely
-----------------------------------------------------------------------------

In this dispatch: CDA deathwatch begins, vultures start to circle
                  Copyright update: sucks to continue, sucks to delay
                  Fred Cherry, back in action!
                  MIT's Seth Finkelstein weighs in on copyright
                  Internet Caucus prepares pro-Net resolution

June 4, 1996


WASHINGTON, DC -- The CDA deathwatch has begun and hungry scavengers
are starting to close in on the ill-begotten law's moldering carcass.

The Philly court yesterday attracted still more hovering media
vultures by saying they'll announce when they're ready to release
their decision.

What a tease.

This evening I called Chris Hansen, who's leading the ACLU's legal
team challenging the CDA in Philadelphia's Federal court. He told me:

  The court will try to give as much advance notice as possible. This
  is unusual but not unheard of -- all along the court has treated
  this as a very important case. They had the court historian come in
  and take pictures the first day. And the clerk himself has been
  present, not his deputies.

(In case anyone's interested, I'm still offering 3:1 odds in our favor
in Philly, though all bets are off when we get to the Supreme Court.)

In the last week, the ALA/CIEC and ACLU media operations shifted into
overdrive, pumping out a flurry of press advisories telling mediaperns
to be on the lookout -- that a decision is expected "any day now."

That was the idea, at least. Conventional wisdom said that our
three-judge panel in Philly would want to rule before the court in New
York City that's currently hearing a weaker, parallel challenge to the
CDA. After all, Federal judges are political beasts and it's a cinch
that any of 'em would want to write an opinion in this landmark case.

Final arguments in the NYC case were scheduled for yesterday. But at
the hearing, the Manhattan court decided it had more questions for
both sides and gave the government until June 7 to file responses and
the plaintiff, Joe Shea, until June 13.

That means that our court has until the end of next week to issue its
decision -- and still come out first.

And so the deathwatch groans onward...


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
           COPYRIGHT UPDATE: SUCKS TO CONTINUE, SUCKS TO DELAY
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

I wrote in my May 30 dispatch that there's "a fighting chance that
this braindead copyright bill will pass this year." 

Now I'm not as sure. The House subcommittee markup session that
tentatively was scheduled for June 5 has been cancelled, and it won't
take place before June 12 or 13.

That's good and bad. The upside is that this ill-fated bill likely
won't pass in any form this session -- but the mucky underside is that
the courts will continue to rely on a Clinton administration white
paper released last fall by copyright czar Bruce Lehman.

Lehman, who heads the Patents and Trademark Office, hatched this
boondoggle that slams online fair-use rights and slaps service
providers with hefty fines if one of their users violates someone's
copyright.

A well-connected lawyer in DC sent me email on this earlier tonight:

  No copyright legislation is going to be passed this year. This comes
  from [Important Name deleted --DBM]. That means the White Paper will
  guide courts for at least the next very critical six months. The
  Scientology v. Lerma court has been looking [for] legislative
  direction, but they can't stall much longer. They will have to base
  their decision on the only thing they have, the White Paper.

Somehow, I suspect the Church of Scientology won't mind that one bit.


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
                       FRED CHERRY, BACK IN ACTION!
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

Fred Cherry, everyone's favorite net.loon and a truly redoubtable
USENET flamer, took center stage briefly at yesterday's Shea v. Reno
CDA hearing in New York City. The amateur lawyer succeeded in joining
his lawsuit with Joe Shea's and has been merrily introducing excerpts
from soc.motss "homonazi" flamewars into evidence.

He maintains that to reply to flames, he must use "indecent" or
"patently offensive" language, which could violate the CDA.

Mark Mangan writes on the June 3 hearing:

  In his deep, raspy voice [Judge] Cabranes then called Fred Cherry,
  who had attended every day of the hearings in hopes of consolidating
  his case. The chief judge looked at a paper and pronounced Cherry's
  name again. Someone leaned over the seats and tapped Cherry. He
  awoke, arose, gathered his plastic bags and umbrella and, wearing
  his overcoat, approached the bench. He walked straight to the
  microphone and rested his belongings at his feet. Cherry started
  his hurried talk about how he "despised the ACLU" and what he was
  there to discuss "goes all the way back 30 years."

I interviewed Cherry earlier today. Here's what he told me:

  -------------------------------------------------------------------
  Q: HOW DID YOU FEEL AFTER THE HEARING?

  A: The judges were nice to me. I can't believe how nice they were.
     That's not what I'm used to when I see judges.

  Q: WHAT ABOUT YOUR REQUEST THAT THE CASES BE CONSOLIDATED?

  A: [Shea's attorney, Randall Boe] said he's worried that if I join,
     I'm so far behind that it'll slow him down. That they won't be
     able to get to the Supreme Court...

     I'm just going to tag along like a caboose hitched onto a train.
     [Shea and his attorney] don't want me. They filed a brief, about
     two pages, saying they didn't want me.

  Q: WHAT DID YOU TELL THE JUDGES YESTERDAY?

  A: I came up with something [posted] by Rod Swift that Jesus had a
     large penis. Everybody [in the courtroom] was going crazy.
     Everyone was laughing.

  Q: WILL YOU INTRODUCE THOSE POSTS INTO EVIDENCE?

  A: They're going to give me more time. There's going to be an
     order -- it hasn't come down yet. They'll issue an order
     allowing me to present more exhibits.
  -------------------------------------------------------------------

I asked Cherry for the penis-posts he read aloud, but he still hasn't
sent 'em to me. I was able to track down some seemingly representative
ones that I archived at EFF's web site in April:

  Your ass is so blocked up that you do need some therapeutic relief
  for your constipation -- a condition which has backlogged all the
  shit right back up into your head, Fred.

  nobody has suggested that fred cherry should be thrown in jail, sued
  for libel, or even so much as fined. i have suggested the wisdom of
  packing his asshole with shards of broken glass, but i wasn't
  serious.  i wasnt _that_ serious anyway.

Whatever you think of Cherry's antics, you gotta grant him one thing:
not many people have the balls to demand that a Federal court uphold
their right to flame.


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
             MIT'S SETH FINKELSTEIN WEIGHS IN ON COPYRIGHT
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

                 By Seth Finkelstein (sethf at mit.edu)

The fight over the future of copyright law is raging over two
competing concepts: information should be for the public good vs. info
is "private property."

Previously, information has been tightly linked to a physical object
-- a book, a record, a tape. Now, with electronic communication, the
full implications of "copyright" -- where using your printscreen key
may be illegal if not explicitly allowed by license -- are becoming
clear.

Since this "property" is so abstract, it's frightening to contemplate
the regulation needed to control the network to ensure no unauthorized
information gets distributed. In the censorship battles, there's at
least *some* material which is safe. Not so in the copyright wars,
where every message may be required to carry "identification papers,"
to establish that it's not fugitive property that has escaped from its
rightful "owner." (And what does this do to anonymity online?)

Unlike many, I don't believe any particular outcome is inevitable.
It's a question of what sort of future world emerges from the
*political* process. It can be either an electronic commons, shared by
all, or a series of tollbooths on every public online street.


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
            INTERNET CAUCUS PREPARES PRO-INTERNET RESOLUTION
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

The congressional Internet Caucus is about to introduce a non-binding
resolution promising to do good by the Net:

  ---------------------------------------------------------------------
  Resolved by the House of Representatives (the Senate concurring),
  That it is the sense of Congress that --

  (1) Congress should educate itself about the Internet and use the
      technology in personal, committee, and leadership offices;

  (2) Congress should work in a bipartisan and bicameral fashion to
      facilitate the growth and advancement of the Internet;

  (3) Congress should maximize the openness of and participation in
      government by the people via the Internet so that our
      constituents can have more information from and more access to
      their elected representatives;

  (4) Congress should promote commerce and free flow of information on
      the Internet;

  (5) Congress should advance the United States' world leadership in the
      digital world by avoiding the passage of laws that stifle
      innovation and increase regulation of the Internet; and

  (6) Congress should work with the Internet community to receive its
      input on the issues affecting the Internet that come before
      Congress.
  ---------------------------------------------------------------------

In today's Campaign Dispatch column on HotWired, Brock Meeks writes:

  The caucus is now 47 members strong, double its original membership.
  But the fight for Net survival -- hell, for simple respect -- is far
  from over. Neither a second-term Clinton nor a Dole presidency gives
  us much reason for hope. We'll be in the trenches for several years
  to come; it's time to get our hands dirty.

More hot air from Congress? Sure. But it's a sea change compared to
where the Net community was a year ago, around the time that TIME
magazine's infamous Cyberporn cover appeared, Marty Rimm published his
fraudulent smut-study, and Sen. Chuck Grassley held the "first-ever"
cybersmut hearing in July...

Stay tuned for more reports.


-----------------------------------------------------------------------------

Today's unsubstantiated rumor:

  Y'all remember Jason "The Weasel" Baron, the DoJ's lumbering,
  cyberchallenged lawyer? Word from an attorney friend of mine says
  that Baron is predicting the DoJ will *lose* on the CDA, three-zip.

Want to subscribe to the announcement-only fight-censorship mailing
list for future Fight-Censorship Dispatches and related updates? Just
send "subscribe fight-censorship-announce" in the body of a message
addressed to:
  majordomo at vorlon.mit.edu

Mentioned in this CDA update:

  Mark Mangan's Shea v. Reno June 3 update:
    http://fight-censorship.dementia.org/dl?num=2691
  EFF's archive on the Fred Cherry v. Reno case:
    http://www.eff.org/pub/Legal/Cases/Fred_Cherry_v_DoJ/
  EFF's archive on the Joe Shea v. Reno case:
    http://www.eff.org/pub/Legal/Cases/Am_Reporter_v_DoJ/
  ACLU predicts decision soon:
    http://fight-censorship.dementia.org/dl?num=2673
  U.S. Congressional Internet Caucus:
    http://www.house.gov/white/internet_caucus/netcauc.html
  Creative Incentive Coalition on copyright:
    http://www.cic.org/
  Digital Future Coalition on copyright:
    http://www.ari.net/dfc/
  Brock Meeks on online copyright:
    http://www.hotwired.com/muckraker/96/20/index3a.html
  Brock Meeks on Internet Caucus, non-binding resolution:
    http://www.hotwired.com/netizen/96/23/index1a.html                 
  Ron Newman's web page on the Church of Scientology:
    http://www.cybercom.net/~rnewman/scientology/

  Fight-Censorship list   <http://fight-censorship.dementia.org/top/>
  Rimm ethics critique    <http://www.cs.cmu.edu/~declan/rimm/>
  Int'l Net-Censorship    <http://www.cs.cmu.edu/~declan/international/>

This and previous Fight-Censorship Dispatches are archived at:
  <http://fight-censorship.dementia.org/top/>

Other relevant web sites:
  <http://www.epic.org/>
  <http://www.eff.org/>
  <http://www.aclu.org/>
  <http://www.cdt.org/>
  <http://www.ala.org/>

-----------------------------------------------------------------------------







From junger at pdj2-ra.F-REMOTE.CWRU.Edu  Wed Jun  5 05:32:29 1996
From: junger at pdj2-ra.F-REMOTE.CWRU.Edu (Peter D. Junger)
Date: Wed, 5 Jun 1996 20:32:29 +0800
Subject: NYT on NTT/RSA Chips
In-Reply-To: <199606041616.JAA24515@mail.pacifier.com>
Message-ID: <m0uREDw-0004M0C@pdj2-ra.F-REMOTE.CWRU.Edu>


jim bell writes:

: At 10:54 AM 6/4/96 GMT, John Young wrote:
: >   An executive at NTT America said that although there were 
: >   no restrictions on the export of cryptographic hardware or 
: >   software from Japan, his company was still anxious to 
: >   obtain software from RSA Data to use in its chips. That 
: >   software is still controlled by United States export law, 
: >   he said. 
: 
: 
: Maybe it's just me, but the solution to NTT's problem is obvious.  Even 
: assuming that the export of this software would be against the law, why 
: doesn't somebody simply violate that law?  RSA would publish that software, 
: possibly encrypted with NTT's public key, on a public system protected 
: against direct export.  "Somebody" would download it, write it to a floppy 
: (taking care not to leave any fingerprints, and wetting both the stamp and 
: the envelope with tap water, rather than licking them) and mail that floppy 
: off to NTT in Japan.  (Naturally, you don't put a return address on that 
: envelope.   The truly paranoid would first take that floppy to some store's 
: PC section, and cross-load the data onto a floppy written by some other 
: floppy drive.)
: 
: NTT finds that envelope in their mail, opens it, reads the floppy, decrypts 
: the data, and say, "Wow!  It's the data we wanted to get!"  It verifies that 
: the data is valid by emailing a copy back to RSA in America, who say, 
: "Amazing!  Somebody has illegally exported our software!"
: 
: As far as I know, there is nothing wrong with NTT using this software even 
: if it is assumed to have been exported illegally.  Obviously, NTT won't 
: _ask_ for somebody to do this, because then the government will claim it was 
: all a conspiracy, but that doesn't prevent NTT from being the beneficiary of 
: somebody else's activities.

I am afraid that that is the solution to the wrong problem.  NTT's
problem is that they cannot sell the RSA chip in the United States
without a license from RSA Data under the RSA patent.  So the deal is
for RSA Data to be NTT's agent in the U.S.  But Bidzos was complaining
bitterly at the EPIC conference that the export regulations on crypto
had cost RSA Data the international market.  

The software for both DES and RSA are publically available so it would
not have solved any previously unsolved problem for someone to have
mailed the code--or the algorithms--to NTT.

--
Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH
Internet:  junger at pdj2-ra.f-remote.cwru.edu    junger at samsara.law.cwru.edu





From gbroiles at netbox.com  Wed Jun  5 05:56:48 1996
From: gbroiles at netbox.com (Greg Broiles)
Date: Wed, 5 Jun 1996 20:56:48 +0800
Subject: Electronic Signature Act Of 1996
Message-ID: <2.2.16.19960605091100.1cd70da2@mail.io.com>



I think more apropos to the discussion of electronic signatures is UCC
1-201(39), "'Signed' includes any symbol executed or adopted by a party with
present intention to authenticate a writing." Comment 39 to 1-201 indicates
"[a]uthentication may be printed, stamped or written; it may be by initials
or by thumbprint. It may be on any part of the document and in appropriate
cases may be found in a billhead or letterhead. No catalog of possible
authentications can be complete and the court must use common sense and
commercial experience in passing upon these matters. The question always is
whether the symbol was executed or adopted by the party with present
intention to authenticate the writing." And comment 2 to 3-401 (re
negotiable instruments) indicates that a signature may be "handwritten,
typed, printed or made in any other manner."

So I don't see why that wouldn't include a PGP signature, a traditional
".signature" block, or the typed "/s/ Greg Broiles" used in some
circumstances. (Of course, the UCC doesn't apply to every transaction, nor
is it adopted in identical form in every state, blah blah blah.) But it's
always nice if the legislature is willing to say "This is the right way to
create an electronic signature" because then we don't have to wonder. 
(However, a signature and a contract are not the same thing - and you don't
need to have a contract to have an enforceable obligation. A nonrepudiable
document still isn't a self-executing one.)

--
Greg Broiles                |"Post-rotational nystagmus was the subject of
gbroiles at netbox.com         |an in-court demonstration by the People
http://www.io.com/~gbroiles |wherein Sgt Page was spun around by Sgt
                            |Studdard." People v. Quinn 580 NYS2d 818,825.






From gary at systemics.com  Wed Jun  5 06:45:10 1996
From: gary at systemics.com (Gary Howland)
Date: Wed, 5 Jun 1996 21:45:10 +0800
Subject: Java
Message-ID: <199606051004.MAA14816@internal-mail.systemics.com>


Clay Olbon II wrote:
>
> Has anyone written a Java app to implement the Chinese Lottery?  Seems like
> a natural way to do it.  A small cash prize might entice lots of folks to
> let it run in the background...

We have plenty of Java code that does crypto.  If anyone can think
of a suitable target (and perhaps a suitable prize for the winner),
we'll help knock up some code.  Click this if you're interested
http://systemics.com:79/  (alternatively finger @systemics.com)

The only targets I can think of are the Sun/Microsoft crypto API
keys (but I would guess that these keys are too large for an
attack to be feasible), and the unix password of David Sternlight
(which was posted to sci.crypt last summer).


Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06





From WlkngOwl at unix.asb.com  Wed Jun  5 07:09:16 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Wed, 5 Jun 1996 22:09:16 +0800
Subject: Richard Stallman on RSA, Zimmermann, crypto
Message-ID: <199606051058.GAA03569@unix.asb.com>


Not to defend or condemn RSA folx or patents, etc., but sometime ago 
(recently) I read or was told or perhaps hallucinated that PGP3 was 
going to include non-RSA algorithms that didn't suffer the patent 
stickiness (El Gammel based on DSA?)

Derek?

On  4 Jun 96 at 18:00, Declan McCullagh wrote:
[..]
> Richard's comments below are very much worth reading. Also check out the
[..]
> The version of PGP used outside the US is free software, but if you
> use it within the US, RSA Inc. can sue you.
> 
> This is very bad for people who would like to use PGP.  But it is
> worse than that.  It affects the political battle too.
> 
> PGP had a chance to create a constituency of Americans who demand the
> right to use encryption.  If PGP had been allowed for use in business,
> not just by hobbyists, we would have far more Americans who care
> enough to fight against Clipper--and they would include businesses
> which have the funds to influence legislators.  RSA Inc. prevented
> this from happening, and did so for no reason except money.
[..] 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From gary at systemics.com  Wed Jun  5 07:20:25 1996
From: gary at systemics.com (Gary Howland)
Date: Wed, 5 Jun 1996 22:20:25 +0800
Subject: Security of PGP if Secret Key Available?
Message-ID: <199606051033.MAA14983@internal-mail.systemics.com>


On Jun 3,  2:36, "Robert A. Hayden" wrote:
> However, I got to wondering about the security of PGP assuming somebody
> trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have
> it on my personal computer, and somebody gets my secret key, how much
> less robust has PGP just become, and what are appropriate and reasonable
> steps to take to protect this weakness?

If the secret key is available then an attacker knows the length
of p & q.  Admittedly this will not usually help matters much,
but I still feel that the lengths of p and q should be encrypted
with the passphrase - perhaps in PGP3.0? (Derek?)

Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06 





From jya at pipeline.com  Wed Jun  5 07:28:15 1996
From: jya at pipeline.com (John Young)
Date: Wed, 5 Jun 1996 22:28:15 +0800
Subject: URL for NRC Report
Message-ID: <199606051047.KAA20751@pipe1.t1.usa.pipeline.com>


Instructions for Web access to the NRC report, "Cryptography's Role in
Securing the Information Society," May 30, 1996, Prepublication Copy, are
at: 
 
 
     http://pwp.usa.pipeline.com/~jya/nrc.txt 
 
 
Appendices A to N are now in individual files. 
 
 
A few typos have been corrected in nrc00.txt and nrc06.txt. 
 
 
For the coder, mathematician and avid proofreader, we'll JPEG and forward
any page that contains equations -- such as those in Appendix C.





From nelson at crynwr.com  Wed Jun  5 09:43:49 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Thu, 6 Jun 1996 00:43:49 +0800
Subject: Markoff in NYT on NTT/RSA chip
In-Reply-To: <v03007101adda1bc74f88@[206.151.234.118]>
Message-ID: <19960605120618.2319.qmail@ns.crynwr.com>


jonathon writes:

 > 	<< Any guesses on just how long ITAR stays around, once
 > 	several companies announce they are terminating the employment
 > 	of 1000+ people, for work overseas, because of ITAR?  >> 

You're assuming that the "jobs" card beats the "crypto-terrorist"
card.  I wouldn't count on it.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From janimmo at ionet.net  Wed Jun  5 09:44:55 1996
From: janimmo at ionet.net (Jeffrey A Nimmo)
Date: Thu, 6 Jun 1996 00:44:55 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SUN.3.91.960604163805.11159A-100000@polaris>
Message-ID: <Pine.SOL.3.91.960605065515.19215C-100000@ion1.ionet.net>




On Tue, 4 Jun 1996, Black Unicorn wrote:

> 
> Hearings on the hill over the child pornographer horseman:
> 
> "Morphing" seems to be the latest buzzword for putting childrens faces on 
> the bodies of adult models in sexually explicit poses and seems to have 
> attracted enough attention to warrant congressional attention.
> 
> Interesting that the media is playing this up as a "net" deal.  (As if 
> somehow it were impossible to do without the all powerful and evil internet.

I've heard of this kind of thing before. Individuals have already been 
sent to jail for doing this, as well as doing and 
distributing kiddie porn drawings. 

I suspect that since it's already illegal on the state level, that 
Congress is looking into making it a federal crime to distribute them 
over state lines via the Internet.

> I'd like to see exactly how they word the proposed prohibitons.  What 
> constitutes "child" when the face painted on is pure artistry?  Will we 
> see a simple and strict prohibition over modifiying sexually explicit 
> pictures to make them appear to be of younger models (whatever their 
> apparent age may be)?  Will we see a subjective test as to what is "child 
> looking" enough?

It only has to give the impression of being under the age of consent in 
order to be illegal. No real models have to be involved.

> Silliness.  All silliness.

That's debatable. However, in this politically correct environment, I 
wouldn't even give the impression of siding with the pedophiles if I were 
you.

> Prediction:  Some manner of law will be on the books (Or perhaps passed, but 
> unsigned) before the election attempting to prohibit some form of this 
> activity.  Certainly Clinton is not going to veto such a bill before the 
> election, which is doubtlessly when the right is going to try to push it 
> through.  (Can they streamline it enough to get a vote in time?)

I wouldn't doubt it.

> ---
> My preferred and soon to be permanent e-mail address:unicorn at schloss.li
> "In fact, had Bancroft not existed,       potestas scientiae in usu est
> Franklin might have had to invent him."    in nihilum nil posse reverti
> 00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
> Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com
> 
> 





From perry at piermont.com  Wed Jun  5 09:50:54 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 6 Jun 1996 00:50:54 +0800
Subject: Senator Exon & me
In-Reply-To: <m0uR7Nb-00037KC@mail.iglou.com>
Message-ID: <199606051212.IAA11953@jekyll.piermont.com>



Blake Wehlage writes:
> I am not one to lash out at anyone but now I feel it is appropite to tell
> the group what our very own Senator Exon has said to myself.

Are you sure that you weren't just getting mail from the Senator Exon
remailer? The real Senator Exon doesn't use email.

.pm





From perry at piermont.com  Wed Jun  5 10:00:55 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 6 Jun 1996 01:00:55 +0800
Subject: How to explain crypto?
In-Reply-To: <Pine.A32.3.93.960604185950.36410A-100000@seminole.gate.net>
Message-ID: <199606051224.IAA11983@jekyll.piermont.com>



Ben Holiday writes:
> Im quoting directly from the PGP manual from pgp2.6.2:
> 
> "People who work in factoring research say that the workload to
> exhaust all the possible 128-bit keys in the IDEA cipher would
> roughly equal the factoring workload to crack a 3100-bit RSA key,
> which is quite a bit bigger than the 1024-bit RSA key size that most
> people use for high security applications..."
> 
> If we take phil at his word, I would say that comparing 90bit symetric to
> 1024bit RSA would be a bit generous to RSA. 

It is very far from clear that Phil was right.

As I said, these comparisons are all based on insufficient data. I
don't think they are a great idea.

Perry





From jya at pipeline.com  Wed Jun  5 10:14:53 1996
From: jya at pipeline.com (John Young)
Date: Thu, 6 Jun 1996 01:14:53 +0800
Subject: Terrorism Hysteria on the Net
Message-ID: <199606051227.MAA00334@pipe2.t2.usa.pipeline.com>


Today's USA has a pair of front page stories: 
 
 
"Feds ready anti-terror cyberteam" and "Terrorism on the Net -- Post-Cold
War hysteria or a national threat?" 
 
 
They lay out the nightmares and the valiant TLA-daydreams to out-fund the
hackers and out-flummox the public. 
 
 
"You bring me a select group of hackers and within 90 days I'll bring this
country to its knees, " says Jim Settle, retired director of the FBI's
computer crime squad. 
 
 
"The threat is there, it's very real," says CIA General Counsel Jeffrey
Smith. "If we have a Unabomber who decides to launch an attack with a PC
instead of a bomb, (there could be) real damage." 
 





From exalt at miworld.net  Wed Jun  5 13:05:55 1996
From: exalt at miworld.net (Intense)
Date: Thu, 6 Jun 1996 04:05:55 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <199606050531.WAA27734@netcom7.netcom.com>
Message-ID: <Pine.LNX.3.91.960605091831.4132F-100000@invictor.miworld.net>


On Tue, 4 Jun 1996, Bill Frantz wrote:

> At  4:45 PM 6/4/96 -0400, Black Unicorn wrote:
> >"Morphing" seems to be the latest buzzword for putting childrens faces on 
> >the bodies of adult models in sexually explicit poses and seems to have 
> >attracted enough attention to warrant congressional attention.
> 
> The ability to use the faces of famous political people (e.g. Bill&Hillery
> or Bob&Libby) in XXXX rated political satire probably has a wider market.


I am just wondering, when the USA can get a little bit more ridiculus.
They seem to have on there "good shoes" when if you look in the past, 
most of the goverment officals have been notihing but people that are 
involved with allot more ilegal activies than the average resident... 
i'ts sad what they will do, to get elected.. 

:(


               *          <exalt at miworld.net>           *








From raph at cs.berkeley.edu  Wed Jun  5 13:12:01 1996
From: raph at cs.berkeley.edu (Raph Levien)
Date: Thu, 6 Jun 1996 04:12:01 +0800
Subject: Java
In-Reply-To: <199606041306.JAA08943@jekyll.piermont.com>
Message-ID: <31B58982.1F54@cs.berkeley.edu>


Vladimir Z. Nuri wrote:
[...]

> you don't get it, as others have pointed out repeatedly. you conveniently
> ignore Frantz' points about the well-known difficulties of porting C. there
> is a big difference in what is conneted by the word "portable".
> if it take a zillion different makefile rules to create the "same"
> program on different machines, is that "portable"? isn't that
> defeating the purpose somewhat? c is "sort of" portable. it is
> "in theory" portable. Java is portable "in theory and practice".

   This point is simply not true, at least for Java as it exists in 
Spring 1996. Almost every Java applet I've seen has little UI glitches 
that prevent it from displaying and operating correctly on all 
platforms. Further, there are little glitches in the language 
implementation and library design that often cause portability problems. 
For example, the first cut of Hal's PGP applet had the standard UI 
problems, plus the fact that a "spinner" thread caused the entire 
browser to lock up -- on Unix, but not on Windows. And this was a 5000 
line of code applet. Hal was able to fix the problems, but it's easy to 
see how the effort involved in this "portability engineering" could 
become comparable to your thousand-line makefile as applications scale 
up.
   The promise is there, but Java has not yet delivered.

   Another concern with Java is that it acheives portability at the cost 
of enforcing a lowest common denominator. For example, all real Windows 
applications support OLE, and all real Mac applications support Apple 
Events. Java applets, and even applications, can't do either. To me, 
that makes the accomplishment of portability a bit less impressive, even 
if it were so.

Raph





From ponder at wane-leon-mail.scri.fsu.edu  Wed Jun  5 13:30:36 1996
From: ponder at wane-leon-mail.scri.fsu.edu (P.J. Ponder)
Date: Thu, 6 Jun 1996 04:30:36 +0800
Subject: Electronic Signature Act of 1996
Message-ID: <Pine.3.89.9606050852.A28531-0100000@wane3.scri.fsu.edu>


The Florida act is available at
  http://www.scri.fsu.edu/fla-leg/bills/senate-1996/sb0942.html

as was repeatedly brought up during hearings on this bill, the existing 
law does not preclude digital signatures from being used or from being 
offered in evidence in support of an argument that so-and-so 'signed' or 
agreed to something.  What the sponsors of this bill wanted was to 
provide additional credence and an air of legitimacy to digital 
signatures, even tho the existing law already permits their use.

In practice, if one asserted a digital signature as evidence of another's 
agreement to a contract for example, the party making the assertion could 
offer other evidence to attest to the validity of the signature, just as 
one would do in the case of a hand-written or holographic signature. (by 
bringing in handwriting experts, e.g.)

The interesting thing to watch in Florida will be the rules and 
procedures to be developed by the (Florida) Secretary of State's office 
relating to certificate authorities, licensing requirements, CRLs, etc.
</end of free legal advice>

I think the Florida Bar wants me to add to that if you feel you have a 
legal problem of any kind, you should seek the advice of a competent 
attorney.  I am not representing you and you rely on cypherpunks mailing 
list legal advice at your peril.
--
pj





From jya at pipeline.com  Wed Jun  5 13:37:54 1996
From: jya at pipeline.com (John Young)
Date: Thu, 6 Jun 1996 04:37:54 +0800
Subject: USA on Feds Cyberteam
Message-ID: <199606051318.NAA03600@pipe2.t2.usa.pipeline.com>


   USA Today, June 5, 1996, p. 1. 
 
 
   Feds ready anti-terror cyberteam 
 
   By M.J. Zuckerman 
 
 
   The Clinton administration, citing the threat of electronic 
   terrorist attacks, is taking steps to secure cyberspace. 
 
   The administration is expected to announce later this month 
   formation of: 
 
   + An emergency response task force, directed by the FBI and 
   based in the Justice Department, to manage any terrorist 
   incident involving an attack in cyberspace. 
 
   The Cyber Security Assurance Group would funcaon as both an 
   emergency response team and investigative body. It will 
   respond to any collapse of the National Information 
   Infrastructure -- the nation's vital computer systems such 
   as banking, transportation and telecommunications. 
 
   "The threat is there, it's very real," says CIA General 
   Counsel Jeffrey Smith. "If we have a Unabomber who decides 
   to launch an attack with a PC instead of a bomb, (there 
   could be) a great deal of damage." 
 
   + A commission, dominated by national security 
   representatives and chaired by a private sector person, to 
   deliver within 12 months a national policy on cyberspace 
   security. 
 
   The commission faces difficulty in balancing government 
   inter-agency turf battles as well as dealing with industry 
   and the private sector, which oppose Internet regulation. 
 
   "This is one of the toughest issues government faces 
   today," says Smith. 
 
   The initiatives have emerged from an unprecedented, closely 
   guarded series of meeangs held in recent months between 
   leading administration officials from law enforcement, 
   national security and defense. 
 
   Attorney General Janet Reno, acting under a classified 
   presidential directive issued late last year in response to 
   the Oklahoma City bombing, chairs the panel. 
 
   It includes the directors of the CIA and FBI along with 
   Cabinet secretaries from Treasury, Commerce, Transportation 
   and Energy. 
 
   Today, the Senate Permanent Subcommittee on Investigations 
   holds the second in a series of hearings examining 
   cyberspace security and threats to information systems. 
 
   The panel's minority staff is expected to endorse 
   administration proposals to clearly draw national policy on 
   information security but calls for a more ambitious 
   emergency response effort by government. 
 
   [End] 
 
   ---------- 
 
   To see adjoining UT article (9 kb),  
    
   "Post-Cold War hysteria or a national threat?" 
 
      http://pwp.usa.pipeline.com/~jya/hysteria.txt 
 
 
 
 
 





From bryce at digicash.com  Wed Jun  5 13:44:50 1996
From: bryce at digicash.com (bryce at digicash.com)
Date: Thu, 6 Jun 1996 04:44:50 +0800
Subject: [META-NOISE]  I'm sick of hearing about policy
Message-ID: <199606051341.PAA12666@digicash.com>



-----BEGIN PGP SIGNED MESSAGE-----

I wish there were some keyword or set of filter-rules so that 
I could eliminate all discussion of government, politics
(including the assassinine kind), policy, export, GAK, TLA's and
cetera from my cpunks inbox.


I really could care less at this point about any of the opinions
that any of the cpunks contributors have on any of those
subjects.  It all amounts to some combination of a) whining and
b) preaching to the choir.


I should just hurry up and implement my "c2punks" NoCeM-style
ratings.  In my spare time.

Hahaha!  "My spare time"!  That was a good one...


Bryce



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i
Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2

iQB1AwUBMbWOmUjbHy8sKZitAQH/eAL+IqOxP6wbrrARWQI/vZEutcx62oRjF2Vf
iznMuOX+xcLrkN1cZWExHffpHGRBBBKmnZqguod0pERkLkFqDe0NtOn/80L2Du/v
sPMkrvGad4pcV3BDy93iCxHB3oxWCORF
=tPVn
-----END PGP SIGNATURE-----





From nelson at crynwr.com  Wed Jun  5 13:46:49 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Thu, 6 Jun 1996 04:46:49 +0800
Subject: Java
In-Reply-To: <199606041306.JAA08943@jekyll.piermont.com>
Message-ID: <19960605135204.2792.qmail@ns.crynwr.com>


Raph Levien writes:

 >    Another concern with Java is that it acheives portability at the cost 
 > of enforcing a lowest common denominator. For example, all real Windows 
 > applications support OLE, and all real Mac applications support Apple 
 > Events. Java applets, and even applications, can't do either. To me, 
 > that makes the accomplishment of portability a bit less impressive, even 
 > if it were so.

On the other hand, you have the potential for running a second Java
applet inside a first Java applet, achieving OLE in a portable
fashion, across all operating systems.  Encryption everywhere.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From bryce at digicash.com  Wed Jun  5 16:49:32 1996
From: bryce at digicash.com (bryce at digicash.com)
Date: Thu, 6 Jun 1996 07:49:32 +0800
Subject: FOR WHOM THE BELL TOLLS
In-Reply-To: <2.2.32.19960604193049.0072daf0@popmail.crl.com>
Message-ID: <199606051413.QAA14317@digicash.com>



-----BEGIN PGP SIGNED MESSAGE-----

"Sandy" wrote:
>
> My question for member of this list is:  When Bell finally
> goes too far and they arrest or shoot him, how can we best
> capitalize on his martyrdom?  Or in a more negative light,
> what damage control will we need to do in that case?


Hm.  I think the best we could hope for is along the lines of 
"The suspect subscribed to the 'Cypherpunks' discussion group on 
the Internet, but his violent views were rejected by the members
of the group."


It is important that the reporter manages to _not_ use the word
"member" to indicate that Bell is a "member" of Cypherpunks.


I think that conversing with Bell, or publically replying to him
at all, even to insult him, makes him more of a "member" and 
makes his pet topic more a part of cypherpunks, both in appearance
and in substance.  So don't do it.  That means you, too,
Black Unicorn.  At _least_ you can take it to private e-mail in
order to prevent the reporters from getting the wrong idea, and
in order to spare the rest of us the tedium of deleting the
messages.


This is assuming that the statement "his violent views were
rejected by the members of the group" is actually true!  If 
there _is_ anyone else here who shares Bell's evil enthusiasms, 
I strongly encourage you to begin a new list dedicated to that 
topic.


Regards,

Bryce



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i
Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2

iQB1AwUBMbWV+kjbHy8sKZitAQG9+QMAmOD17gObNoIYWwstKVwqqzaIE/D3m0YE
E3vkrMSqtXYOqg3va2+FWhaawWvvVJTLPKWdYn/kQN+jaaJo3tmPXmyAFKlLVXs5
qZUWxw+nu4vct8TIw+gAxLsWP5ZZvuGe
=QzOk
-----END PGP SIGNATURE-----





From brucem at wichita.fn.net  Wed Jun  5 17:21:53 1996
From: brucem at wichita.fn.net (Bruce M.)
Date: Thu, 6 Jun 1996 08:21:53 +0800
Subject: Cost of brute force decryption
In-Reply-To: <199606050631.CAA01285@unix.asb.com>
Message-ID: <Pine.BSI.3.91.960605092010.23845A-100000@wichita.fn.net>


On Wed, 5 Jun 1996, Deranged Mutant wrote:

> The figures look familiar.  No references around.  I'm not sure it would 
> require a whole two weeks for 40-bits, though.  Possibly less than a 
> day? (Or was that why you asked baout the figures?)
> 
> The "$10,000 worth of supercomputer time" is fuzzy.  One thing that's
> left out is that once an organization already owns the equipment and 
> has the money to spare, it may be worthwhile to crack things of less 
> importance like personal checking info, email, etc.

    Obviously this will depend on what type of computer(s) you are using 
among other things.  That was what I'm curious about.  Is there some type 
of rough formula where you could just plug in the different variables 
(computer speed, speed of each attempt, key length, etc.) and come up 
with some type of answer.  I was also curious to find out if anyone knew 
where he had come up with these figures.

                    Bruce M. * brucem at feist.com
        ~---------------------------------------------------~
        "Knowledge enormous makes a god of me." -- John Keats






From m5 at vail.tivoli.com  Wed Jun  5 18:01:44 1996
From: m5 at vail.tivoli.com (Mike McNally)
Date: Thu, 6 Jun 1996 09:01:44 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SOL.3.91.960605065515.19215C-100000@ion1.ionet.net>
Message-ID: <31B597DC.6D03@vail.tivoli.com>


Jeffrey A Nimmo wrote:
> ...
> It only has to give the impression of being under the age of consent in
> order to be illegal. No real models have to be involved.
> 
> > Silliness.  All silliness.
> 
> That's debatable.

Anything's debatable, but silliness it remains.  The entire (also
silly, but tediously common) "but there's a real victim involved"
argument goes out the window.  And where's the line drawn?  Like
take for example this filthy little number:

		o+<

Pretty wild, huh?  I mean, so young, and so willing!  Boy, I'm
gettin' all sweaty here just thinking about it; I'd better send
off this note quick and go take a cold shower.

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
       m5 at tivoli.com * m101 at io.com          *
      <URL:http://www.io.com/~m101>         * suffering is optional





From massagj at spock.et.byu.edu  Wed Jun  5 18:18:05 1996
From: massagj at spock.et.byu.edu (John Massaglia)
Date: Thu, 6 Jun 1996 09:18:05 +0800
Subject: Electronic Signature Act Of 1996
Message-ID: <2.2.32.19960605154749.009c6ac4@spock.et.byu.edu>


Hi everybody.  This is my first de-lurking.

For those interested in how Utah's Signature policy works, check out this
web page:

http://www.state.ut.us/ccjj/digsig/default.htm

This web page includes the text and commentary of the digital signature act,
illustrations, guidelines of the American Bar Association regarding digital
signatures, and a bunch of other stuff.

>From what I understood, in Utah, you need to get a digital signature from a
company that verifies your signature.  Once this has been done, it can be
used for commerce on the internet.  Provision have also been included to
revoke certificates, and explanations are given on who is liable in
different situations.
------
John Massaglia
mrklaw at itsnet.com

"The next generation of interesting software will be done on the Macintosh,
not the IBM PC."
	-- Bill Gates, Microsoft Chairman, BusinessWeek, November 26, 1984






From rpowell at algorithmics.com  Wed Jun  5 19:08:30 1996
From: rpowell at algorithmics.com (Robin Powell)
Date: Thu, 6 Jun 1996 10:08:30 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
In-Reply-To: <9606041912.AA01215@bill-the-cat.MIT.EDU>
Message-ID: <96Jun5.120831edt.20482@janus.algorithmics.com>


>>>>> Derek Atkins <warlord at MIT.EDU> writes:

    > So, would you rather see a document right away, or code released
    > sooner?  Take your pick and let me know. :)

Code sooner.

-Robin





From liberty at gate.net  Wed Jun  5 19:09:49 1996
From: liberty at gate.net (Jim Ray)
Date: Thu, 6 Jun 1996 10:09:49 +0800
Subject: whitehouse web incident, viva la web revolution
Message-ID: <199606051551.LAA26104@osceola.gate.net>


-----BEGIN PGP SIGNED MESSAGE-----

"Vladimir Z. Nuri" <vznuri at netcom.com> wrote:

<much elided...>

>- ------- Forwarded Message
>From: "Steve Wingate" <steve at linex2.linex.com>

<...>

>The frustrating thing about Clinton's scandals is that the press
>focuses on two-bit scandals of little importance, such as Whitewater
>and this ridiculous travel office "scandal", while ignoring much more
>significant dirt, such as the Mena, Arkansas contra supply and drug
>operation...

As many of you can imagine, I am a fan of this site. Naturally,
I think the Whitehouse aide particularly wanted to squelch the
Mena information.

It strikes me as a sort of strange deja-vu that this bigger-than-
Watergate issue is so well covered-_UP_ by pretty-much every U.S.
media outlet except (oddly) the W$J, Penthouse, and "High Times,"
(a pot-oriented magazine). I guess that since Clinton is the most
Nixonian president since Nixon himself this should not surprise
me, and I should just expect Clinton's re-election, followed by
his resignation, as yet-another repeat-of-history. Expecting any
{partisan D.= Fiske, and then R.= Starr} "Independent" counsel to
open this can of hypocritical worms without constant prodding is
unrealistic, IMNSHO.

I just convinced their Webmaster, Mark Saltveit, to go get PGP.
I'm talking him through the wonders of using it now.

<...>

>Real People For Real Change is registered with the Federal Election
>Commission as a non-affiliated, independent political action
>committee.

I have even convinced him to look for any dirt on the Libertarian
candidates (not terribly a difficult job in Mr. Schiff's case <g>).
JMR

Regards, Jim Ray -- DNRC Minister of Encryption Advocacy

"Most of the presidential candidates' economic packages involve
 'tax breaks,' which is when the government, amid great fanfare,
 generously decides not to take quite so much of your income.
 In other words, these candidates are trying to buy your votes
 with your own money." -- Dave Barry
___________________________________________________________________
PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE  53 2D 9C A1 B3 50 C9 C8
  <liberty at gate.net>       http://www.shopmiami.com/prs/jimray
___________________________________________________________________


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Freedom isn't Freeh.

iQCVAwUBMbWh+m1lp8bpvW01AQH0MAQApIggCeEKeMAzDNxcs3A9AWi0gfLEDDug
RDietyaaHEBViEcf6EPDjQbsNo0JIJnp6tV9xOkitNbKLt0Z98qBid9VAS6Prv5F
njndwzAirFuOhjnuBkDyKPkwaz8oipS2ulifJzLTj7weHLKUSfDp8aUBBoeoY4JO
merLKkkqvmo=
=l06T
-----END PGP SIGNATURE-----






From nelson at crynwr.com  Wed Jun  5 19:21:11 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Thu, 6 Jun 1996 10:21:11 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SOL.3.91.960605065515.19215C-100000@ion1.ionet.net>
Message-ID: <19960605155715.3302.qmail@ns.crynwr.com>


Bruce M. writes:
 > On Wed, 5 Jun 1996, Jeffrey A Nimmo wrote:
 > 
 > > That's debatable. However, in this politically correct environment, I 
 > > wouldn't even give the impression of siding with the pedophiles if I were 
 > > you.
 > 
 >     Sometimes you have to decide whether to be politically correct or right.


Encryption is about free speech.  It's NEVER politically correct to
defend free speech.  Free speech is about offensive speech because
that's the only kind that people try to ban.


If you can't stand the heat, get out of the enkripchen.


-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From mix at anon.lcs.mit.edu  Wed Jun  5 19:21:23 1996
From: mix at anon.lcs.mit.edu (lcs Mixmaster Remailer)
Date: Thu, 6 Jun 1996 10:21:23 +0800
Subject: How can you protect a remailer's keys?
In-Reply-To: <addac392000210049493@[206.170.115.3]>
Message-ID: <199606051600.MAA02582@anon.lcs.mit.edu>


-----BEGIN PGP SIGNED MESSAGE-----

> From: loki at infonex.com (Lance Cottrell)
> Date: Tue, 4 Jun 1996 22:02:11 -0700
> 
> The best solution I could come up with (and was willing to write and use)
> is to specify the passphrase on the command line argument to the compiler
> 
> make solaris -DPASS="foozooblue"
> 
>                 -Lance

A far better solution would be to have a long-running daemon hold the
secret key.  The mixmaster client could talk to the key daemon through
a unix-domain socket with the permission bits set such that only the
mixmaster user can connect.  Each time the machine is rebooted, the
operator must start the daemon and give it a passphrase.

This has two advantages.  First, it's a lot harder to back up the key
by accident.  If the key ever starts making it only your daily
backups, you are completely hosed because erasing a bunch of mag tapes
would take a lot of time--and maybe you also want to keep your
backups.

Second, if your machine is seized or someone gains unauthorized
physical access to it, the easiest way to get a root shell is by
rebooting single-user.  However, if the only cleartext copy of a key
is in memory rather than in the filesystem, once the machine is
rebooted the secret key is lost.

- - mix-admin at anon.lcs.mit.edu

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQCVAwUBMbWrj0TBtHVi58fRAQEkdQP/e7mouEmphgDmn0NKbaCM4lYnT2WbCFsk
irM2GjttiBdpQxr2QDJKBgmHnuGc09xdiexnGnn4bDFie70YDH2Zma3xF/0OvZeQ
DcgAz/0XwkAGPeLCSg8gfeykWwC0HUJlvGtmOwTQKFn5XtlqFM7pKIYF7lnFtoGY
AX/GoGauum4=
=rhyW
-----END PGP SIGNATURE-----





From jimbell at pacifier.com  Wed Jun  5 19:39:25 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 6 Jun 1996 10:39:25 +0800
Subject: NYT on NTT/RSA Chips
Message-ID: <199606051641.JAA06608@mail.pacifier.com>


At 04:45 AM 6/5/96 -0400, Peter D. Junger wrote:
  
>The software for both DES and RSA are publically available so it would
>not have solved any previously unsolved problem for someone to have
>mailed the code--or the algorithms--to NTT.


Here's something to think about:  At this point, the USG apparently doesn't attempt to restrict the IMPORTATION of crypto software and hardware.  Yet, it calls it "munitions" and the government certainly claims the authority under certain circumstances to restrict munitions imports:  For example, automatic rifles and Chinese "assault weapons" (sic).

Until this new NTT/RSA chip, there has not been much that the USG wanted to keep out that it could keep out.  Software is easily copied, so that is futile.  Hardware is more practical to restrict, but until substantial quantities are imported it doesn't constitute much of a threat.  Wouldn't it be reasonable to suspect that the advent of this NTT chip set might induce the government to start restricting crypto hardware import, under some odd new interpretation of ITAR rules?

If so, I think NTT should immediately import into the US the database for the design and testing of this chip, on the offchance that the USG gets uppity and decides to ban its import.  At that point, they merely start manufacture domestically, supplying the domestic market.


Jim Bell
jimbell at pacifier.com





From brucem at wichita.fn.net  Wed Jun  5 19:49:42 1996
From: brucem at wichita.fn.net (Bruce M.)
Date: Thu, 6 Jun 1996 10:49:42 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SUN.3.91.960604163805.11159A-100000@polaris>
Message-ID: <Pine.BSI.3.91.960605101735.23845C-100000@wichita.fn.net>


On Tue, 4 Jun 1996, Black Unicorn wrote:

> Hearings on the hill over the child pornographer horseman:
> 
> "Morphing" seems to be the latest buzzword for putting childrens faces on 
> the bodies of adult models in sexually explicit poses and seems to have 
> attracted enough attention to warrant congressional attention.
> 
> I'd like to see exactly how they word the proposed prohibitons.  What 
> constitutes "child" when the face painted on is pure artistry?  Will we 
> see a simple and strict prohibition over modifiying sexually explicit 
> pictures to make them appear to be of younger models (whatever their 
> apparent age may be)?  Will we see a subjective test as to what is "child 
> looking" enough?

	As far as I was aware, the manner of currently judging the age of 
people in nude photographs consisted of a usually doctor administered 
examination (of the picture) where the genitals and other age 
characteristics of the BODY were taken into account.  I don't think a 
person's face ever was, or ever should be, a factor.

> Silliness.  All silliness.

	Very true.  Next there will be laws banning provocative pictures of
adults dressed in child-like garb or acting out child-like sexual 
fantasies (the infamous "spank me Daddy!).


                    Bruce M. * brucem at feist.com
        ~---------------------------------------------------~
        "Knowledge enormous makes a god of me." -- John Keats






From perry at piermont.com  Wed Jun  5 19:55:13 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 6 Jun 1996 10:55:13 +0800
Subject: Cost of brute force decryption
In-Reply-To: <Pine.BSI.3.91.960605092010.23845A-100000@wichita.fn.net>
Message-ID: <199606051632.MAA12216@jekyll.piermont.com>



Everyone seems to be arguing about whether brute force decryption of
RC-40 costs "tens of thousands" or not.

The answer is it costs pennies. Literally.

See the "Big Seven" paper on why key lengths of over 80 bits are
required to read the details.

ftp://ftp.research.att.com/dist/mab/keylength.txt

Perry





From sandfort at crl.com  Wed Jun  5 20:07:12 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Thu, 6 Jun 1996 11:07:12 +0800
Subject: MELP: 2400 baud speech coding
Message-ID: <2.2.32.19960605171401.00729e58@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

At 08:28 PM 6/4/96 -0800, jim bell wrote:

>Which raises another question:  When are Internet ISP's 
>going to start acting as Internet-phone gateways?...Any 
>guesses as to when this will be real?

After Jim Bell has shot a few recalcitrant ISP operators?


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From hallam at ai.mit.edu  Wed Jun  5 20:09:15 1996
From: hallam at ai.mit.edu (Hallam-Baker)
Date: Thu, 6 Jun 1996 11:09:15 +0800
Subject: Richard Stallman on RSA, Zimmermann, crypto
In-Reply-To: <4p44o9$aan@life.ai.mit.edu>
Message-ID: <31B5BD2D.41C6@ai.mit.edu>


Deranged Mutant wrote:
> 
> Not to defend or condemn RSA folx or patents, etc., but sometime ago
> (recently) I read or was told or perhaps hallucinated that PGP3 was
> going to include non-RSA algorithms that didn't suffer the patent
> stickiness (El Gammel based on DSA?)

DSA is based on El-Gamal, not the other way round. Although it is likely 
that a future version of PGP will include these algorithms the problem 
arises from the Diffie-Helleman patent and not the RSA patent. When this 
expires in 1997 it is certain that many products using public key 
cryptosystems will be avaliable in an unrestricted fashion.

	Phill





From jya at pipeline.com  Wed Jun  5 20:52:20 1996
From: jya at pipeline.com (John Young)
Date: Thu, 6 Jun 1996 11:52:20 +0800
Subject: URL for NRC Report, html
Message-ID: <199606051735.RAA15372@pipe1.t2.usa.pipeline.com>


Thanks to Replay Web Development, the URL for NRC Report on "Cryptography's
Role in Securing the Information Society" has been html-ed: 
 
 
     http://pwp.usa.pipeline.com/~jya/nrcindex.htm 
 
 





From reagle at MIT.EDU  Wed Jun  5 20:55:37 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Thu, 6 Jun 1996 11:55:37 +0800
Subject: A.Word.A.Day--seigniorage
Message-ID: <9606051737.AA24555@rpcp.mit.edu>


>From: Wordsmith <wsmith at wordsmith.org>
>To: linguaphile at wordsmith.org
>Reply-To: anu at wordsmith.org
>Subject: A.Word.A.Day--seigniorage
>Date: Wed, 5 Jun 1996 00:51:14 -0400
>
>sei.gnior.age or sei.gnor.age \'sa-n-y*-rij\ n [ME seigneurage, fr. MF, 
>   right of the lord (esp. to coin money), fr. s]eigneur : a government 
>   revenue from the manufacture of coins calculated as the difference between 
>   the monetary and the bullion value of the silver contained in silver coins
>
> 
>   1996 MARK BERNKOPF, Electronic Cash and Monetary Policy, 
>   "The widespread adoption of electronic cash would deprive Federal
>   authorities of a substantial amount of seignorage, the margin
>   between the face value of currency issued, and the costs of issuing
>   that currency.  In 1994, the Federal Reserve turned about $20 billion
>   in seignorage over to the Treasury."
> 
> 
>...........................................................................
>When you starve with a tiger, the tiger starves last. -Griffin's Thought
> 
>To subscribe or unsubscribe, please send a message to wsmith at wordsmith.org
>with "Subject:" line as "subscribe <Your Real Name>" or "unsubscribe".
>Email anu at wordsmith.org if you have any questions, comments or suggestions.
>Archives, FAQ, words and more at the WWW site: http://www.wordsmith.org/awad/
>
>
_______________________
Regards,            Real generosity toward the future lies in giving 
                    all to the present. - Albert Camus
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From hallam at ai.mit.edu  Wed Jun  5 20:56:21 1996
From: hallam at ai.mit.edu (Hallam-Baker)
Date: Thu, 6 Jun 1996 11:56:21 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <4p370g$r77@life.ai.mit.edu>
Message-ID: <31B5C131.167E@ai.mit.edu>


Vladimir Z. Nuri wrote:
<Uninformed crap>


Its worth pointing out that a complaint to an editor is not 
necessarily pressure. Did the Whitehouse threaten to sue 
HotWired? What _pressure_ was applied?

I find Meeks' style somewhat tiresome. It is tabloid jornalism
rather than reasoned argument. His dislike for the Clinton is 
well known - he recently accused the administration of being
fascist. I know of no evidence that the Clinton administration
has a genocide policy, it is an insult to the 10 million civilians
murdered by Hitler to use the term facist simply as a term of abuse,
especialy if it is being used as a substitute for an argument.

Point of fact: the skeleton closet does not know how traded options
work.

If one sells a traded option one is liable to pay the broker if the
market moves the opposite way to that hoped for. Normally the broker
asks a client to put up a deposit or "margin" to ensure that the
broker can recoup the money. In this case the broker knew that Hilary
had good credit and so accepted only a token deposit as "margin". Had
the market moved in the opposite direction Hillary would have been
liable for very much more than $1000, she was liable for hundreds of
thousands.

In most cases it is profitable to sell options, it is only if the market
moves in the "wrong" direction that one can lose out. In such cases the
losses are unlimited - the potential profit being fixed. This is why
most punters buy options - the potential loss is limited. 

You can see a similar effect in the market each time there is a "short
squeeze". A lot of people bet on Netscape going down in price because it
was overvalued. The number of short positions turned out to be higher
than the number of shares on offer which meant that many people were
having to buy shares at high prices to cover their positions. This is
how lack of confidence in a stock can send it through the roof. The free
market - don't you just love it?


		Phill





From mpd at netcom.com  Wed Jun  5 21:21:21 1996
From: mpd at netcom.com (Mike Duvos)
Date: Thu, 6 Jun 1996 12:21:21 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SUN.3.91.960604163805.11159A-100000@polaris>
Message-ID: <199606051740.KAA25482@netcom9.netcom.com>


Black Unicorn <unicorn at schloss.li> writes:

 > I'd like to see exactly how they word the proposed
 > prohibitons.  What constitutes "child" when the face painted
 > on is pure artistry?  Will we see a simple and strict
 > prohibition over modifiying sexually explicit pictures to
 > make them appear to be of younger models (whatever their
 > apparent age may be)?  Will we see a subjective test as to
 > what is "child looking" enough?

 > Silliness.  All silliness.

Indeed.  One should note that some states already have
legislation which contains the magic phrase "appears to be" in
the specification of legal ages.  The testimony of a willing
pediatrician is all that is necessary to convert some random
fuzzy GIF into a lengthy prison term.

Morphing technology is a new approach to creating what appear to
be sexual depictions of children, but there have also been
prosecutions based on more traditional technology, like sissors
and paste.

Personally, I don't think it should be possible to commit a
crime in the privacy of ones home using only sissors, Scotch
Tape, an old Playboy, and a JC Penny Catalog.

Those familiar with "The Varieties of Religious Experience" will
recall something called "The Pious Imagination", which results in
every vaguely anthropomorphic smudge being seen as the face of
Christ.  I suspect the Child Sex Hysterics are afflicted with a
similar trait, which similarly transforms image ambiguity into
pre-teen orgies.

 > Prediction: Some manner of law will be on the books (Or
 > perhaps passed, but unsigned) before the election
 > attempting to prohibit some form of this activity. Certainly
 > Clinton is not going to veto such a bill before the
 > election, which is doubtlessly when the right is going to
 > try to push it through.  (Can they streamline it enough to
 > get a vote in time?)

Wasn't Orin Hatch the big proponent of "synthetic child porn"
legislation?  I remember him harping on the subject a while back.

Is he behind this new push?






From brucem at wichita.fn.net  Wed Jun  5 21:30:38 1996
From: brucem at wichita.fn.net (Bruce M.)
Date: Thu, 6 Jun 1996 12:30:38 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SOL.3.91.960605065515.19215C-100000@ion1.ionet.net>
Message-ID: <Pine.BSI.3.91.960605103208.23845D-100000@wichita.fn.net>


On Wed, 5 Jun 1996, Jeffrey A Nimmo wrote:

> That's debatable. However, in this politically correct environment, I 
> wouldn't even give the impression of siding with the pedophiles if I were 
> you.

    Sometimes you have to decide whether to be politically correct or right.

                    Bruce M. * brucem at feist.com
        ~---------------------------------------------------~
        "Knowledge enormous makes a god of me." -- John Keats






From mixmaster at remail.obscura.com  Wed Jun  5 21:44:56 1996
From: mixmaster at remail.obscura.com (Mixmaster)
Date: Thu, 6 Jun 1996 12:44:56 +0800
Subject: OECD on Crypto
Message-ID: <199606051722.KAA06376@sirius.infonex.com>


[haven't seen this on cypherpunks yet]

OECD NEWS RELEASE - Paris, 10 May 1996 

OECD EXPERTS BEGIN DRAFTING CRYPTOGRAPHY GUIDELINES 

Cryptography experts from OECD countries have begun drafting a
proposal for OECD Cryptography Policy Guidelines that governments can
use as a guide to formulate their national policies on encryption. 

Many governments are under pressure within their own countries to
develop a national position on cryptography, which is used in computer
technology to protect everything from product designs to health and
tax records and global correspondence. But the needs of global
technologies and applications require an international --rather than a
strictly national -- approach to policymaking. The fast-paced
development of the Global Information Infrastructure adds an element
of urgency.

The business community, individuals and national security and law enforcement
agencies are all pressing for encryption guidelines and the OECD will strive to
reflect the legitimate interests of all these groups as it drafts Guidelines. 

The private sector is closely involved in drafting the Guidelines,
with business representatives from the Business and Industry Advisory
Committee (BIAC) participating at the meeting. 

The OECD meeting, which took place on 8 May, was hosted by the US
Department of State in Washington DC. It was held immediately after a
Second Business Government Forum on Global Cryptography Policy in
Washington DC on 7 May, which was cosponsored by the OECD, the 
International Chamber of Commerce (ICC) and the Business and Industry Advisory
Committee (BIAC) to the OECD. Two similar conferences took place in Paris in
December, when OECD countries and business representatives met for the
first time to discuss international cryptography policy. 

The process of drafting the OECD Cryptography Policy Guidelines will
continue at an experts meeting in June and is due for completion in
early 1997.

For further information, please contact Ms. Hiroko Kamata, OECD 
Directorate for Science, 
Technology and Industry (tel. 331 45 24 80 04 - fax. 331 45 24 93 32 - 
e-mail. hiroko.kamata at oecd.org).









From minow at apple.com  Wed Jun  5 21:49:33 1996
From: minow at apple.com (Martin Minow)
Date: Thu, 6 Jun 1996 12:49:33 +0800
Subject: Java
Message-ID: <v02140b02addb7880650e@[17.202.12.102]>


> From Tim May's citation of Vladimir Z. Nuri:
>
>> maybe Java is all about a generation
>>gap in computing. hey!! the first language that the "older generation"
>>hates.

Better try another language, I'm quite a bit older than Tim, and like
Java very much. It's one of the best languages I've seen since Algol 60.
To learn the language, I'd recommend Java in 21 Days and, as a quick
desk reference, Java in a Nutshell.

Tim May writes
> I think
>the security problems are, first of all, no worse vis-a-vis the language
>itself than problems with any language.

They're better than most, as programmers can't "escape" from memory
and variable typing bounds.
>
>Until Java and
>associated programs and tools appeared, I was seriously thinking about
>getting a Pentium or Pentium Pro (shudder, even though I admire my former
>employer and current stock benefactor, Intel) and putting Linux on it.

If you're interested in Linux, you can get Linux for Power PC. Check out
http://www.mklinux.apple.com for details. Currently, it runs on the
first-generation Power PC's (6100, 7100, 8100).

>
>Perry has some valid points vis-a-vis the most naive uses of applets. Were
>I the security manager of Morgan Stanley, I would certainly not want
>traders downloading "kewl" applets and (possibly) causing Big Problems. So
>what else is new?

The use of signed classes makes this practical as "kewl," but unsigned,
applets should be safe unless the user makes a stupid decision regarding
default applet permissions (and ignoring the Trojan Horse problem). The
attraction to (for example) Morgan Stanley, is that it minimizes their
risk when employees must work outside the corporate firewall. For example,
an employee making an external sales call can dial into Morgan Stanley
and use an appropriately privileged signed applet to access private data
on the corporate server as well as files on the employee's portable computer).

>
>Java as a language and as a platform-independent implementation is an
>achievement.

It's also not owned by the evil Redmond empire and does not appear
to be owned by a hardware vendor (as, when compared with Intel,
Motorola, and the Intel clones, Sun is a minor player in the hardware
arena).

It will be very interesting to see what happens when ANSI/ISO/IEEE decide
that they must "standardize" the language. I'm currently reading
"The Hubble Wars" and don't hold out mush hope that the official standard
dies will actually improve the language.

>
>And in some ways a more important comparison is to Perl and TCL, along with
>more obscure languages like Python and REXX. The welter of Net-oriented
>languages shows signs of  being much-simplified by the wide adoption of
>Java. It will be interesting to watch the next several years of
>developments.
>
Rather than compare Java to Perl/TCL, try comparing it to Visual Basic,
C, C++, Fortran, and COBOL.

Martin Minow
minow at apple.com







From nelson at crynwr.com  Wed Jun  5 23:56:30 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Thu, 6 Jun 1996 14:56:30 +0800
Subject: Markoff in NYT on NTT/RSA chip
In-Reply-To: <v03007101adda1bc74f88@[206.151.234.118]>
Message-ID: <19960605213317.4796.qmail@ns.crynwr.com>


David Lesher writes:

 > So Motorboatarola puts chips in the domestic MTSO's. 
 > For the international ones, they leave the chips out.

Crypto hooks, or more properly, crypto pads.  Lends new meaning to the
term "one time pads".

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From minow at apple.com  Thu Jun  6 00:17:36 1996
From: minow at apple.com (Martin Minow)
Date: Thu, 6 Jun 1996 15:17:36 +0800
Subject: Fight-Censorship Dispatch #12: CDA deathwatch, copyright update
Message-ID: <v02140b03addb7e62c704@[17.202.12.102]>


In "Fight-Censorship Dispatch #12", Declan McCullagh writes about
"everybody's favorite net.loon," Fred Cherry:

>Whatever you think of Cherry's antics, you gotta grant him one thing
> not many people have the balls to demand that a Federal court uphold
> their right to flame.

I suspect that Tom Payne would -- Cherry seems from your description
to be a prize example of "the lonely pamphleteer."

It would be interesting to know what Nat Hentoff thinks of Fred.

Martin Minow
minow at apple.com








From unicorn at schloss.li  Thu Jun  6 00:25:30 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Thu, 6 Jun 1996 15:25:30 +0800
Subject: Electronic Signature Act Of 1996
In-Reply-To: <2.2.16.19960605091100.1cd70da2@mail.io.com>
Message-ID: <Pine.SUN.3.91.960605162420.7279B-100000@polaris>


On Wed, 5 Jun 1996, Greg Broiles wrote:

> 
> I think more apropos to the discussion of electronic signatures is UCC
> 1-201(39), "'Signed' includes any symbol executed or adopted by a party with
> present intention to authenticate a writing." Comment 39 to 1-201 indicates
> "[a]uthentication may be printed, stamped or written; it may be by initials
> or by thumbprint. It may be on any part of the document and in appropriate
> cases may be found in a billhead or letterhead. No catalog of possible
> authentications can be complete and the court must use common sense and
> commercial experience in passing upon these matters. The question always is
> whether the symbol was executed or adopted by the party with present
> intention to authenticate the writing." And comment 2 to 3-401 (re
> negotiable instruments) indicates that a signature may be "handwritten,
> typed, printed or made in any other manner."

Please remember that the UCC's application is generally restricted to the 
sales of goods or acts between merchants.

> 
> So I don't see why that wouldn't include a PGP signature, a traditional
> ".signature" block, or the typed "/s/ Greg Broiles" used in some
> circumstances. (Of course, the UCC doesn't apply to every transaction, nor
> is it adopted in identical form in every state, blah blah blah.) But it's
> always nice if the legislature is willing to say "This is the right way to
> create an electronic signature" because then we don't have to wonder. 
> (However, a signature and a contract are not the same thing - and you don't
> need to have a contract to have an enforceable obligation. A nonrepudiable
> document still isn't a self-executing one.)

See above.

> --
> Greg Broiles                |"Post-rotational nystagmus was the subject of
> gbroiles at netbox.com         |an in-court demonstration by the People
> http://www.io.com/~gbroiles |wherein Sgt Page was spun around by Sgt
>                             |Studdard." People v. Quinn 580 NYS2d 818,825.
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From vznuri at netcom.com  Thu Jun  6 00:38:04 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Thu, 6 Jun 1996 15:38:04 +0800
Subject: Java
In-Reply-To: <31B58982.1F54@cs.berkeley.edu>
Message-ID: <199606051901.MAA14910@netcom18.netcom.com>


>
>>  c is "sort of" portable. it is
>> "in theory" portable. Java is portable "in theory and practice".
>
>   This point is simply not true, at least for Java as it exists in 
>Spring 1996. Almost every Java applet I've seen has little UI glitches 
>that prevent it from displaying and operating correctly on all 
>platforms.

you caveat, as you write it, is very significant. what I wrote about
was that the burden of portability is placed on the PROGRAMMER for
C. the burden of portability is placed on the Java language implementers
for Java. a BIG difference. Java may be *riddled* with bugs at the moment.
but who is responsible for fixing them? every single programmer in 
existence who wants to port code? (that is what effectively happens
with C makefiles) or the language designers? i.e. Java Inc.?  you
can see the tremendous difference here. the level of portability
*demanded* by the language specification of Java is far higher than
C. whether this works out in practice will take years of fine tuning.
but look how old C is-- 20 years-- and has its portability gotten
better with time, or worse? give Java another few years and its going
to be so good that no one will be arguing with supporters.

 Further, there are little glitches in the language 
>implementation and library design that often cause portability problems. 
>For example, the first cut of Hal's PGP applet had the standard UI 
>problems, plus the fact that a "spinner" thread caused the entire 
>browser to lock up -- on Unix, but not on Windows. 

whose problem is this? his or Java implementors? not his. granted,
in practice he may have to design around it. but Java is in its infancy
and you can't demand mature characteristics. as I emphasized, it
is evolving. it is a step in the right direction. you can't ask Excel
to be written before the PC has been invented. similarly, Java will
not crystallize for some time yet. (however UI problems do seem to me
to be the source of the greatest amount of intrinsic compatibility
problems. I was not wholly impressed with the labor that seemed to
go into the Java UI at first-- it seemed like a little of an afterthought)

And this was a 5000 
>line of code applet. Hal was able to fix the problems, but it's easy to 
>see how the effort involved in this "portability engineering" could 
>become comparable to your thousand-line makefile as applications scale 
>up.
>   The promise is there, but Java has not yet delivered.

I agree that in practice Java is pretty weak at the moment. but consider
how much money Sun has made from it. do you realize they poured 5M
initial development costs into it? can you be sure they will recoup
that? they probably have, but they've been incredibly generous. I am
never ceased to be amazed at how much people rant at stuff that is
given away for free or amazingly low cost.

>   Another concern with Java is that it acheives portability at the cost 
>of enforcing a lowest common denominator. For example, all real Windows 
>applications support OLE, and all real Mac applications support Apple 
>Events. Java applets, and even applications, can't do either. To me, 
>that makes the accomplishment of portability a bit less impressive, even 
>if it were so.

Java cannot solve every programming problem on the planet. it cannot
be a secure OS. it cannot give you a worldwide object standard. Java
has an event mechanism just as Apple does, and it supports object
oriented programming just as OLE is a standard associated with OO.
IMHO it did what it did well. if you want OLE go to microsoft, if
you want Apple Events program on the apple!!! if you want one language
in which you don't have to worry about every standard in the world,
try Java.







From perry at piermont.com  Thu Jun  6 00:56:09 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 6 Jun 1996 15:56:09 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <31B5C131.167E@ai.mit.edu>
Message-ID: <199606051821.OAA12450@jekyll.piermont.com>



Phill, quit while you are ahead. It is my opinion, as a person highly
familiar with the markets in question, that Hillary Clinton's profits
were impossible to achieve by any means other than fraud, and that no
honest broker would have allowed her to hold positions in which she
was so far out of mandatory margin requirements and a trivial move
would have wiped out her entire net worth and more.  I do not know of
a single professional in the industry who disagrees with me.

I know of at least one extremely well written study, by Victor
Neiderhoffer (a very successful futures trader) and Caroline Baum (a
reporter for Telerate) that more or less demonstrates that there is no
way that any of what happened could have been legitimate.

The most astounding part of the trading pattern was that Hillary
Clinton did not "let it ride" and earn the money off of repeated
increases in the value of a single investment -- instead, she took all
profits out of her account after each trade and never invested more
than a tiny sum in any transaction. That is to say, she didn't earn
modest profits repeatedly over many trades -- she earned nearly
impossible profits in trade after trade. In spite of withdrawing her
profits after each trade, she racked up an impossible profit of 100
times her initial investment in a tiny period of time. At no time did
she meet margin requirments, and she repeatedly risked more than the
Clinton's entire net worth on what would have been gambles had her
profits not been guaranteed. In spite of her astounding "performance"
she immediately stopped trading after $100,000 in profits had been
accumulated.

There is an obvious trick by which this can be achieved. The broker
writes two tickets -- one to buy, one to sell. One ticket always loses
exactly what the other gains. The winning ticket is assigned to the
bribee, the loser to the person doing the bribing. The mechanism
self-launders the funds.

Hallam-Baker writes:
> Point of fact: the skeleton closet does not know how traded options
> work.

Mr. Baker, she traded FUTURES.

> If one sells a traded option one is liable to pay the broker if the
> market moves the opposite way to that hoped for. Normally the broker
> asks a client to put up a deposit or "margin" to ensure that the
> broker can recoup the money.

Margin requirements are set by the exchanges and the CFTC, not by the
broker in most cases. They are required by law -- not under broker
discretion.

> In this case the broker knew that Hilary
> had good credit and so accepted only a token deposit as "margin".

He's not allowed to. Furthermore, no sane broker would have allowed a
customer to hold a position in which a small move would have more than
wiped out the customer's entire net worth.

> In most cases it is profitable to sell options,

Futures, Mr. Baker.

> it is only if the market moves in the "wrong" direction that one can
> lose out. In such cases the losses are unlimited - the potential
> profit being fixed. This is why most punters buy options - the
> potential loss is limited.

Hillary Clinton was trading FUTURES.

Perry





From Bodo_Moeller at public.uni-hamburg.de  Thu Jun  6 01:04:25 1996
From: Bodo_Moeller at public.uni-hamburg.de (Bodo Moeller)
Date: Thu, 6 Jun 1996 16:04:25 +0800
Subject: Fate of Ecash if RSA is cracked?
Message-ID: <m0uRIwy-0000AJC@ulf.mali.sub.org>


"Perry E. Metzger" <perry at piermont.com>:
>Igor Chudov @ home:

>> Actually factoring is not exponential even now.
[... est.:]
>> N ~= exp(((1.923+O(1)) * (ln n)^(1/3) * ln ln n)^(2/3))

> The distinction between that and exponential is rather difficult for
> most ordinary people to see, and in any case subexponential and
> exponential are "practically the same" for purposes of this
> discussion.

When discussing the estimated time needed for factoring integers, it
is usually assumed that an "algorithm" is something that is
deterministic or probabilistic.  Quantum computing should also be
mentioned.  Efficient algorithms for logarithms (the Diffie-Hellmann-
problem) and factoring (the RSA-problem) on a quantum computer were
found by Peter Shor [1].

Of course, no quantum computing device that you could run those
"programs" on does exist. But as Gilles Brassard puts it, "In my
opinion, the theoretical notion of feasible computation should be
modelled on our understanding of the physical world, not on our
technological abilities. After all, the classical Turing machine
itself is an idealization that cannot be built in practice even not
taking account of the unbounded tape: any real implmentation of a
Turing machine would have nonzero probability of making a mistake.
Does this discredit the model? I think not." [2]

An other article by Brassard might still be availabe at
<URL:http://www.rsa.com/rsalabs/cryptobytes/spring95/brassard.htm>.
There, he writes quite optimistically: "I like to think that I shall
see a special-purpose quantum factorization device in my lifetime."


[1] Peter W. Shor, Algorithms for Quantum Computation: Discrete
    Logarithms and Factoring (in: Proceedings of the 35th Annual IEEE
    Symposium on Foundations of Computer Science, 1994, pp. 116-134)

[2] Gilles Brassard, A Quantum Jump in Computer Science (in: Computer
    Science Today (Springer-Verlag LNCS 1000), 1995, pp. 1-14)





From unicorn at schloss.li  Thu Jun  6 01:05:11 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Thu, 6 Jun 1996 16:05:11 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SOL.3.91.960605065515.19215C-100000@ion1.ionet.net>
Message-ID: <Pine.SUN.3.91.960605162533.7279C-100000@polaris>


On Wed, 5 Jun 1996, Jeffrey A Nimmo wrote:

> 
> 
> On Tue, 4 Jun 1996, Black Unicorn wrote:
> 
> > 
> > Hearings on the hill over the child pornographer horseman:
> > 
> > "Morphing" seems to be the latest buzzword for putting childrens faces on 
> > the bodies of adult models in sexually explicit poses and seems to have 
> > attracted enough attention to warrant congressional attention.
> > 
> > Interesting that the media is playing this up as a "net" deal.  (As if 
> > somehow it were impossible to do without the all powerful and evil internet.
> 
> I've heard of this kind of thing before. Individuals have already been 
> sent to jail for doing this, as well as doing and 
> distributing kiddie porn drawings. 

I know indirectly of two state supreme courts that have overturned such 
convictions.

> I suspect that since it's already illegal on the state level, that 
> Congress is looking into making it a federal crime to distribute them 
> over state lines via the Internet.

See above.
As to federal crime, I believe so.

> > I'd like to see exactly how they word the proposed prohibitons.  What 
> > constitutes "child" when the face painted on is pure artistry?  Will we 
> > see a simple and strict prohibition over modifiying sexually explicit 
> > pictures to make them appear to be of younger models (whatever their 
> > apparent age may be)?  Will we see a subjective test as to what is "child 
> > looking" enough?
> 
> It only has to give the impression of being under the age of consent in 
> order to be illegal. No real models have to be involved.

Ok, what is "the impression of being under the age of consent" ?

> > Silliness.  All silliness.
> 
> That's debatable. However, in this politically correct environment, I 
> wouldn't even give the impression of siding with the pedophiles if I were 
> you.

That's what nyms are for.

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From unicorn at schloss.li  Thu Jun  6 01:06:25 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Thu, 6 Jun 1996 16:06:25 +0800
Subject: Electronic Signature Act Of 1996
In-Reply-To: <199606050323.WAA09499@manifold.algebra.com>
Message-ID: <Pine.SUN.3.91.960605162011.7279A-100000@polaris>


On Tue, 4 Jun 1996 ichudov at algebra.com wrote:

> Sandy Sandfort wrote:
> > C'punks,
> > 
> > At 11:11 AM 6/4/96 -0400, Perry E. Metzger wrote:
> > 
> > >...I get the impression that under the common law, an ink 
> > >signature is merely a demonstration that a party assented 
> > >to a contract, and except for certain contracts (which 
> > >usually require witnesses etc.) there is no requirement in 
> > >the law that a contract even be on paper...
> > 
> > The "Statute of Frauds" lists the exceptions and they cover
> > most important contracts.  I seem to recall that contracts
> > over a given amount or for interests in real property for 
> > periods of a year or more are covered.  I'm sure someone 
> > with current access to legal research resources will post
> > a better explanation.
> 
> [I AM NOT A LAWYER]
> 
> The following contracts are required to be in writing, in most states: 
> 
> 
> 1. A contract of an executor or administrator to answer
> for a duty of the decedent (the executor-administrator
> provision).
> 
> 2. A contract to answer for debt or default of another (the suretyship
> provision).
> 
> 3. A contract made upon consideration of marriage (the marriage provision).
> 
> 4. A contract for sale of goods worth more than $500 (the sales provision).
> 
> 5. A contract for sale of an interest in land (the land provision).
> 
> 6. A contract not preformable within a year (the one-year provision).

Exceptions and loopholes are SO numerous so as to make this list less 
than worthless.

The only straightforward rules are with respect to UCC sale of goods 
contracts.

> 	- Igor.

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From reagle at mit.edu  Thu Jun  6 01:06:41 1996
From: reagle at mit.edu (Joseph M. Reagle Jr.)
Date: Thu, 6 Jun 1996 16:06:41 +0800
Subject: ICE - International Cryptography Experiment
Message-ID: <9606051848.AA25257@rpcp.mit.edu>


I've seen some mention of international cryptographic CAPI issues, and I
think it is of great importance. However, I don't think many people have had
a chance to look at the actual work. Check out ICE. Those familiar with
cyberpunk fiction will no doubt find the ancronym as humorous/ironic as I do
<grin>:

The International Cryptography Experiment (ICE) calls for a series of
experiments to promote the international use of cryptography in common
computer software applications (i.e., word processors, spreadsheets,
electronic mail systems) in a manner that honors individual national
controls on the import, export, and use of cryptography. The general
approach being advocated by numerous organizations in several countries is
the use of a Cryptographic Application Programming Interface (CAPI) to
separate the actual performance of the cryptographic functions from the
software applications that call for encryption of specific messages or
files. ICE is an informally structured program to coordinate the many
efforts underway in the U.S and several other countries to advance the
general understanding of CAPIs and their use to promote international
cryptography. It is intended that practical standards derived from actual
use will evolve from these experiments in the spirit by which Internet
standards evolve. 

http://www.tis.com/crypto/ice.html .
_______________________
Regards,            Real generosity toward the future lies in giving 
                    all to the present. - Albert Camus
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From markm at voicenet.com  Thu Jun  6 01:10:42 1996
From: markm at voicenet.com (Mark M.)
Date: Thu, 6 Jun 1996 16:10:42 +0800
Subject: Senator Exon & me
In-Reply-To: <199606051212.IAA11953@jekyll.piermont.com>
Message-ID: <Pine.LNX.3.93.960605153622.186B-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 5 Jun 1996, Perry E. Metzger wrote:

> 
> Are you sure that you weren't just getting mail from the Senator Exon
> remailer? The real Senator Exon doesn't use email.

Blake Wehlage wrote:

| #1 If you really wanted to show just had balls (I hate to use the phrase but
| I can't think of anything better) you wouldn't hide behide remailers.
                                                 ^^^^^^^^^^^^^^^^^^^^^

I am sure he realizes Sen. Exon is a remailer given the above quote.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMbXij7Zc+sv5siulAQFZ2gP+OkakYJcDjzK/G2bWEUdIYJAedHh0dbAZ
lwXCjGTLlJmC5lspgZ0qJLRK+PXbp2pcy5Hs1uZQ+N9QMwsbqXPuUXrm0G6QVt6H
8pYB8j7WJwYoJz62rY+eRmiPZR1pth4W8ukeKnRHRYLF2oECHaS8HRNYu8amulBY
BiM3WPmyibs=
=fIxB
-----END PGP SIGNATURE-----





From hallam at Etna.ai.mit.edu  Thu Jun  6 01:10:46 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Thu, 6 Jun 1996 16:10:46 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <199606051821.OAA12450@jekyll.piermont.com>
Message-ID: <9606052018.AA03374@Etna.ai.mit.edu>



>Phill, quit while you are ahead. It is my opinion, as a person highly
>familiar with the markets in question, that Hillary Clinton's profits
>were impossible to achieve by any means other than fraud, and that no
>honest broker would have allowed her to hold positions in which she
>was so far out of mandatory margin requirements and a trivial move
>would have wiped out her entire net worth and more.  I do not know of
>a single professional in the industry who disagrees with me.

Crap Perry, I discussed the affair with a top investment manager
at Barclays Bank Suisse. He saw no problem whatsoever in the deals.
Neither did my friend who trades oil futures for Rappaport. If you 
want to play the "who knows who in banking" game remember that the
Oxford Union and the Swiss National Croquet team are probably better
places to meet banking types than the Palo Alto Au Bon Pain.


>Futures, Mr. Baker.

Its Dr., Mr Metzger


Before you get all steamed up and bothered consider that you are 
behaving in typical USEnet flamefest fashion. Are you going to claim
that the underlying mechanism for options is any different than for 
futures? The point was that she was _selling_ and not _buying_. Thats
a fixed profit bet with an unlimited downside.

>The most astounding part of the trading pattern was that Hillary
>Clinton did not "let it ride" and earn the money off of repeated
>increases in the value of a single investment

Of course, a person _selling_ futures is going to take the profits out
each time. The profits are made against the net worth of the person
concerned. Its an _underwriting_ business Mr Metzger. $100,000 is not a 
substantial increase in Hillary's net worth so she _can't_ underwrite
more business. 

>There is an obvious trick by which this can be achieved. The broker
>writes two tickets -- one to buy, one to sell. One ticket always loses
>exactly what the other gains. The winning ticket is assigned to the
>bribee, the loser to the person doing the bribing. The mechanism
>self-launders the funds.

Oh yes, and how does one cover up the matching ticket? They would
show up on the brokers account. 

If one wishes to bribe a politician a much better way is to give them
a huge advance on their book, or buy some tangible asset at above
market value. I can't see an intelligent broker risking his business 
when there are easier mechanisms available.

>Margin requirements are set by the exchanges and the CFTC, not by the
>broker in most cases. They are required by law -- not under broker
>discretion.

Forgive me if I am wrong but are CFTC margin requirements not 
requirements placed on brokers as opposed to requirements brokers
must impose on customers? That at any rate is my understanding
of the situation from Galbraith.
 

Given the four years of dirt digging over Whitewater its a safe bet
that none of the actions were illegal as Mr Metzger claims. If they
were it would demonstrate more than incompetence on the part of
D'Amato et al. After four years they have a convicted fraudster and 
self confesed pejurer as their only link to the Whitehouse. If there
was such obvious criminality in those dealings D'Amato would have
been all over them.


ObCrypto: Perry is only able to make allegations because the
financial markets are to a degree open. If anoymous cash takes
off and anonymous derivatives follow won't it make it easier to
conceal the type of dealings Perry alledges?


	Phill





From wb8foz at nrk.com  Thu Jun  6 01:27:20 1996
From: wb8foz at nrk.com (David Lesher)
Date: Thu, 6 Jun 1996 16:27:20 +0800
Subject: Markoff in NYT on NTT/RSA chip
In-Reply-To: <v03007101adda1bc74f88@[206.151.234.118]>
Message-ID: <199606052013.QAA04983@nrk.com>


> 
> 
> 3. Once you import an ITAR item, its export becomes controlled. Importing
> the NTT chipset for use, say, in a Motorola cell switch (made in IL) would
> seem to be problematic. Buying chips in Japan for shipment to Moto's phone
> factories in Singapore and Malaysia, however, would appear to be OK. 

So Motorboatarola puts chips in the domestic MTSO's. 
For the international ones, they leave the chips out.

If the local service agency in Freedonia wants to buy the chips
from Japan & install them themselves, what can IL say?



-- 
A host is a host from coast to coast.................wb8foz at nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433





From janimmo at ionet.net  Thu Jun  6 01:28:41 1996
From: janimmo at ionet.net (Jeffrey A Nimmo)
Date: Thu, 6 Jun 1996 16:28:41 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SUN.3.91.960605162533.7279C-100000@polaris>
Message-ID: <Pine.SOL.3.91.960605153106.26199C-100000@ion1.ionet.net>




On Wed, 5 Jun 1996, Black Unicorn wrote:

[snip]

> > I've heard of this kind of thing before. Individuals have already been 
> > sent to jail for doing this, as well as doing and 
> > distributing kiddie porn drawings. 
> 
> I know indirectly of two state supreme courts that have overturned such 
> convictions.

I would put it to you that being branded a pedophile and kiddie-porn 
operator can have worse implications than jail. For instance, I believe 
that even without a conviction, restraining orders can be placed which 
would prevent you from coming within a certain number of feet of 
children. If it were publically known you would almost certainly lose 
your job. I also imagine it would be hell on your marriage.

All this can result from an arrest, not necessarily a conviction.

Besides, I wouldn't count on the courts to uphold our rights. The Supreme 
Court just upheld civil forfeiture, allowing the cops to sieze your 
property without due (or any as far as I'm concerned) process of law.

> > I suspect that since it's already illegal on the state level, that 
> > Congress is looking into making it a federal crime to distribute them 
> > over state lines via the Internet.
> 
> See above.
> As to federal crime, I believe so.
> 
> > > I'd like to see exactly how they word the proposed prohibitons.  What 
> > > constitutes "child" when the face painted on is pure artistry?  Will we 
> > > see a simple and strict prohibition over modifiying sexually explicit 
> > > pictures to make them appear to be of younger models (whatever their 
> > > apparent age may be)?  Will we see a subjective test as to what is "child 
> > > looking" enough?
> > 
> > It only has to give the impression of being under the age of consent in 
> > order to be illegal. No real models have to be involved.
> 
> Ok, what is "the impression of being under the age of consent" ?

I believe that like all porn, it's a reasonability issue. If a 
"reasonable" person would believe that the person depicted in the drawing 
or morph to be underage, that it's illegal. I'm not sure, but I'll bet 
Sternlight would have an opinion. Anyone care (dare) to ask?

> 
> > > Silliness.  All silliness.
> > 
> > That's debatable. However, in this politically correct environment, I 
> > wouldn't even give the impression of siding with the pedophiles if I were 
> > you.
> 
> That's what nyms are for.

That's a good point. Anonymity makes it possible to ask questions that 
would be too embarressing or damaging to ask otherwise. It makes me 
wonder what would have happened if the Cypherpunks had been around in the 
McCarthy era.






From MINITERS at citadel.edu  Thu Jun  6 01:33:49 1996
From: MINITERS at citadel.edu (Syl Miniter)
Date: Thu, 6 Jun 1996 16:33:49 +0800
Subject: is the list active??
Message-ID: <01I5KBX5OHII00030A@CITCS.Citadel.edu>


I recently re-subscribed --several days ago and have not received any
traffic???
I am wondering if the list is still active as I checked and I am subscribednso
I am sending this note to this list to test if anyone is out there





From frissell at panix.com  Thu Jun  6 01:34:00 1996
From: frissell at panix.com (Duncan Frissell)
Date: Thu, 6 Jun 1996 16:34:00 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <2.2.32.19960606024345.00a07918@panix.com>


At 10:41 PM 6/4/96 -0700, Bruce Baugh wrote:
>I think there's a non-trivial chance that this list could be shut down and
>anyone who's made interested sounds in the idea brought in to assist the
>police in their inquiries.

Yeah and they busted Jack London for publishing "The Assassination Bureau, Ltd".
(http://www.amazon.com/exec/obidos/ISBN=0140186778/1663-9102790-622063)

Advocating the general practice of killing one's opponents is as legal as
church on a Sunday.  The War College (or is it the NDU these days) does it
all the time.

DCF






From mccoy at communities.com  Thu Jun  6 01:36:23 1996
From: mccoy at communities.com (Jim McCoy)
Date: Thu, 6 Jun 1996 16:36:23 +0800
Subject: How can you protect a remailer's keys?
Message-ID: <v02140b00addba12bd414@[205.162.51.35]>



Lance Cottrell writes:
> At 11:55 PM 6/1/96, Bill Stewart wrote:
> >Encryption is critical for protecting against traffic analysis,
> >but it's tough to protect a remailer's keys.  Unlike regular email,
> >where you can type the key in as you read it, remailers need to
> >run automatically once you set them up.  Some of the choices are:
> >- leave it around in plaintext with only Unix file protections
> >- type it in to a long-running remailer process
> >- SSL-based remailers, where the web server handles crypto on
> >        a per-machine basis instead of per-remailer
> >- use unauthenticated Diffie-Hellman
> >- off-line or off-site remailer such as a POP3 winsock remailer
> >- human intervention on every message
> >
> >Anybody have any other approaches?  These are mostly weak,
> >annoying, or both.
>
> The best solution I could come up with (and was willing to write and use)
> is to specify the passphrase on the command line argument to the compiler

This is little better than leaving it around in a plaintext file, a pass
or two with gdb on your binary and I have your private key.

The "difficult, expensive, and pain in the ass code to write" solution that
I favor is to use secure multiparty computation to create the remailer.  It
does not exist on a single host, but is rather the sum of a collection of
hosts running on widely seperated machines.  It has the same type of drawback
as a per-execution password entered into a long-lived process (anyone with
root access to the host can yank it out of memory with little difficulty,)
but this is spread out across a larger collection of hosts, making the task
of actually getting the complete password somewhat difficult.  Getting a
subset of the individual host passwords does not provide any partial
information about the collective password (similar to secret sharing.)
The other drawback is that certain operations can be very slow, you end
up emulating a circuit with a _very_ slow clock (8-10 Hz.  Not MHz, not KHz,
but 8-10 ticks/second); as compensation you get a word-size that if
effectively infinite. I have to continue work on a subset of these methods
for a secure digital poker/card-playing system over the next couple of months
and if I have some spare time I might see just how difficult creating a
toolkit for building such virtual circuits really is...

OTOH, a secure PCMCIA or smart-card will probably end up being a better
practical solution.

jim







From perry at piermont.com  Thu Jun  6 01:41:53 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 6 Jun 1996 16:41:53 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <199606052043.QAA12656@jekyll.piermont.com>
Message-ID: <199606052110.RAA12739@jekyll.piermont.com>



I realized that there was an ambiguity in my last missive. I'd like to
close that ambiguity.

"Perry E. Metzger" writes:
> > Forgive me if I am wrong but are CFTC margin requirements not 
> > requirements placed on brokers as opposed to requirements brokers
> > must impose on customers?
> 
> I must confess that I don't know, largely because its irrelevant, even
> in this case.

If you meant "brokers have to put up the margin, not customers, and
they don't have to charge customers the margin" you were simply flat
out wrong. Margin is a customer responsibility, not a broker
responsibility. I will point out, though, that brokers face liability
if their customers cannot meet their obligations -- which naturally
would make any honest broker suspicious of a customer trading a highly
leveraged position in which a tiny move in the market would wipe out
the customer's entire net worth, thus likely exposing the broker to
substantial risk.

Stop loss orders, incidently, aren't any use if the damage would be
done before any such order could be executed.

Perry





From WlkngOwl at unix.asb.com  Thu Jun  6 01:45:39 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Thu, 6 Jun 1996 16:45:39 +0800
Subject: USA on Feds Cyberteam
Message-ID: <199606060340.XAA24064@unix.asb.com>


On  5 Jun 96 at 13:18, John Young wrote:

>    USA Today, June 5, 1996, p. 1. 
[..]
>    To see adjoining UT article (9 kb),  
>     
>    "Post-Cold War hysteria or a national threat?" 
>  
>       http://pwp.usa.pipeline.com/~jya/hysteria.txt 

There's so many fnords my eyes hurt to read it.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From root at edmweb.com  Thu Jun  6 01:56:14 1996
From: root at edmweb.com (Steve Reid)
Date: Thu, 6 Jun 1996 16:56:14 +0800
Subject: Cost of brute force decryption
In-Reply-To: <199606050631.CAA01285@unix.asb.com>
Message-ID: <Pine.BSF.3.91.960605143511.190B-100000@bitbucket.edmweb.com>


> > 	"For example a 40-bit key takes about $10,000 worth of supercomputer 
> > time and two weeks to crack.  Although this key may be adequate to 
> > protect my checking account, it's probably not large enough for the 
> > accounts of a major corporation.
> 
> The figures look familiar.  No references around.  I'm not sure it would 
> require a whole two weeks for 40-bits, though.  Possibly less than a 
> day? (Or was that why you asked baout the figures?)

Um, These 'NT Magizine' people are rather clueless. A $400 FPGA can crack
a 40 bit key in an average of 5 hours. See the report by seven well-known
experts at http://www.bsa.org/bsa/cryptologists.html


=====================================================================
| Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/)    |
| Email: steve at edmweb.com   Home Page: http://www.edmweb.com/steve/ |
| PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 |
|          -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. --          |
===================================================================:)






From somogyi at digmedia.com  Thu Jun  6 02:07:27 1996
From: somogyi at digmedia.com (Stephan Somogyi)
Date: Thu, 6 Jun 1996 17:07:27 +0800
Subject: Java
In-Reply-To: <v02140b02addb7880650e@[17.202.12.102]>
Message-ID: <v03007215addbb3b383e2@[198.93.25.98]>


At 11:05 -0700 5.6.96, Martin Minow wrote:

> Tim May writes
>
>> Java as a language and as a platform-independent implementation is an
>> achievement.
>
>It's also not owned by the evil Redmond empire

I'm not so sure. It seems to me that Sun's abrogation of responsibility
for the x86 reference implementation to Microsoft also handed over the
de facto ownership of Java until ANSI/ISO get their hands on it, by
which time it may be too late. (It also raises the question whether a
browser with a built-in Java VM, such as Netscape's, will use its own
VM or the Java VM present in the OS when a choice is available.)

There are an awful lot of x86 boxes out there and they carry a lot of
common-denominational weight. There's also little to stop Microsoft
from extending their Java implementation while remaining compliant with
the basic Java spec. The HTML wars seem to have quieted down
considerably in recent months, but I still recall the vigorous
extension-tag oneupmanship that went on between Microsoft and Netscape;
I see no reason that this couldn't also happen with Java.

ObCrypto: If Microsoft does wind up setting the de facto standard for
Java by virtue of owning the x86/Win32 VM, can it successfully force
the use of its particular APIs in Java applets by sheer weight of
installed base?

________________________________________________________________________
Stephan Somogyi                Mr Gyroscope                Digital Media







From rodger at interramp.com  Thu Jun  6 02:08:49 1996
From: rodger at interramp.com (Will Rodger)
Date: Thu, 6 Jun 1996 17:08:49 +0800
Subject: Markoff in NYT on NTT/RSA chip
Message-ID: <v01510101addbb8dd94cd@[38.12.4.241]>


>David Lesher writes:
>
> > So Motorboatarola puts chips in the domestic MTSO's.
> > For the international ones, they leave the chips out.
>
and Russ Nelson responded:
>Crypto hooks, or more properly, crypto pads.  Lends new meaning to the
>term "one time pads".
>

For what it's worth, Motorola can do neither. US companies can't produce
anything prohibited for export unless its in the US, for the US market. And
"crypto with a hole," or hooks for crypto generally, can't be exported,
either, unless for 40-bit stuff only. Thus, Microsoft's proposals to
produce "crypto with a hole" depend on "holes" tailored to the requirements
of specific countries.

Will Rodger
Washington Bureau Chief
Interactive Week







From perry at piermont.com  Thu Jun  6 02:10:56 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 6 Jun 1996 17:10:56 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <9606052018.AA03374@Etna.ai.mit.edu>
Message-ID: <199606052043.QAA12656@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> If you want to play the "who knows who in banking" game remember
> that the Oxford Union and the Swiss National Croquet team are
> probably better places to meet banking types than the Palo Alto Au
> Bon Pain.

Working for Wall Street investment banks is probably better than both.

I live in New York, not Palo Alto. Guess who I work for. Hint: if I
want to speak to a futures trader, most days I can walk down the hall.

> >The most astounding part of the trading pattern was that Hillary
> >Clinton did not "let it ride" and earn the money off of repeated
> >increases in the value of a single investment
> 
> Of course, a person _selling_ futures is going to take the profits out
> each time.

I don't think you get it.

Its one thing to put up $1000, make $4000, then put up the $5000 and
make $10,000 with it, etc. Thats a situation where you are compounding
your profits -- reinvesting them.

Its another thing to put up $1000, make $4000, withdraw the $4000, put
up $1000, make $4500, withdraw the $4500, etc.

This is not a case of someone making a profit and reinvesting it so
that she got compound returns. This is a case of someone miraculously
turning one in a million trades over and over and over again on the
same tiny stake until she got $100,000. Its almost impossible to turn
$1000 into $100,000 by reinvesting. Its dead impossible the way that
Hillary did it.

Neiderhoffer and Baum list about a dozen criteria for detecting fraud
in securities transactions like this. Hillary Clinton hits every
single one. She was a first time trader. She took gigantic risk. Her
account was full of large scale irregularities like failure to meet
margin requirments. She earned astounding profits. She was in a
position to be bribed. She made her money off leverage in tiny
movements that would be hard to impossible for people to exploit. She
stopped trading just as suddenly as she started in spite of her
miraculous success. You can read Neiderhoffer and Baum's article
yourself if you like.

I will state this for the record: Having examined the evidence, I
would say that even a non-expert who was reasonably informed about how
the futures markets work would have no choice but to conclude that
Hillary Clinton's trading pattern was impossible without some sort of
fraud being committed.

> The profits are made against the net worth of the person
> concerned. Its an _underwriting_ business Mr Metzger. $100,000 is not a 
> substantial increase in Hillary's net worth so she _can't_ underwrite
> more business. 

Huh? What are you talking about?

Futures contracts aren't an "underwriting" in any case. They are very
simple contracts. When you buy a futures contract in, say, feeder
cattle, you are buying delivery of a fixed size number of feeder
cattle on a particular date in the future. When you sell a contract,
you are agreeing to deliver that many cattle. Thanks to margin, of
course, by putting up a fairly small sum of money you can buy control
over a large number of cattle, and not have to actually put up most of
the money.

One major problem with Hillary Clinton's fraudulent trades, however,
was that she was buying enough contracts that a tiny shift in the
price of the cattle downward -- shifts of a size that would be common
in a given day -- would have more than wiped out her families entire
net worth and more. Somehow, though, her broker allowed her to take
such large positions -- without putting up the *legally*required*
margin -- and somehow in lots of trades a statistically ordinary
blip never hit her.

One wonders why someone who's husband had just been elected Governor,
and who had no history of gambling, and had no sudden financial
crisis, would be willing to gamble her family's entire future over and
over again -- unless, of course, it wasn't gambling.

> >There is an obvious trick by which this can be achieved. The broker
> >writes two tickets -- one to buy, one to sell. One ticket always loses
> >exactly what the other gains. The winning ticket is assigned to the
> >bribee, the loser to the person doing the bribing. The mechanism
> >self-launders the funds.
> 
> Oh yes, and how does one cover up the matching ticket? They would
> show up on the brokers account. 

Of course they would. Sadly, however, the broker in question
conveniently lost ALL RECORDS OF TRANSACTIONS THAT TOOK PLACE AT THAT
TIME. Sad, isn't it?

This same broker was censured repeatedly for violating securities
laws, by the way.

Does the word "coverup" mean anything to you?

> If one wishes to bribe a politician a much better way is to give them
> a huge advance on their book, or buy some tangible asset at above
> market value.

Both of those are visible. This is invisible.

> I can't see an intelligent broker risking his business when there
> are easier mechanisms available.

The trick was very common at the time, a fact that all your brilliant
friends you consulted didn't seem to know. Many brokers got snagged,
along with their clients, in pulling this game for all sorts of
reasons -- shifting assets from a taxable account held by a client
into their tax free pension account, for example. The SEC, CFTC and
IRS caught on, and the practice has been largely wiped out. Matched
trades were common, however, in the period we are talking about, and
many brokers did in fact perform them for clients.

> >Margin requirements are set by the exchanges and the CFTC, not by the
> >broker in most cases. They are required by law -- not under broker
> >discretion.
> 
> Forgive me if I am wrong but are CFTC margin requirements not 
> requirements placed on brokers as opposed to requirements brokers
> must impose on customers?

I must confess that I don't know, largely because its irrelevant, even
in this case.

> Given the four years of dirt digging over Whitewater its a safe bet
> that none of the actions were illegal as Mr Metzger claims.

Of course they were. They just can't be proven.

We are not dealing with some idiot like Spiro T. Agnew here. We are
talking about a pair of well educated, very smart and totally
unscrupulous crooks -- Bill and Hillary Clinton. There is no evidence
that you can pin on them in court. However, I'm not a court, and I'm
allowed to judge something to have been impossible to achieve without
hanky panky regardless of whether or not you can prove who the
counterparty is and why the bribe was made.


Perry





From alanh at infi.net  Thu Jun  6 02:11:46 1996
From: alanh at infi.net (Alan Horowitz)
Date: Thu, 6 Jun 1996 17:11:46 +0800
Subject: USA on Feds Cyberteam
In-Reply-To: <199606051318.NAA03600@pipe2.t2.usa.pipeline.com>
Message-ID: <Pine.SV4.3.91.960605221206.22400H-100000@larry.infi.net>


Guess this puts that Carnagie Mellon-based outfit ("Computer Emergency 
Response Team"?) off the govt contract teat.

Or maybe they will continue to doa all the trenchwork under contract, but 
people high up enough in the DC feeding chain to have their own PR 
appendage, will take the credit?





From szabo at netcom.com  Thu Jun  6 02:12:13 1996
From: szabo at netcom.com (Nick Szabo)
Date: Thu, 6 Jun 1996 17:12:13 +0800
Subject: Micropayments: myth?
Message-ID: <199606060257.TAA16018@netcom.netcom.com>



Some electronic commerce projects promise dramatically lower transaction
costs, so that we can achieve "micropayments", "microintermediation",
and so forth.  Is this achievable?  

Consider a feature fairly independent of the particular payment system: 
the statement of charges.  Here lies a tradeoff here between completeness 
and complexity.   On the one hand, merely summarizing charges creates 
the opportunity for salami frauds, allowing widely distributed false or 
exaggerated microcharges to go undetected.  Furthermore, parties reading 
only the summaries get no feedback by which they can adjust their behavior
to minimize costs.  On the other hand, a statement too complex to
be easily read also allows fraud, error, and inefficient usage to 
go unrecognized, because one or both parties cannot understand the 
rationale for the charges in relation to the presumed agreement on
terms of service and payment. 

There seems to lie here a fundamental cognitive bottleneck, creating a
limit to the granularity of billable transaction size whether electronic
or physical.  One proposed solution to this has been "intelligent 
agents".  But since these agents are programmed remotely, not by the 
consumer, it is difficult for the consumer to determine whether the agent
is acting the consumers' best interests, or in the best interests
of the counterparty -- perhaps, necessarily, at least as difficult 
as reading the corresponding full statement of charges.   By
sleight of hand we may have merely transformed the language of 
the transaction as it needs to be understood by the party, without
reducing the complexity to be understood.  Furthermore, the user 
interface to enable consumers to simply express their sophisticated 
preferences to an agent is lacking, and may represent another fundamental 
cognitive bottleneck.

Telephone companies have found billing to be a major bottleneck.
By some estimates, up to 50% of the costs of a long distance call
are for billing, and this is on the order of a $100 billion per year
market worldwide.  Internet providers have been moving to a flat fee in 
order to minimize these costs, even though this creates the incentive for 
network resource overusage.  

A micropayments system assumes a solution to the billing problem.
If somebody could actually solve the this problem, rather 
than merely claiming to have solved it via some mysterious
means ("intelligent agents", et. al.), the savings would be 
enormous even in existing businesses such as long distance and
Internet service -- never mind all the new opportunities made
possible by micropayments.  

Nick Szabo
szabo at netcom.com
http://www.best.com/~szabo/





From reagle at mit.edu  Thu Jun  6 02:35:18 1996
From: reagle at mit.edu (Joseph M. Reagle Jr.)
Date: Thu, 6 Jun 1996 17:35:18 +0800
Subject: National Bank Brings Internet CyberCash To Canada 06/05/96
Message-ID: <9606052238.AA27259@rpcp.mit.edu>


>Date: Wed, 5 Jun 1996 17:18:39 -0400
>From: reagle at rpcp.mit.edu (Joseph M. Reagle Jr.)
>To: reagle at rpcp.mit.edu
>Subject: National Bank Brings Internet CyberCash To Canada 06/05/96
>
>
>                                         
>MONTREAL, QUEBEC, CANADA, 1996 JUN 5 (NB) -- The National Bank of  
>Canada, one of Canada's smaller chartered banks, has signed an 
>agreement with CyberCash Inc. (NASDAQ:CYCH) to bring the Reston, 
>Virginia-based company's Internet payment service to Canada. 
>
>CyberCash touts its payment service -- also called CyberCash -- as a  
>secure method of making payments over the Internet using a credit 
>card. 
>
>To use the system, a consumer first downloads software called the  
>CyberCash wallet from CyberCash's site on the World Wide Web 
>(http://www.cybercash.com ) or from a participating merchant's 
>site, said Melissa Walia, a spokeswoman for CyberCash. The free 
>software, installed on the user's PC, allows the customer to make 
>purchases via the Internet and have them charged to a credit card. 
>
>CyberCash supports major credit cards such as Visa, MasterCard,  
>American Express, and Discover, company officials said. Walia told 
>Newsbytes that Canadians who wish to use the service will not have 
>to be customers of the National Bank. The bank will work with 
>participating Canadian merchants to provide the CyberCash service. 
>
>The CyberCash Cash Register is the merchant piece of the  
>CyberCash system. It works on a merchant's server and receives 
>information necessary to process a credit card transaction. The 
>system is designed to work with an existing financial institution 
>infrastructure, officials said. 
>
>CyberCash said it is committed to supporting the Secure Electronic  
>Transaction (SET) standard for Internet credit-card transactions, 
>announced recently by Visa and MasterCard. The company claimed it 
>plans to be one of the first SET-compliant Internet payment services 
>available. 
>
>Neither Walia nor Bridget Limoges, a spokeswoman for the National  
>Bank, would say how many Canadian merchants have signed up to 
>use CyberCash at this point. However, Limoges told Newsbytes that 
>interest in the technology has been strong. 
>
>The CyberCash credit-card payment service, launched in the United  
>States in April, 1995, is expected to be available to Canadians 
>this summer, Limoges said. CyberCash also said it is working on 
>electronic check and coin services, expected to be released in 
>the second half of this year. 
>
>(Grant Buckler/19960605/Press Contact: Melissa Walia, Niehaus  
>Ryan Group for CyberCash, tel 415-615-7911, fax 415-615-7901, 
>Internet e-mail melissa at nrgpr.com; Bridget Limoges, National Bank 
>of Canada, 514-394-6494; Public Contact: CyberCash, Internet 
>e-mail info at cybercash.com) 
>                
>
>
_______________________
Regards,            Real generosity toward the future lies in giving 
                    all to the present. - Albert Camus
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From perry at piermont.com  Thu Jun  6 02:39:36 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 6 Jun 1996 17:39:36 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <9606052321.AA03525@Etna.ai.mit.edu>
Message-ID: <199606052352.TAA12965@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> As you know very well it's Dr.

My apologies. From now on I will refer to you solely as Dr. Phill
Hallam-Baker, PhD.

> and as you also know, signing a futures, options or any other type
> of contract is an open ended risk.

One doesn't "sign a futures" contract. The risk is also not always
open ended by any means. If I purchase 50 unleaded gasoline contracts,
my risk is strictly limited -- I cannot lose more than the value of
the gasoline, and that would only be if it became totally worthless
(an unlikely event). If I sell an uncovered contract, things are
different, of course. With options, if I buy puts or calls, again, my
risk is totally limited -- I cannot lose more than the cost of the
contracts.

> That is how the person purchasing the contract has the theoretcial
> possibility of unlimited reward.

Er, no.

You have potentially unlimited reward in ANY purchase, and limited
risk. If I buy a box of cornflakes and next week cornflakes suddenly
become worth $1,000,000 a box, well, I've experienced reward, but my
risk was at most the cost of the cornflakes.

> >Of course they know. There just isn't anything that can be done. There
> >is no proof. Its more or less as though one finds a man with gunpowder
> >stains on his hands, and a bullet embedded in the wall of his office
> >and human blood soaking the carpet. You can't prove that he killed
> >anyone. You can never get a conviction. But you can know.
> 
> Its called circumstantial evidence and it leads to a conviction provided the 
> name of the defendant isn't O.J. Simpson. 

No, it isn't. If there is no body and no one knows who you have shot,
the rules of Corpus Delecti pretty much dictate that you aren't going
to jail. You cannot be charged with the murder of unknown persons when
there isn't even any evidence of what happened (it could very well
have been someone being accidently injured while you were showing off
your gun collection and they might have done just fine). You don't
even have to say what happened -- you are under no obligation to
testify, you know.

Now, your neighbors will probably talk badly of you forever, but you
won't be convicted of anything.

> It would certainly be enough to arrange congressional hearings, subpoena half
> the Whitehouse staff and demand every document in sight.

What documents can they subpoena? All of Hillary Clintons documents
are available. It is known what she traded and when. Without a witness
who will say who did the bribing, or broker records showing the
counterparty who was doing the bribing, nothing can be done.

You seem to assume that every crime in existance can be
prosecuted. They can't. Hillary Clinton can claim to be the victim of
a very odd set of circumstances, which is effectively what she has
done, and we have no way to put her in jail.

That doesn't mean, however, that we have to believe her.

> Speculating in derivatives is not something I am particularly
> interested in, having seen the losses of some people in this
> building who got caught in the Netscape short squeeze I'm not
> particularly inclined to rush into that market.

Netscape options were not available at the time that the shorts got
hurt. Selling short is not a derivatives investment. You don't seem to
have much of a deep knowledge of these markets -- at the very least
you speak of them in a manner guaranteed to produce derision from
professionals.

> >Switching the tickets was the fraud. Taking bribes was also a crime. 
> 
> Perry, Perry, you are off at it again. You are making allegations you cannot 
> back up.

You are right. The human blood might have been from the blood bank,
and the bullet might have been an accident. Its fucking unlikely,
though.

> You have hypothesised that there were multiple tickets but have no 
> proof,

Correct. That is why Hillary Clinton and Bill Clinton aren't in
jail. However, court proof and proof good enough for me aren't the
same thing.

> All you can point to 
> is that a person with a net worth of several million

They had a considerably smaller net worth at the time.

Most of the Clinton's net worth appears to have come from dirty
political dealings over the years -- things like the Cattle Futures
bribe laundry, Rose Law Firm overbillings or dealings with the
Arkansas state government, etc. Not a shred of it can be proven in
court, of course.

> made a tidy profit speculating in cattle futures with the aid of
> some astute financial advice.

No one out there that I know of who does this for a living has ever
seen anyone make that much money in short term speculation that
way. George Soros, Paul Jones and all the rest would be envious of the
performance she had in the markets.

I don't know anyone who can articulate a theory of why the trades were
made when they were that comes from "astute thinking". They are
seemingly random. Thats probably because they WERE random.

> If you are to make such serious allegations against anyone you should be 
> prepared to back them up with something more than heresay and name
> calling.

As I've said, the evidence is compelling. It just isn't proof. Its
just like the bullet, the blood, and the powder burns on your
hands. No body and no missing person means no jail, but it doesn't
mean that one has to go about thinking what one is looking at is
perfectly innocent.

> Just because it might have been possible to conceal a bribe does not
> mean that you have evidence that a bribe was given.

If this was Richard Nixon no one would be questioning what the money
was.

I see no other explanation for what the money would have been. The
fact that her supposed advisor on these trades was the attorney for
Arkansas's most important company, Tyson Chicken, is a bit on the
suggestive side. Again, it is not proof, but proof isn't needed.

> It is not unusual for lawyers to dabble in speculation. It is also
> not unusual for clever lawyers to have friends who can give good
> advice.

If you can find anyone on earth who can give that good a bunch of
advice, please let me know. Several hedge fund managers I work with
would probably pay me for their name.

I don't know anyone who has EVER performed that well in the
markets. Its nearly impossible.

> Consider that anyone on cypherpunks might have made a tidy profit by
> realising that certain network ventures were likely to realize
> substantial profits for those dealing in the market. It dosen't take
> a genius to look at the rise Sun's stock price

Could you have made 100 to one on that in a couple of months, though?

Sure, its easy to make 20% or 30% on your money a year. Its hard, but
many people do it.

Making 10,000% in a few weeks is impossible.

> Oh come off it Perry, the Washington media do not need proof or even
> evidence to have a feeding fest.

They did for a while, but when it became obvious that the evidence was
not going to lead to the court room, it ended. Besides, most of the
media in Washington are registered Democrats. 89% of the Washington
press corps voted for Clinton from what I've read.

Your attitude seems to be "you can't prove anything so you must assume
that they are innocent." My attitude is "I can't prove anything so
they can't go to jail, but that doesn't mean I have to believe that
they are innocent -- in fact, I'm an idiot if I believe that."

> I think that given Perry's ad-hominem attacks and the fact that this
> has nothing to do with cryptography that its about time someone sent
> Perry a Perry-gram.

Cypherpunks no longer is a cryptography mailing list. Its a sewer.

Perry





From jimbell at pacifier.com  Thu Jun  6 03:00:01 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 6 Jun 1996 18:00:01 +0800
Subject: Markoff in NYT on NTT/RSA chip
Message-ID: <199606060356.UAA15845@mail.pacifier.com>


At 09:33 PM 6/5/96 -0000, nelson at crynwr.com wrote:
>David Lesher writes:
>
> > So Motorboatarola puts chips in the domestic MTSO's. 
> > For the international ones, they leave the chips out.
>
>Crypto hooks, or more properly, crypto pads. 

This raises a question:  If you provide a place for a crypto chip but don't 
install it, shouldn't you be able to export it?  But the software analogy, 
crypto hooks, the government is trying to restrict them.  This is why I 
think the latter interpretation is flawed:  Historically, the mere fact that 
a system can interface to another one that can do crypto can't be used to 
restrict it.

Jim Bell
jimbell at pacifier.com





From perry at piermont.com  Thu Jun  6 03:10:14 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 6 Jun 1996 18:10:14 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <9606052133.AA03411@Etna.ai.mit.edu>
Message-ID: <199606052149.RAA12809@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> Well why don't you do that and come back with the results eh? You have to 
> actually _talk_ to them for the knowledge to transfer Perry y' know.

I know the results. 99% of them laughed about the whole thing for
weeks. The poster caricature of Hillary Clinton with a crystal ball
and a thought ballon filled with cattle that I saw on one floor was
particularly amusing.

The thing was a universal joke. I never heard anyone who would be
nicer than to say the whole thing was extremely suspicious.

> You still don't understand, the $1000 is not the stake, it is merely
> the deposit. The stake is Hillary's entire net worth, that is what
> she is betting with.

Gee, Mr. Hallam-Baker, it seems your ignorance about what she was
trading (I believe you thought it was "options" before) also extends
to an ignorance about how the futures markets work or how securities
accounts work.

> Rubbish, thats only 25 contracts sold without a loss. Depending on
> the market one usually takes a profit when selling a contract. 

Making that kind of return in day trades in the cattle markets? You
out of your ever living mind?

Its not like there was even any basis for her trades that she could
articulate. Thats because the trades were made without any basis, in
matched pairs.

(By the way, learn what a contract is. A contract is not the same as a
trade. You are sounding thoroughly ridiculous.)

> These are not "one in a million trades" Perry, they are the sort of
> trade that one would expect to make in an underwritting capacity for
> a commodity market.

You ARE out of your ever living mind.

The average individual account holder at Refco "blows out" (that is,
loses their entire stake) within six months of opening their
account. Refco is one of the more reputable places to trade futures.

You are simply an ignoramous, talking totally outside your
league. Have you ever so much as bought a futures contract or an
options contract? Have you even ever opened a securities account?

> >I will state this for the record: Having examined the evidence, I
> >would say that even a non-expert who was reasonably informed about how
> >the futures markets work would have no choice but to conclude that
> >Hillary Clinton's trading pattern was impossible without some sort of
> >fraud being committed.
> 
> So you think that the Republican's in Washington haven't figured out
> what Perry Metzger has? 

Of course they know. There just isn't anything that can be done. There
is no proof. Its more or less as though one finds a man with gunpowder
stains on his hands, and a bullet embedded in the wall of his office
and human blood soaking the carpet. You can't prove that he killed
anyone. You can never get a conviction. But you can know.

Well, it was announced, and the media discussed it, and Hillary gave
her teary eyed press conference cynically wearing a matronly outfit,
and she gave her usual raft of "I cannot recalls" and "I don't
remembers" and given no additional evidence, the whole thing ended.

> Perry, its the crux of your case, you are claiming that Hilary
> committed fraud but you do not know whether the responsibility for
> covering the trades is on the broker or on the client.

The fraud was in the ticket switching, so it makes no difference that
the margin requirements were not made.

The other crime was, of course, bribery. However, without records or
information, there is no way to prove any of it. The mere fact that
all the records from the brokerage were mysteriously destroyed should
make you wonder.

> You are mouthing off that Hillary was illegally trading without
> putting up margin when you don't know whether or not that is a
> crime.
 
Switching the tickets was the fraud. Taking bribes was also a crime. I
have no concern as to whether the margin requirements issue was
criminal -- it was probably only a civil violation. In any case it
makes no difference -- there is more than enough crime here to go
around.

Perry





From dlv at bwalk.dm.com  Thu Jun  6 03:15:40 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Thu, 6 Jun 1996 18:15:40 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <199606050531.WAA27734@netcom7.netcom.com>
Message-ID: <m0L3oD10w165w@bwalk.dm.com>


frantz at netcom.com (Bill Frantz) writes:

> At  4:45 PM 6/4/96 -0400, Black Unicorn wrote:
> >"Morphing" seems to be the latest buzzword for putting childrens faces on
> >the bodies of adult models in sexually explicit poses and seems to have
> >attracted enough attention to warrant congressional attention.
>
> The ability to use the faces of famous political people (e.g. Bill&Hillery
> or Bob&Libby) in XXXX rated political satire probably has a wider market.

This is a cool idea - I wonder if there's an FTP site with X-rated doctored
pictures of the KKKlintons.  Would a morphed image of Chelsea performing
fellatio on Slick Billy be protected as political satire?

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From dlv at bwalk.dm.com  Thu Jun  6 03:28:10 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Thu, 6 Jun 1996 18:28:10 +0800
Subject: Fate of Ecash if RSA is cracked?
In-Reply-To: <m0uRIwy-0000AJC@ulf.mali.sub.org>
Message-ID: <6a33oD26w165w@bwalk.dm.com>


Bodo_Moeller at public.uni-hamburg.de (Bodo Moeller) writes:
> Of course, no quantum computing device that you could run those
> "programs" on does exist. But as Gilles Brassard puts it, "In my
> opinion, the theoretical notion of feasible computation should be
> modelled on our understanding of the physical world, not on our
> technological abilities. After all, the classical Turing machine
> itself is an idealization that cannot be built in practice even not
> taking account of the unbounded tape: any real implmentation of a
> Turing machine would have nonzero probability of making a mistake.
> Does this discredit the model? I think not." [2]
...
> [2] Gilles Brassard, A Quantum Jump in Computer Science (in: Computer
>     Science Today (Springer-Verlag LNCS 1000), 1995, pp. 1-14)

Note that Turing et al did their analysis of what's computable and what's
not computable on Turing machines and their equivalents before computers
were physically built.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From jfricker at vertexgroup.com  Thu Jun  6 04:02:28 1996
From: jfricker at vertexgroup.com (John F. Fricker)
Date: Thu, 6 Jun 1996 19:02:28 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <2.2.32.19960606004355.007038a0@vertexgroup.com>


Whois this Bell anyway? Hasn't he been communally kill filed yet??






From llurch at networking.stanford.edu  Thu Jun  6 04:05:34 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Thu, 6 Jun 1996 19:05:34 +0800
Subject: Terrorism Hysteria on the Net
In-Reply-To: <199606051227.MAA00334@pipe2.t2.usa.pipeline.com>
Message-ID: <Pine.GUL.3.93.960605173029.13793A-100000@Networking.Stanford.EDU>


On Wed, 5 Jun 1996, John Young wrote:

> Today's USA has a pair of front page stories: 
>  
> They lay out the nightmares and the valiant TLA-daydreams to out-fund the
> hackers and out-flummox the public. 
>  
>  
> "You bring me a select group of hackers and within 90 days I'll bring this
> country to its knees, " says Jim Settle, retired director of the FBI's
> computer crime squad. 

He says that as if it were a bad thing...

> "The threat is there, it's very real," says CIA General Counsel Jeffrey
> Smith. "If we have a Unabomber who decides to launch an attack with a PC
> instead of a bomb, (there could be) real damage." 

Actually, he's probably right. If all the cypherpunks, say, turned "bad,"
there'd be no government and no economy, because so many big systems are so
insecure.

Pooh-poohing the potential risk is not a winning proposition. Pointing out
that the government's policies against properly secure systems have created
this house of cards in which we live is. The NRC crypto report helps
legitimize this spin.

-rich






From markm at voicenet.com  Thu Jun  6 04:08:40 1996
From: markm at voicenet.com (Mark M.)
Date: Thu, 6 Jun 1996 19:08:40 +0800
Subject: Security of PGP if Secret Key Available?
In-Reply-To: <199606051033.MAA14983@internal-mail.systemics.com>
Message-ID: <Pine.LNX.3.93.960605161013.186C-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 5 Jun 1996, Gary Howland wrote:

> On Jun 3,  2:36, "Robert A. Hayden" wrote:
> > However, I got to wondering about the security of PGP assuming somebody
> > trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have
> > it on my personal computer, and somebody gets my secret key, how much
> > less robust has PGP just become, and what are appropriate and reasonable
> > steps to take to protect this weakness?
> 
> If the secret key is available then an attacker knows the length
> of p & q.  Admittedly this will not usually help matters much,
> but I still feel that the lengths of p and q should be encrypted
> with the passphrase - perhaps in PGP3.0? (Derek?)

I don't see how knowing the exact lengths of p and q will help matters much.
I don't think it will speed up the factoring time, and it won't make brute-
forcing the passphrase any easier.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMbXp97Zc+sv5siulAQFTBAQAjcfF5jh29RhTPokzfHbTEU+5aspywOPZ
C3V1Lvucf6rYPH3J8oo8o8qo8iUjWIHR3B6Xh/DllslfDmO+WnOceaz888gErnGz
X30prZ3Q6pue0WbrCk5S6++OMXux0+zzEcB5z5jcZb3wNLie8Qr2nnwyvM3ha1Gj
bx96KawqVEI=
=VSDw
-----END PGP SIGNATURE-----





From exalt at miworld.net  Thu Jun  6 04:37:05 1996
From: exalt at miworld.net (Intense)
Date: Thu, 6 Jun 1996 19:37:05 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.BSI.3.91.960605101735.23845C-100000@wichita.fn.net>
Message-ID: <Pine.LNX.3.91.960606012347.7402C-100000@invictor.miworld.net>


On Wed, 5 Jun 1996, Bruce M. wrote:

> On Tue, 4 Jun 1996, Black Unicorn wrote:
> 
> people in nude photographs consisted of a usually doctor administered 
> examination (of the picture) where the genitals and other age 
> characteristics of the BODY were taken into account.  I don't think a 
> person's face ever was, or ever should be, a factor.
> 
> > Silliness.  All silliness.
> 
> 	Very true.  Next there will be laws banning provocative pictures of
> adults dressed in child-like garb or acting out child-like sexual 
> fantasies (the infamous "spank me Daddy!).
> 

Urk anything that looks child-like, can be considered child porno.. 
again, it's a scarry thought that they govt. can prohibit someting that 
they deem to be "alike" in whatever way they feal....  :(


               *          <exalt at miworld.net>           *








From bruce at aracnet.com  Thu Jun  6 04:40:18 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Thu, 6 Jun 1996 19:40:18 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <2.2.32.19960606045507.006d9b24@mail.aracnet.com>


At 10:43 PM 6/5/96 -0400, Duncan Frissell wrote:

>Yeah and they busted Jack London for publishing "The Assassination Bureau,
Ltd".

Do I really have to point out that London was writing the better part of a
century ago, in a substantially different legal and cultural environment?
(Heck, his socialism made more trouble for him than anything else.)

>Advocating the general practice of killing one's opponents is as legal as
>church on a Sunday.  The War College (or is it the NDU these days) does it
>all the time.

And they, of course, are The Government, who Protect Us from the Evil
Terrorists. Ditto for the heroic BATF agents who only burn bad nasty
terrorists, honest. And all the rest.

The rest of us (in the US) live in a country where the government can now
pretty much declare anyone they like terrorists, and suspend habeus corpus
on the flimsiest of grounds, and use evidence against foreigners that
doesn't have to be presented to the accused, and all sorts of fun stuff.

Hence my concern.

I don't think that my direst claims _will_ come true. But I don't think I'm
speculating anything that _can't_ happen, and I see much of it as
increasingly likely in the light of the ongoing furor over crypto and
related matters.

--
Bruce Baugh
bruce at aracnet.com
http://www.aracnet.com/~bruce






From bruce at aracnet.com  Thu Jun  6 04:41:32 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Thu, 6 Jun 1996 19:41:32 +0800
Subject: Zimmerman/ViaCrypt?
Message-ID: <2.2.32.19960606052017.006e7d90@mail.aracnet.com>


Has there been any news recently about what's going on with commercial
versions of PGP? I've been toying with the idea of buying the Windows
version from ViaCrypt just to have a PGP that doesn't need to shell out to
DOS each time it runs, but I'm curious as to where, if anywhere, things seem
to be going.

--
Bruce Baugh
bruce at aracnet.com
http://www.aracnet.com/~bruce






From mccoy at communities.com  Thu Jun  6 04:45:43 1996
From: mccoy at communities.com (Jim McCoy)
Date: Thu, 6 Jun 1996 19:45:43 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <v02140b00addc39dee500@[205.162.51.35]>



Duncan wrote:
> At 10:41 PM 6/4/96 -0700, Bruce Baugh wrote:
> >I think there's a non-trivial chance that this list could be shut down and
> >anyone who's made interested sounds in the idea brought in to assist the
> >police in their inquiries.
>
> Yeah and they busted Jack London for publishing
>"The Assassination Bureau, Ltd".[...]
>
> Advocating the general practice of killing one's opponents is as legal as
> church on a Sunday.  The War College (or is it the NDU these days) does it
> all the time.

As long as that person is not the President of the United States (at least
for U.S. citizens.)  This was the issue which initiated this thread, the
implied threat made by our favorite nutcase.

jim







From exalt at miworld.net  Thu Jun  6 04:57:15 1996
From: exalt at miworld.net (Intense)
Date: Thu, 6 Jun 1996 19:57:15 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.BSI.3.91.960605101735.23845C-100000@wichita.fn.net>
Message-ID: <Pine.LNX.3.91.960606012308.7402B-100000@invictor.miworld.net>


On Wed, 5 Jun 1996, Bruce M. wrote:

> On Tue, 4 Jun 1996, Black Unicorn wrote:
> 
> > Hearings on the hill over the child pornographer horseman:
> > 
> > "Morphing" seems to be the latest buzzword for putting childrens faces on 
> > the bodies of adult models in sexually explicit poses and seems to have 
> > attracted enough attention to warrant congressional attention.
> > 
> > I'd like to see exactly how they word the proposed prohibitons.  What 
> > constitutes "child" when the face painted on is pure artistry?  Will we 
> > see a simple and strict prohibition over modifiying sexually explicit 
> > pictures to make them appear to be of younger models (whatever their 
> > apparent age may be)?  Will we see a subjective test as to what is "child 
> > looking" enough?
> 
> 	As far as I was aware, the manner of currently judging the age of 
> people in nude photographs consisted of a usually doctor administered 
> examination (of the picture) where the genitals and other age 
> characteristics of the BODY were taken into account.  I don't think a 
> person's face ever was, or ever should be, a factor.
> 
> > Silliness.  All silliness.
> 
> 	Very true.  Next there will be laws banning provocative pictures of
> adults dressed in child-like garb or acting out child-like sexual 
> fantasies (the infamous "spank me Daddy!).
> 
> 
>                     Bruce M. * brucem at feist.com
>         ~---------------------------------------------------~
>         "Knowledge enormous makes a god of me." -- John Keats
> 
> 
> 





From hallam at Etna.ai.mit.edu  Thu Jun  6 05:55:42 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Thu, 6 Jun 1996 20:55:42 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <199606052043.QAA12656@jekyll.piermont.com>
Message-ID: <9606052133.AA03412@Etna.ai.mit.edu>



>I live in New York, not Palo Alto. Guess who I work for. Hint: if I
>want to speak to a futures trader, most days I can walk down the hall.

Well why don't you do that and come back with the results eh? You have to 
actually _talk_ to them for the knowledge to transfer Perry y' know. It dosen't 
osmose into you just because you are frobbing the ethernet on some secretaries 
Mac while some merchant banker is making trades in the next office.


>I don't think you get it.

>Its one thing to put up $1000, make $4000, then put up the $5000 and
>make $10,000 with it, etc. Thats a situation where you are compounding
>your profits -- reinvesting them.

>Its another thing to put up $1000, make $4000, withdraw the $4000, put
>up $1000, make $4500, withdraw the $4500, etc.

You still don't understand, the $1000 is not the stake, it is merely the 
deposit. The stake is Hillary's entire net worth, that is what she is betting 
with.

Its not compound interest on a $1000 stake so $1000+ $4000 profit = $5000
stake, the stake is the $500,000 plus her house would fetch so each time
she takes a $4000 profit her stake barely increases. $500K + 4K is $504K, next 
time she can write a contract for $4040.



>This is not a case of someone making a profit and reinvesting it so
>that she got compound returns. This is a case of someone miraculously
>turning one in a million trades over and over and over again on the
>same tiny stake until she got $100,000.

Rubbish, thats only 25 contracts sold without a loss. Depending on
the market one usually takes a profit when selling a contract. 

These are not "one in a million trades" Perry, they are the sort of trade that 
one would expect to make in an underwritting capacity for a commodity market. 
Steady profits on contracts which generally pay off. 


>I will state this for the record: Having examined the evidence, I
>would say that even a non-expert who was reasonably informed about how
>the futures markets work would have no choice but to conclude that
>Hillary Clinton's trading pattern was impossible without some sort of
>fraud being committed.

So you think that the Republican's in Washington haven't figured out
what Perry Metzger has? 


>> Forgive me if I am wrong but are CFTC margin requirements not 
>> requirements placed on brokers as opposed to requirements brokers
>> must impose on customers?

>I must confess that I don't know, largely because its irrelevant, even
>in this case.

Perry, its the crux of your case, you are claiming that Hilary committed fraud 
but you do not know whether the responsibility for covering the trades is on the 
broker or on the client. You are mouthing off that Hillary was illegally trading 
without putting up margin when you don't know whether or not that is a crime. 


>We are not dealing with some idiot like Spiro T. Agnew here. We are
>talking about a pair of well educated, very smart and totally
>unscrupulous crooks -- Bill and Hillary Clinton. There is no evidence
>that you can pin on them in court.

Perry, before you go off into what you would like to believe consider your last 
sentence. You admit that there is no evidence, you also fail to understand what 
is understand in selling contracts.

As a media meme this one had legs in the same manner as the Borda medals affair. 
There is no reason to believe that Borda was wearing the valour pins in bad 
faith, the rules on the matter were vague. Depending on which version of the 
manual you believe you could say it was right or you could say it was wrong. No 
indication of an act of bad faith. But take a decorated combat vet who is wazzed 
off about being jacked out of the army and the Washington press we know what the 
result would be. Regardless of whether it was or was not an act of bad faith the 
press prefer the bad faith story. 

I don't know any other country which treats it politicians in the same way as 
the US does. I have friends in both parties who have left the Washington 
political scene because they don't think the game is worth the candle. 


		Phill





From yusuf921 at uidaho.edu  Thu Jun  6 06:01:47 1996
From: yusuf921 at uidaho.edu (Syed Yusuf)
Date: Thu, 6 Jun 1996 21:01:47 +0800
Subject: Phill in Zychik Chronicle
In-Reply-To: <Pine.SUN.3.91.960605162420.7279B-100000@polaris>
Message-ID: <Pine.HPP.3.93.960605232630.21102A-100000@buzzard.csrv.uidaho.edu>




Zychik Chronicle is a free  electonic publication, it's recommended
by my Libritarian/Chryto-Anarchal Capiltalist friends.


---fowarded message

---------------World Trade & Liberty:

(CyberWire Dispatch June 3rd, brock at well.com for a free subscription) 
Brook Meeks the author of CyberWire calls it a "virtual nuke hurled into
the arcane subculture of encryption technology." So let's go back to the
days before the virtual nuke. 

The father of encryption technology for most of us layman is Phil
Zimmerman, the author of PGP. Essentially, Phil's PGP (Pretty Good
Privacy) allows you to use encryption technology that the government would
have to spend too much time and too much money to bust every message you
sent. Phil's profit on PGP was zero. He offered it for free. The
government, always willing to let no good deed go unpunished, spent the
last 4 years threatening to put Phil in jail for exporting sensitive
technology. Phil didn't export a thing.  Someone - not Phil - loaded PGP
on the net, and lo and behold, the net being a global village, PGP toured
the village. After harassing Phil for four years, the gov't dropped its
case - in large part due to the financial and legal support Phil got from
those evil perverts called Netizens, Net Surfers, Hackers, Cypherpunks,
Electronic Freedom Foundation, Libertarians and other various forms of
traitorous electronic scum. I know his defense fund got a check from me
and my wife. 

Anyway, the government started feeling threatened by hordes of Pagans who
don't worship at the alter called Congress. So it offered us peanut-brains
the Clipper chip. Oops, make that KKKlipper chip. The idea behind the
KKKlipp-your-liberties-chip was that you could have all the privacy you
wanted by using the gov't chip, as long as the gov't had the "key" to
unlock your code. Duh, I don't know why all of us peanut brains didn't
line up to get that chip? What's the matter with Americans? Don't they
know a good deal when they see one. 

So, just to get even with us peanut-brains,
Bill-if-I-can't-look-up-your-skirt-
then-I'm-going-to-spy-on-your-motherboard-Clinton set up rules which
basically made it impossible for the US to compete in the "robust
encryption technologies [field], at a possible loss of $60 billion for US
companies."

Well, for some strange reason one of us peanut-brained Pagans, one of us
low life Hackers, one of us Netizen pond scum smelled buckies. His name is
Jim Bizdos. He's president of RSA. What RSA did was to hook up with some
of those funny speaking, slant-eyed, yellow people called Japanese
scuzzballs. Yup, Jim & the Japs came out with a "monster chipset capable
of scrambling voice and data real time with a 'key length' of up to 1024
bits." 

The operative term here is key length. The longer the key, the better the
encryption. US law says US companies can't export a key length greater
than 40 bits. Now here's the catch: Jim-unAmerican-greedy-guy and them
Thieving-low-down-Japs ain't exporting nutin'. They made the stuff in
Yellow- Peril Country. You know, Japan! Gosh, my fingers shook as wrote
that Jap word. 

Besides being attacked by the Japs, look out for the Limeys (Brits) and
the Frogs (The French). Dem folx is also developing encryption technology
that will put a child molester in every American home, a Republican in
every American trash can and a Democrat in every US toilet. 

Phil Zimmerman was the pioneer, but as Brock Meeks says, PGP is "tough to
use." The RSA chip set works in real time! It scrambles voice *and* data. 

15 low-down-degenerate-self-indulgent-uncaring-countries "have already
placed orders for these chips." Japanese law forbids building chips that
have what's called "an escrow function." An escrow function means the
gov't gets a key to your code.

In other words those damned Japs are attacking us again by making it a
legal requirement that your privacy and mine be protected. Damn, we should
have bombed on the whole country when we had the chance. Hey, tell you
what, after the FBI blows Justus to hell and back, let's send the Federal
Bloodletters and Incinerator-crew after the Yellow People. 

Yup, we don't no world trade. It's a threat to our pure KKKulture. World
trade is also a threat to jobs. If the Gestapo can't listen in on your
phone calls and decode your e-mail what are all those poor little FBI,
BATF, sheriffs, and local cops going to do? 

Comment: We're entering a period of world trade in which any government
that limits the liberties of its citizens will be punished in the market
place by competing governments. The fun has just begun.


Joe Zychik
Editor, The Zychik Chronicle

-------
Posted daily Mon-Fri after 3 pm PST at
http://www.pacificnet.net/~jzychik
To receive the ZC, free, contact:
jzychik at pacificnet.net







From bruce at aracnet.com  Thu Jun  6 06:42:49 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Thu, 6 Jun 1996 21:42:49 +0800
Subject: whitehouse web incident, viva la web revolution
Message-ID: <2.2.32.19960606051847.006e9b18@mail.aracnet.com>


At 01:17 PM 6/5/96 -0400, Hallam-Baker wrote:

>rather than reasoned argument. His dislike for the Clinton is 
>well known - he recently accused the administration of being
>fascist. I know of no evidence that the Clinton administration
>has a genocide policy, it is an insult to the 10 million civilians
>murdered by Hitler to use the term facist simply as a term of abuse,
>especialy if it is being used as a substitute for an argument.

Fascism has no intrinsic link to genocide. It is a theory of economics,
basically, in which the state has ultimate authority over production and
distribution without (as in socialism) actually _owning_ the means of
production or distribution. This is generally accomplished through
cartelization, the creatin of industry-wide councils in which the
representatives of the most powerful firms set policy in conjunction with
the representatives of the government.

The US has been at least moderately fascist since the 1920s (Hoover was a
big fan of cartelization, and pushed it actively). While the mechanisms of
the modern regulatory state aren't those of classic fascist theory, in
practice most strongly regulated industries in this country operate
_exactly_ the way fascist theory says they should.

And various of Clinton's policies have, in fact, been fascist in this sense.
The man has no doctrinal commitment to fascism (under that name or any
other), but in practical terms virtually all modern Western politics are
either fascist or socialist.

None of this is secret lore, by the way.

--
Bruce Baugh
bruce at aracnet.com
http://www.aracnet.com/~bruce






From gnu at toad.com  Thu Jun  6 06:43:05 1996
From: gnu at toad.com (John Gilmore)
Date: Thu, 6 Jun 1996 21:43:05 +0800
Subject: Triple-DES chip idea: built-in 1DES-cracker
Message-ID: <199606060750.AAA06399@toad.com>


It just occurred to me that companies which are designing Triple-DES
chips should spend a small chunk of their chip area and design time
on building in features for fast single-DES key search.

As in Matt Wiener's design, this would include logic to generate a
sequence of trial keys, and a circuit to evaluate the likelihood that
the trial key was "interesting" after examining the trial plaintext.
All of this logic would be on-chip and isolated from the pins of the
chip, so it could run at high speed without any impact on the rest of
the system.

Then, as these chips are deployed into consumer boards or
motherboards, a small amount of software plus the Internet will make
distributed DES cracking feasible.  Whenever the chip wasn't busy
doing some "real work" encoding data for the user, it would be
spinning its wheels cracking a DES key for fun or profit.

There are lots of interesting ways to build the comparison circuitry
to examine the trial plaintext.  The cheapest is to provide a single
64-bit register with the desired plaintext; that's what Matt's design
did.  Another cheap way would be to provide two 64-bit registers: a
mask and a value.  AND with the mask and compare to the value; it's
interesting if equal.  A second and/or third set of mask and value
registers (and another ciphertext register) would permit the test to
be across 16 or 24 bytes of ciphertext/plaintext rather than just 8.
This would be useful if e.g. your mask is only looking to see that the
high order bit of each byte is off in the ciphertext (indicating a
probability of ASCII text).  8-byte comparison would give you a
false-hit every 256 keys; 16-byte comparison would reduce that to one
every 65,536 keys.

Matt's chips froze when they got a match.  A FIFO on the comparison
output would let the chip continue to spin, looking for more matches,
before software got around to reading the results of a previous hit.
This would permit the chip to do DES-cracking in polled mode, without
using interrupts.  If the DES-cracking control registers were all
disjoint from the ordinary DES operational registers, the DES-cracking
could be initiated at any time, independent of the chip's encryption
functions, and could then be checked-up on periodically, again without
impacting the chip's normal functioning.  As an extreme example, it
could be started at system boot time, and checked only at system
shutdown for hits.

If you wanted to get truly fancy, the comparison should have eight
256-bit vectors, one per byte of plaintext.  Each vector is indexed by
the byte of plaintext, producing a single bit.  If it's 1, that byte
has an interesting value.  So if you set only the bits corresponding
to ASCII uppercase letters, then only a plaintext ASCII uppercase
letter is interesting.  So, the eight trial-plaintext bytes produce
eight bits, one from each vector.  Mash those together, and use this
8-bit value as an index to a ninth bit vector, which would let you
specify which combinations of "interesting" plaintext bytes are truly
interesting enough to stop the chip for.  E.g. if you insist that all
of the ciphertext bytes are ASCII uppercase letters, then all the
eight bit-vectors will be set up the same, and this ninth bit vector
will have a single 1-bit at index 11111111 (all bytes match).  If on
the other hand, any six out of the eight being uppercase is good
enough for you, you'd put a bunch of 1-bits into the ninth vector (one
for each possible way that six of the eight would match, such as
11010111 and 00111111 and 01111110).  In nine 256-bit vectors (less
than 300 bytes of on-chip storage), you could specify truly complex
and useful conditions like "First two bytes of plaintext equals
0x2C07, next three bytes are uppercase ASCII, next byte is a
don't-care, following byte is an ASCII digit".  This would be great
for matching up packet headers or partial plaintext, when looking for
the key to encrypted network traffic.  However, even these days,
adding 300 bytes of static storage to a 3DES chip for this kind of
ancillary function doesn't seem likely, until the market for
DES-cracker boxes matures.  (Each such box tends to consume large
numbers of DES chips, making them an attractive target market for a
chip vendor.)

But some of the simpler des-cracker assists I mentioned should be easy
to implement with only a few dozen bytes of static storage, some small
circuits and maybe one more address pin, making them suitable for
mass-market chips for PC's and such.

	John Gilmore, gnu at toad.com

PS:  Note that this feature would not affect the exportability of your
chip, which was already nil.  Design and build it overseas.





From frantz at netcom.com  Thu Jun  6 06:49:59 1996
From: frantz at netcom.com (Bill Frantz)
Date: Thu, 6 Jun 1996 21:49:59 +0800
Subject: Micropayments: myth?
Message-ID: <199606060708.AAA12312@netcom7.netcom.com>


At  7:57 PM 6/5/96 -0700, Nick Szabo wrote:
>Some electronic commerce projects promise dramatically lower transaction
>costs, so that we can achieve "micropayments", "microintermediation",
>and so forth.  Is this achievable?  
>
>Consider a feature fairly independent of the particular payment system: 
>the statement of charges.  Here lies a tradeoff here between completeness 
>and complexity.   On the one hand, merely summarizing charges creates 
>the opportunity for salami frauds, allowing widely distributed false or 
>exaggerated microcharges to go undetected.  Furthermore, parties reading 
>only the summaries get no feedback by which they can adjust their behavior
>to minimize costs.  On the other hand, a statement too complex to
>be easily read also allows fraud, error, and inefficient usage to 
>go unrecognized, because one or both parties cannot understand the 
>rationale for the charges in relation to the presumed agreement on
>terms of service and payment. 

This is, of course, an opportunity for agents (programmed, or two legged)
to use their superior knowledge of the service/technology/business to
optimize service for ordinary people.

>
>There seems to lie here a fundamental cognitive bottleneck, creating a
>limit to the granularity of billable transaction size whether electronic
>or physical.  One proposed solution to this has been "intelligent 
>agents".  But since these agents are programmed remotely, not by the 
>consumer, it is difficult for the consumer to determine whether the agent
>is acting the consumers' best interests, or in the best interests
>of the counterparty -- perhaps, necessarily, at least as difficult 
>as reading the corresponding full statement of charges.   By
>sleight of hand we may have merely transformed the language of 
>the transaction as it needs to be understood by the party, without
>reducing the complexity to be understood.  Furthermore, the user 
>interface to enable consumers to simply express their sophisticated 
>preferences to an agent is lacking, and may represent another fundamental 
>cognitive bottleneck.

I think that agent providers would gain reputations.  Many consumers might
trust an agent from Consumer's Union for example.  If there end up being
only a few types of agent, then I would expect to see an "arms race"
between charging systems and agents.  The providers would try to devise
charges which maximize their profit, while the agents would try to get the
best combination of service and cost for their users.  This race would be
similar to the situation we see in the telephone industry, with its
continuously changing "special long distance deals".

I assume any user interface will be in terms of the user's interests. 
Since these interests will change over time as the environment and user's
knowledge change, the UI will be a hard problem.  However, the UI will be
another factor in the user's agent selection process. 

>
>Telephone companies have found billing to be a major bottleneck.
>By some estimates, up to 50% of the costs of a long distance call
>are for billing, and this is on the order of a $100 billion per year
>market worldwide.  Internet providers have been moving to a flat fee in 
>order to minimize these costs, even though this creates the incentive for 
>network resource overusage.  

With the current low speed dialup connections, the savings on billing costs
are probably greater than the costs of bandwidth "over use".
>
>A micropayments system assumes a solution to the billing problem.
>If somebody could actually solve the this problem, rather 
>than merely claiming to have solved it via some mysterious
>means ("intelligent agents", et. al.), the savings would be 
>enormous even in existing businesses such as long distance and
>Internet service -- never mind all the new opportunities made
>possible by micropayments.  

Even a cash based payment system will have costs.  The lowest cost IP
payment system I know of, Norm Hardy's Digital Silk Road, has the cost of
increasing the complexity of the IP routers.  There is no free lunch here. 
Whether you call it accounting, billing, or micropayment; it is an
additional function which must be performed by a piece of code with
stringent performance requirements.

Regards - Bill


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From jimbell at pacifier.com  Thu Jun  6 23:33:51 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 6 Jun 1996 23:33:51 -0700 (PDT)
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <199606070633.XAA01053@mail.pacifier.com>


At 07:54 PM 6/6/96 -0700, Timothy C. May wrote:

>However, recall that Senator Jesse Helms elliptically threatened President
>Clinton by saying that Clinton had probably better be wearing a
>bullet-proof vest if he ever visited Helms' part of the country. (Even the
>Republicans were shocked by this, and, I surmise, cast Helms into the outer
>darkness, as Helms has been keeping a low profile for the past 18 months.)

However, Helms is a politician and he's supposed to be on his best behavior. 
 (What Helms' "best behavior" is, is certainly debateable.)


>* Third, while I am bored with Bell's "single note" point of view ("I have
>a solution for this")

Bored?  You're bored?  Maybe I'm going to have to figure out something to 
spice it up, huh?  By the time everybody is as bored as you are today, then 
I will have won.

>and while I feel his "assassination politics" is both naive

"naive"?  In what way?


> and derivative,

Technically, it wasn't derived from anything directly, or for that matter 
even indirectly.  However, since there's nothing new under the sun, 
similarities exist...with your material as well.  Consider this a bow to 
you, I suppose.

> I don't think his advocacy of AP constitutes a direct threat to anyone. 

Even so, given how much noise we've been hearing out of DC on the subject 
of the Internet, digital cash, and good encryption, I'd say SOMEBODY is 
getting a bit worried.  I haven't exactly been keeping this stuff a secret:  
What do you think their reaction has been, so far?  When those 
government-types start considering various scary scenarios, what do you 
think they are imagining?

>He is not actually setting up the betting markets which
>would make AP more of a reality, 

Not quite yet, anyway.  I'm very disappointed to have waited over a year for 
some slick lawyer to show me how I'd be violating some law or another to do so.

>nor is he calling for the killing of any particilar persons.

I generally don't feel the need to name specific people.  I'm sure each 
reader has his own pet list to fall back on.


>* Fourth, merely discussing alternative political systems is not enough to
>trigger legal action, at least not today.

Wait a year or two.

Jim Bell
jimbell at pacifier.com





From jimbell at pacifier.com  Thu Jun  6 08:37:54 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 6 Jun 1996 23:37:54 +0800
Subject: is the list active??
Message-ID: <199606061023.DAA01890@mail.pacifier.com>


At 09:36 PM 6/5/96 -0500, Syl Miniter wrote:
>I recently re-subscribed --several days ago and have not received any
>traffic???
>I am wondering if the list is still active as I checked and I am subscribednso
>I am sending this note to this list to test if anyone is out there


There are many dozen messages per day on CP.  


Jim Bell
jimbell at pacifier.com





From unicorn at schloss.li  Thu Jun  6 09:21:16 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Fri, 7 Jun 1996 00:21:16 +0800
Subject: Terrorism Hysteria on the Net
In-Reply-To: <Pine.GUL.3.93.960605173029.13793A-100000@Networking.Stanford.EDU>
Message-ID: <Pine.SUN.3.91.960606030456.7919A-100000@polaris>


On Wed, 5 Jun 1996, Rich Graves wrote:

> On Wed, 5 Jun 1996, John Young wrote:
> 
> > Today's USA has a pair of front page stories: 
> >  
> > They lay out the nightmares and the valiant TLA-daydreams to out-fund the
> > hackers and out-flummox the public. 
> >  
> >  
> > "You bring me a select group of hackers and within 90 days I'll bring this
> > country to its knees, " says Jim Settle, retired director of the FBI's
> > computer crime squad. 
> 
> He says that as if it were a bad thing...
> 
> > "The threat is there, it's very real," says CIA General Counsel Jeffrey
> > Smith. "If we have a Unabomber who decides to launch an attack with a PC
> > instead of a bomb, (there could be) real damage." 
> 
> Actually, he's probably right. If all the cypherpunks, say, turned "bad,"
> there'd be no government and no economy, because so many big systems are so
> insecure.

One could make the case that this would actually make the United States 
(if c'punks concentrated their attentions there) the most data secure 
country on the planet over time.


---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From frissell at panix.com  Thu Jun  6 12:52:25 1996
From: frissell at panix.com (Duncan Frissell)
Date: Fri, 7 Jun 1996 03:52:25 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <2.2.32.19960606105442.00a0ef34@panix.com>


At 09:55 PM 6/5/96 -0700, Bruce Baugh wrote:

>Do I really have to point out that London was writing the better part of a
>century ago, in a substantially different legal and cultural environment?
>(Heck, his socialism made more trouble for him than anything else.)

It was more restrictive in censorship terms than our current environment.

>>Advocating the general practice of killing one's opponents is as legal as
>>church on a Sunday.  The War College (or is it the NDU these days) does it
>>all the time.
>
>And they, of course, are The Government, who Protect Us from the Evil
>Terrorists. Ditto for the heroic BATF agents who only burn bad nasty
>terrorists, honest. And all the rest.

But I can advocate killing commies too.  It's like when this dumb California
(State) Senator advocated outlawing groups that advocate violence back in
1980 or so, I pointed out that the Public Schools and the Army were then
doomed since both of these groups "advocate violence."  Obviously the
California State Senate "advocates violence" as well in the enforcement of
laws.  

Military types even plan war against friends.  The War Department developed
Plan Red in the '20s for a war with the British Empire.  Called for an
amphibious assault on Halifax and a tank assault via Buffalo to secure
Toronto as part of a conquest of Canada.  

Note too that under the Nurenberg principles, I may be legally compelled (or
legally permitted) to kill my superior officers or government leaders if
they are committing war crimes.  And even the Sainted Ronald Reagan and his
government was convicted of war crimes by the International Court of Justice
for mining the harbor that serves Managua, Nicaragua.  (Air-sown mines.)
'War Crimes' are vague, meaningless, and ex post facto and thus justify
quite a lot of enforcement actions in theory (which is why Senator Robert A.
Taft opposed US participation in the Nurenberg trials.

"Yes, your honor, I'd like to pay taxes and everything but I'm afraid that I
might risk conviction at future war crimes trials of aiding and abetting the
criminal acts of my government." -- From 101 Flaky Anti Tax Arguments (which
may become a web site if I can teach myself forms.

>The rest of us (in the US) live in a country where the government can now
>pretty much declare anyone they like terrorists,

Just foreigners and such designation just affects fundraising.  (I've often
wondered why Hamas uses/used couriers for getting funds to Israel when
Israel has a great ATM network with international links.)

>and suspend habeus corpus on the flimsiest of grounds, 

The Anti Terrorism bill doesn't suspend Habeas Corpus it restricts mandatory
federal court review of state convictions to one try.  One can still submit
an unlimited number of Petitions for Writ of Habeas Corpus and any state or
federal court that wants to can grant one of them just as before.

>and use evidence against foreigners that doesn't have to be presented to
the accused,

In deportation proceedings.  And then they'll have to go to all the trouble
of turning around and coming back like the other million illegal entrants a
year.

DCF






From A5113643667 at attpls.net  Thu Jun  6 13:50:30 1996
From: A5113643667 at attpls.net (Tom Jones)
Date: Fri, 7 Jun 1996 04:50:30 +0800
Subject: Norton Eyes only
Message-ID: <8BBE097C>


Dear Cypherpunks,

Has anyone been able to analyse the 'patent pending', 'on-the-fly'
encryption in Norton's 'For your eyes only'?

Peace.. Tom





From gary at systemics.com  Thu Jun  6 15:22:16 1996
From: gary at systemics.com (Gary Howland)
Date: Fri, 7 Jun 1996 06:22:16 +0800
Subject: Security of PGP if Secret Key Available?
In-Reply-To: <Pine.LNX.3.93.960605161013.186C-100000@gak>
Message-ID: <31B6C91D.28D95ABC@systemics.com>


Mark M. wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On Wed, 5 Jun 1996, Gary Howland wrote:
> 
> > On Jun 3,  2:36, "Robert A. Hayden" wrote:
> > > However, I got to wondering about the security of PGP assuming somebody
> > > trying to read my PGPed stuff has my 1024-bit secret key.  ie, if I have
> > > it on my personal computer, and somebody gets my secret key, how much
> > > less robust has PGP just become, and what are appropriate and reasonable
> > > steps to take to protect this weakness?
> >
> > If the secret key is available then an attacker knows the length
> > of p & q.  Admittedly this will not usually help matters much,
> > but I still feel that the lengths of p and q should be encrypted
> > with the passphrase - perhaps in PGP3.0? (Derek?)
> 
> I don't see how knowing the exact lengths of p and q will help matters much.

That's what I said.  There are however a few cases where it may help.
Two that spring to mind are the brute force factoring of the
BlackNet key - this may have been faster if half of the potential
factors could have been ignored due to wrong key lengths (although I
suspect this depends upon the factoring algorithm), and the other
is that of identifying low quality keys with a small factor (perhaps
generated by low quality software).

> I don't think it will speed up the factoring time

Again, I would say this depends upon the factoring algorithm.

Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06





From jya at pipeline.com  Thu Jun  6 17:50:00 1996
From: jya at pipeline.com (John Young)
Date: Fri, 7 Jun 1996 08:50:00 +0800
Subject: FTC_spy
Message-ID: <199606061230.MAA16373@pipe2.t1.usa.pipeline.com>


   6-5-96. WaPo and NYP: 
 
   "Curbs on Cyberspace Ads Proposed." (WaPo) 
 
      Should spam be jammed and cookies be crumbled on the 
      Internet? Technologies with these gustatory short-hand 
      names are at the heart of industry, consumer and 
      government debate over privacy in cyberspace. The 
      Federal Trade Commission brought together major Internet 
      players for a two-day workshop examining the handling of 
      personal consumer information on the Internet, including 
      the practice of using "cookies." 
 
      "Privacy is somewhat of a snake ... but a snake can be 
      an opportunity," said Peter Harter, public policy 
      counsel for Netscape. 
 
   "Voluntary Rules Are Proposed For the Privacy of Internet 
   Users." (NYP) 
 
      But the proposal, made at a Federal Trade Commission 
      hearing on personal privacy in the information age, drew 
      fire from civil liberties groups and others concerned 
      over privacy issues. They argued that self-policing by 
      the industry would not restrain on-line abuses that they 
      said already range from surreptitious monitoring of 
      activities on the Internet to the illegal sale of 
      personal credit histories over the Internet. 
 
 
   FTC_pry 
 
 
 





From declan at well.com  Thu Jun  6 19:34:13 1996
From: declan at well.com (Declan McCullagh)
Date: Fri, 7 Jun 1996 10:34:13 +0800
Subject: NDcrypt available for Newtons
Message-ID: <Pine.3.89.9606060717.A8573-0100000@well>




---------- Forwarded message ----------
Date: Wed, 5 Jun 1996 22:49:26 -0700
From: Tom Collins <tom at newts.com>
To: declan at well.com
Subject: Revisiting an old subject...

** ENCRYPTION TOOL NOW NEWTON 2.0 SAVVY **

Geert Jadoul <76271.2121 at CompuServe.COM> reports that he has finally
finished a Newton 2.0 savvy version of NDcrypt.

NDcrypt 2.0 Light is an improved version of NDcrypt v1.6.  It has become
a US$15 shareware utility with a trial period of 4 weeks.  After 4 weeks the
"Encrypt" and "UnReadable" buttons will disappear until you fill in the
registration code in the preferences window.  You will still be able
after 4 weeks to "Decrypt" notes or make them "Readable" again, so you
will not lose any data.

The name "NDcrypt 2.0 Light" also infers that Geert is working on a
NDcrypt 2.0 Pro version.  This version will have better incorporation of
NDcrypt in the system; overview and search functions; and viewing Notes
(decrypt a Note to view it but keep it encrypted in the Notes app).

NDcrypt 2.0 Light is available at <ftp://newton.uiowa.edu/submissions>
with the name "NDcry2Li.sit" and on Compuserve <GO NEWTON> under "NOS
2.0 ONLY".

      Tom Collins|Innovative Computer Solutions| <http://www.newts.com/>
    tom at newts.com| 1075 North Miller Rd., #142 |  <ftp://ftp.newts.com/>
pagetom at newts.com|  Scottsdale, Arizona 85257  |<phone://(602)970-1032/>








From adam at homeport.org  Thu Jun  6 20:12:20 1996
From: adam at homeport.org (Adam Shostack)
Date: Fri, 7 Jun 1996 11:12:20 +0800
Subject: Norton Eyes only
In-Reply-To: <8BBE097C>
Message-ID: <199606061700.MAA04547@homeport.org>


Tom Jones wrote:

| Has anyone been able to analyse the 'patent pending', 'on-the-fly'
| encryption in Norton's 'For your eyes only'?

Look for the export control warnings.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From adam at homeport.org  Thu Jun  6 20:14:33 1996
From: adam at homeport.org (Adam Shostack)
Date: Fri, 7 Jun 1996 11:14:33 +0800
Subject: USA on Feds Cyberteam
In-Reply-To: <Pine.SV4.3.91.960605221206.22400H-100000@larry.infi.net>
Message-ID: <199606061707.MAA04567@homeport.org>


	Don't be silly.  The government will just have two groups
doing the same job.  If we're lucky, we'll get a third set of
identical advisories, one from CERT, one from KAYAK, and one from this
new group.

"Your tax dollars at work."

Adam


Alan Horowitz wrote:
| 
| 
| Guess this puts that Carnagie Mellon-based outfit ("Computer Emergency 
| Response Team"?) off the govt contract teat.
| 
| Or maybe they will continue to doa all the trenchwork under contract, but 
| people high up enough in the DC feeding chain to have their own PR 
| appendage, will take the credit?
| 


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From bruce at aracnet.com  Thu Jun  6 20:37:02 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Fri, 7 Jun 1996 11:37:02 +0800
Subject: Kook of the Month
Message-ID: <2.2.32.19960606160108.006c4794@mail.aracnet.com>


Cypherpunks don't just write code, they engage in petty vote fraud!

=-=-=-=-=

From: mlegare at wetware.com (M. Legare, etc.)
Newsgroups: alt.usenet.kooks,news.admin.net-abuse.misc
Subject: KotM Winners for May 1996 - SOMEONE'S miffed!
Date: 3 Jun 1996 16:05:12 GMT
Organization: Castle Wetware's Western Keep
Lines: 112
Message-ID: <4ov2fo$1mm at numbers.wetware.com>
NNTP-Posting-Host: news.wetware.com
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Well... it's June and here we go with the Winners for May - at least I'm 
more on-schedule than I was for April...

KOOK OF THE MONTH MAY 1996 - DMITRI VULIS (dlv at bwalk.dm.com)

In one of the most HOTLY contested KotM races in the history of the award
under my watch, Dmitri Vilus NARROWLY edged out vote taker Dave C (tale)
Lawrence in a race that was right down to the wire.

Let's recap:  Dmitri Vulis nominated tale for KotM because tale was involved
in a "conspiracy of thousands" to send out "forged rmgroup" messages for 
a newsgroup that Dmitri wanted to create.  Dmitri then posted evidence of 
somewhat dunious validity, and someone nominated Dmitri.

And the votes started pouring in.  Some from congress.gov, some from 
algebra.com, some from bwalk.dm.com... hundreds of votes.

Well, after an initial surge ahead by the tale backers, a DELUGE of email 
backing Vulis for KotM poured in, and, since I had to assume that ALL 
votes were valid (as Dmitri kept forging posts to misc.test in my name
to show his displeasure at my INSINUATING that he might have forged any 
votes), Dmitri won by a narrow 30 vote margin!

Vote Count:

Dmitri Vulis - 428 votes
David C Lawrence (tale) - 398 votes
Ed McClosky - 18 votes
Yehuda Silver - 9 votes
Bill Palmer - 4 votes
ellisd at netcom.com - 4 votes
Mr SAM - 2 votes
None of the Above - 3 votes
George Conklin - 1 vote
Rachel Ewing-Pace - 0 votes
smokindude at aol.com - 0 votes


Clueless Newbie of the Month for May 1996 - MARGE KRICK 

Marge won in a less vopulumnous but just as hotly contested race.  As you may
know, Marge is offering a list of ALL USNET NEWSGROUPS for a very reasonable
price - JUST the thing we need, unless you know how to look at your
..newsrc file.

Oops.

Vote Count:
Marge Krick - 12 votes
Bill Byers - 11 votes
Brian Dear - 7 votes
John Turco - 7 votes
None of the Above - 5 votes


Hook Line & Sinker for May 1996 - NONE OF THE ABOVE


Apparently, Charles "Chuckie Monster" Newman didn't impress enough people.
Sorry, Charlie.

Vote Count: 

None of the Above - 19 votes
Charles "Chuckie Monster" Newman - 9 votes


The Victor Von Frankenstein Memorial "Wierd Science" Award - THE USA PARLIAMENT

Brainchild of politial mover and reformer James Ogle (joogle at netcom.com),
the USA PAR is the ONLY "fair" and truly representative governing body in 
the US.  Plan?  Scheme? Deluded ravings?  Well, several members of the 
USA PAR (who also post to alt.politics.greens) have voted to disband the 
USA PAR, to replace James Ogle as secretary, and a few dozen other self-
destructive things, yet the ballots just keep rolling out...


Vote Count:

USA PAR - 19 votes
Joly*s 4-Dimensional Speakers - 6 votes
the Music Theory of Alber Silverman -  4 votes
Church of Scientology (write-in) -  4 votes
None of the Above - 15 Votes



THE GOLDEN KILLFILE - DR. JAI MAHRAJ

I'm not gonna explain, because if you don't know, you're better off.
Check soc.culture.hawaiian and a few thousan related newsgroups.

Vote Count:

Jai Mahraj - 30 votes
None of the Above - 13 votes
the alt.religion.scientology spammer (write-in): 1 
LAW DOCTOR JOHN GRUBOR  (write-in): 1
Ted Holden (write-in): 1

OK. That's it for May.  Nominees go to alt.usenet.kooks, and I'll have the 
new nominees post out soon.  

Oh, and by the way, if anyone sees ANYTHING that is nominally from me BUT
is also cross-posted to misc.test, you have my express written permission to 
CANCEL that article.  You know who you are.  And no more naughty forgeries
ok guys?

Matthew Legare
KotM Vote Wrangler






From hallam at Etna.ai.mit.edu  Thu Jun  6 20:38:41 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Fri, 7 Jun 1996 11:38:41 +0800
Subject: [NOISE] Re: whitehouse web incident, viva la web revolution
In-Reply-To: <2.2.32.19960606004349.006d8404@vertexgroup.com>
Message-ID: <9606061632.AA03941@Etna.ai.mit.edu>


>>it is an insult to the 10 million civilians
>>murdered by Hitler to use the term facist simply as a term of abuse,

>You insult everyone's intelligence by equating fascism to genocide.
>Suggested reading on the origins, meanings and definition of fascism include
>Friere, Foucault and even the damn Utne Reader among many others.

Meeks was intending to link Clinton's crypto policy to Hitler's. I see
no evidence from Meeks' style that he has read Foucault.

If Meeks wanted to be effective he could have accused Clinton and Freeh of 
seeking to build a Stalininst secret police, or make such an organisation 
possible. It would probably be more accurate to link Freeh to Hoover and point 
out how such power has been abused in the US political system before.

The point was that Meeks' article is not the type to advance our cause. It 
basically says "if you are a democrat you believe in cypto-control". Err yes, 
well done, you have just told half the country that they support the opposite 
policy to the one we are trying to get them to believe in. Plus Bush and Reagan 
advocated the same policy so he is also saying Republicans are against our 
cause.

If you want you could reduce the ranks of those fighting for crypto regulations 
to be removed to members of the Libertarian party, but it would be more 
effective to widen the base.


		Phill









From hallam at Etna.ai.mit.edu  Thu Jun  6 20:43:55 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Fri, 7 Jun 1996 11:43:55 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <Pine.3.89.9606061558.A14010-0100000@netcom9>
Message-ID: <9606061643.AA03971@Etna.ai.mit.edu>



>	Call it what you will, the odds of 25 consecutive contracts
>	all showing a profit are miniscle, except under one set of
>	circumstances.  <<  It is something like 1 chance in
>	15 511 210 000 000 000 000 000 000.  >>

Rubbish, 2^25 is 33,554,432. How do you calculate your figures? Or do you just 
make 'em up as you go along?

These are contracts which are expected to pay off more times that they are not, 
they are made on the advice of someone who is an expert in the area. The 
contracts are probably hedging each other in such a way that one contract or the 
other is likely to pay off.

If you hit a favourable market for your strategy you can win big. Problem is 
that after a while others are likley to cotton on to your strategy. 

>	Futures trading on contracts generally show a profit?
>	I guess you are talking about the person who sets up 
>	the trades, and takes a commission on the trades, 
>	regardless of who makes, or ( usually ) loses money. 

Yes, selling rather than buying. If you buy a contract to sell gold at price X 
the chances are that you will lose money most of the time. Many of the 
industries buying those contracts are doing so to protect their exposure to 
price fluctuations in raw materials. Selling contracts is in effect 
underwritting risk of market fluctuations, most times you expect to realise a 
profit, but if you lose you can loose very big indeed.

BTW, I'm told that margin requirements for that market are 5%. So to sell 
$20,000 of contracts you only need to put down $1000. 

		Phill






From sclawson at bottles.cs.utah.edu  Thu Jun  6 20:47:35 1996
From: sclawson at bottles.cs.utah.edu (steve clawson)
Date: Fri, 7 Jun 1996 11:47:35 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <31B5C131.167E@ai.mit.edu>
Message-ID: <199606061652.KAA01488@bottles.cs.utah.edu>


Hallam-Baker uttered:
> I find Meeks' style somewhat tiresome. It is tabloid jornalism
> rather than reasoned argument. His dislike for the Clinton is 
> well known - he recently accused the administration of being
> fascist. 

     Ok, I'm with you to here...

> I know of no evidence that the Clinton administration
> has a genocide policy, it is an insult to the 10 million civilians
> murdered by Hitler to use the term facist simply as a term of abuse,
> especialy if it is being used as a substitute for an argument.

     While I agree that merely branding Clinton a facist without
backing it up is childish, I really don't see how it's `an insult to
the 10 million civilians murdered by Hitler.'  Come on now!  Facist
does not necessarily imply Hitler, or even Nazi.  The term facist has
roots that go at least as far back as the Romans, and I don't recall a
`genocide policy' as a prerequisite to being facist at any point in
history.  Even if he had called Clinton a Nazi, how does that equate
to insulting those killed by Hitler and his flunkies?  Perhaps calling
someone a Communist also is insulting everyone that Stalin killed?


steve

-- 
// stephen clawson				sclawson at cs.utah.edu
// university of utah			        






From nCognito at rigel.cyberpass.net  Thu Jun  6 20:49:17 1996
From: nCognito at rigel.cyberpass.net (Anonymous)
Date: Fri, 7 Jun 1996 11:49:17 +0800
Subject: Electronic Signatures
Message-ID: <199606061726.KAA05826@rigel.infonex.com>


Some of the other info in the AP article seems to be coinciding with 
discussions on the list, so heres a less condensed version of the article. 
Are we still within the limits of the copyrights?  God i hope so. :) 


---------- Forwarded message ----------
TAMPA - Flroida now recognizes electronic signatures as legal and 
binding, however, working out the logistics to implement the new law may 
take some doing.

	Andrew Greenberg, an associate at a large Tampa law firm...says, the 
process saves time by using a computer to handle notary duties that used to 
be done by hand. he expects the mechanics of electronic certifaction to become
simple enough for everybody to use.

	"It will be like the telephone - anybody can use it without 
thinking or knowing how it works," he said.

	Ted Barassi, chairman of the United States Council for 
International Business, is among a pool of experts Florida Secretary of 
State Sandra Mortham is expected to call on to set up the state's 
emerging electronic signature certifacation process.

	The law does not specify how an electronic document must be 
signed, but Barassi and others say it probably will mean coding the text 
and typed signature so they cannot be changed by anyone other than the 
writer.

	No on knows yet just how this will be done, but Mortham's own 
expert on the subject, Gene McGee, envisions a central database that 
tracks coded computer signatures for individuals and businesses. 

	With Florida already a hub of Latin American trade, cybernotary 
lawyers could make the state a mecca for international trade, McGee 
predicts.

_______________________________________________________________________

Its kind of scary when the best minds the state could find are so 
obviously without a clue. One of you politically involved folx could dig 
up addresses for some of our mis-representatives and forward them 
discussion from this list, maybe. :)

Adios..






From jya at pipeline.com  Thu Jun  6 20:51:44 1996
From: jya at pipeline.com (John Young)
Date: Fri, 7 Jun 1996 11:51:44 +0800
Subject: InfoSec Spin
Message-ID: <199606061713.RAA23573@pipe1.t2.usa.pipeline.com>


   6-6-96. UST: 
 
   "Businesses bypass law to fend off hackers." 
 
      In cyberspace, where hackers are finding commercial 
      computer systems easy prey, businesses are choosing to 
      hire free-lance security teams rather than involve the 
      law. A Senate subcommittee heard Wednesday from experts 
      who described how businesses, concerned over negative 
      publicity, avoid reporting hacker assaults on their 
      networked computer system. "You stop the bad guy and 
      send him to your competitor," said Dan Gelber, the 
      committee's chief counsel. 
 
      Senator Nunn asked the subcommittee staff to comment on 
      an article in this week's Sunday Times of London that 
      reported, "Cyberterrorists have amassed up to L400 
      million worldwide by threatening to wipe out computer 
      systems" belonging to banks and brokerage houses if they 
      refuse to pay a ransom. "While we can't confirm the 
      entire story," said Gelber, "it is extremely consistent 
      with what industry insiders tell us." 
 
   http://pwp.usa.pipeline.com/~jya/fendof.txt 
 
---------- 
 
   UST had two editorials June 5 on encryption: one 
   criticizing the administration's position, and another 
   defending GAK by Sally Katzen with OMB. 
 
   http://pwp.usa.pipeline.com/~jya/yeanay.txt 
 





From warlord at MIT.EDU  Thu Jun  6 20:55:21 1996
From: warlord at MIT.EDU (Derek Atkins)
Date: Fri, 7 Jun 1996 11:55:21 +0800
Subject: Security of PGP if Secret Key Available?
In-Reply-To: <Pine.LNX.3.93.960605161013.186C-100000@gak>
Message-ID: <199606061756.NAA16447@toxicwaste.media.mit.edu>


> If the secret key is available then an attacker knows the length
> of p & q.  Admittedly this will not usually help matters much,
> but I still feel that the lengths of p and q should be encrypted
> with the passphrase - perhaps in PGP3.0? (Derek?)

PGPlib has an interface to encrypt the whole keyring, however that
probably isn't going to be fully implemented unless time permits.
This interface allows you to encrypt the WHOLE keyring in a
passphrase, which includes not only the secret components, but the
public components as well.  However I don't know if I'll have the time
to get to it.

Enjoy!

-derek





From grafolog at netcom.com  Thu Jun  6 21:05:45 1996
From: grafolog at netcom.com (jonathon)
Date: Fri, 7 Jun 1996 12:05:45 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <9606052133.AA03412@Etna.ai.mit.edu>
Message-ID: <Pine.3.89.9606061558.A14010-0100000@netcom9>


	Phill:


On Wed, 5 Jun 1996 hallam at Etna.ai.mit.edu wrote:

> You still don't understand, the $1000 is not the stake, it is merely the 
> deposit. The stake is Hillary's entire net worth, that is what she is betting 

	Call it what you will, the odds of 25 consecutive contracts
	all showing a profit are miniscle, except under one set of
	circumstances.  <<  It is something like 1 chance in
	15 511 210 000 000 000 000 000 000.  >>

	You expect us to seriously believe that somebody with
	virtually no knowledge of futures trading would not end up
	having to meet at least one margin call, in 25 trades?
	
> trade that one would expect to make in an underwritting capacity 
> for a commodity market. 
> Steady profits on contracts which generally pay off. 

	Futures trading on contracts generally show a profit?
	I guess you are talking about the person who sets up 
	the trades, and takes a commission on the trades, 
	regardless of who makes, or ( usually ) loses money. 
	
> So you think that the Republican's in Washington haven't figured out
> what Perry Metzger has? 

	Statistical proof is only accepted in academia.  Depending
	upon your POV, this may or may not be a good thing, when
	one is facing civil, or criminal charges.  

	Finding proof for either civil or criminal charges is a 
	slightly different matter.

> the US does. I have friends in both parties who have left the Washington 
> political scene because they don't think the game is worth the candle. 

	The US Media is slightly less freindly towards politicians, 
	than other countries.

	US Politicians are freindlier to each other,
	than politicians in other countries are. 

        xan

        jonathon
        grafolog at netcom.com



**********************************************************************
*								     *
*	Opinions expressed don't necessarily reflect my own views.   *
*								     *
*	There is no way that they can be construed to represent      *
*	any organization's views.				     *
*								     *
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
*								     *
*       http://members.tripod.com/~graphology/index.html             *
*								     *
***********************************************************************







From attila at primenet.com  Thu Jun  6 21:07:38 1996
From: attila at primenet.com (attila)
Date: Fri, 7 Jun 1996 12:07:38 +0800
Subject: Tell it like it is, Perry
Message-ID: <199606061828.LAA23429@primenet.com>


Addressed to: Cypherpunks <cypherpunks at toad.com>
              Perry Metzger <perry at piermont.com>


	now, why would anyone want to send Perry a PerryGram?  --Perry's prose is 
    far too elegant to warrant criticism, particularly the closing remark!

= Your attitude seems to be "you can't prove anything so you must assume 
= that they are innocent." My attitude is "I can't prove anything so 
= they can't go to jail, but that doesn't mean I have to believe that 
= they are innocent -- in fact, I'm an idiot if I believe that." 
=  
= > I think that given Perry's ad-hominem attacks and the fact that this 
= > has nothing to do with cryptography that its about time someone sent 
= > Perry a Perry-gram. 
=  
= Cypherpunks no longer is a cryptography mailing list. Its a sewer. 
=  
= Perry 
=  



--
 When you can't say 'fuck,' 
   you can't say 'FUCK THE CDA!' 
        --Lenny Bruce rephrased






From rah at shipwright.com  Thu Jun  6 21:11:25 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 7 Jun 1996 12:11:25 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <199606051821.OAA12450@jekyll.piermont.com>
Message-ID: <v03006f19addcd0b35037@[199.0.65.105]>


At 4:18 PM -0400 6/5/96, hallam at Etna.ai.mit.edu wrote:

> ObCrypto: Perry is only able to make allegations because the
> financial markets are to a degree open. If anoymous cash takes
> off and anonymous derivatives follow won't it make it easier to
> conceal the type of dealings Perry alledges?

Ah. Another bugbear emerges from the monster closet... <sfx: CREEEAAAAAK!!!!>

Don't worry, Phill!

I've put Jell-O all over the kitchen floor, and set the sofa on fire, too!

That should hold it off until you can get under the magic covers!


lub-DUB. lub-DUB. lub-DUB. lub-DUB. lub-DUB. ...



I suppose it depends on what you call "open", eh, Phill?

If by "open", you mean financial markets where, as Milton Freedman says,
each new regulation raises the cost of entry and protects the surviving
firms by killing their smaller competion with red tape, then we have "open"
markets.

If by "open", you mean that people can't purchase the attention of their
favorite politician fair and square, without having to play zero-sum games
with barnyard animals, then we have "open" markets. ;-).

If by "open", you mean capital markets where we have industrial economies
of scale because they're based on industrial communications technology, and
thus no competition at all, then we have "open" markets.

If by "open", you mean we have an ever-decreasing noose of surveillance,
both by nation-states and by large government-created (see Fredman, above)
oligopolies, then we have "open" markets.


Nothing personal, Phill, but it does seem like it's more a question of what
you're afraid of, than what *is*, right?


Cheers,
Bob Hettinga



Now, where exactly *did* I put that chicken heart, anyway...

lub-DUB. lub-DUB. lub-DUB. lub-DUB. lub-DUB. ...


-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From rah at shipwright.com  Thu Jun  6 21:28:24 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 7 Jun 1996 12:28:24 +0800
Subject: DCSB Cocktails Over Back Bay
Message-ID: <v03006f22addcde1e772d@[199.0.65.105]>



--- begin forwarded text


Date: 6 Jun 96 10:13:48 EDT
From: "Julie Rackliffe" <RACKLIFFE at tcm.org>
Subject: DCSB Cocktails Over Back Bay
To: "dcsb" <dcsb at ai.mit.edu>
Sender: bounce-dcsb at ai.mit.edu
Precedence: bulk
Reply-To: "Julie Rackliffe" <RACKLIFFE at tcm.org>

Greetings!

As those who attended yesterday's lunch already know, We Have A Date!

I am simply delighted to announce that Open Software Foundation has generously
agreed to sponsor our first ever cocktail party for the Digital Commerce
Society
of Boston. I promises to be a memorable evening and I hope that you will
plan to
come, and please feel free to introduce a friend to this unique group. Our
intention is that this event should be used as a networking opportunity in
addition to getting some more people interested in DCSB (and, of course,
expanding our mailing list!)

So, here's the specifics:

When:	Thursday, June 20, 1996
	5-8 pm

Where: 	The Harvard Club, One Federal Street, 38th floor
	in The Lounge (sunset over the Back Bay will be featured!)

	Hot and Cold Hors D'oeuvres ala The Harvard Club
	and cool libations compliments of OSF and DCSB.



What's the Catch?- No Catch! Just RSVP to me before June 17


Do Come!

Julie Rackliffe					The Computer Museum
Annual Fund/Membership Manager			300 Congress St, Boston 02210
rackliffe at tcm.org  				617.426.2800 X432
********************************************************************************
The Walk-Through Computer 2000 is open! This is a "must see"!
Museum Membership:SR/STU $25...IND $35...FAM $50...NON-PROFIT $250...LIB $500
Web Site: http://www.tcm.org




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To unsubscribe from this list, send a letter to: Majordomo at ai.mit.edu
In the body of the message, write:  unsubscribe dcsb
Or, to subscribe,           write:  subscribe dcsb
If you have questions, write to me at Owner-DCSB at ai.mit.edu

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From rah at shipwright.com  Thu Jun  6 21:28:28 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 7 Jun 1996 12:28:28 +0800
Subject: ALERT: Court decision expected soon in free speech case; spreadthe word! (fwd)
Message-ID: <v03006f20addc6f66dd18@[199.0.65.105]>


Date: Wed, 5 Jun 1996 11:44:10 -0400
From: shabbir at vtw.org (Shabbir J. Safdar)
To: Multiple recipients of list <com-priv at lists.psi.com>
Subject: ALERT: Court decision expected soon in free speech case; spread
the word!

- ------
[Dear Friend-of-VTW,

 During our "Turn the Web Black campaign", you wrote us regarding that
 protest.  Because of the success of that campaign, we are asking you
 to participate again in another net-campaign to draw attention to the
 upcoming decision in the lawsuit to challenge the net censorship
 legislation.  This information is not widely available yet, and I would
 appreciate it if you did not redistribute this.

 Because you helped us out during the highly successful "Turn the Web
 Black" campaign, we are giving you advanced notice of this effort before
 we tell anyone else.

 -Shabbir J. Safdar, Voters Telecommunication Watch (www.vtw.org)]

========================================================================
__     _________        __     __   ____ ____ _____
\ \   / /_   _\ \      / /    / /  / ___|  _ \_   _|    Raise the roof
 \ \ / /  | |  \ \ /\ / /    / /  | |   | | | || |     for the Court's
  \ V /   | |   \ V  V /    / /   | |___| |_| || |     decision on net
   \_/    |_|    \_/\_/    /_/     \____|____/ |_|       free speech!
 Voters Telecommunications Watch / Center for Democracy and Technology

        JOIN TENS OF THOUSANDS OF NET USERS IN SPREADING THE WORD
           ABOUT THE FIRST RESULT OF THE FREE SPEECH LAWSUIT

                            June 5, 1996

          Redistribute (intact, please) only until June 28, 1996

- ------------------------------------------------------------------------
Table of contents
	News - A decision in the court case is near
	How to participate
	How will this campaign work?
	Press information on this event
	Background: what is the CDA?

- ------------------------------------------------------------------------
NEWS - A DECISION IN THE COURT CASE IS NEAR

The fate of the Internet and the future of the First Amendment in the
information age hang in the balance.  As early as this week, three federal
judges in Philadelphia are poised to issue a ruling in the law suit
challenging the Communications Decency Act (CDA), which restricts
constitutionally protected speech on the Internet.

Will the court rule that the CDA is unconstitutional? That the Internet is
a unique communications technology that deserves the same First Amendment
protections enjoyed by the print media? Or will the court side with Senator
Exon, conservative "pro-family" groups, and the Justice Department who have
argued that the government is the best judge of what material is
appropriate online.

Regardless of the outcome, the decision will have a profound impact on the
future of the Internet as a medium for free expression, education, and
commerce.

JOIN TENS OF THOUSANDS OF YOUR FELLOW NETIZENS IN ANNOUNCING THE DECISION

When the Communications Decency Act was signed into law by President
Clinton on February 8, 1996, the World Wide Web went black in protest.
When the decision in the historic legal challenge to the CDA is announced,
join tens of thousands of your fellow netizens in spreading the word on the
decision and its impact.

This campaign follows in the steps of the Turn the Web Black campaign,
which was a tremendous success.  Believe it or not, many Internet users
had only superficial knowledge about the proposed law and the enormous
press coverage and online awareness afterwards mobilized large numbers
of people.

In addition to the online campaign, there are currently rallies planned for
New York, press conferences from the CIEC and the ACLU, and a net campaign
to raise awareness to the decision and the effects it will have on free
speech.

The result of the first CDA decision is an extremely important milestone in
the fight for free speech online.  Will the net look more like print, or
more like Saturday morning television?

- ------------------------------------------------------------------------
INSTRUCTIONS ON HOW TO PARTICIPATE:

In anticipation of the decision, you can help keep your fellow Netizens
informed on the latest news and participate in a dramatic demonstration
when the decision is announced.

1. Add the following link *TODAY* in a prominent location on your web site:

	<a href="http://www.vtw.org/speech/">
        <img src="http://www.vtw.org/images/cda.gif"
        alt="Free speech court decision" align=top></a><br clear = all><br>

        A decision is near in the fight to overturn the Communications Decency
        Act. <br>Watch this image and follow the link for more information.

2. To let us know you have joined us, fill out the form at
	     http://www.vtw.org/speech/
   with your URL.  A list of participating will be displayed.

3. Attend the online press conference with lead CIEC (Citizens Internet
   Empowerment Coalition) attorney Bruce Ennis on HotWired.  More details
   are available on the WWW page.

- ------------------------------------------------------------------------
HOW WILL THIS CAMPAIGN WORK?

After you have added the link (above) to your page, an animated image
signifying that a decision in the case is expected soon will be
displayed on your site.  By clicking on that image, visitors to your
page can jump to a site containing the latest news and information on
the case.

As soon as a decision is announced, the image will be changed
automatically (the update will happen at our server - you will not have to
do anything), and Netizens throughout the entire global Internet will
immediately be aware of the result (win or lose).

By clicking on the updated image, visitors to your page will be able
to obtain the text of the decision, analysis, and other relevant
information.

Until the decision is announced, there will be information about upcoming
events and rallies on the VTW Free Speech page, http://www.vtw.org/speech/

- ------------------------------------------------------------------------
PRESS INFORMATION ON THIS EVENT

For more information on this event, including press inquiries, please
contact:

Jonah Seiger, Policy Analyst, Center For Democracy and Technology (CDT)
     <jseiger at cdt.org>  +1.202.637.9800

Shabbir Safdar, Online Representative, Voters Telecommunications Watch (VTW)
     <shabbir at vtw.org> +1.718.596.2851

- ------------------------------------------------------------------------
BACKGROUND: WHAT IS THE CDA?

The Communications Decency Act was passed as part of the Telecommunications
Reform bill in February 1996.  The law seeks to protect minors from
objectionable or sexually explicit material on the Internet by imposing
stiff criminal penalties on the "display" of "indecent" or "patently
offensive" material online.

Opponents to the new law argue that while well intentioned, the CDA fails
to account for the unique nature of the Internet, and that it will have a
far-reaching chilling effect on constitutionally protected speech online.
On a global, decentralized communications medium like the Internet, the
only effective and constitutional means of controlling access to
objectionable material is to rely on users and parents, not the government,
to decide what material is or is not appropriate.

Two lawsuits have been filed to challenge the constitutionality of the CDA
in a Philadelphia federal court. The cases have been consolidated and an
decision is expected in early June 1996.

The cases have been brought, respectively, by The Citizens Internet
Empowerment Coalition (CIEC), comprised of civil Liberties groups,
libraries, Internet Service Providers, Commercial Online Service Providers,
Newspaper, Magazine and Book Publishers, and over 45,000 individual
internet users, and a coalition of civil liberties groups, authors, and
others organized by the ACLU.

Detailed information on the legal challenges, as well as information about
the CDA, is available at the following web sites:

Legal Challenges To The CDA
- ----------------------------

*  The ACLU                     -   http://www.aclu.org/

*  The Citizens Internet
   Empowerment Coalition (CIEC)  -  http://www.cdt.org/ciec

Background Information On The CDA/Internet Censorship Issues
- ------------------------------------------------------------

* The ACLU                                     - http://www.aclu.org
* Center for Democracy and Technology (CDT)    - http://www.cdt.org
* Electronic Frontier Foundation (EFF)         - http://www.eff.org
* Electronic Privacy Information Center (EPIC) - http://www.epic.org
* Voters Telecommunications Watch (VTW)        - http://www.vtw.org

========================================================================


-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From sjb at universe.digex.net  Thu Jun  6 21:34:11 1996
From: sjb at universe.digex.net (Scott Brickner)
Date: Fri, 7 Jun 1996 12:34:11 +0800
Subject: Multiple Remailers at a site?
In-Reply-To: <19960604232157.2053.qmail@ns.crynwr.com>
Message-ID: <199606061916.PAA07088@universe.digex.net>


nelson at crynwr.com writes:
>Scott Brickner writes:
> > If the remailer does a good job with the delays and shuffling, then
> > it becomes difficult for the analyst to match message a with
> > message b, leaving him with what he already knew (that A and
> > RemailerX have a common interest, as to B and RemailerX, but the
> > interests may be wholly unrelated).
>
>Nope.  Not if each of them runs a remailer.  That's why mixmaster is
>SO WONDERFUL.

Aside from the fact that your point doesn't address mine, it doesn't
address the issue.  The "to" and "from" values that the traffic analyst
will be using are the IP addresses in the packets.  It doesn't matter
whether mixmaster, cypherpunks, or penet remailers are used, they still
use IP addresses.

Retransmission delays slightly reduce the analyst's ability to
correlate inbound and outbound messages.  Mixmaster significantly
reduces it, since all messages are the same size.  Chaining (and
mixmaster's inter-host mixing) means that the analyst needs to target
more machines to get meaningful correlations.

The discussion was about multiple remailers from multiple accounts on
the same machine.  The very existence of the remailer, independent of
issues like shuffling and chaining, is supposed to eliminate
identifying the originator by the content of the message.  Message
shuffling, delays, and chaining are entirely for the purpose of
reducing the information available to the traffic analyst.  If several
remailers are running on the same machine, they may be treated as if
there were only one remailer, for the purpose of traffic analysis.
Getting more traffic going through them just makes the analysts job
easier, because his statistical conclusions are stronger.





From sandfort at crl.com  Thu Jun  6 22:36:28 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Fri, 7 Jun 1996 13:36:28 +0800
Subject: Terrorism Hysteria on the Net
Message-ID: <2.2.32.19960606164902.0072e3f0@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

At 05:35 PM 6/5/96 -0700, Rich Graves wrote:

>Pooh-poohing the potential risk is not a winning proposition. Pointing out
>that the government's policies against properly secure systems have created
>this house of cards in which we live is. 

A classic case of government being a disease posing as its 
own cure.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From unicorn at schloss.li  Fri Jun  7 00:27:28 1996
From: unicorn at schloss.li (S. Logan vonBernhardi)
Date: Fri, 7 Jun 1996 15:27:28 +0800
Subject: WWW servers.
In-Reply-To: <199606062121.OAA07502@niobe.c2.net>
Message-ID: <Pine.SUN.3.91.960606221523.18480A-100000@polaris>


On Thu, 6 Jun 1996 sameer at c2.org wrote:

> > 
> > Does there currently exist a system which permits webservers to restrict 
> > access to clients who have a given certification?
> 
> 	Yup.

I was hoping you'd chime in.
How about for macs?

> 
> > 
> > What is the current certification practice?
> 
> 	Use either VeriSign, or build your own CA.

"Build your own CA" ?

> > 
> > How easy is it to certify a given client?
> 
> 	Rather easy, using XCert Sentry.

Hmmm, how's it done?  Included with the Apache package?

> > 
> > Are webserver certifications sufficently secure today?
> 
> 	"sufficiently" by whose definition?

Yours.

> > 
> > What are the best servers to use for secure web pages and certification 
> > currently in the United States?
> 
> 	=) Stronghold: The Apache-SSL-US, coupled with XCert
> Sentry. What else?

Got a marketing package around?


> -- 
> Sameer Parekh					Voice:   510-601-9777x3
> Community ConneXion, Inc.			FAX:     510-601-9734
> The Internet Privacy Provider			Dialin:  510-658-6376
> http://www.c2.net/ (or login as "guest")		sameer at c2.net

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From hua at xenon.chromatic.com  Fri Jun  7 01:12:51 1996
From: hua at xenon.chromatic.com (Ernest Hua)
Date: Fri, 7 Jun 1996 16:12:51 +0800
Subject: NSA/CIA to snoop INSIDE the U.S.???
Message-ID: <199606061729.KAA18108@ohio.chromatic.com>


What?!  What the *@#!! is wrong with the people who supposedly smart
people representing us?!

Ern

-------- From SJ Mercury:

    NET FEVER ON THE HILL
    
    Published: June 6, 1996
    
    BY RORY J. O'CONNOR
    Mercury News Washington Bureau
    
    WASHINGTON -- The White House wants a coordinated task force to fight
    terrorism on the Internet. Some senators think the CIA should be
    allowed to work hand in hand with the FBI to fight computer crime on
    U.S. soil. Meanwhile, the federal courts are deciding a major First
    Amendment case that might ban certain information from the Net.
    
    The nation's capital is in the throes of Internet fever.
    
    For the past several months, the condition has become acute, and by
    the end of the year the Internet itself may look far different as a
    result: more tightly regulated, more carefully monitored and more
    expensive.
    
    The latest symptom: a suggestion Wednesday for the elimination of laws
    that prohibit U.S.  intelligence agencies -- notably the National
>>> Security Agency and the Central Intelligence Agency -- from snooping   <<<
>>> on home soil. The reason: The potential for computer crime and         <<<
    terrorism is so great, and the Internet so decentralized and
    international, that police and the FBI must combine forces with spy
    agencies in order to successfully analyze the threat and investigate
    criminal activity.
    
    ''If we're going to live in this kind of world, we're going to have to
    link the intelligence world with law enforcement,'' said Sen. Sam
    Nunn, D-Ga.
    
    For many people in government who work on computer and law-enforcement
    issues, the course of the disease seems painfully slow. They often
    describe the Internet as the Wild West that's sorely in need of a good
    marshal. But for many people who use the Internet, the government's
    efforts are moving far ahead of any real knowledge of a technology
    that, two years ago, almost nobody had heard of.
    
    ''There are not dead bodies in the street,'' said Donna L. Hoffman, a
    professor at Vanderbilt University who studies the Internet. ''It just
    doesn't make sense to rush into legislation.''

    [ SNIP ]





From jf_avon at citenet.net  Fri Jun  7 01:24:06 1996
From: jf_avon at citenet.net (Jean-Francois Avon)
Date: Fri, 7 Jun 1996 16:24:06 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <9606061850.AA10939@cti02.citenet.net>


On  6 Jun 96 at 11:19, jim bell wrote:


> >>I _do_ believe, however, that the number of people unjustifiably
> >>targeted will be rather low. <snip>  Retaliation is possible, in
> >> that case.

Sorry Jim, I did not get that at all in the past.  I assumed a 
context where the inner workings of AP would not be well understood 
by the population while here, you seems to indicate that everybody 
would operate under the threat / deterrance of mutual anihilation 
principle.

A argued that an impulsive guy might target somebody unjustifiably 
while I overlooked that he could think twice before doing so.  But by 
his nature, being a violent or thug at heart, he will understand this 
"peace based on threat" maybe even better than a pacifist at heart.  
So, my arguments might not stand.  

Have any constructive comments? (hey, just play devil's advocate from 
time to time :)

Ciao

JFA


 DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal
 JFA Technologies, R&D consultants: physicists, technologists and engineers.

 PGP keys at: http://w3.citenet.net/users/jf_avon
 ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 
 





From jeffb at sware.com  Fri Jun  7 01:36:52 1996
From: jeffb at sware.com (Jeff Barber)
Date: Fri, 7 Jun 1996 16:36:52 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606061924.MAA10732@netcom10.netcom.com>
Message-ID: <199606070205.WAA20230@jafar.sware.com>


Vlad the Imposter writes:

> >Telephone companies have found billing to be a major bottleneck.
> >By some estimates, up to 50% of the costs of a long distance call
> >are for billing, and this is on the order of a $100 billion per year
> >market worldwide.  Internet providers have been moving to a flat fee in 
> >order to minimize these costs, even though this creates the incentive for 
> >network resource overusage.  
> 
> imagine a user who controls his own wallet. he knows when he is paying
> from that wallet. you seem to have this idea that outsiders could
> make queries to that wallet that would be hard for the consumer to
> keep track of. this makes no sense to me. the wallet action will always
> be tied with some other action. the user picks up the phone to dial
> somewhere, and it says, "that will be .3c-- will you pay"? he says
> yes. 

I'm sort of a neophyte when it comes to digital cash, micropayments and
so forth but it seems to me that your example provides a fine platform
for discussing the problem.  How will you know the cost is .3c a priori?
What's to stop me from saying yes to the .3c and staying on the line
forever?  If you disallow that, how?  Will it cost the same amount if
I'm not sending anything as it will if I'm sending a live video + audio
feed?  If so, what's to stop me from bundling my whole neighborhood's
Internet traffic into this call?  If not, how will you tell the
difference without monitoring my usage and requiring me to pay for the
additional bandwidth I use?

Or are you saying that each IP packet will have an appropriately sized
digital cash payment attached?  That seems like too much overhead.
And besides, that contradicts your idea that the user would explicitly
approve each wallet access.

It gets even worse if you're an ISP, you obviously can't sit there
and approve each session that goes by (even if you could distinguish
higher level session boundaries which you won't be able to do).  Are
you just to assume at the end of the day that everything worked
perfectly and you received enough revenue to cover your costs without
knowing anything about the payment/usage profiles of any of your
customers?  And how is the ISP's network provider to know how much to
charge the ISP?


-- Jeff





From sameer at c2.org  Fri Jun  7 01:36:57 1996
From: sameer at c2.org (sameer at c2.org)
Date: Fri, 7 Jun 1996 16:36:57 +0800
Subject: WWW servers.
In-Reply-To: <Pine.SUN.3.91.960606221523.18480A-100000@polaris>
Message-ID: <199606070241.TAA16588@niobe.c2.net>


> 
> I was hoping you'd chime in.
> How about for macs?

	I think WebStar/SSL does SSL, but I don't know if it does
client auth. I doubt it though. Netscape Navigator 3.0b4 does client
auth, if you need a client that runs on a mac.

> 
> "Build your own CA" ?

	Yeah, my package (and XCert Sentry) has stuff to let your
build your own CA, for your own company, or whatever.

> Hmmm, how's it done?  Included with the Apache package?
> 

	Xcert Sentry is a seperate product, sold by a seperate
company. http://www.xcert.com/

> 
> Got a marketing package around?

	Not yet. http;//www.us.apache-ssl.com/ for now.

-- 
Sameer Parekh					Voice:   510-601-9777x3
Community ConneXion, Inc.			FAX:     510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.net/ (or login as "guest")		sameer at c2.net





From nelson at crynwr.com  Fri Jun  7 01:37:22 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Fri, 7 Jun 1996 16:37:22 +0800
Subject: Electronic Signatures
In-Reply-To: <199606061726.KAA05826@rigel.infonex.com>
Message-ID: <19960606185840.9230.qmail@ns.crynwr.com>


 > 
 > 	The law does not specify how an electronic document must be 
 > signed, but Barassi and others say it probably will mean coding the text 
 > and typed signature so they cannot be changed by anyone other than the 
 > writer.

Doh!  So set up a business which certifies PGP signatures.  What you
do is take money from people in exchange for a sheet of paper which
contains the PGP fingerprint, and a notarized copy of the person's
driver's license, credit card, or whatever.  Once you get that piece
of paper, you sign the person's PGP key with your business's key.
You certify that you have the piece of paper on file, and will provide
it upon payment of some small fee.

There.  A signature registry.  And you can even do it through a
service like First Virtual, or Digicash or Cybercash.  The only reason
I haven't done it is because I have other business with a higher
margin, and there's only so much Russell to go around.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From jimbell at pacifier.com  Fri Jun  7 01:44:11 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 7 Jun 1996 16:44:11 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <199606070328.UAA19061@mail.pacifier.com>


At 09:55 PM 6/5/96 -0700, Bruce Baugh wrote:

>The rest of us (in the US) live in a country where the government can now
>pretty much declare anyone they like terrorists, and suspend habeus corpus
>on the flimsiest of grounds, and use evidence against foreigners that
>doesn't have to be presented to the accused, and all sorts of fun stuff.

But if that's true...

>I don't think that my direst claims _will_ come true. But I don't think I'm
>speculating anything that _can't_ happen, and I see much of it as
>increasingly likely in the light of the ongoing furor over crypto and
>related matters.

If that's true (and I don't doubt that it is) doesn't that suggest to you 
that something serious needs to be done to fix the problem?

>From a tagline:

"If you always do what you have always done, you will always get what you've
always got."

If you say we shouldn't rock the boat because the bad guys might come, isn't 
it just possible that the REASON the "bad guys might come" is because we 
have not, in the past, adequately rocked the boat?

My impression is that it is frequently the pacifist-types who get us into 
war, because they start the process out by tolerating actions by others that 
turn into more serious actions, etc.  You know, the appeasers.  Are you an 
appeaser?

All I'm advocating is to set up a system which gives government-types a very 
stark choice: War or peace.  Then let them make that choice.  I predict they 
will choose peace.



Jim Bell
jimbell at pacifier.com





From adam at homeport.org  Fri Jun  7 01:49:28 1996
From: adam at homeport.org (Adam Shostack)
Date: Fri, 7 Jun 1996 16:49:28 +0800
Subject: How can you protect a remailer's keys?
In-Reply-To: <v02140b00addba12bd414@[205.162.51.35]>
Message-ID: <199606061724.MAA04605@homeport.org>


	I'm not sure that, even in theory spreading your key over
multiple machines isa good idea.  The issue to me is reliability.  If
you (the remailer op) have a single machine thats well secured, you
can get a decent idea of its state at a given time.  It is dependant
on those things that the net depends on, DNS and IP being close to
working.  If the remailer is distributed, you've raised the work to
maintain by a factor of N, and increased the probability of the
machine being insecure by the same amount.  You've also reduced
reliability to that of the least reliable machine.

	The better model (imho) is to have 'co-processing' strong
remailers in safe places.  (I think Alex described these here a few
months back; you have a firewall host that talks to the net, and a
second machine attached to it which does the mixing, and passes
messages back to the firewall for distribution.

Adam

Jim McCoy wrote:

| Lance Cottrell writes:

| > The best solution I could come up with (and was willing to write and use)
| > is to specify the passphrase on the command line argument to the compiler
| 
| This is little better than leaving it around in a plaintext file, a pass
| or two with gdb on your binary and I have your private key.
| 
| The "difficult, expensive, and pain in the ass code to write" solution that
| I favor is to use secure multiparty computation to create the remailer.  It
| does not exist on a single host, but is rather the sum of a collection of
| hosts running on widely seperated machines.  It has the same type of drawback
| as a per-execution password entered into a long-lived process (anyone with
| root access to the host can yank it out of memory with little difficulty,)
| but this is spread out across a larger collection of hosts, making the task
| of actually getting the complete password somewhat difficult.  Getting a
| subset of the individual host passwords does not provide any partial
| information about the collective password (similar to secret sharing.)
| The other drawback is that certain operations can be very slow, you end
| up emulating a circuit with a _very_ slow clock (8-10 Hz.  Not MHz, not KHz,
| but 8-10 ticks/second); as compensation you get a word-size that if
| effectively infinite. I have to continue work on a subset of these methods
| for a secure digital poker/card-playing system over the next couple of months
| and if I have some spare time I might see just how difficult creating a
| toolkit for building such virtual circuits really is...

| OTOH, a secure PCMCIA or smart-card will probably end up being a better
| practical solution.

Yeah.


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From tcmay at got.net  Fri Jun  7 01:59:11 1996
From: tcmay at got.net (Timothy C. May)
Date: Fri, 7 Jun 1996 16:59:11 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <addce3e0020210047407@[205.199.118.202]>


At 10:18 PM 6/6/96, Igor Chudov @ home wrote:
>Jim McCoy wrote:
....
>> As long as that person is not the President of the United States (at least
>> for U.S. citizens.)  This was the issue which initiated this thread, the
>> implied threat made by our favorite nutcase.
>
>Are you sure? Can you cite references? From my readings on the 1st
>amendments, any general kind of speech is legal, even if it advocates
>killing certain officials, including us presidents. *If* instead of
>general advocacy a person gave specific orders or concrete requests to
>kill the prez, then it would not be speech. Please correct me if I am
>wrong.

* First, I disagree with Bruce Baugh's earlier comment that there is a
nonzero chance this list could be "shut down." (Well, "nonzero" covers a
_lot_ of numbers, but as it usually understood in hackerspeak, "nonzero"
means "finite," and "finite" means "a credible chance." It is this with
which I disagree.)

There is virtually no chance that even fairly egregious threats would allow
the government to "shut down" a public forum. Prior restraint and all that.
I suppose there is some slight chance that John Gilmore could be held
liable in some way for messages flowing through his "toad" machine, and
that hence the instantiation of the Cypherpunks list _on toad_ could be
affected. But I am skeptical even of this. In past cases where the
government felt a newspaper or magazine had published or planned to publish
material they felt was illegal ("The Progressive" and "The New York Times,"
for example), the ongoing operations of these newspapers were not stopped.

(There may be cases people can dig up where some newspaper or newsletter
was "shut down," but I think such cases would be hard to find in the last
several decades. Am I wrong on this?)

* Second, there are indeed various laws about threatening the President.
And there are laws about directly threatening others as well. ("Directly
threatening" is a fuzzy idea, which I don't plan to debate here.)

However, recall that Senator Jesse Helms elliptically threatened President
Clinton by saying that Clinton had probably better be wearing a
bullet-proof vest if he ever visited Helms' part of the country. (Even the
Republicans were shocked by this, and, I surmise, cast Helms into the outer
darkness, as Helms has been keeping a low profile for the past 18 months.)

* Third, while I am bored with Bell's "single note" point of view ("I have
a solution for this") and while I feel his "assassination politics" is both
naive and derivative, I don't think his advocacy of AP constitutes a direct
threat to anyone. He is not actually setting up the betting markets which
would make AP more of a reality, nor is he calling for the killing of any
particilar persons.

* Fourth, merely discussing alternative political systems is not enough to
trigger legal action, at least not today.

* Finally, there may be provisions in the Terrorism Act (don't know precise
name, but Clinton signed it into law a few months ago) which could
conceivably trigger having certain groups classified as "terrorist groups."
The law is too new and too untested, I think, to have any implications for
a mailing list such as ours.

Frankly, the list is much likelier to die off from debates about fascism
and Hillary's investments than it is to be "shut down" by government
action.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From nelson at crynwr.com  Fri Jun  7 02:19:17 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Fri, 7 Jun 1996 17:19:17 +0800
Subject: FOR WHOM THE BELL TOLLS
In-Reply-To: <199606070328.UAA19061@mail.pacifier.com>
Message-ID: <19960607040506.11096.qmail@ns.crynwr.com>


jim bell writes:

 > My impression is that it is frequently the pacifist-types who get us into 
 > war, because they start the process out by tolerating actions by others that 
 > turn into more serious actions, etc.  You know, the appeasers.  Are you an 
 > appeaser?

A quote from Donald Wetzel's book Pacifist:

The pacifist is often asked what he would do in the event the United
States were to be conquered by a hostile power.  The assumption on the
part of the questioner is almost always that we would simply assume
the proper position in which best to have our asses kicked.  I suggest
that anyone who believes that such would be the pacifist response to
the imposition in America of an oppressive, authoritarian
rule--foreign or domestic--should consult the prison authorities that
were in power when America's prisons were host to some six thousand
pacifists.  I am sure it will be found that we have not been
forgotten.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From jimbell at pacifier.com  Fri Jun  7 02:52:05 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 7 Jun 1996 17:52:05 +0800
Subject: OECD on Crypto
Message-ID: <199606070342.UAA20358@mail.pacifier.com>


At 10:22 AM 6/5/96 -0700, Mixmaster wrote:

>OECD NEWS RELEASE - Paris, 10 May 1996 
>
>OECD EXPERTS BEGIN DRAFTING CRYPTOGRAPHY GUIDELINES 
>
>Cryptography experts from OECD countries have begun drafting a
>proposal for OECD Cryptography Policy Guidelines that governments can
>use as a guide to formulate their national policies on encryption. 
>
>Many governments are under pressure within their own countries to
>develop a national position on cryptography, 

This is bullshit.  If anything, it's exactly the opposite:  It is the 
GOVERNMENTS and those who hold government jobs who are doing the 
"pressuring."    I haven't seen more than a trickle of desire for a 
"national position on cryptography."  What Internet-people want is the 
ELIMINATION of a "national position on cryptography," I think.

>which is used in computer
>technology to protect everything from product designs to health and
>tax records and global correspondence. But the needs of global
>technologies and applications require an international --rather than a
>strictly national -- approach to policymaking.

In other words, various Constitutions are getting in the way!  Tough!

> The fast-paced
>development of the Global Information Infrastructure adds an element
>of urgency.

In other words, the governments are feeling that the situation is getting 
out of their control!  Excellent, that's progress.

>
>The business community, individuals and national security and law enforcement
>agencies are all pressing for encryption guidelines

BULL!  The businesses are saying, "Don't restrict crypto."  The individuals 
are saying, "Don't restrict crypto!"  

So-called "law enforcement" agencies are saying, "We're losing control of 
the public!  Where's '1984' when we need it!"


> and the OECD will strive to
>reflect the legitimate interests of all these groups as it drafts Guidelines. 

I don't think so.


>The private sector is closely involved in drafting the Guidelines,
>with business representatives from the Business and Industry Advisory
>Committee (BIAC) participating at the meeting. 

Gee, what about THE INDIVIDUALS?  You know, the ones you steal your tax 
money from?  That's right, the peons.


>The OECD meeting, which took place on 8 May, was hosted by the US
>Department of State in Washington DC.

That's because the USG is the most unhappy, because its Constitution is 
making it very difficult to ban crypto.

 It was held immediately after a
>Second Business Government Forum on Global Cryptography Policy in
>Washington DC on 7 May, which was cosponsored by the OECD, the 
>International Chamber of Commerce (ICC) and the Business and Industry Advisory
>Committee (BIAC) to the OECD.

It probably had a similar lack of participation by ordinary citizens and 
netizens.  Do I detect a pattern here?

> Two similar conferences took place in Paris in
>December, when OECD countries and business representatives met for the
>first time to discuss international cryptography policy. 

Probably because they had gotten wind a few months before of a serious 
potential danger to the continued hegemony of governments over the people.

>
>The process of drafting the OECD Cryptography Policy Guidelines will
>continue at an experts meeting in June and is due for completion in
>early 1997.

It's already too late!


>For further information, please contact Ms. Hiroko Kamata, OECD 
>Directorate for Science, 
>Technology and Industry (tel. 331 45 24 80 04 - fax. 331 45 24 93 32 - 
>e-mail. hiroko.kamata at oecd.org).

Jim Bell
jimbell at pacifier.com





From rah at shipwright.com  Fri Jun  7 03:02:37 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 7 Jun 1996 18:02:37 +0800
Subject: Anonymous stock trades.
In-Reply-To: <9606062327.AA04162@Etna.ai.mit.edu>
Message-ID: <v03006f0caddd1c3bbce1@[199.0.65.105]>


*Damn*, I'm having *fun* today...

At 7:27 PM -0400 6/6/96, hallam at Etna.ai.mit.edu got all "hermeneutic" on us:

> Well, Milton Friedman's method for saving the whale is to leave it to the
>free
> market, if people want whales in the oceans they won't buy whale meat.
>The point
> that even if no US person eats whale, a few thousand "gourmets" in Japan
>can eat
> their way through the remaining stocks of many species in a few years
>escapes
> him. So forgive me if if find you authority somewhat less than compelling.

Yes. And they're tasty, too. I try to eat animal at least once a day,
whether I need it or not.

According to your logic above, it seems that all species are *much* more
important than man. But, with most "liberal" logic, there's a paradox here.
Let's explore it bit, shall we, by looking at the other side of the balance
sheet you just created?

Tell me, Phill, what's *your* pricetag on a single *human* life? The entire
gross global product is not enough? It's this kind of, well, muzzy-headed
innumerate (yes, *Dr.* Hallam-Baker, *innumerate*) silliness that has our
intellectuals believing the hoax, put convincingly enough to get published
in "respected" academic places like "Social Text", that reality (physics,
in this case) is optional.

Can you say "Sophistry", boys and girls? I knew you could. No offense to
the, er, numerate computer science people out there, but it seems that
*Dr.* Hallam-Baker is living proof that you can get an entire *doctorate*
in the field, and not learn to count. I hate to tell you *Dr.*
Hallam-Baker, but Lamarck was wrong, too. Not to mention Lysenko. ;-).
Reality, real, honest-to-god quantitative reality, is, in fact, not
optional.

> Adam Smith makes the point rather better in his analysis of monopolies
>and how
> they affect the market. But remember that although regulations may be
>instituted
> as protectionist mechanisms that is not the only purpose that regulations
>are
> introduced.

You get what you pay for, Phill. The reason, and look it up, that we had
monopolies in *this* country was the same reason that you had monopolies
(and I count labor unions in this) in yours. They were bought and paid for
out of the government trough. So much for the integrity of government.
Frankly, I'd put myself in the hands of those eevill, greeedy, businessmen
any day. Contrary to what they taught you in the Young Pioneers, or
whatever passes for that on your side of the channel, governments not only
screw things up, they kill. Hundreds of millions of people in this century
alone.

>
> >If by "open", you mean that people can't purchase the attention of their
> >favorite politician fair and square, without having to play zero-sum games
> >with barnyard animals, then we have "open" markets. ;-).
>
> There are so many negatives in that sentence I can't figure out which way
>you
> are arguing. Certainly there are many senators, congressman etc who can be
> bought for a contribution to their election fund or a huge advance on their
> memoirs.

Feh. You're just afraid of a little predicate calculus. That looks like
perfect English to me. Even if it's pronounciation isn't quite "received".
Personally, I agree with the Bard. Twain, of course. "A politician is
someone who can take money from the rich and votes from the poor and keep
his job." I suppose if The Earl of Oxford had said it, he'd change "job"
for "head" in the last sentence, but, we live in America, where this
decade's poor is last decade's rich, and vice versa. Or it least it used to
be that way, before these innumerate Keynesians took over our economic
"policy". ;-). "Poor me another Veuve Clicot, Corruthers. I think I have
discovered another way to traitor my class."


> >Nothing personal, Phill, but it does seem like it's more a question of what
> >you're afraid of, than what *is*, right?
>
> No, it is a case of whether you are applying ideological judgements or
>prepared
> to analyse the system itself.

Now, that's the pot calling the kettle black! Phill, we all know you're the
biggest apologist the nation-state has ever had on this list. That's okay,
'cuz you're building the right technology, and someday you'll see the
light. Say AMEN, Somebody!. Sorry. Got carried away in my
techno-evangelism, there...

The point is, Phill, you don't have to pollute the minds of all these
avant-garde young cypherpunks with yesterday's news. I mean, you developed
a double-jointed neck so you could look backwards and walk forwards (*how*
does he keep from *tripping*, brothers and sisters!
It'sa*miracle*sayhalelujia!), but it doesn't mean it's evolutionary
advantageous,  a future dictatorship of the proletariat notwithstanding.
:-).

> I do not believe in the idol of the free market.

Ah. Hmm. Still doesn't get it, does he, folks. A market's not an "idol" to
"believe in", Phill, it's this amazing stuff called "reality". It's really
quite fun. You should try it sometime...

> I
> do not consider ecconomists to have justified the level of inane
>self-satisfied
> certainty about their field that they exude.

Ah. *Your* economists, Phill. Top-down, *Keynesian*,  er, crypto-Marxist,
"control" the political-economy featherheads...

The people who do *financial* economics, just like the people who do
financial cryptography, *experiment* in markets, but they aren't fool
enough to think that they can actually *control* them. Wake up and smell
the coffee, Phill. There's a reason these boys have won all the Nobels,
lately. Reality is not optional. Planned economies aren't, actually.

> I was talking to a professor at the
> Sloane school yesterday who made precisely this point.

Ah. The Sloan school. That paragon of free market thinking. Probably *Dr.*
Thurow, I bet, maybe even <*big* intake of breath> *Dr.* Samuelson?
<oooooh!>. Feh. By, the way, Phill, your appeals to authority are nothing
short of amazing. *Dr.* Hallam-Baker. "*Sloane*" school economist. Feh, and
double-Feh. Credentialism, like any appeal to authority, is the last refuge
of the incompetant. We know *you're* not incompetant, Phill. Stop acting
like somebody who is.

> Deciding what is right implies an ethical judgement.

Yup. Electrons, like prices, are actually ethical creatures, don't you
know. Feh. Next thing he's going to tell us that there's a conciousness
particle... By the way, don't start talkin' that "touch your inner child"
stuff, Phill, or I'm gonna get a two-by-four to keep you off of *mine*...

> Are you basing your
> argument on Kantian or consequentialist assumptions?

Ooooo... Deontological vs. teleological? Wow. A philosopher. Congrats,
Phill. It *does* appear you're educated. At least through first year
ethics...


> I can argue either but
> since most of my thesis is based on a logical positivist approach I'm far
>more
> sympathetic to the utilitarian point of view.

The ganglia twitch. You're making my point for me! Just because you can do
all the mental gymnastics of Gorgias (who maintained, by the way, that
nothing exists) doesn't mean that reality's, er, optional. Remember, Phill,
Gorgias is dead. Not very optional, eh?

> The free market is not in itself an ethical basis - that would be
>creating an
> ought from an is.

Ethical schmethical, Phill. The market, like the rest of physical reality,
is *real*. It is not something to be "believed" in. If you have something I
want, and I have something you want, we trade for it. There has been trade
nearly as long has there has been human artifacts or commodities to trade
with. Hell, trade happens at the *cellular* level, for christsakes, with
stochastic process, markets, if you will. How do you think oxygen transport
works? Market-driven chaos. It's an economy.

Feh! Like Phillip K. Dick said, "Reality is that which, when you change
your mind, doesn't go away." Markets are as real as next month's rent,
Phill.


> The problem which libertarian idelogues are affraid to face up
> to is that markets have required regulation to keep them open and free.

<pardon me, ladies> "Tha's all right, darlin'. I'll only put the head in."
Or, as they say (ooo, this is great!) on the gates of Auschwitz, "Arbiet
Macht Frei". Work makes you free. Freedom is Slavery, right Phill? Read any
Hayek lately? I thought not...

> Its all
> very well for people to jump up and down, stampt their feet and claim the
> opposite but this is what every government in the free world believes.

Yup. You're right, there. Every government, especially the most unfree,
believe that markets can be, *must* be controlled, to make us "free".
Notice the harder they try to "control" markets to make us "free", the more
they control *us*? Eventually they control us so much there's no more
market, Phill. Make sense now? I'll give you a hint. It's called "reality",
and it's not "optional", much less "ethical".

> The
> effects of deregulation in the savings and loans area make it unlikely any
> further experiments in that area will be tried for a while.

This is marvellous. You're making a mobius of yourself! Don't try so hard,
Phill, and you might figure this out. Look, Phill, you've taken logic,
right? Remember the informal fallacy called "false cause"? An increase in
bananna consumption causes suicide? (If you don't believe me, look at the
statistics! I swear! ;-)) Actually, the above line looks more like "Post
hoc, ergo propter hoc".  Yup, all that first-year logic was good for
something. Plain old circular reasoning. Just like the mobius strip you
made of yourself, Phill. Put that double-jointed neck to better use. You
could hurt yourself with these mental contortions...

The reason that deregulation caused so much of a problem in the savings and
loan "industry", was because the "industry" was a creature of government,
which couldn't survive, you guessed it, Phill, "reality". If you ignore
markets, like any other natural force (like, say gas laws, or
thermodynamics, or gravity) you get slapped. Hard. Reality is not optional.

The entire financial system of this country has had to be unwound from all
the regulations that people "controlling markets to make us free" bound
them up in. Starting in the early 70's with the deregulation of brokerage
commissions, through the breaking down of the two equivalents of the Bamboo
(the creation of the savings and loan "industry") and the Iron (the
Glass-Steagal Act) curtains, and, now, the abolition of interstate banking
regulation, (with the internet, you're halfway to anywhere, much to the
relief of our friends in Kentucky) we are starting to have free financial
markets in this country for the first time since we started "consolidating"
it to make it more "efficient" by both the trusts and the trust-busters,
who were really two sides of the same coin: oligopoly and state control.


You just keep it up, Phill. I'm having a great time, here. As we used to
say in Missouri, I haven't had this much fun since the hogs ate my little
brother.


Next?


Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From nelson at crynwr.com  Fri Jun  7 03:29:57 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Fri, 7 Jun 1996 18:29:57 +0800
Subject: Multiple Remailers at a site?
In-Reply-To: <19960604232157.2053.qmail@ns.crynwr.com>
Message-ID: <19960607042143.11138.qmail@ns.crynwr.com>


nelson at crynwr.com writes:
 > Scott Brickner writes:

 >  > The "to" and "from" values that the traffic analyst will be using
 >  > are the IP addresses in the packets.  It doesn't matter whether
 >  > mixmaster, cypherpunks, or penet remailers are used, they still use
 >  > IP addresses.
 > 
 > Sure *does* matter.  There's no computationally feasible way to
 > associate one mixmaster message with another.  The only way you can
 > get a clue is by analyzing who sends mail into and out of the
 > mixmaster system.  If both of your endpoints are within the mixmaster
 > system, you have no entering or exiting mail to analyze.  It doesn't
 > matter if the mixmaster remailers are on the same or different systems.

Scott indicates, in private mail, that he needs another, clearer,
explanation.  Okay, here goes:

A is sender, B is recipient, M is mixmaster remailer network, W is
watcher.

A Mixmaster system (there can be more than one, although there is
currently only one published Mixmaster system of remailers) acts as a
single node for the purposes of traffic analysis.  Imagine, if you
will, a remailer that everyone trusts implicitly.  Why would you need
any other remailers??  All W can see is incoming mixmaster messages
(lets you identify A), and outgoing ASCII messages (lets you identify
B).  If W can correlate traffic between A and B, he does it by
watching what happens between A and B, not being privy to the
internals of M.

Now obviously there is no single trustable M.  So, you create many Ms,
who move traffic between themselves.  Let's assume that only one of
them is trustable (M') and happens to be used by A to send a message
to B.  W STILL doesn't know what happens inside M' and has no more
information about the correlation between the message sent by A and
the message received by B than in the first case.

Do you see now, Scott?  Adding mixmasters doesn't need to make traffic
analysis harder (it does, but it doesn't need to).  It makes finding
an M that you trust easier.  And to that end, it doesn't matter if
those mixmasters are all running on the same host or not.

Now, my point about increased security by sender and/or receiver
running a Mixmaster remailer is that W has an easy time identifying A
and B because he can see that A sends a mixmaster message, and B
receives an ASCII message from a mixmaster remailer.  If either A or B
is running a mixmaster, W is denied knowledge that A or B even exists.
He MUST assume that anyone running a remailer is receiving or sending
some or all of the messages.  Message counting (looking for a delta
implying an internally received or transmitted message) is no help.
Since mixmaster happily ignores bogus messages, I could receive a
message, fill its packets with junk, send them one or more hops, and
let someone *else* be under suspicion of having received a message.

As an aside, the TLAs *are* looking for A's and B's.  They spend
millions of dollars a year on telephone traffic analysis.  We MUST
assume that they would spend tens of thousands of dollars a year on
email traffic analysis.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From rah at shipwright.com  Fri Jun  7 03:33:07 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 7 Jun 1996 18:33:07 +0800
Subject: <<Vitamin B>> (June 6, 1996) Reality Check
Message-ID: <v03006f1faddd5ff26300@[199.0.65.105]>


Speak of the devil...


Cheers,
Bob Hettinga

--- begin forwarded text


To: DAILY DOSE <DAILY_DOSE at notes.worldcom.com>
From: VitaminB <VitaminB at bionomics.org>
Date:  6 Jun 96 20:31:04
Subject: <<Vitamin B>> (June 6, 1996) Reality Check
Mime-Version: 1.0

Vitamin B:
                   Your Daily Dose of Bionomics

                                           June 6, 1996



Reality Check

Everyone knows that you can't predict the future.
The question is: Can traditional economics understand
the present?

Not too many years ago, on the eve of the collapse
of the Soviet Union, the leading economics textbook
had this to say:

"The Soviet economy is proof that, contrary to what
many skeptics had earlier believed, a
socialist command economy can function and
even thrive."

                      -- Paul A. Samuelson, Professor emeritus, MIT
                       (in Samuelson & Nordhaus, Economics, 1989)

We wonder what "conventional wisdom" of 1996
will prove to be as, ummm, quotable in the not too
distant future.

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From jimbell at pacifier.com  Fri Jun  7 03:52:18 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 7 Jun 1996 18:52:18 +0800
Subject: SF Bay Area Physical Cpunks Meeting, June 8th, Stanford Turing Aud
Message-ID: <199606070520.WAA26866@mail.pacifier.com>


At 07:15 PM 6/6/96 -0700, Just Rich wrote:
>This Saturday, Turing Auditorium, Noon-5. Unrestricted Ethernet
>connectivity (both thinnet and 10BaseT) will be available; email me for an
>IP address. Turing Aud has a Mac and a PC on the Net connected to an 
>EXCELLENT presentation system. If you have something you'd like to show 
>off, this is the place, and we're still short on topics.

> If you have a GPS receiver, head for 37.4296875N 122.1783752E.

That's specified to a resolution of about 2/5 of an inch.  If everyone heads 
to this exact spot, it's going to be a VERY friendly meeting!



Jim Bell
jimbell at pacifier.com





From nelson at crynwr.com  Fri Jun  7 04:06:22 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Fri, 7 Jun 1996 19:06:22 +0800
Subject: Multiple Remailers at a site?
In-Reply-To: <19960604232157.2053.qmail@ns.crynwr.com>
Message-ID: <19960607045419.11244.qmail@ns.crynwr.com>


Sorry to be following up to my own message Yet Again, but I see a hole
in my analysis that needs patching.

If you have a mixmaster host M, with certain characteristics (latency,
reordering, and traffic volume), that is NOT identical in security to
a mixmaster network M with identical characteristics, but in which
some hosts are not trustable.  The non-trustable host(s) keep track of
their latency, reordering, and traffic volume, so it's removed from
the characteristics of the network above.

Therefore, to keep the characteristics of the trusted host constant
when converting into a partially trusted network, each of the
individual hosts needs to increase their parameters by some amount
(which amount someone else will have to contribute, cuz I have no clue
and need sleep).

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From adamsc at io-online.com  Fri Jun  7 04:17:50 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 19:17:50 +0800
Subject: Clipper III analysis
Message-ID: <199606070506.WAA20841@toad.com>


On 29 May 1996 14:53:30 pdt, tcmay at got.net wrote:

>>        A good Questioned Document Examiner will be able to demonstrate
>>        that the signed document in question was not authored by Joe
>>        Blow, even if it contains his digital signature.
>
>I was of course talking about digital signatures, not handwritten signatures.
>
>I would be very interested to hear how a "Questioned Document Examiner" can
>possibly determine that a digital signature was not applied by a particular
>person.

I believe he was referring to document analysis. By closely comparing a questionable work 
with those of known authorship, a skilled analyst can hopefully find enough 
[dis]similarities to say whether a document was authored by a given person.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From adamsc at io-online.com  Fri Jun  7 04:25:32 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 19:25:32 +0800
Subject: Fwd: subscribe cyberwire dispatch
Message-ID: <199606070508.WAA20911@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "brock at well.com" <brock at well.com>
>Date: Thu, 06 Jun 96 15:37:46 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: subscribe cyberwire dispatch
>

subscribe cyberwire dispatch

If this account belongs to an actual human, my apologies for treating you
like a mailerbot.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From adamsc at io-online.com  Fri Jun  7 04:29:12 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 19:29:12 +0800
Subject: Fwd: Re: [crypto] crypto-protocols for trading card gam
Message-ID: <199606070508.WAA20910@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "cypherpunks" <cypherpunks at toad.com>
>Date: Thu, 30 May 96 01:22:36 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: [crypto] crypto-protocols for trading card gam
>

On 29 May 1996 18:57:58 pdt, alanh at infi.net wrote:

>What _did_   Solitaire do for Windows 3.1?   Distract the attention of 
>the unwashed masses away from the actual merits of the beast?

Actually, I believe it covered a direct lack thereof.
(Of course, you could have been intending this in a heavily sarcastic
form. In that case, I 
agree entirely)

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From jamesd at echeque.com  Fri Jun  7 04:34:44 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Fri, 7 Jun 1996 19:34:44 +0800
Subject: whitehouse web incident, viva la web revolution
Message-ID: <199606070652.XAA25256@dns1.noc.best.net>


I wrote:
> As usual you display profound ignorance of history and politics.

Oops!  This entire "fascism is a form of socialism" thread started
in a troll by Detwieler
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From frantz at netcom.com  Fri Jun  7 04:48:29 1996
From: frantz at netcom.com (Bill Frantz)
Date: Fri, 7 Jun 1996 19:48:29 +0800
Subject: Micropayments: myth?
Message-ID: <199606070553.WAA28796@netcom7.netcom.com>


At 10:05 PM 6/6/96 -0400, Jeff Barber wrote:
>Or are you saying that each IP packet will have an appropriately sized
>digital cash payment attached?  That seems like too much overhead.
>And besides, that contradicts your idea that the user would explicitly
>approve each wallet access.
>
>It gets even worse if you're an ISP, you obviously can't sit there
>and approve each session that goes by (even if you could distinguish
>higher level session boundaries which you won't be able to do).  Are
>you just to assume at the end of the day that everything worked
>perfectly and you received enough revenue to cover your costs without
>knowing anything about the payment/usage profiles of any of your
>customers?  And how is the ISP's network provider to know how much to
>charge the ISP?

I think I'm starting to sound like a broken record, so I'll stop with this
post.  Some of the issues you are discussing are addressed by the Digital
Silk Road proposal from Norm Hardy and Dean Tribble.

See: http://www.agorics.com/agorics/dsr.html

Bill


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From grafolog at netcom.com  Fri Jun  7 04:49:06 1996
From: grafolog at netcom.com (jonathon)
Date: Fri, 7 Jun 1996 19:49:06 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <9606061643.AA03971@Etna.ai.mit.edu>
Message-ID: <Pine.3.89.9606070553.A624-0100000@netcom2>



	Phill:

On Thu, 6 Jun 1996 hallam at Etna.ai.mit.edu wrote:

> >	circumstances.  <<  It is something like 1 chance in
> >	15 511 210 000 000 000 000 000 000.  >>
> Rubbish, 2^25 is 33,554,432. How do you calculate your figures? 

	You have one chance in three, of showing a profit, in 
	one trade.  For 25 consecutive trades to show a profit
	it is 1 chance in 3^25.  <<  Slightly lower than my original
	25!, which is what the odds are, if the trades have to
	occur in a specific sequence. >> 

> If you hit a favourable market for your strategy you can win big. 

	_If_ is the operative word there.  

> Problem is 
> that after a while others are likley to cotton on to your strategy. 

	Or in Hillary's case, no strategy at all, just
	pure, dumb luck that she caught all those
	successfull trades, and then quit.  

	Can anybody replicate her trades, on any futures market,
	and gain anything close to the success she had?  

        xan

        jonathon
        grafolog at netcom.com


**********************************************************************
*								     *
*	Opinions expressed don't necessarily reflect my own views.   *
*								     *
*	There is no way that they can be construed to represent      *
*	any organization's views.				     *
*								     *
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
*								     *
*       http://members.tripod.com/~graphology/index.html             *
*								     *
***********************************************************************







From rich at c2.org  Fri Jun  7 04:53:46 1996
From: rich at c2.org (Just Rich)
Date: Fri, 7 Jun 1996 19:53:46 +0800
Subject: SF Bay Area Physical Cpunks Meeting, June 8th, Stanford Turing Aud
Message-ID: <Pine.SUN.3.91.960606190304.8686A-100000@infinity.c2.org>


This Saturday, Turing Auditorium, Noon-5. Unrestricted Ethernet
connectivity (both thinnet and 10BaseT) will be available; email me for an
IP address. Turing Aud has a Mac and a PC on the Net connected to an 
EXCELLENT presentation system. If you have something you'd like to show 
off, this is the place, and we're still short on topics.

Graphical actualizations of ideas raised at the last meeting regarding 
crypto GUIs would be one way to use the space.

The agenda is rather slim... Hugh was working on it, but nobody seems to
have anything to say. If we get really desperate for ideas, I might end up
talking about what I've REALLY been doing for the last five months. Dave
Harman will probably miss this one, but he's still invited.

Long, anal form of the directions follows.

-rich


When:

 June 8th, Noon-5.

Where:

 Turing Auditorium, Stanford University. Directions and maps below.

Your Hosts:

 Hugh Daniels <hugh at toad.com>, speaker wrangler/emcee
 Rich Graves <llurch at networking.stanford.edu>, venue/den mother/fucking *

Amenities:

 * Seating for 100 (should be enough)
 * Plenty of white boards
 * Air conditioning
 * High-end Mac and Windoze PC on the Internet, both hard-wired into an
   EXCELLENT projection system, 800x600x16-bit or so
 * Open 10Base2 and 10BaseT Ethernet drops for your laptop, no firewall to
   Net; email rich at c2.org for IP address
 * One analog phone
 * NO munchies within 5 minutes' walk, but Rich will bring bagels
 * NO plugging your own laptops into the projection system; however, the
   Mac will have an X server and, of course, web clients

Dinner:

 Fanny & Alexander's? Or Jing Jing again?

Directions:

 If you have a GPS receiver, head for 37.4296875N 122.1783752E.

 If you have excellent hearing, call 415-853-9080 and follow the ringing.

 Or, get to Stanford's Campus Drive via 280-Sand Hill or 101-El Camino
 Real-Embarcadero. From 280, take Campus Drive left (clockwise). From 101,
 take Campus Drive right (counterclockwise). Turn South (centripetal) at
 Panama Street and take an immediate left into the Jordan Quad parking lot
 (empty on weekends). Walk between Pine and Redwood Halls to Polya. 
 Turing is between Polya and Cypress. It doesn't appear on most campus
 maps, but it's there, honest. Entrance to Turing Auditorium is by the
 Pac Bell payphone sign. 

Maps:

 http://www-leland.stanford.edu/group/Transportation/PGrid4.html (parking)
 http://www.stanford.edu/gifs/campus.1620-63-4.gif (800K campus map)
 http://www.stanford.edu/home/visitors/vicinity.html (note: upside down!)

Socialized transportation:

 CalTrain to the Palo Alto station; 20-minute walk or arrange to be picked
 up by a local. 7F bus. See http://www.stanford.edu/group/Transportation/

-rich
 quidquid latine dictum sit, altum viditur





From adamsc at io-online.com  Fri Jun  7 04:54:55 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 19:54:55 +0800
Subject: Where does your data want to go today?
Message-ID: <199606070509.WAA20975@toad.com>


On 30 May 1996 07:56:26 pdt, EALLENSMITH at ocelot.Rutgers.EDU wrote:

>From:	IN%"mclow at owl.csusm.edu"  "Marshall Clow" 29-MAY-1996 19:18:31.60
>
>>* Why encrypt before compression? If the encryption is any good, then the
>>encrypted data won't compress much at all. However, compression before
>>encryption has its own problems.
>
>	What problems does compression before encryption have? It at least
>seems to work for PGP.


The most significant would be the presence of a compression header (what
has the data 
telling how to decompress a datastream). If you leave this in (for
instance, assuming you 
were to use PKZIP (STUPID!) you would have PK as the first two bytes
EVERY TIME!) you give 
your codebreaker a HUGE advantage. You can bypass this by removing ANY
information which 
isn't message specific and standardizing on one compression method.
Alternately, you could 
use your session key to encrypt a length word and then pad the start (and
end) with a 
string of random characters.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From jf_avon at citenet.net  Fri Jun  7 04:56:05 1996
From: jf_avon at citenet.net (Jean-Francois Avon)
Date: Fri, 7 Jun 1996 19:56:05 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <9606070544.AB18682@cti02.citenet.net>


On  6 Jun 96 at 17:55, jim bell wrote:

> At 02:47 PM 6/6/96 +0000, Jean-Francois Avon wrote:
> >On  6 Jun 96 at 11:19, jim bell wrote:
> >
> >
> >> >>I _do_ believe, however, that the number of people
> >> >>unjustifiably targeted will be rather low. <snip>  Retaliation
> >> >>is possible, in
> >> >> that case.
> >
> >Sorry Jim, I did not get that at all in the past.  I assumed a
> >context where the inner workings of AP would not be well understood
> > by the population while here, you seems to indicate that everybody
> > would operate under the threat / deterrance of mutual anihilation
> >principle.
> 
> Hmmm...  sorry, I thought that was obvious.  Well, perhaps not
> "obvious," but it's one of those facts that will become second
> nature to people once AP starts up.  

Well, yes and no.  What made me change my mind is when I tried to see 
the situation from the standpoint of a guy from a thuggish mentality. 
Actually, it might not deter somebody else acting on the spur of the 
moment.  Take a typical harsh divorce situation where peoples act in 
the most surprisingly irrationnal way.  I think that ex-husbands or 
wifes would get targeted more than their fair share, and quite often, 
without any reasonable cause.

JF
 DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal
 JFA Technologies, R&D consultants: physicists, technologists and engineers.

 PGP keys at: http://w3.citenet.net/users/jf_avon
 ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 
 





From jimbell at pacifier.com  Fri Jun  7 04:59:58 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 7 Jun 1996 19:59:58 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <199606070059.RAA09341@mail.pacifier.com>


At 02:47 PM 6/6/96 +0000, Jean-Francois Avon wrote:
>On  6 Jun 96 at 11:19, jim bell wrote:
>
>
>> >>I _do_ believe, however, that the number of people unjustifiably
>> >>targeted will be rather low. <snip>  Retaliation is possible, in
>> >> that case.
>
>Sorry Jim, I did not get that at all in the past.  I assumed a 
>context where the inner workings of AP would not be well understood 
>by the population while here, you seems to indicate that everybody 
>would operate under the threat / deterrance of mutual anihilation 
>principle.

Hmmm...  sorry, I thought that was obvious.  Well, perhaps not "obvious," 
but it's one of those facts that will become second nature to people once AP 
starts up.  


>A argued that an impulsive guy might target somebody unjustifiably 
>while I overlooked that he could think twice before doing so.  But by 
>his nature, being a violent or thug at heart, he will understand this 
>"peace based on threat" maybe even better than a pacifist at heart.  
>So, my arguments might not stand.  

As can be expected, people will be looking out for themselves in an 
AP-dominated system, just as today.  I think most people will have a fairly 
good idea who's targeting them if the hit's not justified.  Almost every 
justified hit can be fairly anonymous.

Jim Bell
jimbell at pacifier.com





From llurch at networking.stanford.edu  Fri Jun  7 05:01:30 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Fri, 7 Jun 1996 20:01:30 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <2.2.32.19960606051847.006e9b18@mail.aracnet.com>
Message-ID: <Pine.GUL.3.93.960606105007.19086B-100000@Networking.Stanford.EDU>


On Wed, 5 Jun 1996, Bruce Baugh, who usually knows better, wrote:

> Fascism has no intrinsic link to genocide. It is a theory of economics,
> basically, in which the state has ultimate authority over production and
> distribution without (as in socialism) actually _owning_ the means of
> production or distribution. This is generally accomplished through
> cartelization, the creatin of industry-wide councils in which the
> representatives of the most powerful firms set policy in conjunction with
> the representatives of the government.
> 
> The US has been at least moderately fascist since the 1920s (Hoover was a
> big fan of cartelization, and pushed it actively). While the mechanisms of
> the modern regulatory state aren't those of classic fascist theory, in
> practice most strongly regulated industries in this country operate
> _exactly_ the way fascist theory says they should.
> 
> None of this is secret lore, by the way.

Yes, I'm afraid these ahistorical myths are widespread. What _do_ they teach
in these schools?

Pick up anything by Renzo De Felice to gain a basic historical understanding
of what fascism was about, from someone who was sympathetic to them. 

I'd also recommend a biography of the very influential and gifted American
modernist poet Ezra Pound, who led the Italian fascist propaganda effort
from 1941 to 1943 and spent six months in an American POW camp, followed by
some time in mental hospitals as his rants against jewish conspiracies under
every bed became increasingly incoherent, for his trouble. Like Orwell's
very complicated views towards socialism and Stalinism (see Homage to
Catalonia), e. e. cummings' anti-government pacifism, Whitman's queerness,
and Byron's essential kookiness, this is something your high school english
teacher probably failed to mention.

-rich






From adamsc at io-online.com  Fri Jun  7 05:10:10 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 20:10:10 +0800
Subject: Fwd: Re: Clipper III analysis
Message-ID: <199606070507.WAA20874@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "cypherpunks" <cypherpunks at toad.com>
>Date: Thu, 30 May 96 01:16:32 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: Clipper III analysis
>

On 29 May 1996 14:53:30 pdt, tcmay at got.net wrote:

>>        A good Questioned Document Examiner will be able to demonstrate
>>        that the signed document in question was not authored by Joe
>>        Blow, even if it contains his digital signature.
>
>I was of course talking about digital signatures, not handwritten signatures.
>
>I would be very interested to hear how a "Questioned Document Examiner" can
>possibly determine that a digital signature was not applied by a particular
>person.

I believe he was referring to document analysis. By closely comparing a
questionable work 
with those of known authorship, a skilled analyst can hopefully find
enough 
[dis]similarities to say whether a document was authored by a given
person.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================


This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From adamsc at io-online.com  Fri Jun  7 05:11:32 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 20:11:32 +0800
Subject: Possible out-of-US remailer sites, 2nd edition
Message-ID: <199606070510.WAA20995@toad.com>


From: stewarts at ix.netcom.com
To: Adamsc
Date: 31 May 1996 05:28:24 pdt
Subject: Re: Possible out-of-US remailer sites, 2nd edition

>_Country/Area_  _Name_                           _Email_
>Anguilla        Cable & Wireless                 webmaster at candw.com.ai
>Anguilla	Offshore Information Services***  info at offshore.com.ai


There are a number of small countries that aren't part of the 
US/European/Chinese/Singaporean Hegemonies, where telecom is expensive
and
Fidonets and uucp are the way to get email there.  If you're willing to
pay some money to support one, you might get some real anonymity
for financially critical data.  Also, there are periodic articles
in magazines like Wired about how George Soros is wiring the Balkans;
perhaps someone there would like to make some money running remailers.

If you are willing to go that route, you can setup a Fidonet mailer VERY
easily, and send 
mail that looks like it is from any of the 36000 bulletin boards in the
nodelist. Generally 
it will be refused by a board that has a session password. However, it is
exceedingly 
unlikely that a bbs in Singapore would have a passworded session with a
bbs in Texas.  You 
could send it randomly to a BBS using the name of another random board.
However, this would 
probably be very very very UNPOPULAR, particularly if someone got nailed
because of it. It 
would be better to work it out with some sysop in a small 3rd world
country...

Alternately, if you were to run a board, it is VERY simple to fake the
addressing on a 
Fidonet mail packet...

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From adamsc at io-online.com  Fri Jun  7 05:15:59 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 20:15:59 +0800
Subject: Fwd: Re: Possible out-of-US remailer sites, 2nd edition
Message-ID: <199606070510.WAA21002@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "cypherpunks" <cypherpunks at toad.com>
>Date: Fri, 31 May 96 23:06:02 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: Possible out-of-US remailer sites, 2nd edition
>

From: stewarts at ix.netcom.com
To: Adamsc
Date: 31 May 1996 05:28:24 pdt
Subject: Re: Possible out-of-US remailer sites, 2nd edition

>_Country/Area_  _Name_                           _Email_
>Anguilla        Cable & Wireless                 webmaster at candw.com.ai
>Anguilla	Offshore Information Services***  info at offshore.com.ai


There are a number of small countries that aren't part of the 
US/European/Chinese/Singaporean Hegemonies, where telecom is expensive
and
Fidonets and uucp are the way to get email there.  If you're willing to
pay some money to support one, you might get some real anonymity
for financially critical data.  Also, there are periodic articles
in magazines like Wired about how George Soros is wiring the Balkans;
perhaps someone there would like to make some money running remailers.

If you are willing to go that route, you can setup a Fidonet mailer VERY
easily, and send 
mail that looks like it is from any of the 36000 bulletin boards in the
nodelist. Generally 
it will be refused by a board that has a session password. However, it is
exceedingly 
unlikely that a bbs in Singapore would have a passworded session with a
bbs in Texas.  You 
could send it randomly to a BBS using the name of another random board.
However, this would 
probably be very very very UNPOPULAR, particularly if someone got nailed
because of it. It 
would be better to work it out with some sysop in a small 3rd world
country...

Alternately, if you were to run a board, it is VERY simple to fake the
addressing on a 
Fidonet mail packet...






From jamesd at echeque.com  Fri Jun  7 05:18:35 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Fri, 7 Jun 1996 20:18:35 +0800
Subject: whitehouse web incident, viva la web revolution
Message-ID: <199606070603.XAA21706@dns1.noc.best.net>


On Wed, 5 Jun 1996, Bruce Baugh, wrote:
> > Fascism [...] is a theory of economics,
> > basically, in which the state has ultimate authority over production and
> > distribution without (as in socialism) actually _owning_ the means of
> > production or distribution. .

At 11:18 AM 6/6/96 -0700, Rich Graves wrote:
>Yes, I'm afraid these ahistorical myths are widespread. What _do_ they teach
>in these schools?

As usual you display profound ignorance of history and politics.

Far from being an ahistorical myth, this is an entirely accurate description
of fascist ideology:  Or do you claim that Mussolini, Peron, etc, were not 
fascists?  Mussolini was the one who coined the name fascism.  The theory and
ideology of fascism was developed by the philosopher Giovanni Gentile, and 
there is nothing particularly racist or right wing about either Gentile or
Mussolini.

Fascism is not Republicanism on steriods, nor is it racism.  Fascism is 
basically romanticism plus socialism plus nationalism.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From adamsc at io-online.com  Fri Jun  7 05:19:54 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 20:19:54 +0800
Subject: [crypto] crypto-protocols for trading card gam
Message-ID: <199606070506.WAA20842@toad.com>


On 29 May 1996 18:57:58 pdt, alanh at infi.net wrote:

>What _did_   Solitaire do for Windows 3.1?   Distract the attention of 
>the unwashed masses away from the actual merits of the beast?

Actually, I believe it covered a direct lack thereof.
(Of course, you could have been intending this in a heavily sarcastic form. In that case, I 
agree entirely)

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From hallam at Etna.ai.mit.edu  Fri Jun  7 05:21:56 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Fri, 7 Jun 1996 20:21:56 +0800
Subject: Anonymous stock trades.
Message-ID: <9606062327.AA04162@Etna.ai.mit.edu>



>I suppose it depends on what you call "open", eh, Phill?

>If by "open", you mean financial markets where, as Milton Freedman says,
>each new regulation raises the cost of entry and protects the surviving
>firms by killing their smaller competion with red tape, then we have "open"
>markets.

Well, Milton Friedman's method for saving the whale is to leave it to the free 
market, if people want whales in the oceans they won't buy whale meat. The point 
that even if no US person eats whale, a few thousand "gourmets" in Japan can eat 
their way through the remaining stocks of many species in a few years escapes 
him. So forgive me if if find you authority somewhat less than compelling.

Adam Smith makes the point rather better in his analysis of monopolies and how 
they affect the market. But remember that although regulations may be instituted 
as protectionist mechanisms that is not the only purpose that regulations are 
introduced.


>If by "open", you mean that people can't purchase the attention of their
>favorite politician fair and square, without having to play zero-sum games
>with barnyard animals, then we have "open" markets. ;-).

There are so many negatives in that sentence I can't figure out which way you 
are arguing. Certainly there are many senators, congressman etc who can be 
bought for a contribution to their election fund or a huge advance on their 
memoirs. 


>Nothing personal, Phill, but it does seem like it's more a question of what
>you're afraid of, than what *is*, right?

No, it is a case of whether you are applying ideological judgements or prepared 
to analyse the system itself. I do not believe in the idol of the free market. I 
do not consider ecconomists to have justified the level of inane self-satisfied 
certainty about their field that they exude. I was talking to a professor at the 
Sloane school yesterday who made precisely this point.

Deciding what is right implies an ethical judgement. Are you basing your 
argument on Kantian or consequentialist assumptions? I can argue either but 
since most of my thesis is based on a logical positivist approach I'm far more 
sympathetic to the utilitarian point of view.


The free market is not in itself an ethical basis - that would be creating an 
ought from an is. The problem which libertarian idelogues are affraid to face up 
to is that markets have required regulation to keep them open and free. Its all 
very well for people to jump up and down, stampt their feet and claim the 
opposite but this is what every government in the free world believes. The 
effects of deregulation in the savings and loans area make it unlikely any 
further experiments in that area will be tried for a while.


		Phill







From minow at apple.com  Fri Jun  7 05:25:27 1996
From: minow at apple.com (Martin Minow)
Date: Fri, 7 Jun 1996 20:25:27 +0800
Subject: Norton Eyes only
Message-ID: <v02140b05addcfddf88c4@[17.202.12.102]>


>
>Has anyone been able to analyse the 'patent pending', 'on-the-fly'
>encryption in Norton's 'For your eyes only'?
>

Why bother? If it's freely exportable, we have a good estimate of
it's cryptographic strength :-)

Martin.








From stewarts at ix.netcom.com  Fri Jun  7 05:32:40 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Fri, 7 Jun 1996 20:32:40 +0800
Subject: ID this 31173 NCR keyboard
Message-ID: <199606070859.BAA24803@toad.com>


Does it have any identifying numbers?
NCR OEMed a line of ADDS Viewpoint terminals for a while,
and while the numbers no longer come to mind
(unless they're like 2920), they might look familiar
if I saw them.  This keyboard sample doesn't look
quite like them, though.  Most of their keyboards
like that were for terminals, not for PCs.
Are the connectors even PC-like?

Also, if there are function keys through F20, it might very
well be a 3270-emulator of some sort.

At 01:52 PM 6/6/96 -0700, you wrote:
>Oops.  I wrote that just looking at the keyboard.
>Picked it up at Seattle's Ex-Pc for $3.
>It's so old, I think it requires a non-PC BIOS.
>No manual, labels etc.
>
>Anyone have a clue as to what this is:
>
>NCR
>
>F1 F2          [...]               F18 F19 F20/RESET|
>ESC            [...]     TAB             |[five direction keys]
>CONTROL Q      [...]     }/] CONTROL     |CLR 7 8 9 /
>CAPS_LOCK A    [...]      ~/` |NEW       |  - 4 5 6 *
>[up] |/\ Z     [...]   [upup] |LINE      |  + 1 2 3 |NEW
>               [space]                   |  0_ 00 . |LINE
>
>It was designed for easily customizing your keytable,
>being an actual flat terminal with square keys easily
>pulled out and interchanged.
>
>The back of the keyboard has three switches for
>the boolean selection of languages: US English,
>UK/Int. English, French, German, Swedish/Finnish,
>Danish/Norwegian, Spanish, Italian.
>
>So, where to get a NEW keyboard like this:
>
>FLAT, with a full set of SQUARE, EASILY pulled out keys.
>
>
>
#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Rescind Authority!






From stewarts at ix.netcom.com  Fri Jun  7 05:32:53 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Fri, 7 Jun 1996 20:32:53 +0800
Subject: Cost of brute force decryption
Message-ID: <199606070859.BAA24817@toad.com>


At 02:44 PM 6/5/96 -0700, you wrote:
>> > 	"For example a 40-bit key takes about $10,000 worth of supercomputer 
>> > time and two weeks to crack.  Although this key may be adequate to 
>> > protect my checking account, it's probably not large enough for the 
>> > accounts of a major corporation.
>> The figures look familiar.  No references around.  I'm not sure it would 
>> require a whole two weeks for 40-bits, though.  Possibly less than a 
>> day? (Or was that why you asked baout the figures?)

It was from The Newspapers, of course :-)  The "$10,000 of supercomputer time"
was in an initial press release description by somebody in Netscape or RSA
after the RC4/40 Netscape crack, and was way high.  (Check Altavista...)

However, it's not too far off for the cost of a DES crack, where "supercomputer"
is defined as "a special-purpose cracking machine" rather than "a Cray"..
(Maybe an order of magnitude high for that.)  And the description of
$10,000 as "maybe enough to protect my checking account, but not large enough
for the accounts of a major corporation" is about right.  
#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Rescind Authority!






From declan+ at CMU.EDU  Fri Jun  7 05:34:54 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 7 Jun 1996 20:34:54 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SOL.3.91.960605065515.19215C-100000@ion1.ionet.net>
Message-ID: <Mlhv4sG00YUz4x13wH@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 5-Jun-96 Re: On the Hill: Child
Porn.. by Jeffrey A Nimmo at ionet.ne 
> I've heard of this kind of thing before. Individuals have already been 
> sent to jail for doing this, as well as doing and 
> distributing kiddie porn drawings. 
>  
> I suspect that since it's already illegal on the state level, that 
> Congress is looking into making it a federal crime to distribute them 
> over state lines via the Internet.


FYI -- I have a link to Bob Chatelle's Toni Marie Angeli "child porn"
case (photos of her kid for a Harvard class) at http://joc.mit.edu/

-Declan






From adamsc at io-online.com  Fri Jun  7 05:39:46 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 20:39:46 +0800
Subject: Class III InfoWar
Message-ID: <199606070507.WAA20868@toad.com>


On 2 Jun 1996 03:06:14 pdt, hal9001 at panix.com wrote:

>At 21:33 -0400 6/1/96, winn at Infowar.Com wrote:
>
>
>>The article discussed the advanced information warfare techniques used by the
>>perpetrators. "According to the American National Security Agency (NSA), they
>>have penetrated computer systems using 'logic bombs' (coded devices that
>>can be
>>remotely detonated)
>
>Unless the definition has changed recently, a "logic bomb" is normally a
>piece of code in a program that is triggered when a specific event occurs
>(such as the programmer's name not appearing in a payroll file for a
>designated period of time [which might trigger a salami round off routine
>to start cutting checks 2 months after s/he is no longer working for the
>company]).

I believe that is what they were referring to. However, the press garbled it as usual. It 
seems like the original was something like 'logic bombs' (bits of code that can be 
triggered remotely). Probably sounded more impressive the reporter's way...

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From declan+ at CMU.EDU  Fri Jun  7 05:40:07 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 7 Jun 1996 20:40:07 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SOL.3.91.960605153106.26199C-100000@ion1.ionet.net>
Message-ID: <IlhvdRi00YUz4xgRNx@andrew.cmu.edu>


I should have said that (A) (B) and (C) are linked by OR, not by AND.

-Declan

Excerpts from outbox: 7-Jun-96 Re: On the Hill: Child Porn.. by =>
cypherpunks at toad.com 
> (A) the production of such visual depiction involves the use of a minor
> engaging in sexually explicit conduct;
>  
> (B) such visual depiction is, or appears to be, of a minor engaging in
> sexually explicit conduct;
>  
> (C) such visual depiction is advertised, promoted, presented, or
> distributed in such a manner that conveys the impression that the
> material is or contains a visual depiction of a minor engaging in
> sexually explicit conduct.







From adamsc at io-online.com  Fri Jun  7 05:47:35 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 20:47:35 +0800
Subject: Fwd: Second email address
Message-ID: <199606070508.WAA20917@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "sysop at io-online.com" <sysop at io-online.com>
>Date: Mon, 03 Jun 96 19:50:50 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Second email address
>

How much would it be to get a second email address? (Just POP access.
Doesn't even need to 
be able to send mail) That way I could have an address to send stuff like
mailing lists to.

Also: Web pages - I believe I saw something that mentioned that some
space was included 
w/the subscription. How much, and how do I access it?

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From nelson at crynwr.com  Fri Jun  7 05:51:46 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Fri, 7 Jun 1996 20:51:46 +0800
Subject: Multiple Remailers at a site?
In-Reply-To: <19960604232157.2053.qmail@ns.crynwr.com>
Message-ID: <19960606195025.9398.qmail@ns.crynwr.com>


Scott Brickner writes:
 > nelson at crynwr.com writes:
 > >Scott Brickner writes:
 > > > If the remailer does a good job with the delays and shuffling, then
 > > > it becomes difficult for the analyst to match message a with
 > > > message b, leaving him with what he already knew (that A and
 > > > RemailerX have a common interest, as to B and RemailerX, but the
 > > > interests may be wholly unrelated).
 > >
 > >Nope.  Not if each of them runs a remailer.  That's why mixmaster is
 > >SO WONDERFUL.
 > 
 > The "to" and "from" values that the traffic analyst will be using
 > are the IP addresses in the packets.  It doesn't matter whether
 > mixmaster, cypherpunks, or penet remailers are used, they still use
 > IP addresses.

Sure *does* matter.  There's no computationally feasible way to
associate one mixmaster message with another.  The only way you can
get a clue is by analyzing who sends mail into and out of the
mixmaster system.  If both of your endpoints are within the mixmaster
system, you have no entering or exiting mail to analyze.  It doesn't
matter if the mixmaster remailers are on the same or different systems.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From hugh at ecotone.toad.com  Fri Jun  7 05:55:55 1996
From: hugh at ecotone.toad.com (Hugh Daniel)
Date: Fri, 7 Jun 1996 20:55:55 +0800
Subject: MEETING:  SF Bay area Cypherpunks meeting for June 8th
Message-ID: <199606070640.XAA14607@ecotone.toad.com>



What:	Monthly meeting of San Francisco area Cypherpunks &
	Stanford PGP Club
When:	Saturday June 8th 12:00 noon
Where:	Turing Auditorium, Stanford University (Directions below)
Dinner: Fanny & Alexander's  412 Emerson, Palo Alto, +1 415 326 7183

Topics: Random, PGP Keys siging, More on Crypto GUI's, Random.

Directions:

 If you have a GPS receiver, head for 37.4296875N 122.1783752E.

 If you have excellent hearing, call 415-853-9080 and follow the ringing.

 Or, get to Stanford's Campus Drive via 280-Sand Hill or 101-El Camino
 Real-Embarcadero. From 280, take Campus Drive left (clockwise). From 101,
 take Campus Drive right (counterclockwise). Turn South (centripetal) at
 Panama Street and take an immediate left into the Jordan Quad parking lot
 (empty on weekends). Walk between Pine and Redwood Halls to Polya. 
 Turing is between Polya and Cypress. It doesn't appear on most campus
 maps, but it's there, honest. Entrance to Turing Auditorium is by the
 Pac Bell payphone sign. 

Maps:

 http://www-leland.stanford.edu/group/Transportation/PGrid4.html (parking)
 http://www.stanford.edu/gifs/campus.1620-63-4.gif (800K campus map)
 http://www.stanford.edu/home/visitors/vicinity.html (note: upside down!)

Socialized transportation:

 CalTrain to the Palo Alto station; 20-minute walk or arrange to be picked
 up by a local. 7F bus. See http://www.stanford.edu/group/Transportation/

Notes:
  The short notice is my fault, I was hoping to get some folks to talk
at the meeting and waited far too long to give up on them.

Thanks:
  Much thanks to Rich Graves and the Stanford PGP Club for the wonderful
meeting space.





From declan+ at CMU.EDU  Fri Jun  7 05:57:45 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 7 Jun 1996 20:57:45 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <4p370g$r77@life.ai.mit.edu>
Message-ID: <Ilhv_bu00YUzIx19wP@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 5-Jun-96 Re: whitehouse web
incident.. by Hallam-Baker at ai.mit.edu 
> I find Meeks' style somewhat tiresome. It is tabloid jornalism
> rather than reasoned argument. His dislike for the Clinton is 
> well known - he recently accused the administration of being
> fascist. I know of no evidence that the Clinton administration

Phillip:

I'll let Brock defend himself. I will, however, say that my
conversations with him indicate that he probably dislikes Dole and
Clinton equally -- or, if you prefer, likes one as much as the other.

-Declan






From stewarts at ix.netcom.com  Fri Jun  7 05:59:43 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Fri, 7 Jun 1996 20:59:43 +0800
Subject: WWW servers.
Message-ID: <199606070859.BAA24808@toad.com>


Black Unicorn:
>> Does there currently exist a system which permits webservers to restrict 
>> access to clients who have a given certification?

Sameer:
>	Yup.
....
>	=) Stronghold: The Apache-SSL-US, coupled with XCert
>Sentry. What else?

Of course, there's a simpler approach; restrict access to people
who have logins and passwords, and only give those to people
who have the certification...
#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Rescind Authority!






From adam at homeport.org  Fri Jun  7 06:03:37 1996
From: adam at homeport.org (Adam Shostack)
Date: Fri, 7 Jun 1996 21:03:37 +0800
Subject: Security of PGP if Secret Key Available?
In-Reply-To: <199606061756.NAA16447@toxicwaste.media.mit.edu>
Message-ID: <199606070010.TAA05952@homeport.org>


Leave it for 3.1.  There are worse programs being advanced because
people feel we're waiting too long for PGP3.

Derek Atkins wrote:

| PGPlib has an interface to encrypt the whole keyring, however that
| probably isn't going to be fully implemented unless time permits.
| This interface allows you to encrypt the WHOLE keyring in a
| passphrase, which includes not only the secret components, but the
| public components as well.  However I don't know if I'll have the time
| to get to it.

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From adamsc at io-online.com  Fri Jun  7 06:05:11 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 21:05:11 +0800
Subject: Fwd: Re: INteresting tidbit
Message-ID: <199606070507.WAA20878@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "cypherpunks" <cypherpunks at toad.com>
>Date: Wed, 29 May 96 22:36:17 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: INteresting tidbit
>

>On the Encryption note, and I swear not along the lines of the 'DOJ' 
>and 'FBI Snooping' Big-Brother events, I heard another story recently.
>
># begin story
>
>A person working on the MBONE project did an unannounced experiment
>across the internet using Triple-DES for MBONE, and the very next day, 
>'ATF' agents knocked on his door and warned him against exporting 
>munitions.  The experimentor was shaken by the fact that agents 
>approached him so quickly after the experiment.
>
># end story
>
>Extrapolations of fact:
>   1.   Internet traffic is monitored.
>   2.   The ability to snoop for encrypted traffic is present
>   3.   The ability to identify encryption levels is present
>        (How else can they differentiate DES-1 from DES-3?)
>   4.   The ability to crack DES-1 in near real-time mode is present.
>        (See above).
First, this has been loosely confirmed for ages. Someone was mentioning
that FBI offices 
supposedly have software that (on a 486) can crack a DES-1 key in under
an hour. Multiply * 
modern high capacity computers = problem.  However, this does not
nessesarily follow from 
#3. First off, you could probably tell the encryption used from a file
format; the software 
on the other end has to know what it's getting. Secondly, you could
probably tell quite a 
lot about what was used by some intense analysis.
Finally, if their software cannot read it and analysis suggested it was
more than DES-1 
then they might go after someone w/o being able to read the document in
question.
>   5.   If above=true, then Feds dropping the Zimmerman PGP case probably
>        also points to it also being crackable in a similar manner.
Not necessarily. This freemen issue shows that the FBI is getting gunshy
about bad 
publicity, which they were getting.
>   6.   Using encryption only flags traffic for capture and decryption, 
>        using strong encryption makes you all that more interesting.
Sounds like the old argument for encrypting everything...

>Sorry, couldn't resist.  I'll try not to start a threads about 
>electro-plasma propulsion craft at Area 51, metallic-ceramic skin 
>and pulse-jets on the Aurora spy plane, heat-imaging video cameras 
>on satellites and planes that can watch you through your houses' roof, 
>etc.  :)

What??? Now you're going to tell us X-Files is just a TV show? <g>

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From perry at piermont.com  Fri Jun  7 06:06:02 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Fri, 7 Jun 1996 21:06:02 +0800
Subject: InfoSec Spin
In-Reply-To: <199606061713.RAA23573@pipe1.t2.usa.pipeline.com>
Message-ID: <199606061933.PAA15452@jekyll.piermont.com>



John Young writes:
>       In cyberspace, where hackers are finding commercial 
>       computer systems easy prey, businesses are choosing to 
>       hire free-lance security teams rather than involve the 
>       law. A Senate subcommittee heard Wednesday from experts 
>       who described how businesses, concerned over negative 
>       publicity, avoid reporting hacker assaults on their 
>       networked computer system.

Shocking, that.

Of course this happens. I mean, its part of my bread and
butter. However, this shouldn't be surprising -- businesses have
ALWAYS operated this way, whether on shoplifting or catching employees
with their hands in the kitty or hacking. It is not only a question of
avoiding embarassment, but also a question of having different
interests from law enforcement. The company wants safety, not
convictions. They don't have to worry about warrants or absolute proof
-- they only have to worry about their actions being defensible in a
civil suit. This makes their operations in such cases very different indeed.

Perry





From adamsc at io-online.com  Fri Jun  7 06:08:01 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 21:08:01 +0800
Subject: Fwd: Re: forged addresses
Message-ID: <199606070507.WAA20872@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "cypherpunks" <cypherpunks at toad.com>
>Date: Thu, 30 May 96 01:32:54 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: forged addresses
>

On 29 May 1996 19:38:16 pdt, nobody at nowher.com wrote:

>Hi, I'm not sure if there was ever a thread on this, but I was wondering if 
>anyone can determine your real email address, if you were to fake it to your 
>email client.
>
>I hope that this doesn't offend anyone, since this is a high traffic list, but 
>I was wondering if this would work.  To try it out, I setup my client to think 
>I was someone else, and sent myself an email.  I could only figure out what 
>ISP it came from.
>
>What I would like to know is, can any of the experts on this list determine my 
>address from the header of this post??
I didn't receive anything except your nobody at ... address.
>again, if this is something that I shouldn't have done, just let me know, and 
>it won't happen again.
>
 Hmmm... I'm going to have to play around with this. I can get outbound
email access 
through my school district's mailserver simply by filling in the
appropriate fields in 
netscape (we have a WAN hooked up to a T1).  It would seem to me that
this would be rather 
secure for several reasons, if for no other than that NO logging is
made... In a large 
district, like mine (probably 10-15 thousand potential users), I doubt
they would have the 
resources to track any of the 100 or so Internet machines on my campus
alone, even if they 
could tell it came from here.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From bogus@does.not.exist.com  Fri Jun  7 06:08:45 1996
From: bogus@does.not.exist.com ()
Date: Fri, 7 Jun 1996 21:08:45 +0800
Subject: ID this 31173 NCR keyboard
Message-ID: <199606062052.NAA08300@netcom19.netcom.com>


! At 05:46 PM 6/3/96 -0700, you wrote:
! >ncr terminals are the most 31173 D0Dz
! 
! I'm guessing that "D0Dz" is a variant on "dudes";
! is "31173" supposed to be an upside-down "ElliE"?
! Having worked at NCR, I like their cash-machines and cash-registers,
! dislike the Microchannels in some of their PCs, 
! dislike the terminals they used to make (I think SunRiver
! is the current manufacturer for that product line)
! and like their Teradata descendants.
! #				Thanks;  Bill
! # Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
! # http://www.idiom.com/~wcs
! #				Rescind Authority!

Oops.  I wrote that just looking at the keyboard.
Picked it up at Seattle's Ex-Pc for $3.
It's so old, I think it requires a non-PC BIOS.
No manual, labels etc.

Anyone have a clue as to what this is:

NCR

F1 F2          [...]               F18 F19 F20/RESET|
ESC            [...]     TAB             |[five direction keys]
CONTROL Q      [...]     }/] CONTROL     |CLR 7 8 9 /
CAPS_LOCK A    [...]      ~/` |NEW       |  - 4 5 6 *
[up] |/\ Z     [...]   [upup] |LINE      |  + 1 2 3 |NEW
               [space]                   |  0_ 00 . |LINE

It was designed for easily customizing your keytable,
being an actual flat terminal with square keys easily
pulled out and interchanged.

The back of the keyboard has three switches for
the boolean selection of languages: US English,
UK/Int. English, French, German, Swedish/Finnish,
Danish/Norwegian, Spanish, Italian.

So, where to get a NEW keyboard like this:

FLAT, with a full set of SQUARE, EASILY pulled out keys.






From elam at art.net  Fri Jun  7 06:11:59 1996
From: elam at art.net (Lile Elam)
Date: Fri, 7 Jun 1996 21:11:59 +0800
Subject: Senate Staff Report...
Message-ID: <199606062147.OAA10230@art.net>



Hi all,

Does anyone know the location on the web of the Senate staff report
that was presented on some Wednesday? I read an article about it
on the sjmercury that says people with computers do not consider
security a high priority...

I am curous what else the report says...

thanks,

-lile






From tcmay at got.net  Fri Jun  7 06:12:26 1996
From: tcmay at got.net (Timothy C. May)
Date: Fri, 7 Jun 1996 21:12:26 +0800
Subject: "Fascism is corporatism"
Message-ID: <addcfd85030210047ae2@[205.199.118.202]>


At 6:18 PM 6/6/96, Rich Graves wrote:
>On Wed, 5 Jun 1996, Bruce Baugh, who usually knows better, wrote:
>
>> Fascism has no intrinsic link to genocide. It is a theory of economics,
>> basically, in which the state has ultimate authority over production and
>> distribution without (as in socialism) actually _owning_ the means of
>> production or distribution. This is generally accomplished through
>> cartelization, the creatin of industry-wide councils in which the
>> representatives of the most powerful firms set policy in conjunction with
>> the representatives of the government.
...
>Yes, I'm afraid these ahistorical myths are widespread. What _do_ they teach
>in these schools?
>
>Pick up anything by Renzo De Felice to gain a basic historical understanding
>of what fascism was about, from someone who was sympathetic to them.

Rich, I don't think it nearly so clear as you are claiming. The definition
of fascism, that is. Without resorting to the usual ploy of quoting
Webster's (a ploy I usually am not impressed by), let me cite an
"anti-fascist" radio personality, Dave Emory, who I have been listening to
nearly every week for several years.

Dave is undeniably anti-fascist, an unusual mixture of left-leaning views
and National Rifle Association sympathies, and he often quotes Mussolini's
famous "Fascism is corporatism" line. That is, a view more similar to Bruce
Baugh's point that fascism is primarily an economic theory, about the
organization and ownership of production systems, than about hatred of any
particular ethnic group.

It is certainly true that Italian and German fascism (and the important
variant of "national socialism") become intertwined with certain forms of
racism, with which we are all familiar, but I don't think Bruce is at all
wrong in his definition of fascism. That Hitler and his group combined
fascist economic theories with occultist views of racial superiority does
not mean the two viewpoints are identical.

("Fascism is corporatism" is of course not an overall indictment of all
corporations. "Corporatism" is basically a view that government should
identify key industries and corporations and then pick the winners and
support them while suppressing their competitors. This oversimplifies what
Mussolini, Emory, myself, etc. mean by "corporatism," but I hope this gives
at least a glimpse. And we could get off into discussions of "state
capitalism" and how the Soviet and Chinese forms of government were
essentially examples of "state capitalism," but this would be a long and
involved debate.)


>I'd also recommend a biography of the very influential and gifted American
>modernist poet Ezra Pound, who led the Italian fascist propaganda effort
>from 1941 to 1943 and spent six months in an American POW camp, followed by
>some time in mental hospitals as his rants against jewish conspiracies under
>every bed became increasingly incoherent, for his trouble. Like Orwell's
>very complicated views towards socialism and Stalinism (see Homage to
>Catalonia), e. e. cummings' anti-government pacifism, Whitman's queerness,
>and Byron's essential kookiness, this is something your high school english
>teacher probably failed to mention.

My high school teachers failed to mention much of anything, but this was
hardly surprising to me--I never expected them to. Fortunately, I knew how
to read, and so I learned all of these things. (Except for Pound, whom I
didn't encounter until my first year in college.)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From attila at primenet.com  Fri Jun  7 06:17:13 1996
From: attila at primenet.com (attila)
Date: Fri, 7 Jun 1996 21:17:13 +0800
Subject: Hackers prevent Crackers!
Message-ID: <199606070435.VAA21846@primenet.com>


Addressed to: Cypherpunks <cypherpunks at toad.com>
              Black Unicorn <unicorn at schloss.li>


** Reply to note from Black Unicorn <unicorn at schloss.li> 06/06/96   
03:05am -0400  
  
= > Actually, he's probably right. If all the cypherpunks, say, turned    
= > "bad," there'd be no government and no economy, because so many big    
= > systems are so insecure.   
=    
= One could make the case that this would actually make the United     
= States(if c'punks concentrated their attentions there) the most data     
= secure country on the planet over time.   
=   
  
	regardless of their opinion on hackers, that is what secuirty  
    is all about.  the same is not true for crackers --maybe we need to  
    run a campaign with the slogan of:   
  
		Hackers (help) prevent Crackers!  
  


--
the last free election in the United States was in 1860.






From unicorn at schloss.li  Fri Jun  7 06:21:35 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Fri, 7 Jun 1996 21:21:35 +0800
Subject: WWW servers.
Message-ID: <Pine.SUN.3.91.960606161633.1329A-100000@polaris>



Does there currently exist a system which permits webservers to restrict 
access to clients who have a given certification?

What is the current certification practice?

How easy is it to certify a given client?

Are webserver certifications sufficently secure today?

What are the best servers to use for secure web pages and certification 
currently in the United States?

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From qut at netcom.com  Fri Jun  7 06:22:27 1996
From: qut at netcom.com (harman.david)
Date: Fri, 7 Jun 1996 21:22:27 +0800
Subject: You're a Twit! [ ]   [And, a jackass]
In-Reply-To: <199606062134.OAA20430@Networking.Stanford.EDU>
Message-ID: <199606062147.OAA13396@netcom2.netcom.com>


> The message with headers below has been received and set aside for careful
> handling by carbon-based units. Thank you so much for your contribution to
> global understanding.
> 
> Love,
> Rich's Twit Acknowledger
> 
> >From qut at netcom.com Thu Jun  6 14:34:48 1996
> Received: from boron.Stanford.EDU (boron.Stanford.EDU [36.56.0.10]) by Networking.Stanford.EDU (8.7.5/8.6.6) with ESMTP id OAA20426 for <llurch at networking.stanford.edu>; Thu, 6 Jun 1996 14:34:48 -0700
> Received: from netcom2.netcom.com (qut at netcom2.netcom.com [192.100.81.108]) by boron.Stanford.EDU (8.7.5/8.7.3) with SMTP id OAA16925 for <llurch at stanford.edu>; Thu, 6 Jun 1996 14:34:45 -0700 (PDT)
> Received: (from qut at localhost) by netcom2.netcom.com (8.6.13/Netcom)
> 	id OAA12280; Thu, 6 Jun 1996 14:34:46 -0700
> Date: Thu, 6 Jun 1996 14:34:46 -0700
> From: qut at netcom.com (harman.david)
> Message-Id: <199606062134.OAA12280 at netcom2.netcom.com>
> To: llurch at stanford.edu

Oh, did I miss the Cypherpunk announcment or something?
Do I care?
Isn't cypherpunking rather elitist?
Isn't elitism a signatory of worthless knowledge?

Hey, look at me, I'm elite!



-- 
Love,
Qut at netcom.com







From vznuri at netcom.com  Fri Jun  7 06:25:29 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Fri, 7 Jun 1996 21:25:29 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606060257.TAA16018@netcom.netcom.com>
Message-ID: <199606061924.MAA10732@netcom10.netcom.com>



I believe that micropayments will revolutionize business
transactions, and that they are entirely feasible, and have
written on the subject on cpunks intermittently. NS starts
out with some opposite assumptions, which I don't really
think are entirely plausible.

>Consider a feature fairly independent of the particular payment system: 
>the statement of charges.  Here lies a tradeoff here between completeness 
>and complexity.   On the one hand, merely summarizing charges creates 
>the opportunity for salami frauds, allowing widely distributed false or 
>exaggerated microcharges to go undetected.  Furthermore, parties reading 
>only the summaries get no feedback by which they can adjust their behavior
>to minimize costs.

dunno what you are talking about here. with micropayments, why would
you necessarily have statements? you're using an old billing model
on a new paradigm. please establish a *context*. it would be ridiculous
if people submitted "microbills" to companies that responded with
"micropayments". that's the wrong model.

here's how people are talking about micropayments. imagine that
you see a link with a little 5c sign next to it. that means when
you click on it, you are automatically debited 5c. your own browser
can handle keeping your own records. the transaction occurs when
you hit the button. the idea of a bill being submitted, that you seem to
be suggesting with your idea, doesn't make sense. another example:
downloading an FTP file.  the whole idea of billing is thrown away
in favor of immediate processing.

  On the other hand, a statement too complex to
>be easily read also allows fraud, error, and inefficient usage to 
>go unrecognized, because one or both parties cannot understand the 
>rationale for the charges in relation to the presumed agreement on
>terms of service and payment. 

again, this doesn't make sense at all to me. "statements, bills, 
summaries"-- these are all things you require for larger size
transactions. if after a day of net surfing I have spent $3.16,
and my browser kept a record of every case where I paid it out,
what's the problem? the browser does not pay unless I click somewhere.
nobody submits bills to my browser.  all actions are initiated by
me.

>There seems to lie here a fundamental cognitive bottleneck, creating a
>limit to the granularity of billable transaction size whether electronic
>or physical.

"fundamental cognnitive bottleneck"?? not in my brain. perhaps you
should check your own equipment <g>

  One proposed solution to this has been "intelligent 
>agents".  But since these agents are programmed remotely, not by the 
>consumer, it is difficult for the consumer to determine whether the agent
>is acting the consumers' best interests, or in the best interests
>of the counterparty -- perhaps, necessarily, at least as difficult 
>as reading the corresponding full statement of charges. 

it doesn't make sense at all for one to give autonomous capability
to agents to spend money, at least until they have been refined.
I don't see where agents fit into this all in the beginning. you're
putting the cart before the horse. I've never seen micropayments
discussed in the context you are putting them in. (no wonder it
is causing you "cognitive dissonance"). the uses you cite may not
appear until long into the future. in the meantime the model I wrote
about above has no problems you cite that I can tell.

  By
>sleight of hand we may have merely transformed the language of 
>the transaction as it needs to be understood by the party, without
>reducing the complexity to be understood.  Furthermore, the user 
>interface to enable consumers to simply express their sophisticated 
>preferences to an agent is lacking, and may represent another fundamental 
>cognitive bottleneck.

you are tackling a different problem. "how can we get reliable agents
that can be trusted with buying decisions". this has nothing or little
to do with "the feasibility of micropayments". micropayments are not
necessarily tied to agents.

>Telephone companies have found billing to be a major bottleneck.
>By some estimates, up to 50% of the costs of a long distance call
>are for billing, and this is on the order of a $100 billion per year
>market worldwide.  Internet providers have been moving to a flat fee in 
>order to minimize these costs, even though this creates the incentive for 
>network resource overusage.  

imagine a user who controls his own wallet. he knows when he is paying
from that wallet. you seem to have this idea that outsiders could
make queries to that wallet that would be hard for the consumer to
keep track of. this makes no sense to me. the wallet action will always
be tied with some other action. the user picks up the phone to dial
somewhere, and it says, "that will be .3c-- will you pay"? he says
yes. 

>A micropayments system assumes a solution to the billing problem.

as I wrote, I don't imagine a billing system at all in terms of
micropayments. its the wrong model. in a billing system, the bill
and the action are not tied tightly together. person does [x] and
receives bill 3 days later or whatever. with micropayments, you
will have instantaneous transactions.

>If somebody could actually solve the this problem, rather 
>than merely claiming to have solved it via some mysterious
>means ("intelligent agents", et. al.), the savings would be 
>enormous even in existing businesses such as long distance and
>Internet service -- never mind all the new opportunities made
>possible by micropayments.  

wow, I think I've solved it. you can nominate me for some award
now <g>






From adamsc at io-online.com  Fri Jun  7 06:40:05 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 21:40:05 +0800
Subject: Fwd: Re: Clipper III analysis
Message-ID: <199606070509.WAA20971@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "cypherpunks" <cypherpunks at toad.com>
>Date: Thu, 06 Jun 96 16:51:18 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Fwd: Re: Clipper III analysis
>

==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "cypherpunks" <cypherpunks at toad.com>
>Date: Thu, 30 May 96 01:16:32 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: Clipper III analysis
>

On 29 May 1996 14:53:30 pdt, tcmay at got.net wrote:

>>        A good Questioned Document Examiner will be able to demonstrate
>>        that the signed document in question was not authored by Joe
>>        Blow, even if it contains his digital signature.
>
>I was of course talking about digital signatures, not handwritten signatures.
>
>I would be very interested to hear how a "Questioned Document Examiner" can
>possibly determine that a digital signature was not applied by a particular
>person.

I believe he was referring to document analysis. By closely comparing a
questionable work 
with those of known authorship, a skilled analyst can hopefully find
enough 
[dis]similarities to say whether a document was authored by a given
person.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================


This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From bogus@does.not.exist.com  Fri Jun  7 06:44:48 1996
From: bogus@does.not.exist.com ()
Date: Fri, 7 Jun 1996 21:44:48 +0800
Subject: ID this 31173 NCR keyboard
Message-ID: <199606062051.NAA08276@netcom19.netcom.com>


! At 05:46 PM 6/3/96 -0700, you wrote:
! >ncr terminals are the most 31173 D0Dz
! 
! I'm guessing that "D0Dz" is a variant on "dudes";
! is "31173" supposed to be an upside-down "ElliE"?
! Having worked at NCR, I like their cash-machines and cash-registers,
! dislike the Microchannels in some of their PCs, 
! dislike the terminals they used to make (I think SunRiver
! is the current manufacturer for that product line)
! and like their Teradata descendants.
! #				Thanks;  Bill
! # Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
! # http://www.idiom.com/~wcs
! #				Rescind Authority!

Oops.  I wrote that just looking at the keyboard.
Picked it up at Seattle's Ex-Pc for $3.
It's so old, I think it requires a non-PC BIOS.
No manual, labels etc.

Anyone have a clue as to what this is:

NCR

F1 F2          [...]               F18 F19 F20/RESET|
ESC            [...]     TAB             |[five direction keys]
CONTROL Q      [...]     }/] CONTROL     |CLR 7 8 9 /
CAPS_LOCK A    [...]      ~/` |NEW       |  - 4 5 6 *
[up] |/\ Z     [...]   [upup] |LINE      |  + 1 2 3 |NEW
               [space]                   |  0_ 00 . |LINE

It was designed for easily customizing your keytable,
being an actual flat terminal with square keys easily
pulled out and interchanged.

The back of the keyboard has three switches for
the boolean selection of languages: US English,
UK/Int. English, French, German, Swedish/Finnish,
Danish/Norwegian, Spanish, Italian.

So, where to get a NEW keyboard like this:

FLAT, with a full set of SQUARE, EASILY pulled out keys.






From adamsc at io-online.com  Fri Jun  7 06:47:30 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 21:47:30 +0800
Subject: How can you protect a remailer's keys?
Message-ID: <199606070700.AAA22916@toad.com>


>> The best solution I could come up with (and was willing to write and use)
>> is to specify the passphrase on the command line argument to the compiler

>A far better solution would be to have a long-running daemon hold the
>secret key.  The mixmaster client could talk to the key daemon through
>a unix-domain socket with the permission bits set such that only the
>mixmaster user can connect.  Each time the machine is rebooted, the
>operator must start the daemon and give it a passphrase.

>Second, if your machine is seized or someone gains unauthorized
>physical access to it, the easiest way to get a root shell is by
>rebooting single-user.  However, if the only cleartext copy of a key
>is in memory rather than in the filesystem, once the machine is
>rebooted the secret key is lost.


How about adding an "Oh s___" feature that would dump the key? You could
even tie it to a login attempt (i.e. be sneaky and rename the actual root
account to something else. Possibly hack the login client to return
"root" as the username, etc, etc to complete the illusion if they are
using TEMPEST.  Then set it so that a root login makes the daemon dump
the password)

This would have possibilities, too, if you made it react to a) certain
files in certain directories, b) certain signals or c) certain network
messages.
This would allow you to put in an innocous clear signal. Set it to a temp
file created when editing your remailer's configuration (or userlist).
Make it so that you have to conciously DISABLE security or it dumps the
password. Have an innocent program terminate it. Be able to cancel it by
sending an email (or using telnet) - this would be great if you had a
trusted friend.  Also, with some modification, you could set it to react
to an external stimulus - say a panic button? or a card lock?  You could
even have fun putting all your sensitive stuff on an external hard drive
and rigging your panic button to a) stop the remailer and b) activate the
thermite charge on the external drive.
// This was typed on a Warped PC by an equally warped Chris Adams <adamsc at io-online.com>
// The Enigman Group - We do Web Pages!
// Opinions expressed are not necessarily my own, much less another's.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From llurch at networking.stanford.edu  Fri Jun  7 06:47:39 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Fri, 7 Jun 1996 21:47:39 +0800
Subject: ALERT: Court decision expected soon in free speech case; spread the word! (fwd)
In-Reply-To: <v03006f20addc6f66dd18@[199.0.65.105]>
Message-ID: <Pine.GUL.3.93.960606180545.19086K-100000@Networking.Stanford.EDU>


Well, it worked. The web server on www.vtw.org is *totally* overloaded now.

When are these people going to learn about the Internet? :-)

-rich






From adamsc at io-online.com  Fri Jun  7 06:50:05 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 21:50:05 +0800
Subject: Fwd: Re: Class III InfoWar
Message-ID: <199606070508.WAA20926@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "cypherpunks" <cypherpunks at toad.com>
>Date: Sun, 02 Jun 96 18:04:15 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: Class III InfoWar
>

On 2 Jun 1996 03:06:14 pdt, hal9001 at panix.com wrote:

>At 21:33 -0400 6/1/96, winn at Infowar.Com wrote:
>
>
>>The article discussed the advanced information warfare techniques used by the
>>perpetrators. "According to the American National Security Agency (NSA), they
>>have penetrated computer systems using 'logic bombs' (coded devices that
>>can be
>>remotely detonated)
>
>Unless the definition has changed recently, a "logic bomb" is normally a
>piece of code in a program that is triggered when a specific event occurs
>(such as the programmer's name not appearing in a payroll file for a
>designated period of time [which might trigger a salami round off routine
>to start cutting checks 2 months after s/he is no longer working for the
>company]).

I believe that is what they were referring to. However, the press garbled
it as usual. It 
seems like the original was something like 'logic bombs' (bits of code
that can be 
triggered remotely). Probably sounded more impressive the reporter's
way...

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From adamsc at io-online.com  Fri Jun  7 06:55:09 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 21:55:09 +0800
Subject: forged addresses
Message-ID: <199606070506.WAA20846@toad.com>


On 29 May 1996 19:38:16 pdt, nobody at nowher.com wrote:

>Hi, I'm not sure if there was ever a thread on this, but I was wondering if 
>anyone can determine your real email address, if you were to fake it to your 
>email client.
>
>I hope that this doesn't offend anyone, since this is a high traffic list, but 
>I was wondering if this would work.  To try it out, I setup my client to think 
>I was someone else, and sent myself an email.  I could only figure out what 
>ISP it came from.
>
>What I would like to know is, can any of the experts on this list determine my 
>address from the header of this post??
I didn't receive anything except your nobody at ... address.
>again, if this is something that I shouldn't have done, just let me know, and 
>it won't happen again.
>
 Hmmm... I'm going to have to play around with this. I can get outbound email access 
through my school district's mailserver simply by filling in the appropriate fields in 
netscape (we have a WAN hooked up to a T1).  It would seem to me that this would be rather 
secure for several reasons, if for no other than that NO logging is made... In a large 
district, like mine (probably 10-15 thousand potential users), I doubt they would have the 
resources to track any of the 100 or so Internet machines on my campus alone, even if they 
could tell it came from here.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From adamsc at io-online.com  Fri Jun  7 07:02:05 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 22:02:05 +0800
Subject: INteresting tidbit
Message-ID: <199606070506.WAA20840@toad.com>


>On the Encryption note, and I swear not along the lines of the 'DOJ' 
>and 'FBI Snooping' Big-Brother events, I heard another story recently.
>
># begin story
>
>A person working on the MBONE project did an unannounced experiment
>across the internet using Triple-DES for MBONE, and the very next day, 
>'ATF' agents knocked on his door and warned him against exporting 
>munitions.  The experimentor was shaken by the fact that agents 
>approached him so quickly after the experiment.
>
># end story
>
>Extrapolations of fact:
>   1.   Internet traffic is monitored.
>   2.   The ability to snoop for encrypted traffic is present
>   3.   The ability to identify encryption levels is present
>        (How else can they differentiate DES-1 from DES-3?)
>   4.   The ability to crack DES-1 in near real-time mode is present.
>        (See above).
First, this has been loosely confirmed for ages. Someone was mentioning that FBI offices 
supposedly have software that (on a 486) can crack a DES-1 key in under an hour. Multiply * 
modern high capacity computers = problem.  However, this does not nessesarily follow from 
#3. First off, you could probably tell the encryption used from a file format; the software 
on the other end has to know what it's getting. Secondly, you could probably tell quite a 
lot about what was used by some intense analysis.
Finally, if their software cannot read it and analysis suggested it was more than DES-1 
then they might go after someone w/o being able to read the document in question.
>   5.   If above=true, then Feds dropping the Zimmerman PGP case probably
>        also points to it also being crackable in a similar manner.
Not necessarily. This freemen issue shows that the FBI is getting gunshy about bad 
publicity, which they were getting.
>   6.   Using encryption only flags traffic for capture and decryption, 
>        using strong encryption makes you all that more interesting.
Sounds like the old argument for encrypting everything...

>Sorry, couldn't resist.  I'll try not to start a threads about 
>electro-plasma propulsion craft at Area 51, metallic-ceramic skin 
>and pulse-jets on the Aurora spy plane, heat-imaging video cameras 
>on satellites and planes that can watch you through your houses' roof, 
>etc.  :)

What??? Now you're going to tell us X-Files is just a TV show? <g>

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From frissell at panix.com  Fri Jun  7 07:07:41 1996
From: frissell at panix.com (Duncan Frissell)
Date: Fri, 7 Jun 1996 22:07:41 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <2.2.32.19960607102709.00cba438@panix.com>


At 07:54 PM 6/6/96 -0700, Timothy C. May wrote:
>(There may be cases people can dig up where some newspaper or newsletter
>was "shut down," but I think such cases would be hard to find in the last
>several decades. Am I wrong on this?)

Not newspapers but a number of radio stations of course.  Licensure.  Even
under CDA, we are not subject to license, however.  Though I wonder how the
FCC will behave as TV stations join the radio and "radio" stations that are
already netcasting beyond its control.

DCF






From ichudov at algebra.com  Fri Jun  7 07:13:15 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Fri, 7 Jun 1996 22:13:15 +0800
Subject: FOR WHOM THE BELL TOLLS
In-Reply-To: <v02140b00addc39dee500@[205.162.51.35]>
Message-ID: <199606062218.RAA22385@manifold.algebra.com>


Jim McCoy wrote:
> Duncan wrote:
> > At 10:41 PM 6/4/96 -0700, Bruce Baugh wrote:
> > >I think there's a non-trivial chance that this list could be shut down and
> > >anyone who's made interested sounds in the idea brought in to assist the
> > >police in their inquiries.
> >
> > Yeah and they busted Jack London for publishing
> >"The Assassination Bureau, Ltd".[...]
> >
> > Advocating the general practice of killing one's opponents is as legal as
> > church on a Sunday.  The War College (or is it the NDU these days) does it
> > all the time.
> 
> As long as that person is not the President of the United States (at least
> for U.S. citizens.)  This was the issue which initiated this thread, the
> implied threat made by our favorite nutcase.

Are you sure? Can you cite references? From my readings on the 1st
amendments, any general kind of speech is legal, even if it advocates
killing certain officials, including us presidents. *If* instead of
general advocacy a person gave specific orders or concrete requests to
kill the prez, then it would not be speech. Please correct me if I am
wrong. 

>From my scarce reading of jimbell, his messages were fairly abstract
and were likely just a protected speech.

	- Igor.





From adamsc at io-online.com  Fri Jun  7 07:14:23 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 22:14:23 +0800
Subject: Fwd: Re: [crypto] crypto-protocols for trading card gam
Message-ID: <199606070508.WAA20921@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "ogren at concentric.net" <ogren at concentric.net>
>Date: Thu, 30 May 96 02:30:30 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: [crypto] crypto-protocols for trading card gam
>

>Disadvantages:
>
>The entire integrity of the system relies on the security of the
>game company's key pair.  If the secret key is comprimised, either by
>Cards are not transferrable.  In order to make cards transferrable the
>game company must be able to invalidate cards which have been traded
>to others.  In other words if Alice wants to give a cards to Bob she
>must:
I would just have multiple validators w/separate keys. sign w/each. This
would not 
eliminate the problem but could reduce it...

>1. Contact the game company and tell them she wants to give the card
>to Bob. 2. The game company must issue a new card to Bob with a new
>serial number and with Bob's public key rather than Alice's. 3. The
>game company must invalidate Alice's old card.  Since there is no way
>that the game company can make sure all copies of the card have been
>destroyed it must create a "invalid serial number list" and have the
>players dial into that list everytime the game is played.
>
>Since step 3 is so costly to implement, I think it is unlikely that a
>cryptography-based trading card game will have tradable cards.

Much easier - with each card, store its ownership history. EACH time it
is transfered, have 
it be signed by the previous owner.  Originally, the game company signs
it as a valid card. 
On selling it, they record the purchaser's identity (email address,
etc)and seal the card 
with the company key (or set of keys - see above). Repeat as needed.

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From adamsc at io-online.com  Fri Jun  7 07:23:55 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 22:23:55 +0800
Subject: Fwd: Re: Idea 'bout banning the internet
Message-ID: <199606070508.WAA20922@toad.com>


==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "jwilk at iglou.com" <jwilk at iglou.com>
>Date: Mon, 03 Jun 96 20:36:49 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Subject: Re: Idea 'bout banning the internet
>

On 3 Jun 1996 19:48:48 pdt, jwilk at iglou.com wrote:

>What if in the future a country banned the internet and all things that had
>to deal with it (ie-  telnet, irc). It would be  the "underground" thing.
>Just a thought, it would really suck! As I think about it it is impossible
>or is it???? Hell the usa cant even ban porn let alone the whole thing. They
>could ban it like they did fizzies. Hey there making a comeback did you here
>now they have nutrasweet in them. If you know what fizzies are than your
>pretty kewl. I'm only 13 and love then they are the drink of the future!!!!
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>Blake "Pokey" Wehlage     Gaa- 3.69
><jwilk at iglou.com>         Record- 2-4-4
>Age- 13                   Final Standings- 2nd Place (Beat in Championship)
>
>President & Founder:
>                   
>Revolution Software       "I have the fastest glove in the east!"
>Profanity Software        "Hackers never stop hacking they just get caught"
>VSoft
>
>My life- Rarely eat or sleep, Hack til' 7:00a, goto school, play goalie
>til' 8:00p, hack til' 7:00a
>Hank Aaron- d:-)!-<   Pope- +<:-)   Santa Claus- *<:-) The Unabrower |:-)
>
>Current Girlfriend(s)- Lindsey Wilcox, Laura Schubring
>
>Personal Quote- Mr Plow, thats my name, that name aguin is Mr. Plow 
>-Homer Simpson
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>


You know, even counting the header, your signature is longer than the
message...
BTW, I doubt most of us care about your current love life or soccer
standings. We won't 
even mention Homer Simpson...

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.







From sameer at c2.org  Fri Jun  7 07:30:28 1996
From: sameer at c2.org (sameer at c2.org)
Date: Fri, 7 Jun 1996 22:30:28 +0800
Subject: WWW servers.
In-Reply-To: <Pine.SUN.3.91.960606161633.1329A-100000@polaris>
Message-ID: <199606062121.OAA07502@niobe.c2.net>


> 
> Does there currently exist a system which permits webservers to restrict 
> access to clients who have a given certification?

	Yup.

> 
> What is the current certification practice?

	Use either VeriSign, or build your own CA.

> 
> How easy is it to certify a given client?

	Rather easy, using XCert Sentry.

> 
> Are webserver certifications sufficently secure today?

	"sufficiently" by whose definition?

> 
> What are the best servers to use for secure web pages and certification 
> currently in the United States?

	=) Stronghold: The Apache-SSL-US, coupled with XCert
Sentry. What else?

-- 
Sameer Parekh					Voice:   510-601-9777x3
Community ConneXion, Inc.			FAX:     510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.net/ (or login as "guest")		sameer at c2.net





From declan at well.com  Fri Jun  7 07:53:26 1996
From: declan at well.com (Declan McCullagh)
Date: Fri, 7 Jun 1996 22:53:26 +0800
Subject: Fight-Censorship Dispatch #12: CDA deathwatch, copyright update
In-Reply-To: <v02140b03addb7e62c704@[17.202.12.102]>
Message-ID: <Pine.3.89.9606061716.A1018-0100000@well>


Fred Cherry is a prize example of your lonely pamphleteer, though he's one
who's just plain wacky. 

Note that calling someone wacky or a loon does not equate to saying they
should be silenced. I've said many times that Cherry should not be muzzled
on Usenet.

-Declan

For more info on Fred Cherry and his lawsuit, check out my 
#5 fight-censorship dispatch at:
  http://fight-censorship.dementia.org/dl?num=2115


On Wed, 5 Jun 1996, Martin Minow wrote:

> Date: Wed, 5 Jun 1996 11:16:49 -0700
> From: Martin Minow <minow at apple.com>
> To: declan at well.com
> Cc: minow at apple.com, cypherpunks at toad.com
> Subject: re: Fight-Censorship Dispatch #12: CDA deathwatch, copyright update
> 
> In "Fight-Censorship Dispatch #12", Declan McCullagh writes about
> "everybody's favorite net.loon," Fred Cherry:
> 
> >Whatever you think of Cherry's antics, you gotta grant him one thing
> > not many people have the balls to demand that a Federal court uphold
> > their right to flame.
> 
> I suspect that Tom Payne would -- Cherry seems from your description
> to be a prize example of "the lonely pamphleteer."
> 
> It would be interesting to know what Nat Hentoff thinks of Fred.
> 
> Martin Minow
> minow at apple.com
> 
> 
> 
> 





From declan+ at CMU.EDU  Fri Jun  7 08:05:59 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 7 Jun 1996 23:05:59 +0800
Subject: On the Hill: Child Porn "Morphing"
In-Reply-To: <Pine.SOL.3.91.960605153106.26199C-100000@ion1.ionet.net>
Message-ID: <wlhvNja00YUz0xgNAP@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 5-Jun-96 Re: On the Hill: Child
Porn.. by Jeffrey A Nimmo at ionet.ne 
> I believe that like all porn, it's a reasonability issue. If a 
> "reasonable" person would believe that the person depicted in the drawing 
> or morph to be underage, that it's illegal. I'm not sure, but I'll bet 
> Sternlight would have an opinion. Anyone care (dare) to ask?

Read the legislation. I have the text of S.1237 in front of me now.

Child pornography is any depiction, including electronic, where:

(A) the production of such visual depiction involves the use of a minor
engaging in sexually explicit conduct;

(B) such visual depiction is, or appears to be, of a minor engaging in
sexually explicit conduct;

(C) such visual depiction is advertised, promoted, presented, or
distributed in such a manner that conveys the impression that the
material is or contains a visual depiction of a minor engaging in
sexually explicit conduct.

Anyone who "knowingly receives or distributes" it in any way over state
lines "including by computer" will be fined and given a 5 to 15 year
vacation at Club Fed.

-Declan






From stevenw at best.com  Fri Jun  7 08:16:06 1996
From: stevenw at best.com (Steven Weller)
Date: Fri, 7 Jun 1996 23:16:06 +0800
Subject: RISKS: YAJSH
Message-ID: <v01540b01addd3ef40288@[206.86.1.35]>


Reposted from RISKS:   Yet Another Java Security Hole:

------------------------------

Date: Sun, 2 Jun 1996 07:46:20 +0000 (BST)
From: David Hopwood <david.hopwood at lady-margaret-hall.oxford.ac.uk>
Subject: Another Java attack

There is another serious security bug in the class loading code for all
currently available Java browsers:

    Netscape up to versions 2.02 and 3.0beta4 (except Windows 3.x)
    Oracle PowerBrowser for Win32
    HotJava 1.0beta
    'appletviewer' from the Java Development Kit up to version 1.0.2

Sun, Netscape, and Oracle have been sent details of the problem (which is
partly related to the ClassLoader attack found by Drew Dean, et al. in
March).  The attack works by exploiting a design flaw in the mechanism that
separates JVM classes into different namespaces.

Using this bug, an attacker can bypass all of Java's security restrictions.
This includes reading and writing files, and executing native code on the
client with the same permissions as the user of the browser.

The only way to avoid this problem at the moment is to disable Java. For
more details see
    http://ferret.lmh.ox.ac.uk/~david/java/bugs/

Technical details will be posted when Sun, Netscape, and Oracle release
patches.

David Hopwood  david.hopwood at lmh.ox.ac.uk  http://ferret.lmh.ox.ac.uk/~david/

------------------------------

Date: Thu, 6 Jun 1996 14:15:46 -0700
From: mrm at doppio.Eng.Sun.COM (Marianne Mueller)
Subject: Another Java attack

David Hopwood, a Java researcher in the UK, has uncovered a new security bug
in Java [RISKS-18.18].  In simple terms, he has been able to manipulate the
way objects are assigned and the way they collaborate, in order to undermine
the applet security manager.

Hopwood contacted JavaSoft directly re: the bug, and we have had a team
working on a fix for the past 72 hours.  In addition, we are applying
Hopwood's model to conduct a security review, to determine if there are
other bugs that may apply.

We are currently thoroughly testing the fix, and plan to release a patch as
soon as possible.  As we complete more testing of the fix, a more detailed
description of the bug and the fix will be added to the JavaSoft security
FAQ at http://java.sun.com/sfaq/.

JavaSoft is grateful for the internet security community's active interest
in reviewing our code and we welcome feedback that makes Java better
technology.

------------------------------

-------------------------------------------------------------------------
Steven Weller                      |  Technology (n):
                                   |
                                   |     A substitute for adulthood.
stevenw at best.com                   |     Popular with middle-aged men.







From adamsc at io-online.com  Fri Jun  7 08:42:00 1996
From: adamsc at io-online.com (Chris Adams)
Date: Fri, 7 Jun 1996 23:42:00 +0800
Subject: Fwd: [Fwd: Welcome!]
Message-ID: <199606070507.WAA20877@toad.com>

==================BEGIN FORWARDED MESSAGE==================
>From: "Chris Adams" <adamsc at io-online.com>
>To: "Jerry Kuhn" <jerry.kuhn at f0.n206.z1.fidonet.org>,
>	"Gary Orthuber" <nccorthu at rain.org>
>Date: Tue, 28 May 96 00:01:11 
>Reply-To: "Chris Adams" <adamsc at io-online.com>
>Priority: Normal
>X-Mailer: PMMail 1.5 UNREGISTERED SHAREWARE
>MIME-Version: 1.0
>Content-Type: multipart/mixed; boundary="_=_=_=IMA.BOUNDARY.DS3KHZ138764=_=_=_"
>Subject: Fwd: [Fwd: Welcome!]
>

==================BEGIN FORWARDED MESSAGE==================
>Message-ID: <1082295506 at bbs.io-online.com>
>From: adamsc at io-online.com
>MIME-Version: 1.0
>Content-Type: multipart/mixed; boundary="zzzz408284d220bc8563io-online.cozzzz"
>To: Adamsc
>Date: 28 May 1996 12:31:14 pdt
>Subject: [Fwd: Welcome!]
>


This message has been generated solely to deliver this file attachment.
This file attachment was originally included in another message, which
had multiple file attachments.

This message was automatically generated.




===================END FORWARDED MESSAGE===================


This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.



===================END FORWARDED MESSAGE===================

/* From Chris Adams <adamsc at io-online.com> on a Warped PC running a proudly unregistered (for now) PMMAIL 1.5!
The Enigman Group - We do Web Pages! */

This Message Was Sent With An UNREGISTERED Version Of PMMail.  
Please Encourage Its Author To Register Their Copy Of PMMail.  
For More Information About PMMail And SouthSide Software's Other 
Products, Contact http://www.southsoft.com.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: bin00000.bin
Type: application/octet-stream
Size: 4696 bytes
Desc: "FILE.EXT"
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/19960607/0e649230/attachment.bin>

From nelson at crynwr.com  Fri Jun  7 09:36:37 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 8 Jun 1996 00:36:37 +0800
Subject: Multiple Remailers at a site?
In-Reply-To: <19960604232157.2053.qmail@ns.crynwr.com>
Message-ID: <19960607121455.12742.qmail@ns.crynwr.com>


nelson at crynwr.com writes:

 > Therefore, to keep the characteristics of the trusted host constant
 > when converting into a partially trusted network, each of the
 > individual hosts needs to increase their parameters by some amount
 > (which amount someone else will have to contribute, cuz I have no clue
 > and need sleep).

Ahhhh, sleep is a wonderful thing.  It clears the brain so well.  The
increase is proportional to the level of distrust of the individual
hosts by other hosts.  If you think half the hosts are TLS moles,
you'd double your characteristics (reordering and traffic).

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From shabbir at vtw.org  Fri Jun  7 11:47:04 1996
From: shabbir at vtw.org (Voters Telecommunications Watch)
Date: Sat, 8 Jun 1996 02:47:04 +0800
Subject: INFO: Discuss crypto with Sen. Burns online the night before hearings!
Message-ID: <199606071312.JAA08699@panix3.panix.com>


=============================================================================
          ____                  _              _   _
         / ___|_ __ _   _ _ __ | |_ ___       | \ | | _____      _____
        | |   | '__| | | | '_ \| __/ _ \ _____|  \| |/ _ \ \ /\ / / __|
        | |___| |  | |_| | |_) | || (_) |_____| |\  |  __/\ V  V /\__ \
         \____|_|   \__, | .__/ \__\___/      |_| \_|\___| \_/\_/ |___/
                    |___/|_|

           CRYPTO HEARINGS (S.1726) SET FOR 6/12/96 IN WASHINGTON D.C.
          MEET AND SPEAK TO SENATOR BURNS ON HOTWIRED THE NIGHT BEFORE!
      SEN. CONRAD BURNS (R-MT) SCHEDULED FOR HOTWIRED CHAT 6/11/96 10-11PM EST

                              Date: June 7, 1996

         URL:http://www.crypto.com/            crypto-news at panix.com
           If you redistribute this, please do so in its entirety,
                         with the banner intact.
-----------------------------------------------------------------------------
Table of Contents
        News
	Press Release on Hearings
        How to receive crypto-news
        Press contacts

-----------------------------------------------------------------------------
NEWS

In what is becoming the newest way for Congress to read the net.community's
opinion on issues, Senator Conrad Burns will be on HotWired on June
11th @ 10pm EST to discuss the encryption issue with all attendees.
The next day, Senator Burns will be coordinating a day of hearings on the
encryption issues with industry luminaries.  

Never before has the public had this much access to legislators without
geographical proximity.  Cheaper than teleconferencing, and more direct
and unfiltered than the traditional press, online chats allow the public
to directly question and hear the answers of Congress.  

Have a question about encryption policy that you've never been able to find
out from the government?  Come to the HotWired chat and ask Senator Burns
to be your advocate, to press the witnesses and the White House on these
issues.

The online chat is on June 11 at 10pm EST, the night before the hearings 
HotWired's WiredSide chat is at (http://www.hotwired.com/wiredside).

Information on Senator Burns' legislation is available at
http://www.crypto.com

-----------------------------------------------------------------------------
PRESS RELEASE ON HEARINGS

  Senator Conrad Burns (R-Mont.)
  WEB SITE   http://www.senate.gov/~burns/

  For immediate release:          Contact:                  Matt Raymond
  Thursday, June 6, 1996                                  (202) 224-8150
                                                         Randall Popelka
                                                          (202) 224-6137

  First Pro-CODE Hearing Slated
  Burns' Subcommittee to Hear High-Profile Executives, Witnesses

          WASHINGTON, D.C. _ Montana Senator Conrad Burns today announced
  the first of two Senate hearings on S. 1726, the Promotion of Commerce
  Online in the Digital Era Act of 1996, or "Pro-CODE."  The hearing will
  take place in the Commerce Subcommittee on Science, Technology and Space,
  of which Burns is chairman.

          The hearing is scheduled Wednesday, June 12, at 9:30 a.m. in room
  253 of the Russell Senate Office Building.

          Scheduled to testify are: Michael Zisman, president and CEO of
  Lotus; Jim Barksdale, president and CEO of Netscape Communications; Jim
  Bidzos, president and CEO of RSA Data Security; Tim Krauskopf, V.P. and
  co-founder of Spyglass Inc.; Kenneth Dam, chairman of the National
  Research Council; Douglas J. McGowan, director of the SmartCard Alliance
  for Hewlett-Packard; Computer Systems Policy Project representative
  (invited); Joe Holmes, chief technology officer for EDS; Joel S. Lisker,
  senior V.P. for security and risk management at MasterCard; Danne
  Buchanan, president of Zion's Data Services Company; Jack Valenti,
  executive director of the Motion Picture Association of America; Aharon
  Friedman, chairman, founder and chief technical officer of Digital
  Secured Networks Technology Inc.; Steve Case, president and CEO of
  America Online (invited); and Robert Bigomy, senior V.P. and director of
  strategic marketing, government and space technology group, for Motorola.

          Burns said the focus of the hearing is on commerce and business
  issues.  He said a second hearing, which will focus on privacy, law
  enforcement and national security issues, is scheduled in his
  subcommittee on June 26.

          The bipartisan Pro-CODE bill would ease export restrictions on
  computer security, or "encryption," for software and hardware.  It would
  also prohibit mandatory systems in which users or companies would have to
  place a code-breaking "key" in the hands of a third party.

                                        # # #

-----------------------------------------------------------------------------
HOW TO RECEIVE CRYPTO-NEWS

To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com)
or send mail to majordomo at panix.com with "subscribe crypto-news" in the body
of the message.
-----------------------------------------------------------------------------
PRESS CONTACT INFORMATION

Press inquiries on Crypto-News should be directed to
	Shabbir J. Safdar (VTW) at +1.718.596.2851 or shabbir at vtw.org
	Jonah Seiger (CDT) at +1.202.637.9800 or jseiger at cdt.org

-----------------------------------------------------------------------------
End crypto-news
=============================================================================







From qut4.qut at netcom.com  Fri Jun  7 12:11:56 1996
From: qut4.qut at netcom.com (qut4.qut at netcom.com)
Date: Sat, 8 Jun 1996 03:11:56 +0800
Subject: Thank you for the Archives 100 messages
Message-ID: <199606071402.HAA10943@netcom4.netcom.com>


Apologies, but rich has deleted me from
his mailboxes, and for a few days now,
somebody has placed a global cancel bot on
me.  I'm gonna have plenty of fun figuring
this out.  Kwow any good sniffers?

I agree the list should be public usenet:
A mail gate-way to a usenet group that
ALSO permits unmoderated posts.  This
would be a nice way to combine a strict
moderated mail-list, with a standard 
netnews group.







From froomkin at law.miami.edu  Fri Jun  7 12:23:45 1996
From: froomkin at law.miami.edu (Michael Froomkin)
Date: Sat, 8 Jun 1996 03:23:45 +0800
Subject: Electronic Signatures
In-Reply-To: <19960606185840.9230.qmail@ns.crynwr.com>
Message-ID: <Pine.SUN.3.93.960607100847.6828D-100000@viper.law.miami.edu>


On 6 Jun 1996 nelson at crynwr.com wrote:

>  > 
>  > 	The law does not specify how an electronic document must be 
>  > signed, but Barassi and others say it probably will mean coding the text 
>  > and typed signature so they cannot be changed by anyone other than the 
>  > writer.
> 

Before you get all hot under the collar, may I note that I've known
Barassi for more than a year, and he is very technically sophisticated.
Allow for some reporter-garble.   Barassi understands digital signatures
as well as you do.

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin at law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's warm here, and humid.






From Clay.Olbon at dynetics.com  Fri Jun  7 12:26:52 1996
From: Clay.Olbon at dynetics.com (Clay Olbon II)
Date: Sat, 8 Jun 1996 03:26:52 +0800
Subject: whitehouse web incident, viva la web revolution
Message-ID: <ADDDA7B6-382D7B@193.239.225.200>


Jonathon,

>	Statistical proof is only accepted in academia.  Depending
>	upon your POV, this may or may not be a good thing, when
>	one is facing civil, or criminal charges.  
>
>	Finding proof for either civil or criminal charges is a 
>	slightly different matter.

IANAL, but your statements are misleading.  Statistics are often used in
both criminal and civil cases.  Look at the DNA evidence in the OJ trial
(OK, maybe a bad example), or the evidence that breast implants don't cause
various ailments (probably another bad example :-).  Both of these examples
are based on statistics.  IMO, part of the problem with juries (and public
discourse in general) today is that anecdotal evidence is often accepted,
when that evidence is clearly not statistically significant.  The examples
I cited previously illustrate this - the four horsemen are a similar
example for public policymaking.  

	Clay

---------------------------------------------------------------------------
Clay Olbon II            | Clay.Olbon at dynetics.com
Systems Engineer         | ph: (810) 589-9930 fax 9934
Dynetics, Inc., Ste 302  | http://www.msen.com/~olbon/olbon.html
550 Stephenson Hwy       | PGP262 public key: on web page
Troy, MI 48083-1109      | pgp print: B97397AD50233C77523FD058BD1BB7C0
                     TANSTAAFL
---------------------------------------------------------------------------






From nelson at crynwr.com  Fri Jun  7 12:52:37 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 8 Jun 1996 03:52:37 +0800
Subject: Electronic Signatures
In-Reply-To: <19960606185840.9230.qmail@ns.crynwr.com>
Message-ID: <19960607141610.13186.qmail@ns.crynwr.com>


Michael Froomkin writes:

 > >  > 	The law does not specify how an electronic document must be 
 > >  > signed, but Barassi and others say it probably will mean coding the text 
 > >  > and typed signature so they cannot be changed by anyone other than the 
 > >  > writer.
 > 
 > Before you get all hot under the collar, may I note that I've known
 > Barassi for more than a year, and he is very technically sophisticated.
 > Allow for some reporter-garble.   Barassi understands digital signatures
 > as well as you do.

I never said or even (should you be a telepath) thought that he
didn't.  Heck, I've PGP-signed documents which I've then had to FAX to
people.  :)  OCR is your friend, eh?

No, I was responding to the person who was distrustful of the law's
requirement for certified signatures.  DON'T WAIT FOR THE GUVMINT TO
CREATE A CERTIFYING AGENCY -- start your own and get some momentum.
Makes it much harder for them to claim that PGP won't work because
there's no central signature registry.  PGP doesn't require a central
registry, but then again it doesn't disallow it either.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From wilcoxb at nagtje.cs.colorado.edu  Fri Jun  7 13:28:35 1996
From: wilcoxb at nagtje.cs.colorado.edu (Bryce)
Date: Sat, 8 Jun 1996 04:28:35 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606070205.WAA20230@jafar.sware.com>
Message-ID: <199606071441.KAA13062@nagtje.cs.colorado.edu>



-----BEGIN PGP SIGNED MESSAGE-----

Hello Jeff B, vznuri, szabo & alia.


Jeff wrote:
>
> Or are you saying that each IP packet will have an appropriately sized
> digital cash payment attached?  That seems like too much overhead.
  
  
So people who work on micropayments are trying to reduce that 
overhead.  It is clear to me that it is feasible to do so.  
(Someone have a list of references to published micropayment
schemes that I can insert here?)  IPng headers have plenty of
room for this kind of thing, don't they?
 
 
Also on this thread someone mentioned seeing an icon that says  
"5 cents" and clicking on it to pay 5 cents from their wallet.  
Well, please start your Ecash(tm) wallet and visit 
"http://www.c2.net/~bryce/BuyBAP.html".  Click on the dime.  
Better yet click on the pair of quarters.  As a bonus you 
actually get a copy of 'Bryce's Easy PGP', too!
 
 
(Sameer's the one to blame for this new threat to our national
security/children's innocence/community standards/etc.  His
"Ecash(tm) integrated with c2.net" system underlies my
cybershop.)
 
 
Regards,
 
Bryce
 
#include <stddisclamer.h> /* I'm not speaking for anyone else at this time. */
- ----- BEGIN GOODTIMES VIRUS INNOCULATION -----
Once you have read and understood this .sig, you are immune 
to the Good Times virus.  Please help spread this innoculation!
- ----- END GOODTIMES VIRUS INNOCULATION -----



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: www.c2.net/~bryce -- 'BAP' Easy-PGP v1.1b2

iQCVAwUBMbg/mvWZSllhfG25AQGOGwP/SwDNHECjGy5a7dNVIVZEjLofN+Dgsoq0
ri7LrIE/m5hyj9Xu2HelM8o8p8e2bTylQ7GFcTZVFYBYMbb2INldFacf4X/hGfrG
snhDWuV2ZQts4/CO92hQ44OhPSCTFPHH+nKnocTQRwNOySqPWGTxSxnvFO+Grguv
NMv7U9k/do0=
=uvhj
-----END PGP SIGNATURE-----





From declan+ at CMU.EDU  Fri Jun  7 13:42:12 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sat, 8 Jun 1996 04:42:12 +0800
Subject: FOR WHOM THE BELL TOLLS
In-Reply-To: <199606070633.XAA01053@mail.pacifier.com>
Message-ID: <8li234S00YUzE1usAp@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 6-Jun-96 Re: FOR WHOM THE BELL TOLLS
by jim bell at pacifier.com 
> Not quite yet, anyway.  I'm very disappointed to have waited over a year for 
> some slick lawyer to show me how I'd be violating some law or another
to do so
> .

A few observations:

1. Not many readers of cypherpunks are lawyers
2. Of the laywers who do read cypherpunks, many may not choose to spend
their time researching what laws AP may violate. Or they're not "slick"
lawyers; take your pick.
3. Congress would have no problems passing a law outlawing AP, if one
does not exist already.

-Declan






From crisper at ascensionet.com  Fri Jun  7 13:53:40 1996
From: crisper at ascensionet.com (Sean T Carnes)
Date: Sat, 8 Jun 1996 04:53:40 +0800
Subject: Banking's Physical Security
Message-ID: <01BB545E.2DDAE5C0@ppp3>


	We all know that banks are very highly protected as far as their money goes but how safe are there computers?  I live very close to a computer database collecting company that collects the data related to many banks in the area.  It is all done through land lines and is not very well protected.  They aren't very careful about who or what they let into the building also.  If someone were to cut the lines the banks in the area would be out for days and they wouldn't have a means to do interbank transactions outside of the immediate area.  Has anyone else seen this in there area or heard of it. Wouldn't it be a better idea to do the transactions by satellite.





From brock at well.com  Fri Jun  7 14:23:17 1996
From: brock at well.com (Brock N. Meeks)
Date: Sat, 8 Jun 1996 05:23:17 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <Ilhv_bu00YUzIx19wP@andrew.cmu.edu>
Message-ID: <Pine.3.89.9606070804.A29868-0100000@well>


Hey, you misinformed Dolt Hallam-Baker, for the record
I voted for Clinton.  I won't for Dole.  Now, back in your cave.

--Brock





From crisper at ascensionet.com  Fri Jun  7 14:24:48 1996
From: crisper at ascensionet.com (Sean T Carnes)
Date: Sat, 8 Jun 1996 05:24:48 +0800
Subject: Jobs
Message-ID: <01BB5460.9B743B20@ppp3>


I am looking for a job in the computer business doing basically anything computer related, except something like typing all day, where i could get some experience around different computer enviroments.  I have good knowledge of PC's and of some basic network situations.  If anyone is in the NY metro area or on Long Island and is looking for some summer help could you please e-mail me back.

Thanks






From perry at piermont.com  Fri Jun  7 14:24:49 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sat, 8 Jun 1996 05:24:49 +0800
Subject: Anonymous stock trades.
In-Reply-To: <9606062327.AA04162@Etna.ai.mit.edu>
Message-ID: <199606071452.KAA18055@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> 
> >I suppose it depends on what you call "open", eh, Phill?
> 
> >If by "open", you mean financial markets where, as Milton Freedman says,
> >each new regulation raises the cost of entry and protects the surviving
> >firms by killing their smaller competion with red tape, then we have "open"
> >markets.
> 
> Well, Milton Friedman's method for saving the whale is to leave it
> to the free market, if people want whales in the oceans they won't
> buy whale meat.

Dr. Phill Hallam-Baker, PhD, seems to know even less about free market
environmentalism than he knows about futures and options.

Of course, what Dr. Phill Hallam-Baker, PhD, suggests is idiotic. As
any free market economist would tell you, the way to stop a resource
from being destroyed is not to pray that people won't buy it but to
assure that someone has an ownership stake in the resource, thus
assuring that their investment would be destroyed if the resource
vanished. Thats why, for instance, timber companies happily clear cut
government land that they have leased (after all, not clear cutting
would mean that they wouldn't extract maximum value for their lease
under the idiotic terms that the leases are made under) but will
almost never clear cut their own lands, because that would reduce
their long term value.

Dr. Phill Hallam-Baker, PhD, however, does not understand economics in
spite of his PhD and thus attributes views to free market economists
that they do not hold, as in his whole cloth synthesis of a viewpoint
which he ascribed to Milton Friedman which Milton Friedman would never
in a million years espouse.


Perry





From jim at ACM.ORG  Fri Jun  7 14:33:27 1996
From: jim at ACM.ORG (Jim Gillogly)
Date: Sat, 8 Jun 1996 05:33:27 +0800
Subject: FOR WHOM THE BELL TOLLS
In-Reply-To: <199606070633.XAA01053@mail.pacifier.com>
Message-ID: <199606071523.IAA12176@mycroft.rand.org>



Regarding TCM's en passant comment that Bell's ideas are derivative:

jim bell <jimbell at pacifier.com> writes:
>Technically, it wasn't derived from anything directly, or for that matter 
>even indirectly.  However, since there's nothing new under the sun,

Try Gilbert & Sullivan's operetta "Utopia, Ltd."  Assassinating the ruler
was fine and/or encouraged, but the assassin had to take his place.  Not
as close as the Dirty Harry movie, though...

>I generally don't feel the need to name specific people.  I'm sure each 
>reader has his own pet list to fall back on.

Aha.  Gilbert & Sullivan again, this time from the Mikado:  "I've got a
little list of society offenders who might well be under ground, and who
never would be missed."  That's Koko, the Lord High Executioner, casting
about for the next victim.  However, in Mikado assassinating an Heir
Apparent was a punishable offense.  Something <lingering> involving
boiling oil, as I recall.

I noted recently a news article listing about 4 "dead pools" around the
Web, not even counting the Idea Futures death claims.  I don't recall that
any of them used real money.

	Jim Gillogly
	Sterday, 18 Forelithe S.R. 1996, 15:17





From jamesd at echeque.com  Fri Jun  7 14:41:33 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Sat, 8 Jun 1996 05:41:33 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <199606071535.IAA27849@dns1.noc.best.net>


At 06:54 AM 6/6/96 -0400, Duncan Frissell wrote:
> (I've often
> wondered why Hamas uses/used couriers for getting funds to Israel when
> Israel has a great ATM network with international links.)

Sounds like you are suffering caffeine withdrawal.  Try wondering again 
after you have had some coffee.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From trei at process.com  Fri Jun  7 16:08:18 1996
From: trei at process.com (Peter Trei)
Date: Sat, 8 Jun 1996 07:08:18 +0800
Subject: Cost of brute force decryption.
Message-ID: <199606071645.JAA04692@toad.com>



> From: "Deranged Mutant" <WlkngOwl at unix.asb.com>
> 
> On  4 Jun 96 at 10:58, Bruce M. wrote:
> 
> [..]
> > 	"If you can ensure secrecy either until no one cares about the 
> > information or so that cracking the code costs more than the information 
> > is worth, it's 'secure enough.'
> > 
> > 	"For example a 40-bit key takes about $10,000 worth of supercomputer 
> > time and two weeks to crack.  Although this key may be adequate to 
> > protect my checking account, it's probably not large enough for the 
> > accounts of a major corporation.
> [..]
> 
> The figures look familiar.  No references around.  I'm not sure it would 
> require a whole two weeks for 40-bits, though.  Possibly less than a 
> day? (Or was that why you asked baout the figures?)

A week? No.

The second round of the cypherpunk's distributed key cracking (which 
bruted 40 bit RC4) completed  in 38 hours. That was a year ago.
With the growth in the number of interested people on the net, and the
upgrades in cpu power since then, I expect that a similarly motivated 
effort could burn the same number of cycles in well under 24 hours.
(The bottleneck a year ago was in coordination - not raw processing
power).

Prediction: By the millenium, we'll have made single DES look about as
silly as 40 bit RC4 is today.

Peter Trei





From frissell at panix.com  Fri Jun  7 16:12:04 1996
From: frissell at panix.com (Duncan Frissell)
Date: Sat, 8 Jun 1996 07:12:04 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <2.2.32.19960607170941.0075b778@popserver.panix.com>


At 08:29 AM 6/7/96 -0700, jamesd at echeque.com wrote:
>At 06:54 AM 6/6/96 -0400, Duncan Frissell wrote:
>> (I've often
>> wondered why Hamas uses/used couriers for getting funds to Israel when
>> Israel has a great ATM network with international links.)
>
>Sounds like you are suffering caffeine withdrawal.  Try wondering again 
>after you have had some coffee.
> ---------------------------------------------------------------------

James.  What am I missing?  It is trivial to keep both ends of an international ATM transaction anonymous.  And if Hamas suicide bombers can make it into Israel proper, I'm sure bagmen can hit ATMs there.  There may even be ATMs in East Jerusalem or on the West Bank.

DCF





From unicorn at schloss.li  Fri Jun  7 16:16:13 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sat, 8 Jun 1996 07:16:13 +0800
Subject: Banking's Physical Security
In-Reply-To: <01BB545E.2DDAE5C0@ppp3>
Message-ID: <Pine.SUN.3.91.960607131001.13383B-100000@polaris>


On Wed, 5 Jun 1996, Sean T Carnes wrote:

> 	We all know that banks are very highly protected as far as their 
money goes but how safe are there computers?  I live very close to a 
computer database collecting company that collects the data related to  
many banks in the area.  It is all done through land lines and is not 
very well protected.  They aren't very careful about who or what they 
let into the building also.  If someone were to cut the lines the banks 
in the area would be out for days and they wouldn't have a means to do 
interbank transactions outside of the immediate area.  Has anyone else 
seen this in there area or heard of it. Wouldn't it be a better idea to 
do the transactions by satellite.

^^

Very vulnerable to jamming.

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From tcmay at got.net  Fri Jun  7 16:41:01 1996
From: tcmay at got.net (Timothy C. May)
Date: Sat, 8 Jun 1996 07:41:01 +0800
Subject: It tolls for thee
Message-ID: <addda7cd01021004f950@[205.199.118.202]>


At 7:29 AM 6/7/96, jim bell wrote:

>Even so, given how much noise we've been hearing out of DC on the subject
>of the Internet, digital cash, and good encryption, I'd say SOMEBODY is
>getting a bit worried.  I haven't exactly been keeping this stuff a secret:
>What do you think their reaction has been, so far?  When those
>government-types start considering various scary scenarios, what do you
>think they are imagining?

I don't think any significant amount of the current stuff coming out of
Washington has anything to do with my words, your words, or the words of
anyone on this or any other forum I know about.

Importantly, I'm including my own words, explicitly. Sorry to burst _our_
bubbles, but I just don't think the lawmakers and burrowcrats are being
driven by loose talk by us.

Rather, the reasons for their actions and hyperbole about the Net, the Web,
online porn, money laundering, the "information highway," and all that
trendy stuff is because they can see many of the same trends we see.

While I have a certain amount of pride that my single-page "Crypto
Anarchist Manifesto" essentially nailed a bunch of trends which have become
obvious to all in the 8 years after I issued it, I don't for a picosecond
think anything I wrote then or since has had any significant effect on
proposed leglislation.

While some of our writings and talk may have inspired "sound bites" in
their own reports, the concerns governments have about strong cryptography,
transparent borders, alternative forms of money, data havens, etc., are
easy to understand.


>Not quite yet, anyway.  I'm very disappointed to have waited over a year for
>some slick lawyer to show me how I'd be violating some law or another to do so.

This is factually incorrect. I recall at least one law professor and at
least one assistant DA publically commenting on the legal implications of
your actual deployment of AP (as opposed to merely speculating about such
things, which all agree is protected speech). And this was soon after your
initial flurry of posts describing your "wonderful idea."

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From jimbell at pacifier.com  Fri Jun  7 16:56:48 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 8 Jun 1996 07:56:48 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <199606071725.KAA26027@mail.pacifier.com>


At 04:05 AM 6/7/96 -0000, nelson at crynwr.com wrote:
>jim bell writes:
>
> > My impression is that it is frequently the pacifist-types who get us into 
> > war, because they start the process out by tolerating actions by others that 
> > turn into more serious actions, etc.  You know, the appeasers.  Are you an 
> > appeaser?
>
>A quote from Donald Wetzel's book Pacifist:
>
>The pacifist is often asked what he would do in the event the United
>States were to be conquered by a hostile power.  The assumption on the
>part of the questioner is almost always that we would simply assume
>the proper position in which best to have our asses kicked.  I suggest
>that anyone who believes that such would be the pacifist response to
>the imposition in America of an oppressive, authoritarian
>rule--foreign or domestic--should consult the prison authorities that
>were in power when America's prisons were host to some six thousand
>pacifists.  I am sure it will be found that we have not been
>forgotten.

I propose that there has ALREADY been "the imposition in America of an 
oppressive, authoritarian rule."

What are the pacifists doing now?

Jim Bell
jimbell at pacifier.com





From attila at primenet.com  Fri Jun  7 17:07:55 1996
From: attila at primenet.com (attila)
Date: Sat, 8 Jun 1996 08:07:55 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <199606071658.JAA27327@primenet.com>



 jim bell writes:

 > My impression is that it is frequently the pacifist-types who get us into 
 > war, because they start the process out by tolerating actions by others that 
 > turn into more serious actions, etc.  You know, the appeasers.  
 >

	true, too true.

	unfortunately, the point is corrrect: the pacifist do tolerate actions that 
    others would not thereby encouraging further aggression. 

	after the pacifists have been attacked, they can be particularly violent  
    --and incarcertated, they are defiant.  Or, as I prefer to put it: 

	    there is nothing worse than a liberal whose ass has been bit.


--
Hackers never stop hacking, they just get caught






From hallam at Etna.ai.mit.edu  Fri Jun  7 17:26:17 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Sat, 8 Jun 1996 08:26:17 +0800
Subject: Anonymous stock trades.
In-Reply-To: <199606071452.KAA18055@jekyll.piermont.com>
Message-ID: <9606071731.AA04519@Etna.ai.mit.edu>



Perry writes..

>Dr. Phill Hallam-Baker, PhD, seems to know even less about free market>
>environmentalism than he knows about futures and options.

This is the Perry argument!

Call someone a fool, invite ridicule... ohhh perry does that make you feel big?
does that make you feel like you can argue?

Of course you can't argue or you would not have begun your arguement with a 
gratuitous insult. You are clearly uncertain of your case and feel that you have 
to puff yourself up a bit and try a bit of intimidation. 


I asked my stock broker about the trades Hilary did. Sorry Perry, you were wrong 
5% margin is sufficient in most markets. That means $1000 can cover $20,000. 
Your whole case was based on a false premise.

Since the last time you began a Perrygram by insulting me you turned out to be 
wrong it should be no suprise for this to be a repeat.

The argument from Friedman was as published in a letter to the London Times by 
the man himself. You can even go and look it up if you like, it was published in 
'89 or '90. He did not make a reference to "stakeholders". That was not his 
argument. His argument was based entirely on the mechanism of the market, supply 
and demand.


	-Phill





From unicorn at schloss.li  Fri Jun  7 17:29:03 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sat, 8 Jun 1996 08:29:03 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <ADDDA7B6-382D7B@193.239.225.200>
Message-ID: <Pine.SUN.3.91.960607131101.13383C-100000@polaris>


On 7 Jun 1996, Clay Olbon II wrote:

> Jonathon,
> 
> >	Statistical proof is only accepted in academia.  Depending
> >	upon your POV, this may or may not be a good thing, when
> >	one is facing civil, or criminal charges.  
> >
> >	Finding proof for either civil or criminal charges is a 
> >	slightly different matter.
> 
> IANAL,

And so you thought you would engage in legal commentary, of course. :)

> but your statements are misleading.  Statistics are often used in
> both criminal and civil cases.  Look at the DNA evidence in the OJ trial
> (OK, maybe a bad example), or the evidence that breast implants don't cause
> various ailments (probably another bad example :-).  Both of these examples
> are based on statistics.  IMO, part of the problem with juries (and public
> discourse in general) today is that anecdotal evidence is often accepted,
> when that evidence is clearly not statistically significant.  The examples
> I cited previously illustrate this - the four horsemen are a similar
> example for public policymaking.  

Statistical evidence is fairly strictly regulated actually in a judicial 
context.

e.g., People v. Collins, 438 P.2d 33 (1968) (prohibiting mathamatical odds and 
statistical evidence from use in identification and requireing strict 
foundation to be laid before any probability evidence will be admitted); 
Cole v. Cole, 328 S.E.2.d 446 (1985) (discussing the nature of 
probability in relation to the scope of the evidence presented); Frye v. 
U.S., 293 F. 1013 (D.C.Cir 1923) (estlablishing the rule that scientific 
evidence must be treated with a different standard even when presented 
by certified experts.  specifically that it must be 'generally accepted in 
the scientific community);  See Generally, L.J. Cohen, The Probably and 
the Provable (1977).

> 	Clay
> 
> ---------------------------------------------------------------------------
> Clay Olbon II            | Clay.Olbon at dynetics.com
> Systems Engineer         | ph: (810) 589-9930 fax 9934
> Dynetics, Inc., Ste 302  | http://www.msen.com/~olbon/olbon.html
> 550 Stephenson Hwy       | PGP262 public key: on web page
> Troy, MI 48083-1109      | pgp print: B97397AD50233C77523FD058BD1BB7C0
>                      TANSTAAFL
> ---------------------------------------------------------------------------
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From perry at piermont.com  Fri Jun  7 18:30:20 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sat, 8 Jun 1996 09:30:20 +0800
Subject: Anonymous stock trades.
In-Reply-To: <9606071852.AA04637@Etna.ai.mit.edu>
Message-ID: <199606071900.PAA18399@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> PS, I don't recommend that people read the works of the late Cato
> Institute staffer mentioned. There are better authorities than the
> speechwriter of Barry Goldwater.

Karl Hess Jr (PhD). wasn't Barry Goldwater's speechwriter. His father
was. His father didn't have a PhD -- indeed, he never attended a state
run school past his early teenage years. Karl Hess senior also was
never a Cato instutute staffer -- to my knowledge, his son is not on
the staff of the Cato institute either. Its astounding how many
inaccurate comments you can pack into a brief space.

Dr. Phill Hallam-Baker, D.Phil (one wonders how a doctor of philosophy
differs from a PhD since that is also a doctor of philosophy) seems to
spew random inaccuracies left and right.

Perry





From nelson at crynwr.com  Fri Jun  7 18:31:54 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 8 Jun 1996 09:31:54 +0800
Subject: Internet solution for law enforcement
In-Reply-To: <199606071900.MAA12968@hopf.dnai.com>
Message-ID: <19960607194629.14482.qmail@ns.crynwr.com>


caal at hopf.dnai.com writes:
 > Has anyone seen this yet?  Looks like it's two weeks old.  Internet Police!

Hey, I went into the local New York State Police station and asked if
they had email.  The answer is basically "No."  They've got something
like a telex system.  I doubt that they're any encryption on their
data services.  You'd think that police department RADIOS would at
least be encrypted!  Thanks, TLAs, for your crime encouraging efforts.
[ TLA lurkers should have the grace to wince at that. ]

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From frantz at netcom.com  Fri Jun  7 18:48:53 1996
From: frantz at netcom.com (Bill Frantz)
Date: Sat, 8 Jun 1996 09:48:53 +0800
Subject: WWW servers.
Message-ID: <199606071858.LAA28919@netcom7.netcom.com>


Black Unicorn:
>> Does there currently exist a system which permits webservers to restrict 
>> access to clients who have a given certification?

Sameer:
>       Yup.
....
>       =) Stronghold: The Apache-SSL-US, coupled with XCert
>Sentry. What else?

Bill Stewart:
>Of course, there's a simpler approach; restrict access to people
>who have logins and passwords, and only give those to people
>who have the certification...

But of course, cleartext passwords have their own problems.  You really
need to make use of the fact that there is a computer at both ends so you
are protected from replay attacks.  With that caveat, passwords work fine
(except for the difficulty of remembering a bunch of them vs. the
insecurity of using the same one multiple places or writing them down).


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From SBinkley at atitech.ca  Fri Jun  7 19:26:56 1996
From: SBinkley at atitech.ca (Scott Binkley)
Date: Sat, 8 Jun 1996 10:26:56 +0800
Subject: mailing-list through a remailer
In-Reply-To: <FBBE9A4A02502C79@-SMF->
Message-ID: <FBBE9A4A01502C79@-SMF->


Does anyone know if the following would work:



Having a mailing-list run through a remailer??



Someone would post (through an anon remailer) about a majordomo type list 
through an anonymous remailer (anon-penet.fi for example).  You would 
send a message to 123456 at anon-penet.fi, with a subscribe SECRET-LIST.  
Your message would be anonymous to the list, as the server would be to 
you.  The server would then treat your return address through the 
remailer as your address, and you would post to the anonymous account for 
the server.



It would be double blind, and difficult to find out who ran the list.  If 
you chained the remailers, it would be even more difficult.



Can this be done??



Has this been tried??






From vznuri at netcom.com  Fri Jun  7 19:38:08 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Sat, 8 Jun 1996 10:38:08 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606070205.WAA20230@jafar.sware.com>
Message-ID: <199606072058.NAA05291@netcom3.netcom.com>


>
>> the wallet action will always
>> be tied with some other action. the user picks up the phone to dial
>> somewhere, and it says, "that will be .3c-- will you pay"? he says
>> yes. 
>
> How will you know the cost is .3c a priori?
>What's to stop me from saying yes to the .3c and staying on the line
>forever?

I don't understand why this micropayment thing is being thought
so complicated.

I am making some simple assumptions that seem to not be obviously
apparent, apparently.

I don't think micropayments make sense in transactions in which
the buyer requires the ability to back out of a purchase. in
other words, if I download an FTP file, pay 2c, and then say,
"this isn't what I wanted", I don't think a refund is typically going
to be supported. it would be up to individual vendors, but I doubt
very many would allow it.

a service [x] knows how much they are going to charge for a file
or a http transfer. they tell the user, "you can have this for
[x] cost". the user *sends* them the money to get the data.
there is no concept of the company going into their wallet and
pulling out the cash. the buyer sends the token and initiates the
entire transaction. I am not saying this micropayment thing is
going to be the only way future transactions will work. of course
not. it's just one way that makes some assumptions.

what about services that don't deliver? I would imagine a cyberspatial
equivalent of the BBB will be just fine for that. an agency that
registers complaints. a company doing a micropayment bilk scheme
could only get away with a small amount of cash before they got
a bad reputation. the reputation could be checked by the browser
prior to paying, that kind of thing.

the example I gave of a phone service billing people for phone calls
was not a great example for micropayments, but it could be pulled
off. imagine that your phone has a little readout that tells you
how much you are being charged. you can cancel the call. you can
watch your little readout as it bills you money. you could set
limits, "do not pay more than 10c/minute". these limits are built
into your *local* wallet (browser, phone) etc.-- they are not
handled by the company that is charging you. hence you retain
full control.

  If you disallow that, how?  Will it cost the same amount if
>I'm not sending anything as it will if I'm sending a live video + audio
>feed?  If so, what's to stop me from bundling my whole neighborhood's
>Internet traffic into this call?  If not, how will you tell the
>difference without monitoring my usage and requiring me to pay for the
>additional bandwidth I use?

MICROPAYMENTS. they are for small transactions. the standard billing
model will be used in other situations as it is today, although it
will be moved into a cyberspatial equivalent. micropayments are NOT
going to be the only way the future economy will work. I think some
people seem to have some misconceptions about this. it won't make
sense to use microcurrency everywhere. I don't know if micropayments
will ever be tied to each pack like you are proposing. at least
in the beginning, I would assume a structure like the internet is
today with a micropayment charges built on top of it like I suggested
with browsers or that kind of thing.

companies will probably charge for bandwidth if they are charging for
network services. you can't send a lot of data without using more
bandwidth.






From sandfort at crl.com  Fri Jun  7 20:24:04 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Sat, 8 Jun 1996 11:24:04 +0800
Subject: No Subject
Message-ID: <2.2.32.19960607185634.00749a80@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

At 08:29 AM 6/7/96 -0700, you wrote, re: using ATM machines
instead of couriers:

>Sounds like you are suffering caffeine withdrawal.  Try 
>wondering again after you have had some coffee.

Gosh, I don't even drink coffee and I think Duncan is 
absolutely right on point.  Snide remarks notwithstanding,
what substantive critique do you have of Duncan's remarks?


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From nelson at crynwr.com  Fri Jun  7 20:28:19 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 8 Jun 1996 11:28:19 +0800
Subject: FOR WHOM THE BELL TOLLS
In-Reply-To: <199606071725.KAA26027@mail.pacifier.com>
Message-ID: <19960607182852.14074.qmail@ns.crynwr.com>


jim bell writes:
 > At 04:05 AM 6/7/96 -0000, nelson at crynwr.com wrote:
 > >jim bell writes:
 > >
 > > > My impression is that it is frequently the pacifist-types who get us into 
 > > > war, because they start the process out by tolerating actions by others that 
 > > > turn into more serious actions, etc.  You know, the appeasers.  Are you an 
 > > > appeaser?
 > >
 > >A quote from Donald Wetzel's book Pacifist:
 > >
 > >The pacifist is often asked what he would do in the event the United
 > >States were to be conquered by a hostile power.  The assumption on the
 > >part of the questioner is almost always that we would simply assume
 > >the proper position in which best to have our asses kicked.  I suggest
 > >that anyone who believes that such would be the pacifist response to
 > >the imposition in America of an oppressive, authoritarian
 > >rule--foreign or domestic--should consult the prison authorities that
 > >were in power when America's prisons were host to some six thousand
 > >pacifists.  I am sure it will be found that we have not been
 > >forgotten.
 > 
 > I propose that there has ALREADY been "the imposition in America of an 
 > oppressive, authoritarian rule."
 > 
 > What are the pacifists doing now?

Nothing -- alas, they don't see the oppression or authority.

For better or worse, America really *is* the most free country.  We
sit here and say how much better it could be, and how awful it is
compared to that.  Others look around and say "Well, you aren't being
carried off in the middle of the night by death squads, so I'm not
going to waste my time on you when I could help other people in danger
of death."  I'm not prepared to argue against that judgement.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From hallam at Etna.ai.mit.edu  Fri Jun  7 20:28:29 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Sat, 8 Jun 1996 11:28:29 +0800
Subject: Anonymous stock trades.
In-Reply-To: <199606071900.PAA18399@jekyll.piermont.com>
Message-ID: <9606072143.AA04720@Etna.ai.mit.edu>


 
Perry, 

	for a person who is picking nits you are getting rather too many wrong:
Fortunately you are now arguing in a region where I can give authoratative 
sources online. 

>Karl Hess Jr (PhD). wasn't Barry Goldwater's speechwriter. His father
>was. His father didn't have a PhD -- indeed, he never attended a state
>run school past his early teenage years. 

I had missed the Jr bit, but Hess Sr is somewhat better known.


> Karl Hess senior also was
>never a Cato instutute staffer -- to my knowledge, his son is not on
>the staff of the Cato institute either.

Wrong, try visitng the Cato Institute's site:

http://www.cato.org/people.html

You can find his papers at:

http://www.cato.org/pa-234es.html


Of course the Cato Institute may have simply added him to their "staff" list to 
make them look more important but I doubt it. 

The piece is not particularly original, Cadilac Desert made the same points in 
the early 80s. On the other hand it is a briefing paper intended to influence 
legislation so thats not suprising. Federal subsidies of water and farmland have 
turned into corporate handouts. This is hardly suprising given the mechanism. 

The farmers want to get a freebie handout while pretending that they are not on 
welfare. This leads to a mechanism which is attempting socialist policies 
without admitting that they are socialist, the handouts have to be disguised  
resulting in far more waste than if an intellectually honest policy were 
followed. In the EU there is a similar system of corrupt price support for 
agriculture, mainly supported by the French. 

I don't know of any serious political movement which supports such policies 
except for farmers advocates which does not recognise them as pork barrel.


		Phill





From caal at hopf.dnai.com  Fri Jun  7 20:37:08 1996
From: caal at hopf.dnai.com (caal at hopf.dnai.com)
Date: Sat, 8 Jun 1996 11:37:08 +0800
Subject: "EASYSAFE(R) VERSION 3.0
Message-ID: <199606072136.OAA24986@hopf.dnai.com>


I thought this may be of interest to the list.

>[PRNewswire:Computers-0605.14]    6/5/96
>
>        EASYSAFE(R) VERSION 3.0 FOR DOS, WINDOWS & WINDOWS 95 'FIRST
>        NOTEBOOK SECURITY PRODUCT'
>        
>            CHICAGO, June 5 /PRNewswire/ - EliaShim Safe Software, a leading
>        provider of network security products and anti-virus protection
>        systems, announced at Spring Comdex 96 the release of EasySafe,
>        version 3.0, the first security and encryption product designed
>        specifically for notebook computers.
>        
>        .. EasySafe provides bullet-proof protection that is easy to install.
>        .. EasySafe prevents unauthorized use or access through boot password
>          protection.
>        .. EasySafe prevents removal or transfer of information via full hard
>          disk encryption.
>        .. EasySafe provides keyboard locking after three incorrect password
>          attempts.
>        .. EasySafe provides screen blanking after a predetermined period of
>          inactivity.
>        .. EasySafe denies system level access to hard disk information.
>        .. EasySafe can be configured to disable LPT, COM, and Floppy ports.
>        
>            Upon boot-up, EasySafe asks the user for a password.  A
>        correctly entered password grants the user access to the computer.
>        Encryption/decryption of data on the hard disk is dynamic and
>        completely transparent to the user.  The system allows for three
>        password attempts before locking the computer, and only a cold-boot
>        reset is possible. After entering the correct password, the disk is
>        unencrypted dynamically, normal boot up takes place, and the user is
>        granted access to the system without disk access restrictions or
>        delay.
>        
>            EasySafe includes a DOS/Windows screen saving utility which
>        blanks the screen after a period of inactivity.  The only way to re-
>        activate the computer is to enter the correct password.
>        
>            EasySafe offers two encryption methods.  The first encrypts all
>        data on local hard drives.  The second method encrypts boot sectors
>        and partitions.  This prevents unauthorized users from booting from
>        the "A": drive and accessing the data on the hard disk.  This
>        encryption scheme also protects against the use of disk editing
>        programs (such as Norton Utilities).  Thus, valuable company secrets
>        remain hidden and secure. EasySafe can be configured to disable LPT,
>        COM, and Floppy ports to ensure that the information contained on
>        the hard drive cannot be transferred to another system for later
>        viewing.
>        
>            While annual purchases of notebook computers have increased
>        steadily, the number of notebooks reported stolen each year is much
>        more alarming.  In 1995, 208,000 notebooks with a value of almost
>        $640 million were reported stolen by a Columbus, Ohio insurance
>        company that offers coverage for portable computers (Information
>        Week - May 6, 1996 issue).  EasySafe is the perfect product for
>        those field professionals whose notebooks contain valuable,
>        confidential, company information and other sensitive data that is
>        hundreds of times more valuable than the cost of a notebook.
>        
>            Founded in 1983, EliaShim Safe Software has been providing PC
>        security solutions and anti-virus protection for corporate,
>        government, educational institutions, and program developers in both
>        domestic and international markets.  Over four million computers are
>        protected worldwide.  Product line includes: EasySafe, MasterSafe,
>        ViruSafe Gold, and ViruSafe LAN.
>        
>        -0-                        6/5/96
>        /CONTACT:  Carl Frederick, Jr., Director of Marketing, EliaShim
>        Microcomputers, 800-477-5177, or at Spring Comdex 96, Booth . C5431,
>        312-
>        791-6708/
>        
>        CO:  EliaShim Microcomputers, Inc.
>        ST:  Florida
>        IN:  CPR
>        SU:  PDT
>        
>      






From hallam at Etna.ai.mit.edu  Fri Jun  7 20:58:43 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Sat, 8 Jun 1996 11:58:43 +0800
Subject: Anonymous stock trades.
In-Reply-To: <199606072309.TAA18743@jekyll.piermont.com>
Message-ID: <9606072345.AA04810@Etna.ai.mit.edu>


Perry,

BTW, its not normally polite to post comments on personal mail to a 
list. I thought the list had probably got bored with this nonsense long
ago.

> The fact that neither of them lives within striking distance of
>Cato headquarters (O'Rourke lives in New Hampshire) makes your claim
>ever more interesting.

Being listed as staff in my view makes one a staff member. 

There have been interesting developments in telecommunications which
make it no longer necessary to physically reside where one works.

When I was a CERN fellow I was certainly on the payroll of CERN - 
generally that is what "Fellow" means.

If Perry wishes to call me a fool for calling a person listed by the Cato 
Institute as a member of their "staff" a member of the Cato institute staff then 
I guess Perry has a different deffinition of "fool";.



	Phill







From perry at piermont.com  Fri Jun  7 20:59:51 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sat, 8 Jun 1996 11:59:51 +0800
Subject: Anonymous stock trades.
In-Reply-To: <9606071731.AA04519@Etna.ai.mit.edu>
Message-ID: <199606071820.OAA18322@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> Call someone a fool, invite ridicule... ohhh perry does that make
> you feel big?

Not nearly as big as insisting that all around acknowledge your
doctorate must make you feel, Dr. Phill Hallam-Baker, PhD.

I like the fact, by the way, that you essentially ignored the
substance of my comments, and instead chose to discuss peripheral matters.

If anyone wants to see real discussion of environmental issues with an
emphasis on market based solutions, rather than arguments pulled out
of the buttocks of Dr. Phill Hallam-Baker, PhD, I suggest the writings
of, among others, Karl Hess Jr. (oh, and Dr. Phill Hallam-Baker, PhD
might wnat to know that its Dr. Karl Hess)

> I asked my stock broker about the trades Hilary did. Sorry Perry,
> you were wrong 5% margin is sufficient in most markets.

Only in some markets, but that doesn't matter. She had even less than
that on all of her trades, or didn't you pay any attention, Dr. Phill
Hallam-Baker, PhD. You should have been able to figure that out from
my remarks, incidently -- had she merely been controlling $20,000
worth of cattle with a $1000 investment she couldn't possibly have
wiped out her net worth on a single transaction. Control hundreds of
thousands or millions of dollars worth of cattle, however, and a
sneeze in the marketplace will cost a pretty penny.

Frankly, I think this latest flub demonstrates you don't know any of
the facts of the case, You can't name the size of her trades. You
didn't even know whether she was trading options or futures. I suspect
you are just plain ignorant of the entire situation and are pulling
facts out of your buttocks, largely for reasons of your partisan
support of the Clintons.

Perry





From hallam at Etna.ai.mit.edu  Fri Jun  7 21:02:48 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Sat, 8 Jun 1996 12:02:48 +0800
Subject: Anonymous stock trades.
In-Reply-To: <199606071820.OAA18322@jekyll.piermont.com>
Message-ID: <9606071852.AA04637@Etna.ai.mit.edu>



>Not nearly as big as insisting that all around acknowledge your
>doctorate must make you feel, Dr. Phill Hallam-Baker, PhD.

It was you who insited on calling me "Mr Baker" despite the fact that we have 
been introduced. If you insist on being formal you can get it right. Its a 
D.Phil by the way, not a PhD.


>I like the fact, by the way, that you essentially ignored the
>substance of my comments, and instead chose to discuss peripheral matters.

Good.


	Phill

PS, I don't recommend that people read the works of the late Cato Institute 
staffer mentioned. There are better authorities than the speechwriter of Barry 
Goldwater.

If people are interested in Philosophy then I suggest they read "A History of 
Western Philosophy" by Bertrand Russel. 





From asgaard at sos.sll.se  Fri Jun  7 21:09:39 1996
From: asgaard at sos.sll.se (Asgaard)
Date: Sat, 8 Jun 1996 12:09:39 +0800
Subject: Electronic Signatures
In-Reply-To: <19960607141610.13186.qmail@ns.crynwr.com>
Message-ID: <Pine.HPP.3.91.960608020153.21836A@cor.sos.sll.se>


On 7 Jun 1996 nelson at crynwr.com wrote:

> No, I was responding to the person who was distrustful of the law's
> requirement for certified signatures.  DON'T WAIT FOR THE GUVMINT TO
> CREATE A CERTIFYING AGENCY -- start your own and get some momentum.
> Makes it much harder for them to claim that PGP won't work because

Good advice. And if we are all waiting for our respective Post Offices
to come aboard we'll have to wait for a long time. I don't remember
how many years ago our Post Office was announcing 'real soon now' for
the first time, because so much time has elapsed since then. I guess
such institutions (bye economic capabilities) are mainly hiring cheap
incompetents who will never catch up with the latest developments.

Asgaard





From caal at hopf.dnai.com  Fri Jun  7 21:29:39 1996
From: caal at hopf.dnai.com (caal at hopf.dnai.com)
Date: Sat, 8 Jun 1996 12:29:39 +0800
Subject: Internet solution for law enforcement
Message-ID: <199606071900.MAA12968@hopf.dnai.com>


Has anyone seen this yet?  Looks like it's two weeks old.  Internet Police!

>[BizWire]    5/20/96
>
>        (SUN/PSI-INTL)(SUNW) PSI International, Sun partner, unveils Java-
>        based Internet solution for law enforcement agencies; "Internet in
>        Blue" Police Internet/Intranet Application Suite Available in July
>        1996 
>        
>          Business Editors/Computer Writers
>        
>        Highlights:
>            -- Internet in Blue, one of the first Java-based solutions aimed
>        at fighting crime, is being introduced by PSI International, a
>        strategic partner of Sun Microsystems Federal, and includes other
>        Sun products.  
>        
>            -- Internet in Blue combines the power of Java and Netra servers
>        to enable law enforcement agencies and police departments to quickly
>        leverage the capabilities of the Internet and intranets.  
>        
>            -- This solution is the latest evidence of Sun taking advantage
>        of the significant market opportunity for crime prevention
>        technology.  Last year, Sun Federal announced a dedicated Criminal
>        Justice Operation, which is working with police departments and law
>        enforcement agencies around the world to help them use technology in
>        fighting crime.  
>        
>            MOUNTAIN VIEW, Calif.--(BUSINESS WIRE)-- May 20, 1996--One of
>        the first Sun(TM) Java(TM)-based solutions aimed at fighting crime
>        was introduced today by PSI International, a strategic partner of
>        Sun Microsystems Federal, a subsidiary of Sun Microsystems, Inc.  
>        
>            Called Internet in Blue(TM), the solution combines the power of
>        Sun's Java technology, its Netra(TM) Internet servers, its Java
>        WorkShop(TM) development tools, and PSI's relational database
>        software. This solution fully leverages the capabilities of the
>        Internet for the benefit of law enforcement agencies because of the
>        inclusion of Java, the revolutionary Internet platform from Sun that
>        makes possible fast, easy, operating-system-independent use of the
>        Internet.  
>        
>            To be offered by PSI, Internet in Blue will enable police
>        departments and other law enforcement agencies to leverage the
>        latest Internet technology to fight crime and promote citizen
>        involvement and community-based policing.  From a citizen's
>        perspective, having a local police force with an Internet presence
>        gives people the opportunity to report problems online and play a
>        more active role in fighting crime in their neighborhoods.  
>        
>            Besides utilizing the Internet, the PSI solution also allows
>        local police to build an "intranet," which is a greatly enhanced
>        internal information network to handle departmental processes as
>        well as to speedily access any internal database of interest.
>        Examples of these databases include local crime data such as
>        patterns of crimes, gang affiliations, data on previous suspects and
>        arrests.  Currently, many police departments must locate such data
>        via a paper trail, which is very inefficient.  
>        
>            "Law enforcement agencies are quickly realizing the power of the
>        Internet and intranets as strategic tools in fighting crime," said
>        John Marselle, president of Sun Microsystems Federal.  "The Internet
>        in Blue solution from PSI -- based on Sun technology -- takes
>        advantage of Java's security features, platform independence and
>        database access capabilities.  It should make it much easier for
>        police departments and other criminal justice organizations to get
>        online and to leverage the capabilities of the network."  
>        
>            With Java WorkShop, a visual development environment for Java
>        that can be included as part of the Internet in Blue solution,
>        police departments can design, test, deploy and maintain Internet
>        and intranet applications based on Java with speed and simplicity.
>        Java WorkShop runs on the Sun Solaris(TM) environment and Windows
>        95/NT.  Using Java, the PSIBase relational database management
>        system can access Web browsers across any hardware platform.  
>        
>            "The Internet is the next frontier in the development of law
>        enforcement information systems," said Paul Wormeli, program
>        director for law enforcement at PSI.  "Our Internet in Blue solution
>        will enable law enforcement agencies to quickly exploit the latest
>        technologies like Java."  
>        
>        Internet in Blue includes the following:
>        
>            A starter kit with a Sun Netra Internet server and PSI software
>        and services needed to set up a site on the World Wide Web, as well
>        as technical assistance from PSI for developing content and training
>        for a Webmaster.  
>        
>            A full set of applications to create a police intranet providing
>        secure internal access to selected crime information, standard
>        operating police procedures and other infrastructure services.  
>        
>            An interactive, community-based communications medium to
>        facilitate crime reporting over the Internet and community-based
>        policing.  
>        
>            Suggestions for services that law enforcement agencies can
>        develop in order to offset the cost of the Internet project, such as
>        providing online crime reports and accident report information to
>        authorized outside organizations including legal firms and insurance
>        companies.  -0-
>        
>            The Internet in Blue product will be available in July, 1996.
>        Pricing will vary depending on customer needs.  
>        
>            PSI International, Inc. has provided systems integration and
>        services for over 14 years to federal, state and local governments.
>        The company specializes in law enforcement and public safety
>        solutions, consulting services, and integration of software and
>        hardware.  With a staff of over 250 professionals in the information
>        system and services industry, PSI has a team of people that have
>        both technical and industry knowledge of public safety and justice
>        applications, including computer aided dispatch, records and
>        investigative management, imaging, telecommunications, and mobile
>        computing.  
>        
>            Sun Microsystems Federal, Inc., headquartered in Vienna,
>        Virginia, is a subsidiary of Sun Microsystems, Inc.  Sun Federal's
>        charter is to develop, deliver and sustain markets for Sun products
>        in governments worldwide.  
>        
>            With annual revenues of $6 billion, Sun Microsystems, Inc.,
>        provides solutions that enable customers to build and maintain open
>        network computing environments.  Widely recognized as a proponent of
>        open standards, the company is involved in the design, manufacture
>        and sale of products, technologies and services for commercial and
>        technical computing.  Sun's SPARC(TM) workstations, multiprocessing
>        servers, SPARC microprocessors, Solaris(Tm) operating software and
>        ISO-certified service organization each rank No. 1 in the UNIX(TM)
>        industry.  Founded in 1982, Sun is headquartered in Mountain View,
>        Calif., and employs more than 16,000 people worldwide.  -0-
>        
>            Note to Editors: Sun, the Sun logo, Sun Microsystems, Java, Java
>        Workshop, Netra and Solaris are trademarks or registered trademarks
>        of Sun Microsystems, Inc. in the United States and in other
>        countries.  All SPARC trademarks are used under license and are
>        trademarks or registered trademarks of SPARC International, Inc. in
>        the United States and other countries.  Products bearing SPARC
>        trademarks are based upon an architecture developed by Sun
>        Microsystems, Inc.  UNIX is a registered trademark in the United
>        States and other countries exclusively licensed through X/Open
>        Company, Ltd.  
>        
>            Internet in Blue is a trademark of PSI, International and is
>        properly written in boldface italics, all lower case.  
>        
>            Press announcements and other information about Sun Microsystems
>        are available on the Internet via the World Wide Web using a tool
>        such as Netscape or NCSA Mosaic.  Type http://www.sun.com at the URL
>        prompt.  
>        
>        --30--css/sf*
>        
>        CONTACT: Burson-Marsteller (for Sun)
>                 Jane Rauckhorst, 212/614-4880
>                     or
>                 PSI International
>                 Martha Hill, 703/352-8700
>        
>        KEYWORD: CALIFORNIA
>            INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED
>        INTERACTIVE/MULTIMEDIA/INTERNET PRODUCT GOVERNMENT
>        
>         REPEATS: New York 212-752-9600 or 800-221-2462; Boston 617-236-4266
>        or 800-225-2030; SF 415-986-4422 or 800-227-0845; LA 310-820-9473 BW
>        URL: http://www.businesswire.com
>        






From ponder at wane-leon-mail.scri.fsu.edu  Fri Jun  7 21:40:38 1996
From: ponder at wane-leon-mail.scri.fsu.edu (P.J. Ponder)
Date: Sat, 8 Jun 1996 12:40:38 +0800
Subject: Wasting time and bandwidth on Bell
Message-ID: <Pine.3.89.9606071348.A12943-0100000@wane3.scri.fsu.edu>



On Fri, 7 Jun 1996 08:29:56 -0400 (EDT), Declan McCullagh wrote:

>Excerpts from internet.cypherpunks: 6-Jun-96 Re: FOR WHOM THE BELL TOLLS
>by jim bell at pacifier.com 
>> Not quite yet, anyway.  I'm very disappointed to have waited over a 
>>year for 
>> some slick lawyer to show me how I'd be violating some law or another
>>to do so
...
>A few observations:

>1. Not many readers of cypherpunks are lawyers

I've noticed quite a few, actually.  I don't know how many are regular
readers but there seems to be enough to maintain a steady undercurrent of
legal thinking on the issues associated with digital commerce, some
anonymity and First Amendment issues, a sprinkling of criminal law topics,
and of course, banking, intellectual property, SEC, antitrust, general
contract, and related commercial law.

>2. Of the laywers who do read cypherpunks, many may not choose to spend
>their time researching what laws AP may violate. Or they're not "slick"
>lawyers; take your pick.

Or they automatically delete any posts that come from or relate to the 
puerile bullshit Bell is infamous for, and choose not to get dragged into 
this type of time- and bandwidth- wasting garbage.  Of which this post is 
just another, of course, but i get so damn sick and tired of the constant 
imposition of 'AP' and related nonsense on this list.  Of late, the 
trolls seems to be particularly effective among people who should know 
better, and an aura of credence or relevance has developed around some of 
this crap.  Can't we just ignore it, and move on?  Maybe if we ignore him 
he'll go away.

>3. Congress would have no problems passing a law outlawing AP, if one
>does not exist already.
>
>-Declan

I would be satisfied if they just outlawed e-mail about it. 





From perry at piermont.com  Fri Jun  7 21:53:34 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sat, 8 Jun 1996 12:53:34 +0800
Subject: Anonymous stock trades.
In-Reply-To: <9606071739.AA04525@Etna.ai.mit.edu>
Message-ID: <199606071832.OAA18353@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> No, you miss the point. Friedman has become a slave to his theory, he is 
> attempting to push his idea even to solve a situation it clearly
> cannot.

I don't believe you when you claim that Friedman said what you claim
at all. I suspect it is, as most of your other comments have been,
either a complete misunderstanding of some actual comments or
something pulled essentially out of the air. The claim you have made
is so at odds with the Milton Friedman who's writings I have been
reading for years (and indeed so out of character for any member of
his economic school) that I find it nearly impossible to believe that
the article exists as stated.

No modern economist would claim that the market solution to preventing
a species from going extinct is for people not to buy it. Its one of
the msot idiotic statements I've heard in years. As a nobel prize
winning economist, Friedman understands things like commons issues and
the public goods problem and I cannot believe he would ever make such
an inane statment, no matter what you claim.

Given your poor record with facts here recently (nearly every
assertion you have made about the Hillary Clinton case, from claiming
she was trading options when she traded futures to obviously having no
knowledge of the size of her trades), I will want to see a reprint of
the article you claim exists before I will accept that there is any
validity to your claims whatsoever.

Perry





From asgaard at sos.sll.se  Fri Jun  7 22:01:10 1996
From: asgaard at sos.sll.se (Asgaard)
Date: Sat, 8 Jun 1996 13:01:10 +0800
Subject: Anonymous stock trades.
In-Reply-To: <199606071452.KAA18055@jekyll.piermont.com>
Message-ID: <Pine.HPP.3.91.960608021535.21836B-100000@cor.sos.sll.se>


On Fri, 7 Jun 1996, Perry E. Metzger wrote:

> Of course, what Dr. Phill Hallam-Baker, PhD, suggests is idiotic. As
> any free market economist would tell you, the way to stop a resource
> from being destroyed is not to pray that people won't buy it but to
> assure that someone has an ownership stake in the resource, thus
> assuring that their investment would be destroyed if the resource
> vanished.

Who is going to assure that someone has an ownership stake in the
Humpback Whales? The World Government? Is that entity supposed to
give the whales to some private whale-watcher's tourism enterprise?
I don't get it.

Who cares about a bunch of Norwegian (or Japaneese) fishermen?

Asgaard





From perry at piermont.com  Fri Jun  7 22:20:41 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sat, 8 Jun 1996 13:20:41 +0800
Subject: Anonymous stock trades.
In-Reply-To: <9606072143.AA04720@Etna.ai.mit.edu>
Message-ID: <199606072223.SAA18645@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> > Karl Hess senior also was
> >never a Cato instutute staffer -- to my knowledge, his son is not on
> >the staff of the Cato institute either.
> 
> Wrong, try visitng the Cato Institute's site:
> 
> http://www.cato.org/people.html

He's a Cato fellow. I don't think that implies anything more than
he he gets some money from them.

Or are you on the staff of the U.S. government?

.pm





From perry at piermont.com  Fri Jun  7 22:26:51 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sat, 8 Jun 1996 13:26:51 +0800
Subject: Anonymous stock trades.
In-Reply-To: <9606072307.AA04756@Etna.ai.mit.edu>
Message-ID: <199606072309.TAA18743@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
> >He's a Cato fellow. I don't think that implies anything more than
> >he he gets some money from them.
> 
> Nope, he is listed in "senior staff".

He's listed in the staff section, but he's clearly labeled as a
fellow. P.J. O'Rourke is also listed in the same column as a fellow. I
suppose he's working at Cato full time and only moonlights at Rolling
Stone. The fact that neither of them lives within striking distance of
Cato headquarters (O'Rourke lives in New Hampshire) makes your claim
ever more interesting.

> I'm working on digital signature systems under a DARPA contract.

We shall therefore have to declare you to be a U.S. Government employee.

.pm





From blancw at MICROSOFT.com  Fri Jun  7 22:27:35 1996
From: blancw at MICROSOFT.com (Blanc Weber)
Date: Sat, 8 Jun 1996 13:27:35 +0800
Subject: Anonymous stock trades.
Message-ID: <c=US%a=_%p=msft%l=RED-81-MSG-960607225058Z-3624@abash1.microsoft.com>


>From: 	hallam at Etna.ai.mit.edu

>The farmers want to get a freebie handout while pretending that they
>are not on 
>welfare. This leads to a mechanism which is attempting socialist
>policies ...
[etc.]
.............................................................

Okay, but what does this have to do with anonymous stock trades?


>    ..
>Blanc





From rah at shipwright.com  Fri Jun  7 22:31:52 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Sat, 8 Jun 1996 13:31:52 +0800
Subject: Anonymous stock trades.
In-Reply-To: <199606071820.OAA18322@jekyll.piermont.com>
Message-ID: <v03006f0cadde3dcbbe36@[199.0.65.105]>


At 2:52 PM -0400 6/7/96, hallam at Etna.ai.mit.edu wrote:

> If people are interested in Philosophy then I suggest they read "A
>History of
> Western Philosophy" by Bertrand Russel.

About the only useful thing he's said here in weeks...

Cheers,
Bob Hettinga





-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From trei at process.com  Fri Jun  7 22:35:27 1996
From: trei at process.com (Peter Trei)
Date: Sat, 8 Jun 1996 13:35:27 +0800
Subject: [NOISE] Banking's Physical Security
Message-ID: <199606071803.LAA05945@toad.com>



From: Sean T Carnes <crisper at ascensionet.com>

> We all know that banks are very highly protected as far as their money =
> goes but how safe are there computers?  I live very close to a computer =
> database collecting company that collects the data related to many banks =
> in the area.  It is all done through land lines and is not very well =
> protected.  They aren't very careful about who or what they let into the =
> building also.  If someone were to cut the lines the banks in the area =
> would be out for days and they wouldn't have a means to do interbank =
> transactions outside of the immediate area.  Has anyone else seen this =
> in there area or heard of it. Wouldn't it be a better idea to do the =
> transactions by satellite.

There's a big difference between a real bank and a data collection outfit. I used
to work at a major money center bank in the Wall Street area. To get to the data 
center I had to:

1. Walk into the building, past an armed security guard.
2. Within sight of him, use my badge stripe to get through a turnstile - most employees
    had badges which were limited in the times they would work.
3. Take an elevator to the (unadvertised)  correct floor.
4. Use my badge in a reader to get out of the elevator lobby - most badges were 
    restricted in the floors they would open.
5. Use my badge to get through an unmarked door, into the 'airlock'.

In the airlock, I'd hold my photo ID up to a reader, so the guard downstairs could.

a. Compare my face against that on the photo ID.
b. Check that I was authorized to enter the data center.
c. Check that there was no one else in the airlock with me.

If he was satisfied, he'd open the inside door remotely.

6. The data center was manned by at least two operators (usually more), 24 hours
a day, seven days a week. Only they were permitted to touch terminals connected to
operational systems.

(There were other security features I won't go into.)

Sure, our fiber optic lines to CHIPS and the Fed occasionally went out - that's what 
backup dialout phone lines are for. If we had phone
problems, the lines were fixed in a couple hours, not days. At a pinch, I imagine you
could use now a cellphone and  modem to keep things moving.

Peter Trei





From ravage at ssz.com  Fri Jun  7 22:39:19 1996
From: ravage at ssz.com (Jim Choate)
Date: Sat, 8 Jun 1996 13:39:19 +0800
Subject: Remailer thoughts
Message-ID: <199606080031.TAA04969@einstein.ssz.com>



Hi Adam,

Forwarded message:

> From: Adam Shostack <adam at homeport.org>
> Subject: Re: Remailer chain length?
> Date: Tue, 4 Jun 1996 22:57:10 -0500 (EST)
> 
> Jim Choate wrote:
> 
> | > I don't think multiple remailers at the same site help anything.
> | > 
> | 
> | I agree completely. If traffic analysis is going to be done on a single box
> | it isn't going to matter how many remailers are there.  The monitor will
> | simply grab them all. At this point it simply maps them thusly:
> 
> |       incoming message > remailer #1 > .... > remailer #n > outgoing
> | 
> | 
> | That this really maps to is obvious:
> | 
> | 
> |       incoming message > remailer #1-#n > outgoing
> 
> 	Analyzing the traffic through three remailers is more
> difficult than analyzing the traffic through one.  One remailer with
> three N messages per day is more secure than an equivilant remailer
> with N mesasges.


Not if they are on the same box, simply treat the box itself as the
remailer. The internal mechanics are for the most part irrelevant to this
issue. N messages go in, N messages with (number of remailers)(# of cover
traffic/real message) messages of cover. My contention is that it does not
matter how many remailers are on a single box. It is the number of
connections in and out of the box available. The above equation is clearly
linear and therefore not what I would consider computationaly challenging.

If I may introduce some terminology (unless their is an existing stnd.),

x       number of messages
y       message multiplier
N#()    remailer number #
R#()    number of remailers on machine #
C()     number of cover messages/original messages
E#      number of connections on machine #
T()     total traffic through remailer system
$i()    cost per message, incoming
$o()    cost per message, outgoing
C       fixed cost items of operation (eg rent)

Note: each of these represent a family of functions.

My contention:

T(R#(n)) is equivalent to T(R#(N1(x), N2(x)..., Nn(x))) 

Where,

T() = R#(n)(2N#(x) + C(yN#(x)))

The term 2N#(x) represents the number of valid messages the remailer
handles. x incoming & x outgoing, hence 2x.

The total income of such a remailer:

$(T(x))=$i(x)-$o(T(x)-x)-C

It is important to recognize the profit dependancy on the input/output
message ratio. If it gets too high, you got nothing to spend on yourself.

Your contention (if I may translate):

N1(3x) is more secure than N1(x), assuming identical remailer configuration.

Do you consider N#(ax) equivalent to aN#(x)? May I inquire into your
reasoning?

> [much good thought deleted.]
> 
> |         5. Automaticaly limits spamming unless a remailer allows cloning
> |            AND all recipients share a commen private key.
> 
> 	Or unless the remailer mails to a mail to news gateway.

This is a limitation of the mail-news gateway and not of the remailer
technology. What it points to is a serious shortcoming in mail-news gateway
software. The technology required for truely efficient newsgroup handling is
something sorely in need of work.

> |         6. It maps 1:1 onto the physical remailer model with the same limits
> |            on information at each stage. This allows one to directly apply
> |            the current history of precedence involving anonymity and
> |            physical remailers.
> 
> 	With physical remailers, you can open the inner envelopes and
> read the message, leaving the end user to wonder where the post office
> lost the message.  With 'real' remailers, the lost message can't be
> read, only not delivered.

If the encryption technology is secure. The point I am making here is that
the encryption envelope is 'secure' only so long as nobody is trying to
crack it. Sooner or later somebody is going to decrypt your message, if not
the entire encryption system. This is synonymous with the physical model. The
paper envelope is secure as long as somebody isn't breaking the law by
tampering with the mail.
 
> | This is the basic model that the Austin Cypherpunks are working on at the
> | currrent time. The big problem we have right now is determining if the body
> | is actualy encrypted. We have done some basic tests of encryption-spoofing
> | using pgp and it is looks to be a thorny problem. It simply is not trivial
> | to look at a block of characters and determine if they are actualy
> | encrypted. You can't rely on the wrapper around the data put there by the
> 
> 	I'm not sure I see why this matters?  If you check that the
> message is not obviously readable, why not assume that its well
> encrypted?  You're rarely required to contort yourself to ensure your
> customers are obeying the law (weaponsmiths, cryptographers, and banks
> excepted.)  

Ok. Let's for a moment assume that to send a message to
'president at whitehouse.gov' with 'Die Bill!' is a crime. Would it not be a
crime to foil a packet of encryption by inserting 'Die Bill!' messages in
clear text in the encryption block? To date, provided no attempt at actual
decryption is attempted, there is nothing in the standards that prevent this
other than digital signatures. And again, a specific program has to be
executed. A person might very well look at it as plaintext w/o ever running
digital signatures (or they just assume its always right). Would this also
be a crime?

                                                      Jim Choate

       "Reality is observer dependant"
                              \
                                \   \\/////
                                    |     | 
                                    (.) (.)
      ===========================oOO==(_)==OOo==========================             

         Tivoli an IBM company                  CyberTects: SSZ
         Customer Support Engineer              SOHO Consulting/VR/Robotics

         9442 Capitol of Texas Highway North    1647 Rutland
         Suite 500                              #244  
         Austin, TX 78759                       Austin, TX  78758

         Email: jchoate at tivoli.com              Email: ravage at ssz.com
         Phone: (512) 436-8893                  Phone: (512) 259-2994
         Fax:   (512) 345-2784                  Fax: n/a
         WWW:   www.tivoli.com                  WWW: www.ssz.com
         Modem: n/a                             Modem: (512) 836-7374
         Pager: n/a                             Pager: n/a
         Cellular: n/a                          Cellular: n/a

      ===================================================================






From rah at shipwright.com  Fri Jun  7 22:41:25 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Sat, 8 Jun 1996 13:41:25 +0800
Subject: E-Data Systems ~ patent #4,528,643
Message-ID: <v03006f0aadde3d5ca403@[199.0.65.105]>


I think this has made the rounds here, already.

If it hasn't, any comments?

Cheers,
Bob Hettinga

--- begin forwarded text


Date: Fri, 7 Jun 1996 15:53:52 GMT
X-Sender: jnferree at postoffice.worldnet.att.net
Mime-Version: 1.0
To: Robert Hettinga <rah at shipwright.com>
From: "J. Neil Ferree" <jnferree at worldnet.att.net>
Subject: E-Data Systems ~ patent #4,528,643

Has anyone else received the *Amnesty* documentation from
E-data Systems of Secaucus, NJ regarding their patent on:

... system for reproducing information in material objects at a
point of sale location ...

"The patent generally describes the system and methodology
whereby products composed of digital data are purchased and
embedded electronically at a point of sale location from a host
computer. The products are typically delivered in usable form only
after payment is made. The purchaser requests delivery after the
money requirements are satisfied and authorized for the delivery
is granted. In today's vernacular, the patent covers on-demand
electronic distribution". [taken from the accompanying brochure]

Their licensing agreement (with fee schedules) addresses;

1) Content providers; Owners and sellers of products which are
sold and delivered electronically by the provider or through a
distribution network owned by another within the scope of at
least one of the E-data Systems patent claims.

2) Resellers; Distributors who provide a distribution network for
content providers to sell products within the scope of at least one
of the E-data Systems patent claims.

3) Service providers for Electronic Distribution Applications;
Providers of various services, (ie) encryption, locking, unlocking
metering, etc. who provide applications for content providers and/or
resellers within the scope of at least on of the E-data Systems patent
claims.

Contact information for E-data Systems regarding how to obtain
a license ....

Tele         800-406-1668
Web        www.3wnet.com/corp/edata
e-mail     gift at planet.net

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From hallam at Etna.ai.mit.edu  Fri Jun  7 22:49:43 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Sat, 8 Jun 1996 13:49:43 +0800
Subject: Anonymous stock trades.
In-Reply-To: <v03006f0caddd1c3bbce1@[199.0.65.105]>
Message-ID: <9606071739.AA04525@Etna.ai.mit.edu>



>According to your logic above, it seems that all species are *much* more
>important than man. But, with most "liberal" logic, there's a paradox here.
>Let's explore it bit, shall we, by looking at the other side of the balance
>sheet you just created?

No, you miss the point. Friedman has become a slave to his theory, he is 
attempting to push his idea even to solve a situation it clearly cannot. There 
are good reasons to conserve whale stocks irrespective of your eccological 
position. Without sufficient stocks the whaling industry will go the way of the 
carrier pidgeon canning industry.

>Tell me, Phill, what's *your* pricetag on a single *human* life? The entire
>gross global product is not enough? It's this kind of, well, muzzy-headed
>innumerate (yes, *Dr.* Hallam-Baker, *innumerate*) silliness that has our
>intellectuals believing the hoax, put convincingly enough to get published
>in "respected" academic places like "Social Text", that reality (physics,
>in this case) is optional.

Bob, you are way off base here. You are putting up a straw man. I have not 
endorsed the views of Social text, I've not even mentioned them. 


As I stated I am much more inclined to the logical positivist view than to the 
continental school of philosophy of which social text is an exemplar. My views 
on Derrida and his school are pretty negative, he has perhaps three good ideas 
and has been eeking them out with showmanship. I don't think that the 
deconstructionists are able to enter into a rational debate because they 
continually consider themselves obliged to challenge the terms of the debate. 

I'm fairly familiar with the debate that Social Text engages in and I consider 
it to be pretty bogus. They are arguing that language is insufficient for the 
purposes of their discussion so they create a new vocabulary without 
preconceptions. This project is doomed to failure since there is no means of 
defining the new language except in terms of the one in common usage they have 
rejected. So one might as well use plain language for arguement.

This is why the Web is heavilly influenced by Hermenuetics, the point Sokal was 
making was actually one which is central to the work of Hiedegger and Gadamer. 
The establishment of a shared vocabulary is necessary for communication, 
communication defines being. It is entierely illogical for someone claiming to 
be establishing a theory of communication to do so by attempting to establish a 
private ontology. The Social Text people are refuted by their own work. 


>Can you say "Sophistry", boys and girls? I knew you could. No offense to
>the, er, numerate computer science people out there, but it seems that
>*Dr.* Hallam-Baker is living proof that you can get an entire *doctorate*
>in the field, and not learn to count. 

Bob, you would be able to make your point better if you had an understanding of 
the principles you are discussing. I have some understanding of philosophical 
method and how to apply it. Your point on sophistry is a straw man. Solopcism is 
a paradox, it is an argument which demonstrates the inadequacy of our system of 
thought. Descartes and Hume argued the point at great length, whether mind or 
sensation is primary. 


I fail to see how you make the bridge from comments on Friedman to Social Text. 
I was merely pointing out that I consider Friedman to be overly ideological and 
that the certainty he claims for his results are not backed by empirical proof. 
He has described a theory which is impossible to prove or disprove because it is 
impossible to perform controlled experiments. Would the US ecconomy be stronger 
if Carter had won in 1980 instead of Reagan? Its impossible to say.


If the libertarian fringe does not wish to remain so I suggest you try the 
following:-

1) Never ever start a post by directly stating that someone is an ignoramous.

2) Accept the fact that some people do not accept the axioms you are arguing 
from.

3) Differentiate between advancing your arguement and advancing your ego.


The first is the most important. If you have no respect for the people you are 
arguing against you will utterly fail to convince them of anything. 







From frantz at netcom.com  Fri Jun  7 22:51:31 1996
From: frantz at netcom.com (Bill Frantz)
Date: Sat, 8 Jun 1996 13:51:31 +0800
Subject: Anonymous stock trades.
Message-ID: <199606071858.LAA28924@netcom7.netcom.com>


At 10:52 AM 6/7/96 -0400, Perry E. Metzger wrote:
>... As
>any free market economist would tell you, the way to stop a resource
>from being destroyed is not to pray that people won't buy it but to
>assure that someone has an ownership stake in the resource, thus
>assuring that their investment would be destroyed if the resource
>vanished. Thats why, for instance, timber companies happily clear cut
>government land that they have leased (after all, not clear cutting
>would mean that they wouldn't extract maximum value for their lease
>under the idiotic terms that the leases are made under) but will
>almost never clear cut their own lands, because that would reduce
>their long term value.

I find this analysis a bit superficial because it does not consider the
difference between short-term and long-term value.  To use Perry's example
of the timber industry.  Before the late 1980s, the lands owned by Pacific
Lumber were managed for long-term production.  When the company was taken
over as part of the "maximize present value" movement in the late 1980s,
the management goals changed to increase timber production without regard
to long-term production.  (I seem to remember that the takeover was one of
Michael Milken's deals.)

My conclusion from this example is that if your interest is in the
long-term preservation of ecosystems, you need institutions that are
structured so they take a long-term view, and can not be subverted by
short-term trends in markets.  As far as I can tell, the US National Park
Service, for all its faults, does as good a job of preserving ecosystems as
any other institution, and better than most.  (If you disagree, please
provide examples of institutions that do as well.)


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From declan at well.com  Fri Jun  7 23:21:14 1996
From: declan at well.com (Declan McCullagh)
Date: Sat, 8 Jun 1996 14:21:14 +0800
Subject: NSA/CIA to snoop INSIDE the U.S.???
Message-ID: <v01510103adde28dab2e8@[204.62.128.229]>


This is a fucking big story.

Allowing the CIA and NSA to snoop domestically, and using only a handful of
suspicions and anecdotes about cybernastiness and evil cryptohackers to
justify this major policy shift -- well, it's fucking amazing.

Nunn's proposal, unfortunately, was more than a "suggestion."

But Rory's right. DC *is* in the throes of Internet fever, and it'll just
get worse as the summer gets hotter and hotter. It's almost 80 degress
right now.

-Declan



>What?!  What the *@#!! is wrong with the people who supposedly smart
>people representing us?!
>
>Ern
>
>-------- From SJ Mercury:
>
>    NET FEVER ON THE HILL
>
>    Published: June 6, 1996
>
>    BY RORY J. O'CONNOR
>    Mercury News Washington Bureau
>
>    WASHINGTON -- The White House wants a coordinated task force to fight
>    terrorism on the Internet. Some senators think the CIA should be
>    allowed to work hand in hand with the FBI to fight computer crime on
>    U.S. soil. Meanwhile, the federal courts are deciding a major First
>    Amendment case that might ban certain information from the Net.
>
>    The nation's capital is in the throes of Internet fever.
>
>    For the past several months, the condition has become acute, and by
>    the end of the year the Internet itself may look far different as a
>    result: more tightly regulated, more carefully monitored and more
>    expensive.
>
>    The latest symptom: a suggestion Wednesday for the elimination of laws
>    that prohibit U.S.  intelligence agencies -- notably the National
>>>> Security Agency and the Central Intelligence Agency -- from snooping   <<<
>>>> on home soil. The reason: The potential for computer crime and         <<<
>    terrorism is so great, and the Internet so decentralized and
>    international, that police and the FBI must combine forces with spy
>    agencies in order to successfully analyze the threat and investigate
>    criminal activity.
>
>    ''If we're going to live in this kind of world, we're going to have to
>    link the intelligence world with law enforcement,'' said Sen. Sam
>    Nunn, D-Ga.
>
>    For many people in government who work on computer and law-enforcement
>    issues, the course of the disease seems painfully slow. They often
>    describe the Internet as the Wild West that's sorely in need of a good
>    marshal. But for many people who use the Internet, the government's
>    efforts are moving far ahead of any real knowledge of a technology
>    that, two years ago, almost nobody had heard of.
>
>    ''There are not dead bodies in the street,'' said Donna L. Hoffman, a
>    professor at Vanderbilt University who studies the Internet. ''It just
>    doesn't make sense to rush into legislation.''
>
>    [ SNIP ]







From declan+ at CMU.EDU  Fri Jun  7 23:23:28 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sat, 8 Jun 1996 14:23:28 +0800
Subject: OECD http://www.oecd.org/news_and_events/release/nw96-46a.htm
In-Reply-To: <199606071824.LAA06312@toad.com>
Message-ID: <EliCI2_00YUzQPhrRx@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 7-Jun-96 Re: OECD  
http://www.oecd... by Bill Stewart at ix.netcom.c 
> >>The private sector is closely involved in drafting the Guidelines,
> >>with business representatives from the Business and Industry Advisory
> >>Committee (BIAC) participating at the meeting. 
> >>The OECD meeting, which took place on 8 May, was hosted by the US
> >>Department of State in Washington DC.
>  
> Was the meeting announced to at least the public in advance?
> The schedule on the web page mentioned the 8 May meeting,
> at least after the fact, but does not list any of the following
> meetings, and there's no identification of your BIAC committee's
> members or even the member governments participating.

I believe the OECD meetings are closed to the public and journalists. I
was thinking of going to one, but was told that I couldn't. (Even though
I'm fully accredited with U.S. Congress-issued press identification.)

Isn't there an OECD meeting soon in Paris? Marc Rotenberg from EPIC has
been following this closely and would be a good person to ask.

-Declan
(somewhat tipsy, always a bad idea when posting to cypherpunks)






From jon at aggroup.com  Fri Jun  7 23:24:37 1996
From: jon at aggroup.com (Yanni)
Date: Sat, 8 Jun 1996 14:24:37 +0800
Subject: E-Data Systems ~ patent #4,528,643
Message-ID: <9606071941.AA57813@jon>


> I think this has made the rounds here, already.
>
> If it hasn't, any comments?
>
> Cheers,
> Bob Hettinga

yea, we got a couple of them from those guys...

whatever...

how can you claim a patent on that stuff?

geeezzz...

-jon

Jon (no h) S. Stevens        yanni at clearink.com
ClearInk WebMagus      http://www.clearink.com/
finger pgp at sparc.clearink.com for pgp pub key
What I just wrote is beta. Please report all bugs directly to me.





From ezundel at alpha.c2.org  Fri Jun  7 23:26:02 1996
From: ezundel at alpha.c2.org (E. Zundel Repost)
Date: Sat, 8 Jun 1996 14:26:02 +0800
Subject: I swear I am not making this up. (rec.music.white-power)
Message-ID: <199606080130.SAA18545@infinity.c2.org>


From: bb748 at FreeNet.Carleton.CA (Milton Kleim)
Newsgroups: news.groups,alt.skinheads,alt.politics.nationalism.white,
            alt.politics.white-power
Subject: Statement Regarding rec.music.white-power
Date: 6 Jun 1996 23:10:41 GMT
Organization: The National Capital FreeNet
Lines: 48
Sender: bb748 at freenet3.carleton.ca (Milton Kleim)
Message-ID: <4p7ohh$mq2 at freenet-news.carleton.ca>
NNTP-Posting-Host: freenet3.carleton.ca

Now that the results for our newsgroup proposal have been issued, we wish 
to make a statement concerning our objectives.

Three objectives were sought in the rec.music.white-power project:

#1: Generate mainstream media publicity for the Aryan Resistance Movement
    and disseminate the Holy Cause of the 14 Words -- "We must secure the
    existence of our People and a future for White children."

#2: Encourage revelation of Enemy activists' identities to facilitate 
    counter-espionage and prevent many instances of "anti-racist" activism
    against the 14 Words.

#3: Create a newsgroup for discussion and promotion of Aryan music. 

On objective one, we succeeded beyond all expectations.  No informed 
North American is not now unaware of our existence on the Internet.  
National Public Radio, _USA Today_, the _St. Paul Pioneer Press_, and 
Minnesota Public Radio, to name a few media organs, gave us priceless 
free publicity for our ideas and our Holy Cause.

On objective two, we also succeeded well.  We now have a comprehensive 
list of Enemy agents who are active on the Net.  Aryan Corps Counter-
intelligence is now undertaking a classification and cataloguing project 
which will make our counter-espionage efforts much more effective.

On objective three, we obviously failed, but this was expected.  Nonethe-
less, benefit has been gained from this defeat.  The Aryan Corps 
succeeded in organizing hundreds of Aryan Resistance Movement activists 
toward a constructive goal, increasing the "esprit de corps" of our ranks.

We would like to thank all individuals who, for whatever reason, voted in 
the affirmative for our group.

A special thanks is extended to Mr. Michael Handler, our vote-taker, for 
his herculean efforts to process the massive results for our proposal.  
We wish him well.

-- Milton John Kleim, Jr., Proponent, rec.music.white-power; Chief Organi-
                           zer, Aryan Corps

-- White Wolf (RH), Deputy Organizer, Aryan Corps

   And on behalf of the entire Aryan Corps Network.





From perry at alpha.jpunix.com  Fri Jun  7 23:36:52 1996
From: perry at alpha.jpunix.com (John Perry)
Date: Sat, 8 Jun 1996 14:36:52 +0800
Subject: New type2.list/pubring.mix
Message-ID: <199606072340.SAA01105@alpha.jpunix.com>

A non-text attachment was scrubbed...
Name: not available
Type: application/pgp
Size: 14 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/19960608/43d6f93c/attachment.bin>

From asgaard at sos.sll.se  Fri Jun  7 23:38:16 1996
From: asgaard at sos.sll.se (Asgaard)
Date: Sat, 8 Jun 1996 14:38:16 +0800
Subject: It tolls for thee
In-Reply-To: <addda7cd01021004f950@[205.199.118.202]>
Message-ID: <Pine.HPP.3.91.960608022659.21836C-100000@cor.sos.sll.se>


On Fri, 7 Jun 1996, Timothy C. May wrote:

> Importantly, I'm including my own words, explicitly. Sorry to burst _our_
> bubbles, but I just don't think the lawmakers and burrowcrats are being
> driven by loose talk by us.

Perhaps not the lawmakers, but...

There was this moment last summer, on a Friday, when loose
talk on the cp-list (and, explicitly, some comments from TC May)
made me 99% sure that selling Netscape stock (short) would be a
great idea. Still next Monday it sold for something like $145.
Next Wednesday it fell to around $120. I know for sure that if
I had been in a position then to conveniently (and immediately)
act on the NY Stock Exchange (which I was not) I would have
risked something like $5,000 on such a deal - I'm not rich but
so strong was the cypherpunkish momentum towards this development.

Asgaard





From caal at hopf.dnai.com  Fri Jun  7 23:50:24 1996
From: caal at hopf.dnai.com (caal at hopf.dnai.com)
Date: Sat, 8 Jun 1996 14:50:24 +0800
Subject: Internet Police
Message-ID: <199606072143.OAA25552@hopf.dnai.com>


Has anyone seen this yet?  Looks like it's two weeks old.  Internet Police!

>[BizWire]    5/20/96
>
>        (SUN/PSI-INTL)(SUNW) PSI International, Sun partner, unveils Java-
>        based Internet solution for law enforcement agencies; "Internet in
>        Blue" Police Internet/Intranet Application Suite Available in July
>        1996 
>        
>          Business Editors/Computer Writers
>        
>        Highlights:
>            -- Internet in Blue, one of the first Java-based solutions aimed
>        at fighting crime, is being introduced by PSI International, a
>        strategic partner of Sun Microsystems Federal, and includes other
>        Sun products.  
>        
>            -- Internet in Blue combines the power of Java and Netra servers
>        to enable law enforcement agencies and police departments to quickly
>        leverage the capabilities of the Internet and intranets.  
>        
>            -- This solution is the latest evidence of Sun taking advantage
>        of the significant market opportunity for crime prevention
>        technology.  Last year, Sun Federal announced a dedicated Criminal
>        Justice Operation, which is working with police departments and law
>        enforcement agencies around the world to help them use technology in
>        fighting crime.  
>        
>            MOUNTAIN VIEW, Calif.--(BUSINESS WIRE)-- May 20, 1996--One of
>        the first Sun(TM) Java(TM)-based solutions aimed at fighting crime
>        was introduced today by PSI International, a strategic partner of
>        Sun Microsystems Federal, a subsidiary of Sun Microsystems, Inc.  
>        
>            Called Internet in Blue(TM), the solution combines the power of
>        Sun's Java technology, its Netra(TM) Internet servers, its Java
>        WorkShop(TM) development tools, and PSI's relational database
>        software. This solution fully leverages the capabilities of the
>        Internet for the benefit of law enforcement agencies because of the
>        inclusion of Java, the revolutionary Internet platform from Sun that
>        makes possible fast, easy, operating-system-independent use of the
>        Internet.  
>        
>            To be offered by PSI, Internet in Blue will enable police
>        departments and other law enforcement agencies to leverage the
>        latest Internet technology to fight crime and promote citizen
>        involvement and community-based policing.  From a citizen's
>        perspective, having a local police force with an Internet presence
>        gives people the opportunity to report problems online and play a
>        more active role in fighting crime in their neighborhoods.  
>        
>            Besides utilizing the Internet, the PSI solution also allows
>        local police to build an "intranet," which is a greatly enhanced
>        internal information network to handle departmental processes as
>        well as to speedily access any internal database of interest.
>        Examples of these databases include local crime data such as
>        patterns of crimes, gang affiliations, data on previous suspects and
>        arrests.  Currently, many police departments must locate such data
>        via a paper trail, which is very inefficient.  
>        
>            "Law enforcement agencies are quickly realizing the power of the
>        Internet and intranets as strategic tools in fighting crime," said
>        John Marselle, president of Sun Microsystems Federal.  "The Internet
>        in Blue solution from PSI -- based on Sun technology -- takes
>        advantage of Java's security features, platform independence and
>        database access capabilities.  It should make it much easier for
>        police departments and other criminal justice organizations to get
>        online and to leverage the capabilities of the network."  
>        
>            With Java WorkShop, a visual development environment for Java
>        that can be included as part of the Internet in Blue solution,
>        police departments can design, test, deploy and maintain Internet
>        and intranet applications based on Java with speed and simplicity.
>        Java WorkShop runs on the Sun Solaris(TM) environment and Windows
>        95/NT.  Using Java, the PSIBase relational database management
>        system can access Web browsers across any hardware platform.  
>        
>            "The Internet is the next frontier in the development of law
>        enforcement information systems," said Paul Wormeli, program
>        director for law enforcement at PSI.  "Our Internet in Blue solution
>        will enable law enforcement agencies to quickly exploit the latest
>        technologies like Java."  
>        
>        Internet in Blue includes the following:
>        
>            A starter kit with a Sun Netra Internet server and PSI software
>        and services needed to set up a site on the World Wide Web, as well
>        as technical assistance from PSI for developing content and training
>        for a Webmaster.  
>        
>            A full set of applications to create a police intranet providing
>        secure internal access to selected crime information, standard
>        operating police procedures and other infrastructure services.  
>        
>            An interactive, community-based communications medium to
>        facilitate crime reporting over the Internet and community-based
>        policing.  
>        
>            Suggestions for services that law enforcement agencies can
>        develop in order to offset the cost of the Internet project, such as
>        providing online crime reports and accident report information to
>        authorized outside organizations including legal firms and insurance
>        companies.  -0-
>        
>            The Internet in Blue product will be available in July, 1996.
>        Pricing will vary depending on customer needs.  
>        
>            PSI International, Inc. has provided systems integration and
>        services for over 14 years to federal, state and local governments.
>        The company specializes in law enforcement and public safety
>        solutions, consulting services, and integration of software and
>        hardware.  With a staff of over 250 professionals in the information
>        system and services industry, PSI has a team of people that have
>        both technical and industry knowledge of public safety and justice
>        applications, including computer aided dispatch, records and
>        investigative management, imaging, telecommunications, and mobile
>        computing.  
>        
>            Sun Microsystems Federal, Inc., headquartered in Vienna,
>        Virginia, is a subsidiary of Sun Microsystems, Inc.  Sun Federal's
>        charter is to develop, deliver and sustain markets for Sun products
>        in governments worldwide.  
>        
>            With annual revenues of $6 billion, Sun Microsystems, Inc.,
>        provides solutions that enable customers to build and maintain open
>        network computing environments.  Widely recognized as a proponent of
>        open standards, the company is involved in the design, manufacture
>        and sale of products, technologies and services for commercial and
>        technical computing.  Sun's SPARC(TM) workstations, multiprocessing
>        servers, SPARC microprocessors, Solaris(Tm) operating software and
>        ISO-certified service organization each rank No. 1 in the UNIX(TM)
>        industry.  Founded in 1982, Sun is headquartered in Mountain View,
>        Calif., and employs more than 16,000 people worldwide.  -0-
>        
>            Note to Editors: Sun, the Sun logo, Sun Microsystems, Java, Java
>        Workshop, Netra and Solaris are trademarks or registered trademarks
>        of Sun Microsystems, Inc. in the United States and in other
>        countries.  All SPARC trademarks are used under license and are
>        trademarks or registered trademarks of SPARC International, Inc. in
>        the United States and other countries.  Products bearing SPARC
>        trademarks are based upon an architecture developed by Sun
>        Microsystems, Inc.  UNIX is a registered trademark in the United
>        States and other countries exclusively licensed through X/Open
>        Company, Ltd.  
>        
>            Internet in Blue is a trademark of PSI, International and is
>        properly written in boldface italics, all lower case.  
>        
>            Press announcements and other information about Sun Microsystems
>        are available on the Internet via the World Wide Web using a tool
>        such as Netscape or NCSA Mosaic.  Type http://www.sun.com at the URL
>        prompt.  
>        
>        --30--css/sf*
>        
>        CONTACT: Burson-Marsteller (for Sun)
>                 Jane Rauckhorst, 212/614-4880
>                     or
>                 PSI International
>                 Martha Hill, 703/352-8700
>        
>        KEYWORD: CALIFORNIA
>            INDUSTRY KEYWORD: COMPUTERS/ELECTRONICS COMED
>        INTERACTIVE/MULTIMEDIA/INTERNET PRODUCT GOVERNMENT
>        
>         REPEATS: New York 212-752-9600 or 800-221-2462; Boston 617-236-4266
>        or 800-225-2030; SF 415-986-4422 or 800-227-0845; LA 310-820-9473 BW
>        URL: http://www.businesswire.com
>        






From jya at pipeline.com  Fri Jun  7 23:53:33 1996
From: jya at pipeline.com (John Young)
Date: Sat, 8 Jun 1996 14:53:33 +0800
Subject: NTT Chips Beat Cops
Message-ID: <199606080230.CAA26365@pipe5.t2.usa.pipeline.com>


   The Economist, June 8, 1996, p. 65. 
 
 
   Encryption 
 
   Silence of the bugs 
 
 
   Spare a thought for America's professional snoops. For 
   decades the FBI and others have counted the telephone 
   wiretap among their favourite weapons against crime, as 
   countless mafiosi can (and did) testify. Now, software in 
   a computer or digital telephone can scramble a message so 
   effectively that no law-enforcement agency can read it. For 
   years, the government has fought back by restricting the 
   use of encryption, to the fury of privacy advocates on the 
   Internet, where rampant eavesdropping makes encryption 
   essential. Now a bit of silicon and a stack of paper have 
   apparently ended the battle: the cops lost. 
 
   The bit of silicon is actually two chips that can encrypt 
   data transmissions so that they are in effect uncrackable. 
   Had the chips been developed in the United States, the 
   government would have classified them as "munitions" and 
   banned their export. But they were developed in Japan, by 
   NTT, the telephone giant, and the Japanese subsidiary of 
   RSA, an American encryption company, which revealed their 
   existence early this week. They can therefore be used 
   around the world, and even imported into the United States. 
   There seems nothing the American government can do about 
   it. 
 
   As if that were not bad enough, America's restrictive 
   encryption policy took another hit last week when a report, 
   commissioned by Congress and compiled by the prestigious 
   National Research Council (NRC), concluded that the policy 
   had hurt Americans far more than it had helped them. For 
   the past few years, the White House has been offering a 
   purported compromise: give the government (or a mutually 
   trusted third party) a key to read your encrypted e-mail, 
   and you can scramble it all you like. The problem with this 
   so-called "key escrow" proposal was that it smacked to many 
   of Big Brotherism. The computer industry rejected it out of 
   hand, and fell back instead on weaker encryption that was 
   not regulated, even though this can be cracked over a 
   weekend with a home PC. 
 
   Up to now, the government's response to cries for better 
   encryption for all has been to fall back on its 
   responsibility to protect the citizenry. The NRC panel 
   rejected this, together with the "if only you knew what we 
   know" argument the government has usually trotted out. 
   Composed of former security officials and encryption 
   experts, this panel did know what the government knows, and 
   was still not convinced. 
 
   Now the NTT chips seem to sweep away the whole debate. NTT 
   has already sold the chips in 15 countries, and they should 
   soon be incorporated in products. Stewart Baker, the former 
   general counsel of America's National Security Agency, 
   concedes that the chips have probably killed encryption 
   controls in America, but argues that the battle will 
   continue to run in Europe, where countries such as France 
   limit their use. For the rest of the world, these bits of 
   silicon may indeed make it harder for police to protect 
   citizens. But they will also make it easier for citizens to 
   protect themselves. 
 
   -- 
 





From jimbell at pacifier.com  Fri Jun  7 23:57:20 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 8 Jun 1996 14:57:20 +0800
Subject: It tolls for thee
Message-ID: <199606072243.PAA13632@mail.pacifier.com>


At 09:42 AM 6/7/96 -0700, Timothy C. May wrote:
>At 7:29 AM 6/7/96, jim bell wrote:
>
>>Even so, given how much noise we've been hearing out of DC on the subject
>>of the Internet, digital cash, and good encryption, I'd say SOMEBODY is
>>getting a bit worried.  I haven't exactly been keeping this stuff a secret:
>>What do you think their reaction has been, so far?  When those
>>government-types start considering various scary scenarios, what do you
>>think they are imagining?
>
>I don't think any significant amount of the current stuff coming out of
>Washington has anything to do with my words, your words, or the words of
>anyone on this or any other forum I know about.

Okay, I was not trying to suggest that any particular source is followed.  
What I'm noticing is the almost uniformly "pessimistic" (as to the fate of 
the government) views I've read on the various computer networks, and the 
uniformly hostile reactions to government proposals.  This can't be 
reassuring to the people in power today.



>Rather, the reasons for their actions and hyperbole about the Net, the Web,
>online porn, money laundering, the "information highway," and all that
>trendy stuff is because they can see many of the same trends we see.
>
>While I have a certain amount of pride that my single-page "Crypto
>Anarchist Manifesto" essentially nailed a bunch of trends which have become
>obvious to all in the 8 years after I issued it, I don't for a picosecond
>think anything I wrote then or since has had any significant effect on
>proposed leglislation.

Don't be so sure.  Legislators, alone, don't have the smarts to figure out 
why they "needed" a Clipper-chip proposal, or the capacity to tap 1% of the 
phone calls, or other recent government proposals.  Government is usually 
very good at ignoring problems long after they become problems.  The fact 
that they're so hot to control the Internet suggests to me that somebody has 
been talking to them about what is going to happen. 
 

Jim Bell
jimbell at pacifier.com





From wendigo at gti.net  Sat Jun  8 00:21:55 1996
From: wendigo at gti.net (Herr Wendigo)
Date: Sat, 8 Jun 1996 15:21:55 +0800
Subject: Clinton To Cipher Whitewater Video (fwd)
Message-ID: <199606071922.PAA04435@apollo.gti.net>


An entity claiming to be Matthew Gaylor wrote:
>From freematt at coil.com Fri Jun  7 12:31:25 1996
Date: Fri, 7 Jun 1996 12:02:40 -0400
X-Sender: freematt at bronze.coil.com
Message-Id: <v0213050badddc7a0b29f@[198.4.94.200]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: freematt at coil.com (Matthew Gaylor)
From: freematt at coil.com (Matthew Gaylor)
Subject: Clinton To Cipher Whitewater Video

From: softwa19 at us.net (Charles R. Smith)
Subject: Clinton To Cipher Whitewater Video

President Clinton is scheduled to video-tape his testimony in
the second Whitewater trial.  He will do so from the oval office
in July.  The first video taped testimony he sent to an Arkansas
court room was scrambled in order to protect his personal and
political privacy.  One can only assume that the President will
also encrypt his second testimony for the same reasons.  I have
no problem with the President exercising his rights to use
encryption.  That is what the defensive technology is for.
However, President Clinton is also engaged in an effort to
deny that very same right from ordinary citizens.

The Clinton administration has tried for several years to ban or
remove all defensive encryption security from computers,
stressing that crime had a higher priority over privacy.  His
latest Clipper III proposal would require all U.S. citizens to
turn over their keys (escrow) so that the FBI can ensure that no
one is using their computer for criminal activities.  In effect,
the proposal would invalidate the First, Fourth and Fifth
amendments.  Escrow is the modern equal to the FBI demanding
your house key.  This is so the FBI can check in every now and
then.  Yet, instead of making life safer, the proposal will
leave us wide open for hacker attack.

It is a fact that the Clinton record of computer security is so
poor that the GAO reported over 160,000 successful penetrations
against just the Defense Department in 1995.  In fact, during
one incident, a 16 year old hacker could have started a war
between North Korea and America (Rome NY USAF Base/Korean Atomic
Research Facility 1995). Please note - DOD has the best computer
security record of all government agencies!  That means the
situation at the FBI, BATF, FAA, HUD and IRS is worse.  Much
worse.  The computers that control the military, financial,
industrial, medical and political heart of America are waiting
for a Digital Pearl Harbor, left undefended by Presidental
order.  His proposal also assumes that a huge bureaucracy
erected to monitor escrowed keys would be more secure than our
nuclear arsenal.  Ridiculous.

President Clinton has risked global nuclear war to push
intrusive and obsolete ideas which protect nothing.  Instead,
President Clinton should heed the GAO report which concluded
that securing million dollar military computers with no
encryption software, no firewalls and untrained, part-timers, is
the wrong thing to do.  President Clinton demands his personal
and legal privacy but refuses to support the same for you and
me.  President Clinton has risked our personal safety and our
common democracy in order to create a large bureaucracy of
lawyers who will do nothing but count bits.  The President
should take a lesson from his own actions, cipher thyself, and
protect America.  He should join Senator Bob Dole and a whole
crowd of Bi-partisan elected officals in supporting the PROCODE
bill (S. 1726).  This bill gives every American the right to
encrypt.  The right to personal privacy.  The same right Bill
Clinton enjoyed during the last video session at the Whitehouse.

1 if by land, 2 if by sea.  Paul Revere - Encryption 1775
Charles R. Smith
SOFTWAR  Richmond, VA  http://ally.ios.com/~softwa19

PCYPHER signature:
4279C640DB607D4D13B808082D7CC6F23938320C1956E31A50781D192D627672
601D141C6516051C061976462B382C294542435F19665B2B316E174955445C56
5A506675180400041F030A001472657A6A1201191C0E0003784FCCE47ACB9531
E1EE5997D5E34A97A351C22B2F1871573A85BB02E3CB5C046FB24E80478AEB74
4063578E1E8019425A08091923FE6D4CA375669185FD8935B361CA6B65949FE3
57E8629F5981F5030E0AAD2BECA669808B2A038E1D89E810398F0A4DDCD2F5A7
B1E6417290D1290346BE790894F6AD1E790C57A0B457C1BE85A5D3CFB42E38E8
D5C6BDAECA57F968898F345920D5804CF5832D70534F5C66230AF099F68CAECD


****************************************************************************
Subscribe to Freematt's Alerts: Pro-Individual Rights Issues
Send a blank message to: freematt at coil.com with the words subscribe FA
on the subject line. List is private and moderated (7-30 messages per week)
Matthew Gaylor,1933 E. Dublin-Granville Rd.,#176, Columbus, OH  43229
****************************************************************************




-- 
    Mark Rogaski   | Why read when you can just sit and |      Member
  GTI System Admin |         stare at things?           | Programmers Local
  wendigo at gti.net  | Any expressed opinions are my own  |     # 0xfffe
 wendigo at pobox.com | unless they can get me in trouble. |     APL-CPIO






From editor at cdt.org  Sat Jun  8 00:26:02 1996
From: editor at cdt.org (Bob Palacios)
Date: Sat, 8 Jun 1996 15:26:02 +0800
Subject: CDT Policy Post 2.23 - Congress/FTC Focus on Online Privacy Issues
Message-ID: <v02140b0badde8519e0ee@[204.157.127.16]>


-----------------------------------------------------------------------------
    _____ _____ _______
   / ____|  __ \__   __|   ____        ___               ____             __
  | |    | |  | | | |     / __ \____  / (_)______  __   / __ \____  _____/ /_
  | |    | |  | | | |    / /_/ / __ \/ / / ___/ / / /  / /_/ / __ \/ ___/ __/
  | |____| |__| | | |   / ____/ /_/ / / / /__/ /_/ /  / ____/ /_/ (__  ) /_
   \_____|_____/  |_|  /_/    \____/_/_/\___/\__, /  /_/    \____/____/\__/
   The Center for Democracy and Technology  /____/     Volume 2, Number 23
----------------------------------------------------------------------------
      A briefing on public policy issues affecting civil liberties online
----------------------------------------------------------------------------
 CDT POLICY POST Volume 2, Number 23                         June 7, 1996

 CONTENTS: (1) Congress/FTC Focus on Online Privacy Issues - Solutions Differ
           (2) Text of EFF, CDT, PFAW, VTW Letter to Rep. Franks (R-NJ)
                on impact of "Children's Privacy" Bill
           (3) Join Senator Burns Live Online June 11, 10pm ET
           (4) How to Subscribe/Unsubscribe
           (5) About CDT, contacting us

  ** This document may be redistributed freely with this banner in tact **
        Excerpts may be re-posted with permission of <editor at cdt.org>
-----------------------------------------------------------------------------

  ** UPDATE: DECISION IS NEAR IN FIGHT TO SAVE FREE SPEECH ONLINE **

  An announcement from the Court is expected any time. Be sure to visit
     http://www.cdt.org/ciec/ for the latest news and information!

-----------------------------------------------------------------------------
(1) CONGRESS/FTC FOCUS ON ONLINE PRIVACY - OFFER DIVERGENT SOLUTIONS

The increasing use of the Internet by children, combined with the ease of
collecting personal information online, raise serious privacy issues.
However, while there is broad consensus on the goal of giving people more
control over the collection and use of personal information online, some of
the solutions being offered may have far-reaching, though perhaps
inadvertent, impact on the free flow of information in interactive media.

Over the past several months, concerns about the availability and use of
personal information in the online world, particularly with respect to the
collection and use of information about children, have prompted the
Congress and the Federal Trade Commission (FTC) to seriously consider this
important issue.

The approaches to this issue fall broadly into two distinct categories:

* Create Criminal Penalties For The Collection And Use Of Personal
  Information About Kids Without Parental Consent.

* Encourage The Development And Use Of Technologies That Enable Users
  and Parents To Limit The Amount Of Personal Information They and Their
  Children Reveal Online.

Legislation designed to restrict the collection and use of personal
information about children without parental consent was recently introduced
by Rep Bob Franks (R-NJ). The bill has sparked concerns from cyber-rights
advocates that it may end up increasing the collection of personal
information online and result in restrictions on the free flow of
information (see the attached letter from EFF, People for the American Way
Action Fund, VTW, and CDT below).

Recent hearings before the FTC emphasized the broad consensus about the need
to give individuals more control over the collection and use of personal
information. The FTC hearings highlighted the availability of technologies
which empower users and parents to exercise more control over the collection
and use of such information, and the possibility that existing methods,
including the PICS standards, can be enhanced to enable users to express
preferences about how and to what extent they are willing to have personal
information reused (although much work needs to be done before this is fully
implemented).

In addition, Rep. Ed Markey (D-MA), a long time champion of privacy issues,
told the FTC panel that he would like to encourage the development of
technologies that enable users to control the amount of personal
information they reveal online. Markey also emphasized that Congress should
consider legislation in this area if such technologies are not developed or
are not effective.  Markey told the FTC:

 "We should see if there are technological tools that can empower
  consumers. Where they don't exist, or where a particular industry
  refuses to embrace this code of electronic ethics in a way that solves
  this problem, then the government is obliged to step in and do
  something."

Markey also announced that he intends to introduce legislation soon to give
consumers the right to know that information is being collected about them,
notice that personal information may be reused or sold, and the right to
say "no" to the reuse or sale of their personal information.  Markey's
legislation would also commission a study of existing online privacy
practices (The full text of Rep. Markey's statement is available at CDT's
privacy issues web page URL below.)

The FTC hearings illustrated that there is broad concern about the
collection and use of personal information online. There was also great
substantial support expressed for technological solutions to address this
issue.  As a result, the FTC has requested that the industry report back to
the Commission in 6 months on progress towards developing technologies that
enhance user control over the collection and use of personal information
online.

CDT is encouraged that Congress and the FTC have taken such strong interest
in the issue of online privacy, and we look forward to working with all
interested parties to ensure that solutions give users control over the
collection and use of personal information and do not adversely affect the
free flow of information online.

More information, including CDT's testimony before the FTC panel and Rep.
Markey's statement, and a demonstration illustrating the amount of personal
information collected during the normal course of surfing the Web, can be
found at CDT's Privacy Issues page:

   http://www.cdt.org/privacy/

-----------------------------------------------------------------------

(2) Letter from EFF, PFAW Action Fund, VTW & CDT to Rep. Bob Franks
    Regarding "Children's Privacy" (HR 3508) Bill

The following letter was sent last week to Representative Bob Franks (R-NJ)
regarding the "Children's Privacy Protection and Parental Empowerment Act"
(HR 3508) from the Electronic Frontier Foundation, People for the American
Way Action Fund, the Voters Telecommunications Watch, and the Center for
Democracy and Technology.

Among other things, the groups expressed concern that, as currently
drafted, the bill raises some of the same privacy and free flow of
information issues raised by the Exon/Coats "Communications Decency Act" to
the extent that it is extremely difficult to know whether or not a person
visiting a web site is or is not a child without requiring all visitors to
identify themselves.

While commending Rep. Franks for his efforts and expressing support for the
goal of his legislation, the letter outlines several concerns about the
impact of the bill on the Internet.  The groups pledged to work with Rep.
Franks and other interested members of Congress to explore technological
solutions which empower users and parents to control the use of personal
information and preserve the free flow of information.

The Franks bill enjoys broad support from a number of conservative
"pro-family" groups such as the Christian Coalition, Enough Is Enough!, and
the National Law Center for Children and Families, as well as privacy
groups such as EPIC, Privacy Times Publisher Evan Hendricks and Privacy
Journal Publisher Robert Ellis Smith.

The text of HR 3508 is available at: http://www.cdt.org/privacy/children/

The full text of the letter from EFF, PFAW Action Fund, VTW and CDT follows:

----------
June 4, 1996

Representative Bob Franks
429 Cannon House Office Building
Washington, DC 20515

Dear Representative Franks:

We are writing to commend your efforts to protect children's privacy.
We are pleased that you have begun a process to put these important issues
at the center of the political debate. We believe, however, that the
solutions recommended in your bill, -- the "Children's Privacy Protection
and Parental Empowerment Act" (HR 3508) -- particularly as they relate to
the exchange of information on the Internet, will not only increase the
collection of information about children in certain circumstances but will
also criminalize behavior in a vast array of unintended situations, thereby
compromising the free flow of information online.

With the rising popularity of the Internet and commercial online
services, concerns regarding the vulnerabilities of unsupervised children's
activities online must be addressed. Indeed, although the Internet offers
children unprecedented and important new educational and recreational
opportunities, the medium also may offer access to inappropriate material,
or exposure to unfair marketing or information collection practices.
 Solutions to these problems must be carefully analyzed and should take into
account both the unique nature of the Internet, as well as the multitude of
First Amendment and privacy rights at stake for all who seek to read,
communicate, and associate with others in the online environment. In fact,
the Federal Trade Commission (FTC), whose responsibility it is to police the
existence and proliferation of unfair or deceptive advertising and
information practices has scheduled hearings for June 4 and 5 to look at
these very issues as they apply to the Internet.

Because your bill was drafted to apply to all media we are concerned
that its application in the Internet context may lead to unintended
consequences. We ask that you examine, together with the FTC, the unique
qualities of the Internet and the problems that result from regulating
activity at the information publisher or Web site operator end.

In its application to the Internet, the Children's Privacy Protection
and Parental Empowerment Act is both over-inclusive, covering virtually all
who participate in the Internet, and ineffective, in that it leaves
substantial loopholes for those who engage in the behavior at which the bill
is targeted.

The term "personal information," the basic regulatory target of the
bill, is defined in such as way that it may include nothing more than an
electronic mail address which by its nature, gives no indication of the age
or physical location of a user.  Furthermore, the term "list broker," is
drafted to cover any entity which exchanges personal information in the
course of its operation. The vast majority of World Wide Web site operators,
as well as anyone who operates a listserv, mailing list or other information
distribution mechanism, all collect, store, and may well exchange, email
addresses. Then, unless Web site operators obtain parental consent before
collecting information, they risk criminal penalties for violation of
section (a)(4).

The difficulty in compliance is two-fold. First, information providers
on the Internet have no way of distinguishing children from adults.  In
fact, compliance with the bill could well lead to an increase in the
collection of information about children and adults, only compounding
privacy risks. Even with the imposition of an unacceptably intrusive
national ID system (a system that none of us support), it would still be
essentially impossible for an information publisher or Web site operator to
establish the age of the user visiting the providers site. Second, the
requirement to disclose the source of personal information about children to
parents creates unclear new obligations on Internet information providers.
In fact, many of the information providers who would be covered by your
bill do not keep track of the source of their information and thus may not
have the ability to comply with the statute.  Compliance with this section
could well lead to an increase in the overall collection of personal
information about Internet users, thereby compounding privacy risks.

Imposed identification procedures applied to the World Wide Web under
the threat of criminal penalties would limit all Internet users' ability to
read, speak, receive information and interact online under
constitutionally-protected conditions of anonymity. Further, requiring
parental consent in all instances or requiring providers to disclose
information to parents collected from children fails to acknowledge the
distinction between young children and teenagers and their rights under the
Constitution.

Finally, section (a)(6) which criminalizes any distribution or receipt
of personal information where the receiver has knowledge or "reason to
believe that the information will be used to abuse the child or physically
harm the child" is well-intentioned, but potentially so broad as to cover
anyone who receives and discloses personal information about a child. The
bill establishes no clear standard of care or level of knowledge necessary
to meet this requirement, leaving everyone on the Internet in doubt about
whether or not they may be violating this new crime. Schools and
organizations who publish directories as well as newspapers who publish the
identity of a child in a news story could be subject to prosecution because
they had "reason to know" that the information may end up in the possession
of bad actors.

Given all of these difficulties in applying your bill to the Internet,
and given the importance of addressing children's privacy issues, we suggest
that examination of alternatives is in order. Empowering parents to protect
their children's privacy with existing technological tools and fair
information practices by the industry will help ensure that the Internet
continues to grow and thrive for both commercial and noncommercial
endeavors. For example, software already on the market such as Cyberpatrol,
as well as industry-standard technologies such as the Platform for Internet
Content Selection (PICS) enable people -- including parents and their
children -- to restrict access to sites which practice objectionable
marketing and information collection techniques.

At present, PICS technology, along with other innovative products,
allows parents to filter and block-out materials that contain objectionable
content or block access to sites with inappropriate or abusive marketing
practices. Current technology can enable parents to:

* prevent their children from accessing Web sites with inappropriate
  information practices -- as defined by the parent or a consumer or privacy
  organization of the parent's choice;

* prevent their children from revealing personal information such as name,
  address, and e-mail address to others;

* install security measures such as passwords that prevent their child from
  changing rules about Web site access or information disclosure, collection
  and use that the parent has established.

The Internet community is already considering extensions to the PICS
specifications which will enable individual users and parents to block the
transmission of their personal information to Web sites they visit and to
express a preference about how and to what extent they are willing to have
personal information reused. PICS, Cyberpatrol and other technologies can
help eradicate the deceptive and inappropriate practices your bill seeks to
address without compromising the rights of users or content providers.

Several of us have had the opportunity to talk with you and your staff
about this legislation. We appreciate your willingness to discuss these
issues and look forward to working with you in this important area in the
hopes that technological alternatives combined with better industry
practices and much more narrowly crafted legislation will help protect this
nation's children in the online world, consistent with First Amendment and
privacy principles.

Sincerely,

The Center for Democracy and Technology
The Electronic Frontier Foundation
People For the American Way Action Fund
Voters Telecommunications Watch
----------
----------------------------------------------------------------------------
(3) Join Senator Conrad Burns Live Online to Discuss Encryption Policy The
    Night Before His Subcommittee Holds a Hearing On the Issue!

 --> Visit http://www.hotwired.com/wiredside/ for details <--

In what is becoming the newest way for Congress to read the net.community's
opinion on issues, Senator Conrad Burns (R-MT) will be on HotWired on June
11th @ 10pm EST to discuss the encryption issue with all attendees. The
next day, Senator Burns will chair the first of two scheduled hearings on
the encryption issue with industry luminaries.

Never before has the public had this much access to legislators without
geographical proximity.  Cheaper than teleconferencing, and more direct
and unfiltered than the traditional press, online chats allow the public
to directly question and hear the answers of Congress.

Have a question about encryption policy that you've never been able to find
out from the government?  Come to the HotWired chat and ask Senator Burns
to be your advocate to press the witnesses and the White House on these
issues.

The online chat is at 10pm EDT (7pm PDT) on Tuesday June 11, the night
before the first hearing. HotWired's WiredSide chat is at:

     http://www.hotwired.com/wiredside/

Next Tuesday's forum is another in a series of planned events, and is part
of a broader project coordinated by CDT and the Voters Telecommunications
Watch (VTW) designed to bring the Internet Community into the debate and
encourage members of Congress to work with the Net.community on vital
Internet policy issues.

The transcript from last week's discussion with Congressman Rick White is
now available -- for information about the transcript, previous events with
other members of Congress, and upcoming events, please check CDT's newest
Issues Page, "Congress and the Net":

     http://www.cdt.org/net_congress/

------------------------------------------------------------------------
(4) SUBSCRIPTION INFORMATION

Be sure you are up to date on the latest public policy issues affecting
civil liberties online and how they will affect you! Subscribe to the CDT
Policy Post news distribution list.  CDT Policy Posts, the regular news
publication of the Center For Democracy and Technology, are received by
more than 9,000 Internet users, industry leaders, policy makers and
activists, and have become the leading source for information about
critical free speech and privacy issues affecting the Internet and other
interactive communications media.

To subscribe to CDT's Policy Post list, send mail to

     policy-posts-request at cdt.org

with a subject:

     subscribe policy-posts

If you ever wish to remove yourself from the list, send mail to the
above address with a subject of:

     unsubscribe policy-posts

-----------------------------------------------------------------------
(5) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US

The Center for Democracy and Technology is a non-profit public interest
organization based in Washington, DC. The Center's mission is to develop
and advocate public policies that advance democratic values and
constitutional civil liberties in new computer and communications
technologies.

Contacting us:

General information:  info at cdt.org
World Wide Web:       URL:http://www.cdt.org/
FTP                   URL:ftp://ftp.cdt.org/pub/cdt/

Snail Mail:  The Center for Democracy and Technology
             1634 Eye Street NW * Suite 1100 * Washington, DC 20006
             (v) +1.202.637.9800 * (f) +1.202.637.0968

-----------------------------------------------------------------------
End Policy Post 2.23                                             6/7/96
-----------------------------------------------------------------------







From nobody at replay.com  Sat Jun  8 00:26:39 1996
From: nobody at replay.com (Name Withheld by Request)
Date: Sat, 8 Jun 1996 15:26:39 +0800
Subject: middle-man may be moving...
Message-ID: <199606080215.EAA10166@basement.replay.com>


	It looks like I'm going to have to move the middle-man remailer.
The nym server at alpha.c2.org has been down for several days. This
directly affects the middle-man remailer. Since nymrod at nym.jpunix.com has
made it to Raph's list, I'm going to contact the admin at jpunix.com and
see if it's ok for me to point the middle-man remailer nym at his server.
Maybe it will be a little more reliable and allow the middle-man remailer
to work properly. Stay tuned for further details as they occur!

  middle-man-admin at alpha.c2.org (don't bother to reply, it doesn't work)





From smorri59 at raptor.icubed.net  Sat Jun  8 00:27:55 1996
From: smorri59 at raptor.icubed.net (ScottMorris)
Date: Sat, 8 Jun 1996 15:27:55 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <9606080332.AA29486@raptor.icubed.net>


[snip]
>
>On the substance of Schwartau's claims about "HERF guns," I'm a bit
>skeptical that this is a real threat _at this time_. I'll say more on this
>later.
>

>So, why am I so skeptical? For a couple of reasons:
>
>1. Conventional explosives work perfectly fine for a lot of sabotage
>efforts. It is unlikely that a mysterrious van is likely to be parked next
>to a London brokerage or computer firm in the City of London, given their
>history of terrorism.

Why bother with explosives when you can pull a manhole cover and climb down
with a <insert power tool of choice here, I prefer the chainsaw myself>. All
that copper/fiber has to run somewhere in the area to get into the buildings.
When the conductor is gone say goodnight. Or the alternative, pour gas into
the access covers and light it. Simple is better.

>2. To be a credible threat, there usually needs to be some form of
>"demonstration." I have heard of no such thing. Absent such a public
>demonstration, I find it hard to believe that beancounters would OK the
>giving away of hundreds of millions of dollars for a threat which is
>abstract and hard to understand for laymen.

        Short of a tac nuke there won't be one any time soon. The
herf/emp/sci-fi weapon of choice is not feasible *at this time*. Remember
the square law. If it isn't in the machine room, or damn close it won't
work. One has to wonder why the assorted experts on this haven't built a
working model and given a controlled demonstration.

>3. This recent story smacks of hype. I'm not saying Schwartau is hyping his
>conferences and his book, and his consulting business, just saying it
>strikes me as a hyped threat without direct confirmation.

While the consultants are hypeing all this I have REAL threats to deal with.

>
>--Tim May
>

P.S. I guess I'm going to have to get Eudora Pro so I can filter out the
psychos 'R' us persona.
-----
My opinions are my own, not those of my employer.

Scott L. Morris	
smorri59 at mailhost.icubed.net
** They can have my PGP key when they **
** pry it from my cold dead keyboard! **






From sandfort at crl.com  Sat Jun  8 00:30:56 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Sat, 8 Jun 1996 15:30:56 +0800
Subject: Anonymous stock trades.
In-Reply-To: <Pine.HPP.3.91.960608021535.21836B-100000@cor.sos.sll.se>
Message-ID: <Pine.SUN.3.91.960607190041.20808B-100000@crl8.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

On Sat, 8 Jun 1996, Asgaard wrote:

> Who is going to assure that someone has an ownership stake in the
> Humpback Whales? The World Government? Is that entity supposed to
> give the whales to some private whale-watcher's tourism enterprise?
> I don't get it.

When I first was introduced to free market economics, I had the
same sorts of questions (e.g., "who will own the roads?").  If
you keep at it, though, these questions are easily answered.

Rather than give away the answer to Asgaard's question, I'll
propose the following Socratic response:

Who assures that someone has an ownership stake in the ships
that sail the sea?  


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~








From nelson at crynwr.com  Sat Jun  8 00:33:09 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 8 Jun 1996 15:33:09 +0800
Subject: mailing-list through a remailer
In-Reply-To: <FBBE9A4A02502C79@-SMF->
Message-ID: <19960608040239.16261.qmail@ns.crynwr.com>


Scott Binkley writes:
 > Having a mailing-list run through a remailer??

Only through a penet-type remailer.  It couldn't work at all with a
mixmaster-type, and would work but poorly with a ghio-type with reply
block.

 > It would be double blind, and difficult to find out who ran the list.

Only if your name isn't Julf.

 > If you chained the remailers, it would be even more difficult.

If you chained the remailers for your subscription, then every message
would travel the same path.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From llurch at networking.stanford.edu  Sat Jun  8 00:39:59 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sat, 8 Jun 1996 15:39:59 +0800
Subject: "Fascism is corporatism"
In-Reply-To: <addcfd85030210047ae2@[205.199.118.202]>
Message-ID: <Pine.GUL.3.93.960607174038.163C-100000@Networking.Stanford.EDU>


On Thu, 6 Jun 1996, Timothy C. May wrote:

> At 6:18 PM 6/6/96, Rich Graves wrote:
> >On Wed, 5 Jun 1996, Bruce Baugh, who usually knows better, wrote:
> >
> >> Fascism has no intrinsic link to genocide. It is a theory of economics,
> >> basically, in which the state has ultimate authority over production and
> >> distribution without (as in socialism) actually _owning_ the means of
> ...
> >Yes, I'm afraid these ahistorical myths are widespread. What _do_ they teach
> >in these schools?
> >
> >Pick up anything by Renzo De Felice to gain a basic historical understanding
> >of what fascism was about, from someone who was sympathetic to them.
> 
> Rich, I don't think it nearly so clear as you are claiming. The definition
> of fascism, that is. Without resorting to the usual ploy of quoting
> Webster's (a ploy I usually am not impressed by), let me cite an

Actually, perhaps you *should* check Webster's... you forget that I'm a
Certified Political Scientist. The etymology of fascism is particularly on
point. Historically, it refers to the building of a military vanguard as an
outgrowth of risorgimento, Italy's process of becoming a independent,
unified [fucking] state rather than a bunch of weak city-states, which were
often dominated by French, Prussian, or Austria-Hungarian interests.

In an interesting turn from the theme of this list, Italians from the 1870's
through Mussolini saw a strong, centralized state as the best way to be free
from tyranny and government theft. I'm not much of an historian of Italy,
though, so I won't pursue this point. Besides, it came from a peculiar set
of historical circumstances that CLEARLY do not apply to the US today. 

> "anti-fascist" radio personality, Dave Emory, who I have been listening to
> nearly every week for several years.
> 
> Dave is undeniably anti-fascist, an unusual mixture of left-leaning views
> and National Rifle Association sympathies, and he often quotes Mussolini's
> famous "Fascism is corporatism" line. That is, a view more similar to Bruce

Sounds like my kind of guy. I tend not to be much impressed by radio
personalities, but I may look him up.

"What is fascism" could be batted about forever; I don't think it's much
worth talking about, especially out of historical context. Mussolini started
as a Machiavellian who had not read Machiavelli. Early fascism, and the
etymology of fascism, was a nationalistic, militaristic struggle for power.
Once they got in power, then they started developing an economic ideology.
That's how it works with just about every "political theory"... with the
exceptions of Marxism, libertarianism, and religious fundamentalism,
perhaps.

> Baugh's point that fascism is primarily an economic theory, about the
> organization and ownership of production systems, than about hatred of any
> particular ethnic group.

Of "particular" ethnic groups, probably no. Ezra Pound's antisemitism was
actually pretty unusual. But fascism's essence is rabid, disciplined
nationalism of the militaristic kind. Not really xenophobic and explicitly
genocidal like "National Socialism," which isn't descriptive but was just a
name/party that Hitler was able to hijack to put his extended rant Mein
Kampf into practice, but definitely conscious of the "national character" to
the exclusion of any other. 

> ("Fascism is corporatism" is of course not an overall indictment of all
> corporations. "Corporatism" is basically a view that government should
> identify key industries and corporations and then pick the winners and
> support them while suppressing their competitors. This oversimplifies what
> Mussolini, Emory, myself, etc. mean by "corporatism," but I hope this gives
> at least a glimpse.

That's one glimpse, but I think it's worthwile clarifying that corporatism
isn't about corporations. It's organizing societal groups into officially
recognized corps. Corporatism defines people by their profession, to the
exclusion of any other ties that bind (religion, family, hobbies, political
views, race -- cuz they're all assumed to be of the same "national
character" anyway) and all transactions among the various corps is mediated
by the government. An excellent example of corporatism is Mexico's PRI
(Institutional Revolutionary Party), which is essentially to say the Mexican
government, which is functionally divided into units such as the CTM
(Confederation of Mexican Workers, an umbrella for legally sanctioned trade
unions).

-rich






From ses at tipper.oit.unc.edu  Sat Jun  8 00:49:13 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Sat, 8 Jun 1996 15:49:13 +0800
Subject: eTimeouts
Message-ID: <Pine.SUN.3.91.960607223623.19492A-100000@tipper.oit.unc.edu>


Are about to be imposed on Perry and Phil. You don't both have to play
with the same tentacle - there are plenty to go around. Now behave, or I
won't let you watch todays episode of (smith) Barney. 

Simon
---
Cause maybe  (maybe)		      | In my mind I'm going to Carolina
you're gonna be the one that saves me | - back in Chapel Hill May 16th.
And after all			      | Email address remains unchanged
You're my firewall -    	      | ........First in Usenet.........





From die at pig.die.com  Sat Jun  8 00:54:30 1996
From: die at pig.die.com (Dave Emery)
Date: Sat, 8 Jun 1996 15:54:30 +0800
Subject: Internet solution for law enforcement
In-Reply-To: <19960607194629.14482.qmail@ns.crynwr.com>
Message-ID: <9606080052.AA12694@pig.die.com>


 Russ Crynwr writes:

> Hey, I went into the local New York State Police station and asked if
> they had email.  The answer is basically "No."  They've got something
> like a telex system.  I doubt that they're any encryption on their
> data services.  You'd think that police department RADIOS would at
> least be encrypted!  Thanks, TLAs, for your crime encouraging efforts.
> [ TLA lurkers should have the grace to wince at that. ]

	Actually there is quite a strong school of thought that holds
that police should be discouraged from using hard encryption on their
radios because that makes it impossible for the media and public to keep
an eye on them to make sure that they are on the up and up.  Remember 
that policeman carry guns and have wide discression in what they can do
in many situations, especially in short term immediate situations. And
quite a few are not well educated or terribly bright. And most members
of the general public are inclined to believe the word of police rather
than some random citizen.
 
	A hard encrypted police radio system restricts public
information about police activities largely to what the police chooses
to voluntarily reveal to the media - and given the self promoting
political games, corruption, fabrication of evidence, brutality, racism
and plain stupidity that characterize all too many police departments
that often is not enough and very very self serving.  Leaving police
radio communications at least mostly open allows the media and curious
citizens to follow and observe police actions and have enough knowlage
of what went on to ask the hard questions and be witnesses to the
actual events.

	Many police radio systems have been deliberately left open in
recent years even as digital DES based technology has become practical and
somewhat affordable and widely installed.  Lots of police departments
have agreed or been forced to not encrypt anything but sensitive
undercover surveillance related coms, and certain tactical coms in
crisis situations such as hostage takings.  (It still remains also true,
however, that digital voice radios systems have less range, penetrating
power and more unpredictable outages and dead spots than good old analog
fm systems do so there is an added benefit to not using encryption).

	And most police officers seem to believe that allowing the
public to listen to their communications is a net plus - there are
apparently few known instances of criminals making particularly
effective use of scanners to thwart the police and lots of instances of
citizens spotting suspects and other suspicious activities and informing
the police because they knew they were interested from what they
overheard listening to a scanner.
                  
	As for police digital communications (the so called MDT
terminals installed in many police cruisers) - the older and larger city
systems installed mostly by big companies such as Motorola use feeble or
non existant encryption and can be readily intercepted by a slightly
modified scanner (using radio shack parts) and a PC with suitable
software (though the baud rates are odd, the data format synchronous
rather than start-stop async, the messages mostly sent in the form of
packed codewords in some BCH or Reed Soloman error correcting code with
the data bits strangely distributed in the codeword for best error
immunity, and the actual data a hodgepodge mixture of ASCII text and
binary screen formating and control characters).

	The MDT systems installed in smaller towns and more recently by
a small company founded by a former colleague of mine (K1EA) that use
standard laptops instead of proprietary terminals do use single DES
encryption (my pro-crypto rantings on slow afternoons many years ago may
have had some effect). I don't know how good the key management is - I
keep meaning to ask Ken the next time I see him at a hamfest - but at
least the data is not sitting there for the taking by anyone with a PC,
a scanner, and some reasonably straightforward DOS software.

	I have been told that interconnecting non secure digital terminal
systems with the various federal and state criminal data base systems
such as NCIC and its successors that contain sensitive non public information
such as criminal histories and arrest records is supposed to be illegal.
It is not clear how completely this rule is observed.
                                                        
	Crypto in the real world raises some interesting issues - the
nazis or fascists in the evil sense in the future will certainly make
very effective use of it to do evil.

							Dave Emery
							die at die.com







From stewarts at ix.netcom.com  Sat Jun  8 01:13:27 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 8 Jun 1996 16:13:27 +0800
Subject: OECD http://www.oecd.org/news_and_events/release/nw96-46a.htm
Message-ID: <199606071824.LAA06312@toad.com>


Ms. Kamata wrote:
>>The process of drafting the OECD Cryptography Policy Guidelines will
>>continue at an experts meeting in June and is due for completion in
>>early 1997.

Cryptography policy is a matter of vital public interest;
while I assume that actual participation will be limited by the
need for a small enough group to actually get work done,
the World-Wide Web makes it easy to publish working papers,
meeting agendas, drafts, and participant contact information
so that the public can keep track of what's being done.
There's a lot of broad-level material on your web site (I enjoyed the 
perspective of http://www.oecd.org/dsti/iccp/legal/top-page.html),
but it would be a substantial benefit to the community to
provide the in-depth material as well.

At 08:39 PM 6/6/96 -0800, Jim Bell wrote, replying to Ms. Kamata's
press release:
>>OECD EXPERTS BEGIN DRAFTING CRYPTOGRAPHY GUIDELINES 
>>Many governments are under pressure within their own countries to
>>develop a national position on cryptography, 
>
>If anything, it's exactly the opposite:  It is the GOVERNMENTS and
>those who hold government jobs who are doing the "pressuring."   
>I haven't seen more than a trickle of desire for a 
>"national position on cryptography."  What Internet-people want is the 
>ELIMINATION of a "national position on cryptography," I think.

Most governments already have a "national position", restricting
cryptography in ways that violate free speech by their citizenry
and interfere with commerce to varying degrees.  The US has been
one of the more egregious violators in this case, since US companies
and products dominate the software industry, and national police organs
have been strongly opposing the industry's attempts to provide decent
security for communications.  Industry, on the other hand, has been
pressuring government to allow at least enough security to prevent
massive fraud and theft and protect proprietary business communications;
some parts of industry are willing to compromise if they get this much
(perhaps with the added bribe of government contracts to make up for
lost opportunities in the free market), while other parts (especially
smaller companies, where the costs of bureaucratic compliance 
have more effect, and where proprietors can speak for the company)
take a far stronger view, that freedom of speech cannot be compromised.

>>But the needs of global technologies and applications require an 
>>international --rather than a strictly national -- approach to 
>>policymaking.  The fast-paced development of the Global Information 
>>Infrastructure adds an element of urgency.

The global characteristics of technology render strictly national
policymaking increasingly obsolete, because any individual in a free
or semi-free computerized country can develop software like PGP
which can at most be blocked by vigorous local government action.
There are two added forms of urgency - the critical need for security for
electronic commerce, which is growing rapidly and increasingly in conflict
with nationalist military policies, and the increasing deployment of
technology which reduces government control.

>>The private sector is closely involved in drafting the Guidelines,
>>with business representatives from the Business and Industry Advisory
>>Committee (BIAC) participating at the meeting. 
>>The OECD meeting, which took place on 8 May, was hosted by the US
>>Department of State in Washington DC.

Was the meeting announced to at least the public in advance?
The schedule on the web page mentioned the 8 May meeting,
at least after the fact, but does not list any of the following
meetings, and there's no identification of your BIAC committee's
members or even the member governments participating.

                Thanks!
#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Rescind Authority!






From anonymous-remailer at shell.portal.com  Sat Jun  8 01:17:00 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sat, 8 Jun 1996 16:17:00 +0800
Subject: Is the alpha.c2.org 'Nymserver Down?
Message-ID: <199606080439.VAA09011@jobe.shell.portal.com>


My 'nym seems to be broken again, and I've heard other reports that
the alpha.c2.org 'nymserver is down.  Yet, Raph's ping list seem to
indicate it's healthy:

remailer  email address                        history  latency  uptime
-----------------------------------------------------------------------
alpha    alias at alpha.c2.org               +-++**++-++*    49:22  99.66%


What's the story?






From caal at hopf.dnai.com  Sat Jun  8 01:17:48 1996
From: caal at hopf.dnai.com (caal at hopf.dnai.com)
Date: Sat, 8 Jun 1996 16:17:48 +0800
Subject: "EASYSAFE(R) VERSION 3.0
Message-ID: <199606072143.OAA25549@hopf.dnai.com>


I thought this may be of interest to the list.

>[PRNewswire:Computers-0605.14]    6/5/96
>
>        EASYSAFE(R) VERSION 3.0 FOR DOS, WINDOWS & WINDOWS 95 'FIRST
>        NOTEBOOK SECURITY PRODUCT'
>        
>            CHICAGO, June 5 /PRNewswire/ - EliaShim Safe Software, a leading
>        provider of network security products and anti-virus protection
>        systems, announced at Spring Comdex 96 the release of EasySafe,
>        version 3.0, the first security and encryption product designed
>        specifically for notebook computers.
>        
>        .. EasySafe provides bullet-proof protection that is easy to install.
>        .. EasySafe prevents unauthorized use or access through boot password
>          protection.
>        .. EasySafe prevents removal or transfer of information via full hard
>          disk encryption.
>        .. EasySafe provides keyboard locking after three incorrect password
>          attempts.
>        .. EasySafe provides screen blanking after a predetermined period of
>          inactivity.
>        .. EasySafe denies system level access to hard disk information.
>        .. EasySafe can be configured to disable LPT, COM, and Floppy ports.
>        
>            Upon boot-up, EasySafe asks the user for a password.  A
>        correctly entered password grants the user access to the computer.
>        Encryption/decryption of data on the hard disk is dynamic and
>        completely transparent to the user.  The system allows for three
>        password attempts before locking the computer, and only a cold-boot
>        reset is possible. After entering the correct password, the disk is
>        unencrypted dynamically, normal boot up takes place, and the user is
>        granted access to the system without disk access restrictions or
>        delay.
>        
>            EasySafe includes a DOS/Windows screen saving utility which
>        blanks the screen after a period of inactivity.  The only way to re-
>        activate the computer is to enter the correct password.
>        
>            EasySafe offers two encryption methods.  The first encrypts all
>        data on local hard drives.  The second method encrypts boot sectors
>        and partitions.  This prevents unauthorized users from booting from
>        the "A": drive and accessing the data on the hard disk.  This
>        encryption scheme also protects against the use of disk editing
>        programs (such as Norton Utilities).  Thus, valuable company secrets
>        remain hidden and secure. EasySafe can be configured to disable LPT,
>        COM, and Floppy ports to ensure that the information contained on
>        the hard drive cannot be transferred to another system for later
>        viewing.
>        
>            While annual purchases of notebook computers have increased
>        steadily, the number of notebooks reported stolen each year is much
>        more alarming.  In 1995, 208,000 notebooks with a value of almost
>        $640 million were reported stolen by a Columbus, Ohio insurance
>        company that offers coverage for portable computers (Information
>        Week - May 6, 1996 issue).  EasySafe is the perfect product for
>        those field professionals whose notebooks contain valuable,
>        confidential, company information and other sensitive data that is
>        hundreds of times more valuable than the cost of a notebook.
>        
>            Founded in 1983, EliaShim Safe Software has been providing PC
>        security solutions and anti-virus protection for corporate,
>        government, educational institutions, and program developers in both
>        domestic and international markets.  Over four million computers are
>        protected worldwide.  Product line includes: EasySafe, MasterSafe,
>        ViruSafe Gold, and ViruSafe LAN.
>        
>        -0-                        6/5/96
>        /CONTACT:  Carl Frederick, Jr., Director of Marketing, EliaShim
>        Microcomputers, 800-477-5177, or at Spring Comdex 96, Booth . C5431,
>        312-
>        791-6708/
>        
>        CO:  EliaShim Microcomputers, Inc.
>        ST:  Florida
>        IN:  CPR
>        SU:  PDT
>        
>      






From llurch at networking.stanford.edu  Sat Jun  8 01:30:22 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sat, 8 Jun 1996 16:30:22 +0800
Subject: Internet solution for law enforcement
In-Reply-To: <199606071900.MAA12968@hopf.dnai.com>
Message-ID: <Pine.GUL.3.93.960607215457.1728A-100000@Networking.Stanford.EDU>


On Fri, 7 Jun 1996 caal at hopf.dnai.com wrote:

> Has anyone seen this yet?  Looks like it's two weeks old.  Internet Police!
> 
> >[BizWire]    5/20/96
> >
> >        (SUN/PSI-INTL)(SUNW) PSI International, Sun partner, unveils Java-
> >        based Internet solution for law enforcement agencies; "Internet in
> >        Blue" Police Internet/Intranet Application Suite Available in July
> >        1996 

Is this a joke, or has the world gone completely batty?

-rich






From declan+ at CMU.EDU  Sat Jun  8 01:37:13 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sat, 8 Jun 1996 16:37:13 +0800
Subject: Wasting time and bandwidth on Bell
In-Reply-To: <Pine.3.89.9606071348.A12943-0100000@wane3.scri.fsu.edu>
Message-ID: <4liCDhS00YUzEPhpdP@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 7-Jun-96 Wasting time and bandwidth
.. by "P.J. Ponder"@wane-leon- 
> Or they automatically delete any posts that come from or relate to the 
> puerile bullshit Bell is infamous for, and choose not to get dragged into 
> this type of time- and bandwidth- wasting garbage.  Of which this post is 

One of 'em just emailed me saying just that.

-Declan






From jimbell at pacifier.com  Sat Jun  8 01:41:12 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 8 Jun 1996 16:41:12 +0800
Subject: Wasting time and bandwidth on Bell
Message-ID: <199606080514.WAA02576@mail.pacifier.com>


At 02:08 PM 6/7/96 +0100, P.J. Ponder wrote:

>Or they automatically delete any posts that come from or relate to the 
>puerile bullshit Bell is infamous for, and choose not to get dragged into 
>this type of time- and bandwidth- wasting garbage.  Of which this post is 
>just another, of course, but i get so damn sick and tired of the constant 
>imposition of 'AP' and related nonsense on this list. 

It is to be expected that among the citizens of this world, there would be 
those who have so much moral or economic stock in the current order that 
they would strongly resist any serious change. (maybe they're already on 
top, or they hope to be in a few years, etc.)   Until a few years ago, 
almost everybody probably figured that the main effect of computer 
networking (and the Internet) on politics would be to allow people to send 
letters to their Congressmen faster while destroying fewer trees, or letting people 
send in their votes by email rather than travelling to a voting booth.

Simple changes.  Non-threatening.  Don't rock the boat.  Don't upset the 
apple cart.  Don't make a wave.

It will be a great shock to most of you to hear that the real changes will 
not only be figuratively "revolutionary" but also LITERALLY revolutionary.  



>>3. Congress would have no problems passing a law outlawing AP, if one
>>does not exist already.

>I would be satisfied if they just outlawed e-mail about it. 

I guess this guy never heard about the 1st Amendment.  Or maybe he did, but 
he concluded that it must have been a mistake, because it's not the kind of 
thing that the people in charge today would vote for if they had a choice in 
the matter..

Jim Bell
jimbell at pacifier.com





From adamsc at io-online.com  Sat Jun  8 01:46:33 1996
From: adamsc at io-online.com (Chris Adams)
Date: Sat, 8 Jun 1996 16:46:33 +0800
Subject: INteresting tidbit
Message-ID: <199606080142.SAA15961@toad.com>


** Reply to note from stewarts at ix.netcom.com 06/07/96 11:15am pdt  

> >>   4.   The ability to crack DES-1 in near real-time mode is present.
> >>        (See above).
> >First, this has been loosely confirmed for ages. Someone was mentioning
>> that FBI offices supposedly have software that (on a 486) can crack a DES-1 key  
>> in under an hour. Multiply * modern high capacity computers = problem.  
>> However, this does not nessesarily follow from 
> 
> Sigh.  This is of course hopelessly bogus.  You can't even crack RC4/40 in
> under an hour on a 486 machine, thoguh you can do it very fast on custom 
> hardware.

 I figured it had been sensationalized. I received an email from someone who had  
actually played with such a beast (or claimed to have) and I believe he mentioned  
it had an addin card.

> 
> >This Message Was Sent With An UNREGISTERED Version Of PMMail.  
> >Please Encourage Its Author To Register Their Copy Of PMMail.  
> >For More Information About PMMail And SouthSide Software's Other 
> >Products, Contact http://www.southsoft.com.
> 
> I won't encourage you to register it, but at least please find a way to
> quiet the sucker down.  Mailers that do one line of advertising on unregistered
> shareware are semi-tolerable.  Mailers that do 4 lines are highly rude.
> Fortunately, a good binary editor makes it easy to go in and turn the message
> to something quieter, like -'s or :-)'s...

I just did that. Took awhile to find a decent OS/2 email program... I'm not sure  
the new one is better, but it sure is less intrusive.  That and a little bug that  
resulted in some messages getting dumped here (still wondering how it managed  
that) cost them a sale.








From qut at netcom.com  Sat Jun  8 02:05:46 1996
From: qut at netcom.com (Be Good)
Date: Sat, 8 Jun 1996 17:05:46 +0800
Subject: ID this 31173 NCR keyboard
In-Reply-To: <199606070859.BAA16976@mail5>
Message-ID: <199606080415.VAA24937@netcom22.netcom.com>


> Does it have any identifying numbers?

There's a bunch of labels and printings inside
the board, the pc board says ELE 2001;
the chip says NCR '82 and 31960;
and a couple labels on the inside of
the case that don't make any sense.

Do I have any chance of getting term
support for this, or getting a new
keyboard like this?  It seems ideal.

> NCR OEMed a line of ADDS Viewpoint terminals for a while,
> and while the numbers no longer come to mind
> (unless they're like 2920), they might look familiar
> if I saw them.  This keyboard sample doesn't look
> quite like them, though.  Most of their keyboards
> like that were for terminals, not for PCs.
> Are the connectors even PC-like?

The connector and cable is standard XT-like.

> Also, if there are function keys through F20, it might very
> well be a 3270-emulator of some sort.
> 
> At 01:52 PM 6/6/96 -0700, you wrote:
> >Oops.  I wrote that just looking at the keyboard.
> >Picked it up at Seattle's Ex-Pc for $3.
> >It's so old, I think it requires a non-PC BIOS.
> >No manual, labels etc.
> >
> >Anyone have a clue as to what this is:
> >
> >NCR
> >
> >F1 F2          [...]               F18 F19 F20/RESET|
> >ESC            [...]     TAB             |[five direction keys]
> >CONTROL Q      [...]     }/] CONTROL     |CLR 7 8 9 /
> >CAPS_LOCK A    [...]      ~/` |NEW       |  - 4 5 6 *
> >[up] |/\ Z     [...]   [upup] |LINE      |  + 1 2 3 |NEW
> >               [space]                   |  0_ 00 . |LINE
> >
> >It was designed for easily customizing your keytable,
> >being an actual flat terminal with square keys easily
> >pulled out and interchanged.
> >
> >The back of the keyboard has three switches for
> >the boolean selection of languages: US English,
> >UK/Int. English, French, German, Swedish/Finnish,
> >Danish/Norwegian, Spanish, Italian.
> >
> >So, where to get a NEW keyboard like this:
> >
> >FLAT, with a full set of SQUARE, EASILY pulled out keys.
> >
> >
> >
> #				Thanks;  Bill
> # Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
> # http://www.idiom.com/~wcs
> #				Rescind Authority!
> 
> 


-- 

Kill Your Television






From qut at netcom.com  Sat Jun  8 03:14:09 1996
From: qut at netcom.com (Be Good)
Date: Sat, 8 Jun 1996 18:14:09 +0800
Subject: Thank you for the Archives 100 messages
In-Reply-To: <31B91EA0.16F@netcom.com>
Message-ID: <199606080730.AAA24004@netcom13.netcom.com>


> qut4.qut at netcom.com wrote:
> > 
> > Apologies, but rich has deleted me from
> > his mailboxes, and for a few days now,
> 
> As I have, too, now.
> 
> > somebody has placed a global cancel bot on
> > me.  I'm gonna have plenty of fun figuring
> > this out.  Kwow any good sniffers?
> 
> I'm glad! If my processor/filtering software doesn't
> have to deal with your garbage, that's more time I have
> to spend with folks who have something to say.

The only thing your type of "cypherpunk" has
to say, is blather about liability, copyrights,
and other capitali$t bs.

REAL crypto-anarchists, of course, want the 
destruction of copyrights, trademarks, and
other weapons of capitali$m, and will
implement crypto-anonymonity to proceed
forthwith.

> No, I don't know of any better "sniffers" (I assume you
> mean, "software that can detect a cancelbot"), as such
> software is impossible to detect. Of course, unless Rich
> (or whomever cares so much about a moron) has either root
> on toad.com, or at least as many resources as the NSA, he
> can't cancel your mail to Cypherpunks (or anywhere else).

I was talking about netnews, mormon.

> > I agree the list should be public usenet:
> > A mail gate-way to a usenet group that
> > ALSO permits unmoderated posts.  This
> > would be a nice way to combine a strict
> > moderated mail-list, with a standard
> > netnews group.
> 
> Er, what?
> 
> That paragraph makes absolutely no sense whatsoever.

There's already hundreds of groups like
that, stupid.  It will be implemented,
whether you like it or not.


--

Kill Your Television





From stewarts at ix.netcom.com  Sat Jun  8 04:00:20 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 8 Jun 1996 19:00:20 +0800
Subject: How to explain crypto?
Message-ID: <199606080749.AAA26078@toad.com>


At 01:50 PM 6/4/96 -0500, Declan wrote:
>For example, someone sent me this explanation:
>  "The 1024 bit key is likely an RSA key, and is not comperable to a 40 bit
>  symetric key.  From memory, 1024 bit RSA is about as hard to crack as 90
>  bit symetric."
>Is this a reasonable comparison?

It's probably close enough for anti-government work; the relative strength
depends a lot on whether you're using general-purpose computers or
custom crackerboxes, and on the state of the art in factoring technologies.
I'd be tempted to be verbose and say that public-key systems like RSA
use prime numbers for keys, so they need to be a lot longer than
secret-key algorithms like DES or RC4 which can use any number as a key but
need to keep it secret.  You can double the cracking effort by adding
one bit to a secret key or about 10 to a public key. 
500-bit public keys and 56-bit secret keys are about the limit of cracking 
technology for organizations with a couple of million dollars spare for
supercomputers, which is your desktop in 5-10 years.

The NSA's Clipper Chip used 80-bit keys, which is about 20 years' protection
against people who can't use the built-in wiretap or bribe a cop to
get a warrant.  One problem with these secret hardware designs is that you 
usually can't tell if there's a back-door unless they tell you - or goof up
like they did with the Clipper's short checksum.

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From stewarts at ix.netcom.com  Sat Jun  8 04:13:45 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 8 Jun 1996 19:13:45 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
Message-ID: <199606080829.BAA26495@toad.com>


At 10:52 AM 6/7/96 -0400, Perry wrote:
>hallam at Etna.ai.mit.edu writes: [...]
>> Well, Milton Friedman's method for saving the whale is to leave it
>> to the free market, if people want whales in the oceans they won't
>> buy whale meat.
[...]
>Dr. Phill Hallam-Baker, PhD, however, does not understand economics in
>spite of his PhD and thus attributes views to free market economists
>that they do not hold, as in his whole cloth synthesis of a viewpoint
>which he ascribed to Milton Friedman which Milton Friedman would never
>in a million years espouse.

Oh, come on now, Perry - while Friedman has more sense than that,
you've been around the Libertarian party long enough to know people
who call themselves free-market environmentalists who contend that whales
will be best protected if they're owned property, that do-gooder
environmentalists will be free to outbid Sushi Inc.* for them,
and that initial ownership of the whales ought to be decided by
the traditional initial land-ownership method of homesteading.
Personally, I view this as rent-seeking by folks who ought to let
the whales own themselves, and think they've got as little understanding
of free-market environmentalism as the government bureaucrats who
massively subsidize the logging of US National Forests, but they _are_ there.

[*A wholly owned subsidiary of Taco Bell, but with digicash** and 
anonymous stock ownership, On the Internet, nobody knows that all
restaurants are Taco Bell.]

[**Ineffective attempt to pretend some relevance to cypherpunks...]


#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From loki at obscura.com  Sat Jun  8 04:27:47 1996
From: loki at obscura.com (Lance Cottrell)
Date: Sat, 8 Jun 1996 19:27:47 +0800
Subject: Multiple Remailers at a site?
Message-ID: <added28f0302100472cc@[206.170.115.3]>


At 12:16 PM 6/6/96, Scott Brickner wrote:
<SNIP>
>The discussion was about multiple remailers from multiple accounts on
>the same machine.  The very existence of the remailer, independent of
>issues like shuffling and chaining, is supposed to eliminate
>identifying the originator by the content of the message.  Message
>shuffling, delays, and chaining are entirely for the purpose of
>reducing the information available to the traffic analyst.  If several
>remailers are running on the same machine, they may be treated as if
>there were only one remailer, for the purpose of traffic analysis.
>Getting more traffic going through them just makes the analysts job
>easier, because his statistical conclusions are stronger.
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I don't think I am following you. My messages are a constant size signal (I
send N messages through the remailer). More traffic increases the
background signal and background noise. While the signal to noise of the
background gets better, the actual amount of noise went up so the ratio of
MY signal to the background noise went down. Perhaps I don't understand
what you are saying.

I think multiple remailers on a machine are less effective than a single
remailer with the combined traffic of all the individual remailers, because
the combined remailer does better reordering from a larger pool.

If the remailer chain contains just two or more uncompromised hops (not
necessarily consecutive) I suspect an attacker will be forced to treat the
remailer bramble as a single object. This attack is based on time
correlations of messages sent and received. In this case background traffic
is good because of the large number of false correlations it generates.
However, it is stunning how few messages it takes to make the correlation
stand out. The defense against this attack is to ensure that you send and
receive enough remailer mail to correlate with all other users for all
messages. Producing cover traffic, some of which returns to you, and some
of which is bit bucketed also ensures that it will not be known when you
receive a real message (as opposed to one of your own). Obviously this is
best done when you are a remailer operator yourself.

        -Lance (who will now dismount the soap box)

----------------------------------------------------------
Lance Cottrell   loki at obscura.com
PGP 2.6 key available by finger or server.
Mixmaster, the next generation remailer, is now available!
http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com

"Love is a snowmobile racing across the tundra.  Suddenly
it flips over, pinning you underneath.  At night the ice
weasels come."
                        --Nietzsche
----------------------------------------------------------







From rah at shipwright.com  Sat Jun  8 06:33:11 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Sat, 8 Jun 1996 21:33:11 +0800
Subject: Neologism: "crackerbox"
In-Reply-To: <199606080749.AAA26078@toad.com>
Message-ID: <v03006f04addf0980c7ed@[199.0.65.105]>


I think we have another winner, folks!

At 3:47 AM -0400 6/8/96, Bill Stewart wrote:
> It's probably close enough for anti-government work; the relative strength
> depends a lot on whether you're using general-purpose computers or
> custom crackerboxes, and on the state of the art in factoring technologies.
         ^^^^^^^^^^^^

I *like* it!

Cheers,
Bob Hettinga



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From Stef=buyinfo at nma.com  Sat Jun  8 08:58:03 1996
From: Stef=buyinfo at nma.com (Einar Stefferud)
Date: Sat, 8 Jun 1996 23:58:03 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606072058.NAA05291@netcom3.netcom.com>
Message-ID: <27817.834218804@odin.nma.com>


Yo are assuming away facts that some of us cannot assume away.

>From your message Fri, 07 Jun 96 13:58:53 -0700:
}
}>
}>> the wallet action will always
}>> be tied with some other action. the user picks up the phone to dial
}>> somewhere, and it says, "that will be .3c-- will you pay"? he says
}>> yes. 
}>
}> How will you know the cost is .3c a priori?
}>What's to stop me from saying yes to the .3c and staying on the line
}>forever?
}
}I don't understand why this micropayment thing is being thought
}so complicated.
}
}I am making some simple assumptions that seem to not be obviously
}apparent, apparently.
}

Specifically, you assume that no one will want to audit and check up
on micro-charges that accumulate nto bills.  Like my phone bill with 5
pages of 2-5 cent toll calls.  I really don't want to analyze all
that, but I also don't trust the phone company to always present me
with an accurate bill. 

So, I would rather deal with the accumulation schem by paying a fixed
fee for a service that does not send me all that deatil that I cannot
use or analyze.  To use it I would have to keep a log, with the times
of all calls to compare.

Now, you want to move this kind of charging to some service I do not
trust as much as I trust the phone company, and send me a bill for an
accumulation of charges without supporting detail.  Thsi might be OK
for small amounts, but what about a large company where these
undocumented microcharges add up to say, $200,000/year?

How do we know that someone is not simply padding the bill?  All we
need is for the billing system to slip in an occasional bogus charge
the looks for all the world like any other microcharge.

You know, like the bank employee case where someone accumulates the
round-up transaction adjustments to an account and ships the money to
Switzerland.

This is what you are omitting in your assumptions...
I just don't believe the world is going to be so trusting....\Stef





From jya at pipeline.com  Sat Jun  8 09:45:37 1996
From: jya at pipeline.com (John Young)
Date: Sun, 9 Jun 1996 00:45:37 +0800
Subject: BIO_nfo
Message-ID: <199606081353.NAA20540@pipe3.t2.usa.pipeline.com>


A biocryptoanarchy link to Adleman's DNA work? 
 
 
   6-8-96. FiTi: 
 
   "Bioinformatics: the jobs of the future." 
 
      One of the biggest manpower shortages today is in 
      bioinformatics, the area in which biology meets computer 
      science. Biology is becoming a data-intensive science, 
      in the same way that physics did almost 50 years ago 
      when it became clear that computers would be needed not 
      only to store information but also to process it. 
      There's a great shortage of people, partly because a 
      lot of organisations are simultaneously seeing the need 
      for bioinformatics and partly because the skills 
      required are changing so fast:  
 
      + Search and analysis, including new mathematical 
      techniques for finding patterns in data; 
 
      + Knowledge management, including ways to integrate 
      information from different databases; 
 
      + Mapping and genomics, including approaches to 
      identifying the genetic components of complex traits; 
 
      + Sequence/structure/function including rapid methods to 
      predict the biological function of a gene from its DNA. 
 
      The mainstream computer and information technology 
      companies are only just beginning to take an interest in 
      bioinformatics. "There's a huge vacuum there." For an 
      undergraduate scientist searching for a field in which 
      to specialise, there are no better job prospects than 
      bioinformatics or - cheminformatics. 
 
   BIO_nfo 
 





From dlv at bwalk.dm.com  Sat Jun  8 11:03:35 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Sun, 9 Jun 1996 02:03:35 +0800
Subject: RFD: Time to kick some anti-scientologist ass?
Message-ID: <aRk8oD61w165w@bwalk.dm.com>


I haven't been paying a lot of attention to the Church of $cientology wars
until recently. Here's an executive summary for those who don't give a damn.

1. There's a gang of flamers (David Gerard, Jon Noring, Ron Newman, Rob J.
Nauta, and the like) who try to stop $cientologists from discussing their
religion on the Usenet newsgroup alt.religion.scientology. Most of them are
disgruntled former cult members and/or members of other similar cults.

2. The anti-scientologists have caused many cypherpunks anonymous remailers
to shut down via their egotistical misuse of them, viz. criminally posting
copyrighted Co$ writings to Usenet. They did it knowing that the Co$ is
likely to harrass the remailer operators, causing them to shut down and
depriving everyone of their services.

3. These harrassers are Usenet Cabal supporters, and they are sometimes
joined by initerant cabal enforcers such as Peter Vorobieff, who visit a.r.s
to lend a helping hand and to flame Co$.

4. Recently the anti-scientologists have asked me for a copy of my cancelbot,
and have been using it to forge cancels for scientologist posts on a.r.s.

Here's a typical anti-scientologist Usenet article lauding content-based
forged cancels:

]Path: ...!newsfeed.internetmci.com!howland.reston.ans.net!nntp.coast.net!harbinger.cc.monash.edu.au!news.rmit.EDU.AU!news.unimelb.EDU.AU!munnari.OZ.AU!news.mel.connect.com.au!news.mel.aone.net.au!fun
]From: fun%/etc/HOSTNAME (David Gerard)
]Newsgroups: alt.religion.scientology,alt.religion.scientology.xenu
]Subject: Re: Cancel Summary
]Followup-To: alt.religion.scientology,alt.religion.scientology.xenu
]Date: 5 Jun 1996 20:51:37 GMT
]Organization: Expert Marcabian Spam-Dodgers of the Universe
]Lines: 28
]Message-ID: <4p4s0p$h06 at news.mel.aone.net.au>
]References: <SatJun1224302EDT1996 at lightlink.com> <31b194aa.599605 at news.clark.net>
]Reply-To: fun at suburbia.net
]NNTP-Posting-Host: athene.glasswings.com.au
]X-Newsreader: TIN [version 1.2 PL2]
]
]StarOwl (starowl at triskele.com) wrote:
]: On 1 Jun 1996 22:43:05 -0400, Lazarus <homer at lightlink.com> wrote:
]
]: >Thu May 30 00:48:49 EDT 1996  Lazarus V2.3
]: >lightlink.com/var/spool/news/control/1456170
]: >Article: 170077
]: >From: info at triskele.com (ARSE INFO SERVICEl)
]: >Date: Sun, 26 May 1996 13:22:08 GMT
]: >Subject: Bryan Wilson - In Conclusion.
]: >    Message-ID: <31a857ae.664540 at news.clark.net>
]: >Control: cancel <31a857ae.664540 at news.clark.net>
]
]: Great.  Even the parodies of spam get canceled.  :-/
]
]
]Well. This is actually GOOD NEWS. Because what it means is that there is at
]least one spam cancelbot on the case, as is eminently a wonderful idea for
]getting the hell RID of this shit ... in an entirely accepted and acceptable
]Usenet manner.
]
]If you can find the cancel, you can ask whoever zapped it to
]repost it I suppose, in such a way as to evade the cancelbot.
]
]Now what we need is MORE spam cancelbots on this material.
]
]
]--
]http://suburbia.net/~fun/scn/ -- if it doesn't work for you, email me.





From lharrison at mhv.net  Sat Jun  8 11:37:37 1996
From: lharrison at mhv.net (Lynne L. Harrison)
Date: Sun, 9 Jun 1996 02:37:37 +0800
Subject: Is the alpha.c2.org 'Nymserver Down?
Message-ID: <9606081544.AA07498@mhv.net>


At 09:39 PM 6/7/96 -0700, anonymous wrote:
>My 'nym seems to be broken again, and I've heard other reports that
>the alpha.c2.org 'nymserver is down.  Yet, Raph's ping list seem to
>indicate it's healthy:
>
>remailer  email address                        history  latency  uptime
>-----------------------------------------------------------------------
>alpha    alias at alpha.c2.org               +-++**++-++*    49:22  99.66%
>
>What's the story?


   FWIW, I just pinged Host: alpha.c2.org - 
   64 bytes received, icmp _seq 1, time=384 ms
   --- Round-trip (ms)  min/avg/max = 384/384/384 ---

   I, however, have also heard that the remailer alias at alpha.c2.org has down
for a few days.


Regards -
Lynne


*************************************************************
Lynne L. Harrison, Esq.      |     "The key to life:
Poughkeepsie, New York       |      - Get up;
lharrison at mhv.net            |      - Survive;
http://www.dueprocess.com    |      - Go to bed."
*************************************************************

DISCLAIMER:  The above discussion is **NOT**  to be construed
as legal advice.  Proper protection of your legal rights may
require consultation with an attorney in a traditional setting.






From nobody at REPLAY.COM  Sat Jun  8 11:52:37 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 9 Jun 1996 02:52:37 +0800
Subject: No Subject
Message-ID: <199606081538.RAA19160@basement.replay.com>


Russ of nelson at crynwr.com apparently writes:

:"Well, you aren't being
:carried off in the middle of the night by death squads, so I'm :not going to waste my time on you when I could help other people :in danger of death."  I'm not prepared to argue against that :judgement.

I am.

Russ, this rant is not directed at you. I'm just weary of the Bell-bashing.

Perhaps the reason that our society has evolved to the point of not having to fear deathsquads is because of assholes like Bell who keep prodding us to expand the limits of personal liberty and free speech by their rantings.  He makes me think; sometimes the unthinkable, and gives me the opportunity to _reject_ his ideas.

Each time I suggest that someone goes *a little too far,* I draw in the circle of my own protected speech a bit more. *My God, he can't say that!" He _may_ be an adult who knows and accepts the possible consequences of his speech. 

Notice the chilling effect on virtually any discussion when the threat of legal action is suggested.  There's the danger.

Read the entire quote by Donne.  *...any man's death diminishes me, because I am involved in mankind;...*  By protecting Bell's right to speak what he thinks, we serve as an example to the rest of the world of what personal freedom really means. *Those crazy Americans* 

Bell gives me the opportunity to say that his pronouncements are antithetical to the best interests of the _inhabitants_ of this nation, not simply the government itself.


Thank you, Jim.    







From declan+ at CMU.EDU  Sat Jun  8 12:29:46 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sun, 9 Jun 1996 03:29:46 +0800
Subject: RFD: Time to kick some anti-scientologist ass?
In-Reply-To: <aRk8oD61w165w@bwalk.dm.com>
Message-ID: <4liOMeG00YUyA52Gh9@andrew.cmu.edu>


The attached summary is substantially incorrect. I know some of the
"flamers" you mentioned, and their intentions are *not* to stop the
Scientologists from discussing their religion.

On the contrary, the Scientologists are trying to make it very difficult
for anyone to *criticize* the Church of Scientology or reveal some of
its more wacky teachings.

For more info --

  Ron Newman's web page on the Church of Scientology:
    http://www.cybercom.net/~rnewman/scientology/
  Dave Touretzky's web page:
    http://www.cs.cmu.edu/~dst/Fishman/

-Declan

  

Excerpts from internet.cypherpunks: 8-Jun-96 RFD: Time to kick some
anti.. by Dr.Dimitri V. KOTM at bwalk 
> 1. There's a gang of flamers (David Gerard, Jon Noring, Ron Newman, Rob J.
> Nauta, and the like) who try to stop $cientologists from discussing their
> religion on the Usenet newsgroup alt.religion.scientology. Most of them are
> disgruntled former cult members and/or members of other similar cults.
>  
> 2. The anti-scientologists have caused many cypherpunks anonymous remailers
> to shut down via their egotistical misuse of them, viz. criminally posting
> copyrighted Co$ writings to Usenet. They did it knowing that the Co$ is
> likely to harrass the remailer operators, causing them to shut down and
> depriving everyone of their services.
>  
> 3. These harrassers are Usenet Cabal supporters, and they are sometimes
> joined by initerant cabal enforcers such as Peter Vorobieff, who visit a.r.s
> to lend a helping hand and to flame Co$.
>  
> 4. Recently the anti-scientologists have asked me for a copy of my cancelbot,
> and have been using it to forge cancels for scientologist posts on a.r.s.






From hal at alfred.sims.berkeley.edu  Sat Jun  8 12:37:58 1996
From: hal at alfred.sims.berkeley.edu (Hal Varian)
Date: Sun, 9 Jun 1996 03:37:58 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606060257.TAA16018@netcom.netcom.com>
Message-ID: <Pine.NXT.3.91.960608091548.3094C-100000@alfred.sims.berkeley.edu>


On Wed, 5 Jun 1996, Nick Szabo wrote:

> 
> Some electronic commerce projects promise dramatically lower transaction
> costs, so that we can achieve "micropayments", "microintermediation",
> and so forth.  Is this achievable?  
> 

Well let me chip in on this.  First, my Web site at
   http://www.sims.berkeley.edu/resources/infoecon/Commerce.html
has links to lots of the relevant resources.

I think that there are really two accounting models that are being
discussed.  One is centralized accounting, a la the phone company.
The other is what I call "distributed accounting".  Models for
distributed accounting are postage stamps/meters, and cash.
In the distributed accounting model, individuals get tokens
(stamps, coins, dollars, BART cards, phone cards, etc.) and keep
track of their own usage.  This form of accounting is ideally suited
to micropayments.  You may lose your BART card, or your dollars,
but that risk is borne by the user.

As Stefan pointed out, micropayments can add up in a big organization.
But in the distributed accounting case, it is the organization's 
responsibilty for managing these payments.  Indeed, most organizations
have strict policies about petty cash, postage stamps, etc for just this 
reason. 

Centralized accounting is much more open-ended.  Here the risk of 
non-payment is often partially borne by the provider and partially
by the user.  This form of payment is typically used for repeated
purchases where reputation/credit-worthiness plays a big role.

Hal Varian, Dean           voice: 510-642-9980
SIMS, 102 South Hall       fax:   510-642-5814
University of California   hal at sims.berkeley.edu
Berkeley, CA 94720-4600    http://www.sims.berkeley.edu/~hal






From dlv at bwalk.dm.com  Sat Jun  8 13:53:54 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Sun, 9 Jun 1996 04:53:54 +0800
Subject: RFD: Time to kick some anti-scientologist ass?
In-Reply-To: <4liOMeG00YUyA52Gh9@andrew.cmu.edu>
Message-ID: <XBq8oD69w165w@bwalk.dm.com>


"Declan B. McCullagh" <declan+ at CMU.EDU> writes:

> The attached summary is substantially incorrect.

You mean, the anti-scientologists aren't massively forging cancels
for scientologits' posts on alt.religion.scientology using my cancelbot?

Or the anti-scientologists haven't caused most of the problems cypherpunks
remailers face through posting CO$ copyrighted material through them?

>                                                  I know some of the
> "flamers" you mentioned,

My condolences.

>                          and their intentions are *not* to stop the
> Scientologists from discussing their religion.

Then how come anyone who posts to a.r.s in support of the cult gets
harrassed by your acquaintances (flamed, mailbombed, etc)?

(Note: I'm not a Co$ affiliate and have exactly as much disdain for it as
for any other cult.)

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From alano at teleport.com  Sat Jun  8 14:20:31 1996
From: alano at teleport.com (Alan Olsen)
Date: Sun, 9 Jun 1996 05:20:31 +0800
Subject: Neologism: "crackerbox"
Message-ID: <2.2.32.19960608174620.00cb4094@mail.teleport.com>


At 06:43 AM 6/8/96 -0400, Robert Hettinga wrote:
>I think we have another winner, folks!
>
>At 3:47 AM -0400 6/8/96, Bill Stewart wrote:
>> It's probably close enough for anti-government work; the relative strength
>> depends a lot on whether you're using general-purpose computers or
>> custom crackerboxes, and on the state of the art in factoring technologies.
>         ^^^^^^^^^^^^
>
>I *like* it!

I am sorry, but the term "crackerbox" has been deemed derogatory to Southern
Americans by the Society for the Protection of American Minorities (SPAM).

You will have to apply for another neologism from the Bureau of Neologisms.
This time I suggest that you remember to fill out the proper paperwork so
that these problems will not occur in the future.  (To speed your
application, please include doubling the filing fee, the first half as a
check made out to the Bureau and the other half in cash.)


---
|Coors - For people who don't want to think about what they are drinking.|
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.teleport.com/~alano/          | alano at teleport.com  |






From perry at piermont.com  Sat Jun  8 14:21:32 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 9 Jun 1996 05:21:32 +0800
Subject: "qut"
In-Reply-To: <199606080730.AAA24004@netcom13.netcom.com>
Message-ID: <199606081750.NAA21341@jekyll.piermont.com>



"qut" the imbecile writes:
> REAL crypto-anarchists, of course, want the 
> destruction of copyrights, trademarks, and
> other weapons of capitali$m, and will
> implement crypto-anonymonity to proceed
> forthwith.

No one speaks for all anarchists, or even anyone other than
themselves.

I realize that you are trolling, but, speaking for me, you're a
fruitcake.

.pm





From perry at piermont.com  Sat Jun  8 14:25:19 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 9 Jun 1996 05:25:19 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
In-Reply-To: <199606080829.EAA22187@linet02.li.net>
Message-ID: <199606081754.NAA21353@jekyll.piermont.com>



Bill Stewart writes:
> Oh, come on now, Perry - while Friedman has more sense than that,
> you've been around the Libertarian party long enough to know people
> who call themselves free-market environmentalists who contend that whales
> will be best protected if they're owned property,

Sure, but Dr. Phill Hallam-Baker, D.Phil., was contending that
Friedman said the free market solution was for people to voluntarily
stop buying whale meat -- he wasn't even contending that Friedman said
the whales should be owned. Dr. Phill Hallam-Baker, D.Phil., presented
a portrait of Friedman that is so totally out of line with even the
most fuzzy headed free market types that it is almost impossible to
believe that he said anything of the sort.

Perry





From alanh at infi.net  Sat Jun  8 14:55:59 1996
From: alanh at infi.net (Alan Horowitz)
Date: Sun, 9 Jun 1996 05:55:59 +0800
Subject: Thank you for the Archives 100 messages
In-Reply-To: <199606080730.AAA24004@netcom13.netcom.com>
Message-ID: <Pine.SV4.3.91.960608143037.10776F-100000@larry.infi.net>


> REAL crypto-anarchists, 

  Like the folks who brought us Tiannemen Square?

> of course, want the 
> destruction of copyrights, trademarks, and
> other weapons of capitali$m, and will





> Kill your Television

   Threw mine out in 1987. There's more people who don't have indoor
bathrooms, than don't have a TV. (source: 1990 Bureau of the Census). I'm
in a pretty elite group. 






From alanh at infi.net  Sat Jun  8 14:57:57 1996
From: alanh at infi.net (Alan Horowitz)
Date: Sun, 9 Jun 1996 05:57:57 +0800
Subject: Internet solution for law enforcement
In-Reply-To: <Pine.GUL.3.93.960607215457.1728A-100000@Networking.Stanford.EDU>
Message-ID: <Pine.SV4.3.91.960608141857.10776D-100000@larry.infi.net>


It appears that someone has figured out that medium-sized jurisdictions 
don't want to be left out of the trendiness. And has put together a 
product that can be peddled at the trade shows where Police Chiefs go.

I recall reading that there's something like 25,000 different police 
departments in America. It's a sizeable market. And a very politically 
correct one, right now.

Do these managers _need_ this stuff? Well, did they _need_ all those 
black-ninja hollywood flavored SWAT uniforms?

Now, if they could just get a few more PC-of-the-month phraseologies into 
the title of their product, they'd sell twice as many.  Start with 
"anti-deadbeat-dad software", maybe. "Pro Diversity". "Environmentally 
Friendly Software".

Is America great, or what?





From hallam at Etna.ai.mit.edu  Sat Jun  8 14:57:57 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Sun, 9 Jun 1996 05:57:57 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
In-Reply-To: <199606081754.NAA21353@jekyll.piermont.com>
Message-ID: <9606081830.AA05221@Etna.ai.mit.edu>



>Sure, but Dr. Phill Hallam-Baker, D.Phil., was contending that
>Friedman said the free market solution was for people to voluntarily
>stop buying whale meat -- he wasn't even contending that Friedman said
>the whales should be owned. Dr. Phill Hallam-Baker, D.Phil., presented
>a portrait of Friedman that is so totally out of line with even the
>most fuzzy headed free market types that it is almost impossible to
>believe that he said anything of the sort.


Perry, 

	Apart from hero worship why do you believe that Friedman is not able to say 
anything ridiculous? I found the letter to be ridiculous which is why I remember it. 

	Since you were so certain that Hess was not a staff member of the Cato institute 
despite being listed as such on their home page is it not just a little possible that 
you might be wrong in this case?

	Plus, to say that such an analysis would be out of line with "even the most 
fuzzy headed free market types" is somewhat rich. I have heard plans to eliminate all 
government apart from the army, privatising roads and the police. I have heard numerous 
claims that monopolies cannot ever exist under any circumstances unless they are created 
by government. I have even heard it stated that had gun ownership been more widespread 
in the UK the Dunblane massacre would not have occurred. Whether  the teacher was 
expected to gun down Hamilton with the Kalashnikov she carried to school each day or 
whether the tots were expected to come to her aid with Smith and Westons I'm not sure. 
In short I don't think that there is any type of piffle that the "most fuzzy headed free 
market types" cannot offer.

	How to save the whales is a logical outcome of Friedman's thesis that markets 
are everything. It is unfortunately very common for great men to get megalomania and 
believe they have the solution to the worlds problems in one theory.

	The flaw in Perry's "stakeholder" theory is the same one in many academic 
theories. It assumes that most people are smart enough to realise their true interests. 
It assumes that people take a longer term look than they do. 

	
		Phill





From jimbell at pacifier.com  Sat Jun  8 15:16:11 1996
From: jimbell at pacifier.com (jim bell)
Date: Sun, 9 Jun 1996 06:16:11 +0800
Subject: 
Message-ID: <199606081816.LAA24268@mail.pacifier.com>


At 05:38 PM 6/8/96 +0200, Anonymous wrote:

>Read the entire quote by Donne.  *...any man's death diminishes me, because 
I am involved in mankind;...*  By protecting Bell's right to speak what he 
thinks, we serve as an example to the rest of the world of what personal 
freedom really means. *Those crazy Americans* 
>
>Bell gives me the opportunity to say that his pronouncements are 
antithetical to the best interests of the _inhabitants_ of this nation, not 
simply the government itself.

>Thank you, Jim.   

While I appreciate your...uh...appreciation, let me remind you that part of 
my "pronouncements" are that the current political and social system is 
sick.  Many people around here seem to agree with this assessment.  What I 
advocate is a comparatively simple change in the rules that could have the 
effect of vastly changing the way things are done.  Whether these changes 
are in "the best interests of the inhabitants of this nation" is still an 
open question, and many people have agreed with me on this matter. 

Jim Bell
jimbell at pacifier.com





From strick at jihad.yak.net  Sat Jun  8 15:38:31 1996
From: strick at jihad.yak.net (strick at Jihad)
Date: Sun, 9 Jun 1996 06:38:31 +0800
Subject: need meeting location
Message-ID: <199606081835.SAA00155@jihad.yak.net>


hey, could a few of you forward me the location 
of the bay area meeting today .... sorry to bother you,
but the ftp server seems to be down ...    thanks,,,, strick at yak.net






From jamesd at echeque.com  Sat Jun  8 16:06:45 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Sun, 9 Jun 1996 07:06:45 +0800
Subject: RFD: Time to kick some anti-scientologist ass?
Message-ID: <199606081945.MAA04681@dns2.noc.best.net>



"Declan B. McCullagh" <declan+ at CMU.EDU> writes:
>> The attached summary is substantially incorrect.

At 12:29 PM 6/8/96 EDT, Dr.Dimitri Vulis KOTM wrote:
>You mean, the anti-scientologists aren't massively forging cancels
>for scientologits' posts on alt.religion.scientology using my cancelbot?

No:  He means that the anti-scientologists are massively forging
cancels of robotically generated spam produced by the scientologists
in an effort to close down the alt.religion.scientology newsgroup.


 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From jamesd at echeque.com  Sat Jun  8 16:17:48 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Sun, 9 Jun 1996 07:17:48 +0800
Subject: NOISE: "Fascism is corporatism"
Message-ID: <199606081932.MAA03833@dns2.noc.best.net>


Like someone who cannot resist looking at a dreadful traffic
accident, I continue to participate in this Detweiler inspired
troll:

At 07:09 PM 6/7/96 -0700, Rich Graves wrote:
> you forget that I'm a
> Certified Political Scientist. 
> [...]
> Once they got in power, then they started developing an economic ideology.

Untrue:

Fascism is of course a reasonably complete, coherent, and 
philosophically consistent logical system, almost as coherent as 
marxism, and far more logical than Mill's utilitarianism.  It was 
published and thoroughly debated well before they pursued or took power.

Rich Graves's lie is a lie I frequently hear from those who well 
know the truth, 

Many of my readers will think I am excessively harsh, calling Rich
Graves a liar rather than a fool, but I hear the above story 
(that fascism is not a coherent ideology or philosophy) primarily from
those whose interests this story serves, and if they genuinely 
thought this story was true, they would not know that it is in their
interests to push it.

Therefore one may reasonably conclude that most who push this story
are knowingly lying, that it is a widespread lie, not a widespread
fallacy or an alternate interpretation of the truth.

I mostly hear it from those whose economic ideology strongly resembles 
fascism, or those whose philosophy is directly descended from fascism, 
is in fact fascist philosophy.  Rich's economic ideology does not seem 
to resemble fascism, so I would guess he is in the second category
but not the first.  Most PC folk are postmodernists, poststructuralists,
deconstructionists, etc, which philosophies directly descend from fascist 
philosophy, and he seems to be PC, so this would explain his peculiar
assertion above.

Not only do such concepts as feminist science, phallocentric science, 
etc, strongly resemble such concepts as aryan science, jewish science, 
etc, but they are justified using the same arguments from the same 
philosophers.  Indeed Heidegger was not only a philosopher of fascism, 
but he personally participated in Hitler's terror, terrorizing his academic
colleagues, and Paul De Man of Yale University worked directly for the 
Nazis as a propagandist in occupied Belgium.

Hence the frequent lie by those who share this monstrous 
philosophy, that the fascists had no philosophy.

 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From test921148 at alpha.c2.org  Sat Jun  8 16:19:30 1996
From: test921148 at alpha.c2.org (test921148 at alpha.c2.org)
Date: Sun, 9 Jun 1996 07:19:30 +0800
Subject: alpha.c2.org IS UP AND RUNNING
Message-ID: <199606081930.MAA19819@infinity.c2.org>


alpha.c2.org is working well.





From Doug.Hughes at Eng.Auburn.EDU  Sat Jun  8 16:40:48 1996
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Sun, 9 Jun 1996 07:40:48 +0800
Subject: 
In-Reply-To: <199606081816.LAA24268@mail.pacifier.com>
Message-ID: <doug-9605082008.AA00025852@netman.eng.auburn.edu>




>While I appreciate your...uh...appreciation, let me remind you that part of 
>my "pronouncements" are that the current political and social system is 
>sick.  Many people around here seem to agree with this assessment.  What I 
>advocate is a comparatively simple change in the rules that could have the 
>effect of vastly changing the way things are done.  Whether these changes 
>are in "the best interests of the inhabitants of this nation" is still an 
>open question, and many people have agreed with me on this matter. 
>
>Jim Bell
>jimbell at pacifier.com
>
>
>

Hmm....

Assissination Politics: "Curing the sickness by killing the patient"

;)





From nCognito at rigel.cyberpass.net  Sat Jun  8 17:04:15 1996
From: nCognito at rigel.cyberpass.net (Anonymous)
Date: Sun, 9 Jun 1996 08:04:15 +0800
Subject: Electronic Signatures
In-Reply-To: <19960607141610.13186.qmail@ns.crynwr.com>
Message-ID: <199606082036.NAA25594@rigel.infonex.com>


> Michael Froomkin writes:
> 
>  > >  > 	The law does not specify how an electronic document must be 
>  > >  > signed, but Barassi and others say it probably will mean coding the text 
>  > >  > and typed signature so they cannot be changed by anyone other than the 
>  > >  > writer.
>  > 
>  > Before you get all hot under the collar, may I note that I've known
>  > Barassi for more than a year, and he is very technically sophisticated.
>  > Allow for some reporter-garble.   Barassi understands digital signatures
>  > as well as you do.
> 

I suppose that I'll have to trust you on this score, and hope that you're 
correct.  Unfortunately, however, even if you are correct, it doesn't 
mean that the law that eventually makes it through commitee will provide 
any useful guidelines. <shrug> But this thread has decended to noizes, so 
I'm out. 

Adios..







From drose at AZStarNet.com  Sat Jun  8 17:05:02 1996
From: drose at AZStarNet.com (drose at AZStarNet.com)
Date: Sun, 9 Jun 1996 08:05:02 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
Message-ID: <199606082022.NAA20567@web.azstarnet.com>


hallam at Etna.ai.mit.edu wrote:

>Whether  the teacher was 
>expected to gun down Hamilton with the Kalashnikov she carried to school
each day or 
>whether the tots were expected to come to her aid with Smith and Westons
I'm not sure. 

Are Smith and Westons like Bolt .45s?

-Master D.M. Rose, M.B.A (Harvard) Looks pretty foolish, doesn't it? But
usually, people just call me Davve.






From tcmay at got.net  Sat Jun  8 17:17:25 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 9 Jun 1996 08:17:25 +0800
Subject: Whalepunks, Marginpunks, Gunpunks, Clintonpunks, and Politics
Message-ID: <addf243d040210043520@[205.199.118.202]>



To all the Whalepunks, Marginpunks, and Gunpunks,

I've been deleting after only a brief glance the dozens of posts on these
subjects (funny how some people who issue "pissograms" telling people
things are "off-topic" apparently think their own long rants on off-topic
subjects are just fine). However, this misstatement caught my eye:

At 6:30 PM 6/8/96, hallam at Etna.ai.mit.edu wrote:

>by government. I have even heard it stated that had gun ownership been
>more widespread
>in the UK the Dunblane massacre would not have occurred. Whether  the
>teacher was
>expected to gun down Hamilton with the Kalashnikov she carried to school
>each day or
>whether the tots were expected to come to her aid with Smith and Westons
>I'm not sure.
>In short I don't think that there is any type of piffle that the "most
>fuzzy headed free
>market types" cannot offer.

Some of the folks I know would point out the logical flaws in this model.

First, a Smith and Wesson is not what the tots should be carrying. An MP-5K
would fit nicely in their bookpacks (especially now that all yuppie kids
carry de rigeur designer backpacks, though mostly for designer water). More
firepower.

Second, the preferred "trans-humanist" solution is much cleaner: blow up
the classroom and then restore the innocents from backups.

(High-tech variant: "Kill them all and let the nanotech truth machines sort
them out.")

My point of view is that while schools should be free of guns, adult
citizens should probably have access to guns. There are, sadly, nutty
people who will use nearly any available weapon to commit mayhem and mass
murder. Rifles, shotguns, axes, knives... The "Luby's" cafeteria massacre
in Texas several years back is a better example than the Dunblane school
shooting (or the one in Tasmania, or the one in California....). There, had
some of the restaurant patrons been armed, it is likely that at least one
of them could have gotten off a shot. Further, many of these nutcase
killers are basically cowards, according to profiles I've read, and might
be fearful of sitiuations where there victims can shoot back. When they
know their victims are unarmed, are sheep for the slaughterhouse, I think
this causes more such "mukkings" (to use Brunner's prescient term from
"Stand on Zanzibar...Christ, what an imagination he had).

Remember, "Guns don't kill people, postal workers do."

In general, I think Phill raises some good points about the efficiency of
free markets. However, I doubt that Cypherpunks is the proper forum for
debating economic theory, for various reasons. I lean strongly toward the
free market side, inasmuch as I think most non-free market economies are
actually just cases where the government controls the _single_ corporation
they let run an industry, and thus one gets a worse situation that with the
grossest excesses of capitalism. More pollution, more strip-mining, more
denudation of forests, more destruction of lakes, etc. Look at the former
U.S.S.R. and Eastern Europe for a glimpse of what "state capitalism" can
do.

However, the reason many of us don't jump in and write defenses of free
markets here (and I would not have except to make my transhumanist joke--so
sue me) is that this list is not "Libernet" nor any of the similar
political discussion lists. Secondly, there is almost zero chance that any
of us will have our views changed by such political arguments, so why
bother?

(I do discuss what I think are the _logical implications_ of strong
cryptography and cryptoprivacy, and even the implications of crypto
anarchy, and I think these issues are "on-topic" for this list. Even if one
is a socialist, a fascist, a royalist, or a Wobbly, the implications remain
important.)

But arguing the merits of capitalism vs. socialism, for example, has rarely
been fruitful in the past 10 years of the Usenet, or on mailing lists, and
I doubt the debate will be more fruitful here.

The same goes for debate about Clinton, Hillary, Vince Foster, Whitewater,
etc. The fact that someone forwarded a Brock Meeks story in which he
(apparently, as I skimmed-then-deleted the story) make negative comments
about the Clintons, and then someone chimed in with points about her
allegedly illegal stock trades....well, these are clearly not list topics,
in my view of course.

(I claim no right to set the list agenda. Nor do I accept Perry's
oft-repeated claim that I am "causing" the list's decline by stating my
views on this point.)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From cibir at netcom.com  Sat Jun  8 17:32:58 1996
From: cibir at netcom.com (Joseph Seanor)
Date: Sun, 9 Jun 1996 08:32:58 +0800
Subject: Visual Basic, C++ Programmer
In-Reply-To: <01BB5460.9B743B20@ppp3>
Message-ID: <Pine.3.89.9606081407.A7593-0100000@netcom15>



I am interested in talking with any people that are fluent in Visual 
Basic or C++, and are independtly minded.  The needed programs are small 
programs that need to be written for a growing company.  Interested 
people, please contact me via email at: cibir at netcom.com


Thanks!

Joseph Seanor
CIBIR Corporation





From drose at AZStarNet.com  Sat Jun  8 17:33:43 1996
From: drose at AZStarNet.com (drose at AZStarNet.com)
Date: Sun, 9 Jun 1996 08:33:43 +0800
Subject: Internet solution for law enforcement
Message-ID: <199606082052.NAA28043@web.azstarnet.com>


"Alan Horowitz" alanh at infi.net wrote:

>It appears that someone has figured out that medium-sized jurisdictions 
>don't want to be left out of the trendiness. And has put together a 
>product that can be peddled at the trade shows where Police Chiefs go.
>
>I recall reading that there's something like 25,000 different police 
>departments in America. It's a sizeable market. And a very politically 
>correct one, right now.
>
>Do these managers _need_ this stuff? Well, did they _need_ all those 
>black-ninja hollywood flavored SWAT uniforms?
>
>Now, if they could just get a few more PC-of-the-month phraseologies into 
>the title of their product, they'd sell twice as many.  Start with 
>"anti-deadbeat-dad software", maybe. "Pro Diversity". "Environmentally 
>Friendly Software".
>
>Is America great, or what?

You bet.  PC stuff is essential.  Here in Tucson, the cops came up with a
novel, simple, cheap, and efficacious method to determine cocaine HCl usage:
Put a strip of Scotch (TM) tape across the nostrils of a
suspectee/apprehendee and see if there's any toot on it.

Local judges disallowed this procedure because, in the absence of a
substantial presence of African-Americans in the "community" (they comprise
<2% of local population), almost all of those arrested were
Hispanic-surnamed Latinos.






From Christian.K at t-online.de  Sat Jun  8 18:05:19 1996
From: Christian.K at t-online.de (Dr. Atomic)
Date: Sun, 9 Jun 1996 09:05:19 +0800
Subject: lets hack German Telekom
Message-ID: <m0uSVpW-0000ncC@ermail00.btx.dtag.de>


Hello guys,

i am from Germany and i want to ask you, if you know something about
the password-encryption of the T-Online Decoder from German Telekom!

I tried to crack it, but it is not easy!
The password is hidden in a file called DBSERVER.INI.
If someone know how to crack it or has any programms please let me 
know!


--------------------------------------------------------------------
written by Atomic (christian.k at t-online.de)             ;-)
But remember! A Homepage will soon be variable, too.     :-o
--------------------------------------------------------------------





From hallam at Etna.ai.mit.edu  Sat Jun  8 18:05:50 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Sun, 9 Jun 1996 09:05:50 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
In-Reply-To: <199606082022.NAA20567@web.azstarnet.com>
Message-ID: <9606082133.AA05913@Etna.ai.mit.edu>



>usually, people just call me Davve.

Unusual to spell Dave with two v's, were your parents also dyslexic?

How about everyone holding off on the spelling flames for a while?


Having discovered from Hal Finnley that you US types do not lump together 
derivatives based on futures when you refer to futures I think I now understand 
the point Perry was originaly trying to make. Yes speculating in ordinary 
futures, one would normally expect a return of about the same as the margin put 
up. Does anyone have a first hand report of the precise contracts being traded? 
There appear to be no details on the Web that Alta Vista has access to.

Of course if Perry and his cohorts were not so keen to call people drivelling 
idiots we would have got to this point rather earlier. 

I have a habit of not valuing very highly claims from people who feel they have 
to resort to insults to get an argument across. Perry's mode of argument appears 
to be the automatic gainsaying of whatever the other person says - not too 
helpfull.


I'm still at a loss to see why Bob thinks I have anything whatsoever to do with 
the Social Text people. I've never accepted any of the Derrida type stuff and 
have metaphysical and linguistic objections to that approach based in the theory 
they are alledgedly advancing. 


		Phill








From ichudov at algebra.com  Sat Jun  8 18:20:02 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Sun, 9 Jun 1996 09:20:02 +0800
Subject: 
In-Reply-To: <199606081816.LAA24268@mail.pacifier.com>
Message-ID: <199606082209.RAA19856@manifold.algebra.com>


jim bell wrote:
> 
> While I appreciate your...uh...appreciation, let me remind you that part of 
> my "pronouncements" are that the current political and social system is 
> sick.  Many people around here seem to agree with this assessment.  What I 
> advocate is a comparatively simple change in the rules that could have the 
> effect of vastly changing the way things are done.  Whether these changes 
> are in "the best interests of the inhabitants of this nation" is still an 
> open question, and many people have agreed with me on this matter. 
> 

Since corrupt officials are likely to have more anonymous cash that
phreedom phighters, guess who will win.

Also, think about this: lots of people have someone they'd like
to assassinate but do not actually do it because of lack of anonymity
and associated hassles (like dealing with assassins non-anonymously,
abundance of traces, possible confession of the assassin and so on).
With your assassination clearinghouse these hassles go away. I think it
would present an excellent prospect for reducing the population.

Maybe *that* will help the whales and trees, because of the effect on demand.

	- Igor.





From perry at piermont.com  Sat Jun  8 18:51:33 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 9 Jun 1996 09:51:33 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
In-Reply-To: <9606081830.AA05221@Etna.ai.mit.edu>
Message-ID: <199606082240.SAA21523@jekyll.piermont.com>



hallam at Etna.ai.mit.edu writes:
>Apart from hero worship why do you believe that Friedman is not able to say 
>anything ridiculous?

Because I've read vast chunks of the corpus of his writings and the
comment you attribute to him sounds about as much in character as, say,
Jesse Helms announcing that he's in favor of gay marriages. Its
POSSIBLE that it could happen, but its not bloody likely.

He's said many things that I disagree with -- his contentions about
fixed rule central banking seem specious, for instance -- but I've
never heard him say or write anything out of character.

>Since you were so certain that Hess was not a staff member of the
>Cato institute despite being listed as such on their home page

He isn't. My whole point about P.J. O'Rourke should have made that
point, but you just spewed inanities about telecommuting. You
obviously had no idea where he worked even though I dropped the major
sarcastic hint that it was Rolling Stone, and not Cato. Never mind. I
suppose your sense of sarcasm is also impaired.

You have contended that Hillary Clinton traded options when she traded
futures.

You have contended that Hillary Clinton was trading in margin when the
facts were that she was trading out of margin.

You have contended that Hillary Clinton was trading lots of under
$20,000 when she was trading vastly larger sizes.

You obviously didn't examine the situation yourself at all.

However, having a doctorate in an unrelated field, you apparently
believe that you are able to make pronouncements in the absense of
facts. Later in your message, you accused the free market faction of
being "academic".

>Plus, to say that such an analysis would be out of line with "even
>the most fuzzy headed free market types" is somewhat rich. I have
>heard plans to eliminate all government apart from the army,
>privatising roads and the police.

Yes, but since you don't understand how free markets work or how free
market types think you can't reason about them.

Put it this way -- communists say really outrageous things, right?
Well, would it be in character for a communist to go out and endorse
joint stock companies as a primary mechanism for distributing factory
profits?

Just because someone says something you consider weird doesn't mean
they aren't thinking in a systematic fashion, and doesn't mean that
certain things are and are not out of character. Over and over again,
however, you have betrayed a fundamental ignorance of the arguments
free marketeers use. It is one thing to disagree with someone, but it
is another thing to mischaracterize them. I've read lots of Marx and
Lenin, but it doesn't seem like you've bothered to read the writings
of even fairly mainstream economists.

>I have heard numerous claims that monopolies cannot ever exist under
>any circumstances unless they are created by government.

I've never heard that, but I myself have made the argument that they
are very rare without government intervention. Its a simple fact of
the world -- if you disagree with me you are disagreeing with the
historical record. I can name the real cases of monopoly that have
sprung up over the decades -- Alcoa being about the best example.
You probably can't name any to speak of, other than tired and fake
examples like U.S. Steel.

>I have even heard it stated that had gun ownership been more widespread 
>in the UK the Dunblane massacre would not have occurred.
>Whether the teacher was expected to gun down Hamilton with the
>Kalashnikov she carried to school each day

Of course, thank goodness the U.K. has some of the strictest gun
control in the world, since it stops these sorts of
incidents. (I'll point out for Dr. Hallam-Baker's benefit that this
sentence was "sarcasm".)

And yes, if she'd been carrying not a Kalashnikov rifle but just a
simple pistol in her pocket she might indeed have been able to shoot
the guy. I realize this may come as a shock to you, but in a fire
fight the winner is the guy who fires accurately first, not the guy
with the longer gun. Of course, you prefer to use distortionary
language (like refering to carrying a rifle) to make things look
ridiculous when in fact non-silly alternatives are possible.

>How to save the whales is a logical outcome of Friedman's thesis that markets 
>are everything.

Since you are either misreporting or inventing the comments you
attribute to Friedman and can neither cite the actual article nor
produce quotes from it, I don't think its entirely fair for you to
make claims about his position.

>The flaw in Perry's "stakeholder" theory is the same one in many
>academic theories. It assumes that most people are smart enough to
>realise their true interests.

Since in practice it always works, and since the alternatives never
do, I would say that the collectivists of the world, such as yourself,
are the academics here.

Amazing how time after time even weak Adam Smithian analysis works
just fine. Impose price controls on gasoline, and watch shortages form
when supplies change, as in 1973. Remove price controls, and watch
shortages disappear. Substantially lower the income tax, growth goes
up. Substantially raise it, growth goes down. Make alchohol illegal,
watch criminals take over the market. Make it legal again, watch the
problems go away.

No, Dr. Phill Hallam-Baker, D.Phil., who can't name whether Hillary
Clinton traded options or futures and never examined a single trade
she made but who can give us details about how those of us who looked
at the thing in detail are wrong when we say her trades were
impossible, it is you who is the academic high in your ivory tower
with no sense of reality whatsoever.

Ask all the people defecting from Cuba if they think your way is
better some time. Be prepared to wipe the spit off your face.

Perry





From perry at piermont.com  Sat Jun  8 19:32:10 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 9 Jun 1996 10:32:10 +0800
Subject: Whalepunks, Marginpunks, Gunpunks, Clintonpunks, and Politics
In-Reply-To: <addf243d040210043520@[205.199.118.202]>
Message-ID: <199606082322.TAA21596@jekyll.piermont.com>



Timothy C. May writes:
> In general, I think Phill raises some good points about the efficiency of
> free markets. However, I doubt that Cypherpunks is the proper forum for
> debating economic theory, for various reasons.
[...]
> However, the reason many of us don't jump in and write defenses of free
> markets here (and I would not have except to make my transhumanist joke--so
> sue me) is that this list is not "Libernet" nor any of the similar
> political discussion lists.

Am I the only person who finds this comment, in context, howlingly funny?

> Secondly, there is almost zero chance that any of us will have our
> views changed by such political arguments, so why bother?

Mine were many years ago -- 

> But arguing the merits of capitalism vs. socialism, for example, has rarely
> been fruitful in the past 10 years of the Usenet,

And I know of other people who's ideas were changed by such
discussions. A couple of them subscribe to this list.

In any case, Tim, this *is* now the sewer list, the place where
anything at all may be flushed by the inhabitants, partially as a result
of your own lobbying against "Perrygrams" and such. I understand that
many do not like the taste of their own drek, but hey, its what you
asked for. Repeatedly, you stood your ground and staked your claim and
said "no one will tell ME what to do", and well, you got what you
wanted.

Perry





From mpd at netcom.com  Sat Jun  8 20:06:12 1996
From: mpd at netcom.com (Mike Duvos)
Date: Sun, 9 Jun 1996 11:06:12 +0800
Subject: Clam Wars
In-Reply-To: <aRk8oD61w165w@bwalk.dm.com>
Message-ID: <199606082344.QAA04566@netcom11.netcom.com>


LD editorializes:

 > I haven't been paying a lot of attention to the Church of
 > $cientology wars until recently. Here's an executive
 > summary for those who don't give a damn.

Uh huh.

 > 1. There's a gang of flamers (David Gerard, Jon Noring, Ron
 > Newman, Rob J. Nauta, and the like) who try to stop
 > $cientologists from discussing their religion on the Usenet
 > newsgroup alt.religion.scientology. Most of them are
 > disgruntled former cult members and/or members of other
 > similar cults.

Actually, from my infrequent and cursory reading of a.r.s, it is
my impression that the antis are discussing their own views of
Scientology, not trying to prevent anyone else from discussing
theirs.  I would think all opinions related to Scientology would
be on-topic for a.r.s., both positive and negative.

 > 2. The anti-scientologists have caused many cypherpunks
 > anonymous remailers to shut down via their egotistical
 > misuse of them, viz. criminally posting copyrighted Co$
 > writings to Usenet. They did it knowing that the Co$ is
 > likely to harrass the remailer operators, causing them to
 > shut down and depriving everyone of their services.

Well, perhaps.  It certainly isn't very nice to post copyrighted
works via anon remailers.  At least not more than constitutes
"fair use" for the purpose of critical review (or hilarious
laughter, as the case may be).

 > 3. These harrassers are Usenet Cabal supporters, and they
 > are sometimes joined by initerant cabal enforcers such as
 > Peter Vorobieff, who visit a.r.s to lend a helping hand and
 > to flame Co$.

Nothing wrong here.  Flames are the thread from which the fabric
of Usenet is woven.

 > 4. Recently the anti-scientologists have asked me for a
 > copy of my cancelbot, and have been using it to forge
 > cancels for scientologist posts on a.r.s.

It should be noted that said Scientologist posts consist of
thousands of distinct little snippets from the Scientologist
Handbook and other similar tracts, posted as separate articles
from multiple accounts simultaneously.  This is clearly an
attempt to flood everything else off servers while staying clear
of the current definitions of Spam and Velveeta.

While Usenet tends to frown on content-based cancels, I find it
difficult to understand why the cancellation of thousands of
gratuitous posts duplicated amongst a large number of accounts
should be considered "content-based." Does participation in
a.r.s. ever legitimately require this level of posting?  It
shouldn't be too difficult to find non-content-based criteria for
cancelling this crap.

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     mpd at netcom.com     $    via Finger.                      $






From hfinney at shell.portal.com  Sat Jun  8 20:14:24 1996
From: hfinney at shell.portal.com (Hal)
Date: Sun, 9 Jun 1996 11:14:24 +0800
Subject: Anonymous return addresses
Message-ID: <199606082329.QAA14538@jobe.shell.portal.com>


Browsing through the 1995 IEEE Symposium on Security and Privacy
proceedings at the library, I found two articles of interest here.  The
first, "Preserving Privacy in a Network of Mobile Computers", is really a
method for anonymously receiving mail via reading it from a large
database such that no one knows which part you are reading.  This is a
topic which we discussed here at some length a year or two ago, but I
think this article has a new idea about it which I will discuss below.

The other one was "Holding Intruders Accountable on the Internet" and it
had one strange comment.  Basically it was about a way of trying to track
down cracker types who break into systems.  One strategy these people use
is to log into a whole series of insecure hosts, one after the other,
before attacking their target.  Then tracing back where they came from is
very difficult.  Cliff Stoll's "The Cuckoo's Egg" is the classic account
of how hard it is to trace these people.  Probably the new books about
Mitnick talk about the same thing.

The idea in this article is that you monitor the whole net and track
all the rlogin and telnet traffic between pairs of hosts.  Then they
describe a statistical technique for determining that two different
telnet sessions are chained together by recognizing the same patterns
of traffic on them.  Basically they count the frequency of spaces and
punctuation marks on minute-long time slices and try to correlate
them.  This way you can tell that the intruder attacking here is also
using these other hosts over there, and try to track him down that
way.

I don't think this is very practical, and I have mixed feelings about the
technology - I don't favor breakins, but the kinds of surveillance that
would be necessary to implement their technique seem very threatening.
Also they do mention the obvious countermeasure of using encryption at
each stage, which would be easy with such things as the secure remote
shell programs around now.

The interesting comment came when they were discussing an alternative
scheme, which would be to have all hosts keep track of their incoming and
outgoing connections:  "The difficulty with all such host-based tracing
systems is that, when an extended connection crosses a host which is not
running the system, accountability is altogether lost at that point....
Even if most hosts could be secured, the intruder community could easily
maintain a set of machines to launder connections, just as they maintain
anonymous remailers."

So apparently in the view of these authors anonymous remailers are
maintained by "the intruder community."  It is unfortunate that we have
this image among some member of the larger community.  BTW, there are
periodic suggestions here to run general-purpose connection redirectors,
but people should be aware of the problem that cracker types would seize
on these as another shield for their crimes.  These would have to be
limited to specific uses, such as port 80 which is the http port and
which hopefully can't easily be used for attacks.

In any case, let me describe the message-receipt idea from the other paper
I mentioned above, which is by David A. Cooper and Kenneth P. Birman of
Cornell.  They have a few ideas, among them exchanging message labels
for the next message in an ongoing conversation, so that later messages
don't have any identifying information on them, but just opaque message
labels which can be scanned for matches to those of interest.  This is a
concept we have discussed before.  However you still have the problem
at least for the first message to an anonymous recipient of getting it to
him anonymously even though the message says what pseudonym it is for.

A simple idea is to put all such messages into a database and to let
everyone scan the message headers to see whom they are for.  Then when
they see one for them they download, decrypt, and read it.  For more
security, let the database machine be trusted, and let the download
request and response be sent encrypted.  Now only the database machine
knows which person asked for which message.  This provides a level of
security analogous to sending through a single remailer.

(Another idea is to download all messages, but that is generally
infeasable if there are a lot of people using the system.)

The new idea is to use multiple databases to get security similar to
using multiple remailers.  I'll describe it using two machines.  Each
holds a database of messages, and the two databases are exactly alike.
Some mechanism keeps the two synchronized.  Furthermore, all the
messages need to be the same size.  There will need to be some padding
and fragmentation/assembly mechanism to arrange for this.

Someone who wants to receive some mail anonymously first downloads all
the message headers as before, and determines which messages are for
them.  Suppose just one is, and it is message number 20 out of a database
of, say, 50 messages.  Now what the reader does is to choose a random 50
bit number (where 50 is the total number of messages in the database).
He makes a copy of this number, and toggles bit 20 in one of them (20 is
the message he wants to receive).  Then he sends one number to one of the
database servers, and the other to the other server.  Each one receives a
random-looking 50 bit number.

What each server does is to take the messages from the database which
correspondo to 1 bits in the 50 bit number, and XOR all those messages
together, byte for byte.  The resulting output will be the same size as
a quantized message.  It is sent, encrypted, back to the requestor.

Now all he does is to XOR the two messages he got back from the servers.
All of them will cancel out except for message 20, which is the one he
wants.  This can be generalized to more than two servers, by creating
multiple bit strings and arranging so that the XOR of all of them will
just leave the bit set for the message he wants.  If he wants more than
one message the protocol has to be repeated separately for each message.

There is no large amount of traffic needed, as each server only sends an
amount of data equal to one message.  The individual servers do not get
any information about which message the requestor wants (other than that
it is one of the 50).  Only by colluding and XOR'ing their bit strings
can they figure that out.  The same kind of collusion is needed to trace
a sent message using two remailers, so the security is similar to what we
get sending messages.

Messages would have a finite lifetime and would expire and be removed
from the database after a while.  The authors propose breaking the
database up into batches with a fixed number of messages, but I don't
fully follow the reasoning behind this.  I guess it reduces the load on
the server when it does its XOR's.

I'm not sure whether this particular scheme was proposed when we
discussed this concept in the past, but it does seem like an interesting
alternative way to receive messages.

Hal





From nobody at c2.org  Sat Jun  8 20:20:00 1996
From: nobody at c2.org (Anonymous User)
Date: Sun, 9 Jun 1996 11:20:00 +0800
Subject: NSA/CIA to snoop INSIDE the U.S.???
Message-ID: <199606090005.RAA17235@infinity.c2.org>


: This is a fucking big story.
: Allowing the CIA and NSA to snoop domestically, and using only a handful of
: suspicions and anecdotes about cybernastiness and evil cryptohackers to
: justify this major policy shift -- well, it's fucking amazing.
: Nunn's proposal, unfortunately, was more than a "suggestion."

This is very serious. Why has there not been more discussion about 
this on the list?

How close/far is this from becoming law?

If they are now trying to make it legal for the CIA and NSA to snoop 
inside the US  I would guess that it's happening already. Remember
wiretaps? Do it now and they will make it legal later.







From jimbell at pacifier.com  Sat Jun  8 21:00:44 1996
From: jimbell at pacifier.com (jim bell)
Date: Sun, 9 Jun 1996 12:00:44 +0800
Subject: 
Message-ID: <199606090006.RAA05123@mail.pacifier.com>


At 05:09 PM 6/8/96 -0500, Igor Chudov @ home wrote:
>jim bell wrote:
>> 
>> While I appreciate your...uh...appreciation, let me remind you that part of 
>> my "pronouncements" are that the current political and social system is 
>> sick.  Many people around here seem to agree with this assessment.  What I 
>> advocate is a comparatively simple change in the rules that could have the 
>> effect of vastly changing the way things are done.  Whether these changes 
>> are in "the best interests of the inhabitants of this nation" is still an 
>> open question, and many people have agreed with me on this matter. 
>> 
>
>Since corrupt officials are likely to have more anonymous cash that
>phreedom phighters, guess who will win.


The people, that's who.  The reason is that while "corrupt officials" may 
have more money, per person, that ordinary citizens, there are FAR more 
ordinary citizens than officials.  Further, these corrupt officials only 
have more money because they rob it from ordinary citizens, which means that 
they start out the game hated by the public.

Finally, officials are, by definition, identified or identifiable, while 
disaffected citizens are not.


Jim Bell
jimbell at pacifier.com





From rah at shipwright.com  Sat Jun  8 21:01:45 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Sun, 9 Jun 1996 12:01:45 +0800
Subject: Elementrix Snake Oil Spam...
Message-ID: <v03006f0baddfc7ed055b@[199.0.65.105]>


Was it just me, or did others on this list get three whopping MS Word docs
sent to them from the POTP snake-oil folks?

Came from one Charles W. Morgan, <charlie at outcomesinc.com>, of "Outcomes
2000, Inc.", whoever *that* is...  Probably somebody trying to give the
Albuquerque Spam King a run for his money, I bet.

Feh!


Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From ichudov at algebra.com  Sat Jun  8 21:16:41 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Sun, 9 Jun 1996 12:16:41 +0800
Subject: 
In-Reply-To: <199606090006.RAA05123@mail.pacifier.com>
Message-ID: <199606090034.TAA20636@manifold.algebra.com>


jim bell wrote:
> At 05:09 PM 6/8/96 -0500, Igor Chudov @ home wrote:
> >
> >Since corrupt officials are likely to have more anonymous cash that
> >phreedom phighters, guess who will win.
> 
> The people, that's who.  The reason is that while "corrupt officials" may 
> have more money, per person, that ordinary citizens, there are FAR more 
> ordinary citizens than officials.  Further, these corrupt officials only 
> have more money because they rob it from ordinary citizens, which means that 
> they start out the game hated by the public.

You haven't seen _real_ corrupt officials. :)

	- Igor.





From nobody at REPLAY.COM  Sat Jun  8 22:43:19 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Sun, 9 Jun 1996 13:43:19 +0800
Subject: Anti-Scientologists
Message-ID: <199606090245.EAA05922@basement.replay.com>


>1. There's a gang of flamers (David Gerard, Jon Noring, Ron Newman, Rob J.
>Nauta, and the like) who try to stop $cientologists from discussing their
>religion on the Usenet newsgroup alt.religion.scientology. Most of them are
>disgruntled former cult members and/or members of other similar cults.

Untruth #1. Aside from the "religion" red herring you tossed in (it's a cult), the critics expose the lies, doubletalk and inconsistencies posted by cult apologists. (It should be noted that these people aren't generally "just another satisfied Scientologist," but are cult employees who are carefully vetted to distribute propaaganda without ever answering critics' questions.)

[snip]

>3. These harrassers are Usenet Cabal supporters, and they are sometimes
>joined by initerant cabal enforcers such as Peter Vorobieff, who visit a.r.s
>to lend a helping hand and to flame Co$.

So what's your point? Besides, there is no Cabal fnord. :-)

>4. Recently the anti-scientologists have asked me for a copy of my cancelbot,
>and have been using it to forge cancels for scientologist posts on a.r.s.

Untruth #2. Articles canceled from a.r.s. have been multiple postings of standard Scientology tracts (over 10,000 in all, so my newsreader says), spread out over various alleged users. These aren't intended to promote discussion -- they're intended to bury the newsgroup in noise.

Apparently being selected Kook of the Month causes disturbances in one's ability to distinguish the correct from the incorrect. (Or is that how one gets the award in the first place?)








From markm at voicenet.com  Sat Jun  8 22:44:34 1996
From: markm at voicenet.com (Mark M.)
Date: Sun, 9 Jun 1996 13:44:34 +0800
Subject: Rabin patented?
Message-ID: <Pine.LNX.3.93.960608220851.129A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

Is Rabin encryption patented?  I have never heard of any patent covering Rabin
encryption, but I have also heard that Diffie-Hellman will be the first PK
algorithm that is patent-free when the patent expires in '97.  I know that
until recently, ElGamal was considered to be covered under the DH patent.  I
wonder if the same is also true for Rabin.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMbozMrZc+sv5siulAQH2ugP8C0ymdTJJLUa9NQxj7ahkcGD/u0tFZWfN
DtMDRm08b0aupADNgDntn7ZHAZKXo5RRAClLfvB3Z/gIGMbqAQKFMItSN7CbJ4k1
osY2enhnrDN840LH0jQmC/dS0MjVWh5CaC3R9SqHqhiu5S5oZUP4fAJhIyDMcQuo
VLGUQzLZVxs=
=P3wZ
-----END PGP SIGNATURE-----





From hallam at Etna.ai.mit.edu  Sat Jun  8 23:29:23 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Sun, 9 Jun 1996 14:29:23 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
In-Reply-To: <199606082240.SAA21523@jekyll.piermont.com>
Message-ID: <9606090229.AA06296@Etna.ai.mit.edu>



>>Since you were so certain that Hess was not a staff member of the
>>Cato institute despite being listed as such on their home page

>He isn't. My whole point about P.J. O'Rourke should have made that
>point,

Perry, one last time:

The POINT is that you CORRECTED me in saying Hess was a Cato Institute staff 
member when the Cato Institute THEMSELVES list him as a staff member.

Your correction was ILL INFORMED and WRONG to continue to present this as an 
example of my being in error is somewhat stupid.

It wouldn't be so bad Perry but you can't resist calling someone an imbecile 
when they say something you disagree with. I may occasionaly post without 
checking my facts but I don't call someone a fool without checking my facts. 
When Perry mentioned Hess I did a search on Alta-Vista, found his work at the 
Cato Institute and read it. Unfortunately that search produced hits for the 
father as well as the son but the papers were all by the son. 

P.J. O' Rourke is also listed as a Cato staff member. So to describe him as such 
would NOT be inaccurate. It might not be the best way to describe O'Rourke but 
it would not be an incorrect way.

If you happen to know that the Cato institute is lying then thats another 
matter. Its not unknown for lobby groups to fill out their staff lists with 
bogus placemen but if O'Rourke isn't happy about being called a Staff member of 
Cato presumably his lawyers would be issuing letters. Certainly I would not call 
someone a fool for believing the Insititute of Historical Review when they 
falsely claim that A.J.P.Taylor was a supporter of their position. I might 
correct them and point out that the IHR was lying but I would not 


>>I have heard numerous claims that monopolies cannot ever exist under
>>any circumstances unless they are created by government.
>
>I've never heard that, but I myself have made the argument that they
>are very rare without government intervention. 

Its not a debate that I think its worth having with you and its a pointless 
debate in any case. There is no large company in the world which does not 
interact with government agencies and is not affected by government regulations. 
It is impossible to attribute cause and effect and say what would have been the 
case had government not been involved. The deBeers Diamond cartel was formed by 
Rhodes because he had the only steam pump in South Africa, not because of any 
governmental favours. It has continued because it is in the interests of all 
suppliers to maintain the false price. Granted that the current state of the 
diamond market may not last another twenty years it has already survived a 
century.

Of course monopolies will be rare, by their nature there can only be one in any 
particular industrial sector.


>Of course, thank goodness the U.K. has some of the strictest gun
>control in the world, since it stops these sorts of
>incidents. (I'll point out for Dr. Hallam-Baker's benefit that this
>sentence was "sarcasm".)

Actually it turns out that they are not all that tight after all. But don't 
worry, this is being fixed. 


>And yes, if she'd been carrying not a Kalashnikov rifle but just a
>simple pistol in her pocket she might indeed have been able to shoot
>the guy. I realize this may come as a shock to you, but in a fire
>fight the winner is the guy who fires accurately first, not the guy
>with the longer gun.

Is it just me or is the idea that teachers should be armed with lethal weapons 
somewhat a silly one. For a start the number of teachers who crack and plug a 
youngster being a pain would probably be higher than the current number of 
schools masacres. Secondly it may be just me but I suspect that Hamilton would 
have been the person to shoot first in the Dunblane trajedy.



>Since you are either misreporting or inventing the comments you
>attribute to Friedman and can neither cite the actual article nor
>produce quotes from it, I don't think its entirely fair for you to
>make claims about his position.

Perry, I do not carry a full archive of press clippings arround with me! I gave 
you the reference, you have the opportunity to look it up if you have access to 
an online service with archives from English papers. 


>Amazing how time after time even weak Adam Smithian analysis works
>just fine. Impose price controls on gasoline, and watch shortages form
>when supplies change, as in 1973. 

Perry, you are entirely neglecting the effect of a little cartel in the middle 
east that got together to deliberately force up the price of oil called OPEC. 
While nobody in the west is likely to support their action its a bit rich for 
you to claim that shortages resulted from domestic policy when the oil producing 
countries enacted a deliberate policy to force the price of oil up. From the 
supplier country point of view its hard to argue that the OPEC move was a bad 
one, it allowed them to drastically increase the value of their oil stocks. Its 
a pity that little of that reached the people in those countries but that is 
capitalism for you.


>Ask all the people defecting from Cuba if they think your way is
>better some time. Be prepared to wipe the spit off your face.


Perry you are worse than a fool. I have never been an appologist for Castro or 
his self serving ideology. It is ideologues like Castro and yourself who do the 
real damage. By idealogue I mean someone who tries to pretend that society can 
be organised according to a single overarching principle which is believed in as 
an article of faith. 


		Phill





From cmcurtin at fahlgren.com  Sun Jun  9 00:00:37 1996
From: cmcurtin at fahlgren.com (C Matthew Curtin)
Date: Sun, 9 Jun 1996 15:00:37 +0800
Subject: US: Domestic Encryption Protected by US Constitution?
Message-ID: <199606090326.XAA06963@goffer.ee.net>



Something that has come up in my recent random thoughts...

Given that the US State Department classifies strong crypto as
munitions, is it possible that any laws passed outlawing the use of
strong crypto among US citizens could be declared unconsitutional, in
violation of the second amendment?

Are there any legal precedents that apply here? Is the question purely
academic (i.e., no such laws exist, no such bills are in the works, or
none have been tried)? Does anyone know of any laws on the books that
might be relevant to my question?

--
C Matthew Curtin                                                Chief Hacker
Fahlgren, Inc.    655 Metro Pl S, Ste 700, Box 7159     Dublin OH 43017-7159
http://www.local.com/~cmcurtin/  cmcurtin at fahlgren.com    PGP Mail Preferred





From drose at azstarnet.com  Sun Jun  9 00:15:13 1996
From: drose at azstarnet.com (drose at azstarnet.com)
Date: Sun, 9 Jun 1996 15:15:13 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
Message-ID: <199606090200.TAA26296@web.azstarnet.com>


hallam at Etna.ai.mit.edu wrote:

>>usually, people just call me Davve.
>
>Unusual to spell Dave with two v's, were your parents also dyslexic?

Er, Phill (if I may make so bold, sir--arggh, treasure ahead laddies), I'm
being a tad sarcastic, Phillll. Get it?

Frankly, my wanker/tosspot amigo, I am more than a bit sick of your
self-professed ignorance. And your ad hominem attacks don't amount to a hill
of beans.

I am more than through with you.  Perhaps Perry has more patience.






From dlv at bwalk.dm.com  Sun Jun  9 00:29:13 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Sun, 9 Jun 1996 15:29:13 +0800
Subject: 
In-Reply-To: <199606090034.TAA20636@manifold.algebra.com>
Message-ID: <VLi9oD75w165w@bwalk.dm.com>


ichudov at algebra.com (Igor Chudov @ home) writes:
> You haven't seen _real_ corrupt officials. :)

Jim - could corrupt gov't official hide behind anonymity too?
E.g., a particularly obnoxious gov't regulation being issued from
behind anon remailer?

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From dlv at bwalk.dm.com  Sun Jun  9 00:31:16 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Sun, 9 Jun 1996 15:31:16 +0800
Subject: 
In-Reply-To: <199606082209.RAA19856@manifold.algebra.com>
Message-ID: <k5H9oD71w165w@bwalk.dm.com>


ichudov at algebra.com (Igor Chudov @ home) writes:
> > While I appreciate your...uh...appreciation, let me remind you that part of
> > my "pronouncements" are that the current political and social system is
> > sick.  Many people around here seem to agree with this assessment.  What I
> > advocate is a comparatively simple change in the rules that could have the
> > effect of vastly changing the way things are done.  Whether these changes
> > are in "the best interests of the inhabitants of this nation" is still an
> > open question, and many people have agreed with me on this matter.
> >
>
> Since corrupt officials are likely to have more anonymous cash that
> phreedom phighters, guess who will win.
>
> Also, think about this: lots of people have someone they'd like
> to assassinate but do not actually do it because of lack of anonymity
> and associated hassles (like dealing with assassins non-anonymously,
> abundance of traces, possible confession of the assassin and so on).
> With your assassination clearinghouse these hassles go away. I think it
> would present an excellent prospect for reducing the population.

Igor, have you ever read novels about British life in 18th century?
(I'm using this as an example because every good Russian reads them. :-)
Have you noticed how exaggeratedly polite they were to each other,
in comparison to Americans today? Do you know why?
Because back then, every gentle person was armed and might use violence
in sufficiently provoked.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From foodie at netcom.com  Sun Jun  9 00:31:25 1996
From: foodie at netcom.com (Jamie Lawrence)
Date: Sun, 9 Jun 1996 15:31:25 +0800
Subject: Reference Correction Re: Thank you for the Archives 100 messages
Message-ID: <v02140b02ade008e3f040@DialupEudora>



Careful Alan; I didn't write that.

That was qut at netcom.com, the latest addition to my killfile,
who replied to my private email on Cypherpunks, and, rather oddly,
called me a Mormon.

Message in question appended.

-j

>> REAL crypto-anarchists,
>
>  Like the folks who brought us Tiannemen Square?
>
>> of course, want the
>> destruction of copyrights, trademarks, and
>> other weapons of capitali$m, and will
>
>
>
>
>
>> Kill your Television
>
>   Threw mine out in 1987. There's more people who don't have indoor
>bathrooms, than don't have a TV. (source: 1990 Bureau of the Census). I'm
>in a pretty elite group.


------------------

Return-Path: <qut>
Received: (from qut at localhost) by netcom13.netcom.com (8.6.13/Netcom)
        id AAA24004; Sat, 8 Jun 1996 00:30:50 -0700
From: qut (Be Good)
Message-Id: <199606080730.AAA24004 at netcom13.netcom.com>
Subject: Re: Thank you for the Archives 100 messages
To: foodie at netcom.com
Date: Sat, 8 Jun 1996 00:30:50 -0700 (PDT)
Cc: cypherpunks at toad.com
Reply-To: foodie at netcom.com
In-Reply-To: <31B91EA0.16F at netcom.com> from "Jamie Lawrence" at Jun 7, 96
10:33:09 pm
X-Mailer: ELM [version 2.4 PL23]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Length: 1582

> qut4.qut at netcom.com wrote:
> >
> > Apologies, but rich has deleted me from
> > his mailboxes, and for a few days now,
>
> As I have, too, now.
>
> > somebody has placed a global cancel bot on
> > me.  I'm gonna have plenty of fun figuring
> > this out.  Kwow any good sniffers?
>
> I'm glad! If my processor/filtering software doesn't
> have to deal with your garbage, that's more time I have
> to spend with folks who have something to say.

The only thing your type of "cypherpunk" has
to say, is blather about liability, copyrights,
and other capitali$t bs.

REAL crypto-anarchists, of course, want the
destruction of copyrights, trademarks, and
other weapons of capitali$m, and will
implement crypto-anonymonity to proceed
forthwith.

> No, I don't know of any better "sniffers" (I assume you
> mean, "software that can detect a cancelbot"), as such
> software is impossible to detect. Of course, unless Rich
> (or whomever cares so much about a moron) has either root
> on toad.com, or at least as many resources as the NSA, he
> can't cancel your mail to Cypherpunks (or anywhere else).

I was talking about netnews, mormon.

> > I agree the list should be public usenet:
> > A mail gate-way to a usenet group that
> > ALSO permits unmoderated posts.  This
> > would be a nice way to combine a strict
> > moderated mail-list, with a standard
> > netnews group.
>
> Er, what?
>
> That paragraph makes absolutely no sense whatsoever.

There's already hundreds of groups like
that, stupid.  It will be implemented,
whether you like it or not.


--

Kill Your Television



--
The signal is the noise.
____________________________________________________________________
Jamie Lawrence   mailto:jal at cyborganic.net  mailto:foodie at netcom.com







From jf_avon at citenet.net  Sun Jun  9 00:35:27 1996
From: jf_avon at citenet.net (Jean-Francois Avon)
Date: Sun, 9 Jun 1996 15:35:27 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <9606090406.AA19866@cti02.citenet.net>


On  8 Jun 96 at 12:40, jim bell wrote:

> JFA wrote:
> >I did something I always bitch at when done by others: looking at a
> >situation outside of it's appropriate and complete context.  
> 
> As you can see, this is one of the big difficulties that people can
> have understanding AP:  Since it changes just about everything about
> how a society works, you can't analyze it "easily" using your
> built-up knowledge of societies.

Actually, it makes one realize that society and the "collective" is 
nothing, that the basic building block is the individual.  If you 
analyse the motivation of the individual, AP is not difficult to 
understand.

> As I've said so many times before, AP is like a political Rorschach
> test:  Your reaction to it is strongly related to your political
> philosophy.  That's part of the magic.

Please stay out of magic.  The actual politician are enough into it.


JFA
 DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal
 JFA Technologies, R&D consultants: physicists, technologists and engineers.

 PGP keys at: http://w3.citenet.net/users/jf_avon
 ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 
 





From roy at sendai.scytale.com  Sun Jun  9 00:54:26 1996
From: roy at sendai.scytale.com (Roy M. Silvernail)
Date: Sun, 9 Jun 1996 15:54:26 +0800
Subject: [NOISE] Re: RFD: Time to kick some anti-scientologist ass?
In-Reply-To: <XBq8oD69w165w@bwalk.dm.com>
Message-ID: <960608.225259.7F4.rnr.w165w@sendai.scytale.com>


-----BEGIN PGP SIGNED MESSAGE-----

In list.cypherpunks, dlv at bwalk.dm.com writes:

> Or the anti-scientologists haven't caused most of the problems cypherpunks
> remailers face through posting CO$ copyrighted material through them?

> (Note: I'm not a Co$ affiliate and have exactly as much disdain for it as
> for any other cult.)

Am I the only one whose ironometer just pegged?
- -- 
           Roy M. Silvernail     [ ]      roy at scytale.com
PGP Public Key fingerprint =  31 86 EC B9 DB 76 A7 54  13 0B 6A 6B CC 09 18 B6
                Key available from pubkey at scytale.com

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbpK3xvikii9febJAQGAgAP+PSHGQarfMIeZiwXZrlsSoaY3rduI2gFe
HIH2ml2gLUlAUwEXd/Jd4uxIBqeCXJOdcjgA8zz0B5ddCpGshhrD3/XIzIWIteOz
2NdyK6dIZx64wo7gYGOzTDFhx8i2GXn3nhaxyMwEHpOqZ+Uk3wflmKWbCq5cJivx
H2B1gSMQlpo=
=pzuj
-----END PGP SIGNATURE-----






From anonymous-remailer at shell.portal.com  Sun Jun  9 01:31:17 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sun, 9 Jun 1996 16:31:17 +0800
Subject: Clam Wars
Message-ID: <199606090513.WAA08328@jobe.shell.portal.com>


 > 2. The anti-scientologists have caused many cypherpunks
 > anonymous remailers to shut down via their egotistical
 > misuse of them, viz. criminally posting copyrighted Co$
 > writings to Usenet. They did it knowing that the Co$ is
 > likely to harrass the remailer operators, causing them to
 > shut down and depriving everyone of their services.

This scenario is beginning to sound suspiciously similar each time
it happens:  an anonymous individual or individuals utilize a
remailer in a way that's deemed abusive, certain individuals
complain loudly, and the remailer (or mail2news gateway) either
shuts down or blocks the affected newsgroup.  Thus far I've seen it
happen with the alt.religion.scientology, alt.smokers, and
alt.syntax.tactical newsgroups.

This is setting a bad precedent.  It sends the message that you
merely have to fabricate a little "abuse" through one or more
remailers to get what you want -- the elimination of your opponents'
platform to dissent without fear of retribution.  Whether the abuse
in any of the aforementioned instances was actually fabricated or
not is immaterial.  If it wasn't, it very could have been, with
identical results in either case.  The problem being, with an
anonymous attack through a remailer and/or mail2news gateway, how do
you identify the intended victim?  Was it the NG or the
remailer/gateway itself?

The first two NGs have one striking similarity:  both involve a
product or service where those who stand to profit from it have
recently been plagued with "whistle blowers" and "defectors" from
among their ranks -- the CO$ and the tobacco industry.  In both
cases, those who've come forward and divulged secrets have reported
harassment.

I'm at a loss to understand the blocking of the third NG,
alt.syntax.tactical, however, unless the intent was strictly
punitive.  I can't imagine anyone from a.s.t. coming forward to
complain about "abuse"!  That would be like complaining about foul
language on alt.blasphemy.  <g>






From jamesd at echeque.com  Sun Jun  9 01:50:25 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Sun, 9 Jun 1996 16:50:25 +0800
Subject: Anonymous stock trades.
Message-ID: <199606090521.WAA14979@dns2.noc.best.net>


At 02:25 AM 6/8/96 +0200, Asgaard wrote:
> Who is going to assure that someone has an ownership stake in the
> Humpback Whales? The World Government?

Brand them and herd them like open range cattle:  The west did not
need a government to do that, though they did need to hang a few
folk who favored a different method of open ranging.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From tcmay at got.net  Sun Jun  9 02:07:54 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 9 Jun 1996 17:07:54 +0800
Subject: US: Domestic Encryption Protected by US Constitution?
Message-ID: <addfac9c060210043f32@[205.199.118.202]>


At 3:26 AM 6/9/96, C Matthew Curtin wrote:

>Given that the US State Department classifies strong crypto as
>munitions, is it possible that any laws passed outlawing the use of
>strong crypto among US citizens could be declared unconsitutional, in
>violation of the second amendment?
>
>Are there any legal precedents that apply here? Is the question purely
>academic (i.e., no such laws exist, no such bills are in the works, or
>none have been tried)? Does anyone know of any laws on the books that
>might be relevant to my question?


I recall that this general issue was discussed several times on the
"Cyberia-l" mailing list, a list consisting mostly of law professors,
lawyers, law students, and a bunch of Cypherpunks. (I left that list
several months back.)

Some points:

1. There are currently no laws restricting crypto use in the U.S., save for
some special circumstances (e.g., sending code over the ham radio band).
There being no laws, no courts have been asked to rule on such laws.

(I don't mean to sound confusing and circular here. The point is that the
boundaries of a law get shaped when the law is tested. Inasmuch as there
have been no laws about domestic use of crypto, we have little guidance as
to how the courts will frame arguments should such a law ever be passed.)

2. Most advocates for a continued right to use strong crypto have used the
First Amendment centrally. That is, "encrypted speech is still speech." Any
demand that speech conform to government standards would run into the basic
point that Congress is not to make such laws.

I believe this approach is the strongest one. Even if there are some limits
on speech (a la the infamous "falsely shouting 'Fire!' in a crowded
theater" example), this sort of limit does not limit the _form_ of speech.

(Quibblers may point out other such limits, even some on _form_. For
example, speech at 95 dB is OK, but "speech" at a jet-engine level of 135
dB is not. I won't get into such quibbles here.)

Casting a pro-crypto argument in terms of the Second Amendment ("encrypted
speech is a weapon") opens the door to all kinds of potential arguments for
restricting access to crypto. Think of all the various limits on firearms
ownership and use: certain calibers and types are restricted, the shapes of
firearms are controlled, special taxes are often required, waiting periods
for purchase, no ownership by convicted felons, no possession on or near
schoolgrounds, bullet types are controlled, limits on magazine capacity, no
possession of biological weapons, etc. etc. etc.

I don't think we want crypto controlled by the Bureau of Alcohol, Tobacco,
and Firearms, do we?

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From kinney at bogart.Colorado.EDU  Sun Jun  9 02:51:41 1996
From: kinney at bogart.Colorado.EDU (W. Kinney)
Date: Sun, 9 Jun 1996 17:51:41 +0800
Subject: Anonymous stock trades.
In-Reply-To: <199606090521.WAA14979@dns2.noc.best.net>
Message-ID: <199606090637.AAA01593@bogart.Colorado.EDU>



Normally I wouldn't comment, but:


James A. Donald writes:

> At 02:25 AM 6/8/96 +0200, Asgaard wrote:
> > Who is going to assure that someone has an ownership stake in the
> > Humpback Whales? The World Government?
> 
> Brand them and herd them like open range cattle.

Branding whales?

Um, what? 


                                -- Will


(Maybe digitally signing whales might be more appropriate for this forum...)







From richieb at teleport.com  Sun Jun  9 03:07:11 1996
From: richieb at teleport.com (Rich Burroughs)
Date: Sun, 9 Jun 1996 18:07:11 +0800
Subject: [NOISE] Re: RFD: Time to kick some anti-scientologist ass?
Message-ID: <2.2.32.19960609071830.009e7374@mail.teleport.com>


-----BEGIN PGP SIGNED MESSAGE-----

At 10:52 PM 6/8/96 CST, roy at sendai.scytale.com wrote:
[snip]
>Am I the only one whose ironometer just pegged?

Actually, now that you mention it, mine is pegged.  I hadn't noticed,
because I was busy trying to recalibrate my bullshit detector which
was off the fucking dial.

LD's post is full of shit.

David Gerard, Jon Noring, and Ron Newman are not "flamers."  People
who have even lurked there for a short while should know this.  I've
seen Ron urge people towards compassionate behavior on a.r.s. more than
just about anyone on a.r.s.  It's a bit hard to be compassionate when
you're dealing with a group that uses every means at its disposal to
silence its critics.

I don't even think Nauta is on a.r.s., except for perhaps an occasional
crosspost or two.  Perhaps he lurks, but he doesn't post there to any
significant extent.

I don't know of any "Anti-Scientologists" who are forging cancels.  I
really doubt anyone would have checked with Dimitri first, though :)
JEM did issue a bunch of cancels, as have some of the ISPs whose
services have been abused.

We have been inundated with over 12,000 "vertical spam" posts since
May 19th, and it's still coming in.  Many of these posts are
repetitions of the same materials, and must be well over the BI by
now.

"Anti-Scientologists" have discussed various technological methods of
dealing with the spam (cross-posted to news.admin.net-abuse), but no
plan has been seized upon due to lack of consensus.

I've written an article in the latest issue of my zine about the spam,
if people would like more info.  URL in my sig.


Rich



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbp6fYT0GKfZRA/9AQFGVgQAvvH4Fa8nwF6qbqHGVuKfO2uv0Ynw388Z
0QxO42wIzt9VrNckRvn+geYFRRYu9DoasGCw8imQqBN85OY3OasjpOIycyQnrjEW
C3MqyP44esuyThI6Ds30bwFYc4rP+ZWFWp1rmgv3LmYAaPdh1dAwtzPsKzy4N4NF
0pLAsusDr9k=
=PSIh
-----END PGP SIGNATURE-----
______________________________________________________________________
Rich Burroughs  richieb at teleport.com  http://www.teleport.com/~richieb
See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon
New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause





From ichudov at algebra.com  Sun Jun  9 03:23:49 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Sun, 9 Jun 1996 18:23:49 +0800
Subject: 
In-Reply-To: <k5H9oD71w165w@bwalk.dm.com>
Message-ID: <199606090728.CAA21978@manifold.algebra.com>


Dr.Dimitri Vulis KOTM wrote:
> ichudov at algebra.com (Igor Chudov @ home) writes:
> > Also, think about this: lots of people have someone they'd like
> > to assassinate but do not actually do it because of lack of anonymity
> > and associated hassles (like dealing with assassins non-anonymously,
> > abundance of traces, possible confession of the assassin and so on).
> > With your assassination clearinghouse these hassles go away. I think it
> > would present an excellent prospect for reducing the population.
> 
> Igor, have you ever read novels about British life in 18th century?
> (I'm using this as an example because every good Russian reads them. :-)
> Have you noticed how exaggeratedly polite they were to each other,
> in comparison to Americans today? Do you know why?
> Because back then, every gentle person was armed and might use violence
> in sufficiently provoked.

Actually, here in Oklahoma almost everyone has a gun (not that they use
them though, but many carry). Incidentally, everyone including most down
to earth truckers is exceedingly polite. When I went to NYC first time,
I was shocked how less polite people were in comparison with Oklahomans.

Are the folks in Flushing, NY or around Avenue of the Americas allowed to
possess firearms? :)

Russians in Russia are even less polite, and guns are outlawed.

Maybe your hint really makes sense and after initial depopulation the
citizens will use different, more considerate, ways of dealing with each
other. Or, alternatively, maybe people will hide behind anonymity most
of the time to avoid becoming vistims of jimbell's clearinghouse.
Really, it is very hard to assasssinate username at alpha.c2.org, although
it is possible to hire nyms to write programs and pay them hard earned
digicash.

If we think about anonymous computer contractors and anonymous
employers, the interesting question is how to maintain reputations and
how to check references.

	- Igor.





From attila at primenet.com  Sun Jun  9 03:28:49 1996
From: attila at primenet.com (attila)
Date: Sun, 9 Jun 1996 18:28:49 +0800
Subject: Asendmail Status & Politikal Rant
Message-ID: <199606090736.AAA29492@primenet.com>


Addressed to: Ben Holiday <ncognito at gate.net>
              Cypherpunks <cypherpunks at toad.com>

** Reply to note from Ben Holiday <ncognito at gate.net> 05/29/96 10:30pm -0400

	as to the politiks --if we do not standup now, we will not even be able  
to speak up later.  there is no question that every means of confronting a  
totalitarian driven government apparati must be developed, and the means of  
impletation well known.

	the only safety is in numbers; and, yes, some of the "brethern" will  
fall.  anymore than the aging Chinese despots were able to contain the news of  
Tinnamin square, and I stood at the corner by the Forbidden City as it was  
starting to form, despots everywhere are faced with the same problem.  in  
China, the free speach and democracy protestors faced enormous technological  
and communication deficiencies --so far, we do not.

--
The result of today's 'government' 
  is new world disorder, unfolding at warp velocity.






From attila at primenet.com  Sun Jun  9 03:29:18 1996
From: attila at primenet.com (attila)
Date: Sun, 9 Jun 1996 18:29:18 +0800
Subject: You bet they have/are: NSA/CIA to snoop INSIDE the U.S.???
Message-ID: <199606090736.AAA29479@primenet.com>


** Reply by attila to note from Anonymous User <nobody at c2.org> 06/08/96   
	5:05pm -0700

	anyone who believes the FBI and a host of other U.S. agencies even 
    less scrupulous does not wiretap without permits, has been standing behind 
    the door. generally, it does not matter if the information learned is 
    admissable in court  --they never admit wiretapping in the first place as  
    the agency themselves, in many cases, *did*not*wiretap*  --but the agency 
    does buy info from usually unsavory "contractors" who do wiretap.

	as for the NSA/CIA spying on US citizens --they dont, they spy on 
    British citizens with facilities provided by M5 and M6.  in return, 
    British M5/6 agents spy on U.S. citizens from Langely or Gaithersberg, or 
    wherever.  The fact they just happen to share information is an 
    "accident."  

	so, why legalize it? --if it aint broke, don't fix it.

	when the great sleeping, well-fed dog awakes in slavery, they will 
    look for the "false"-prophets who have long since been purged by the 
    adversary government   --and fools like Baker-Halle will be in power 
    (temporarily).

    --- original post by anon-remailer ---

= : This is a fucking big story.
= : Allowing the CIA and NSA to snoop domestically, and using only a handful  
of
= : suspicions and anecdotes about cybernastiness and evil cryptohackers to
= : justify this major policy shift -- well, it's fucking amazing.
= : Nunn's proposal, unfortunately, was more than a "suggestion."
= 
= This is very serious. Why has there not been more discussion about 
= this on the list?
= 
= How close/far is this from becoming law?
= 
= If they are now trying to make it legal for the CIA and NSA to snoop 
= inside the US  I would guess that it's happening already. Remember
= wiretaps? Do it now and they will make it legal later.


--
The result of today's 'government' 
  is new world disorder, unfolding at warp velocity.






From blancw at accessone.com  Sun Jun  9 03:48:49 1996
From: blancw at accessone.com (blanc)
Date: Sun, 9 Jun 1996 18:48:49 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
Message-ID: <01BB559F.9D9D18A0@blancw.accessone.com>


From: 	hallam at Etna.ai.mit.edu

	How to save the whales is a logical outcome of Friedman's thesis that markets 
are everything. It is unfortunately very common for great men to get megalomania and 
believe they have the solution to the worlds problems in one theory.

	The flaw in Perry's "stakeholder" theory is the same one in many academic 
theories. It assumes that most people are smart enough to realise their true interests. 
It assumes that people take a longer term look than they do. 
................................................................................................


A point about the free market:

Those "great men" who advocate it realize that one theory may not solve the world's problems, that individuals themselves can come up with the answers to their own problems.

Instead of other people's theories and solutions being imposed upon them, individuals 
are seen as capable of interacting with each other and making decisions and trades in the market of choices made available through commercial enterprise, thus involving themselves in the discovery, pursuit, and satisfaction of their true interests.

It doesn't assume that because people's judgements can be flawed and that they can make mistakes, that therefore others (governments & other authoritative types) have the right to step in and determine for them how their dreams should be realized.  

     ..
Blanc





From llurch at networking.stanford.edu  Sun Jun  9 03:49:21 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sun, 9 Jun 1996 18:49:21 +0800
Subject: Thank you for the Archives 100 messages
In-Reply-To: <199606071402.HAA10943@netcom4.netcom.com>
Message-ID: <Pine.GUL.3.93.960609005510.6682B-100000@Networking.Stanford.EDU>


On Fri, 7 Jun 1996, Skippy <qut at netcom.com> shared with the group:

> Apologies, but rich has deleted me from
> his mailboxes, and for a few days now,

This isn't true. I don't believe in killfiles. Being on my twit list simply
means that you're entitled to a brief acknowledgement of every message you
send me. Skippy was added after he sent me the 3MB results from the
rec.music.white-power vote as a rather limp mailbombing attempt (free clue:
it takes a lot more than that to make a dent in our bandwidth or disk
space); see http://www.stanford.edu/~llurch/potw2/rec.music.white-powder for
that email. 

> somebody has placed a global cancel bot on
> me.  I'm gonna have plenty of fun figuring
> this out.  Kwow any good sniffers?

The one that used to be running on darth.stanford.edu was pretty good. 
Since February 22nd, I've working on the assumption that everything I do
unencrypted is public. I would revoke my PGP key, but I never used it much
for receiving mail anyway, and I'm not sure that it was found. 

> I agree the list should be public usenet:
> A mail gate-way to a usenet group that
> ALSO permits unmoderated posts.  This
> would be a nice way to combine a strict
> moderated mail-list, with a standard 
> netnews group.

Gee, what a great idea! Why hasn't anyone thought of that? hks.net, for
example. Unfortunately, there are too many copyright terrorists here.
There's a tradeoff between freedom and visibility. As astute readers are
aware, hks.net had to take down the archives after WSJ made a threat that
was a little too credible.

-rich






From llurch at networking.stanford.edu  Sun Jun  9 03:49:29 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sun, 9 Jun 1996 18:49:29 +0800
Subject: NOISE: "Fascism is corporatism"
In-Reply-To: <199606081932.MAA03833@dns2.noc.best.net>
Message-ID: <Pine.GUL.3.93.960608223458.6149D-100000@Networking.Stanford.EDU>


On Sat, 8 Jun 1996 jamesd at echeque.com wrote:

> At 07:09 PM 6/7/96 -0700, Rich Graves wrote:
> > you forget that I'm a
> > Certified Political Scientist. 
> > [...]
> > Once they got in power, then they started developing an economic ideology.
> 
> Untrue:
> 
> Fascism is of course a reasonably complete, coherent, and 
> philosophically consistent logical system, almost as coherent as 
> marxism, and far more logical than Mill's utilitarianism.  It was 
> published and thoroughly debated well before they pursued or took power.

Besides being unture, this is rather skew to the discussion of whether
fascism = corporatism = Clinton. Whether it is possible to construct a
coherent ideology is rarely relevant to historical processes; was Castro's
Moncada attack motivated by Marxist ideology, for example? But anyway...

> Rich Graves's lie is a lie I frequently hear from those who well 
> know the truth, 

I know you & Tim aren't impressed by Webster's, which Tim claimed as an
authority without bothering to check whether it agreed with him at all (it
doesn't; in fact, it directly contradicts him), but how about The
Encyclopedia Brittanica on "The Philosophical Bases of Fascism":

 In its beginnings fascism was not a doctrine and had no clearly elaborated
 program. It was a technique for gaining and retaining power by violence, 
 and with astonishing flexibility it subordinated all questions of program
 to this one aim. From the beginning it was dominated by a definite
 attitude of mind that exalted the fighting spirit, military discipline,
 ruthlessness, and action and rejected all ethical motives as weakening the
 resoluteness of will. 

It pleases me greatly that you do not presume to call me a fool.

I've cited Machiavelli, the historical progression of risorgimento, and Paul
Morrison, "The poetics of fascism :  Ezra Pound, T.S. Eliot, Paul de Man," 
ISBN 0-19-508085-8. All you're doing is blathering on with some
anti-intellectual lumpenlibertarian claptrap that tries to smear anything
you disagree with as tantamount to fascism. You do libertarianism, with
whose precepts I wholeheartedly agree, a serious disservice. Go back to
Bastiat and leave history alone.

The Encyclopedia Brittanica says of Mussolini:

 He read widely and voraciously, if not deeply, plunging into the
 philosophers and theorists Immanuel Kant and Benedict de Spinoza, Peter
 Kropotkin and Friedrich Nietzsche, G.W.F. Hegel, Karl Kautsky, and Georges
 Sorel, picking out what appealed to him and discarding the rest, forming no
 coherent political philosophy of his own yet impressing his companions as a
 potential revolutionary of uncommon personality and striking presence. 

For a more nuanced view, try A. James Gregor's "Young Mussolini and the
Intellectual Origins of Fascism," ISBN 0-520-03799-5. I could mail you
photocopies of the relevant sections if you like. 

> Many of my readers will think I am excessively harsh, calling Rich
> Graves a liar rather than a fool, but I hear the above story 
> (that fascism is not a coherent ideology or philosophy) primarily from
> those whose interests this story serves, and if they genuinely 
> thought this story was true, they would not know that it is in their
> interests to push it.

[Boggle]

Huh? In English, please.

[much more content-free blather deleted]

Anyway, I never suggested that there was no such thing as fascist
philosophy; just that fascism was not rooted in a well-developed ECONOMIC
ideology, and that Tim's definition of corporatism is incorrect both in the
abstract and in the cases of Italian fascism and Nazism.

> Not only do such concepts as feminist science, phallocentric science, 
> etc, strongly resemble such concepts as aryan science, jewish science, 
> etc, but they are justified using the same arguments from the same 
> philosophers.  Indeed Heidegger was not only a philosopher of fascism, 
> but he personally participated in Hitler's terror, terrorizing his academic
> colleagues, and Paul De Man of Yale University worked directly for the 
> Nazis as a propagandist in occupied Belgium.

How did we get from economics to philosophy?

Here James demonstrates his absolute mastery of the subject.

Heidegger only really supported Nazism from 1933-34; in the 40's and
thereafter, he referred to Nazism as a disease. He is remembered as an
existentialist, not a Nazi, though he did join the party when he became the
rector of Freiburg. I don't believe that either Hitler or Goebbels were
familiar with Heidegger's philosophical work.

The fact that Paul de Man, in his early years in Nazi-occupied Belgium,
wrote antisemitic propaganda for a number of local collaborationist journals
was not discovered until four years after his death (by Ortwin de Graef). 
The statement "Paul de Man of Yale University worked directly for the Nazis" 
is not true in the sense that most readers might think. He collaborated,
left, and started a new life. He contributed absolutely nothing to Nazi
philosophy, because he did not become a philosopher until years after the
war -- probably as a way to cope with the horrors he saw, and the shame of
his cowardly collaboration.  I don't think anyone has suggested that de Man
was a serious Nazi -- just a fucking wimp.

Where are you getting this nonsense about Heidegger and de Man? I have no
sympathy for their views, but any attempt to smear them as a bunch of Nazis
is ludicrous. Give me a reference. This is sure to be amusing.

By the way, I voted for Bush, and no matter how many times you contradict
me, I know I don't support the government's actions at Ruby Ridge. Your
foaming-mouth projections on people who disagree with you are laughable.

James, I have a lot of respect for Tim and Bruce (anyone who thought I was
calling Bruce a Nazi for holding a common libertarian fallacy must be
oxygen-deprived), but you're really losing me here.

-rich






From llurch at networking.stanford.edu  Sun Jun  9 03:57:36 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sun, 9 Jun 1996 18:57:36 +0800
Subject: [WAY, WAY NOISE] Re: Reference Correction Re: Thank you for the, Archives 100 messages
In-Reply-To: <v02140b02ade008e3f040@DialupEudora>
Message-ID: <Pine.GUL.3.93.960609011452.6149E-100000@Networking.Stanford.EDU>


On Sat, 8 Jun 1996, Jamie Lawrence wrote:

> Careful Alan; I didn't write that.
> 
> That was qut at netcom.com, the latest addition to my killfile,
> who replied to my private email on Cypherpunks, and, rather oddly,
> called me a Mormon.

For enlightenment on that point, see Skippy's message "Christ was NOT a
Mormon" in alt.zen and 35 other newsgroups, <qutDrFypn.6Io at netcom.com>,
http://ww2.altavista.digital.com/cgi-bin/news?plain at msg@33480 at rec%2emusic%2echristian

-rich






From middle-man at nym.jpunix.com  Sun Jun  9 06:39:13 1996
From: middle-man at nym.jpunix.com (Middle Man)
Date: Sun, 9 Jun 1996 21:39:13 +0800
Subject: middleman status
Message-ID: <199606091052.FAA20619@alpha.jpunix.com>


Damn!!

	A corrupted reply block! Anyway, the middleman remailer seems to
be functional again. Give it a try and see if it works for you.

	The middleman remailer will respond to both
middle-man at alpha.c2.org and middle-man at nym.jpunix.com. I will eventually
drop one of the nyms in favor of the more robust nym server. I've tested
it and it works for me. Please let me know if you have problems.

		middle-man-admin at alpha.c2.org
		middle-man-admin at nym.jpunix.com






From rah at shipwright.com  Sun Jun  9 09:38:06 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Mon, 10 Jun 1996 00:38:06 +0800
Subject: Anonymous stock trades.
In-Reply-To: <199606090521.WAA14979@dns2.noc.best.net>
Message-ID: <v03006f02ade076420e84@[199.0.65.105]>


At 1:15 AM -0400 6/9/96, jamesd at echeque.com wrote:
> At 02:25 AM 6/8/96 +0200, Asgaard wrote:
> > Who is going to assure that someone has an ownership stake in the
> > Humpback Whales? The World Government?
>
> Brand them and herd them like open range cattle:  The west did not
> need a government to do that, though they did need to hang a few
> folk who favored a different method of open ranging.

ObPrettyCrypto:

Ah. Transponders. Could blind-sign 'em. Maritime specific-identity
accounting. Trade 'em on the open market. Actual anonymous er, stock,
ownership? Whale-meat futures on the hoof, er, fin?... Woah! Idea!
Whale-watch tags? Anyone who comes within a 100-yards of them on the
surface pays a nickle? This is brilliant! What a way to make Algore and all
the treehuggers eat their own dog-food. (Ewwww! That was *really* crass,
considering what "meat and meat byproducts" used to mean...)

*That's* what all those marine biologists are doing out there in their
Zodiacs!  And *I* thought that they were doing research. Your tax dollars
at work...

;-).

All of which gives me a very Friedmanesque idea: a money-fence. With these
"charging", heh, transponders, you could tag something you want to
"protect", and charge micromoney based on your proximity-time with the
object/plant/animal. The rarer the animal is, the more you charge. New
meaning to the phrase, "you break it, you bought it." You touch it, you buy
it?

Sort of like financial defense-in-depth ala "The Mesh and the Net", or
"Diamond Age".

You could even build the transponders to "offload" micromoney to "rangers"
(their owners, of course!) whenever they passed by...

Okay, Okay. Enough already. I'll go take my Ritalin now...

Oh. And, Phill? I'm still trying to deciding whether to refute your recent
tractologicophilosphicus, but, in the meantime, how 'bout this for a terse
version:

   I think you're ugly, and your mother dresses you funny.

;-).

There. All that undergraduate philosophy (and beer!) at Missouri wasn't
wasted. See, Ma? I invect, therefore I am.

Cheers,
Bob Hettinga



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From dlv at bwalk.dm.com  Sun Jun  9 10:56:00 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Mon, 10 Jun 1996 01:56:00 +0800
Subject: [NOISE] Re: RFD: Time to kick some anti-scientologist ass?
In-Reply-To: <2.2.32.19960609071830.009e7374@mail.teleport.com>
Message-ID: <qwc0oD83w165w@bwalk.dm.com>


Rich Burroughs <richieb at teleport.com> writes:
> I don't know of any "Anti-Scientologists" who are forging cancels.

Check out the Lasarus reports on alt.religion.scientology -- 5000 lines,
6000 lines, 7000 lines...

>                                                                     I
> really doubt anyone would have checked with Dimitri first, though :)

The forged cancels started a short time after one prominent anti-scentologist
flamer e-mailed me and asked for a copy of my cancelbot. (The first time I've
seen him being quasi-polite! :-) The cancels look like they came from my 'bot,
and are directed at _anything posted by certain Co$ supporters.

I don't care about the bizarre religion views of the present or former cult
members, but forging cancels makes you as much of a slime as Co$.

I note that you chose to ignore the cypherpunks-relevant portion of my question
- that the anti-scientologists have been abusing the cypherpunks remailers.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From dlv at bwalk.dm.com  Sun Jun  9 11:15:04 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Mon, 10 Jun 1996 02:15:04 +0800
Subject: 
In-Reply-To: <199606090728.CAA21978@manifold.algebra.com>
Message-ID: <u7c0oD84w165w@bwalk.dm.com>


ichudov at algebra.com (Igor Chudov @ home) writes:
> Actually, here in Oklahoma almost everyone has a gun (not that they use
> them though, but many carry). Incidentally, everyone including most down
> to earth truckers is exceedingly polite. When I went to NYC first time,
> I was shocked how less polite people were in comparison with Oklahomans.
>
> Are the folks in Flushing, NY or around Avenue of the Americas allowed to
> possess firearms? :)

I'm not quite in Flushing, but: it's possible to keep one at home, but
a carry licence is impossible.

> Russians in Russia are even less polite, and guns are outlawed.

Russians in Russia are very polite to boys wearing leather and riding BMW's.
New Yorkers are sometimes polite to black men wearing lots of gold jewelry.
Maybe they suspect something.

> Maybe your hint really makes sense and after initial depopulation the
> citizens will use different, more considerate, ways of dealing with each
> other.

I think it would take very few 'depopulation' incidents to improve manners.
Humans, like rats, are very good at learning from others' mistakes.

>        Or, alternatively, maybe people will hide behind anonymity most
> of the time to avoid becoming vistims of jimbell's clearinghouse.
> Really, it is very hard to assasssinate username at alpha.c2.org, although
> it is possible to hire nyms to write programs and pay them hard earned
> digicash.

There are some very interesting discussions in Bruno Solnik's book I
mentioned about the worth of anonymity v. reputation in financial markets.
I wonder if it would be possible for government officials to hide behind
anonymity. Everyone will hate a certain gov't official, but no one will
know who s/he is?

> If we think about anonymous computer contractors and anonymous
> employers, the interesting question is how to maintain reputations and
> how to check references.

That's an interesting question - want to think about a protocol?

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From nobody at REPLAY.COM  Sun Jun  9 12:20:47 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 10 Jun 1996 03:20:47 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <199606091601.SAA14792@basement.replay.com>



Bryce wrote (whilst on his high horse):

> Hm.  I think the best we could hope for is along the lines of
> "The suspect subscribed to the 'Cypherpunks' discussion group on
> the Internet, but his violent views were rejected by the members
> of the group."

Not every member of this list rejects his views.  I for one do not
reject them outright, but will not defend his views publically for
fear of embarassing the corporation that I work for. I do not
reject Jim Bell's violent views for the simple reason that violence
is often required to fight violence.  In other words, the best you
can hope for is "... but his violent views were rejected by some
members of the group."

> It is important that the reporter manages to _not_ use the word
> "member" to indicate that Bell is a "member" of Cypherpunks.

He *is* a member. And why shouldn't he be?  Are you suggesting that
this group become moderated? (hiss).  The whole AP concept is very
relevent to the Cypherpunks, whether the majority like it or not.

> I think that conversing with Bell, or publically replying to him
> at all, even to insult him, makes him more of a "member" and
> makes his pet topic more a part of cypherpunks, both in appearance
> and in substance.  So don't do it.  That means you, too,
> Black Unicorn.  At _least_ you can take it to private e-mail in
> order to prevent the reporters from getting the wrong idea, and
> in order to spare the rest of us the tedium of deleting the
> messages.

No platform for lunatics???  If there is one thing that a Cypherpunk
should have learned during his time in the group, is that the answer
to hate speech (or violent speech, or whatever you wish to call it)
is more speech.

If your fear is that reporters will get hold of the wrong end of the
stick, then perhaps you are correct, but the real problem is the
*reporters*, not the attitude of the Cypherpunks.  blame them.
propose a solution. (how about abolition of all libel laws?)

> This is assuming that the statement "his violent views were
> rejected by the members of the group" is actually true!  If
> there _is_ anyone else here who shares Bell's evil enthusiasms,
> I strongly encourage you to begin a new list dedicated to that
> topic.

I disagree with the phrase "evil enthusiasms."  Bell is not an
evil man.  A little crazy perhaps, but not evil.  If you bothered
to listen to him, you would find that his aim is to create a
"better" world, where people (especially politicians) are very
much more responsible for their own actions.  He suggests that
the number of deaths due to AP will be less that the number of
deaths due to the current corrupt system.

think about it.  how many on this group would have another man
killed for his views?  For his noisy stereo?  For a competive
advantage in business?  I am confident the answer will be zero.

On the other hand, I would gladly throw in a few dollars to have
certain politicians killed.  gladly.  and I will be able to sleep
at night.  I will sleep better knowing that, although I was
partly responsible for a mans death, I will have saved countless
others (a bit like dropping an a-bomb on Japan).


Question for Jim - would you resort to AP to have Bryce popped off?
Question for Bryce - would you resort to AP to have Jim popped off?








From nobody at REPLAY.COM  Sun Jun  9 13:34:18 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 10 Jun 1996 04:34:18 +0800
Subject: Anti-Scientologists
Message-ID: <199606091713.TAA18786@basement.replay.com>



Anonymous wrote:
> 
> >1. There's a gang of flamers (David Gerard, Jon Noring, Ron Newman, Rob J.
> >Nauta, and the like) who try to stop $cientologists from discussing their
> >religion on the Usenet newsgroup alt.religion.scientology. Most of them are
> >disgruntled former cult members and/or members of other similar cults.
> 
> Untruth #1. Aside from the "religion" red herring you tossed in (it's a cult), the critics expose the lies, doubletalk and inconsistencies posted by cult apolo

Truth #1: It is a religion
Truth #2: It is no longer a cult, since the leader is dead.








From bal at martigny.ai.mit.edu  Sun Jun  9 14:25:27 1996
From: bal at martigny.ai.mit.edu (Brian A. LaMacchia)
Date: Mon, 10 Jun 1996 05:25:27 +0800
Subject: US: Domestic Encryption Protected by US Constitution?
In-Reply-To: <addfac9c060210043f32@[205.199.118.202]>
Message-ID: <199606091721.NAA00327@slip-bal.lcs.mit.edu>


   Date: Sat, 8 Jun 1996 22:36:53 -0700
   X-Sender: tcmay at mail.got.net
   Mime-Version: 1.0
   Content-Type: text/plain; charset="us-ascii"
   From: tcmay at got.net (Timothy C. May)
   Sender: owner-cypherpunks at toad.com
   Precedence: bulk

   At 3:26 AM 6/9/96, C Matthew Curtin wrote:

   >Given that the US State Department classifies strong crypto as
   >munitions, is it possible that any laws passed outlawing the use of
   >strong crypto among US citizens could be declared unconsitutional, in
   >violation of the second amendment?
   >
   >Are there any legal precedents that apply here? Is the question purely
   >academic (i.e., no such laws exist, no such bills are in the works, or
   >none have been tried)? Does anyone know of any laws on the books that
   >might be relevant to my question?

   [...]

   2. Most advocates for a continued right to use strong crypto have used the
   First Amendment centrally. That is, "encrypted speech is still speech." Any
   demand that speech conform to government standards would run into the basic
   point that Congress is not to make such laws.

   I believe this approach is the strongest one. Even if there are some limits
   on speech (a la the infamous "falsely shouting 'Fire!' in a crowded
   theater" example), this sort of limit does not limit the _form_ of speech.

   (Quibblers may point out other such limits, even some on _form_. For
   example, speech at 95 dB is OK, but "speech" at a jet-engine level of 135
   dB is not. I won't get into such quibbles here.)

IANACLP (Const. Law Prof.), but there is a fundamental difference in
First Amendment analysis between content-related restrictions and "time,
place and manner"-related restrictions.  Laws that prevent me from
shouting over a bullhorn at 3am are an example of the latter; they
operate in a manner neutral to the content of the speech and such
regulations are not subject to as strict scrutiny as content-related
restrictions (such as obscenity laws).  

The distinction between content and time/place/manner restrictions is
important.  Whether domestic use of cryptography may be regulated by the
Government may very well turn on whether the Court decides that the
encrypted version of my protected speech is itself protected content or
just a manner of expressing the underlying unencrypted content.  [For
example, Judge Patel recently found that source code was speech for
First Amendment purposes in Bernstein v. US Dept. of State, which
allowed Bernstein's constitutional challenge to the ITAR to proceed.]

A moot court panel on the constitutionality of possible domestic
cryptography restrictions was one of the headline events at CFP '96.  I
would strongly encourage those interested to check out:

	http://swissnet.ai.mit.edu/~switz/cfp96/plenary-court.html

which has pointers to all the background briefs and analysis as well as
RealAudio recordings of the oral argument held at CFP.

					--bal





From jimbell at pacifier.com  Sun Jun  9 14:41:40 1996
From: jimbell at pacifier.com (jim bell)
Date: Mon, 10 Jun 1996 05:41:40 +0800
Subject: [Off-Topic]  "Curfews"
Message-ID: <199606091739.KAA04024@mail.pacifier.com>


At 12:03 AM 6/9/96 +0000, Jean-Francois Avon wrote:
>On  8 Jun 96 at 12:40, jim bell wrote:

>> As you can see, this is one of the big difficulties that people can
>> have understanding AP:  Since it changes just about everything about
>> how a society works, you can't analyze it "easily" using your
>> built-up knowledge of societies.
>
>Actually, it makes one realize that society and the "collective" is 
>nothing, that the basic building block is the individual.  If you 
>analyse the motivation of the individual, AP is not difficult to 
>understand.

It is, however, hard to separate out all the familiar assumptions we make 
about the world based on the current way of doing things.


>
>> As I've said so many times before, AP is like a political Rorschach
>> test:  Your reaction to it is strongly related to your political
>> philosophy.  That's part of the magic.
>
>Please stay out of magic.  The actual politician are enough into it.

Well, I was speaking hyperbolically.  (hyperbole.)


Jim Bell
jimbell at pacifier.com





From jimbell at pacifier.com  Sun Jun  9 14:51:09 1996
From: jimbell at pacifier.com (jim bell)
Date: Mon, 10 Jun 1996 05:51:09 +0800
Subject: Minority vs. majority
Message-ID: <199606091739.KAA04029@mail.pacifier.com>


At 10:40 PM 6/8/96 EDT, Dr.Dimitri Vulis KOTM wrote:
>ichudov at algebra.com (Igor Chudov @ home) writes:
>> You haven't seen _real_ corrupt officials. :)
>
>Jim - could corrupt gov't official hide behind anonymity too?
>E.g., a particularly obnoxious gov't regulation being issued from
>behind anon remailer?

Regulation issued?  Sure.  Regulation _enforced_?  Far more difficult!  
Maybe even impossible, when considered over the entire population.  I've 
been considering this for a long time, and I came to the conclusion that you 
really can't enforce regulations dictated by a small fraction of the 
population onto the large majority.  

Enforcing a regulation costs effort.  (money?  time? people?)  People are 
not going to put in this kind of effort unless they feel strongly about an 
issue.  It would be possible for a large majority to enforce a standard of 
behavior on a tiny minority ("rules" against theft and other common crime) 
but this will work only if the average individual is willing to donate money 
to see those general rules enforced.  Over time, few people will donate 
money to see victimless crimes (drugs, gambling, prostituion) enforced, for instance.
Jim Bell
jimbell at pacifier.com





From llurch at networking.stanford.edu  Sun Jun  9 16:39:39 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Mon, 10 Jun 1996 07:39:39 +0800
Subject: [NOISE] Re: RFD: Time to kick some anti-scientologist ass?
In-Reply-To: <qwc0oD83w165w@bwalk.dm.com>
Message-ID: <Pine.GUL.3.93.960609115703.8416A-100000@Networking.Stanford.EDU>


On Sun, 9 Jun 1996, Dr.Dimitri Vulis KOTM wrote:

> I note that you chose to ignore the cypherpunks-relevant portion of my
> question - that the anti-scientologists have been abusing the cypherpunks
> remailers. 

I have to agree with the KOTM on this one, as did many of the ars posters
(after a few days of flames subsided). IMO, with the remailer network weak,
and with the posters KNOWING that the remailers were weak (someone posted
ATTACKS ON REMAILERS IMMINENT!!! before the NOTS postings), they should have
used throwaway accounts or some other method of posting, like throwaway AOL
accounts. Fortunately, the damage was localized.

For routine criticism of the cult, absolutely yes, please use the remailers,
but for blatant "copyright terrorism," be careful. As I believe they will... 
we're really not in disagreement here. Only the kooks on either side are
trying to make this controversial. I certainly don't think anyone should
hold any sort of grudge against the arsvolk (i.e., I don't hate myself for
posting Scamizdat 11 a few times to ars and my web page, under my own name). 
I think everyone but CoS and the KOTM have learned something from this
experience, and we'll be better equipped to deal with the next challenge.

We all know we COULD stress the remailer network, probably to the breaking
point, by sending the right messages to the right people. But we don't,
because we're responsible (sorry, I don't think that's a dirty word). Use
the right tool for the job.

-rich






From ichudov at algebra.com  Sun Jun  9 16:42:16 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Mon, 10 Jun 1996 07:42:16 +0800
Subject: Anonymous computer contractors
In-Reply-To: <u7c0oD84w165w@bwalk.dm.com>
Message-ID: <199606091824.NAA01563@manifold.algebra.com>


Dr.Dimitri Vulis KOTM wrote:
[we were discussing jimbell's assassination clearinghouse - Igor]

> > Maybe your hint really makes sense and after initial depopulation the
> > citizens will use different, more considerate, ways of dealing with each
> > other.
> 
> I think it would take very few 'depopulation' incidents to improve manners.
> Humans, like rats, are very good at learning from others' mistakes.

Alright, but since quite a few people have quite a few present enemies,
the depopulation may be severe enough. The only hope is that the assassin
market will become tight.

> >        Or, alternatively, maybe people will hide behind anonymity most
> > of the time to avoid becoming vistims of jimbell's clearinghouse.
> > Really, it is very hard to assasssinate username at alpha.c2.org, although
> > it is possible to hire nyms to write programs and pay them hard earned
> > digicash.
> 
> There are some very interesting discussions in Bruno Solnik's book I
> mentioned about the worth of anonymity v. reputation in financial markets.
> I wonder if it would be possible for government officials to hide behind
> anonymity. Everyone will hate a certain gov't official, but no one will
> know who s/he is?

Sorry, how is the book called?

I think that it is entirely possible. For example, consider usenet: some
groups elect to create a "government" - that is, they elect to become
moderated newsgroups. They elect moderators. For all practical 
purposes these moderators are anonymous - after all, who knows who
hides behind an email address? This anonymity does not prevent
elections. 

Another problem, as we know very well, is that cyberspace elections are
easy to rig and it is easy to create identities that do not correspond
to real-life people.

Maybe we should return to the practices of XVII century and give
cybervotes only to those who pay cybertaxes. Of course, the weight
of the vote must be equal to the amount of cybertax.

> > If we think about anonymous computer contractors and anonymous
> > employers, the interesting question is how to maintain reputations and
> > how to check references.
> 
> That's an interesting question - want to think about a protocol?

Well, let's think. What are the requirements?

	- Igor.





From qut at netcom.com  Sun Jun  9 17:09:14 1996
From: qut at netcom.com (Be Good)
Date: Mon, 10 Jun 1996 08:09:14 +0800
Subject: Thank you for the Archives 100 messages
Message-ID: <199606091911.MAA27107@netcom22.netcom.com>


> This isn't true. I don't believe in killfiles. Being on my twit list simply
> means that you're entitled to a brief acknowledgement of every message you

How polite, like a Courtesy_Copy.    Thanks!

> send me. Skippy was added after he sent me the 3MB results from the
> rec.music.white-power vote as a rather limp mailbombing attempt (free clue:
> it takes a lot more than that to make a dent in our bandwidth or disk
> space); see http://www.stanford.edu/~llurch/potw2/rec.music.white-powder for
> that email. 

Liar.  Since they got rid of the old Bell, Stanford is as good as
Netcom in their top level functions, I retreived the above page in
a few seconds, it's the terminals and stuff which cause the problems.
You, for instance, only use Micro$oft, so you lose out on the use
of Stanford's T3's, which I use all the time whenever I'm logged in
to Netcom.  As if there's anybody stupid enough to use Micro$oft
for networking, much less Dial-ups!

> > somebody has placed a global cancel bot on

I was wrong, I was just Dicked a few forge-cancels.  He got angry
of course, when I added misc.test, which means he can't continue
to forge-cancel without quickly alerting me.

> > me.  I'm gonna have plenty of fun figuring
> > this out.  Kwow any good sniffers?
> 
> The one that used to be running on darth.stanford.edu was pretty good. 
> Since February 22nd, I've working on the assumption that everything I do
> unencrypted is public. I would revoke my PGP key, but I never used it much
> for receiving mail anyway, and I'm not sure that it was found. 

You could explain to us what you are talking about,
but that would threaten your B1!?3 status.

> > I agree the list should be public usenet:
> > A mail gate-way to a usenet group that
> > ALSO permits unmoderated posts.  This
> > would be a nice way to combine a strict
> > moderated mail-list, with a standard 
> > netnews group.

Great idea.  For stormfront.
BTW, can you forge-request another archives for me?
I saw a couple of letters before losing the rest.
I'm trying to work novell dos with linux and making
a general mess of things.  Picked up an unwrapped
copy for $40, is that a good deal?

> Gee, what a great idea! Why hasn't anyone thought of that? hks.net, for
> example. Unfortunately, there are too many copyright terrorists here.

Never noticed it.

> There's a tradeoff between freedom and visibility. As astute readers are
> aware, hks.net had to take down the archives after WSJ made a threat that
> was a little too credible.

Never noticed it.  You folks are just so damned paranoid.
The government's not out to get you, just help you.

> -rich
> 
> 


-- 

Kill Your Television






From qut at netcom.com  Sun Jun  9 18:03:52 1996
From: qut at netcom.com (Be Good)
Date: Mon, 10 Jun 1996 09:03:52 +0800
Subject: your mail
Message-ID: <199606091929.MAA29594@netcom22.netcom.com>


> On Thu, 6 Jun 1996, harman.david wrote:
> 
> > This sat's no good fo' me.
> > Is Jul 13 OK?
> 
> I've got the ResNet conference that week, and I'll probably need to recover.
> It might be fun to meet you at some Tuesday night boink. I'll buy you a
> beer.

I've got gay friends, but I don't boink them.
And, I used to be a nice guy, but I quit drugs.

BTW, what does it cost to get a dedicated T3?
Would it cost more than a vacation?

> > Again, I'm only interested in the implementation,
> > the ongoing discussion about legal liability,
> > is fairly bogus, I, Black Unicorn, and many others,
> > have already declared we would go face to face 
> > with the law.
> 
> To what was this a reference?

Crypto-Anonyminity vs. the law and Co$.

"In the national socialist paradise, there is no law"

-- 

Kill Your Television






From winn at Infowar.Com  Sun Jun  9 18:10:27 1996
From: winn at Infowar.Com (winn at Infowar.Com)
Date: Mon, 10 Jun 1996 09:10:27 +0800
Subject: No Subject
Message-ID: <199606091954.PAA25299@mailhost.IntNet.net>



Class III InfoWar              Part 2                 Report from Europe

FEEL FREE TO DISTRIBUTE WIDELY


I am ostensibly  on vacation with my wife and two children ages 11 & 5 :

Here we are in Venice, Italy  but I can't ignore what seems to be going on in 
England. American media does not appear to be  following it.  So  here 's  what 
is happening.

Headline of  June 9, 1996  Sunday  Times in London reads:

"Secret Inquiry into Cyber Terror."

This is a follow-up of last Sundays story about alleged extortion attacks 
against British financial institutions using Trojan Horses and /or HERF Guns.

According to today's article, the British government  is holding  secret 
investigations into the "attacks" for more than two years involving the Dept. of 
Trade and Industry  (DTI), government communications headquarters (GCHQ),  the 
Brits NSA, The Defence Research Agency (DRA), and the Bank of England.

On June 8, the DTI issued a public statement which included : "We are very 
interested in the allegations of extortion directed at City of London 
institutions which were brought to our attention in 1994.  We responded then by 
involving many government organizations ... so far we have not been presented 
with any hard evidence from victims.  We would urge those threatened to come 
forward."

DTI Director of Technical Affairs, David Hendon wrote a letter in May 1995 
saying they took the extortion issue "Extremely seriously."  The Times' 
reporter's say they have seen some of the evidence that was submitted to DTI and 
GCHQ which includes  a chart on 46 of the attacks. According to the article DRA 
Senior  Director,  Professor David Parks, his agency is  " especially interested 
in the "weaponry" deployed by the cyber terrorists."

The Tmes continued  : "The agency (DRA) believes high intensity radio frequency 
"HIRF" guns may have been used to black out trading positions in City finance 
houses. The weapon disables a computer by firing elctromagnetic radiation at it 
and is  a "Black Programme" at the Defence Ministry, one of the highest security 
classification levels."

In Dec. Of 1995, the DRA and Parks approached a company who specializes in 
information warfare and asked them to "arrange a demonstration of a portable 
HIRF weapon in Germany."

The article further states that details on the HIRF systems and their use in the 
City of London have been compiled by a British computer magazine and are being 
passed onto government officials.

*****

I have spoken to more than fifty media in the last week about this story: The 
comments range from "suspicious" of the British reports, "sounds psy -fi", 
"alarming", "scary" and the like.  Even though I am on vacation (Ha!)  I called 
a few of my expert friends for a sanity check and here is what we have to  say.

* The alleged software attacks mentioned in last weeks article are more likely 
the weapon than HERF/HIRF attacks that todays' article focuses  on.  
 
* "Given the kind of systems they use and their connectivity, I can figure a 
hundred ways to do what the article say" one of my experts stated.
 
* As for the HERF/HIRF  we have worked out a number of models for a number for  
the attacks scenarios mentioned, but we have a targeting problem. A free-space  
(air) based attacked would create a wide dispersion pattern and likely have 
effected other organizations  not just those specifically under attack.

* A ground plane attack might cause the alleged results but requires more 
physical access to the facility.
 
 A few thoughts of the potential motivations:  
 
* Were the alleged attacks meant as a malicious Denial of Service (DNS)  attack 
or as a profit scheme?
* Were trading volumes and the stock prices of the alleged victims effected 
during the times in question?
* Was internal profit taking an ulterior motive ?
* I have to keep in mind if we give these stories credence, that over 50% of 
computer crimes involve insiders.

According to my British friends, the Sunday Times is preparing even more on this 
story which will appear next Sunday -  when I will be in London to get it back 
to you within minutes.

So, the kids are fine.
"Thanks for asking."
My life is almost relaxed, and we are now headed into the Alps for a leisurely 8 
hr drive and will spend the night at the Jungfrau. 
"Damn, it's raining.  It will have to be beer and sauerkraut."

In the meantime, contact betty at infowar.com  at  Interpact for comments and 
interviews.

Back at your later!

Winn Schwartau




Peace
Winn

		        Winn Schwartau - Interpact, Inc.
		        Information Warfare and InfoSec
		       V: 813.393.6600 / F: 813.393.6361
			    Winn at InfoWar.Com






From richieb at teleport.com  Sun Jun  9 18:13:42 1996
From: richieb at teleport.com (Rich Burroughs)
Date: Mon, 10 Jun 1996 09:13:42 +0800
Subject: [NOISE] Re: RFD: Time to kick some anti-scientologist ass?
Message-ID: <2.2.32.19960609202516.00a042f8@mail.teleport.com>


-----BEGIN PGP SIGNED MESSAGE-----

At 09:34 AM 6/9/96 EDT, LD wrote:

>Rich Burroughs <richieb at teleport.com> writes:
>> I don't know of any "Anti-Scientologists" who are forging cancels.
>
>Check out the Lasarus reports on alt.religion.scientology -- 5000 lines,
>6000 lines, 7000 lines...

Gee, those poor CoS posters you mention must be pretty busy to generate
that many messages (which were then canceled).

Homer adjusted Lazarus, and the last I knew the reports didn't have enough
info for anyone to tell who the sender of the cancel was.  Here's an
example from back on the 5th:

- - ----------------------------------------------------------
Mon Jun  3 19:45:33 EDT 1996  Lazarus V2.3
lightlink.com/var/spool/news/control/1501139
Article: 176082
From: info at ars.com (ARS FAQ)
Date: 1 Jun 1996 17:34:29 GMT
Subject: Bryan Wilson - Diversity Among Religions: A Modern Example.
    Message-ID: <4opuv5$6s0 at mordred.cc.jyu.fi>
Control: cancel <4opuv5$6s0 at mordred.cc.jyu.fi>
- - ----------------------------------------------------------

Homer condensed them to one post, as they were just exacerbating the spam
clutter.  I wish he'd have left more info in them.

To be honest, I haven't paid that much attention to them in the last few
days, since it's impossible to tell from them who issued the cancel.

If you know who is forging cancels you might want to share with me, but I
honestly don't.  The only people I am aware of who have been canceling have
been JEM and some of the ISPs involved.  Vague accusations against
"Anti-Scientologists" don't really tell me much.

>> really doubt anyone would have checked with Dimitri first, though :)
>
>The forged cancels started a short time after one prominent anti-scentologist
>flamer e-mailed me and asked for a copy of my cancelbot. (The first time I've
>seen him being quasi-polite! :-) The cancels look like they came from my 'bot,
>and are directed at _anything posted by certain Co$ supporters.

I haven't seen any of the actual cancels, and I wouldn't know how to identify
them as being from your bot.

Those "certain Co$ supporters" are all probably one person who's telnetting
to open NNTP ports and forging thousands of messages a day.  The posts are
all obviously produced by a script (pulling info mainly from the CoS book
_What is Scientology_), and they are not anything even in the neighborhood
of an honest attempt at communication.  It's Net abuse, and I think you
must be trolling if you don't see that.

Should have known you'd go where the action is :)

>I don't care about the bizarre religion views of the present or former cult
>members, but forging cancels makes you as much of a slime as Co$.

The messages that are being canceled are forgeries.  They are a result
of an abuse of service.  That isn't at all the same as CoS canceling due
to content.  Those poor "certain Scientologists" you mentioned have produced
over 12,000 forged messages, which are actually only a small number of
articles that are being continually reposted.  Most must be way over the BI.
I'm not crying a river for them.

>I note that you chose to ignore the cypherpunks-relevant portion of my question
>- that the anti-scientologists have been abusing the cypherpunks remailers.

Wow.  Good thing that there was a relevant portion, huh.  :)  Sorry I missed
it.

I have some mixed feelings about the CoS materials that were posted through
the remailers.  I'm sorry that Hacktic was shut down, but I don't think that
was the intent of the people who posted those materials.  They were blowing
the whistle on a criminal organization.  I can't honestly say whether I think
their actions were "right" or not.  

In any case, the actions you've described were committed by a handful of people.
There are hundreds of Anti-Scientologists who post to a.r.s., and many more who
lurk.  Probably less than 5 have done wholesale posting of copyrighted
materials,
(beyond what would be considered "fair use") and most of them didn't even use
remailers.  Scamizdat being the big exception.

I'm assuming that your anti-"Anti-Scientologist" screed is just an attempt to
get people riled up.  Having fun?



Rich



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbsypoT0GKfZRA/9AQF62wP/TUdUKXwAgO7irnE08P5mSP1K+MNP0Ukb
ZqZPCKmWxrtHql/a3E7dYquQ0fp9fCe4a+d/TyvJQFAc3/LS/6/Qb6nkOB0HqSP5
+9URNIJPgBVRigxbL0m9ZJS6zzw9+ewRi6mu1wxaaHlPE/QDjZZnfKJi8bjcMUCk
Ap7kN+sw8GQ=
=jIEl
-----END PGP SIGNATURE-----
______________________________________________________________________
Rich Burroughs  richieb at teleport.com  http://www.teleport.com/~richieb
See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon
New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause






From winn at Infowar.Com  Sun Jun  9 18:19:43 1996
From: winn at Infowar.Com (winn at Infowar.Com)
Date: Mon, 10 Jun 1996 09:19:43 +0800
Subject: No Subject
Message-ID: <199606091950.PAA25078@mailhost.IntNet.net>



Class III InfoWar              Part 2                 Report from Europe

FEEL FREE TO DISTRIBUTE WIDELY


I am ostensibly  on vacation with my wife and two children ages 11 & 5 :

Here we are in Venice, Italy  but I can't ignore what seems to be going on in 
England. American media does not appear to be  following it.  So  here 's  what 
is happening.

Headline of  June 9, 1996  Sunday  Times in London reads:

"Secret Inquiry into Cyber Terror."

This is a follow-up of last Sundays story about alleged extortion attacks 
against British financial institutions using Trojan Horses and /or HERF Guns.

According to today's article, the British government  is holding  secret 
investigations into the "attacks" for more than two years involving the Dept. of 
Trade and Industry  (DTI), government communications headquarters (GCHQ),  the 
Brits NSA, The Defence Research Agency (DRA), and the Bank of England.

On June 8, the DTI issued a public statement which included : "We are very 
interested in the allegations of extortion directed at City of London 
institutions which were brought to our attention in 1994.  We responded then by 
involving many government organizations ... so far we have not been presented 
with any hard evidence from victims.  We would urge those threatened to come 
forward."

DTI Director of Technical Affairs, David Hendon wrote a letter in May 1995 
saying they took the extortion issue "Extremely seriously."  The Times' 
reporter's say they have seen some of the evidence that was submitted to DTI and 
GCHQ which includes  a chart on 46 of the attacks. According to the article DRA 
Senior  Director,  Professor David Parks, his agency is  " especially interested 
in the "weaponry" deployed by the cyber terrorists."

The Tmes continued  : "The agency (DRA) believes high intensity radio frequency 
"HIRF" guns may have been used to black out trading positions in City finance 
houses. The weapon disables a computer by firing elctromagnetic radiation at it 
and is  a "Black Programme" at the Defence Ministry, one of the highest security 
classification levels."

In Dec. Of 1995, the DRA and Parks approached a company who specializes in 
information warfare and asked them to "arrange a demonstration of a portable 
HIRF weapon in Germany."

The article further states that details on the HIRF systems and their use in the 
City of London have been compiled by a British computer magazine and are being 
passed onto government officials.

*****

I have spoken to more than fifty media in the last week about this story: The 
comments range from "suspicious" of the British reports, "sounds psy -fi", 
"alarming", "scary" and the like.  Even though I am on vacation (Ha!)  I called 
a few of my expert friends for a sanity check and here is what we have to  say.

* The alleged software attacks mentioned in last weeks article are more likely 
the weapon than HERF/HIRF attacks that todays' article focuses  on.  
 
* "Given the kind of systems they use and their connectivity, I can figure a 
hundred ways to do what the article say" one of my experts stated.
 
* As for the HERF/HIRF  we have worked out a number of models for a number for  
the attacks scenarios mentioned, but we have a targeting problem. A free-space  
(air) based attacked would create a wide dispersion pattern and likely have 
effected other organizations  not just those specifically under attack.

* A ground plane attack might cause the alleged results but requires more 
physical access to the facility.
 
 A few thoughts of the potential motivations:  
 
* Were the alleged attacks meant as a malicious Denial of Service (DNS)  attack 
or as a profit scheme?
* Were trading volumes and the stock prices of the alleged victims effected 
during the times in question?
* Was internal profit taking an ulterior motive ?
* I have to keep in mind if we give these stories credence, that over 50% of 
computer crimes involve insiders.

According to my British friends, the Sunday Times is preparing even more on this 
story which will appear next Sunday -  when I will be in London to get it back 
to you within minutes.

So, the kids are fine.
"Thanks for asking."
My life is almost relaxed, and we are now headed into the Alps for a leisurely 8 
hr drive and will spend the night at the Jungfrau. 
"Damn, it's raining.  It will have to be beer and sauerkraut."

In the meantime, contact betty at infowar.com  at  Interpact for comments and 
interviews.

Back at your later!

Winn Schwartau




Peace
Winn

		        Winn Schwartau - Interpact, Inc.
		        Information Warfare and InfoSec
		       V: 813.393.6600 / F: 813.393.6361
			    Winn at InfoWar.Com






From unicorn at schloss.li  Sun Jun  9 18:51:14 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Mon, 10 Jun 1996 09:51:14 +0800
Subject: Thank you for the Archives 100 messages
In-Reply-To: <199606091911.MAA27107@netcom22.netcom.com>
Message-ID: <Pine.SUN.3.93.960609164637.26097A-100000@polaris>


On Sun, 9 Jun 1996, Be Good wrote:
 
> > There's a tradeoff between freedom and visibility. As astute readers are
> > aware, hks.net had to take down the archives after WSJ made a threat that
> > was a little too credible.
> 
> Never noticed it.  You folks are just so damned paranoid.
> The government's not out to get you, just help you.


Bahahahah! - Ok, that's clear, now go away.
 
> -- 
> 
> Kill Your Television

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From karri19 at idt.liberty.com  Sun Jun  9 19:03:20 1996
From: karri19 at idt.liberty.com (karri19 at idt.liberty.com)
Date: Mon, 10 Jun 1996 10:03:20 +0800
Subject: 1000 Shares
Message-ID: <199606092004.NAA21765@liberty.ca.idt.net>


1000 SHARES

Warren Buffett, the worlds greatest investor said---"buy a business, not a
stock" ---and--- "is the business simple and understandable?"  Some savvy
investors have made their fortune, or at least a lot of money by buying into
a company in it's early stages of development, before the general public
discovers it!  They have found and then invested in a company they believe
in and watched it grow over time.  Did you hear about Novell stock when it
was only $2.25 a share, or Xerox at 50 cents?  How about Wal-Mart, Telefono
de Mexico or Toys r Us?  Not likely, small or micro-cap stocks are almost
totally invisible until it's much too late for the average investor.  We
would like to send you information on a micro-cap company in its early
stages of development.  Simple business --- we refurbish AT&T telecom
equipment and sell it overseas to emerging third world economies such as
Belarus, Philippines, South America and Russia.  This stock is still trading
under $1 with very strong upside potential as the company develops its
customer base in the multi-billion dollar overseas telecom business.
Contact us today to have a free corporate profile on this exciting company
faxed or e-mailed to you. Please e-mail your request to: karri19 at idt.liberty.com

This is not a solicitation to buy or sell securities, but for information
purposes only.  Investing in securities is speculative and carries a high
degree of risk.






From frissell at panix.com  Sun Jun  9 19:22:48 1996
From: frissell at panix.com (Duncan Frissell)
Date: Mon, 10 Jun 1996 10:22:48 +0800
Subject: Whalepunks, Marginpunks, Gunpunks, Clintonpunks, and Politics
Message-ID: <2.2.32.19960609213222.00b3e650@panix.com>


At 01:09 PM 6/8/96 -0700, Timothy C. May wrote:

>First, a Smith and Wesson is not what the tots should be carrying. An MP-5K
>would fit nicely in their bookpacks (especially now that all yuppie kids
>carry de rigeur designer backpacks, though mostly for designer water). More
>firepower.

>My point of view is that while schools should be free of guns, adult
>citizens should probably have access to guns. There are, sadly, nutty
>people who will use nearly any available weapon to commit mayhem and mass
>murder. Rifles, shotguns, axes, knives...

And to bring things back somewhat to cypherpunk (or at least
technopunk)issues, weapons control (like other forms of regulation) is
defeated by technology.  Last week's Economist had an article on the first
commercially available 3D "printers" or desktop fabrication stations.  A bit
hard to control weapons when one can just print off a few.  In addition
other technical advances are bound to put a host of weapons in everyone's
hands.  You can't disarm a technically advanced population.  Too many tools
can be adapted to kill.  

This being the case, you should allow your society to adapt to this reality
by getting people used to the concept of self defense, small group defense,
and behaving oneself in public.  

>Remember, "Guns don't kill people, postal workers do."

In fact, in 1995 the term to go "postal" entered the vocabulary.  As in the
sentence "LD went postal and wiped out the whole ballet class."  

Another Cypherpunks angle lies in the fact that fans of "going postal" have
also noted that 14 is a Schelling point for the number of victims of one of
these massacres.  I wonder why that is?  Magazine size?

>In general, I think Phill raises some good points about the efficiency of
>free markets. However, I doubt that Cypherpunks is the proper forum for
>debating economic theory, for various reasons. I lean strongly toward the
>free market side, inasmuch as I think most non-free market economies are
>actually just cases where the government controls the _single_ corporation
>they let run an industry, and thus one gets a worse situation that with the
>grossest excesses of capitalism.

I always ask the commies how they can guarantee that political complications
won't interfere with the perfect implementations of their no doubt superior
five year plans.  I can guarantee that the commissar's brother-in-law will
go bankrupt (if he deserves to) under capitalism.  How can they guarantee
that under socialism?

>However, the reason many of us don't jump in and write defenses of free
>markets here (and I would not have except to make my transhumanist joke--so
>sue me) is that this list is not "Libernet" nor any of the similar
>political discussion lists. 

Also it's not necessary since markets can take care of themselves these
days.  "History is on our side."  "We will bury you."  "The Multinational
unites the human race."  "Di-electrical materialism dooms both the ancien
regime and state capitalism." etc.

DCF

"A free market is what you get when people are free."






From frissell at panix.com  Sun Jun  9 19:58:23 1996
From: frissell at panix.com (Duncan Frissell)
Date: Mon, 10 Jun 1996 10:58:23 +0800
Subject: US: Domestic Encryption Protected by US Constitution?
Message-ID: <2.2.32.19960609214558.00b44844@panix.com>


At 10:36 PM 6/8/96 -0700, Timothy C. May wrote:

>I don't think we want crypto controlled by the Bureau of Alcohol, Tobacco,
>and Firearms, do we?

That'd be the BATFC.  To be called "bat fuck" in the popular press (but not
on the post-CDA Net).

DCF

"If you have a job opening in a cool climate for an experienced technical
author  with a solid understanding of cryptography, write to me."






From reagle at MIT.EDU  Sun Jun  9 22:06:20 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Mon, 10 Jun 1996 13:06:20 +0800
Subject: Gore opposes unwarranted'' Internet censorship
Message-ID: <9606100105.AA23760@rpcp.mit.edu>



        Sounds good but I had to laugh when I heard it... is he at odds with
other members of the administration, or is this rhetoric?

                              
>         CAMBRIDGE, Mass (Reuter) - Vice President Al Gore said  
>Friday society should not resort to ``unwarranted censorship'' 
>on the Internet as an overreaction to protect children from 
>objectionable material in cyperspace. 
>         In a commencement address at the Massachusetts Institute of  
>Technology, Gore said government had to assist parents in 
>protecting their children from exposure to such material. 
>         ``But let me also state my clear and unequivocal view that a  
>fear of chaos cannot justify unwarranted censorship of free 
>speech, whether that speech occurs in newspapers, on the 
>broadcast airwaves -- or over the Internet.'' 
>         ``Our best reaction to the speech we loathe is to speak out,  
>to reject, to respond, even with emotion and fervor, but to 
>censor -- no. That has not been our way for 200 years, and it 
>must not become our way now,'' he said. 
>         In February, President Clinton signed the Communications  
>Decency Act, which bans making indecent material available to 
>minors over computer networks. 
>         The American Civil Liberties Union and the American Library  
>Association have filed suit in a Philadelphia court challenging 
>the law as unconstitutional, saying it would stifle a broad 
>range of speech. 
>         In his address at the MIT, Gore stressed the gulf separating  
>society and science, a theme students had suggested in e-mail 
>messages to the vice president. He said new technologies 
>initially break down stable patterns and ``then new ones emerge 
>at a higher degree of complexity. 
>         ``Societies are vulnerable to misinterpreting the first  
>stage as a descent into chaos and then overreacting with the 
>imposition of a rigid, stagnating order,'' Gore told the 2,000 
>graduates in an outdoor ceremony. 
>                
>
>
_______________________
Regards,            Real generosity toward the future lies in giving 
                    all to the present. - Albert Camus
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From jamesd at echeque.com  Sun Jun  9 22:23:48 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Mon, 10 Jun 1996 13:23:48 +0800
Subject: Anonymous stock trades.
Message-ID: <199606100051.RAA27475@dns2.noc.best.net>


At 1:15 AM -0400 6/9/96, jamesd at echeque.com wrote:
>> Brand [the whales] and herd them like open range cattle:  The west did not
>> need a government to do that, though they did need to hang a few
>> folk who favored a different method of open ranging.

At 09:02 AM 6/9/96 -0400, Robert Hettinga wrote:
> Ah. Transponders. Could blind-sign 'em. Maritime specific-identity
> accounting. Trade 'em on the open market. Actual anonymous er, stock,
> ownership? Whale-meat futures on the hoof, er, fin?

Thanks for this clarification:  I fear my post had a lot of people thinking
of whalers sitting around a sagebrush campfire heating extremely large irons 
red hot.  Really large irons.

Really, really, really large irons.  And a really big sagebrush campfire.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From um at c2.org  Sun Jun  9 22:32:51 1996
From: um at c2.org (Ulf Moeller)
Date: Mon, 10 Jun 1996 13:32:51 +0800
Subject: Report from Germany on "backdoor" net-censorship
Message-ID: <m0uSrkU-0000AdC@ulf.mali.sub.org>


[German institutions' cancelling pornography, violence and Nazi
propaganda on Usenet will certainly have large international impact.
Thus I strongly suggest that you ask <summa at eco.de> for an official
translation.  I cannot guarantee for this rough translation to be
correct.  -- Ulf]

From:         summa at eco.de ("Harald A. Summa")

Press Release, June 5, 1996

Internet Media Counsil presents fist measurements for Voluntary
Self-Control

  [Voluntary Self-Control is the doublespeak term for censorship on
  pornography, violence, etc. It is, of course, not voluntary. um]

The leading Internet Serive Providers, on whose initiave the Internet
Medienrat, have deciced to found the Internet Content Task Force (ICTF)
for the purposes of Voluntary Self-Control. The ICTF will introduce
technical and organizational measurements to put up effective control
against contents harmful to minors and national-socialist propaganda
material. As a first step, the ICTF occupy itself with the News service,
and later with other forms of content transport in the Internet as
well.

The Internet Content Task Force will supply a news server specificially
configured for purposes of self-control at DE-CIX, the national data
exchange point of the Internet Service Providers. Proof of origin of
critical articles will be processed by the server, archived in a data
base observing privacy laws, and stored at a central facility.
Furthermore, sample news articles will be suject to detailed legal
evaluation. Should this result in suspicion or proof of transportation
of illegal contents, the ICTF can launch various steps to work against
propagation of these contents. For example, it can arrange for
blocking of complete newsgroups or retrospect "Cancel" of articles
already transmitted. ICTF can direct possible criminal investigation
with help of its data base.

Criteria for the ICTF's proceed will be developed, evaluated and
continuously updated by the Internet Medienrat. As an independant
gremium, the Internet Medienrat tries to achieve a social consensus
in the use of online media without government [sic! um] censorship.
The formation of the Internet Medienrat, which is currently preparing
its working basis, is being pushed ahead by Prof. Goetze, COE of
Springer Verlag Heidelberg, and eco Electronic Commerce Forum e.V.
It will present its members and organization to the public on
September 19, 1996.

>From govenment side, the Internet Medienrat is supported by the
Federal Ministry of Economy. Min. of Economy Rexroth: "I appreciate
the German online industry's initiative to found an Internet Media
Counsil as a gremium of Voluntary Self-Control."


Background Information on the Internet Content Task Force (ICTF)

The problem of protection of minors and of spreading
national-socialist ideas in the new media - especially on the Internet
- is currently being discussed intensively and controversially.
Meanwhile, politics and investigation authorities have begun to
proceed against the distribution of illegal contents the the Internet.
In the past weeks, the press has been reporting intensively about
investigations against large service providers.

However, the current legal situation gives few starting points for
coordinated proceeding. Lawyers cannot even agree on who can and
should be punished for distributing contents relevant to criminal
law on the Internet. Depending on standpoint and interests, even
noted criminal lawyers hold different views. Some do not consider
distribution of pornography and national-socialist writings in
electronic form punishable at all, others even want to hold service
providers responsible for mere transportation of data. Mediating
opionions imply that only the author of the message be punishable.
The only strong fact in the complete discussion is that the matter
-- as always in difficult dogmatic questions in penal law -- will
finally be decided by courts. It is also a fact that the true
authors of illegal messages -- especially those with an especially
high criminal energy -- can be determined only with great difficulty,
so that the threat of punishment insofar is void.

The solution to this problem is being complicated by the continuing
political discussion and superposed by other question complexes.
For example, the states regard new media as an extension of their
traditional radio regulation competence. They are trying to ensure
future influence by an extensive interpretation of the constitutional
regulation of competences and the laws and state treaties based on it.
The draft State Treaty on Media Services that applies to the whole
field of Internet and online services is one result of these
reasonings. To create facts in this field, the state treaty shall
be passed soon.

Lead by the "Future" Ministry, the federation is also working on
legal framework for new information and communication services to
comprehensively cover the subject. The Ministry of Interior on its
side is concerned with restricting Freedom of Communication with
priority. This activity has already resulted in the novel Wiretap
Law and the Telecommunication Surveillance Decree. Further laws,
especially a ban on crytography, are planned. On the European level,
a working group initiated on the last G7 conference, is trying to
achive international consesus.

Legal clarification, which is strictly needed but with still open
result, is faced by fear of censorship and too wide-reaching
government interference.

Since a long time, the leading German Internet Service Providers have
been trying to solve the now openly visible conflict betreen the
"Information Police State" and the "Anarchy in the Net" as feared by
politics. Thus they have propagated founding a Voluntary Self-Control
and initiated the formation of an Internet Medienrat. As a further
buiding stone, the Internet Content Task Force (ICTF) is now being
put to existence.

This shall also work against the impression that the main purpose of
the Internet were distributiong extremist and pornographic contents.
At least this was the result of numerous -- often badly researched --
reports in the recent weeks. They did neither differenciate between
the Internet services (Mail, News, WWW, Chat and others), nor present
the relation of doubtlessly useful and the less desired contents.
ICTF now turns towards the problem in a much more refined way. There,
it first will occupy itself with the currently probably most critcal
part of the Internet, the so-called News service.

The special problem of the News service is that information can be
distributed world-wide, yet anonymously. This is different of at least
fundamentally more difficult in other parts of the Internet, so that
the volume of critical content in the News is comparably high. The
ICTF will register the information availible on the origin of news
and store them in a data base as to make it possible to determine
who has sent an article or disguised the real author's identity, in
retrospect. The data base will be kept observing privavy laws and
third parties' protection-deserving interests [the Privacy Law puts
limits on databases with "protection-deserving" personal
information, um]. To avoid abuse, the data will regularly be exported
to hard storage and deposited with an attorney.

Furthermore, the existing or newly created newsgroups will be
classified, so that groups serving to distribute exclusively or
predominantly illegal contents can be excluded from further
distribution. Sample investigation of articles and analysis of
articles as necessary will also make it possible to limit the
transportation of individual articles.

Founding the ICTF, the Internet Service Providers accept part of the
responsibility in forming a modern information society. It is clear
that preventive action on a national level cannot stop illegal action
on a global level. Thus, the ICTF is a model for similar initiatives
in other countries, and is to be seen as an appeal to politics to
make their contribution to solving the problem. Currently, the ICTF
is the only perceptible approach to respect the need for "Law and
Order" and yet leaves the new medium Internet with the freedom needed
for futher prosperation.

On the other hand, national legislator's attempts to solve the problem
on its own will hardly solve the problem, but put severe damage to
the economic site Germany. For one thing is clear in the virtual
worlds of communication networks: Borders lose their importance, and
location is no longer an issue. There is nothing to prevent an
enterprise from moving its online activities to a country with less
bureaucrary and legal restrictions. First tendencies for migration
are already percepted.

The Internet Content Task Force is supported be the following Internet
Service Providers:

CERFnet GmbH, Heidenrod
ECRC GmbH, Muenchen,
EUnet Deutschland GmbH, 
GTN GmbH, Krefeld,
ipf.net GmbH, Frankfurt,
IS/Thyssen  Internet Service GmbH,  Hamburg,
Point of Presence, Hamburg, 
nacamar GmbH, Dreieich,
NTG-X/link GmbH, Karlsruhe,
roka GmbH, Duisburg,
seicom GmbH, Pfullingen,
spacenet GmbH, Muenchen.

Further information can be obtained from:

eco Electronic Commerce Forum e. V.
c/o Harald A. Summa
Schaeferkampstr. 19

44287 Dortmund
Tel:	+49 (0) 231 44 79 49
Fax:	+49 (0) 231 44 81 35
E-Mail: summa at eco.de
http://www.eco.de/

or

attorney at law
RA Michael Schneider
Dickstr. 35
53773 Hennef / Sieg, 
Tel:	+49 (0) 2242 9270-0 
Fax: 	+49 (0) 2242 9270-99                     
E-Mail: Michael.Schneider at Anwalt.DE
http://www.anwalt.de/


+++
eco - Electronic Commerce Forum e. V.

c/o Harald A. Summa
Sch�ferkampstr. 19
44287 Dortmund

Tel 0231 / 44 79 49
Fax 0231 / 44 81 35
Email info at eco.de
+++





From jamesd at echeque.com  Sun Jun  9 22:43:56 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Mon, 10 Jun 1996 13:43:56 +0800
Subject: [NOISE] "Fascism is corporatism"
Message-ID: <199606100023.RAA25303@dns2.noc.best.net>


At 12:44 AM 6/9/96 -0700, Rich Graves wrote:
[A whole bunch of totally irrelevant boring distractions, amongst them]:
> The Encyclopedia Brittanica says of Mussolini:
>
>  He read widely and voraciously, if not deeply, plunging into the
>  philosophers and theorists Immanuel Kant and Benedict de Spinoza, Peter
>  Kropotkin and Friedrich Nietzsche, G.W.F. Hegel, Karl Kautsky, and Georges
>  Sorel, picking out what appealed to him and discarding the rest, forming no
>  coherent political philosophy of his own

To argue that fascism has no philosophy without mentioning Maurice Barres is
nearly as silly as arguing that communism has no philosophy without mentioning
Marx.  If you delete all reference to Fascist philosophers, you will of course
come to the conclusion that fascism has no coherent philosophy.

Fascism got its epistemology from Barres, and its economic theory from Sorel.

Your argument is analogous to someone who argues that communism had no coherent 
philosophy by talking about Mao as if he had popped out of nowhere, and failing 
to mention Marx and Lenin.

In my opinion the most coherent fascist 
philosopher that preceded the fascist rise to power was Maurice Barres. 
(Of course once fascism was on the rise, you got a bunch more fascist 
philosophers, most of them way to the left of Barres.) This thread in 
philosophy has continued to the present day, though it was abruptly 
renamed after the defeat of Hitler.  Barres's arguments are logically 
and philosophically coherent, and are clearly and unambiguously 
recognizable as the epistemology, and much of the claptrap and rhetoric 
of fascism, and as the epistemology, and much of the claptrap and rhetoric 
of modern PC, and we can trace the philosophical thread connecting modern 
PC to Barres through known Nazi philosophers who not merely philosophized, 
but also participated actively in Hitler's regime, and to direct and 
immediate disciples of those philosophers, such as Derrida.

> > Many of my readers will think I am excessively harsh, calling Rich
> > Graves a liar rather than a fool, but I hear the above story 
> > (that fascism is not a coherent ideology or philosophy) primarily from
> > those whose interests this story serves, and if they genuinely 
> > thought this story was true, they would not know that it is in their
> > interests to push it.

> Huh? In English, please.

Perhaps I was elliptical in the above.  I will restate:

The claim that fascism lacks an economic program and/or a philosophy comes 
primarily from those whose economic program and/or philosophy bears a
marked resemblance to fascism.   If they were not aware of this resemblance
they would not so vigorously seek to redefine fascism as military dictatorship, 
racism, etc.

This leads me to doubt the basic human honesty of those who push this line,
and their concern for human lives.

> Anyway, I never suggested that there was no such thing as fascist
> philosophy; just that fascism was not rooted in a well-developed ECONOMIC
> ideology, 

Revisionism alert:  

I just deleted vast chunks of text from your message above 
where you presented negative evidence that fascism had no 
philosophy, and I was just thinking that maybe I had overdone it 
and would get flamed for deleting arguments rather than answering them.

> and that Tim's definition of corporatism is incorrect both in the
> abstract and in the cases of Italian fascism and Nazism.

Revisionism alert:

Tim gave a perfectly correct definition of corporatism, and you then
proceeded to give a very similar definition, and you then proceeded 
to smear Tim by falsely implying that he gave a silly ignorant 
definition, radically different to the one he did in fact give.

You also have carefully avoided mentioning Sorel, who of course advocated 
roughly the economic problem that Mussolini attempted to implement, that
Hitler did implement, and that Timothy May condemned, long before Mussolini
got of the ground.  Sure sounds like an economic ideology to me.

> > Not only do such concepts as feminist science, phallocentric science, 
> > etc, strongly resemble such concepts as aryan science, jewish science, 
> > etc, but they are justified using the same arguments from the same 
> > philosophers.  Indeed Heidegger was not only a philosopher of fascism, 
> > but he personally participated in Hitler's terror, terrorizing his academic
> > colleagues, and Paul De Man of Yale University worked directly for the 
> > Nazis as a propagandist in occupied Belgium.

> Here James demonstrates his absolute mastery of the subject.
>
> Heidegger only really supported Nazism from 1933-34; in the 40's and
> thereafter, he referred to Nazism as a disease. 

Yeah, right, And the only fifty thousand jews were murdered.  :-)

Historical Revisionism alert:  

The above is wildly implausible:  You do not call Nazism a disease 
in Nazi Germany and live to tell of it, let alone call Nazism a 
disease and get appointed to the important and well paid job of 
terrorizing your academic colleagues.

The above is also infamously false:  As rector, Heidegger denounced 
those of his colleagues he wished murdered as jews, including his 
own teacher, and he organized paramilitary camps for his students, 
spouting martial rhetoric about the "inner truth and greatness of 
National Socialism," see citation below.

> He is remembered as an
> existentialist, not a Nazi, 

Historical Revisionism alert:  

See http://www.inlink.com/~dhchase/heidig.htm for how he is REALLY 
remembered.

Heidegger himself claimed at the time, his political activities grew 
out of his philosophy, and this claim seems to me to be very obviously true.

Indeed what he claimed then is equivalent to what I have been telling you in
public and private email:  That your ideas lead to people being murdered by
the state, and therefore you should consider them more carefully.

> though he did join the party when he became the
> rector of Freiburg. 

Historical revisionism alert:

His most infamous work was his laudatory speech on Hitler given when 
he was appointed rector of Freiburg.  In addition he never disowned 
his works on the "jewish problem".  As rector he imposed Nazism on 
his colleagues by the usual means.

> The fact that Paul de Man, in his early years in Nazi-occupied Belgium,
> wrote antisemitic propaganda for a number of local collaborationist journals
> was not discovered until four years after his death (by Ortwin de Graef). 

The fact that Paul de Man's philosophy had a very strong resemblance to 
fascist philosophy was discovered considerably earlier.  The fact that he 
also wrote the kinds of racist propaganda that are no longer politically 
correct was merely the icing on the cake.

> By the way, I voted for Bush, and no matter how many times you contradict
> me, I know I don't support the government's actions at Ruby Ridge. 

Revisionism alert (or perhaps in this case merely a reinterpretation alert):

In previous mail you claimed it was not a government action, it was just
a few FBI guys running amuck entirely on their own initiative.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From declan+ at CMU.EDU  Sun Jun  9 23:05:36 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Mon, 10 Jun 1996 14:05:36 +0800
Subject: Gore opposes unwarranted'' Internet censorship
In-Reply-To: <9606100105.AA23760@rpcp.mit.edu>
Message-ID: <Alirsxq00YUy0aELd7@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 9-Jun-96 Gore opposes unwarranted''
.. by Joseph M. R. Jr. at MIT.EDU 
>         Sounds good but I had to laugh when I heard it... is he at odds with
> other members of the administration, or is this rhetoric?

Heh. It's rhetoric, but it's also a sign of the shift in political tides
in DC. Now it's possible for politicos to claim the CDA went a bit too
far -- but they waited for a broad, corporate, mainstream challenge to
the CDA and a negative reaction to the DoJ's arguments from the judges
before they felt comfy taking this position.

Jack Fields, chair of House telecom subcom, made similar mouthings last
month in a speech I reported on in this month's (or was it last month's)
Internet World.

Also check out my f-c dispatch #13 for background on Gore's stand.

-Declan






From declan+ at CMU.EDU  Sun Jun  9 23:07:07 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Mon, 10 Jun 1996 14:07:07 +0800
Subject: Anti-Scientologists
In-Reply-To: <199606091713.TAA18786@basement.replay.com>
Message-ID: <clirxai00YUyAaEOgJ@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 9-Jun-96 Re: Anti-Scientologists by
Anonymous at REPLAY.COM 
> Truth #1: It is a religion
> Truth #2: It is no longer a cult, since the leader is dead.

Truth #1: It is indeed a religion. First Amendment advocates need to
tread carefully when dealing with the Church of Scientology, I believe.

Truth #2: Cults can exist in the absence of a charismatic leader. 

-Declan






From furballs at netcom.com  Sun Jun  9 23:07:32 1996
From: furballs at netcom.com (Paul S. Penrod)
Date: Mon, 10 Jun 1996 14:07:32 +0800
Subject: 
In-Reply-To: <u7c0oD84w165w@bwalk.dm.com>
Message-ID: <Pine.3.89.9606091735.A9700-0100000@netcom4>




On Sun, 9 Jun 1996, Dr.Dimitri Vulis KOTM wrote:

> I think it would take very few 'depopulation' incidents to improve manners.
> Humans, like rats, are very good at learning from others' mistakes.
> 

A brief survey of history reveals that humans are more anxious to repeat 
the mistakes of their peers and forebearers than to learn from them. It's 
not that they don't learn, but fail to pass the wisdom on to their 
progeny. Not to mention that the average retention span is quite low.

Or you could exhume the old argument that stupid people shouldn't breed. :-)

...Paul






From llurch at networking.stanford.edu  Sun Jun  9 23:25:18 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Mon, 10 Jun 1996 14:25:18 +0800
Subject: Netly News on Info War
In-Reply-To: <199606091954.PAA25299@mailhost.IntNet.net>
Message-ID: <Pine.GUL.3.93.960609182437.10009B-100000@Networking.Stanford.EDU>


Pathfinder's ever-cheesy Netly News, www.netlynews.com, carried a story June
5th called "InfoWar is Hell" reacting to the Sunday Times cyberterror
report.  http://pathfinder.com/@@V1G2VgUAwN2g0jLY/Netly/daily/960605.html
Pretty good story IMO. 

June 7th story was on the rec.music.white-powder troll. People who actually
bothered to look at news.groups will be pleased to see the laurels heaped on
the votetaker, but displeased that my attempts to get the reporter to POINT
PEOPLE TO NEWS.GROUPS were unsuccessful. URL 
http://pathfinder.com/@@V1G2VgUAwN2g0jLY/Netly/daily/960607.html

If for whatever reason you want the 3MB raw results, I have a copy at
http://www.stanford.edu/~llurch/potw2/rec.music.white-powder that's probably
easier to get to than ftp.uu.net.

-rich






From jya at pipeline.com  Sun Jun  9 23:33:26 1996
From: jya at pipeline.com (John Young)
Date: Mon, 10 Jun 1996 14:33:26 +0800
Subject: TST on Cyber Terror Inquiry
Message-ID: <199606100036.AAA24146@pipe3.ny3.usa.pipeline.com>


The article Winn Schwartau cited today and a related column: 
 
---------- 
 
   The Sunday Times (London), June 9, 1996, p. 1/8 
 
 
   Secret DTI inquiry into cyber terror [Insight Column] 
 
 
   The government has been holding a secret investigation into 
   attacks by "cyber terrorists" on the City of London for 
   more than two years. The Department of Trade and Industry 
   (DTI), Bank of England, GCHQ, the secret listening station, 
   and the Defence Research Agency (DRA) are involved in the 
   inquiry. 
 
   The existence of the investigation, which began in April 
   1994, emerged after The Sunday Times revealed last week 
   that banks, broking firms and investment houses had paid 
   millions of pounds to gangs that threaten to wipe out 
   computer systems. 
 
   Correspondence from the investigating authorities, seen by 
   Insight, include letters from civil servants saying they 
   are "extremely concerned" at the evidence of extortion 
   demands. 
 
   Yesterday the DTI issued a statement confirming the inquiry 
   and suggesting its work had been hampered by the lack of 
   co-operation from City institutions. 
 
   "We are very interested in the allegations of extortion 
   directed at City of London institutions which were brought 
   to our attention in 1994. We responded then by involving 
   many government organisations, including the DTI, the 
   police, the Bank of England and other agencies. So far, we 
   have not been presented with any hard evidence from 
   victims. We would urge those threatened to come forward," 
   a spokesman said. 
 
   In one letter, dated May 1995, David Hendon, director of 
   DTI technical affairs, wrote to a company specialising in 
   computer security work stating that he was taking the City 
   extortion issue "extremely seriously". Insight has since 
   seen the evidence passed to the DTI and GCHQ which sparked 
   the investigation. In 1994, a consultant working for a 
   company which undertakes computer risk assessments for City 
   institutions compiled a table of 46 attacks on banks and 
   finance houses in New York, London and other centres, 
   starting in January 1993. 
 
   The list included details of raids on three British banks 
   and one American investment house. The documents suggested 
   that operations in the futures markets had been a focus for 
   some of the attacks. 
 
   Documents sent by the DRA, from the office of Professor 
   David Parks, a senior director, indicate that the agency is 
   especially interested in the "weaponry" deployed by the 
   cyber terrorists. 
 
   The agency believes high-intensity radio frequency (HIRF) 
   guns may have been used to black out trading positions in 
   City finance houses. The weapon disables a computer by 
   firing electromagnetic radiation at it and is a "black 
   programme" at the defence ministry, one of the highest 
   security classification levels. 
 
   Last December, Parks approached a company which specialises 
   in defensive measures against information warfare and 
   carries out work for GCHQ. For a L30,000 fee it was asked 
   to arrange a demonstration of a portable HIRF weapon in 
   Germany. 
 
   Details of the HIRF weaponry and its use in the City have 
   also been compiled by Computing magazine, which intends to 
   pass them to the DTI and other authorities. 
 
   [End] 
 
---------- 
 
   [Related column, p. 2/4] 
 
   Held to ransom by superhighway-men 
 
   Private Account [Column] 
 
   By Jeff Randall 
 
 
   Forget Butch Cassidy and the Sundance Kid, the world's 
   financial institutions have a new type of bank robber to 
   deal with -- the cyber terrorist. 
 
   Before you start thinking it sounds like science fiction, 
   consider this: the Department of Trade and Industry (DTI) 
   this weekend confirmed there is an official investigation 
   into "raids" by gangs of computer experts who threaten to 
   wipe out electronic information and trading systems, unless 
   they are paid off. 
 
   The DTI spoke out after last weekend's scoop by the Sunday 
   Times' Insight team revealing that some of London's best- 
   known institutions have paid huge ransoms to "electronic 
   highwaymen" to prevent the meltdown of computer networks. 
   These revelations have sent a shiver up the spines of the 
   City's top banks. Financiers are terrified the emergence of 
   a gaping hole in their systems will cause a loss of 
   investor and customer confidence -- and rightly so. 
 
   Can you imagine calling your stockbroker to buy a few 
   thousand ICI shares, only to be told its entire information 
   bank had been blown away by a Dick Turpin with a PhD in 
   electronic engineering? 
 
   If, like me, you know nothing about computer technology, 
   and care even less, the temptation is to dismiss the 
   problem as the creation of Arthur C Clarke. But the DTI has 
   acknowledged for the first time that an investigation into 
   these "attacks" has been under way for two years. The Bank 
   of England and GCHQ, the government's secret listening 
   station, are working alongside the DTI in the inquiry. 
 
   Agencies in Britain and America believe there have been 
   more than 40 raids on investment firms in New York, London 
   and other European financial centres since 1993. Victims 
   are understood to have paid up to L13m a time after 
   blackmailers showed their ability to bring electronic 
   trading in shares, bonds and commodities to a halt. 
   Futures-market systems have been a favoured target of the 
   space-age bandits. In some cases, the blackmailers have 
   used technology developed by military scientists. 
 
   But here is the paradox: the DTI has been hampered by the 
   reluctance of City firms involved to co-operate. 
   Extortionists have so frightened the investment houses, 
   they fear reprisals if they are discovered helping official 
   agencies track down the gangs. There is also concern that 
   an admission of the threats would diminish confidence in 
   the banking system and create a loss of face for the 
   victims. A banker told Insight: "You will never get a 
   financial institution to admit it has an extortion policy, 
   let alone that it has paid money." 
 
   That begs the question: who in London has paid up? Insight 
   has been told of at least four blue-chip firms caving in to 
   extortionists. For the time being, we have agreed to keep 
   certain information confidential to preserve the integrity 
   of the institutions while the agencies investigate. But the 
   names will eventually surface, and then there will be some 
   serious explaining to do. 
 
   [End] 
 
 
 
 
 
 
 





From jamesd at echeque.com  Sun Jun  9 23:36:18 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Mon, 10 Jun 1996 14:36:18 +0800
Subject: Anti-Scientologists
Message-ID: <199606100121.SAA29907@dns2.noc.best.net>


At 07:13 PM 6/9/96 +0200, Anonymous wrote:
>Truth #1: It is a religion
>Truth #2: It is no longer a cult, since the leader is dead.

Truth number 3:  It charges fifty thousand dollars or so for
secrets of "religous technology" that are available free of charge
on the internet.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From frissell at panix.com  Sun Jun  9 23:48:25 1996
From: frissell at panix.com (Duncan Frissell)
Date: Mon, 10 Jun 1996 14:48:25 +0800
Subject: Report from Germany on "backdoor" net-censorship
Message-ID: <2.2.32.19960609235723.00b35b20@panix.com>


>Criteria for the ICTF's proceed will be developed, evaluated and
>continuously updated by the Internet Medienrat. As an independant
>gremium, the Internet Medienrat tries to achieve a social consensus
>in the use of online media without government [sic! um] censorship.

Is that any relation to the Judenrat that ran the inside of the Ghettos and
Concentrated Camps during the late unpleasantness in Deutschland?

DCF






From jimbell at pacifier.com  Mon Jun 10 00:11:59 1996
From: jimbell at pacifier.com (jim bell)
Date: Mon, 10 Jun 1996 15:11:59 +0800
Subject: Anonymous computer contractors
Message-ID: <199606100240.TAA25079@mail.pacifier.com>


At 01:24 PM 6/9/96 -0500, Igor Chudov @ home wrote:
>Dr.Dimitri Vulis KOTM wrote:
>[we were discussing jimbell's assassination clearinghouse - Igor]
>
>> > Maybe your hint really makes sense and after initial depopulation the
>> > citizens will use different, more considerate, ways of dealing with each
>> > other.
>> 
>> I think it would take very few 'depopulation' incidents to improve manners.
>> Humans, like rats, are very good at learning from others' mistakes.
>
>Alright, but since quite a few people have quite a few present enemies,
>the depopulation may be severe enough.

I disagree.  While each of us may arguably have a number of enemies, if our 
lists were compared I think most of those enemies can be located in a 
relatively tiny group of people, most of whom exercise government authority. 
 Eliminate them, and a relatively small number of criminals, and it'll be a 
rather safe and pleasant society.


> The only hope is that the assassin market will become tight.

I think that the _need_ will drop long before the supply of potential 
assassins will.  Resignations will occur, and criminals will straighten up quickly.




Jim Bell
jimbell at pacifier.com





From tcmay at got.net  Mon Jun 10 00:28:50 1996
From: tcmay at got.net (Timothy C. May)
Date: Mon, 10 Jun 1996 15:28:50 +0800
Subject: Gore's speech writers
Message-ID: <ade0d4f70b021004dfaf@[205.199.118.202]>


At 1:02 AM 6/10/96, Joseph M. Reagle Jr. wrote:
>        Sounds good but I had to laugh when I heard it... is he at odds with
>other members of the administration, or is this rhetoric?
>
[Gore speech elided]

You want a serious answer?

"Speech writers."

Guys at the level of Gore rarely compose their own thoughts. They depend
almost wholly on speech writers. William Safire, Patrick Buchanan, etc. (I
don't follow Clinton and Gore, so I don't know who their speech writers
are.)

I read an interesting op-ed piece about how wonderful Bob Dole's
resignation-from-the-Senate speech was, about how resonant and thoughtful
it was. But the piece went on to point out that the speech was
"un-Dole-like." Turns out it was written by Mark Helprin, a former WSJ
writer and current novelist. Dole is just a typical politician.

Gore is also just a typical politician. To an MIT or CMU crowd he'll give a
speech about the importance of free speech. To a San Francisco crowd he'll
give a speech about the need to create methods of self-policing of hate
speech and limits on speech critical of gays. To a graduating class at "The
Farm" he'll give a speech about the reasons the CIA and NSA must wiretap
all communications. To his St. Alban's 30th Reunion buddies he'll reminisce
about how much fun it was to sit there on Dad's lawn overlooking the
Potomac smoking dope. To the Drug Enforcement Administration he'll give a
pep talk on how DARE is successfully getting more and more children to narc
out their parents.

And so it goes. Politicians say what they think their audience wants to hear.

--Tim May



Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From declan+ at CMU.EDU  Mon Jun 10 00:30:48 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Mon, 10 Jun 1996 15:30:48 +0800
Subject: More on LolitaWatch
Message-ID: <IlisQxa00YUy8aEFgk@andrew.cmu.edu>


http://www.internetworld.com/iw-online/July96/news.html
                  
     CDA Watch: DoJ Proposes Tagging Underage Users
       
     According to the press release, Nubility Inc. had released
     LolitaWatch, a network utility that detects "nubile young teens"
     online by checking for the federally mandated "age bit" in TCP/IP
     packets. But like the original novel, which parodied an older man's
     lust for a lascivious teen, LolitaWatch is a hoax, designed to
     illustrate the dangers of attaching age information to this
     workhorse Internet protocol.

     The proposal for an age bit is a serious one. Advanced during the
     Philadelphia court challenge to the Communications Decency Act
     (CDA), it's part of what American Library Association (ALA) attorney
     Bruce Ennis calls the Department of Justice's (DoJ's) "efforts to
     redefine the way the CDA is written."

[...]

     If the high court strikes down the CDA, Congress will try again. 
     Jack Fields (R-Texas), chair of the House telecommunications       
     subcommittee, said in May: "We should be ready with a         
     response--[pornography] is a real problem. I have a six-year old and
     I get concerned about that. I want a real solution that works. The
     CDA was driven by emotion and not by real policy."
     
     Forty years ago, media hype gave Lolita a reputation as an obscene
     novel and prompted the French, Argentine, and New Zealand           
     governments to censor it. But Vladimir Nabokov's work contained not
     one explicitly sexual passage. Without reading the book, customs
     agents never knew that it was a sad parody of an old man's fantasy
     lust for a young girl.

     The Net censors seem to have found in the Internet a modern      
     Lolita--which they understand just about as well as the 1950s   
     customs agents understood Nabokov.

     --Declan McCullagh








From bgrosman at healey.com.au  Mon Jun 10 00:46:38 1996
From: bgrosman at healey.com.au (Benjamin Grosman)
Date: Mon, 10 Jun 1996 15:46:38 +0800
Subject: New Encryption Algorithm and Program
Message-ID: <1.5.4.32.19960610011120.006b41cc@healey.com.au>


Hello there everyone subscribing to this mailing list...
My name is Benjamin Grosman and I am a 17 year old student from Sydney,
Australia...but please, don't hold any of that against me :)

Anyway, for my major assignment I wrote an encryption program under Turbo
Pascal for Dos, version 7.0, and for this program I developed the algorithm
myself...
Now, what I am wodnering is, is there anyone on this list who might be
interested in testing my program, and or analyisng the strength of the
encryption and reporting there findings back to me? The more people who are
knowledgeable in the field of encryption who want to have a look, the
better, so please, don't hesitate, as I would really appreciate all input....

As you all might have guessed, I am definitely pro-encryption. I have some
particularly malicious "friends" who go to great pains to find out what you
typed in your latest assignments...before they are due...and so I have
undertaken this project out of necessity as much as interest, and I find the
US governments ban on the exportation of cypher technology and knowledge a
great burden on the academic community in their efforts to further their
knowledge...but please don't sledge me for my views, just please respond to:
bgrosman at healey.com.au if you are interested in obtaining a copy of my
program...

Many thanks....
Ben






From declan+ at CMU.EDU  Mon Jun 10 01:05:38 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Mon, 10 Jun 1996 16:05:38 +0800
Subject: Fight-Censorship Dispatch #13: The Second Great Net Panic
Message-ID: <oliq7Pe00YUy8X6p4_@andrew.cmu.edu>




-----------------------------------------------------------------------------
                     Fight-Censorship Dispatch #13
-----------------------------------------------------------------------------
                      The Second Great Net Panic
-----------------------------------------------------------------------------
         By Declan McCullagh / declan at well.com / Redistribute freely
-----------------------------------------------------------------------------

In this dispatch: The Second Great Net Panic grips Washington, DC
                  Bruce Taylor tries a "finger" gambit
                  DFC online copyright action alert, press conference
                  Deputy Atty General slams Net, calls for central control
                  Al Gore decries "unwarranted censorship?"


June 9, 1996

WASHINGTON, DC -- As a wet spring steams into a muggy summer, the
Second Great Net Panic has gripped the nation's capital. 

It could be the humidity. The same waterlogged air that makes my
keyboard stick about this time every year forces lobbyists and
legislators indoors to catered receptions and air-conditioned 
hearing rooms where they catalog the dangers of the Net. Or perhaps
election year politics lends this scaremongering rhetoric its
rough, serrated edge. 

Whatever the cause, it's clear that last year's cyberporn scare --
centering around online smut and leading to the passage of the
Communications Decency Act -- is dwarfed by this year's fevered
attempts to control the Net.

That is, you ain't seen nothin' yet. 

In the last two weeks:

  * The Federal Trade Commission held two days of hearings to decide
    how to regulate web sites that collect personal information about
    children.
  * Sen. Sam Nunn (D-GA) announced at a Senate investigations
    subcommittee hearing that his suspicions of evil cryptohackers
    lurking on the Net mean the CIA and NSA must be permitted to
    snoop domestically, a practice long prohibited by law.
  * The Clinton administration responded to Congressional attempts to
    liberalize export controls on strong encryption with a "Clipper
    III" white paper, and a blue-ribbon NRC report recommended only
    minor changes in U.S. crypto export policy.
  * The Senate Judiciary Committee held hearings where witnesses from
    the Hollywood copyright lobby testified that copyright thieves
    plague the Net.
  * A House Judiciary subcommittee is planning a final markup of
    HR2441, a terribly restrictive online copyright bill similar to
    one the Senate is considering, this Wednesday.
  * The Defense Information Systems Agency released a report claiming
    that hackers tried to break into Pentagon systems 250,000 times in
    1995.
  * The 1997 Defense Authorization Bill will give the White House six
    months to report on "the national policy on protecting the
    national information infrastructure from strategic attack."
  * At the first-ever "CyberCongress" hearing held by a House
    committee, representatives complained about being flamed through
    anonymous remailers and said there should be accountability online.
  * Today's Sunday Washington Post featured an article by Richard Leiby
    on the first page of the Outlook section bashing "self-indulgent
    dross" and "crap" on the Net: "I took out the Internet trash
    and found there wasn't much left."
  * Sen. Orrin Hatch (R-UT), chair of Senate Judiciary, held a hearing
    on June 4 where family values activists testified in support of
    Hatch's bill that gives you 15 years for creating or viewing a
    GIF that "appears to be" or is said to be kiddie porn -- even if
    it's actually a morphed photo of an adult.
  * Journalist Lew Koch unearthed an alarmist speech by Deputy
    Attorney General Jamie Gorelick slamming not just nonescrowed
    crypto but the "social problems" of the Net -- and calling for a
    new "Manhattan Project" and even a new Federal agency to start
    "devising and implementing solutions."

That's the bad news, and the good news is far from reassuring. Some
Congressperns are starting to learn about the Net and the Internet
Caucus' membership is growing. The computer industry has begun to
become more involved in the legislative process, but they're up
against well-entrenched opposition.

The EFF's Mike Godwin had it right when he wrote to me earlier today:
"Every agency wants a bite of jurisdiction over the Internet."

I'm not placing any bets on the eventual outcome of the Second Great
Net Panic, especially when protect-our-children rhetoric comes laced
with protect-our-country slogans. But I know the summer's starting and
some of the keys on my workstation are starting to stick. Yesterday I
spent a sweaty afternoon performing open-keyboard surgery to try and
get my home row working again.

So I'm not too optimistic...


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
                  BRUCE TAYLOR TRIES A "FINGER" GAMBIT
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

Bruce Taylor, the former Federal smut-buster and chief architect of
the CDA, is at it again. This time the Brucester is weighing in on the
New York CDA case with an expanded copy of the amicus brief he first
filed in the Philly lawsuit in which I'm a plaintiff.

When I spoke with him last Thursday, Taylor sketched out his latest
argument in favor of the CDA -- that it's constitutional because the
"finger" service can be modified to return info about whether
someone's an adult or a child. "I just learned about 'finger' a few
weeks ago," Taylor said.

His brief reads:

  Though the testimony is disputed between the parties, there is
  evidence in the record to show that there ways to comply with the
  CDA that are presently available, other means that are possible and
  trivial to institute, and there will undoubtedly be more and easier
  ways to comply in the future.  Potential mechanisms of compliance
  include... agreement on an -L18 or digital or access provider user
  or some other mechanism or combination of devices which allow
  content providers to identify adult visitors to their sites, pages,
  or GIFs and thereby exclude children (such as refinement of the
  PRESENT METHOD OF FINGERING to identify the name of a visitor so
  that the visitor's access provider or ISP releases the users age as
  well as his or her identity -- a fact no less anonymous),
                                               [Emphasis mine. --DBM]

Of course, Taylor's suggestion of putting an "A" or "C" (adult or
child) flag in the info returned by finger creates more problems than
it solves. Most online services don't provide information about users
via finger daemons. More to the point, such a proposal would let any
unscrupulous net.lurker troll for "C" flags -- not exactly the best
way to protect children!


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
          DIGITAL FUTURE COALITION ACTION ALERT, PRESS CONFERENCE
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

In response to a planned House subcommittee markup of its ill-bred
copyright legislation this Wednesday, the Digital Future Coalition is
planning a press conference at 9:30 am this Tuesday, June 11, at the
National Press Club in Washington, DC.

Presenters at the press conference include the Consumer Federation of
America, the National Education Association, the American Committee
for Interoperable Systems (including Sun Microsystems and America
Online), and the Home Recording Rights Coalition. Other members of the
DFC include the American Library Association, the Electronic Frontier
Foundation, People for the American Way, and the Electronic Privacy
Information Center.

-----------------------------------------------------------------------------

                   DIGITAL FUTURE COALITION ACTION ALERT
                            From dfc at alawash.org

      Imminent Congressional action on NII copyright bill threatens
             consumers, students, and other Internet users

Your immediate contacts with key House Judiciary Subcommittee Members
critical!

The House of Representatives Subcommittee on Courts and Intellectual
Property will meet in the next few days to vote on H.R. 2441, the NII
Copyright Protection Act. Call subcommittee members who represent you
or to your institution NOW and tell them that this badly imbalanced
bill shouldn't be voted on unless and until all of the following
problems are addressed. If passed in its current form, H.R. 2441
would:

  * Make it a crime to manufacture the next generation of VCRs,
    personal computers and other digital devices needed for
    recreational and educational use by adding a sweeping and
    overbroad new Section 1201 to the Copyright Act;

  * Make simply browsing the Internet a violation of the law without
    a license from copyright owners;

  * Prevent teachers from using computers to their full potential in
    "distance education" efforts that bring electronic classrooms to
     kids, especially in rural communities and for the disabled;

  * Subject computer system operators -- including online services
    and networks at schools and libraries -- to potentially crippling
    liability for the copyright violations of their users.

Please immediately fax a letter to -- AND CALL -- all members of the
House Judiciary Subcommittee on Courts and Intellectual Property who
represent you or an institution with which you are affiliated. These
contacts must be made NO LATER THAN Tuesday, June 11 and preferably
sooner. Address contacts to the Congressperson, but direct your letter
or call to the appropriate staffer. [URL at the end. -DBM]


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
         DEPUTY ATTY GENERAL SLAMS NET, CALLS FOR CENTRAL CONTROL
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

It's scaremongering at its finest. That's all I can think after I read
the text of a speech Deputy Attorney General Jamie Gorelick gave
earlier this year at the Air Force Academy.

Gorelick starts with the time-honored horror gambit of terrorists,
child pornographers, organized crime groups, and hackers -- but then
moves on to rail against the social problems she's found on the Net.
"Email flames" and "faceless" chat rooms are threats to family values,
she claims.

Then she calls for a centralized government agency to deal with the
problem of the Internet. Clearly, she says, we need a "Manhattan
Project" to fight cybernastiness and net.terrorists:

  We clearly need one focal point in the government to take the lead
  in addressing this issue comprehensively -- to develop national
  policy, coordinate the necessary other agencies, and with industry
  on developing solutions. We need the equivalent of the "Manhattan
  Project" to address the technological issues and to help us harden
  our infrastructures against attack. It might be that we can just
  designate an existing agency to take the lead. Or we may need a new
  agency or some interagency body to perform the task...

Jeanne Devoto (jdevoto at well.com) writes:

  [It's an] attempt to conflate the threat of computer intrusion with
  the "threat" of open access to a mass medium. If such a conflation
  is widely successful, we could see "We must pass this measure
  to license Internet users/ban indecent language/impose FCC
  regulation on ISPs - in order to combat the threat of computer
  crime!"

Computers are the equivalent of nuclear weapons? Maybe treating software
as a munition makes sense after all. 


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
                AL GORE DECRIES "UNWARRANTED CENSORSHIP?"
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

Al Gore sure knows how to play to an audience -- even if it's a bunch
of computer geeks who don't like how the White House has embraced and
defended the Communications Decency Act. During his commencement
address at MIT on June 7, Gore said:

  But let me also state my clear and unequivocal view that a fear of
  chaos cannot justify unwarranted censorship of free speech, whether
  that speech occurs in newspapers, on the broadcast airwaves -- or
  over the Internet.

  Our best reaction to the speech we loathe is to speak out, to reject,
  to respond, even with emotion and fervor, but to censor -- no. That
  has not been our way for 200 years, and it must not become our way
  now.

Talk is cheap. It's now possible for Washington politicians to speak
out against the CDA -- but only because so many mainstream industry
and academic groups coalesced around the ALA/CIEC lawsuit.

When it counted, Gore did nothing to halt the morality crusaders who
pushed the "indecency" standard through Congress. In fact, he embraced
the bill, saying in an interview with the Wall Street Journal:

  This is an early Christmas for consumers. It's a terrific bill...
  Every concern the president expressed about the initial legislation
  has been dealt with on a bipartisan basis.

He also issued a statement on December 20, 1996:

  Today we had a victory for the American economy and the American
  consumer with the bipartisan agreement to create a telecommunications 
  industry for the 21st Century in a way that will lower prices,
  increase and improve services in telecommunications and preserve the
  diversity of voices and viewpoints in television and radio that are
  essential to our democracy.

Stay tuned for more reports.


-----------------------------------------------------------------------------

A clarification to Dispatch #12: Cherry v. Reno has not yet been
formally consolidated with Shea v. Reno.

Mentioned in this CDA update:

  Deputy Atty Gen Jamie Gorelick's speech slamming Net, calling for controls:
    http://fight-censorship.dementia.org/dl?num=2733
  Complete DFC copyright Action Alert, with legislator contact info:
    http://fight-censorship.dementia.org/dl?num=2740
  Declan McCullagh on "LolitaWatch" and -L18 -- July '96 Internet World:
    http://www.internetworld.com/iw-online/July96/news.html
  Declan McCullagh on CDA hearings -- June '96 Internet World:
    http://www.internetworld.com/iw-online/June96/news.html
  Bruce Taylor's amicus "finger" brief in NYC CDA lawsuit:
    http://fight-censorship.dementia.org/dl?num=2736
  NRC crypto report now online, thanks to John Young:
    http://pwp.usa.pipeline.com/~jya/nrcindex.htm
  Brock Meeks on Sen. Sam Nunn's plans for domestic snooping:
    http://www.hotwired.com/netizen/96/23/campaign_dispatch3a.html
  Al Gore speaks at MIT about dangers of net.censorship:
    http://fight-censorship.dementia.org/dl?num=2737
  Al Gore's 12/95 statement on Telecommunications Act of 1996:
    http://fight-censorship.dementia.org/dl?num=478
  Al Gore calls Telecommunications Act "early Christmas" present:
    http://fight-censorship.dementia.org/dl?num=469
  Al Gore speaks at Penn, greeted by anti-CDA protests:
    http://fight-censorship.dementia.org/dl?num=1170
  Creative Incentive Coalition on copyright, pro-HR2441:
    http://www.cic.org/
  Digital Future Coalition on copyright, anti-HR2441:
    http://www.ari.net/dfc/
  Brock Meeks on online copyright:
    http://www.hotwired.com/muckraker/96/20/index3a.html
  U.S. Congressional Internet Caucus:
    http://www.house.gov/white/internet_caucus/netcauc.html

  Fight-Censorship list   <http://fight-censorship.dementia.org/top/>
  Rimm ethics critique    <http://www.cs.cmu.edu/~declan/rimm/>
  Int'l Net-Censorship    <http://www.cs.cmu.edu/~declan/international/>
  Justice on Campus       <http://joc.mit.edu/>

This document and previous Fight-Censorship Dispatches are archived at:
  <http://fight-censorship.dementia.org/top/>

To subscribe to future Fight-Censorship Dispatches and related
announcements, send "subscribe fight-censorship-announce" in the body
of a message addressed to:
  majordomo at vorlon.mit.edu

Other relevant web sites:
  <http://www.vtw.org/>
  <http://www.epic.org/>
  <http://www.aclu.org/>
  <http://www.cdt.org/>
  <http://www.ala.org/>
  <http://www.eff.org/>

-----------------------------------------------------------------------------








From anonymous-remailer at shell.portal.com  Mon Jun 10 01:10:10 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Mon, 10 Jun 1996 16:10:10 +0800
Subject: Obscenity checkpoints
Message-ID: <199606100153.SAA28565@jobe.shell.portal.com>


The Maryville-Alcoa (TN) Daily Times, June 3, 1996.

`Calvin' Decals Catching Some Heat

Auto displays may be deemed `obscene'

By Justin Cress

Tennessee motorists might need to be more discriminating in the
future about the statement their automobiles are making.

A recent warning issued to a South Carolina woman for displaying
an "obscene" bumper sticker has caused some controversy about
that state's obscenity laws.

Decals portraying Calvin, of Bill Waterson's popular "Calvin and
Hobbes" comic strip, urinating on assorted objects of ridicule
are sweeping the Southeast.  The decals' increased visibility
prompts the question:  Is it obscentity or simply bad taste?

Patti Redden of McConnells, S.C., was surprised to find, while
being stopped at a highway patrol checkpoint, that the
reproduction displayed in her rear window was considered
offensive and illegal according to state ordinances.  Her version
depicted the letters "IRS" receiving the Calvinesque treatment.

Like South Carolina, Tennessee's obscenity laws prohibit the use
of "patently offensive" stickers, window-signs, or other markings
on a motor vehicle.  An opinion handed down in 1989 by the state
defines patently offensive as "that which goes substantially
beyond customary limits of candor in describing or representing
such matters," especially when pertaining to excretory functions.

Sharon Curtis-Flair, public information officer of the Tennessee
Attorney General's Office, expects to see renewed interest in the
state's laws.

"We went through this before in 1988 with (another questionable
bumper sticker)," said Curtis-Flair.  "The law has really not
been tested yet.  It's just never been challenged."  (...)






From jamesd at echeque.com  Mon Jun 10 03:12:48 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Mon, 10 Jun 1996 18:12:48 +0800
Subject: Why PGP isn't so ubiquitous (was NRC Session Hiss)
Message-ID: <199606100605.XAA10885@dns1.noc.best.net>


At 05:43 PM 6/3/96 -0700, Joel McNamara wrote:
> (I'm sure the name "wizards" is trademarked by MS, so they won't be called
> that). 

You are free to use the word "wizard" provided that they look, feel,
and work much like what Microsoft calls a "wizard" -- see the 
Microsoft UI guidelines.  

This demand by Microsoft is pretty reasonable.  Now if it had been Apple
or lotus they probably would have declared that you could not write 
anything that looked, felt, or worked much like a wizard.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From sead at cost.se  Mon Jun 10 05:12:04 1996
From: sead at cost.se (sead at cost.se)
Date: Mon, 10 Jun 1996 20:12:04 +0800
Subject: COST CA/WWW Security
Message-ID: <199606100832.KAA17108@cost1.cost.se>


To whom it may concern:

This message is based on some questions recently posted at this mailing list
concerning the issues of certification technology, certification authorities
and related security applications, especially Secure WWW syste, combined with 
usage of certificates.

For all interested, I would like to invite you to visit our WWW server
(http://www.cost.se) where you may find all the information about our
current security products. You may also browse our CA infrastructure.

In case of any further question, please contact me directly.

Regards,

Sead Muftic




____________________________________________
Sead Muftic
COST - Computer Security Technologies CST AB
E-mail: sead at cost.se
Tel: +46-8-16 16 92
Fax: +46-8-471-7722 






From gbroiles at netbox.com  Mon Jun 10 06:45:24 1996
From: gbroiles at netbox.com (Greg Broiles)
Date: Mon, 10 Jun 1996 21:45:24 +0800
Subject: Electronic Signature Act Of 1996
Message-ID: <2.2.16.19960610095811.1d4f15ba@mail.io.com>


At 04:24 PM 6/5/96 -0400, Black Unicorn wrote:

>Please remember that the UCC's application is generally restricted to the 
>sales of goods or acts between merchants.

I'll "remember" this only insofar as it reminds me to read your other
messages with a more skeptical eye. I hope you pay more attention to
accuracy when you're at work.

--
Greg Broiles                |"Post-rotational nystagmus was the subject of
gbroiles at netbox.com         |an in-court demonstration by the People
http://www.io.com/~gbroiles |wherein Sgt Page was spun around by Sgt
                            |Studdard." People v. Quinn 580 NYS2d 818,825.






From perry at alpha.jpunix.com  Mon Jun 10 07:50:59 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Mon, 10 Jun 1996 22:50:59 +0800
Subject: New Type2.list/Pubring.mix
Message-ID: <Pine.NEB.3.93.960610053918.12087A-100000@alpha.jpunix.com>


-----BEGIN PGP SIGNED MESSAGE-----

Hello Everyone,

	I've created a new type2.list/pubring.mix combination on
jpunix.com. The most notable change is that the q at c2.org has been removed
from the list. After several spot checks over the weekend I noticed the
ncognito remailer producing sporadic pings so I left it on the list. Also,
please note that the middleman remailer has changed nym servers from
alpha.c2.org to nym.jpunix.com. 

	The files are available by WWW at http://www.jpunix.com as well as
by anonymous FTP at ftp.jpunix.com.

 John Perry - perry at alpha.jpunix.com -  PGP-encrypted e-mail welcome!
 WWW - http://www.jpunix.com
 PGP 2.62 key for perry at jpunix.com is on the keyservers.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbv9H1OTpEThrthvAQEyewQAqHY5duExLgUQBSf/EQOshXCevQReOKY4
LyVJ4GODBY626OxSUNvi+9+mlJs/0oW2tQ0iSuz3EeEBLrZw0m02wsCPtyGgojd+
hJd+T717sUX9xQ8lsiZHWZ27+Hvb0a8Y2yJ0ugYAKg5jTFfbSkxgpodSXdorqi7c
Mlt6fLof080=
=QCge
-----END PGP SIGNATURE-----





From declan+ at CMU.EDU  Mon Jun 10 08:00:28 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Mon, 10 Jun 1996 23:00:28 +0800
Subject: Gore's speech writers
In-Reply-To: <ade0d4f70b021004dfaf@[205.199.118.202]>
Message-ID: <4lizxrC00YUy41ClsW@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 9-Jun-96 Gore's speech writers by
Timothy C. May at got.net 
> I read an interesting op-ed piece about how wonderful Bob Dole's
> resignation-from-the-Senate speech was, about how resonant and thoughtful
> it was. But the piece went on to point out that the speech was
> "un-Dole-like." Turns out it was written by Mark Helprin, a former WSJ
> writer and current novelist. Dole is just a typical politician.

I've been a fan of Helprin's short stories for a number of years -- he
is a beautiful writer and talented wordsmith. Helprin can make a
paragraph get up, get down, and do the fandango.

If anything is going to give Dole a competitive edge during this
campaign, it's Mark Helprin.

-Declan






From jya at pipeline.com  Mon Jun 10 11:02:40 1996
From: jya at pipeline.com (John Young)
Date: Tue, 11 Jun 1996 02:02:40 +0800
Subject: NYT on Crypto Policy
Message-ID: <199606101036.KAA26662@pipe5.t1.usa.pipeline.com>


   The New York Times, June 10, 1996, p. A10. 
 
 
   The New Encryption Universe [Editorial] 
 
 
   The development of inexpensive computer programs and 
   hardware that scramble telephone calls and computer 
   messages to prevent eavesdropping is rapidly transforming 
   the world of cryptography. Once largely the domain of 
   governments and their intelligence services, encryption 
   technology is now commonly used by corporations, banks, 
   securities firms and individual computer operators. It is 
   time to revise Government encryption policy to fit this new 
   universe. 
 
   A panel of the National Research Council makes a convincing 
   case for doing just that after a careful review of 
   encryption issues. The panel calls on the Government to 
   abandon its effort to limit the development and 
   availability of advanced encryption technology. The Clinton 
   Administration has fought to preserve the Government's 
   ability to access commercial and individual communications 
   for law enforcement purposes by encouraging adoption of a 
   single encryption standard that Government agencies could 
   track and decipher if needed. 
 
   The Research Council panel leans the other way, urging the 
   commercial development of powerful encryption software even 
   though it would make wiretapping more difficult. It also 
   recommends that Washington ease restrictions on exports of 
   encryption technology. 
 
   The Government has long framed the debate over commercial 
   encryption around its need to fight crime through 
   wiretapping. The panel recognizes the usefulness of 
   court-authorized wiretaps. But the panel suggests that a 
   more important issue is the ability of the private sector 
   to transfer confidential financial and other data over 
   telecommunications pathways without interception. 
 
   The Clinton Administration wants the private sector to 
   adopt a type of encryption technology, known as key escrow, 
   that would give the Government the ability to unscramble 
   private phone or computer messages with court authorization 
   and thereby preserve its wiretap capability. But the policy 
   has so far failed several practical tests. The private 
   sector has not voluntarily adopted a Government-controlled 
   technology. In addition, encryption programs are already 
   available that allow almost anyone with a computer and 
   modem to work around Government-controlled technology. One 
   sophisticated system would allow two strangers -- people 
   who had swapped no private passwords -- to read each 
   other's encoded messages. 
 
   It seems likely that the Administration approach will not 
   succeed. If so, the danger is that Washington might move to 
   outlaw encryption technology it has not approved, a step 
   that would grossly violate American civil liberties. The 
   best way for the Government to protect its ability to 
   eavesdrop on domestic and foreign criminals is to stay 
   technically ahead of them. The panel recommends vigorous 
   Government research programs to that end. 
 
   The Research Council group would permit American computer 
   companies to export more powerful encryption software than 
   currently permitted. Foreigners already have access to 
   encryption systems that are more powerful than those 
   American companies are allowed to sell. The export 
   restrictions do nothing to keep encryption software out of 
   the hands of criminals and hostile governments, but 
   needlessly drive American exports out of foreign markets. 
 
   The panel's conclusions are especially credible because its 
   membership was not tilted against the Government. The 
   16-member panel was led by Kenneth Dam, a former Deputy 
   Secretary of State, and included Benjamin Civiletti, a 
   former Attorney General, and Ann Caracristi, a former 
   deputy director of the National Security Agency. The 
   Clinton Administration should take notice. It needs a new 
   encryption policy. 
 
   -- 
 
 
 
 
 
 
 





From jya at pipeline.com  Mon Jun 10 11:46:11 1996
From: jya at pipeline.com (John Young)
Date: Tue, 11 Jun 1996 02:46:11 +0800
Subject: TWP on Crypto Policy
Message-ID: <199606101259.MAA01702@pipe5.t1.usa.pipeline.com>


   The Washington Post, June 10, 1996, p. A18. 
 
 
   Global Village Cops? 
 
 
   What will be the long-term effect of Internet technologies 
   on global law enforcement? The amazing story of Bill and 
   Anna Young, a k a Leslie Rogge and Judy Kay Wilson, offers 
   one possible scenario. The pseudonymous Youngs, residents 
   of Guatemala who the FBI says have been on a decade-long 
   run from U.S. justice since Mr. Rogge was convicted of a 
   string of bank robberies and other offenses, turned 
   themselves in to authorities after a neighbor recognized 
   Mr. Rogge's face on the FBI home page's Most Wanted list. 
   According to a story first told in the Guatemala Weekly, 
   the person who recognized him was a newly Internet-wired 
   14-year-old. 
 
   The vision of the future evoked by this story, of a world 
   in which the familiar "global village" becomes a place not 
   just of instant communication but of neighborly nosiness 
   and where no one can just melt into the crowd, is 
   reassuring and unnerving in about equal proportions. (What 
   if it were a network of hit men or an authoritarian 
   government seeking a dissident, rather than the FBI, making 
   use of this powerful technology?) But it's also worth 
   keeping in mind that, other than the romance of the 
   technology, it doesn't represent that great an advance on 
   current global media that have made celebrities or 
   fugitives' faces familiar to a vast public -- just ask 
   Salman Rushdie. The Rogge nabbing is the first that the FBI 
   credits to its home page specifically, but TV's "America's 
   Most Wanted" has scored similar coups. 
 
   The impossibility of predicting the exact shape of these 
   extensions of policing is relevant as well to a report that 
   the National Research Council recently issued on another 
   computer technology issue -- the vexed matter of whether to 
   ease export controls on encryption software, which encodes 
   information sent electronically so that only a user with a 
   key can decipher it. 
 
   The government until now has resisted lifting controls on 
   "uncrackable" encryption software --  that is, codes that 
   are too complex to be broken by brute force -- unless the 
   industry agrees to deposit keys in an escrow arrangement 
   with a third party so the government can seek and obtain a 
   warrant to read encoded communications if necessary. 
   Software makers, meanwhile, are pushing hard to have these 
   restrictions eased. The research council, an arm of the 
   generally neutral National Academy of Sciences, sought to 
   bridge the gap between industry interests and such 
   government agencies as the FBI and national security 
   agencies, whose case, they say, is based largely on 
   classified matter that can't be publicly discussed. 
 
   Part of the report's conclusion, which favors the easing 
   though not the abolition of current restrictions, is that 
   wider use of encryption technology will actually *help* 
   national security and law enforcement because more data, 
   economic and otherwise, will be secure to begin with. But 
   if the news of the changing terrain tells anything, it is 
   that it is far too soon to base arguments on such a 
   premise. Our own sense on encryption is that the national 
   security and law enforcement questions remain too important 
   to be sacrificed lightly, despite the considerable economic 
   interests of the parties on the other side. But the world 
   of Internet law enforcement is still taking shape. Whatever 
   the public conclusion on encryption, the debate should not 
   rest on any assumptions about what that shape will be. 
 
   -- 
 
 
 
 





From jwilk at iglou.com  Mon Jun 10 12:12:03 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Tue, 11 Jun 1996 03:12:03 +0800
Subject: New signature
Message-ID: <m0uT79y-00035TC@mail.iglou.com>


Ok you all happy now i made my signature 4 lines. After god knows how many
people were bitching at me to change it.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage     Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> President of Revolution Software
Quote- Does whiskey count as beer? -Homer Simpson          
Current Girlfriend - Lindsey Wilcox
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From m5 at vail.tivoli.com  Mon Jun 10 14:15:25 1996
From: m5 at vail.tivoli.com (Mike McNally)
Date: Tue, 11 Jun 1996 05:15:25 +0800
Subject: Gore opposes unwarranted'' Internet censorship
In-Reply-To: <9606100105.AA23760@rpcp.mit.edu>
Message-ID: <31BC1F14.6AE@vail.tivoli.com>


Joseph M. Reagle Jr. wrote:
> 
> Sounds good but I had to laugh when I heard it... is he at odds with
> other members of the administration, or is this rhetoric?

Good cop, bad cop.

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
       m5 at tivoli.com * m101 at io.com          *
      <URL:http://www.io.com/~m101>         * suffering is optional





From trei at process.com  Mon Jun 10 14:30:44 1996
From: trei at process.com (Peter Trei)
Date: Tue, 11 Jun 1996 05:30:44 +0800
Subject: [NOISE] I swear I am not making this up. (rec.music.white-po
Message-ID: <199606101409.HAA21056@toad.com>


Received: from toad.com [140.174.2.1] by alcor.process.com
           with SMTP-OpenVMS via TCP/IP; Fri, 7 Jun 1996 23:37 -0400
Received: (from majordom at localhost) by toad.com (8.7.5/8.7.3) id SAA15816 for cypherpunks-outgoing; Fri, 7 Jun 1996 18:38:51 -0700 (PDT)
Received: from infinity.c2.org (infinity.c2.org [140.174.185.11]) by toad.com (8.7.5/8.7.3) with ESMTP id SAA15811 for <cypherpunks at toad.com>; Fri, 7 Jun 1996 18:38:44 -0700 (PDT)
Received: (from ghio at localhost) by infinity.c2.org (8.7.4/8.6.9)
	id SAA18545; Fri, 7 Jun 1996 18:30:38 -0700 (PDT)
	Community ConneXion: Privacy & Community: <URL:http://www.c2.net>
Date: Fri, 7 Jun 1996 18:30:38 -0700 (PDT)
Message-Id: <199606080130.SAA18545 at infinity.c2.org>
X-Plug: Community ConneXion offers privacy on the internet.  http://www.c2.org/
From: ezundel at alpha.c2.org (E. Zundel Repost)

>From: bb748 at FreeNet.Carleton.CA (Milton Kleim)
>Newsgroups: news.groups,alt.skinheads,alt.politics.nationalism.white,
 >           alt.politics.white-power
>Subject: Statement Regarding rec.music.white-power

>Now that the results for our newsgroup proposal have been issued, we wish 
>to make a statement concerning our objectives.
>
>Three objectives were sought in the rec.music.white-power project:
>
[...]
>
>#3: Create a newsgroup for discussion and promotion of Aryan music. 
[...]

You mean those wonderful ragas and songs from the Vedas, don't you?
I ust *love* sitar music.

Check out The Aryan Pages at http://www.cs.man.ac.uk/~pateld/aryan_dir/aryan.html

Peter Trei





From raph at CS.Berkeley.EDU  Mon Jun 10 15:02:17 1996
From: raph at CS.Berkeley.EDU (Raph Levien)
Date: Tue, 11 Jun 1996 06:02:17 +0800
Subject: List of reliable remailers
Message-ID: <199606101350.GAA12423@kiwi.cs.berkeley.edu>


   I operate a remailer pinging service which collects detailed
information about remailer features and reliability.

   To use it, just finger remailer-list at kiwi.cs.berkeley.edu

   There is also a Web version of the same information, plus lots of
interesting links to remailer-related resources, at:
http://www.cs.berkeley.edu/~raph/remailer-list.html

   This information is used by premail, a remailer chaining and PGP
encrypting client for outgoing mail. For more information, see:
http://www.c2.org/~raph/premail.html

   For the PGP public keys of the remailers, finger
pgpkeys at kiwi.cs.berkeley.edu

This is the current info:

                                 REMAILER LIST

   This is an automatically generated listing of remailers. The first
   part of the listing shows the remailers along with configuration
   options and special features for each of the remailers. The second
   part shows the 12-day history, and average latency and uptime for each
   remailer. You can also get this list by fingering
   remailer-list at kiwi.cs.berkeley.edu.

$remailer{"extropia"} = "<remail at miron.vip.best.com> cpunk pgp special";
$remailer{"portal"} = "<hfinney at shell.portal.com> cpunk pgp hash";
$remailer{"alumni"} = "<hal at alumni.caltech.edu> cpunk pgp hash";
$remailer{"c2"} = "<remail at c2.org> eric pgp hash reord";
$remailer{"penet"} = "<anon at anon.penet.fi> penet post";
$remailer{"flame"} = "<remailer at flame.alias.net> cpunk mix pgp. hash latent cut post reord";
$remailer{"mix"} = "<mixmaster at remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?";
$remailer{"replay"} = "<remailer at replay.com> cpunk mix pgp hash latent cut post ek";
$remailer{"ecafe"} = "<cpunk at remail.ecafe.org> cpunk mix";
$remailer{"amnesia"} = "<amnesia at chardos.connix.com> cpunk mix pgp hash latent cut ksub";
$remailer{'alpha'} = '<alias at alpha.c2.org> alpha pgp';
$remailer{'nymrod'} = '<nymrod at nym.jpunix.com> alpha pgp';
$remailer{"lead"} = "<mix at zifi.genetics.utah.edu> cpunk pgp hash latent cut ek";
$remailer{"treehole"} = "<remailer at mockingbird.alias.net> cpunk pgp hash latent cut ek";
$remailer{"exon"} = "<remailer at remailer.nl.com> cpunk pgp hash latent cut ek";
$remailer{"vegas"} = "<remailer at vegas.gateway.com> cpunk pgp hash latent cut";
$remailer{"haystack"} = "<haystack at holy.cow.net> cpunk mix pgp hash latent cut ek";
$remailer{"ncognito"} = "<ncognito at rigel.cyberpass.net> mix cpunk pgp hash latent";
catalyst at netcom.com is _not_ a remailer.
lmccarth at ducie.cs.umass.edu is _not_ a remailer.
usura at replay.com is _not_ a remailer.

Groups of remailers sharing a machine or operator:
(c2 alpha)
(flame replay)
(alumni portal)

Use "premail -getkeys pgpkeys at kiwi.cs.berkeley.edu" to get PGP keys
for the remailers. Fingering this address works too.

Note: The remailer list now includes information for the alpha
nymserver.

Last update: Mon 10 Jun 96 6:48:03 PDT
remailer  email address                        history  latency  uptime
-----------------------------------------------------------------------
replay   remailer at replay.com              *+*********+     5:38  99.97%
nymrod   nymrod at nym.jpunix.com                    +**#     7:18  99.95%
flame    remailer at flame.alias.net         ---+++++++++  1:07:16  99.94%
alumni   hal at alumni.caltech.edu            -##-*######     8:52  99.92%
mix      mixmaster at remail.obscura.com     +++-_.-.-+++  9:01:40  99.88%
treehole remailer at mockingbird.alias.net   -.-_.--+-+++  6:53:46  99.87%
alpha    alias at alpha.c2.org               ++**++-++***    43:27  99.82%
ecafe    cpunk at remail.ecafe.org           ##*#**#*##.-  2:32:01  99.82%
c2       remail at c2.org                    ++++----++-+    50:04  99.80%
amnesia  amnesia at chardos.connix.com       -----------   3:25:22  99.74%
vegas    remailer at vegas.gateway.com       -***+**-** *    12:10  99.57%
portal   hfinney at shell.portal.com         # ##-####*##     9:04  99.37%
lead     mix at zifi.genetics.utah.edu       ++++ +++-+++    57:39  96.99%
ncognito ncognito at rigel.cyberpass.net             -.    5:56:16  96.90%
exon     remailer at remailer.nl.com         * *+****** *     5:53  96.70%
haystack haystack at holy.cow.net            +# ##*#*#* +     9:32  96.44%
penet    anon at anon.penet.fi               __-----      39:12:37  88.74%
extropia remail at miron.vip.best.com        -----.----    7:07:20  83.80%

   History key
     * # response in less than 5 minutes.
     * * response in less than 1 hour.
     * + response in less than 4 hours.
     * - response in less than 24 hours.
     * . response in more than 1 day.
     * _ response came back too late (more than 2 days).

   cpunk
          A major class of remailers. Supports Request-Remailing-To:
          field.
          
   eric
          A variant of the cpunk style. Uses Anon-Send-To: instead.
          
   penet
          The third class of remailers (at least for right now). Uses
          X-Anon-To: in the header.
          
   pgp
          Remailer supports encryption with PGP. A period after the
          keyword means that the short name, rather than the full email
          address, should be used as the encryption key ID.
          
   hash
          Supports ## pasting, so anything can be put into the headers of
          outgoing messages.
          
   ksub
          Remailer always kills subject header, even in non-pgp mode.
          
   nsub
          Remailer always preserves subject header, even in pgp mode.
          
   latent
          Supports Matt Ghio's Latent-Time: option.
          
   cut
          Supports Matt Ghio's Cutmarks: option.
          
   post
          Post to Usenet using Post-To: or Anon-Post-To: header.
          
   ek
          Encrypt responses in reply blocks using Encrypt-Key: header.
          
   special
          Accepts only pgp encrypted messages.
          
   mix
          Can accept messages in Mixmaster format.
          
   reord
          Attempts to foil traffic analysis by reordering messages. Note:
          I'm relying on the word of the remailer operator here, and
          haven't verified the reord info myself.

   mon
          Remailer has been known to monitor contents of private email.
          
   filter
          Remailer has been known to filter messages based on content. If
          not listed in conjunction with mon, then only messages destined
          for public forums are subject to filtering.
          

Raph Levien





From nobody at REPLAY.COM  Mon Jun 10 15:03:46 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 11 Jun 1996 06:03:46 +0800
Subject: Anti-Scientologists
Message-ID: <199606101537.RAA11056@basement.replay.com>



James A. Donald wrote:
>
> At 07:13 PM 6/9/96 +0200, Anonymous wrote:
> >Truth #1: It is a religion
> >Truth #2: It is no longer a cult, since the leader is dead.
> 
> Truth number 3:  It charges fifty thousand dollars or so for
> secrets of "religous technology" that are available free of charge
> on the internet.

So?


Declan wrote:

> Truth #2: Cults can exist in the absence of a charismatic leader.

Would you describe Christianity as a cult?  If not, why not?








From minow at apple.com  Mon Jun 10 15:10:33 1996
From: minow at apple.com (Martin Minow)
Date: Tue, 11 Jun 1996 06:10:33 +0800
Subject: Report from Germany on "backdoor" net-censorship
Message-ID: <v02140b00ade1ed543c0f@[17.202.12.102]>


>>Criteria for the ICTF's proceed will be developed, evaluated and
>>continuously updated by the Internet Medienrat. As an independant
>>gremium, the Internet Medienrat tries to achieve a social consensus
>>in the use of online media without government [sic! um] censorship.
>
>Is that any relation to the Judenrat that ran the inside of the Ghettos and
>Concentrated Camps during the late unpleasantness in Deutschland?
>
>DCF

Linguistically or politically?

If my (almost totally forgotten) German is correct, the suffix -rat
means "council" or "ministry" or, rather more generally, "governing
body."

But, you probably knew that already.

Cheers

Martin.








From stevenw at best.com  Mon Jun 10 16:49:54 1996
From: stevenw at best.com (Steven Weller)
Date: Tue, 11 Jun 1996 07:49:54 +0800
Subject: [SF Bay Area] Internet security course at Stanford
Message-ID: <v01540b00ade1ee2d4b2b@[206.86.1.35]>




Seen on the net:


The Western Institute of Computer Science announces
a week-long course on

INTERNET SECURITY

taught at Stanford University

July 29 -- August 2, 1996

by Arthur M. Keller (Stanford University)
David H. Crocker (Brandenburg Consulting)
Tina M. Darmohray (Information Warehouse!)
Whitfield Diffie (Sun Microsystems)
Mark Eichin (Cygnus Support)
Alan Fedeli (IBM)
Gail Grant (Open Market)
Lance Hoffman (George Washington University)
Peter G. Neumann (SRI International)
Allan Schiffman (Terisa Systems)

A Practical Week-long Course for Consultants, Educators, Government
and Industry Scientists and Engineers

This course is taught by leading researchers and practitioners in the
area of internet security: Arthur M. Keller, Dave Crocker, Tina M.
Darmohray, Whitfield Diffie, Mark Eichin, Alan Fedeli, Gail Grant,
Lance Hoffman, Peter Neumann, and Allan M. Schiffman.  Participants
will receive a grounding in internet security, familiarity with
current concepts and issues, and exposure to the most important
research and development trends in the area.

Connecting to the Internet brings both unparalleled information
resources and unparalleled security dangers.  Protecting computer
systems and networks from attacks is a critical and ongoing process.
Equally important is protecting corporate intellectual property
assets from inappropriate access.  This course will examine a variety of
network security topics, including protecting against intrusion,
detecting and tracking intruders, and repairing damage after
intrusion.

The course will being with a survey of risk analysis and setting up
emergency responses to network incidents.  We then follow with a
detailed description of cryptography, including cryptographic policy
and a panel.  The course will then cover specific security
technologies.  These include network firewalls (which provide
perimeter security), Kerberos and adding security to existing network
applications, secure messaging, secure payments, and World Wide Web
security (including SSL).  This course will also analyze security
issues for electronic commerce.  We will also show a videotape
presentation on SATAN by Dan Farmer, one of its developers, and a
videotape presentation by John Markoff and Tsutomu Shimomura on
Takedown.

TEXT: Building_in_Big_Brother, Lance Hoffman, and a complete set of
course notes.

PREREQUISITES: This course assumes a general knowledge of
computers and using the Internet.

WHO SHOULD ATTEND: Computer programmers, system managers, computer
operations staff and managers, information technologists and managers,
and teachers who want to gain insight into the capabilities,
implementation and current trends in this emerging technology.

COURSE SCHEDULE: INTERNET SECURITY
Course dates:   July 29 -- August 2, 1996
Schedule   AM1: 9:00 -- 10:30       AM2:   11:00 -- 12:30
           PM1: 1:30 --  3:00       PM2:    3:30 --  5:00

Mon AM  Security Overview
        . Risk Analysis: Lance Hoffman
        . Setting up Emergency Responses to Network Incidents: Alan Fedeli

Mon PM  Cryptography
        . Cryptography 1: Whitfield Diffie
        . Cryptography 2: Whitfield Diffie

Tue AM  Cryptography
        . Cryptography 3: Whitfield Diffie
        . Cryptography 4: Whitfield Diffie

Tue PM  Cryptography
        . Cryptographic policy: Lance Hoffman
        . Cryptography panel: Lance Hoffman (moderator), Peter Neumann,
          Whitfield Diffie

Wed AM  Firewalls
        . Firewall overview and design: Tina Darmohray
        . Packet filtering, proxies, firewall toolkits: Tina Darmohray

Wed PM  SATAN: Dan Farmer by videotape
        Takedown: John Markoff and Tsutomu Shimomura by videotape

Thu AM  Kerberos: Mark Eichin
        Adding security to existing network applications: Mark Eichin

Thu PM  Security for Messaging: Dave Crocker
        Secure payments: Gail Grant

Fri AM  WWW security: Allan Schiffman
        SSL: Allan Schiffman

Fri PM  panel: Arthur Keller (moderator), Dave Crocker, Whitfield Diffie,
        Peter Neumann, Allan Schiffman

ABOUT THE INSTRUCTORS

DR. ARTHUR M. KELLER is a Senior Research Scientist at Stanford
University.  He is Project Manager of Stanford University's
participation in CommerceNet, which is doing the first large-scale
market trial of electronic commerce on the Internet.  He leads the
effort on smart catalogs and virtual catalogs.  He was Manager of the
Penguin project, to provide sharing of persistent object data among
multiple applications.  He is also working on managing inconsistency
in federated, autonomous database systems.  His publications include
work on database security, databases on parallel computers, incomplete
information in databases, database system implementation, hypertext
databases, and computerized typesetting.

DAVID H. CROCKER is a principal with Brandenburg Consulting, providing
business and technical planning for distributed information products
and services.  He has participated in the development of
internetworking capabilities since 1972, first as part of the Arpanet
research community and more recently in the commercial sector.  Mr.
Crocker has made extensive contributions to the development of
electronic mail and other Internet services.  He has worked at a
number of Silicon Valley companies, producing a wide range of TCP/IP,
OSI, and network management products.  He serves as Chairman of the
non-profit Silicon Valley - Public Access Link, a community network
information service.  Mr. Crocker continues technical involvement in
Internet standards activities for transport services, electronic mail
and electronic commerce.

TINA M. DARMOHRAY is a senior consultant for Information Works!, which
specializes in Internet connections, firewall configurations, security
audits, and Internet workshops.  Previously Tina led the UNIX system
administration team at Lawrence Livermore National Laboratory, where
her team had responsibility for over 1000 machines.  Tina is a
founding board member of SAGE (USENIX System Administrators Guild) and
has over a decade of experience as a UNIX system and network
administrator and instructor.  She received her BS/MS from the
University of California at Berkeley.

DR. WHITFIELD DIFFIE, who holds the position of Distinguished Engineer
at Sun Microsystems, is best known for his 1975 discovery of the
concept of public key cryptography, for which he was awarded a
Doctorate in Technical Sciences (Honoris Causa) by the Swiss Federal
Institute of Technology in 1992.  For a dozen years prior to assuming
his present position in 1991, Diffie was Manager of Secure Systems
Research for Northern Telecom, functioning as the center of expertise
in advanced security technologies throughout the corporation.  Among
his achievements in this position was the design of the key management
architecture for NT's recently released PDSO security system for X.25
packet networks.  Diffie received a Bachelor of Science degree in
mathematics from the Massachusetts Institute of Technology in 1965.
He is the recipient of the IEEE Information Theory Society Best Paper
Award for 1979 and the IEEE Donald E. Fink award for 1981.

MARK EICHIN is the primary development engineer for Cygnus Network
Security, Mark Eichin has been involved in the development of the
Kerberos network security system since his days as an undergraduate at
MIT.  He continues to work closely with MIT on the development of
Kerberos.  He was also involved in the design and implementation of
the Zephyr Notification Service, which has been billed as one of the
most complex uses of Kerberos ever seen in an application.

ALAN FEDELI manages IBM network security functions including: IBM's
AntiVirus products and services, phone fraud, and external network
connectivity policy and security countermeasures.  He also manages
IBM's central Computer Emergency Response Team (CERT), which handles
harmful code and network intrusions worldwide, for IBM and customers.
He formed IBM's Internet Emergency Response Service (ERS) as a
fee-based commercial offering.  He has been a manager of technology in
IBM for the past 20 years.  He has managed systems programming,
network software development, and in the past 7 years he has created
information security businesses within IBM.  He is a graduate of City
College of New York, and recently earned his MBA in Organizational
Behavior at Pace University.

GAIL GRANT is the vice president for Business Development for Open
Market, Inc., responsible for evaluation of potential technology
partners and long-term technical requirements.  She also is the
chairman of the Network Services Working Group in CommerceNet, which
is working to facilitate the development, standardization and
deployment of protocols, applications and enabling technologies which
provide authentication, privacy/encryption and certification services
over the Internet in a secure and interoperable manner.  Prior to
joining OMI in 1994, Ms. Grant pioneered the Internet Alpha Program
for Digital Equipment Corporation.  This innovative, industry-first
program generated millions in revenues and was featured in numerous
publications, including Fortune Magazine, The New York Times and USA
Today.  Previous positions include development and development
management positions at Bolt Beranek and Newman in Cambridge MA and in
Cardiac Research at Mass. General Hospital in Boston MA.  Ms. Grant
presents regularly at conferences on the Internet, World-Wide Web and
Electronic Commerce as well as recently authoring a chapter on
Internet business transaction systems for Mary Cronin's upcoming book
in Internet strategies to be published by Harvard Business School
Press.

DR. LANCE J. HOFFMAN is Professor of Electrical Engineering and
Computer Science at The George Washington University in Washington, D.
C. and Director of the School of Engineering's Institute on Computer
and Telecommunications Systems Policy.  He is known for his pioneering
research on computer security and risk analysis, and for his
interdisciplinary work in computer policy issues.  Dr. Hoffman is the
author or editor of five books and numerous articles on computer
security and privacy; his new work on cryptographic policy, Building
in Big Brother, is the first book devoted to the topic.  He also is
the editor of the well-received readings book Rogue Programs: Viruses,
Worms and Trojan Horses.  Dr. Hoffman has lectured around the world on
computer security and privacy and on the vulnerability of society to
computer systems.  Dr. Hoffman was previously a National Lecturer for
the Association for Computing Machinery and a Distinguished Visitor
for the Institute of Electrical and Electronics Engineers.  He served
as general chairman of the Second Conference on Computers, Freedom,
and Privacy, held in March 1992 in Washington.  He is past chair of
the IEEE Committee on Communications and Information Policy's
Subcommittee on Information Security and Applications.  Dr. Hoffman is
a member of the National Advisory Board of the newsletter Privacy and
American Business and a Fellow of the Association for Computing
Machinery.

DR. PETER G. NEUMANN is a principal scientist in the Computer Science
Laboratory at SRI, where he has been since 1971, and his work is
concerned with computer systems having requirements for security,
reliability, human safety, and high assurance (including formal
methods).  He was founder and Editor of the SIGSOFT Software
Engineering Notes (1976-1993), and is Chairman of the ACM Committee on
Computers and Public Policy (since 1985), a Contributing Editor for
CACM (since 1990), and creator (in 1985) and moderator of the ACM
Forum on Risks to the Public in the Use of Computers and Related
Technology.  His RISKS-derived book on the benefits and pitfalls of
computer-communication technology, Computer-Related Risks, is
published by ACM Press and Addison Wesley.

ALLAN M. SCHIFFMAN was named chief technical officer of Terisa Systems
in April 1995.  He was formerly chief technical officer of EIT, one
of the founders of Terisa.  He is principal architect of CommerceNet,
a Bay Area consortium supporting electronic commerce over the
Internet.  His current obsession is Internet transaction security and
has been working for the last year on Secure HTTP.  Schiffman was
previously vice president of technical strategy for ParcPlace Systems
where he led the development of their well-known Objectworks\Smalltalk
product family.  Prior to this, he was senior MTS at Schlumberger
Research and assistant director of the Fairchild Laboratory for
Artificial Intelligence Research.  He holds an M.S. in Computer
Science from Stanford University.

COURSE INFORMATION
Dates:  Monday-Friday, July 29-August 2, 1996
Times:  Registration Sunday afternoon, July 28
        Morning sessions 9:00am-12:30pm with a 30 minute break
        Afternoon sessions 1:30-5:00pm with a 30 minute break
        Lunch break 12:30-1:30pm daily
Location:       on the campus of Stanford University in Stanford, CA.
Course Fee:
        $1,450 (includes instruction, complete set of course notes,
        break refreshments, and Tuesday night reception.)
        $1,575 for registration after July 15
Group Discount: A $100 discount is given to each individual when three or
        more register from the same organization for one of the courses.
Accommodations: Housing information will be mailed at the request of the
        participant after enrollment.
Parking permits are available at the Sunday afternoon course registration and
        are not included in your registration fee.  Out-of-town participants
        will probably NOT need a car during the week.
Transportation: from San Francisco International Airport: Shuttle
        service (Airport Connection) to the Stanford Campus approx. $17.00
        each way; from San Jose International Airport: approx. $17.00

GENERAL INFORMATION
Registration:   Mail the registration form to the Western Institute of
        Computer Science, P.O. Box 1238, Magalia, CA 95954;
        FAX the registration form with your VISA/Mastercard number or company
        purchase order number to (916) 873-6697; or
        EMAIL your registration with company purchase order number or
        VISA or Mastercard number to barnhill at hudson.stanford.edu;
        TELEPHONE (916) 873-0575 with your company purchase order number or
        VISA or Mastercard numbers.
CANCELLATIONS:  are accepted up to 14 working days prior to the start of the
        course. A $100 processing fee will be assessed.  After that date,
        no refunds will be given, but you may send a substitute in your
        place. If WICS is forced to cancel a course for any reason, liability
        is limited to the return of the paid registration fee.
FOR INFORMATION: Call Western Institute of Computer Science
        at (916) 873-0575; email to barnhill at hudson.stanford.edu.

_____________________________________________________________________________
Registration Form
INTERNET SECURITY
July 24-28, 1995

Registration on or before July 15
[  ] INTERNET SECURITY                                              $1,450
Registration after July 15
[  ] INTERNET SECURITY                                              $1,575

Name____________________________________

Title___________________________________

Company_________________________________

Address_________________________________

________________________________________

City/State______________________________

Zip___________________

Country_________________

Work Phone (________)___________________

Home Phone (________)___________________

Electronic Mail address __________________________

        on network _____________________


Total amount enclosed: $___________

Method of payment
[  ] Check enclosed (payable to WICS)

[  ] Visa/Mastercard #________________________________ card exp. date__________

        cardholder signature___________________________________________________

[  ] Bill my company. Purchase Order #__________________________
        Write billing address below.

Return registration form with payment to:
Western Institute of Computer Science
P.O. Box 1238
Magalia, CA 95954-1238

-------------------------------------------------------------------------
Steven Weller                      |  Technology (n):
                                   |
                                   |     A substitute for adulthood.
stevenw at best.com                   |     Popular with middle-aged men.







From bshantz at nwlink.com  Mon Jun 10 17:35:11 1996
From: bshantz at nwlink.com (Brad Shantz)
Date: Tue, 11 Jun 1996 08:35:11 +0800
Subject: Kahn's "The CodeBreakers"
Message-ID: <199606101738.KAA11362@montana.nwlink.com>


C-Punks,

Just as an interesting side note.....

I got lucky this weekend and found a First Edition copy of David 
Kahn's "The Code Breakers" at a little bookstore in Port Townsend, 
Washington.  WHAT A SHOCK!!!  Anyway, I snagged it for $25.00. 
 The cover has been laminated (library style, 
not card style) and it is in excellent condition.

For those wondering what the significance of Port Townsend is...well, 
there is none.  It is, however, the location of Fort Worden which is 
where "An Officer and a Gentleman" was filmed.  (Major piece of 
military history, isn't it?)

Anyway, if any one is looking for a copy, mine is not for sale, but 
the owner of the store said that she has seen copies come through every 
now and again.  (Not necessarily First Ed's)  If you are interested 
in getting in touch with the store, let me know.

Please use my work address,

brads at trisource.com

Brad Shantz
TRIsource Windows Development Services
2825 Eastlake Ave. E. Suite 100
Seattle, WA 98012-3062






From steve.dommett at ukimage.demon.co.uk  Mon Jun 10 18:16:09 1996
From: steve.dommett at ukimage.demon.co.uk (Steve Dommett)
Date: Tue, 11 Jun 1996 09:16:09 +0800
Subject: send info
Message-ID: <960610125009@ukimage.demon.co.uk>





--
  _  ______      _      _____  _____
 | ||  ___ \    \ \    / ____||_____|  * Consulting * Designing * Publishing *
 | || | _ | |   _\ \  | /  __  _____      Chairman & President Andrew Lobel
 | || || || |  / /\ \ | | |__||  ___|
 | || || || | / /__\ \\ \____|| |___     Visit http://www.mirage.co.uk/image/
 |_||_||_|| |/________\\_____/|_____|
                                        Tel: 0956 82 8157   Fax: 0181 959 6094
   E  N  T  E  R  P  R  I  S  E  S       (National Rate)    BBS: 0181 959 8868






From jimbell at pacifier.com  Mon Jun 10 18:43:52 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 11 Jun 1996 09:43:52 +0800
Subject: FOR WHOM THE BELL TOLLS
Message-ID: <199606101827.LAA02620@mail.pacifier.com>


At 06:01 PM 6/9/96 +0200, Anonymous wrote:
>
>Bryce wrote (whilst on his high horse):
>
>> Hm.  I think the best we could hope for is along the lines of
>> "The suspect subscribed to the 'Cypherpunks' discussion group on
>> the Internet, but his violent views were rejected by the members
>> of the group."
>
>Not every member of this list rejects his views.  I for one do not
>reject them outright, but will not defend his views publically for
>fear of embarassing the corporation that I work for. 

Some day, the "embarrassment" may be among those who misunderstood an idea 
that is, by then, fully operational and was an improvement over the previous 
system.  I seem to recall some funny poster titled something like "The five 
stages of a new idea"  which starts out "It'll never work"  and ends up, "I 
knew it would work all along!"

>I do not
>reject Jim Bell's violent views for the simple reason that violence
>is often required to fight violence.  In other words, the best you
>can hope for is "... but his violent views were rejected by some
>members of the group."

I'd like to know what they mean by using the term "rejected."  A rejection 
without an alternative is irresponsible.  Assuming they agree that the 
status quo is unacceptable, and if they believe that change is possible, 
then what is their solution?

Moreover, what is the real meaning of the word "rejected" in this context?  
You can't "reject" gravity, or a hurricane, or eventual death.  


>> It is important that the reporter manages to _not_ use the word
>> "member" to indicate that Bell is a "member" of Cypherpunks.
>
>He *is* a member. And why shouldn't he be?  Are you suggesting that
>this group become moderated? (hiss).  The whole AP concept is very
>relevent to the Cypherpunks, whether the majority like it or not.

In fact, I'd argue that it's inextricably linked to good encryption.  
Defending one will ultimately defend the other.


>If your fear is that reporters will get hold of the wrong end of the
>stick, then perhaps you are correct, but the real problem is the
>*reporters*, not the attitude of the Cypherpunks.  blame them.
>propose a solution. (how about abolition of all libel laws?)

Now _that's_ an excellent idea!  Libel laws never protect the 
anti-establishment, non-mainstream portion of the public, for one.


>> This is assuming that the statement "his violent views were
>> rejected by the members of the group" is actually true!  If
>> there _is_ anyone else here who shares Bell's evil enthusiasms,
>> I strongly encourage you to begin a new list dedicated to that
>> topic.
>
>I disagree with the phrase "evil enthusiasms."  Bell is not an
>evil man.  A little crazy perhaps, but not evil.

Thanks...uh...I think...


>  If you bothered
>to listen to him, you would find that his aim is to create a
>"better" world, where people (especially politicians) are very
>much more responsible for their own actions.  He suggests that
>the number of deaths due to AP will be less that the number of
>deaths due to the current corrupt system.

True.  And it's not just the quantity of deaths that'll be lowered:  The 
"quality" of those deaths (the justification for killing the target) will go 
up, which may seem to be an odd way to refer to it.  Most of us will agree 
that if there was some way to swap the death of the victim, automatically, 
for the death of the criminal or attacker, that would be far more just 
arrangement, as well as rather rapidly deterring future killings.  

An example of the exact opposite is frequently exposed in discussing 
anti-gun-carry laws, which only disarm law-abiding citizens and leave the 
criminals armed.  Such laws, therefore, actually swap the death of the 
criminal for the death of the victim.


>think about it.  how many on this group would have another man
>killed for his views?  For his noisy stereo?  For a competive
>advantage in business?  I am confident the answer will be zero.

Moreover, the number of people wanting to kill the "unjustified" target will 
be extremely low, meaning that one odd donor would have to pay a large 
amount of money to get "action" on his donation.



>On the other hand, I would gladly throw in a few dollars to have
>certain politicians killed.  gladly.  and I will be able to sleep
>at night.

You and a few million other people.  Which is why AP will work so well 
getting rid of governments...and criminals.

>I will sleep better knowing that, although I was
>partly responsible for a mans death, I will have saved countless
>others (a bit like dropping an a-bomb on Japan).

That's exactly correct.  But also, the very existence of such a system will 
_deter_ such people, meaning that it is very likely you won't have to pay 
for anybody's death at all...except for a few that resignation won't save.


>Question for Jim - would you resort to AP to have Bryce popped off?

Nope.  Not when there are so many other deserving targets!    B^)


>Question for Bryce - would you resort to AP to have Jim popped off?

It wouldn't do any good...

Jim Bell
jimbell at pacifier.com





From richieb at teleport.com  Mon Jun 10 18:52:16 1996
From: richieb at teleport.com (Rich Burroughs)
Date: Tue, 11 Jun 1996 09:52:16 +0800
Subject: Anti-Scientologists
Message-ID: <2.2.32.19960610194210.009e3afc@mail.teleport.com>


-----BEGIN PGP SIGNED MESSAGE-----

At 05:37 PM 6/10/96 +0200, someone wrote:
[snip]
>Declan wrote:
>
>> Truth #2: Cults can exist in the absence of a charismatic leader.
>
>Would you describe Christianity as a cult?  If not, why not?

So we're going to argue about whether the word "cult" should apply
to CoS??  Okay, how about this: it's a _religion_ that uses
deception, mind control techniques, and criminal activities to
attempt to get as much possible money from as many marks^H^H^H^H^H
worshippers as possible, and goes to extreme lengths to silence
its critics.

Is that better?

Hubbard started CoS because he was getting too much heat over the
quackery and pseudoscience in "Dianetics."

I'm going to start a religion, too, called the Church of the Shell
Game.  Don't you call it a cult, or I'll be real mad!


Rich



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbx6cYT0GKfZRA/9AQFUTwP+ODigyynDs76o039u/SgxP5K54LSOjsh+
AoKWi81U/cHwPABNZ+fhoP+Hcpd21m4mycWRcFoMwW/VC1xfuEYaCRrqhUlJy5oe
EMYlHNbZQ/klZPBnZkfBZSJFApWpeZTfsaAPKnzwtEGJVTGd0GtdnUe8X2mfCJHJ
Hc5gmTmyQvA=
=RZOB
-----END PGP SIGNATURE-----
______________________________________________________________________
Rich Burroughs  richieb at teleport.com  http://www.teleport.com/~richieb
See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon
New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause





From wendigo at gti.net  Mon Jun 10 19:00:55 1996
From: wendigo at gti.net (Herr Wendigo)
Date: Tue, 11 Jun 1996 10:00:55 +0800
Subject: Anti-Scientologists
In-Reply-To: <199606101537.RAA11056@basement.replay.com>
Message-ID: <199606101932.PAA26136@apollo.gti.net>


-----BEGIN PGP SIGNED MESSAGE-----

An entity claiming to be Anonymous wrote:
: 
: Would you describe Christianity as a cult?  If not, why not?
: 

Cult == "The church down the street"

- -- 
    Mark Rogaski   | Why read when you can just sit and |      Member
  GTI System Admin |         stare at things?           | Programmers Local
  wendigo at gti.net  | Any expressed opinions are my own  |     # 0xfffe
 wendigo at pobox.com | unless they can get me in trouble. |     APL-CPIO


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbx4IQ0HmAyu61cJAQH8XgP/RpFrMMzKZCkwLb/bOVZkOMrv4QhfBRmO
MhIcg+jttI0Bqy8Dp0BmkJbpqHS9tSIKZjoJXRkT/Hb3aGi2G8wvoxIAjoDchoPt
HwAgkI/YV1zW4kXdWHmm7H3WIfr5va/wJyjQHlrqawtt5XKRfE2nIXCZW5tlkdv9
WdSL5eWbs5w=
=MZfs
-----END PGP SIGNATURE-----





From sjb at universe.digex.net  Mon Jun 10 19:50:24 1996
From: sjb at universe.digex.net (Scott Brickner)
Date: Tue, 11 Jun 1996 10:50:24 +0800
Subject: Multiple Remailers at a site?
In-Reply-To: <added28f0302100472cc@[206.170.115.3]>
Message-ID: <199606101858.OAA29866@universe.digex.net>


Lance Cottrell writes:
>At 12:16 PM 6/6/96, Scott Brickner wrote:
><SNIP>
>>The discussion was about multiple remailers from multiple accounts on
>>the same machine.  The very existence of the remailer, independent of
>>issues like shuffling and chaining, is supposed to eliminate
>>identifying the originator by the content of the message.  Message
>>shuffling, delays, and chaining are entirely for the purpose of
>>reducing the information available to the traffic analyst.  If several
>>remailers are running on the same machine, they may be treated as if
>>there were only one remailer, for the purpose of traffic analysis.
>>Getting more traffic going through them just makes the analysts job
>>easier, because his statistical conclusions are stronger.
>         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
>I don't think I am following you. My messages are a constant size signal (I
>send N messages through the remailer). More traffic increases the
>background signal and background noise. While the signal to noise of the
>background gets better, the actual amount of noise went up so the ratio of
>MY signal to the background noise went down. Perhaps I don't understand
>what you are saying.

The TA isn't just looking at your messages.  All traffic through the
remailer represents data.  The S/N ratio is constant whether the
machine has a single remailer or a dozen.  The total traffic through a
machine with a dozen remailers is likely to be higher, since the total
number of remailers world-wide is so small, and users are looking for
fairly random and fairly long chains.  This means that the TA's
statistical sample is a larger fraction of the population (of total
remailer traffic), so correlations identified are stronger.

>I think multiple remailers on a machine are less effective than a single
>remailer with the combined traffic of all the individual remailers, because
>the combined remailer does better reordering from a larger pool.

I agree totally.  The whole point is that multiple remailers on one
machine are a bad thing.  If it weren't for traffic analysis, we would
be happy even if there were only one remailer world-wide that we felt
was safe from subversion.  Adding more remailers to the same machine
doesn't improve protection from traffic analysis, and may slightly
weaken it (by attracting more traffic).

Therefore, multiple remailers on a single machine are a bad thing.





From vznuri at netcom.com  Mon Jun 10 20:20:21 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Tue, 11 Jun 1996 11:20:21 +0800
Subject: whitehouse queries files on political enemies
Message-ID: <199606102021.NAA01025@netcom9.netcom.com>



what goes around comes around..
this reminds me of the old stories of Nixon and the various NSA
domestic programs mentioned by Bamford ("Puzzle Palace")


- ------- Forwarded Message

Date: Fri, 7 Jun 1996 22:23:03 -0700 (MST)
To: fsnw-l at freespeechnews.com
From: Free Speech <ron at grapevinenews.com>
Subject: [FreeSpeech-NewsWire] Files White House Got


>From POLITICSnow I just picked up the following Associated Press story,
dated June 7, 1996:


"The Clinton White House acknowledged Friday it
sought and received more than 300 FBI files,
including those of House Speaker Newt Gingrich's
press secretary, former Bush chief of staff James A.
Baker III and other prominent Republicans."
- - -- Associated Press=20

Also, in POLITICSnow is another press story which states, "Blankley, Baker,
Fitzwater Among 330 FBI
Files White House Got". The following is from that story:

Friday, June 7, 1996=20
=A9 The Associated Press=20

"WASHINGTON (AP) - The Clinton White House acknowledged
Friday it sought and received more than 300 FBI files, including those of
House Speaker Newt Gingrich's press secretary, former Bush chief of
staff James A. Baker III and other prominent Republicans.=20

Republicans immediately denounced the White House, saying President
Clinton's aides misused the FBI to get information on political enemies.
A top GOP leader suggested hearings were in order.=20

White House spokesman Mark Fabiani called it "an innocent
bureaucratic mistake" and said there was no indication anyone reviewed
the FBI background material.=20

But among the unanswered questions were who at the White House
knew the files had been gathered and why they were kept at the White
House rather than returned to the FBI after the error was discovered by
a low-level White House employee sometime early in 1994.=20

The files - some 330 in all, almost all of them former employees of
Republican administrations - were stored in the White House security
office's vault in late 1993 and early 1994, the White House said."

My comments:

I have heard posters say, "So what, I'm alive. I have a job. Why should I
care about this Whitwater
stuff?"

I, myself, have defended President Clinton in POLITICSnow when they were
known as PoliticsUSA. I
have held firm that there is no evidence against the Clinton's. This still
holds true, in my opinion, with
Ron Brown, Vince Foster, etc.

I stated that Travelgate, Whitewatergate, Troopergate, etc. were much to do
about nothing. Maybe they
are in themselves. Although, I am on the verge of making a public apology in
POLITICSnow based upon
the evidence that is beginning to come forth.

For anyone who counts himself a liberal, a basic premise is to have the
government out of our personal
business unless there is an absolute need for it. What apparently has
happened is that the Whitehouse,
for purely political reasons, obtained 330 FBI files almost all of them
former employees of Republican
administrators. This violates, in my opinion, the basic principles of
liberalism. I will answer any posts in
this news forum by anyone who terms himself a liberal and at the same time
defends, what I consider,
Nazi behavior. I want to add that I have the highest respect for the FBI and
all the other Intelligence
Services of the United States. The buck stops somewhere, and it is not with
the FBI.

Best regards,


Bob Drake
snoball at mail.idt.net




- ------- End of Forwarded Message


------- End of Forwarded Message






From llurch at networking.stanford.edu  Mon Jun 10 20:45:14 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Tue, 11 Jun 1996 11:45:14 +0800
Subject: HACK - Class III Information Warfare, Has It Begun?  (fwd)
Message-ID: <Pine.GUL.3.93.960610130553.22853C-100000@Networking.Stanford.EDU>


Yes, I recently subscribed to Netly-L. What of it?

Any bets on whether the Sunday Times is going to sue Time for this blatant
copyright violation? :-)

-rich

---------- Forwarded message ----------
Date: Mon, 10 Jun 1996 12:17:41 -0400
From: Noah Robischon <noah at pathfinder.com>
Reply-To: netly-l at pathfinder.com
To: Multiple recipients of list <netly-l at relay.pathfinder.com>
Subject: HACK - Class III Information Warfare, Has It Begun? 

Well this update from The Sunday Times of London clarifies just how much
last week's story was based on rumor. The answer: totally.  (Esp. note the
quote in paragraph #5).

From:
http://www.sunday-times.co.uk/news/pages/Sunday-Times/stinwenws01027.html?12
55993

Secret DTI inquiry into cyberterror

 THE government has been holding a secret investigation into attacks by
 "cyber terrorists" on the City of London for more than two years. The
Department of Trade and Industry (DTI), Bank of England, GCHQ, the
 secret listening station, and the Defence Research Agency (DRA) are
 involved in the inquiry.

The existence of the investigation, which began in April 1994, emerged
 after The Sunday Times revealed last week that banks, broking firms and
investment houses had paid millions of pounds to gangs that threaten to
wipe out computer systems.

 Correspondence from the investigating authorities, seen by Insight,
include letters from civil servants saying they are "extremely concerned"
 at the evidence of extortion demands.

Yesterday the DTI issued a statement confirming the inquiry and
 suggesting its work had been hampered by the lack of co-operation from
 City institutions.

"We are very interested in the allegations of extortion directed at City of
 London institutions which were brought to our attention in 1994. We
 responded then by involving many government organisations, including
 the DTI, the police, the Bank of England and other agencies. So far, we
have not been presented with any hard evidence from victims.We would
 urge those threatened to come forward," a spokesman said.

 In one letter, dated May 1995, David Hendon, director of DTI technical
affairs, wrote to a company specialising in computer security work
stating that he was taking the City extortion issue "extremely seriously".
Insight has since seen the evidence passed to the DTI and GCHQ which
sparked the investigation. In 1994, a consultant working for a company
which undertakes computer risk assessments for City institutions
compiled a table of 46 attacks on banks and finance houses in New
York, London and other centres, starting in January 1993.

 The list included details of raids on three British banks and one American
investment house. The documents suggested that operations in the
 futures markets had been a focus for some of the attacks.

Documents sent by the DRA, from the office of Professor David Parks,
a senior director, indicate that the agency is especially interested in the
 "weaponry" deployed by the cyber terrorists.

The agency believes high-intensity radio frequency (HIRF) guns may
have been used to black out trading positions in City finance houses. The
weapon disables a computer by firing electromagnetic radiation at it and
is a "black programme" at the defence ministry, one of the highest
security classification levels.

Last December, Parks approached a company which specialises in
defensive measures against information warfare and carries out work for
 GCHQ. For a�30,000 fee it was asked to arrange a demonstration of a
portable HIRF weapon in Germany.

Details of the HIRF weaponry and its use in the City have also been
compiled by Computing magazine, which intends to pass them to the
 DTI and other authorities.






From tcmay at got.net  Mon Jun 10 21:13:28 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 11 Jun 1996 12:13:28 +0800
Subject: Kahn's "The CodeBreakers"
Message-ID: <ade1e4100c02100490cd@[205.199.118.202]>


At 10:40 AM 6/10/96, Brad Shantz wrote:

>For those wondering what the significance of Port Townsend is...well,
>there is none.  It is, however, the location of Fort Worden which is
>where "An Officer and a Gentleman" was filmed.  (Major piece of
>military history, isn't it?)
>

Ah, but it does have some significance. "Liberty" is published out of Port
Townsend. (More precisely, it was the last time I looked.)

And it's near Hump Tulips, Sequim, and Chimicum (sp?). Ma and Pa Kettle country.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From jaed at best.com  Mon Jun 10 21:14:54 1996
From: jaed at best.com (Jeanne A. E. DeVoto)
Date: Tue, 11 Jun 1996 12:14:54 +0800
Subject: Report from Germany on "backdoor" net-censorship
Message-ID: <v01540b00ade249ef4c82@[205.149.167.81]>


At 11:10 PM 6/9/96, Ulf Moeller wrote:
>Furthermore, sample news articles will be suject to detailed legal
>evaluation. Should this result in suspicion or proof of transportation
>of illegal contents, the ICTF can launch various steps to work against
>propagation of these contents. For example, it can arrange for
>blocking of complete newsgroups or retrospect "Cancel" of articles
>already transmitted.

Um. Does this ICTF understand the implications of sending forged cancel
messages outside its own server, when the cancels are based strictly on
disapproval of the content? Do they realize what the consequences will be
for carriage of traffic from their node?

Is Germany about to become known as "Cancelbunny Nation"?

>Internet Media Counsil presents fist measurements for Voluntary
>Self-Control

This is a wonderful type in the fifth word above... ;-)

--
The Internet interprets the US Congress as system damage
and routes around it.   - with apologies to John Gilmore







From shabbir at vtw.org  Mon Jun 10 21:29:24 1996
From: shabbir at vtw.org (Shabbir J. Safdar)
Date: Tue, 11 Jun 1996 12:29:24 +0800
Subject: Gore opposes unwarranted'' Internet censorship
Message-ID: <199606101855.OAA29891@panix4.panix.com>


We should not cut the Administration slack on the basis of some
carefully spun comment by Al Gore's handlers.

We're going to win this one for ourselves.  The fact that the White House
has begun the process of backing away from their own case through ol' Al 
should not, and will not, change my mind.

If you're going to give them credit for anything, give them credit for
directing the Justice dept. to state that they were opposed to Exon's
ideas very early on in the game.  (even if that position became amazingly
low profile when faced with the certainty of the rest of the telecomm bill)

-Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW)
 http://www.vtw.org/ * Defending Your Rights In Cyberspace

Mike McNally writes:
>Joseph M. Reagle Jr. wrote:
>> 
>> Sounds good but I had to laugh when I heard it... is he at odds with
>> other members of the administration, or is this rhetoric?
>
>Good cop, bad cop.
>
>______c_____________________________________________________________________
>Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
>       m5 at tivoli.com * m101 at io.com          *
>      <URL:http://www.io.com/~m101>         * suffering is optional





From frantz at netcom.com  Mon Jun 10 21:35:02 1996
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 11 Jun 1996 12:35:02 +0800
Subject: InfoWar and a.r.s
Message-ID: <199606102213.PAA28725@netcom7.netcom.com>


It seems to me we are seeing an example of Information Warfare in the
doings around alt.religion.scientology.  The board game "Go" models warfare
by having a goal of controlling territory.  In the a.r.s war, we see the
combatants trying to control the newsgroup.  We even see an arms race with
weapons such as cancelbots being developed and employed.

The major difference between newsgroup war and conventional war is that the
dimension a victor needs to control is time and not space.

One question to ponder is whether the a.r.s war will perform the same role
as the Spanish Civil War vs. WW2.  Will we see newsgroup war expand to
other news groups?  I would think a few of the .culture.* groups could be
candidates.


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From tcmay at got.net  Mon Jun 10 21:49:05 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 11 Jun 1996 12:49:05 +0800
Subject: Slander of Catholic Church
Message-ID: <ade1e9960d021004dcf7@[205.199.118.202]>


At 7:42 PM 6/10/96, Rich Burroughs wrote:

>....  Okay, how about this: it's a _religion_ that uses
>deception, mind control techniques, and criminal activities to
>attempt to get as much possible money from as many marks^H^H^H^H^H
>worshippers as possible, and goes to extreme lengths to silence
>its critics.

I don't think this vicious criticism of the Catholic Church is warranted here!

Many of those investigated by the Holy Office actually _were_ heretics, and
the turning of bread into the holy flesh of Our Lord Jesus Christ has been
verified by Vatican scientists. Further, those peasants of Latin America
who give their earnings to the Church so that more jewel-encrusted crosses
and goblets can be bought do not see themselves as victims of a scam. After
all, the Church may get richer in this secular world as they get poorer,
but the Church promises them a seat at St. Peter's dinner table in the next
life.

As to the Church silencing its critics...surely you are not referring to
that Jew slander about the Vatican banker found hanging from Black Friar's
bridge in London? Or the Protestant myth about Opus Dei and its
dispensation of papal justice?

The Pope can utter nothing that is false when he speaks ex cathedra. You
heathens had better remember this, else you may expect an invitation from
the Sacred Congregation for the Doctrine of the Faith (which some of you
heretics and nonbelievers may know by its old name, the Sacred Congregation
of Universal Inquisition).

Millions alive today will reveal the truth before they die.

--Cardinal Timothy May

(Who believes all cults and religions are basically the same shuck and
jive, and who thinks the "Church of Scientology" is actually a little bit
less foolish that the Church of Mormon, with its "baptism of dead
ancestors" into the Church, the funny underwear people have to secretly
wear, etc. However, I have great respect for the practical tactics of the
Mormons, and no respect for the day to day behavior of the CoS.)


Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From unicorn at schloss.li  Mon Jun 10 21:59:59 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 11 Jun 1996 12:59:59 +0800
Subject: Electronic Signature Act Of 1996
In-Reply-To: <2.2.16.19960610095811.1d4f15ba@mail.io.com>
Message-ID: <Pine.SUN.3.93.960610182335.19662A-100000@polaris>


On Mon, 10 Jun 1996, Greg Broiles wrote:

> At 04:24 PM 6/5/96 -0400, Black Unicorn wrote:
> 
> >Please remember that the UCC's application is generally restricted to the 
> >sales of goods or acts between merchants.
> 
> I'll "remember" this only insofar as it reminds me to read your other
> messages with a more skeptical eye. I hope you pay more attention to
> accuracy when you're at work.

In that I posted nearly the entire statute of frauds section, which was
the subject of the above comment in context, you seem to have taken the
above out of context, and applied it too broadly.

> --
> Greg Broiles                |"Post-rotational nystagmus was the subject of
> gbroiles at netbox.com         |an in-court demonstration by the People
> http://www.io.com/~gbroiles |wherein Sgt Page was spun around by Sgt
>                             |Studdard." People v. Quinn 580 NYS2d 818,825.
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From llurch at networking.stanford.edu  Mon Jun 10 22:06:06 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Tue, 11 Jun 1996 13:06:06 +0800
Subject: PGP key revocation
Message-ID: <Pine.GUL.3.93.960610121323.21861C-100000@Networking.Stanford.EDU>


If you exchanged private email with me in the last 18 months, encrypted or
not, in either direction, you should assume that it has been read. 

If you want to contact me, please use my alpha pager, rich at beep.stanford.edu
(60 characters in the Subject: line) or leave a message at 415-725-7710 and
I will call you back. 

My backup key 0x6992AB4D is probably still secure, but I'm going to generate
a new one as soon as I find the time to build a clean machine. 

Thank you for playing. 

-rich

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzCFUi4AAAEEAN/ubnqjGw3s2lNatp3UIqsMarHA9GyZQijm5kgSMaSrsp6M
u43nYmUvcfEAffDv4bH2uH6D1KnSx5DlNoC7uxzjD2jJjAcIiEo/5wkGrBPUBjA+
C9hHsVXIrzDvXWcz/iHAJhyljgqGl9NkvGAy6PNLcJk/ljmixI3DXUbM57SdAAUR
iQCVAwUgMbxsZY3DXUbM57SdAQGudwP+MOWhcL+ZtoPDMjZg/qcUyLINlp/0y2/o
9K/bluz0C5Q62wN+9NV3FCghdtdUTYjPd0bMUKVjRds0jedAq5yOqoc3nTamiqa2
Y1ybm7gnlpqubrbVlFnlFLRJspDva6wZfD8Hdzrd0X/BfWIJYLv17epZYue3WCDF
zsW2B0n4GNK0N1JpY2hhcmQgQ2hhcmxlcyBHcmF2ZXMgPGxsdXJjaEBuZXR3b3Jr
aW5nLnN0YW5mb3JkLmVkdT6JARUDBRAxQg5/iBwV98nhsvEBAXEfB/9KaEAILYNA
sNMiIhjcgJWYXh0bfpgNA53wch4jcwpUtn7btnfvpiHXBsfzGhkbNjjVRUqjRzwF
3MvwZvj+ABCIe+JKD2HEZZDe1GH5Bx/OKNWnTxfNQK4oy1pjwQ+mTVHYj1c+P4qb
naPW8BLc6rL1jKtDjH0Jm/xC5f1H7dtSTPewv/n4JrcBZFeneOnPOJoM33NQbOgJ
9VEEe3OvW7QbLxwuMKxKwBiOG7BMJDDb/SHanqZo1lExbDXUuAiI18tKW3E9s87t
CkJukLJWvXUOA3e2DWN4IDfvFde80NPYbSVbpzLvuLYwxK+iAGshifXVXZe49Cr1
IvTKM+pwI4CeiQBVAwUQMUJ+W/thU5e7emAFAQFMIQH/VilvyRTg23royZQpuk5F
YXHEued4yyApNXPthCxZIYe24nUlcgpY4QWKy++nmUV25OGJR6Y2WsC2z0XIWygZ
zYkAlQMFEDFAYX1pqHkdFx/OXQEBYGgEAJDoATPIWIxriQa5tadTAu3bGvVv2zkb
d0GPXTfr16m/GvLiJ5lmCYqcsKuB/TFcDx/mpKRKQ1kxwOKUwd/W5aSFN5keIlDW
xv0XbGVsHfA+k0vUDQ8drEPd5TdIRvNzPqm2bZyVnGslfvYsFM5nSj2GdrkZgxR2
jxBprZhaES0giQCVAwUQMTjO/hRnBgsaWCnFAQHpNAP/ZoZhHA/JzAecCXPETJIf
9zjPKi4Ih465nxwnhXXwUtNVMFjq7SfJWGSPr/Ei+PE+TKunoGY0/FxV38uyFxXR
Cu2OD3JMIv24NfnUHPnRq/0Hd/NFknGcL1YMXz2DZ63sPO/8Q8GCxXsQ+503DRS2
EUEUSL3ncsukpyPEOb1Sk1WJAJUDBRAxOM8dFIEgbOEpZk0BAR8NBADNJx2lstV7
FziO7O/Aq50mF/oqy4ccAPGzEr2bzGHsP2p7eOG+YJIGI4OrZljoKfhnTtEHiRtu
Fl0m0HsvMVK1Gqbzr+j47gpCDv81WEQae5lNHy5/xWGItEPRZj3EWke8fJWh8HaL
f0sSgGaYtFjj4x7E524NONHlvln21VjWbIkAlQMFEDE4zlEaFuRhG5FXbQEBPs8E
AIQjJgfAdyLxYz/IQy8dCxviausupCtvKKoKdsLj9Q6WN68tjqtjFJI2QHltyjVT
5cyUTpFfegb0PnBmagvkC9fZF3o7N8Mlf0tPV77w9fbjZ7E7pcGdU4S3PNeDvTAb
ChVokB6NigAzXKyaJDlPRAJszF+GOt83HYbOtZWzLEVwiQCVAwUQMTjOsCe8yKJt
SqxdAQEPEwQArHWrSOHWL7m4ZK1QIEQdpwlZySJM5w53wBS1APp7/MtE39/7/nTp
4FPs5e0Vx/AYMyWHuSo2NNL+iFmGNYrQzAn3wu866gFefjIabx/g0BaklvH/5RwT
IXq78R+//W41UEKu7X4SI4pwg5xNroUsCWdc3id8O4uZiwWydu/ocn6JAJUDBRAx
OM4vQK1BjWmSq00BAXXeA/48YpMA9xc02wqScPo+dVPG5EP+K2wSgjoflkjhTkJ2
N+NNcSihmbKbviHZc/NIcpbw+3pKGZNllv0FemlPNUfvvm5ILKv88w9nHK4DXLEt
c/BOuCJtHnNqU2edBET6mVOnqKyoTIyYLF3gRQusoxB+P9snPEgjMqGJezekI6tk
DYkAlQMFEDCFUk6Nw11GzOe0nQEBqD0D/27O7hOU+DehP4vT1Sb5deYI/bFHoOks
TrlGixC+lAsYMigsz3CFzE8XTNzohVQm1iaeO/43YHrr7cLOTfhep41u4Ag0iSUm
zzDv0iQyAiolsypcZ49wBc8m3VsJVHpUVMG0qmf34xUxXuNUT4BxgGvXEYjEV8eQ
M3350OT5u9i+iQCVAwUQMTjO0tlBWyzhG2y5AQGk/wQAxDjtawWTI8vv7sW1V2dy
qbEJ/76Gfgzv/W6pP3MJVrcDesU7/qQ4aSdPAIP7Ac7RXySMMsrdiRQXFKDHW4I4
78aF1A2HjvlMcrdNR+aldaHkyc+ffv3Z0Y1v3ov+GQM9V2KHdtMXOE3e8PlEg5xF
iOfwWTpihvCMXeM0P+8t+rGJAJUDBRAxOM6P5PUudM+LRA0BAciKA/0bts6s+xKW
eqUMdUjnLclC+Zi50OKhS8LuS8RKLSmo5885eiSMqAaOQYjV924EPBmfsNhWsS3G
51jSxGHj8E/2b3rjsUWOW+O5Lq7DM8W4b0IuQkFINEwgfZ6T5MUc1iPQtYo8l/7W
vR3lAhLFQRmnQgGr8at+ekNumeckasFeALQsUmljaCBFbmNyeXB0ZWQgRHJvcGJv
eCA8bGx1cmNoQGFscGhhLmMyLm9yZz60QEZvciBndWFyYW50ZWVkIHNlY3VyaXR5
LCB1c2UgMHg2OTkyQUI0RCBmb3IgcmljaC5ncmF2ZXNAZm9yc3l0aGW0KlIuIENo
YXJsZXMgR3JhdmVzIDxyY2dyYXZlc0BpeC5uZXRjb20uY29tPrQkUmljaCBHcmF2
ZXMgPGFuMjc0MDc0QGFub24ucGVuZXQuZmk+tBdKdXN0IFJpY2ggPHJpY2hAYzIu
b3JnPg==
=aVAl
-----END PGP PUBLIC KEY BLOCK-----






From blancw at microsoft.com  Mon Jun 10 22:18:16 1996
From: blancw at microsoft.com (Blanc Weber)
Date: Tue, 11 Jun 1996 13:18:16 +0800
Subject: Slander of Catholic Church
Message-ID: <c=US%a=_%p=msft%l=RED-81-MSG-960610225421Z-9034@abash1.microsoft.com>


>From: 	Cardinal Timothy May
>
>(Who believes all cults and religions are basically the same shuck and
>jive, and who thinks the "Church of Scientology" is actually a little
>bit
>less foolish that the Church of Mormon, with its "baptism of dead
>ancestors" into the Church, the funny underwear people have to secretly
>wear, etc. However, I have great respect for the practical tactics of
>the
>Mormons, and no respect for the day to day behavior of the CoS.)
................................................................

With apologies to Perry, who could give a flip, my day will not be
complete until Tim tells us about the funny underwear (and how he knows
about it).


>    ..
>Blanc





From frantz at netcom.com  Mon Jun 10 23:17:30 1996
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 11 Jun 1996 14:17:30 +0800
Subject: whitehouse queries files on political enemies
Message-ID: <199606110000.RAA08427@netcom7.netcom.com>


OBCrypto: William Safire, in his 6/10/96 column on this subject, says,
"Under Freeh, the anti-encryption zealot hand-picked by the man whose name
was used on the phony requisitions, the Justice Department's most
confidential file room has become a walk-in closet for White House pols."


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From snow at smoke.suba.com  Mon Jun 10 23:53:36 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 11 Jun 1996 14:53:36 +0800
Subject: whitehouse web incident, viva la web revolution
In-Reply-To: <2.2.32.19960606051847.006e9b18@mail.aracnet.com>
Message-ID: <Pine.LNX.3.93.960610191020.922D-100000@smoke.suba.com>


On Wed, 5 Jun 1996, Bruce Baugh wrote:

<concerning facism--you know what you wrote>

	Thanks. You said it much better than I could have. 

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From stevenw at best.com  Tue Jun 11 00:03:04 1996
From: stevenw at best.com (Steven Weller)
Date: Tue, 11 Jun 1996 15:03:04 +0800
Subject: MacPGP Control (Front end for Macs)
Message-ID: <v01540b06ade288354598@[206.86.1.35]>


I saw this on the Web. I've never used it.

-------------------------------------8>-----------------------------
MacPGP Control (or MPGPC for short) is an AppleScript application that offers an
easy-to-use, more Macintosh friendly user interface to MacPGP.

MacPGP Control relies on your AppleScript-aware version of MacPGP to
perform encryption
and decryption. For information on how to obtain MacPGP in the USA or
Canada, first refer to that site using your FTP client (Anarchie, Fetch,
etc...) or a World Wide Web browser (Netscape, MacWeb, etc...). For non-USA
citizens, information on how to obtain MacPGP is available at St�le
Schumacher's International PGP Home Page.

The main features of MPGPC are grouped into three categories:

       MacPGP related features
       Eudora and Claris Em at iler related features
       Macintosh related features

The current version of MacPGP Control is 1.0 fc 1. You need, among other
things, the
Scriptable Finder to run MPGPC. If you don't have it or cannot obtain a
legal copy, I cannot help you and you will be wasting your time and money
downloading this software. All other components are available.

MacPGP Control is US$15 shareware.
-------------------------------------8>-----------------------------

For details see:

  http://www.deepeddy.com/pgp/

-------------------------------------------------------------------------
Steven Weller                      |  Technology (n):
                                   |
                                   |     A substitute for adulthood.
stevenw at best.com                   |     Popular with middle-aged men.







From bdurham at metronet.com  Tue Jun 11 00:08:10 1996
From: bdurham at metronet.com (Brian Durham)
Date: Tue, 11 Jun 1996 15:08:10 +0800
Subject: New Encryption Algorithm and Program
In-Reply-To: <1.5.4.32.19960610011120.006b41cc@healey.com.au>
Message-ID: <31BCC3E8.DBF@metronet.com>


Benjamin Grosman wrote:

> ... for my major assignment I wrote an encryption program under Turbo
> Pascal for Dos, version 7.0, and for this program I developed the algorithm
> myself...

> Many thanks....
> Ben

Ben:
   If you can, you may want to get a hold of this book:

   Applied Cryptography by Bruce Schneier
   John Wiley & Sons, Inc. ISBN 0-471-59756-2

   It is a very good reference that will show you what the public 'state 
of the art' is.  [You might find that you have recreated something that 
has already been broken, or see weaknesses in your cipher like other 
cryptosystems in the book that have their faults exposed...]

    Happy hunting and hacking,
    Brian Durham
    bdurham at metronet.com





From snow at smoke.suba.com  Tue Jun 11 00:11:22 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 11 Jun 1996 15:11:22 +0800
Subject: Terrorism Hysteria on the Net
In-Reply-To: <199606051227.MAA00334@pipe2.t2.usa.pipeline.com>
Message-ID: <Pine.LNX.3.93.960610191530.922E-100000@smoke.suba.com>


On Wed, 5 Jun 1996, John Young wrote:

> Today's USA has a pair of front page stories: 
> "Feds ready anti-terror cyberteam" and "Terrorism on the Net -- Post-Cold
> War hysteria or a national threat?" 
> They lay out the nightmares and the valiant TLA-daydreams to out-fund the
> hackers and out-flummox the public. 
> "You bring me a select group of hackers and within 90 days I'll bring this
> country to its knees, " says Jim Settle, retired director of the FBI's
> computer crime squad. 

	Give me 15 well trained soldiers(near special forces level) and I
can do it in less than 60 days. Without touching a computer. 

	There was a blue print published by Omni Magazine in the mid to
late 80's written by Henry Kissinger (IIRC). 

	Give me 15 McVey's with the ability to follow orders and I'll have
this country in chaos in 2 weeks. 

	It isn't that hard, it is just that almost everyone prefers the
current system to total death & destruction chaos that follows a strong
government collapsing. Society holds itself together in large part not
because of the rule of law, but becaue most people want it to. 


Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From mccoy at communities.com  Tue Jun 11 00:47:22 1996
From: mccoy at communities.com (Jim McCoy)
Date: Tue, 11 Jun 1996 15:47:22 +0800
Subject: Report from Germany on "backdoor" net-censorship
Message-ID: <v02140b00ade2903143e5@[205.162.51.35]>


Ulf forwards:
[...]
> Proof of origin of
> critical articles will be processed by the server, archived in a data
> base observing privacy laws, and stored at a central facility.
> Furthermore, sample news articles will be suject to detailed legal
> evaluation. Should this result in suspicion or proof of transportation
> of illegal contents, the ICTF can launch various steps to work against
> propagation of these contents. For example, it can arrange for
> blocking of complete newsgroups or retrospect "Cancel" of articles
> already transmitted. ICTF can direct possible criminal investigation
> with help of its data base.
[...]

Did anyone else hear "Deutchland Uber Alles" in the back of their mind
while reading this?  I wonder if the gestapo.de domain name is taken
yet...

> The special problem of the News service is that information can be
> distributed world-wide, yet anonymously. This is different of at least
> fundamentally more difficult in other parts of the Internet, so that
> the volume of critical content in the News is comparably high.

It is kinda sad that these German ISPs who claim that politicians and
governments do not understand the nature of the net seem themselves
guilty of not understand that all internet traffic is effectively
anonymous, Usenet is just obviously anonymous.

> The
> ICTF will register the information availible on the origin of news
> and store them in a data base as to make it possible to determine
> who has sent an article or disguised the real author's identity, in
> retrospect.

"Papieren bitte..."  Yellow stars, pink triangles, hmmm... seems to me
that the Germans have a rather poor history regarding registration and
identity services, but they are once again proving to be good at
encouraging "collaborators."

jim









From snow at smoke.suba.com  Tue Jun 11 01:10:31 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 11 Jun 1996 16:10:31 +0800
Subject: Internet solution for law enforcement
In-Reply-To: <Pine.GUL.3.93.960607215457.1728A-100000@Networking.Stanford.EDU>
Message-ID: <Pine.LNX.3.93.960610202827.922H-100000@smoke.suba.com>


On Fri, 7 Jun 1996, Rich Graves wrote:
> On Fri, 7 Jun 1996 caal at hopf.dnai.com wrote:
> > Has anyone seen this yet?  Looks like it's two weeks old.  Internet Police!
> > >[BizWire]    5/20/96
> > >        (SUN/PSI-INTL)(SUNW) PSI International, Sun partner, unveils Java-
> > >        based Internet solution for law enforcement agencies; "Internet in
> > >        Blue" Police Internet/Intranet Application Suite Available in July
> > >        1996 
> 
> Is this a joke, or has the world gone completely batty?

	Is this an exclusive-or?

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From snow at smoke.suba.com  Tue Jun 11 01:17:50 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 11 Jun 1996 16:17:50 +0800
Subject: [NOISE] Buying whales with digicash Re: Anonymous stock trades.
In-Reply-To: <9606081830.AA05221@Etna.ai.mit.edu>
Message-ID: <Pine.LNX.3.93.960610203547.922I-100000@smoke.suba.com>



	If you are so bright, why can't you format your line length to
something that fits on an 80 column screen?

On Sat, 8 Jun 1996 hallam at Etna.ai.mit.edu wrote: 
	Apart from hero worship why do you believe that Friedman is not able to say 
anything ridiculous? I found the letter to be ridiculous which is why I remember it. 

 	Since you were so certain that Hess was not a staff member of the Cato institute 
despite being listed as such on their home page is it not just a little possible that 
you might be wrong in this case.

___________________end quoted_________________


	I am not attacking your positions on this, but it would be a lot
easier (well, a little easier) if I could easily READ it. 

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From awestrop at crl.com  Tue Jun 11 01:30:11 1996
From: awestrop at crl.com (Alan Westrope)
Date: Tue, 11 Jun 1996 16:30:11 +0800
Subject: Denver area meeting, Saturday, 6/15, 2 pm
Message-ID: <5zNvxo9g/c/M090yn@crl.com>


-----BEGIN PGP SIGNED MESSAGE-----

This month we'll meet on Saturday so that a couple of folks will
be able to attend Father's Day festivites.  As always, we'll meet
at the Tivoli; send email for directions.

ps -- I haven't been announcing local meetings to the list because
I unsubscribed for a few months...just thought I'd advise everyone
that this meeting will be on a Saturday.  Besides, info about local
meetings is now available at http://www.command.com.inter.net/
thanks to some friends who are frequent attendees.


Alan Westrope     PGP public key:  http://www.nyx.net/~awestrop
<awestrop at nyx.net>
<awestrop at crl.com>
PGP 0xB8359639:   D6 89 74 03 77 C8 2D 43   7C CA 6D 57 29 25 69 23

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMbze8VRRFMq4NZY5AQEFlwP/VqxwvfBt4RH1mk+OIuZe16jXFb+NMoIt
i6f1p74BL4XX9TdOobxL/Rnc+tswE8fDCtudESB9vwBGdqaBELF1uNZVQ7/1E7iq
8m7Q5vdhHTmhX/2zqQlCNIdmM1mtyJrj86nSSMJ+i1Z1pdi1kSw1TvSNM7e7eMpL
8vZSpxIZy6Y=
=FDqe
-----END PGP SIGNATURE-----





From snow at smoke.suba.com  Tue Jun 11 01:48:47 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 11 Jun 1996 16:48:47 +0800
Subject: 
In-Reply-To: <199606082209.RAA19856@manifold.algebra.com>
Message-ID: <Pine.LNX.3.93.960610205205.922M-100000@smoke.suba.com>


On Sat, 8 Jun 1996, Igor Chudov @ home wrote:

> jim bell wrote:
> > 
> > While I appreciate your...uh...appreciation, let me remind you that part of 
> > my "pronouncements" are that the current political and social system is 
> > are in "the best interests of the inhabitants of this nation" is still an 
> > open question, and many people have agreed with me on this matter. 
> Since corrupt officials are likely to have more anonymous cash that
> phreedom phighters, guess who will win.

	There are more phreedom phighters, and their assets aren't as
public as the officials.

> Also, think about this: lots of people have someone they'd like
> to assassinate but do not actually do it because of lack of anonymity
> and associated hassles (like dealing with assassins non-anonymously,
> abundance of traces, possible confession of the assassin and so on).

	Most people don't kill because they have a built in psychological
block (call it morals if you wish) against killing in cold blood. This is
what makes people like snipers so puzzling and in some sense romantic to
the average person. They _can't_ at a deep level consider calmly and
dispassonately blowing anothers brains all over the wall. Most murders in
this country are either down in the heat of passion, by psychotics/
sociopaths or by professionals, who usually fall into one of the previous
catagories.

	It is almost ridicoulously simple to kill someone in a relatively
untraceable fashion. Any person of average intelligence can do a little
research (say about 3 hours at a decent (non-chicago) library) and spend
an hour or two in thought and come up with a way to target a non- to
moderately public figure with out getting caught. 
	I can give you 4 right off the top of my head that have a
reasonable chance of sucess, and very little chance of discovery. 

	People like *A* president, or similar high profile fiugre would be
much tougher target, but by no means impossible. 

	Contracting with a "professional killer" is really very silly as I
would bet many of them are unreliable and untrustworthy (outside of
Mafia/Gang related killers--they are (IANAE) more like soldiers, doing it
for "country"-- than freelance assians.) There may be professional hitmen
that are reliable, but they tend to be out of the price range of normal
people. 

	Life ain't TV. 


Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From ddrew at mci.net  Tue Jun 11 02:11:10 1996
From: ddrew at mci.net (Dale Drew)
Date: Tue, 11 Jun 1996 17:11:10 +0800
Subject: Terrorism Hysteria on the Net
Message-ID: <199606110345.XAA25894@druid.reston.mci.net>


At 07:21 PM 6/10/96 -0500, snow wrote:
>On Wed, 5 Jun 1996, John Young wrote:

>> "You bring me a select group of hackers and within 90 days I'll bring this
>> country to its knees, " says Jim Settle, retired director of the FBI's
>> computer crime squad. 
>
>	Give me 15 well trained soldiers(near special forces level) and I
>can do it in less than 60 days. Without touching a computer. 
>

To understand where "They" think they are coming from, you have to compare
Apples-to-Apples.  The concern is the medium of choice; the Internet and it's
high availability of anonymity, coupled with its access to large amounts of
computer systems available via one virtual channel.

A well orchestrated and well researched attack by the right folk, as the thought
process goes, could in-fact, potentially affect large amounts of critical
computer systems within a short period of time. And while the government
has inroads available to identify potential physical terrorists threats,
they do not feel as prepared for the virtual ones.

===============================================================
Dale Drew                                MCI Telecommunications
Manager                                    internetMCI Security
                                                    Engineering
Voice:  703/715-7058                    Internet: ddrew at mci.net
Fax:    703/715-7066                MCIMAIL: Dale_Drew/644-3335






From bogdan at ljextra.com  Tue Jun 11 02:16:39 1996
From: bogdan at ljextra.com (bogdan at ljextra.com)
Date: Tue, 11 Jun 1996 17:16:39 +0800
Subject: [SF Bay Area] Internet security course at Stanford
Message-ID: <199606110350.XAA17034@mail01.ljextra.com>


>
>
>Seen on the net:
>
>
>The Western Institute of Computer Science announces
>a week-long course on
>
>INTERNET SECURITY
>
>taught at Stanford University
>
>July 29 -- August 2, 1996
>
>Course Fee:
>        $1,450 (includes instruction, complete set of course notes,
>        break refreshments, and Tuesday night reception.)
>        $1,575 for registration after July 15

Any guys from this list are gonna take a class for $1500??






From dlv at bwalk.dm.com  Tue Jun 11 02:22:46 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Tue, 11 Jun 1996 17:22:46 +0800
Subject: PGP key revocation
In-Reply-To: <Pine.GUL.3.93.960610121323.21861C-100000@Networking.Stanford.EDU>
Message-ID: <F75BPD108w165w@bwalk.dm.com>


Rich Graves <llurch at networking.stanford.edu> writes:
> If you exchanged private email with me in the last 18 months, encrypted or
> not, in either direction, you should assume that it has been read.

That's right - you can't trust Rich's procmail to have junked any e-mail
reliably. He may have read it all. What a paranoid maroon.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From hal9001 at panix.com  Tue Jun 11 02:23:03 1996
From: hal9001 at panix.com (Robert A. Rosenberg)
Date: Tue, 11 Jun 1996 17:23:03 +0800
Subject: Anonymous return addresses
In-Reply-To: <199606082329.QAA14538@jobe.shell.portal.com>
Message-ID: <v03007102ade2846cf37a@[166.84.254.3]>


At 16:29 -0700 6/8/96, Hal wrote:


>There is no large amount of traffic needed, as each server only sends an
>amount of data equal to one message.  The individual servers do not get
>any information about which message the requestor wants (other than that
>it is one of the 50).  Only by colluding and XOR'ing their bit strings
>can they figure that out.  The same kind of collusion is needed to trace
>a sent message using two remailers, so the security is similar to what we
>get sending messages.

If the message is split into more than one part (to meet the message size
requirement) there is some potential leakage to each server of what message
is being requested. If User a requested 3 messages, then they MAY be
requesting all three parts of a 3 part message (or 2+1). If a record is
kept of the number of requests over time, then there can be some regression
checking based on the ID (ie: If the number of new messages for ANx in the
DB matches the number that User Y requests in the current session). I may
be in error with this thought but it looks like a possible problem.

>Messages would have a finite lifetime and would expire and be removed
>from the database after a while.  The authors propose breaking the
>database up into batches with a fixed number of messages, but I don't
>fully follow the reasoning behind this.  I guess it reduces the load on
>the server when it does its XOR's.

This can also affect the "attack" I speculated on above since it can "leak"
more info. Multi-part messages (or multiple messages to the same recipient)
which are retrieved in one session can be correlated between the groups
(ie: User Y asked for 5 messages [Selected from Groups 1&5] and ANx is the
one AN? that has the requested number of messages in each of the Groups
[ie: 3 from G1 and 2 from G5]).







From jpp at software.net  Tue Jun 11 02:24:13 1996
From: jpp at software.net (John Pettitt)
Date: Tue, 11 Jun 1996 17:24:13 +0800
Subject: AOL 3.0 and SSL
Message-ID: <2.2.32.19960611040101.00b16bd8@mail.software.net>


I see AOL 3.0 how has SSL - does anybody know if they ran the encrypted
pipe out to the browser or stopped it at the AOL host ... since it's
possible to connect to the AOL host via the net the latter would be a
very silly idea ...

John Pettitt, jpp at software.net
VP Engineering, CyberSource Corporation, 415 473 3065
 "Technology is a way of organizing the universe so that man
  doesn't have to experience it." - Max Frisch

PGP Key available at:
http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA3705






From markm at voicenet.com  Tue Jun 11 02:31:31 1996
From: markm at voicenet.com (Mark M.)
Date: Tue, 11 Jun 1996 17:31:31 +0800
Subject: Anonymous return addresses
In-Reply-To: <199606082329.QAA14538@jobe.shell.portal.com>
Message-ID: <Pine.LNX.3.93.960608224227.128A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Sat, 8 Jun 1996, Hal wrote:

> The other one was "Holding Intruders Accountable on the Internet" and it
> had one strange comment.  Basically it was about a way of trying to track
> down cracker types who break into systems.  One strategy these people use
> is to log into a whole series of insecure hosts, one after the other,
> before attacking their target.  Then tracing back where they came from is
> very difficult.  Cliff Stoll's "The Cuckoo's Egg" is the classic account
> of how hard it is to trace these people.  Probably the new books about
> Mitnick talk about the same thing.
> 
> The idea in this article is that you monitor the whole net and track
> all the rlogin and telnet traffic between pairs of hosts.  Then they
> describe a statistical technique for determining that two different
> telnet sessions are chained together by recognizing the same patterns
> of traffic on them.  Basically they count the frequency of spaces and
> punctuation marks on minute-long time slices and try to correlate
> them.  This way you can tell that the intruder attacking here is also
> using these other hosts over there, and try to track him down that
> way.
> 
> I don't think this is very practical, and I have mixed feelings about the
> technology - I don't favor breakins, but the kinds of surveillance that
> would be necessary to implement their technique seem very threatening.
> Also they do mention the obvious countermeasure of using encryption at
> each stage, which would be easy with such things as the secure remote
> shell programs around now.

I don't really understand how such a system would work.  It would either
require some kind of centralized system to receive information from each host
being monitored, or each host would have to contact another and relay the
connection information.  The former would require too much bandwidth and the
latter would open up hosts to easy eavesdropping attacks.  The only alternative
is for sysadmins to monitor syslog activity which is (hopefully) done already.

[...]
> 
> So apparently in the view of these authors anonymous remailers are
> maintained by "the intruder community."  It is unfortunate that we have
> this image among some member of the larger community.  BTW, there are
> periodic suggestions here to run general-purpose connection redirectors,
> but people should be aware of the problem that cracker types would seize
> on these as another shield for their crimes.  These would have to be
> limited to specific uses, such as port 80 which is the http port and
> which hopefully can't easily be used for attacks.

Unfortunately, httpd is very insecure.  First of all, cgi scripts are very
difficult to make secure and can be exploited quite easily.  There may also
be buffer-overflow problems.  It's about as difficult to make connection
redirectors safe from cracker use as it is to make anonymous remailers safe
from child pornographers, terrorists, and other horsemen.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMbo8bbZc+sv5siulAQFfJAP+K8Fl268+FFZ1NRkqQfndKpGvyhH0DYya
ADgQSTClURwL5zWss7esRIpPSvBybCp9JPh9O9v53sTcOToiDWfuAJmuqrugycQa
QyzZW0FI+eNOfZfnMSvNJBs/5LAv2qCLgHDUX4RbT2O9zpaBkp7xAIibc3mQC8ED
CmDACy3Kt24=
=b7Ug
-----END PGP SIGNATURE-----





From jimbell at pacifier.com  Tue Jun 11 02:42:35 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 11 Jun 1996 17:42:35 +0800
Subject: Terrorism Hysteria on the Net
Message-ID: <199606110418.VAA07752@mail.pacifier.com>


At 07:21 PM 6/10/96 -0500, snow wrote:
>On Wed, 5 Jun 1996, John Young wrote:
>
>> "You bring me a select group of hackers and within 90 days I'll bring this
>> country to its knees, " says Jim Settle, retired director of the FBI's
>> computer crime squad. 
>
>	Give me 15 well trained soldiers(near special forces level) and I
>can do it in less than 60 days. Without touching a computer. 
>	There was a blue print published by Omni Magazine in the mid to
>late 80's written by Henry Kissinger (IIRC). 
>	Give me 15 McVey's with the ability to follow orders and I'll have
>this country in chaos in 2 weeks. 
>
>	It isn't that hard, it is just that almost everyone prefers the
>current system to total death & destruction chaos that follows a strong
>government collapsing.

Doesn't this statement represent something of a bias in favor of today's 
system?  Is the "total death and destruction chaos" a function of the 
collapse of that strong government, or the immediate tendency of it to be 
replaced with dictator wannabes?

In other words, if a "strong government" could be brought down with a 
guarantee that nobody would be able to even begin to replace it, might that 
not be an entirely different matter?


>Society holds itself together in large part not
>because of the rule of law, but becaue most people want it to. 

Doesn't this statement contradict the previous statement you made?  If 
there's "chaos" perhaps that's merely because a small group of people is 
trying to take control.  Most people want peace, but it can be disturbed by 
a minority.


Jim Bell
jimbell at pacifier.com





From brian at organic.com  Tue Jun 11 02:56:31 1996
From: brian at organic.com (Brian Behlendorf)
Date: Tue, 11 Jun 1996 17:56:31 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606060257.TAA16018@netcom.netcom.com>
Message-ID: <Pine.SGI.3.91.960610213300.11005B-100000@fully.organic.com>


On Wed, 5 Jun 1996, Nick Szabo wrote:
> Consider a feature fairly independent of the particular payment system: 
> the statement of charges.  Here lies a tradeoff here between completeness 
> and complexity.   On the one hand, merely summarizing charges creates 
> the opportunity for salami frauds, allowing widely distributed false or 
> exaggerated microcharges to go undetected.  Furthermore, parties reading 
> only the summaries get no feedback by which they can adjust their behavior
> to minimize costs.  On the other hand, a statement too complex to
> be easily read also allows fraud, error, and inefficient usage to 
> go unrecognized, because one or both parties cannot understand the 
> rationale for the charges in relation to the presumed agreement on
> terms of service and payment. 

When we are faced with a complex set of interactions with which we expect 
the average person to not only be able to understand, but use, then it's 
always helpful to use metaphors.  Consider the following:


  Many people drive cars.  Those cars require gas.  Gas is "spent" in 
very small amounts at any discrete moment in time, but those who use cars 
are used to paying for gas in lump sums and not necessarily fretting 
about the state of their "gas balance" at every step of the way.  People 
who drive cars have two valuable metrics to gauge their usage of gas and 
the rate at which they spend it: the speedometer and the feul tank 
levels.  When people drive fast, their speedometer is high, and they know 
they are burning gas at a faster rate than when they drive more slowly 
(compensated by the fact that they are getting somewhere faster).  People 
are also used to refilling their gas tank when they get low.


Now, let's consider bridging this metaphor into the micropayments world.  
Imagine that surfing the web is like driving a car - you'll dribble out 
small amounts of money over a period of time, but as long as you watch 
your speedometer (the rate at which you spend money) and the feul tank 
levels (the amount of coinage in your wallet), you are in control of your 
spending rates.  Whether you approve every micropayment explicitly, or 
you set a minimum level below which requests for payments are automagically 
granted, is up to you.  Me, I'd probably be alright with just about any 
site I go to asking for less than $.02 for any action I take.  Anything 
above that, I want to be explicitly asked.  My user interface has a gas 
gauge and a speedometer in the upper-right-hand corner instead of a 
throbbing "N".  When my levels are low, I go visit my bank and "refill" 
my wallet.  Voila!

The billing happens, as others have previously noted, entirely at the 
client side.  There's no reason the wallet or web browser can't keep a 
log of expenditures, and there's no chance for spoofery at that point 
(the wallet knows where it sent money).  

And yes, I am presuming a system involving transfers of digitally signed 
tokens of some sort.  I don't think this is a mistaken presumption.  

	Brian

--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
brian at organic.com  |  We're hiring!  http://www.organic.com/Home/Info/Jobs/






From snow at smoke.suba.com  Tue Jun 11 03:16:36 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 11 Jun 1996 18:16:36 +0800
Subject: Terrorism Hysteria on the Net
In-Reply-To: <199606110345.XAA25894@druid.reston.mci.net>
Message-ID: <Pine.LNX.3.93.960610225538.922V-100000@smoke.suba.com>


On Mon, 10 Jun 1996, Dale Drew wrote:
> At 07:21 PM 6/10/96 -0500, snow wrote:
> >On Wed, 5 Jun 1996, John Young wrote:
> >> "You bring me a select group of hackers and within 90 days I'll bring this
> >> country to its knees, " says Jim Settle, retired director of the FBI's
> >> computer crime squad. 
> >	Give me 15 well trained soldiers(near special forces level) and I
> >can do it in less than 60 days. Without touching a computer. 
> To understand where "They" think they are coming from, you have to compare
> Apples-to-Apples.  The concern is the medium of choice; the Internet and it's
> high availability of anonymity, coupled with its access to large amounts of
> computer systems available via one virtual channel.

	Preaching to the choir, but once again it is a case of nothing
new. The potential for economic terrorism is not significantly larger
given the existance of the internet than it was before. This is what needs
to constantly be drummed into the technically dis-inclined, that the same
problems exists off the net that exist ON the net.
 
> A well orchestrated and well researched attack by the right folk, as the thought
> process goes, could in-fact, potentially affect large amounts of critical
> computer systems within a short period of time. And while the government
> has inroads available to identify potential physical terrorists threats,
> they do not feel as prepared for the virtual ones.

	I would think that shutting down power to New York City for more
than a couple of days would pretty much throw the economy into a fit. 

	I would go so far as to say that you can cause MORE havoc in the
physical arena than the virtual. 


Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From WlkngOwl at unix.asb.com  Tue Jun 11 03:26:21 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 11 Jun 1996 18:26:21 +0800
Subject: [NOISE] whitehouse queries files on political enemies
Message-ID: <199606110558.BAA21396@unix.asb.com>


On 10 Jun 96 at 13:21, Vladimir Z. Nuri wrote:

> what goes around comes around..
> this reminds me of the old stories of Nixon and the various NSA
> domestic programs mentioned by Bamford ("Puzzle Palace")
> 
> 
> - ------- Forwarded Message

Old news, actually. It came over the wire Firday night.

Can't think of anything about it relevant to crypto at the moment...

 





From jwilk at iglou.com  Tue Jun 11 03:54:40 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Tue, 11 Jun 1996 18:54:40 +0800
Subject: No Subject
Message-ID: <m0uTKd3-00035bC@mail.iglou.com>


 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> President of Revolution Software
Quote- Does whiskey count as beer? -Homer Simpson          






From s1113645 at tesla.cc.uottawa.ca  Tue Jun 11 03:57:00 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Tue, 11 Jun 1996 18:57:00 +0800
Subject: [more noise] Re: [NOISE] I swear I am not making this up.
In-Reply-To: <199606101409.HAA21056@toad.com>
Message-ID: <Pine.3.89.9606110239.A21446-0100000@tesla.cc.uottawa.ca>



On Mon, 10 Jun 1996, Peter Trei wrote:

> >#3: Create a newsgroup for discussion and promotion of Aryan music. 
> [...]
> You mean those wonderful ragas and songs from the Vedas, don't you?
> I ust *love* sitar music.
 ;-)
> Check out The Aryan Pages at http://www.cs.man.ac.uk/~pateld/aryan_dir/aryan.html

Om, that reminds me,
ObCryptolinguisticsPunks: Did anyone know Iranian and Aryan are synonyms?
I have always been puzzled as to why nazis are so in love with my ethnic 
group. Very strange.





From enquirer at alpha.c2.org  Tue Jun 11 04:12:42 1996
From: enquirer at alpha.c2.org (enquirer at alpha.c2.org)
Date: Tue, 11 Jun 1996 19:12:42 +0800
Subject: Cypherpunk Enquirer
Message-ID: <199606110631.XAA25212@infinity.c2.org>




			THE CYPHERPUNK ENQUIRER

                   "Encyphering minds want to know."


The Enquirer's Public Service Award for this month goes to ABC Evening
News, which, after noting that 25% of America's children have access to
bomb-making instructions via the Internet, proceeded to provide those
instructions to the 75% without Internet access.  ABC News President Roone
Arledge defended the decision to describe the explosives made from commonly
available household ingredients, stating that "In the interest of public
safety, we omitted the final instruction to 'light the fuse and run like
hell'."

The Cypherpunk Academy of Codes and Cyphers recently announced a new
nomination for the Perry Award.  The nomination for this prestigious award,
given to the cypherpunk who has done the most in the past year to increase
the S/N ratio of the list, goes to Alex de Joode, for shutting down the
famed Hacktic remailer and refusing to confirm or deny that the reason was
actually the fact that the entire staff of Hacktic, Int. has recently
converted to the Church of $cientology.  The resulting rumors set of a wave
of paranoia on the list regarding the future of the remailer network, and
resulted in a few cypherpunks actually writing code for the first time in
recent memory.  Mr. de Joode, interviewed while peddling e-meter software
for $10,000 in Amsterdam's red light district, refused all comment. 

Curtis Sliwa had to return the $10,000 today when it was discovered that
the .gif of "a woman's genitals nailed to a board" that the CyberAngels
presented to the ACLU lawyers in the CDA appeal hearing was really a
photo of his wife Lisa's labial piercings.

Rich Graves finally got his Doctor of Divinity degree from the Universal
Life Church, and requests that from now on, list members refer to him
as "DR. Fucking Statist".

Sotheby's Auction House today announced that the famed "Black Window"
Java applet signed by Marianne Mueller has been sold for $2,500,000.
The rare applet, which can damage hard drive files even though it had
been signed and certified as "completely secure", was purchased by a
certain Wall Street Computer Security Consultant who wishes to remain
anonymous, and who placed his winning bid via anonymizer at c2.org.

Leon Panetta belatedly admitted today that hidden away in the small
print on page 1,237 of the Administration's latest "Law Enforcement
Access to Encrypted Internet Traffic" proposal, otherwise known as
Clipper III, was a section on the new "Republican Members of Congress FBI
File Escrow Service".

Logan promises to never again try to operate his Mac mail software
immediately after one of those late-night Beltway cocktail parties.

Former President Jimmy Carter was vindicated today when Jim Bell
announced that the strange markings on recently deceased ex-CIA Director
William Colby's canoe were indeed the result of rabbit bites.  

Sandy Sandfort's tax avoidance consulting service collapsed today when it
was discovered that tax avoiders weren't any better at chaining remailers
that the average Windows95 user.

Next in the Enquirer:  Tim May's first interview since the Catholic Jihad's
announcement of their "Death Contract" with Jim Bell.





From bogus@does.not.exist.com  Tue Jun 11 04:15:44 1996
From: bogus@does.not.exist.com (Anonymous)
Date: Tue, 11 Jun 1996 19:15:44 +0800
Subject: ANNOUNCEMENT: HACKERPUNKS MAILING LIST
Message-ID: <199606110351.FAA03834@basement.replay.com>



                      H  A  C  K  E  R  P  U  N  K  S  
                       "Obscurity through Security!"


Hi! We are delighted to announce a new mailing list, Hackerpunks! This list
is for serious folks who know stuff about computers _AND_ want to keep
their privacy. The submission address is an anonymous alias,
hackerpunks at alpha.c2.org. It is anonymous because _I_ want to keep my
privacy and do NOT want to answer stupid questions. To further _your_
privacy, we can subscribe ONLY anonymous aliases user_name at alpha.c2.org.
Mailing list messages will be forwarded to your alpha.c2.org adresses 
through anonymous remailers.
.p
This list is UNMODERATED. Due to our organization, we are unable to 
find out your true identity, and you are unable to find out where
our list-bot resides. So - you can now have free discussion about all
exploits and great hacks! Just use remailers and be safe...
.p
Remember i) no one can find out where the list resides ii) nobody can
find out that your alpha.c2.org account is subscribed to Hackerpunks
iii) nobody can find out who hides behind alpha.c2.org accounts
iv) nobody can find out that you are using alpha.c2.org aliases.
.p
Everything goes as long as it is about hacking. We shall decide 
later whether we want to keep non-computer hacking discussions in this
list or make another one. MODERATE FLAMAGE ONLY!
.p
Since remailers are used all the way from you to the list-bot and back,
the time for your messages to reach subscribers will be invariably
longer. You've gotta pay for security. Hackers must be patient!
.p
See our .sig for instructions; get premail for Unix or Private Idaho for
Windows, get an anonymous account at alpha.c2.org, and subscribe!
.p
All subscriptions and submissions NOT originating from alpha.c2.org will
be AUTOMATICALY REJECTED. That will save you YOUR OWN BUTT if you 
mistakenly submit a non-anonymous message.
.p
See ya! Schwartau, join us if you have something real to say (unlikely)!
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
H A C K E R P U N K S   M A I L I N G   L I S T  hackerpunks at alpha.c2.org
Send your requests to [un]subscribe  to hackerpunks-owner at alpha.c2.org
Only nyms from @alpha.c2.org may subscribe and post to this list.
See http://www.c2.org/anon.phtml, http://www.c2.net/~raph/premail
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@





From snow at smoke.suba.com  Tue Jun 11 04:24:21 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 11 Jun 1996 19:24:21 +0800
Subject: Terrorism Hysteria on the Net
In-Reply-To: <199606110418.VAA07752@mail.pacifier.com>
Message-ID: <Pine.LNX.3.93.960610224644.922U-100000@smoke.suba.com>


On Mon, 10 Jun 1996, jim bell wrote:

> At 07:21 PM 6/10/96 -0500, snow wrote:
> >On Wed, 5 Jun 1996, John Young wrote:
> >> "You bring me a select group of hackers and within 90 days I'll bring this
> >current system to total death & destruction chaos that follows a strong
> >government collapsing.
> 
> Doesn't this statement represent something of a bias in favor of today's 
> system?  Is the "total death and destruction chaos" a function of the 
> collapse of that strong government, or the immediate tendency of it to be 
> replaced with dictator wannabes?
> In other words, if a "strong government" could be brought down with a 
> guarantee that nobody would be able to even begin to replace it, might that 
> not be an entirely different matter?

	Notice the use of the word "Collapsing" it was used to refer to a
quick removal of rule/authority.
	I am no proponet of today's system, but no reasonable replacement
has been suggested. Yours included. The problem I have with your system is
basically the same problem I have with todays. Tyranny of the masses and a
system where emotion can be drummed up to kill an idea (or person) where
reason _should_ prevail. 

> >Society holds itself together in large part not
> >because of the rule of law, but becaue most people want it to. 
> 
> Doesn't this statement contradict the previous statement you made?  If 
> there's "chaos" perhaps that's merely because a small group of people is 
> trying to take control.  Most people want peace, but it can be disturbed by 
> a minority.

	In the situation where a small group of people do something to
throw the system into chaos, the rules that stop the minority from running
amuck are no longer in place. In that situation, people get scared. Fear
is condusive to rational thinking. When fear takes over people tend to
react emotionally/instinctively. This would (I think, I haven't done the
research to back this up) tend to cause people to back someone who
promises a return to the previous stability (look at Russia).


Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From jamesd at echeque.com  Tue Jun 11 04:31:30 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Tue, 11 Jun 1996 19:31:30 +0800
Subject: [NOISE] "Fascism is corporatism"
Message-ID: <199606110717.AAA22004@dns1.noc.best.net>


At 12:44 AM 6/9/96 -0700, Rich Graves wrote:
> All you're doing is blathering on with some
> anti-intellectual lumpenlibertarian claptrap that tries to smear anything
> you disagree with as tantamount to fascism. 
> 
> [...]
>
> Heidegger only really supported Nazism from 1933-34; in the 40's and
> thereafter, he referred to Nazism as a disease.
>
> [...]
>
> any attempt to smear them as a bunch of Nazis is ludicrous
>
> [...]
>
> Your foaming-mouth projections on people who disagree with you are 
> laughable.

During the war Heidegger wore full Nazi regalia, and compelled his students to 
participate in fascist rallies which he led.   He consistently claimed that his
philosophy led logically to fascism.  See "A normal Nazi" by Thomas Sheehan,
in the New York Review of Books, early 1993.  Also in the same journal see a 
dozen of the leading lights of the academic left enthusiastically supporting 
a murderous Nazi and the ideas that he loudly proclaimed were fascist ideas.

You revised history in favor of a couple of fascist philosophers, one 
of whom sent one of his former teacher to one of Hitler's concentration 
camps. See the following URLs for the real history.
http://www.wavefront.com/~contra_m/cm/reviews/cm13_rev_heidegger.html
http://www.inlink.com/~dhchase/heidig.htm

You also revised history in favor of a system of ideas that has in the past 
been used to justify and organize the deaths of millions of people, and
which has recently in America been used to justify and organize mild but 
widespread repression, (including the PC laws that you recently denied 
existed), the system of ideas that many people reasonably argue has been
recently been used to justify and organize the narrowly focused severe 
repression, including government murder of women and children, that we 
have recently seen in America (which you recently denied was the intended
outcome of government policy).

And *you* are calling *me* an extremist.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From furballs at netcom.com  Tue Jun 11 04:44:50 1996
From: furballs at netcom.com (Paul S. Penrod)
Date: Tue, 11 Jun 1996 19:44:50 +0800
Subject: Slander of Catholic Church
In-Reply-To: <ade1e9960d021004dcf7@[205.199.118.202]>
Message-ID: <Pine.3.89.9606110041.A8374-0100000@netcom13>




On Mon, 10 Jun 1996, Timothy C. May wrote:

<snip>...

> 
> --Cardinal Timothy May
> 
> (Who believes all cults and religions are basically the same shuck and
> jive, and who thinks the "Church of Scientology" is actually a little bit
> less foolish that the Church of Mormon, with its "baptism of dead
                        ^^^^^^^^^^^^^^^^

It's The Church of Jesus Christ of Latter Day Saints.

If your going to criticize it, at least get the name right.

> ancestors" into the Church, the funny underwear people have to secretly
                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Do you wear yours on the outside like Madonna?

> wear, etc. However, I have great respect for the practical tactics of the
> Mormons, and no respect for the day to day behavior of the CoS.)
> 

Frankly, I think this discussion needs to be put back into 
alt.flame.the.religion.of.your.choice. It's bad enough to watch a 
discussion on anonymous transactions devolve into useless drivel on whale 
ownership and the questionable philisophical ruminations of a Piled 
Higher and Deeper, without flinging this prarrie muffin on the pile too.

...Paul





From llurch at networking.stanford.edu  Tue Jun 11 04:46:34 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Tue, 11 Jun 1996 19:46:34 +0800
Subject: InfoWar and a.r.s
In-Reply-To: <199606102213.PAA28725@netcom7.netcom.com>
Message-ID: <Pine.GUL.3.93.960611001504.26593C-100000@Networking.Stanford.EDU>


On Mon, 10 Jun 1996, Bill Frantz wrote:

> One question to ponder is whether the a.r.s war will perform the same role
> as the Spanish Civil War vs. WW2.  Will we see newsgroup war expand to
> other news groups?  I would think a few of the .culture.* groups could be
> candidates.

Already happened. That's why soc.genealogy.african went moderated a few
months ago. The people in soc.culture.jewish deal with it by posting a
killfile FAQ regularly. Looks like soc.culture.latin-american, which I
followed for academic reasons three years ago, just gave up, splitting into
country-specific groups that are moderated. Pity.

alt.slack beat them off because, well, they're so much smarter and funnier
than any troller. :-)

Some (supposedly) closed mailing lists are openly talking about a vertical
spam of alt.revisionism. Someone new to alt.revisionism might think it has
already happened, but in fact the group is eminently readable and productive
for both sides if you killfile just two people, and followups to their
articles (three if you count the current incarnation of Serdar Argic, who
should be in everyone's global killfile). 

The general mood in news.groups is tilting towards at least robo-moderation
(posts handled by an automatic script that can have a twit filter). I think
it's a shame.

-rich






From nobody at REPLAY.COM  Tue Jun 11 05:13:30 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 11 Jun 1996 20:13:30 +0800
Subject: A guide to self control (Was funny underwear)
Message-ID: <199606110758.JAA15624@basement.replay.com>


  A Guide to Self-Control
 
  Subject: Steps in Overcoming Masterbation
 
 Excerpt from a Mormon missionary guide, circa 1970: Steps in
 Overcoming Masterbation, Mark E. Petersen

   1. Never touch the intimate parts of your body except during normal
       toilet processes.

   2. If you are associated with other persons having this same
      problem, YOU MUST BREAK OFF THEIR FRIENDSHIP. Never associate
      with other people having the same weakness. Don't suppose that
      two of you will quit together, you never will. You must get away
      from people of that kind. Just to be in their presence will keep
      your problem foremost in your mind. The problem must be taken OUT
      OF YOUR MIND for that is where it really exists. Your mind must
      be on other and more wholesome things.

   3. When in bed, if that is where you have your problem for the most
      part, dress yourself for the night so securely that you cannot
      easily touch your vital parts, and so that it would be difficult
      and time consuming for you to remove those clothes. By the time
      you started to remove protective clothing you would have
      sufficiently controlled your thinking that the temptation would
      leave you.

   4. If the temptation seems overpowering while you are in bed, GET
      OUT OF BED AND GO INTO THE KITCHEN AND FIX YOURSELF A SNACK, 
      even  if it is in the middle of the night, and even if you are not
      hungry, and despite your fears of gaining weight. The purpose
      behind this suggestion is that you GET YOUR MIND ON SOMETHING
      ELSE. You are the subject of your thoughts, so to speak.

   5. Never read pornographic material. Never read about your problem.
      Keep it out of mind. Remember -- "First a thought, then an act."
      The thought pattern must be changed. You must not allow this
      problem to remain in your mind. When you accomplish that, you
      soon will be free of the act.

   6. Pray. But when you pray, don't pray about this problem, for that
      will tend to keep [it] in your mind more than ever. Pray for
      faith, pray for understanding of the Scriptures, pray for the
      Missionaries, the General Authorities, your friends, your
      families, BUT KEEP THE PROBLEM OUT OF YOUR MIND BY NOT 
      MENTIONING  IT EVER -- NOT IN CONVERSATION WITH OTHERS, 
      NOT IN YOUR PRAYERS.  KEEP IT _OUT_ of your mind!

   7. Be outgoing and friendly. Force yourself to be with others and
      learn to enjoy working and talking to them. Use principles of
      developing friendships found in books such as _How to Win Friends
      and Influence People_ by Dale Carnegie.

   8. Make a pocket calendar for a month on a small card. Carry it with
      you, but show it to no one. If you have a lapse of self control,
      color the day black. Your goal will be to have _no black days_.
      The calendar becomes a strong visual reminder of self control and
      should be looked at when you are tempted to add another black
      day. Keep your calendar up until you have at least three clear
      months.

   9. In the field of psychotherapy there is a very effective technique
      called _aversion therapy_. When we associate or think of
      something very distasteful with something which has been
      pleasurable, but undesirable, the distasteful thought and feeling
      will begin to cancel out that which was pleasurable. If you
      associate something very distasteful with your loss of
      self-control it will help you to stop the act. For example, if
      you are tempted to masturbate, think of having to bathe in a tub
      of worms, and eat several of them as you do the act.

  10. Keep your bladder empty. Refrain from drinking large amounts of
       fluids before retiring.

  11. Reduce the amount of spices and condiments in your food. Eat as
       lightly as possible at night.

  12. Avoid people, situations, pictures or reading materials that
       might create sexual excitement.

  13. It is sometimes helpful to have a physical object to use in
       overcoming this problem. A Book of Mormon, firmly held in hand,
       even in bed at night has proven helpful in extreme cases.

  14. In very severe cases it may be necessary to tie a hand to the bed
       frame with a tie in order that the habit of masturbating in a
       semi-sleep condition can be broken.

  15. Do not let yourself return to any past habit or attitude patterns
       which were part of your problem. Satan Never Gives Up. Be calmly
       and confidently on guard. Keep a positive mental attitude. You
       can win this fight! The joy and strength you will feel when you
       do will give your whole life a radiant and spiritual glow of
       satisfaction and fulfillment.

--





From perry at alpha.jpunix.com  Tue Jun 11 07:35:11 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Tue, 11 Jun 1996 22:35:11 +0800
Subject: New type2.list/pubring.mix (revisited)
Message-ID: <Pine.NEB.3.93.960611053615.27871B-100000@alpha.jpunix.com>


-----BEGIN PGP SIGNED MESSAGE-----

Hello Everyone,

	The corrected (downed remailers deleted) type2.list/pubring.mix
combination is available on jpunix.com. This list now contains only
remailers that have responded to pings sent out by myself and by Raph. 
I'll automate this shortly to insure that the remailers on the list
actually respond to traffic. 

	Apologies to ecafe for saying it was down. It was poor eysight on
my part.

 John Perry - perry at alpha.jpunix.com -  PGP-encrypted e-mail welcome!
 WWW - http://www.jpunix.com
 PGP 2.62 key for perry at jpunix.com is on the keyservers.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCUAwUBMb1PQ1OTpEThrthvAQHn7gP4rHjupKUM4hWPsbFIxdXWk09KdEZLbpK3
uumHpAlApXfu7n9umOG1evxp9SRy9yUg3PvtV5pHtMGcebv8ngpQEzDekC55RCBz
Rghon7Rqknte+9eRbpbqhq1e/LAzebxwJv+vRSOkYEOmiq6KWdhQ0LZyGjV1VfHA
D/eWCOf2ig==
=w/xe
-----END PGP SIGNATURE-----





From dlv at bwalk.dm.com  Tue Jun 11 08:44:00 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Tue, 11 Jun 1996 23:44:00 +0800
Subject: 
In-Reply-To: <Pine.LNX.3.93.960610205205.922M-100000@smoke.suba.com>
Message-ID: <gaVcPD5w165w@bwalk.dm.com>


snow <snow at smoke.suba.com> writes:
...
> 	It is almost ridicoulously simple to kill someone in a relatively
> untraceable fashion. Any person of average intelligence can do a little
> research (say about 3 hours at a decent (non-chicago) library) and spend
> an hour or two in thought and come up with a way to target a non- to
> moderately public figure with out getting caught.
> 	I can give you 4 right off the top of my head that have a
> reasonable chance of sucess, and very little chance of discovery.

Please do - thank you.

With purely academic interest,

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From gary at systemics.com  Tue Jun 11 08:55:44 1996
From: gary at systemics.com (Gary Howland)
Date: Tue, 11 Jun 1996 23:55:44 +0800
Subject: [Fwd: public key expert witness wanted]
Message-ID: <31BD5FC2.15FB7483@systemics.com>

>From sci.crypt:


Subject: public key expert witness wanted
From: schlafly at bbs.cruzio.com
Date: Mon, 10 Jun 1996 05:37:34 GMT
Keywords: public key expert witness wanted
Newsgroups: sci.crypt,misc.int-property,talk.politics.crypto
Organization: Cruzio Community Networking System, Santa Cruz, CA
Reply-To: schlafly at bbs.cruzio.com
Sender: news at cruzio.com (The News User)
Xref: beta.nedernet.nl sci.crypt:44606 misc.int-property:17035 talk.politics.crypto:17141


My lawsuit against Public Key Partners has a trial on the
scope and validity of the Stanford patents scheduled to
begin in San Jose, Calif, on Sept. 3, 1996.  I am looking
for an expert witness.

Requirements:

* credentials which will impress the court.
* live within driving distance of San Jose.
* thorough understanding of Diffie-Hellman exponential key exchange,
Hellman-Merkle trapdoor knapsack, and related public key crypto.
* willing to face hostile lawyers in depositions, and testify in court.
* must enjoy this sort of thing enough to do it for free.

I am not looking for a mercenary hatchet man.  (Contact RSADSI or
Cylink if that's what you are.)  Just someone to explain the
inventions, and give opinions as to what can reasonably be deduced
from particular disclosures.

For more info on the lawsuit, and on contacting me, see
     http://bbs.cruzio.com/~schlafly#pkpsuit

Roger Schlafly





From moroni at scranton.com  Tue Jun 11 09:35:16 1996
From: moroni at scranton.com (Moroni)
Date: Wed, 12 Jun 1996 00:35:16 +0800
Subject: Slander of Catholic Church
In-Reply-To: <Pine.3.89.9606110041.A8374-0100000@netcom13>
Message-ID: <Pine.LNX.3.91.960611082225.787A-100000@user1.scranton.com>



      Tim ,
          You should stick to your own religion and not criticize other 
peoples. It is unforunate that the esteem that I once felt for you is 
dwindling because of your anti-Mormon trash. Perhaps you do not realise 
that some people take more than an academic interest in their religion 
;this is unforunate . It is pitiful.You are becomeing the ugly 
American that foreigners hate; always having an opinion about everything.
                               moroni






From ddrew at mci.net  Tue Jun 11 12:39:01 1996
From: ddrew at mci.net (Dale Drew)
Date: Wed, 12 Jun 1996 03:39:01 +0800
Subject: Terrorism Hysteria on the Net
Message-ID: <199606111102.HAA26811@druid.reston.mci.net>




I think we are in violent agreement....

The item of issue, between physical and virtual terrorism attacks 
is the  fact the government either is, or wants to give the distinct 
perception that they are, ill-prepared to counter for the types of 
potentials wide-spread Internet-based virtual attacks.  And that the  
intelligence channels they have in place to detect possible movement 
of physical attacks may not fit the "Internet" model.

In addition, the US legal system is ill-prepared to deal with the
prosecutory issues surrounding this type of "terrorism".

===============================================================
Dale Drew                                MCI Telecommunications
Manager                                    internetMCI Security
                                                    Engineering
Voice:  703/715-7058                    Internet: ddrew at mci.net
Fax:    703/715-7066                MCIMAIL: Dale_Drew/644-3335


At 11:02 PM 6/10/96 -0500, snow wrote:
>On Mon, 10 Jun 1996, Dale Drew wrote:
>> At 07:21 PM 6/10/96 -0500, snow wrote:
>> >On Wed, 5 Jun 1996, John Young wrote:
>> >> "You bring me a select group of hackers and within 90 days I'll bring this
>> >> country to its knees, " says Jim Settle, retired director of the FBI's
>> >> computer crime squad. 
>> >	Give me 15 well trained soldiers(near special forces level) and I
>> >can do it in less than 60 days. Without touching a computer. 
>> To understand where "They" think they are coming from, you have to compare
>> Apples-to-Apples.  The concern is the medium of choice; the Internet and it's
>> high availability of anonymity, coupled with its access to large amounts of
>> computer systems available via one virtual channel.
>
>	Preaching to the choir, but once again it is a case of nothing
>new. The potential for economic terrorism is not significantly larger
>given the existance of the internet than it was before. This is what needs
>to constantly be drummed into the technically dis-inclined, that the same
>problems exists off the net that exist ON the net.
> 
>> A well orchestrated and well researched attack by the right folk, as the
thought
>> process goes, could in-fact, potentially affect large amounts of critical
>> computer systems within a short period of time. And while the government
>> has inroads available to identify potential physical terrorists threats,
>> they do not feel as prepared for the virtual ones.
>
>	I would think that shutting down power to New York City for more
>than a couple of days would pretty much throw the economy into a fit. 
>
>	I would go so far as to say that you can cause MORE havoc in the
>physical arena than the virtual. 
>
>
>Petro, Christopher C.
>petro at suba.com <prefered for any non-list stuff>
>snow at crash.suba.com
>
>
>






From sinclai at ecf.toronto.edu  Tue Jun 11 13:19:18 1996
From: sinclai at ecf.toronto.edu (SINCLAIR DOUGLAS N)
Date: Wed, 12 Jun 1996 04:19:18 +0800
Subject: ANNOUNCEMENT: HACKERPUNKS MAILING LIST
In-Reply-To: <199606110351.FAA03834@basement.replay.com>
Message-ID: <96Jun11.101251edt.10956@cannon.ecf.toronto.edu>


I don't have a C2 account, and don't really want to pay for one.
I trust someone will put the hackerpunks archives on the web so
the rest of us can read them.





From eric at clever.net  Tue Jun 11 13:33:23 1996
From: eric at clever.net (eric traudt)
Date: Wed, 12 Jun 1996 04:33:23 +0800
Subject: [Noise] William Safire on the GAK bastards' other privacy violations.
Message-ID: <v02140b00ade2700d75f4@[204.249.244.13]>


WILLIAM SAFIRE: Shame on the FBI


WASHINGTON (Jun 10, 1996 12:00 p.m. EDT) -- Overlooked in the scandal of
Travelgate has been the failure of FBI Director Louis Freeh to protect the
confidential files of citizens from political snoops. Say what you like about J.
Edgar Hoover -- he never let the bureau become a doormat for White House aides.

The background: when President Clinton claimed "executive privilege" to keep
3,000 embarrassing documents from investigators, Congress threatened White House
Counsel Jack Quinn with criminal contempt. To avoid jail, he forked over a
thousand of the least damning documents.

One of them illuminates why Clinton has been stonewalling for years on the rest
of the subpoenaed files. It is a requisition to the "FBI Liaison," ostensibly
from then-White House Counsel Bernard Nussbaum, for the confidential files on
Billy Ray Dale, the travel office employee who had been fired seven months
earlier to make room for a Clinton cousin. The FBI disgorged 22 letters and
reports on Ray alone; he was then besmeared by White House officials in the
press, unjustly prosecuted and financially ruined, before being acquitted by a
jury in two hours.

The requisition for the confidential FBI files was unsigned. The name typed
on it
was Bernard Nussbaum, but Nussbaum now says he had "absolutely no knowledge" of
such a request, and would presumably swear to that. The reason given on the
fraudulent requisition was "access" -- as if Ray were trying to get back
into the
White House, which was untrue.

That was the tip of the iceberg. Despite "executive privilege," Congressman
William Clinger learned that as many as 341 such fraudulent, unsigned requests
for confidential files and name checks were sent under the Nussbaum typed
name to
FBI headquarters. Apparently the snoop was a Clinton political appointee who
preferred anonymity.

The cover story peddled by Clinton aides is that this was a "routine"
updating of
White House files by a stupid clerk that just happened to focus on holdover
Republicans, as well as other Republican political suspects -- including a
former
secretary of state whose aides once improperly snooped into Clinton passport
files. Clinton's lawyers claim that the fraudulently obtained FBI dossiers were
put in a White House vault and nobody looked at them.

What's being done in response to the most egregious invasion of privacy of U.S.
citizens in a generation? Not much. President Clinton says he's sorry, but
continues to stonewall on 2,000 documents; the independent counsel adds
this mess
to his Travelgate list; and the FBI announces a "thorough" investigation by its
in-house counsel, who will rebuke some low-level agent and absolve the boss.

Not good enough. After FBI agents were jerked around to provide political cover
for Clinton patronage moves in 1993, Attorney General Reno and Freeh promised
strict scrutiny of White House requests. They failed abysmally to keep citizens'
confidential files safe from politicians' eyes.

Think of it: Unverified slanders and gossipy tidbits in your FBI file have been
vulnerable to an unsigned form letter from a political partisan hiding behind
another person's name. Under Freeh, the anti-encryption zealot hand-picked
by the
man whose name was used on the phony requisitions, the Justice Department's most
confidential file room has become a walk-in closet for White House pols.

Nobody at Freeh's unbuttoned FBI bothered to ask: What individual wants this and
for what lawful purpose? Can any anonymous bureaucrat requisition, rifle through
and remove confidential records? How come not one agent was required by bureau
policy to ask why not even initials appeared on hundreds of requests to check up
on Republicans?

What a scandalously sloppy way to run a police agency. To entrust the
investigation of this unprecedented hemorrhage of FBI confidentiality to
the same
easily manipulated Justice Department invites a whitewash.

Summer civil libertarians shade their eyes when personal privacy is invaded by
political allies, but this top-level failure to resist an abuse of power dismays
FBI agents in the field. When Clintonites send over for the file on me, Director
Freeh, don't buy their baloney about "seeks access" -- I won't be going to the
White House picnic this summer.







From jf_avon at citenet.net  Tue Jun 11 14:52:27 1996
From: jf_avon at citenet.net (Jean-Francois Avon)
Date: Wed, 12 Jun 1996 05:52:27 +0800
Subject: lambda 2.08 (1/2) - Surveillance du contenu : l'oeil biais_
Message-ID: <9606111452.AA07175@cti02.citenet.net>


On 10 Jun 96 at 19:08, Jerome Thorel wrote:

> DANS LE NUMERO --> 2.08 <-- du bulletin lambda
> http://www.freenix.fr/netizen/
<snip>

> - Les agents, lors des PV, ne signent plus par leur nom, mais par
> des numeros d'immatriculation, a remarque la revue Chroniques

Bonjour Jerome!

Que signifie PV?

Traduction libre par: / non-official translation by: 
jf_avon at citenet.net

... The agents, during PVs(?), are not signing with their own names anymore 
but with an ID number, pointed out "Chroniques" magazine...


La version anglaise de ce texte a-t-elle ete envoye a 
cypherpunks at toad.com?

Si non, pourriez-vous l'y envoyer.  Aussi, en faire parvenir une 
copie anglaise a jimbell at pacifier.com, ca sera du plus grand interet 
pour lui.

Salutations

JFA
 DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal
 JFA Technologies, R&D consultants: physicists, technologists and engineers.

 PGP keys at: http://w3.citenet.net/users/jf_avon
 ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891 
 





From jya at pipeline.com  Tue Jun 11 15:53:01 1996
From: jya at pipeline.com (John Young)
Date: Wed, 12 Jun 1996 06:53:01 +0800
Subject: USS_hit
Message-ID: <199606111358.NAA28670@pipe2.ny3.usa.pipeline.com>


   6-11-96. FiTi: 
 
   "US squares up to cyberterrorists." 
 
      Until recently, the concept of "information warfare" has 
      been widely dismissed as alarmist rhetoric and viewed as 
      "post Cold War hysteria" generated by those with an 
      interest in maintaining the vast US intelligence 
      apparatus. But the potential use of computer networks to 
      undermine public confidence, disrupt essential services, 
      play havoc with the economy or damage military 
      capabilities is now being taken seriously in Washington. 
 
      Encryption may be just one of many battlegrounds -- 
      others include: proposals for mandatory reporting of 
      corporate computer intrusions and for exceptions to US 
      laws that prohibit intelligence agencies from snooping 
      on domestic communications; the forthcoming ruling by US 
      courts on free speech on the Internet, in response to 
      laws aimed at stopping distribution of pornographic 
      material; and possible limits on information that 
      marketers may gather and use about children who surf the 
      Internet. Also the Clinton administration is planning a 
      rapid-response team to take charge in the event of a 
      cyberterrorist attack. 
 
   USS_hit 
 
 





From jimbell at pacifier.com  Tue Jun 11 16:58:37 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 12 Jun 1996 07:58:37 +0800
Subject: USS_hit
Message-ID: <199606111637.JAA06542@mail.pacifier.com>


At 01:58 PM 6/11/96 GMT, John Young wrote:
>   6-11-96. FiTi: 
> 
>   "US squares up to cyberterrorists." 
> 
>      Until recently, the concept of "information warfare" has 
>      been widely dismissed as alarmist rhetoric and viewed as 
>      "post Cold War hysteria" generated by those with an 
>      interest in maintaining the vast US intelligence 
>      apparatus. But the potential use of computer networks to 
>      undermine public confidence,

The government is doing an excellent job `"undermining public confidence" 
all by itself!


 >disrupt essential services,

"essential" in whose opinion?

 
>      play havoc with the economy 

Like maybe massive deficit spending, high taxes, etc for decades?

>or damage military 
>      capabilities is now being taken seriously in Washington. 

How about "damage military NEEDS"?



Jim Bell
jimbell at pacifier.com





From mpd at netcom.com  Tue Jun 11 17:25:56 1996
From: mpd at netcom.com (Mike Duvos)
Date: Wed, 12 Jun 1996 08:25:56 +0800
Subject: Slander of Catholic Church
In-Reply-To: <Pine.LNX.3.91.960611082225.787A-100000@user1.scranton.com>
Message-ID: <199606111558.IAA21479@netcom23.netcom.com>


Joseph Smith hallucinates again and writes:

> It is unforunate that the esteem that I once felt for you is 
> dwindling because of your anti-Mormon trash. Perhaps you do not realise 
> that some people take more than an academic interest in their religion 
> ;this is unforunate.

If people want to believe in a religion which combines the best features 
of anthropomorphic sky-God worship with a UFO contactee cult, that is their
Constitutional right, giggling from the audience notwithstanding. 

I believe it was Thomas Jefferson who said that the voluminous amount of
theological writings by Christian scholars existed only because "nonsense
can never be explained."  I tend to concur.

Most religious doctrine is just a lot of energized enthusiasm.

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     mpd at netcom.com     $    via Finger.                      $





From hfinney at shell.portal.com  Tue Jun 11 18:30:38 1996
From: hfinney at shell.portal.com (Hal)
Date: Wed, 12 Jun 1996 09:30:38 +0800
Subject: Anonymous return addresses
Message-ID: <199606111814.LAA19675@jobe.shell.portal.com>


From: "Robert A. Rosenberg" <hal9001 at panix.com>
> If the message is split into more than one part (to meet the message size
> requirement) there is some potential leakage to each server of what message
> is being requested. If User a requested 3 messages, then they MAY be
> requesting all three parts of a 3 part message (or 2+1). If a record is
> kept of the number of requests over time, then there can be some regression
> checking based on the ID (ie: If the number of new messages for ANx in the
> DB matches the number that User Y requests in the current session). I may
> be in error with this thought but it looks like a possible problem.

Yes, this is a good point.  It might be addressed by having the later
parts of a multi part message not be identified with the anon ID of the
receiver, but rather with a random message label which is revealed to the
receiver in the first part of the message (encrypted, of course).  Then
the database owner could not tell which message parts went together just
by looking at the messages.  Arrival times might give this away, though,
if all parts of a multi-part message were sent at about the same time.

> >Messages would have a finite lifetime and would expire and be removed
> >from the database after a while.  The authors propose breaking the
> >database up into batches with a fixed number of messages, but I don't
> >fully follow the reasoning behind this.  I guess it reduces the load on
> >the server when it does its XOR's.
> 
> This can also affect the "attack" I speculated on above since it can "leak"
> more info. Multi-part messages (or multiple messages to the same recipient)
> which are retrieved in one session can be correlated between the groups
> (ie: User Y asked for 5 messages [Selected from Groups 1&5] and ANx is the
> one AN? that has the requested number of messages in each of the Groups
> [ie: 3 from G1 and 2 from G5]).

Yes, there is a tradeoff with the batch size between efficiency and
privacy.  The multi-part message issue does seem to make the problem
potentially worse.  Maybe it would be necessary for anonymous receivers
to mostly receive small messages, and/or make the message granularity
relatively large.

Some of these kinds of volume- or correlation-based traffic analysis
techniques can be countered by requesting dummy messages, ones which the
receiver won't be able to read.  If he asks for five messages every day
from that day's batch then it doesn't leak any information about which
ones are for him.  Asking for a random number averaging five may work
even better, if occasionally he really needs to read six.

Hal





From bshantz at nwlink.com  Tue Jun 11 20:03:26 1996
From: bshantz at nwlink.com (Brad Shantz)
Date: Wed, 12 Jun 1996 11:03:26 +0800
Subject: Kahn's "The CodeBreakers"
Message-ID: <199606111757.KAA02353@montana.nwlink.com>


Good call, Tim.  That is correct.  I had forgotten. 

> Ah, but it does have some significance. "Liberty" is published out of Port
> Townsend. (More precisely, it was the last time I looked.)
 
> And it's near Hump Tulips, Sequim, and Chimicum (sp?). Ma and Pa Kettle country.

Sequim is further west along the Olympic Peninsula, and Chimacum is 
just south of Port Townsend towards Port Hadlock and the Hood Canal 
bridge.

Once again, good call, Tim.
 





From stephan at studioarchetype.com  Tue Jun 11 20:05:18 1996
From: stephan at studioarchetype.com (Stephan Vladimir Bugaj)
Date: Wed, 12 Jun 1996 11:05:18 +0800
Subject: Micropayments are Crap
In-Reply-To: <199606060257.TAA16018@netcom.netcom.com>
Message-ID: <v03006f04ade3579bc415@[204.162.75.169]>


As far as I'm concerned Micropayments as appealing to me as Data Mining.  I
certainly see how my wallet would benefits from being on the receiving end of
the money and/or information, but I can also clearly see the detrements of
being the one whose money and information was "automagically" being
appropriated. The technical concerns are many, any secure system can be
broken by someone with enough skill and resources, but the social concerns are
more difficult to address. For example, it's great if the browser logs
client side transactions that can't be spoofed because the wallet knows where
it sent money, but try convincing a vendor who is already suspicious of
'all this computer stuff' that you really sent them some money and a savvy
hacker pilfered it all - log or no log.

Setting a micropayment enabled web browser to automatically grant approval to
payments of $.02/action may seem reasonable, but it depends on what the vendor
has decided constitues an action.  If somone charged $.02/nanosecond for
retreiving shareware from an FTP library, and my browser was set to accept this
as reasonable based on the fact that it was $.02/action, I would have no idea
what an exhorbitant rate I was paying for access until my 'wallet' was emptied
by downloading the README file... this kind of rate swindling already goes on
in the telephone industry and would be even easier on a system like the
internet
where people habitually connect with unknown parties to check out the
offerings.
This doesn't happen with phones (well, not as much).  The virtual nomadness of
wandering the net leaves a lot of people - even otherwise careful people -
vulnerable to rate traps.

Micropayment proponents are incredibly fond of the proposition that software
could be leased on a usage time basis from a centralized server, and people
could also rent time on the servers' CPUs.  Sounds an awful lot like the
mainframe days to me.  I see plenty of ways in which this benefits the
vendor
(greater control over distribution, centrailzed revision/upgrade distribution,
greater profits over one-time sales, etc.), but no ways in which this benefits
the user.  Especially the power user.  I'm certainly not going to rent time
on a compiler or image editing program every single time I want to do some
work.
It took the industry long enough to get PCs and workstations to the speeds
they're at today so people could do their own work on their own machines to
go back to waiting in a queue for time on a centralized system so you can
have the honor of paying someone a lot of money to run your job.  As a
programmer, I can
see how I could make a fat chunk of change by bilking people through metered
software usage, but as a software consumer it seems like a rotten idea.  One
effect it would have, however, would be an exponential increase in the quality
and quantity of software available from the Free Software Foundation and
other similar groups as people like myself fled en-masse from commercial
software to a
system where we knew what we were getting into ahead of time.

The other rotten part of this idea, of course, is the irritating lag times
involved with trying to run distributed software (especially poorly
distributed
software, and especially on an overloaded network infrastructure).

Looking at micropayments from the (economically) conservative element
viewpoint within certain industries make them seem a lot less appealing, as
well.  Take television.  If people had to purchase every TV show they
watched, there would be a lot less TV production going on because there
wouldn't be as much random TV watching.   No matter how stupid you may
think your customers are, if you change their pay structure they think
about it - even if only briefly.  It would also be harder to sell TV
advertising, because if nobody was watching a show everyone would know
because this would be metered even better than current rating systems.  The
nature of the TV advertising industry would change because instead of the
archetypal/statistical sampling of Nielsen ratings, you'd know *exactly*
who was watching what.

Both micropayments and data mining require that the user give the vendor a
level of trust which most vendors are not willing to repay with similar
trust and customer satisfaction.  Customer-users are expected to give
vendors greater access to and control over their money and personal
information, yet at best they can expect the same poor customer service and
bureaucratic attitudes encountered when dealing with traditional
transaction processing companies and at worst can expect to be swindled out
of piles of money and/or have their
privacy violated as a matter of course.

Working where I do, everyone around me is on the side of the vendors - who
make up part of our client base.  On cypherpunks, of course, I'm largely
preaching to the converted.  There can be a middle ground, however the
middle ground that's been offered so far still leaves the consumer with the
sort end of the stick and
I'm not convinced they're ultimately what's best for business - especially if
you cling to seemingly outdated ideas like good customer relations, good
public/social relations, and long range growth relationships over short
term
profit pumping.


ttl
Stephan

-------------------------------------------------------------------
This signature has been kidnapped by space aliens.
If you find it you can call (415) 703-8748.
I work for Studio Archetype, and they don't find any of this funny.







From nelson at crynwr.com  Tue Jun 11 20:50:02 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Wed, 12 Jun 1996 11:50:02 +0800
Subject: Micropayments are Crap
In-Reply-To: <199606060257.TAA16018@netcom.netcom.com>
Message-ID: <19960611184817.21676.qmail@ns.crynwr.com>


Stephan Vladimir Bugaj writes:

 > Setting a micropayment enabled web browser to automatically grant approval to
 > payments of $.02/action may seem reasonable, but it depends on what the vendor
 > has decided constitues an action.  If somone charged $.02/nanosecond for
 > retreiving shareware from an FTP library, and my browser was set to accept this
 > as reasonable based on the fact that it was $.02/action,

You could also set a per-site limit, or a per-minute limit.

 > It took the industry long enough to get PCs and workstations to the
 > speeds they're at today so people could do their own work on their
 > own machines to go back to waiting in a queue for time on a
 > centralized system so you can have the honor of paying someone a
 > lot of money to run your job.  As a programmer, I can see how I
 > could make a fat chunk of change by bilking people through metered
 > software usage, but as a software consumer it seems like a rotten
 > idea.

Oh?  Would you rather pay $5,000 for some vertical piece of software,
or license its use on a $1/hour basis?  Even if you used it every hour
of every workday, that's only $2,000.

 > Looking at micropayments from the (economically) conservative element
 > viewpoint within certain industries make them seem a lot less appealing, as
 > well.  Take television.  If people had to purchase every TV show they
 > watched, there would be a lot less TV production going on because there
 > wouldn't be as much random TV watching.

Um, you *do* purchase every TV show.  On the fly.  30 seconds at a
time.  Of course, some cheap people try to welsh [ see my hostname
before taking offense ] on their payments by Going To The Bathroom
during their payment periods!  Disgraceful, just disgraceful.

 > Both micropayments and data mining require that the user give the vendor a
 > level of trust which most vendors are not willing to repay with similar
 > trust and customer satisfaction.  Customer-users are expected to give
 > vendors greater access to and control over their money and personal
 > information, yet at best they can expect the same poor customer service and
 > bureaucratic attitudes encountered when dealing with traditional
 > transaction processing companies and at worst can expect to be swindled out
 > of piles of money and/or have their
 > privacy violated as a matter of course.

Hmmm...  Sounds like a job for ...  Super-Shameer!  Profit-making
super hacker privacy protector!  His mail flies through remailers with
the greatest of ease, he's invincible to flames, and and he is cute,
too!

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software   | Crynwr Software sells packet driver support | PGP ok
11 Grant St.      | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676 | +1 315 268 9201 FAX   | the side of freedom.





From gary at systemics.com  Tue Jun 11 21:30:39 1996
From: gary at systemics.com (Gary Howland)
Date: Wed, 12 Jun 1996 12:30:39 +0800
Subject: Terrorism Hysteria on the Net
In-Reply-To: <Pine.LNX.3.93.960610191530.922E-100000@smoke.suba.com>
Message-ID: <31BDA18F.2C67412E@systemics.com>


snow wrote:
> 
> On Wed, 5 Jun 1996, John Young wrote:
> 
> > Today's USA has a pair of front page stories:
> > "Feds ready anti-terror cyberteam" and "Terrorism on the Net -- Post-Cold
> > War hysteria or a national threat?"
> > They lay out the nightmares and the valiant TLA-daydreams to out-fund the
> > hackers and out-flummox the public.
> > "You bring me a select group of hackers and within 90 days I'll bring this
> > country to its knees, " says Jim Settle, retired director of the FBI's
> > computer crime squad.
> 
>         Give me 15 well trained soldiers(near special forces level) and I
> can do it in less than 60 days. Without touching a computer.

Give me 10 well trained biological warfare scientists and I'll do it
in 30 ...

Any more bids?  :-)

Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06





From attila at primenet.com  Tue Jun 11 21:38:51 1996
From: attila at primenet.com (attila)
Date: Wed, 12 Jun 1996 12:38:51 +0800
Subject: A guide to self control (Was funny underwear)
Message-ID: <199606111759.KAA05005@primenet.com>


** Reply to note from nobody at REPLAY.COM 06/11/96 09:58am +0200

= To: Cypherpunks at toad.com
= From: nobody at REPLAY.COM (Anonymous)
= 
=   A Guide to Self-Control
=  
=   Subject: Steps in Overcoming Masterbation
=  
=  Excerpt from a Mormon missionary guide, circa 1970: Steps in
=  Overcoming Masterbation, Mark E. Petersen
= 
=    1. Never touch the intimate parts of your body except during normal
=        toilet processes.
=
	you forgot to add the dictum on how long you are allowed to wash it 
    in the shower...

--
  "Privacy Through Cryptography."
  "Communicate Globally, Censor Locally."

    I think an old Doonesbury cartoon that had Duke (representing
    the NRA) testifying before a Senate subcommittee summed it up
    quite nicely.....

    Senator: "And we and the American people have had enough of you and
      your fanatic organization!"

    Duke: "I see Senator, shall I put you down for a million postcards?"

    Senator: "Don't you threaten me mister!"

    Politicians only understand one thing.








From markm at voicenet.com  Tue Jun 11 21:46:12 1996
From: markm at voicenet.com (Mark M.)
Date: Wed, 12 Jun 1996 12:46:12 +0800
Subject: ANNOUNCEMENT: HACKERPUNKS MAILING LIST
In-Reply-To: <96Jun11.101251edt.10956@cannon.ecf.toronto.edu>
Message-ID: <Pine.LNX.3.93.960611160145.176A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 11 Jun 1996, SINCLAIR  DOUGLAS N wrote:

> I don't have a C2 account, and don't really want to pay for one.
> I trust someone will put the hackerpunks archives on the web so
> the rest of us can read them.

Alpha nyms are free.  See http://alpha.c2.org for details.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMb3RXrZc+sv5siulAQGHtQQApTTIrifjyfZtQiUMF3AsTnHoAeCVlYWm
/siLEzaEfFcpmYUrNNb2GMrLiH5S/rpKRpPfLgojJ9ezRdNO7CnEj+4zZl1vK4a2
jkeRC8HZIW3oPpFbPGrAbowKirBZNJm/egfdWQoks4moNT2VCg8EjOzBm2gOwXX4
6wqWv0PRah0=
=9DP7
-----END PGP SIGNATURE-----





From vin at shore.net  Tue Jun 11 21:54:37 1996
From: vin at shore.net (Vin McLellan)
Date: Wed, 12 Jun 1996 12:54:37 +0800
Subject: Terrorism Hysteria on the Net
Message-ID: <v02140b02ade3451bc523@[198.115.179.222]>


        Ex-Special-Agent Settle deserves all the derision he has gotten
(probably not in the right places) for his LSD-in-the-water-supply threat:

>> >> "You bring me a select group of hackers and within 90 days I'll bring
>> >> this country to its knees, " says Jim Settle, retired director of the
>> >> FeeBee's computer crime squad.

        snow's jibe about doing the same with a handful of spooky special
forces guys (less than 15, if he used snipers) was appropriate.

        I think, however, Dale Drew went too far when he denied that the
demension of the Net added nothing new to the range of social or economic
threat.  Don't we, as a technical culture, have to acknowledge the
burgening nihilism that is exemplified in both the subculture of virus (and
other randomly distructive pieces of attack code,) and the larger culture
that so often lauds their "creativity" and "ingenuity."  Not even
lumpen-Libertarianism allows the author of such pain and distruction to
escape moral responsibility -- yet the popular tech culture (and the pop
culture) does just that!

        The culture can deal with purposeful terrorism, even purposeful Net
terrorism,  but a whole subculture of sociopaths who -- like arsonists on a
binge, or (to exaggerate slightly) the nerve gas cult in Japan -- toss out
distructive code bombs to see who or what gets blown away, is indeed
something new.

        How many wild viruses are now loose?  What new corners of the
networked infrastructure will be the next forum for these arsonists?  Java
applets?  NT?  The nodes of the Net itself?

        Is this too to be left to police suppression?  Are Net Cops
inevitable?  Are there other forces that could be brought to bear?  (Forces
that could perhaps be influenced by the tone or substance of comments that
originate here or in similar forums?)  And isn't this threat unique to a
culture which has become so dependant on the structured flow of information
products and tools?

        The sky isn't falling; there are no bodies in the street -- so we
have time... but the sense of threat could become so serious that the
public would seek shelter, solice, stability. The spooks' wet-dream, the
wiretapped Garrison Nation (two-way TV always on; no one allowed to whisper
away from a microphone)  is one answer.  Of a sort.

        Suerte,

                        _Vin

         Vin McLellan +The Privacy Guild+ <vin at shore.net>
      53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548
                         <*><*><*><*><*><*><*><*><*>







From WICKERT at vortex.ufrgs.br  Tue Jun 11 22:02:49 1996
From: WICKERT at vortex.ufrgs.br (WICKERT at vortex.ufrgs.br)
Date: Wed, 12 Jun 1996 13:02:49 +0800
Subject: HomePage
Message-ID: <01I5SB8NRK040004XD@vortex.ufrgs.br>


Have Toad Hall a HomePage? I tried http://www.toad.com but I got no response!

Best Regards,
Ricardo Wickert





From blake at bcdev.com  Tue Jun 11 22:15:31 1996
From: blake at bcdev.com (Blake Coverett)
Date: Wed, 12 Jun 1996 13:15:31 +0800
Subject: ANNOUNCEMENT: HACKERPUNKS MAILING LIST
Message-ID: <01BB57A1.75690A70@bcdev.com>


>                       H  A  C  K  E  R  P  U  N  K  S  
>                        "Obscurity through Security!"
> 
> 
> Hi! We are delighted to announce a new mailing list, Hackerpunks! This list
> is for serious folks who know stuff about computers _AND_ want to keep
> their privacy.

Oooo.  Folks who know 'stuff' about computers.  The free world is in danger now.

> This list is UNMODERATED. Due to our organization, we are unable to 
> find out your true identity, and you are unable to find out where
> our list-bot resides. So - you can now have free discussion about all
> exploits and great hacks! Just use remailers and be safe...

Smells like 'elite'punks to me

-Blake (in a cranky mood)






From wb8foz at nrk.com  Tue Jun 11 22:18:17 1996
From: wb8foz at nrk.com (David Lesher)
Date: Wed, 12 Jun 1996 13:18:17 +0800
Subject: Britain to control crypto - official (fwd from Usenet)
Message-ID: <199606112007.QAA01167@nrk.com>



The British government quietly announced yesterday that it will
legislate to restrict crypto. The details are in the attached
Reuters and PA newswires.

Fuller details will no doubt be available at a one day workshop
that the Ministry of Defence is organising at the IEE in Savoy
Place on the 27th June. The speakers will include directors of
both CESG (GCHQ's front operation) and DRA, as well as a policeman
and the data protection registrar. The IEE's phone number is 0171
240 1871.

Ross



RTf  06/10 1355  UK to license information encryption services

    LONDON, June 10 (Reuter) - The British government unveiled proposals on
Monday aimed at meeting the demand for encryption services to safeguard the
confidentiality of electronic information transmitted on public
telecommunications networks.

    Technology minister Ian Taylor published a paper proposing a licensing
system for so-called "Trusted Third parties," or TTPs, to provide encryption
services.
    "The TTPs would offer digital signature, data integrity and retrieval, key
management and other services for which there is a commercial demand," Taylor
said in a written parliamentary answer.
    Taylor said encryption services would facilitate the development of
electronic commerce, thus helping to maintain Britain's competitiveness.
    The licensing policy would aim to protect consumers as well as to preserve
the ability of intelligence and law enforcement agencies to fight serious crime
and terrorism, Taylor said.
    This would be done by establishing procedures for disclosure to them of the
encryption keys, under safeguards similar to those which already exist under 
the Interception of Communications Act, he added.
    Taylor said officials in his department had already held preliminary
discussions with industry groups on the concepts set out in Monday's paper.
    Following consultation by the Department of Trade and Industry on detailed
proposals, the government intends to bring forward legislation, Taylor added.


PA   06/10 1808  MOVE TO STRENGTHEN INFORMATION SECURITY

  By Parliamentary Staff, PA News
   The Government tonight announced plans to strenthen the security of
information sent electronically over public telecommunications networks.
   Technology Minister Ian Taylor, in a Commons written reply, disclosed
proposals to licence trusted third parties to provide encryption services -- 
the process of transforming text into an unintelligible form that can only
subsequently be recovered by someone possessing the corresponding decryption
key.
   These services cover the digital signature, an electronic equivalent of a
hand-written signature, of electronic documents and the protection of the
accuracy and privacy of contents.
   Mr Taylor said: "There is a growing demand for encryption services to
safeguard the integrity and confidentiality of electronic information
transmitted on public telecommunications networks.
   "The Government therefore proposes to make arrangements for licensing 
trusted third parties who would provide such services." These would include 
digital signature, data integrity and retrieval and key management services.
   "The licensing policy will aim to protect consumers as well as to preserve
the ability of the intelligence and law enforcement agencies to fight serious
crime and terrorism by establishing procedures for disclosure to them of the
encryption keys, under safeguards similar to those which already exist for
warranted interception under the Interception of Communications Act."
   Mr Taylor, who disclosed publication of a paper, said it was intended to
bring forward proposals for legislation after consultation on detailed policy
proposals.
   The Trade and Industry Department said increased use of IT systems by 
British business and commerce was a major factor in their improved competitive 
position, but had brought increased security risks -- especially concerning 
integrity and confidentiality of information passed electronically between 
trading bodies.
   Prime candidates to be trusted third parties could include banks, network
operators and trade associations.



-- 
A host is a host from coast to coast.................wb8foz at nrk.com
& no one will talk to a host that's close...........(v)301 56 LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead........vr vr vr vr.................20915-1433





From attila at primenet.com  Tue Jun 11 22:19:49 1996
From: attila at primenet.com (attila)
Date: Wed, 12 Jun 1996 13:19:49 +0800
Subject: Slander of Catholic Church
Message-ID: <199606111758.KAA04717@primenet.com>


Addressed to: Moroni <moroni at scranton.com>
              Cypherpunks <cypherpunks at toad.com>
              Tim May <tcmay at got.net>
              Paul Penrod <furballs at netcom.com>

 
On Tue, 11 Jun 1996, Paul Penrod <furballs at netcom.com> wrote:
= On Mon, 10 Jun 1996, Timothy C. May <tcmay at got.net> wrote:

	<snip>...
=> 
=> --Cardinal Timothy May
=> 
=> (Who believes all cults and religions are basically the same shuck and
=> jive, and who thinks the "Church of Scientology" is actually a little bit
=> less foolish that the Church of Mormon, with its "baptism of dead
=                       ^^^^^^^^^^^^^^^^
= It's The Church of Jesus Christ of Latter Day Saints.
=
= If your going to criticize it, at least get the name right.
=
= > ancestors" into the Church,

	the concept is easy once you consider the sanctity of eternal "life" 
    and the relation of the spirit.  the principle is in the gospels of the 
    disciples in numerous places.

= the funny underwear people have to secretly
= ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
= Do you wear yours on the outside like Madonna?
=
= > wear, etc. However, I have great respect for the practical tactics of 
= > the Mormons, and no respect for the day to day behavior of the CoS.)
= >
= >
	actually, I am curious as to when Tim wore his set of "funny 
    underwear"   sounds like a good topic for the Cypherpunk Enquirer! 

=
= Frankly, I think this discussion needs to be put back into 
= alt.flame.the.religion.of.your.choice. It's bad enough to watch a 
= discussion on anonymous transactions devolve into useless drivel on whale 
= ownership and the questionable philisophical ruminations of a Piled 
= Higher and Deeper, without flinging this prarrie muffin on the pile too.
=
= ....Paul

** Reply to note from Moroni <moroni at scranton.com> 06/11/96 

= Tim ,
=           You should stick to your own religion and not criticize other 
= peoples. It is unforunate that the esteem that I once felt for you is 
= dwindling because of your anti-Mormon trash. Perhaps you do not realise 
= that some people take more than an academic interest in their religion 
= ;this is unforunate . It is pitiful. You are becoming the ugly 
= American that foreigners hate; always having an opinion about everything.
=                                moroni


	too strong, moroni  --remember _our_ values; not those of a critic.  
    last night in FHE I covered the first mob in Jackson County where Bushop 
    Partridge turned the other cheek to make it easier after the first was 
    tarred by the mob.




--
The result of today's 'government' 
  is new world disorder, unfolding at warp velocity.






From alano at teleport.com  Tue Jun 11 22:29:07 1996
From: alano at teleport.com (Alan Olsen)
Date: Wed, 12 Jun 1996 13:29:07 +0800
Subject: Comments on MicroPayments and the Web
Message-ID: <2.2.32.19960611193553.00cb57a0@mail.teleport.com>


I do not see micropayment schemes gaining any acceptance in the long run.
Here is why...

1)  I expect a few scam artists out there to pull something like with what
has been done with 976 numbers.  Put up something that looks like a "hot
page" and then charge you lots of cash when you hit the site.  (Instead of a
fraction of a cent, a quarter or twenty bucks?)  If they are a heavy web
surfer, the ream of paper needed to find the offending page would be pretty
obnoxious.  Most would just pay the bill.  (Leading to even more scams of
this type.)

2)  If a dialog comes up for each site that wants to ding you for a bit of
money, these sites are going to resemble the pay toilets of the net.  People
will go there if they have to, but avoid them (or crawl under with an old
browser) if they can.

All in all, it just sounds like another scam dreamed up by someone in
marketing to Make Money Fast off the Internet.
---
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.teleport.com/~alano/          | alano at teleport.com  |






From markm at voicenet.com  Tue Jun 11 22:37:30 1996
From: markm at voicenet.com (Mark M.)
Date: Wed, 12 Jun 1996 13:37:30 +0800
Subject: ANNOUNCEMENT: HACKERPUNKS MAILING LIST
In-Reply-To: <199606110351.FAA03834@basement.replay.com>
Message-ID: <Pine.LNX.3.93.960611160640.176B-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 11 Jun 1996, Anonymous wrote:

> Hi! We are delighted to announce a new mailing list, Hackerpunks! This list
> is for serious folks who know stuff about computers _AND_ want to keep
> their privacy. The submission address is an anonymous alias,
> hackerpunks at alpha.c2.org. It is anonymous because _I_ want to keep my
> privacy and do NOT want to answer stupid questions. To further _your_
> privacy, we can subscribe ONLY anonymous aliases user_name at alpha.c2.org.
> Mailing list messages will be forwarded to your alpha.c2.org adresses 
> through anonymous remailers.

You might also want to let anonymous aliases user_name at nym.jpunix.com
subscribe.  It doesn't have many aliases in use, but it probably will become
more popular.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMb3SabZc+sv5siulAQHg1AQAsEqbbbm63WVyBtkEYogVOHgRsPk6oc4r
4sV7QysT0CfzoE7pGqEFpKwwCi6BGqK6IydxauGELbVDtpV/iiWwGu9l6bD1WlQW
0q/DhngWFMysb4/Z7myBc4kq/zRNagemnjSlAxlvSjqjEbjcqF/7ex3sjQ6+xcX2
d8cUjBP0dn8=
=0b4v
-----END PGP SIGNATURE-----





From talon57 at well.com  Wed Jun 12 00:02:23 1996
From: talon57 at well.com (talon57 at well.com)
Date: Wed, 12 Jun 1996 15:02:23 +0800
Subject: Terrorism Hysteria on the net
Message-ID: <199606111912.MAA23432@well.com>



snow  wrote:

>>Give me 15 well trained soldiers(near special forces level) and
>>I can do it in less than 60 days. Without touching a computer.

Gary Howland <gary at systemics.com> adds:
>Give me 10 well trained biological warfare scientists and I'll do
>it in 30 ...

>Anymore bids?  :-)

Yeah, Give me one really sick monkey .....

Brian









From cp at proust.suba.com  Wed Jun 12 00:04:53 1996
From: cp at proust.suba.com (Alex Strasheim)
Date: Wed, 12 Jun 1996 15:04:53 +0800
Subject: plugging in
In-Reply-To: <199606111316.JAA29512@jekyll.piermont.com>
Message-ID: <199606111805.NAA03561@proust.suba.com>


> Indeed -- the notion is that one could do things like put support for
> encrypted/signed pages or other cryptographic tools (I haven't checked
> if Netscape mail handles plugins, too) directly into Netscape where
> ordinary users could smoothly use them.

Doing tech support at my ISP has made me very skeptical of anything that
requires a plug in.  Most people aren't willing or able to download and
install them.  Obviously that's not a problem for large organizations who
want to run something internally -- they can make people install them and
provide support to make sure it happens.  But if you want to publish to
the mainstream of people who use the net, using a plug in is a very bad
idea. 

(I don't know anyone that doesn't design web pages for a living who's 
installed the shockwave plugin, for example.  I'm sure that people do, 
just not the people I know.  Only a marketing hack would download a 
couple of megabyte plug in to look at a soda company's web page.)

SSL has a lot of problems (Verisign's pound of flesh, signatures on sites 
rather than documents, etc.), and those problems make a PGP based system 
attractive.  But SSL's ubiquity (is that a word?) and the inherent 
kludginess of a PGP based plug-in make me think that the latter wouldn't 
have a snowball's chance in hell of catching on.







From Ventureweb at aol.com  Wed Jun 12 00:17:35 1996
From: Ventureweb at aol.com (Ventureweb at aol.com)
Date: Wed, 12 Jun 1996 15:17:35 +0800
Subject: Venture capital financing/partnering for unique website ideas/entrepreneurs
Message-ID: <960611151902_554057529@emout14.mail.aol.com>


 Re:	Venture Capital Funding/Venture Partnering For
 	Web Site Developers/Entrepreneurs

 Hello;

 	My firm, DataMerge, Inc.  is currently developing a program to
provide financial backing and strategic assistance for commercially
viable website development. It is my job to locate individuals with ideas
and/or plans for creating high profile,  niche market websites that, with
our assistance,  can be profitably brought to maket.

	We are very interested in unique, highly innovative, information
based sites which are targeted to meet the needs of a specific market,
industry or user group.  While we are interested in creative services
offered through the internet to a targeted group, we are not interested in
backing companies for expanding into run-of-the-mill areas such as ISP,
contract web-site design, or outsourced graphic design.

	We prefer to work with individuals or small teams (no more than
three).  Don't be discouraged if you don't have a lot of business
experience. What we look for more than anything else is creativity and
"entrepreneurial spirit." We find some of the best ideas come from
college, and even high school students.

	What we can provide the entrepreneur includes the following:

*	Strategic, marketing and business planning assistance
*	Financial support during development
*	Marketing/promotional assistance (capital, coordination and 	
	partnering)
*	Long term royalty stream from site
*	Further site development and maintenance contracts

 	DataMerge is currently the largest provider of  niche market
financing information and financing software applications to US
businesses, intermediaries and  finance professionals. DataMerge has a
user base of  21,000 individuals, and a newsletter subscriber base of
73,000.
	DataMerge has been featured in publications including Inc.,
 Financial Times, Entrepreneur, Success, Denver Post, and LA Times to
 name a few.

	If you wish to be considered for this program, please email me
(Spencer Kluesner, CEO, DataMerge, Inc.) at VentureWeb at aol.com.
Please provide a brief (one page or less) description of the website you
propose to develop.

	Snail mail:

DataMerge, Inc.
Website Development Dept
1720 S. Bellaire Suite 310
Denver, CO 80222





From mab at research.att.com  Wed Jun 12 00:20:59 1996
From: mab at research.att.com (Matt Blaze)
Date: Wed, 12 Jun 1996 15:20:59 +0800
Subject: Oblivious key escrow
Message-ID: <199606111854.OAA02575@nsa.tempo.att.com>


I've revised and expanded the paper on decentralized key escrow that I
presented at the Cambridge Information Hiding workshop and mentioned
here a few weeks ago.  The paper is now called "Oblivious Key Escrow",
and is available from:
	ftp://research.att.com/dist/mab/netescrow.ps    (postscript)
	ftp://research.att.com/dist/mab/netescrow.tex   (latex source)
-matt

\begin{abstract}
We propose a simple scheme, based on secret-sharing over large-scale
networks, for assuring recoverability of sensitive archived data ({\em
e.g.,} cryptographic keys).  In our model anyone can request a copy of
the archived data but it is very difficult to keep the existence of a
request secret or to subvert the access policy of the data ``owner.''
We sketch an architecture for a distributed key escrow system that
might be suitable for deployment over very large-scale networks such
as the Internet.  We also introduce a new cryptographic primitive,
{\em oblivious multicast,} that can serve as the basis for such a
system.
\end{abstract}





From alanh at infi.net  Wed Jun 12 00:25:27 1996
From: alanh at infi.net (Alan Horowitz)
Date: Wed, 12 Jun 1996 15:25:27 +0800
Subject: [more noise] Re: [NOISE] I swear I am not making this up.
In-Reply-To: <Pine.3.89.9606110239.A21446-0100000@tesla.cc.uottawa.ca>
Message-ID: <Pine.SV4.3.91.960611174445.20391G-100000@larry.infi.net>



On Tue, 11 Jun 1996 s1113645 at tesla.cc.uottawa.ca wrote:

> ObCryptolinguisticsPunks: Did anyone know Iranian and Aryan are synonyms?

   I think there is NOT a one-to-one mapping of Iranian to Aryan. 
specifically, Farsi'im might be descended from the Aryans, but so are some 
others. Northern Indians, I think?

I have another problem with your statement.  Islam was a gigantic 
watershed in the sociocultural history of Persia. Islamic currents are 
stronger in contemporary Iranian culture, than ancient Aryan influences. 





From tcmay at got.net  Wed Jun 12 00:26:24 1996
From: tcmay at got.net (Timothy C. May)
Date: Wed, 12 Jun 1996 15:26:24 +0800
Subject: Slander of Catholic Church
Message-ID: <ade31529110210043f6a@[205.199.118.202]>


At 5:59 PM 6/11/96, attila wrote:

>        too strong, moroni  --remember _our_ values; not those of a critic.
>    last night in FHE I covered the first mob in Jackson County where Bushop
>    Partridge turned the other cheek to make it easier after the first was
>    tarred by the mob.

Thanks, Attila. I think Paul Penrod and the Archangel Moroni missed my main
point. I was not singling out Mormonism for special criticism, just using
it as an example of a "cult" or "religion" which is in many ways even more
"outre" to many of us than Scientology is. Belief that a body rotting in
the ground can be baptized into one's church is at least as odd as
believing that Mankind is descended from the survivors of spaceships
fleeing an evil overlord.

My point, in using Catholicism as an example (interesting that only my
brief lines on Mormon views were critiqued...Catholicism must indeed be
nearly extinct on lists like ours), was that one's man's "criminal cult" is
another man's "holy religion," and that the "net.war" declared by some on
the Church of Scientology is little different than having a similar war
against Catholics, Rosicrucians, Parsees, whatever.

The Church of Scientology is no more a cult than is LDS or
Catholicism....it is just much newer. Believing that clam consciousness
suffuses our thoughts is no stranger than are the bizarre claims of most
religions.

Talk is of some belief systems being "cults" and others being "religions."
When the Constitution speaks of "Congress shall make no law regarding the
establishment of religion...," it is clear that this is not just for
"recognized" and "established" religions.

(Before the usual suspects jump in with quibbles, this does not mean that a
religion may not be constrained in various ways. The laws against polygamy
constrained the Mormons, the laws against certain drugs constrained certain
Native American religions, etc. Constitutional law classes are the best
forum to debate this.)

I am no supporter of the CoS, nor of any religion. I find it hypocritical
for folks bashing the "clams" and bombarding a.r.s with copyrighted CoS
material to now be whining that the clams are "unfairly" using a.r.s.

I also find it "unsurprising" that the CoS is taking steps to preserve what
it thinks is its copyrighted, proprietary material.

(I am  not interested in debating the ins and outs of whether the NOTS
material should or should not have been published, nor of whether some
investigators went overboard in investigations of Grady Ward, etc. This
stuff is boring ephemera to me, just another religious war.)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From alanh at infi.net  Wed Jun 12 00:42:22 1996
From: alanh at infi.net (Alan Horowitz)
Date: Wed, 12 Jun 1996 15:42:22 +0800
Subject: Anonymous return addresses
In-Reply-To: <Pine.LNX.3.93.960608224227.128A-100000@gak>
Message-ID: <Pine.SV4.3.91.960611172935.20391B-100000@larry.infi.net>


Can anyone "give away the Ending" of Cliff Stoll's book - and describe 
the basic methodology used to track back to the German hacker?

I don't have time to read the book. I don't need to understand all the 
little nuanced details, I just want to know the "trick".

Yours in couch potato'dom,
{your humble servant}





From jpp at software.net  Wed Jun 12 00:53:39 1996
From: jpp at software.net (John Pettitt)
Date: Wed, 12 Jun 1996 15:53:39 +0800
Subject: Britain to control crypto - official (fwd from Usenet)
Message-ID: <2.2.32.19960611222532.00d35584@mail.software.net>


At 04:07 PM 6/11/96 -0400, David Lesher wrote:
>The British government quietly announced yesterday that it will
>legislate to restrict crypto. The details are in the attached
>Reuters and PA newswires.

So I didn't see any move top 'restrict crypto' in the two wire stories.
It looked like the return of clipper with escrow agents other than government
which seems *almost* reasonable when I note that they are not mandating any of
this stuff.

Still given the close relationship between Cheltenham and Ft Mead one is left
wondering what the real story is ...

John Pettitt, jpp at software.net
EVP, CyberSource Corporation, 415 473 3065

PGP Key available at:
http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA3705






From rah at shipwright.com  Wed Jun 12 00:58:50 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Wed, 12 Jun 1996 15:58:50 +0800
Subject: Britain to control crypto - official (fwd from Usenet)
In-Reply-To: <199606112007.QAA01167@nrk.com>
Message-ID: <v03006f0cade3a501bcb5@[199.0.65.105]>


> The British government quietly announced yesterday that it will
> legislate to restrict crypto.

Does anyone here have any idea what this does to british-affiliated states
like Anguilla, or the Caymans?

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From frissell at panix.com  Wed Jun 12 01:25:52 1996
From: frissell at panix.com (Duncan Frissell)
Date: Wed, 12 Jun 1996 16:25:52 +0800
Subject: plugging in
Message-ID: <2.2.32.19960611205625.0075a388@popserver.panix.com>


At 01:05 PM 6/11/96 -0500, Alex Strasheim wrote:
>Doing tech support at my ISP has made me very skeptical of anything that
>requires a plug in.  Most people aren't willing or able to download and
>install them. 

I have installed, RealAudio as have many other people.  Likewise
Streamworks.  I agree with your general point about general plugins but
plugins for specific purposes will be deployed (at least until Netscape
includes the capabilities).

DCF







From drosoff at arc.unm.edu  Wed Jun 12 01:31:45 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Wed, 12 Jun 1996 16:31:45 +0800
Subject: ANNOUNCEMENT: HACKERPUNKS MAILING LIST
Message-ID: <1.5.4.16.19960611233513.32d77d72@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

At 10.12 AM 6/11/96 -0400, SINCLAIR  DOUGLAS N wrote:
>I don't have a C2 account, and don't really want to pay for one.
>I trust someone will put the hackerpunks archives on the web so
>the rest of us can read them.

C2 nym accounts are free.

===============================================================================
David Rosoff (nihongo o chiisaku dekimasu)  ------------->  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
===
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." <---- "Ulysses", by Alfred, Lord Tennyson

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMb4A5xguzHDTdpL5AQGxLQP/YXH9uWmXC2xK/Pr/c4kdyopE213bsQpL
+T3RD2qSK+qO234fHL3nJmQVBTS5Eyyw4YtMEmnV87vclpWbP9WIr+7RDvYpr/aM
1/6QBEux3f/K6SaPD5iBHfuoc8XkriqhfXgiiUnVK4IxbhHaLatPpSeKLQmX0o2Q
3fVXFjWuEGs=
=sSf7
-----END PGP SIGNATURE-----






From jya at pipeline.com  Wed Jun 12 01:33:21 1996
From: jya at pipeline.com (John Young)
Date: Wed, 12 Jun 1996 16:33:21 +0800
Subject: Information Age Intelligence
Message-ID: <199606120115.BAA01339@pipe3.ny3.usa.pipeline.com>


   Foreign Policy, Summer 1996: 
 
   "Information Age Intelligence." by Bruce D. Berkowitz, 
   a former CIA analyst and staff member for the Senate 
   Intelllgence Committee. Excerpts of 14-page essay: 
 
      During most of this century, the intelligence 
      community led the world in developing information 
      technology. Intelligence organizations were deeply 
      involved in the development of telegraph and 
      telephone networks, modern computers, and 
      space-based communications and surveillance 
      systems. The intelligence community also 
      established new forms of analysis and areas of 
      expertise. 
 
      Yet several signs suggest that the intelligence 
      community is no longer the leader in the 
      information world, and it may have fallen behind 
      significantly in some respects. The underlying 
      problem is that the intelligence community has 
      failed to keep up with changes in how modern 
      society uses information and how information 
      technology develops in modern society. As a 
      result, our model for intelligence is out-of-date. 
      This reality is what current efforts at 
      intelligence reform are failing to recognize. 
 
      The intelligence community needs to move as fast 
      as information businesses do to capture markets, 
      but the traditional organization is not up to the 
      task. Today's model for intelligence -- how it is 
      organized and how it operates -- is an artifact 
      from an earlier age. Even the name "Central 
      Intelligence Agency" is reminiscent of the New 
      Deal era, when large, powerful, national 
      bureaucracies were the accepted way of getting 
      things done efficiently. It makes less sense in a 
      world moving toward fluid, distributed, networked 
      information organizations. 
 
      As the capabilities of the private sector improve, 
      the intelligence community will need to move on to 
      the next frontier of technology or expertise that 
      the private sector has yet to fill. While one 
      challenge for intelligence reform is to keep up 
      with these changes, fundamentally the greater 
      challenge will be to establish an organization 
      that can adapt with the times. 
 
      One reason why the intelligence community cannot 
      deal effectively with the Information Revolution 
      is that intelligence requirements and the 
      intelligence community's comparative advantage are 
      both fluid, but the traditional intelligence 
      bureaucracy remains static. In addition, 
      organizations responsible for developing and 
      applying technology, such as the National 
      Reconnaissance Office (NRC)) and the National 
      Security Agency (NSA), have created organizational 
      dogma, and dogma always resist change. Once such 
      organizations carve out a place for themselves 
      (and their technologies) in the budget, they can 
      be difficult to dislodge. The fact that these 
      organizations often operate at a classified level 
      further insulates them. As a result, the 
      intelligence community often locks into specific 
      technologies, even when new and possibly better 
      ideas have come along. 
 
   http://pwp.usa.pipeline.com/~jya/fpintel.htm 
 
----- 
 
Our Web site was hosed clean today, so this article may 
not survive. If not there, send us e-mail with the 
subject: FPI_ntl 
 
 





From markm at voicenet.com  Wed Jun 12 01:37:04 1996
From: markm at voicenet.com (Mark M.)
Date: Wed, 12 Jun 1996 16:37:04 +0800
Subject: Anonymous return addresses
In-Reply-To: <Pine.SV4.3.91.960611172935.20391B-100000@larry.infi.net>
Message-ID: <Pine.LNX.3.93.960611202255.188B-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 11 Jun 1996, Alan Horowitz wrote:

> Can anyone "give away the Ending" of Cliff Stoll's book - and describe 
> the basic methodology used to track back to the German hacker?
> 
> I don't have time to read the book. I don't need to understand all the 
> little nuanced details, I just want to know the "trick".

Here's the story as best as I can remember from _Cyberpunk_:

Cliff Stoll worked at LBL where he found that the account of a former worker
was being abused by a cracker.  He set up a system that would log every
keystroke the cracker made and he would automatically get paged whenever there
was an intrusion.  The connection was apparently from a Tymnet node.  Stoll got
a search warrent and traced the Tymnet connection back to a modem pool at
Mitre in Virginia.  The people at Mitre found that the cracker was dialing into
the modem pool and exploiting a security hole to dial back out to a Tymnet
node.  With cooperation from the CIA, it was found that the calls were being
made from a network in Germany called Datex-P.  When the network discovered the
extremely high long-distance bills, they traced the call back to Pengo (Hans
Huebner).

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMb4P3rZc+sv5siulAQE7UAP/QoDxTapE1GjxXdWBD7mXIv+p4aeo2s8Z
7MZV65Faqpa/iEUEO539TkTToDr8yIUC1Mdkx3QDaJ0k5Wfw8qT2956n6kGS6CkS
hi2CgrOIlzsdBBbvdhxMHoRlA7O15uc4nQ3ghJU/FjjdpOFsQh/pwLRcdrG78L3n
X33Gi7YUdxc=
=2NkX
-----END PGP SIGNATURE-----





From foodie at localhost.netcom.com  Wed Jun 12 01:41:38 1996
From: foodie at localhost.netcom.com (Jamie Lawrence)
Date: Wed, 12 Jun 1996 16:41:38 +0800
Subject: Micropayments: myth?
Message-ID: <v02140b03ade3bafe0390@[10.0.2.15]>


Brian describes a UI metaphor for micropayments, with a gauge
indicating the value of your micropayment purse and a cutoff for
the maximum automatic per-unit payment:

>Now, let's consider bridging this metaphor into the micropayments world.
>Imagine that surfing the web is like driving a car - you'll dribble out
>small amounts of money over a period of time, but as long as you watch
>your speedometer (the rate at which you spend money) and the feul tank
>levels (the amount of coinage in your wallet), you are in control of your
>spending rates.  Whether you approve every micropayment explicitly, or
>you set a minimum level below which requests for payments are automagically
>granted, is up to you.  Me, I'd probably be alright with just about any
>site I go to asking for less than $.02 for any action I take.  Anything
>above that, I want to be explicitly asked.  My user interface has a gas
>gauge and a speedometer in the upper-right-hand corner instead of a
>throbbing "N".  When my levels are low, I go visit my bank and "refill"
>my wallet.  Voila!

That's fine so long as the majority of sites one visits all cost within,
say, an order of magnitude or so.

What happens if people skip around a lot? When I go from checking out
Hagbard's Poetry Corner, which charges $.02 cents per page (and falls
below the speedometer cutoff), and switch over to Belbo's Future's
Tips Market, which charges a dollar a page, I'm going to get annoying
alerts every click. If one allows customizing the cutoff for each page,
the guage becomes meaningless (as much as if your car occasionally sucked
half the gas tank at one stoplight). If you don't, it is annoying.

Sure, $1.00 a page, perhaps, pushes the micropayment scale, but
I'm sure there are plenty of folks who would set the cutoff in
that range or higher.

Perhaps a graphical relation-o-meter, comparing some user defined
scale to the cost of the current page, so that users could get a
relative feel for high rent districts (Web-rent control, anyone?),
but I can see pitfalls to this appoach, too.

I don't think this works unless the micropayments world standardizes
on a very narrow price band, which isn't very likely, or people are
found to stick pretty consistently to a given price when browsing,
which I don't think is very likely either.

>And yes, I am presuming a system involving transfers of digitally signed
>tokens of some sort.  I don't think this is a mistaken presumption.

It strikes me as perhaps more useful for account-driven billing systems,
where one has a contanst quanta of payment magnitude.

-j

--
The signal is the noise.
____________________________________________________________________
Jamie Lawrence   mailto:jal at cyborganic.net  mailto:foodie at netcom.com







From mccoy at communities.com  Wed Jun 12 01:48:22 1996
From: mccoy at communities.com (Jim McCoy)
Date: Wed, 12 Jun 1996 16:48:22 +0800
Subject: Micropayments are Crap
Message-ID: <v02140b02ade3b261dff2@[205.162.51.35]>


Stephan Vladimir Bugaj <stephan at studioarchetype.com> writes:
>
> Micropayment proponents are incredibly fond of the proposition that software
> could be leased on a usage time basis from a centralized server, and people
> could also rent time on the servers' CPUs.  Sounds an awful lot like the
> mainframe days to me.

Well, at the risk of being branded a heretic, maybe the mainframe days were
not as bad as you assume...  Back in "the mainframe days" computers cost
hundreds of thousands of dollars, and the best way to most efficiently use
that resource was to tiemsharing.  Currently I would guess that 2/3 of the
possible CPU cycles in the world go unused, wasted by machines that are
turned off sitting in someones den or running a screensaver in the cubicle of
some drone in the marketting department.  With micropayments one can purchase
access to these cycles and put them to use, allowing the user to recover
costs when they are not using their system and giving the user cheap access
when needed to computing resources way beyond what they would be capable of
purchasing themselves.

> I see plenty of ways in which this benefits the vendor (greater control
> over distribution, centrailzed revision/upgrade distribution, greater
> profits over one-time sales, etc.), but no ways in which this benefits
> the user.  Especially the power user.

Some advantages to the user:

        -Faster and more frequent upgrades and bug fixes.  No need to
         wait for the CD or floppies to be shipped.
        -Better responsiveness from the vendor/distributor.  Currently once
         you buy a program you are stuck with it, warts and all.  A "test
         drive" is not an option, so vendors are led by their marketting
         droids.  With online "rental" the user has the ability to try a
         program before plunking down their $69.95 and possibly ending up
         with an unusable collection of annoying bugs.  This also means
         that they have the option of selecting a different program without
         risking paying the entire cost of a program they do not really want
         but which had good advertising.  Software vendors will be forced to
         actually pay attention to the users _after_ the initial sale and will
         also be motivated to create and provide more customized niche programs
         so you end up with a better selection of software as well.
        -Access to programs which the user could not normally afford or would
         not use enough to justify the purchase price.  I am not a chip
         designer and am not interested enough to drop $20K on a VHDL simulator
         and design synthesis program, but I would be willing to pay several
         dollars an hour to play around with one.


> I'm certainly not going to rent time
> on a compiler or image editing program every single time I want to do some
> work.

Then buy the program yourself, and then wait overnight for that ray tracing
and rendering program to complete two frames of that animated logo for your
kewl web page.  No one is saying that everything wll go to micropayments, in
some cases for software which is used constantly it does make more sense to
buy the program outright but in most cases you end up using the other programs
which clutter your hard disk a lot less than you think.  By renting your
non-essential programs you save money.

> It took the industry long enough to get PCs and workstations to the speeds
> they're at today so people could do their own work on their own machines to
> go back to waiting in a queue for time on a centralized system so you can
> have the honor of paying someone a lot of money to run your job.

How did you make the leap from micropayments (remember that "micro" prefix)
to paying someone a lot of money to run your job.  With micropayments you
can pay a lot of people a very small amount of money to run your job and
get it done orders of magnitude faster than someone stuck with a lone PC.
You also avoid getting caught up in the hardware game.  Just a few years
ago everyone was told they needed to upgrade their 386SX to a 486 or 486DX2
or they would be left behind, now everyone simple must have a Pentium, and
tomorrow it will be the next chip du jour.  By only requiring the hardware
necessary for user interaction on the desktop one can get better economies of
scale (hence the so-called "Network Computer")  If you could get by with
having a 486 on your desk running the presentation and interface level and
then rented cycles on a huge cluster of pentium cycle servers to get real work
done you would probably end up saving money in the long run, and would not need
to run out to Fry's every year/month/week to upgrade your hardware with new
pieces which would soon be obsolete.

jim









From grafolog at netcom.com  Wed Jun 12 01:48:41 1996
From: grafolog at netcom.com (jonathon)
Date: Wed, 12 Jun 1996 16:48:41 +0800
Subject: [Noise] William Safire on the GAK bastards' other privacy violations.
In-Reply-To: <v02140b00ade2700d75f4@[204.249.244.13]>
Message-ID: <Pine.3.89.9606120211.A17815-0100000@netcom12>


	Eric:

On Mon, 10 Jun 1996, eric traudt wrote:

> WASHINGTON (Jun 10, 1996 12:00 p.m. EDT) -- Overlooked in the scandal of
> Travelgate has been the failure of FBI Director Louis Freeh to protect the
> confidential files of citizens from political snoops. Say what you like 
	
> for what lawful purpose? Can any anonymous bureaucrat requisition, 
> rifle through and remove confidential records? How come not one agent 

	I don't have a copy of the law, but it was passed a few years
	ago. << Telecommunications Act of 1994 --- didnt' just allow
	any politicians, to wiretap anybody without a court order,
	but also allowed them to obtain, and retain any records they
	wanted, from any law enforcement body, without any questions. 
	Note just federal, but state, county and local politicians as
	well.  >>

> was required by bureau policy to ask why not even initials appeared on 
> hundreds of requests to check up on Republicans?

	Given the above, I suspect that no signatures are needed.

	





From editor at cdt.org  Wed Jun 12 01:49:24 1996
From: editor at cdt.org (Bob Palacios)
Date: Wed, 12 Jun 1996 16:49:24 +0800
Subject: CDT Policy Post 2.24 - Join Sen. Burns TONIGHT (6/11), 10 EDT
Message-ID: <v02140b08ade34e072059@[204.157.127.16]>


-----------------------------------------------------------------------------
    _____ _____ _______
   / ____|  __ \__   __|   ____        ___               ____             __
  | |    | |  | | | |     / __ \____  / (_)______  __   / __ \____  _____/ /_
  | |    | |  | | | |    / /_/ / __ \/ / / ___/ / / /  / /_/ / __ \/ ___/ __/
  | |____| |__| | | |   / ____/ /_/ / / / /__/ /_/ /  / ____/ /_/ (__  ) /_
   \_____|_____/  |_|  /_/    \____/_/_/\___/\__, /  /_/    \____/____/\__/
   The Center for Democracy and Technology  /____/     Volume 2, Number 24
----------------------------------------------------------------------------
      A briefing on public policy issues affecting civil liberties online
----------------------------------------------------------------------------
 CDT POLICY POST Volume 2, Number 24                        June 11, 1996

 CONTENTS: (1) Join Senator Burns Live Online TONIGHT at 10pm EDT - Preview
               Tomorrow's Hearing on "Pro-CODE" Encryption Bill
           (2) Attend the S.A.F.E. Forum on Encryption - July 1, Stanford, CA
           (3) How to Subscribe/Unsubscribe
           (4) About CDT, contacting us

  ** This document may be redistributed freely with this banner in tact **
        Excerpts may be re-posted with permission of <editor at cdt.org>
         ** This document looks best when viewed in COURIER font **
-----------------------------------------------------------------------------

  ** UPDATE: DECISION IS NEAR IN FIGHT TO SAVE FREE SPEECH ONLINE **

  An announcement from the Court is expected any time. Be sure to visit
     http://www.cdt.org/ciec/ for the latest news and information!

-----------------------------------------------------------------------------

(1) JOIN SENATOR BURNS LIVE ONLINE =TONIGHT= at 10PM EDT: Preview Tomorrow's
    Hearing on "Pro-CODE" Encryption Bill

 --> Visit http://www.hotwired.com/wiredside/ for details <--

Senator Conrad Burns (R-MT) will be on HotWired's WiredSide chat TONIGHT
(6/11) at 10pm EDT to discuss tomorrow's scheduled hearing on his
"Promotion of Commerce Online in the Digital Era Act of 1996" ("Pro-CODE")
encryption bill.

Tonight's WiredSide chat is a great opportunity to join Senator Burns on
the eve of an important hearing to ask questions about encryption policy
and get a preview of what the Senator expects to occur at the hearing.

Senator Burns will chair the first of two scheduled hearings on his
"Pro-CODE" bill tomorrow at 9:30 EDT in Room 253 of the Russell Senate
Office Building.  The hearing will take place in the Commerce Subcommittee
on Science, Technology and Space.  This is the first Congressional hearing
in recent memory to discuss "pro-encryption" legislation that would relax
current restrictive encryption export controls.

Never before has the public had this much access to legislators without
geographical proximity.  Cheaper than teleconferencing, and more direct
and unfiltered than the traditional press, online chats allow the public
to directly question and hear the answers from members of Congress.

The online chat is at 10pm EDT (7pm PDT) TONIGHT (6/11). HotWired's
WiredSide chat is at:

     http://www.hotwired.com/wiredside/

Tonight's forum is another in a series of planned events, and is part
of a broader project coordinated by CDT and the Voters Telecommunications
Watch (VTW) designed to encourage members of Congress to work with the
Net.community on vital Internet policy issues and to bring the Internet
Community into the debate about those issues.

Transcripts from previous online chats are available -- for transcript
information and details about upcoming events, please visit CDT's newest
Issues Page, "Congress and the Net":

     http://www.cdt.org/net_congress/

SEN. BURNS TO CHAIR "PRO-CODE" HEARINGS -- FIRST HEARING TOMORROW (Wed 6/12)

The hearing tomorrow will take place in the Commerce Subcommittee
on Science, Technology and Space, of which Sen. Burns is the chairman.
This first hearing will focus on encryption as it relates to commerce and
business issues.  Prominent industry representatives have been invited to
testify at the hearing.  Scheduled to testify are:

  o Michael Zisman, president and CEO of Lotus;
  o Jim Barksdale, president and CEO of Netscape Communications;
  o Jim Bidzos, president and CEO of RSA Data Security;
  o Tim Krauskopf, V.P. and co-founder of Spyglass Inc.;
  o Kenneth Dam, chairman of the National Research Council;
  o Richard Sevcik, Senior V.P. of Hewlett-Packard;
  o Joe Holmes, chief technology officer for EDS;
  o Joel S. Lisker, senior V.P. for security and risk management at
    MasterCard;
  o Danne Buchanan, president of Zion's Data Services Company;
  o Jack Valenti, executive director of the Motion Picture Association of
    America;
  o Aharon Friedman, chairman, founder and chief technical officer of Digital
    Secured Networks Technology Inc.; and
  o Robert Bigony, senior V.P. and director of strategic marketing, government
    and space technology group, for Motorola.

The second hearing, scheduled for June 26, will focus on privacy, law
enforcement, and national security issues.

For more information about tomorrow's hearing, background on the "Pro-CODE"
legislation (including the text of the bill), and other information
about encryption issues, please visit the Encryption Policy Resource Page
at:

http://www.crypto.com/

or the CDT Cryptography Issues Page at:

http://www.cdt.org/crypto/

------------------------------------------------------------------------
(2) ATTEND THE S.A.F.E. FORUM ON ENCRYPTION - JULY 1 IN STANFORD, CA

On July 1, 1996, members of Congress, prominent computer industry leaders,
noted cryptographers, privacy advocates, press, and netizens will meet in
the heart of California's Silicon Valley for a lively, all-day forum to
discuss cryptography and the need to reform current U.S. encryption policy.

Anyone interested in the future of encryption technology and policy is
strongly encouraged to attend.  Admission to this special event is free, but
those interested must reserve a ticket to attend.  (Please visit the S.A.F.E.
web site to reserve your ticket - http://www.crypto.com/safe/ )

The S.A.F.E. (Security and Freedom Through Encryption) Forum will be held on
Monday July 1st from 9:00am - 4:00pm at Kresge Auditorium on the campus of
Stanford University in Stanford, CA.  S.A.F.E. will feature panel discussions,
interactive demonstrations of cryptography technology, and an opportunity for
feedback from the public.

Scheduled participants include such industry leaders and cryptographers as:

  o Marc Andreeson, Vice President of Netscape Communications Corp.;
  o James Bidzos, President of RSA Data Security;
  o Eric Schmidt, Chief Technical Officer, Sun Microsystems;
  o Brad Silverberg, Senior V.P., Microsoft Corp.; and
  o noted computer security experts Matt Blaze and Eric Thompson.

Members of Congress scheduled to attend include:

  o Sen. Conrad Burns (R-MT),
  o Sen. Patrick Leahy (D-VT) [via satellite]
  o Sen. Larry Pressler (R-SD),
  o Rep. Tom Campbell (R-CA),
  o Rep. Zoe Lofgren (D-CA), and
  o Rep. Anna Eshoo (D-CA).

By bringing together policymakers, industry leaders, cryptographers,
net.advocates, and netizens, the forum promises to be an enlightening
and informative event that will help raise public awareness for the
importance of encryption technology to enhance privacy and security on
the global information infrastructure.  The forum will also detail the
problems posed by the current U.S. encryption policy.

The S.A.F.E. forum is sponsored by:
  o America Online
  o American Civil Liberties Union
  o Americans for Tax Reform
  o AT&T
  o Business Software Alliance
  o Center for Democracy and Technology
  o Center for National Security Studies
  o Commercial Internet eXchange
  o CompuServe Incorporated
  o Computer Professionals for Social Responsibility
  o Cylink Corporation
  o EDS
  o Electronic Frontier Foundation
  o Electronic Messaging Association
  o Electronic Privacy Information Center
  o Information Technology Association of America
  o IEEE - USA
  o Media Institute
  o Microsoft Corporation
  o National Association of Manufacturers
  o Netcom Online Communication Services
  o Netscape Communications Corporation
  o Novell, Inc.
  o Oracle Corporation
  o Pacific Telesis Group
  o Prodigy, Inc.
  o Progress and Freedom Foundation
  o Securities Industry Association
  o Software Publishers Association
  o Sybase, Inc.
  o Voters Telecommunications Watch
  o Wired Magazine

For the latest information about S.A.F.E. and to reserve your free ticket to
the forum, please visit the S.A.F.E. Web site:

http://www.crypto.com/safe/

------------------------------------------------------------------------
(3) SUBSCRIPTION INFORMATION

Be sure you are up to date on the latest public policy issues affecting
civil liberties online and how they will affect you! Subscribe to the CDT
Policy Post news distribution list.  CDT Policy Posts, the regular news
publication of the Center For Democracy and Technology, are received by
nearly 10,000 Internet users, industry leaders, policy makers and
activists, and have become the leading source for information about
critical free speech and privacy issues affecting the Internet and other
interactive communications media.

To subscribe to CDT's Policy Post list, send mail to

     policy-posts-request at cdt.org

with a subject:

     subscribe policy-posts

If you ever wish to remove yourself from the list, send mail to the
above address with a subject of:

     unsubscribe policy-posts

-----------------------------------------------------------------------
(4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US

The Center for Democracy and Technology is a non-profit public interest
organization based in Washington, DC. The Center's mission is to develop
and advocate public policies that advance democratic values and
constitutional civil liberties in new computer and communications
technologies.

Contacting us:

General information:  info at cdt.org
World Wide Web:       URL:http://www.cdt.org/
FTP                   URL:ftp://ftp.cdt.org/pub/cdt/

Snail Mail:  The Center for Democracy and Technology
             1634 Eye Street NW * Suite 1100 * Washington, DC 20006
             (v) +1.202.637.9800 * (f) +1.202.637.0968

-----------------------------------------------------------------------
End Policy Post 2.24                                            6/11/96
-----------------------------------------------------------------------







From stephan at studioarchetype.com  Wed Jun 12 02:06:12 1996
From: stephan at studioarchetype.com (Stephan Vladimir Bugaj)
Date: Wed, 12 Jun 1996 17:06:12 +0800
Subject: Micropayments are Crap
In-Reply-To: <v03006f04ade3579bc415@[204.162.75.169]>
Message-ID: <v03006f00ade3a25564ae@[204.162.75.169]>


>... how much data
>mining is starting to catch on and the positive, quantifiable
>returns it is generating.
>
Returns for whom?

>can people "automagically" take money from your ATM card? nope. in the
>same way, your microwallet will be secure. it will be even more secure,
>because less money is involved.
>
How much money is involved would be up to the consumer.  It would be as secure
as a normal wallet, excepting that I don't usually give people permission to
open my wallet and take money out at regular intervals.

[...]
>can ensure that the money is transferred. the data is not delivered
>unless the payment is received. scam artists can be caught with
>"better business bureau" type rating services.
>
Any cryptographic system has ways to circumvent it.  Whether or not they
are practical is the issue.
As for scam artists, perhaps we could have a scam-artist bit along with
the age bit ;)

>the poster clearly suggested payment PER TIME as a limit.  a pretty
>obvious concept, and easy to implement, don't you think? why does it
>figure as one of your major objections?
>
Because the time limit can be set ridiculously low, making the rates
artificially high from the viewpoint of the kind of time periods that
humans work in.

>it won't happen with micropayments either, because it will be *your*wallet*
>that tells you when it is has an opportunity to pay. no one is dipping
>into your wallet, metaphorically. the actions are always initiated by you.
>
The action of going somewhere that charges a metered rate is initiated by the
user, however to make this safe for the consumer it would have to be required
that there be a 'front door' for every site that charged metered rates
announcing that if you proceed you'll be billed (and, at what rate).  If you
let people charge as soon as you hit their URL, that's malarkey.

>somewhat. mainframes aren't totally the mark of the devil. don't you pay
>your internet provider per hour? how many people do? isn't a Sun pretty
>
No, I don't.  I use it too much, so I found an ISP that does not charge metered
rates.  A lot of people pay by the hour for their ISP, but it may or may not
be a wise idea for them.  If it's part of their work and they're online all the
time, they should consider another payment system.  Same thing with charging
micropayments for using software.  If Adobe started charging me $5/hr to use
Photoshop instead of $500 for the package, I'd stop using photoshop.  In two
weeks I'd have already exceeded the price of the whole package.

>much equivalent/similar in processing power & capability to old mainframes?
>you raise all kinds of objections that make no sense to me.
>
Sure it's the same power as an old mainframe.  Big deal.  What exactly does
that
do to stregnthen your argument?  It's certainly not as costly to build, costly
to maintain, or rare as old mainframes...

>the user is always free to go where a better vendor gives him what he
>wants. because the user can now pay in tiny increments, he has enormous
>increase freedom. he can move between different services far more readily.
>no body is FORCING anyone to spend money.
>
The potential for scams exists.  Certainly even a priest in the church of the
free market can see that.  User education is poor, and consumer protection laws
are weakening.  This does not bode well fo r

>uh huh. what if over your lifetime it cost far less than you pay for
>a shinkwrapped package?
>
If that happened, I'd be very suprised.

>what if you only needed a quick compilation on
>a system you don't normally use? I think you will begin to figure out
>some advantages if you use your imagination to find them (instead of the
>drawbacks)
>
That is a good advantage, you are correct in this.  But there are a number of
instances in which I'd still want software running on a real workstation.  If
people make software only available through micropayments, then that would be
limiting to both the user and the vendor.

>you have this concept of "automated billing" that simply doesn't fit. people
>know how much they are being charged. the payment is UNDER THE COMPLETE
>CONTROL OF THE PAYER, NOT THE BILLER. this simple misconception seems to
>underly a lot of the micropayment objections I've been seeing.
>
The payer could set a certain amount of money that is automatically deemed
acceptable to pay, like the $.02/time-unit example.  This could get misused
by a vendor who chooses a unit small enough that a small per-unit charge
quickly
adds up.  The payer essentially loses control of payment.

>or, it may be that entire new industries spring up because the software
>companies are better able to be compensated for their work from skittish
>consumers. people may be more free about spending micropayments than
>buying shrinkwrapped software. psychologically I think micropayments
>are far more appealing in some ways.
>
In some ways.  But those of use who use certain packages heavily would get
shafted for our loyal support of a vendor if they decided to pander to the
skittish masses and charge a rate that was psychologically more appealing
to
those who wouldn't otherwise use it.  I only hope that vendors who choose to
use micropayments (since they're inevitable) take the small but loyal power
user segment into consideration when making the decision about whether or not
to stop selling full packages altogether.

>admittedly some things have to be in place: a high speed network, and
>other infrastructure ideas. it isn't totally feasible today in cyberspace,
>but large parts of it are and are already being implemented (chaum's
>digicash)
>
The best model is not the mainframe model promoted by the idea of the "internet
computer" (aka. Mutant X-Terminal), but a truly distributed system.
Workstations and PCs can contribute their substantial processing power to a
distributed system.  The other problem I have with the mainframe model and
centralized resources is storage.  It's bad enough to have to wait in line for
a CPU, but the idea of having no direct access to my work is unappealing,
and for a number of industries impossible.  I doubt designers, for example,
would
be willing to leave client work on the big Illustrator server cluster at Adobe.
Fat pipes connecting fast PCs to even faster servers is the best route.


>false, imho. imagine that I can buy only the shows I want to watch, and it
>>out to less than my $20 monthly cable bill. economically this is perfectly
>sensible. people want to pay for what they watch. you seem to think that
>
I was looking at this from a vendor viewpoint in this particular instance.  The
TV old guard may not be willing to give up all that big, fat (and reliable) ad
revenue to the whim of John and Jane Q. Tvwatcher.

>micropayments means "everything costs more". a strange assumption. what if
>I assume, "everything costs less" because billing costs, which other
>posters have pointed out are so enormous, are vaporized?
>
I'd like to see them vaporized.  Billing costs are the swindle of the decade.
I'm quite tempted to cut up both my credit card and ATM card because of the
bullshit administrative fees involved with using them.  Internet transaction
fees are even worse.

>it is true that some industries will change and meld into other forms
>with this new revolutionary form of payment.  welcome to the concept of
> an economy in which anything that is stagnant tends to die.
>
Yeah, but the old tends to cling on for dear life.  Welcome to the concept
of people and institutions that are unwilling to change and do their best to
postpone those changes.

Change doesn't bother *me* personally, I just wish more people would *think*
about whether or not changes are *appropriate* instead of just *possible*.

>right. shows that are not watched are going to go extinct. why should
>advertisers fund them? you think that advertisers have to be fooled
>to pay money to a show?
>
They are now.  It was a pragmatic point.

>that's correct. why do you suggest it would be an infeasible apocalypse?
>it might be an apocalypse of old concepts, but it isn't infeasible.
>
That's not infeasable.  I didn't say anything was infeasable, I just think
some of the current models of how things might work are bad ideas and encourage
debate.  Both consumers and resistant old-school vendors will have issues to
address, and ramming change down people's throats because it's inevitable or
'the market dictates it' is a crappy attitude which I don't encourage.  Also,
note for the record that I don't believe that "the market" is a one-to-one
mapping on to "the people" or even "the consumer".

>false, imho. again the consumer maintains complete control. in a sense
>they have far greater control. if they don't like a company they
>can go somewhere else after only spending a micropayment instead of
>a macropayment. you may find that companies increase their level of
>service and customer satisfaction. but there will probably bogus uses
>that apparently you will gravitate towards, based on your seeming
>preference for them.
>
Ha ha ha.  Yeah, looking out for consumer interests is just doom saying and
negativism.  The current education level of the general public about computers
is low, and about transactional security is even lower.  It can have benefits,
but there are also serious issues which need to be considered.  Another thing
about the paying a micropayment instead of a macropayment and leaving if
you don't like it - a lot of companies offer free trial time with their
service, or a free consultation, etc.  The effects of charging for these
trial offers is
unclear - how would that be good for the consumer?

>imagine shareware authors getting cash for their programs based on their
>actual use. imagine artists and writers bypassing corporate monoliths
>and marketing their work to the public directly, bypassing the enormous
>scrape-off that these self-perpetuating bureacracies snarf.
>
This is a good idea.  It could be a good boon for small businesses (unless
the transaction providers charge prohibitively large fees for their
services...).  I hope you're right and I'm wrong.  That would be much better
for all involved.

>you seem to start from the assumption, "businesses are out to shaft the
>little guy". well, that can be true whether you have micropayments
>or not. I doubt micropayments would make it any worse. it won't solve
>the problem (I agree there is a great greed in places) but it may actually
>make it far more difficult for companies to shaft people, once you think
>about it. remember, the consumer has total control. how can you get
>shafted when you have total control?
>
Your argument works provided the consumer really maintains control.
You can lose that control.  There do need to be safeguards in such a system
that ensure this control.  $.02/nanosecond is, after all, $1.2 billion/minute.
If such a setting were allowed and people habitually allowed $.02/unit
metering as being automatically acceptable, that could clean out a number
of digital
wallets very quickly as unsuspecting customers entered the paid area and
instantly got dialogue boxes announcing that their wallets were empty.

ttl
Stephan


-------------------------------------------------------------------
This signature has been kidnapped by space aliens.
If you find it you can call (415) 703-8748.
I work for Studio Archetype, and they don't find any of this funny.







From wb8foz at nrk.com  Wed Jun 12 02:06:49 1996
From: wb8foz at nrk.com (David Lesher)
Date: Wed, 12 Jun 1996 17:06:49 +0800
Subject: CDA decision TOMORROW 9 am! (fwd)
Message-ID: <199606120259.WAA02510@nrk.com>



The CDA deathwatch is almost over.

The Philadelphia court will announce its decision tomorrow, 6/12, at 9 AM 
EST, according to a fax from the court.

Check the usual web sites for more info and breaking news on the decision:

http://fight-censorship.dementia.org/top/
http://www.eff.org/
http://www.vtw.org/
http://www.aclu.org/
http://www.epic.org/
http://www.cdt.org/

The ACLU is holding a press conference in NYC at 11 am. The ALA/CIEC 
plaintiffs will be holding a press conference in Washington, DC at 12 noon.

For the latest information, subscribe to the fight-censorship-announce
mailing list by sending "subscribe fight-censorship-announce" to
majordomo at vorlon.mit.edu. 

-Declan


// declan at eff.org // I do not represent the EFF // declan at well.com //





From sameer at c2.org  Wed Jun 12 02:23:02 1996
From: sameer at c2.org (sameer at c2.org)
Date: Wed, 12 Jun 1996 17:23:02 +0800
Subject: RSA patents in Canada
Message-ID: <199606112304.QAA22657@atropos.c2.org>


	Anyone have a definitive source on the state of the RSA patent
in Canada? Thanks.

-- 
Sameer Parekh					Voice:   510-601-9777x3
Community ConneXion, Inc.			FAX:     510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.net/ (or login as "guest")		sameer at c2.net





From vznuri at netcom.com  Wed Jun 12 02:24:40 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Wed, 12 Jun 1996 17:24:40 +0800
Subject: Micropayments are Crap
In-Reply-To: <v03006f04ade3579bc415@[204.162.75.169]>
Message-ID: <199606112120.OAA29300@netcom2.netcom.com>



once again, I am confused why this micropayment thing is
considered so controversial and questionable to some. it
seems at the forefront of sensibility to me. clearly we
are struggling with different conceptions/preconceptions
of something that doesn't yet exist.

>As far as I'm concerned Micropayments as appealing to me as Data Mining. 

an interesting way to start off the essay, considering how much data
mining is starting to catch on and the positive, quantifiable
returns it is generating.

 I
>certainly see how my wallet would benefits from being on the receiving end of
>the money and/or information, but I can also clearly see the detrements of
>being the one whose money and information was "automagically" being
>appropriated.

can people "automagically" take money from your ATM card? nope. in the
same way, your microwallet will be secure. it will be even more secure,
because less money is involved.

> but try convincing a vendor who is already suspicious of
>'all this computer stuff' that you really sent them some money and a savvy
>hacker pilfered it all - log or no log.

there is no "convincing someone". people are using the idea of 
handing over money, of bills, etc-- all this makes no sense. it is
all handled at the transaction level. there is no subjectivity. the
vendor either received the cash or not. the cryptographic protocols
can ensure that the money is transferred. the data is not delivered
unless the payment is received. scam artists can be caught with
"better business bureau" type rating services.

>Setting a micropayment enabled web browser to automatically grant approval to
>payments of $.02/action may seem reasonable, but it depends on what the vendor
>has decided constitues an action. 
> If somone charged $.02/nanosecond for
>retreiving shareware from an FTP library, and my browser was set to accept this
>as reasonable based on the fact that it was $.02/action,

the poster clearly suggested payment PER TIME as a limit.  a pretty
obvious concept, and easy to implement, don't you think? why does it
figure as one of your major objections?

>This doesn't happen with phones (well, not as much).  The virtual nomadness of
>wandering the net leaves a lot of people - even otherwise careful people -
>vulnerable to rate traps.

it won't happen with micropayments either, because it will be *your*wallet*
that tells you when it is has an opportunity to pay. no one is dipping
into your wallet, metaphorically. the actions are always initiated by you.

>Micropayment proponents are incredibly fond of the proposition that software
>could be leased on a usage time basis from a centralized server, and people
>could also rent time on the servers' CPUs.  Sounds an awful lot like the
>mainframe days to me. 

somewhat. mainframes aren't totally the mark of the devil. don't you pay
your internet provider per hour? how many people do? isn't a Sun pretty
much equivalent/similar in processing power & capability to old mainframes?
you raise all kinds of objections that make no sense to me.

 I see plenty of ways in which this benefits the
>vendor
>(greater control over distribution, centrailzed revision/upgrade distribution,
>greater profits over one-time sales, etc.), but no ways in which this benefits
>the user.

the user is always free to go where a better vendor gives him what he
wants. because the user can now pay in tiny increments, he has enormous
increase freedom. he can move between different services far more readily.
no body is FORCING anyone to spend money. 

  Especially the power user.  I'm certainly not going to rent time
>on a compiler or image editing program every single time I want to do some
>work.

uh huh. what if over your lifetime it cost far less than you pay for
a shinkwrapped package? what if you only needed a quick compilation on
a system you don't normally use? I think you will begin to figure out
some advantages if you use your imagination to find them (instead of the
drawbacks)

> As a
>programmer, I can
>see how I could make a fat chunk of change by bilking people through metered
>software usage, but as a software consumer it seems like a rotten idea. 

you have this concept of "automated billing" that simply doesn't fit. people
know how much they are being charged. the payment is UNDER THE COMPLETE
CONTROL OF THE PAYER, NOT THE BILLER. this simple misconception seems to
underly a lot of the micropayment objections I've been seeing.

 One
>effect it would have, however, would be an exponential increase in the quality
>and quantity of software available from the Free Software Foundation and
>other similar groups as people like myself fled en-masse from commercial
>software to a
>system where we knew what we were getting into ahead of time.

or, it may be that entire new industries spring up because the software
companies are better able to be compensated for their work from skittish
consumers. people may be more free about spending micropayments than 
buying shrinkwrapped software. psychologically I think micropayments
are far more appealing in some ways.

>The other rotten part of this idea, of course, is the irritating lag times
>involved with trying to run distributed software (especially poorly
>distributed
>software, and especially on an overloaded network infrastructure).

admittedly some things have to be in place: a high speed network, and
other infrastructure ideas. it isn't totally feasible today in cyberspace,
but large parts of it are and are already being implemented (chaum's
digicash)

>Looking at micropayments from the (economically) conservative element
>viewpoint within certain industries make them seem a lot less appealing, as
>well.  Take television.  If people had to purchase every TV show they
>watched, there would be a lot less TV production going on because there
>wouldn't be as much random TV watching.

false, imho. imagine that I can buy only the shows I want to watch, and it comes
out to less than my $20 monthly cable bill. economically this is perfectly
sensible. people want to pay for what they watch. you seem to think that
micropayments means "everything costs more". a strange assumption. what if
I assume, "everything costs less" because billing costs, which other
posters have pointed out are so enormous, are vaporized?

it is true that some industries will change and meld into other forms
with this new revolutionary form of payment.  welcome to the concept of
 an economy in which anything that is stagnant tends to die.

   No matter how stupid you may
>think your customers are, if you change their pay structure they think
>about it - even if only briefly.  It would also be harder to sell TV
>advertising, because if nobody was watching a show everyone would know
>because this would be metered even better than current rating systems. 

right. shows that are not watched are going to go extinct. why should
advertisers fund them? you think that advertisers have to be fooled
to pay money to a show?

 The
>nature of the TV advertising industry would change because instead of the
>archetypal/statistical sampling of Nielsen ratings, you'd know *exactly*
>who was watching what.

that's correct. why do you suggest it would be an infeasible apocalypse?
it might be an apocalypse of old concepts, but it isn't infeasible.

>Both micropayments and data mining require that the user give the vendor a
>level of trust which most vendors are not willing to repay with similar
>trust and customer satisfaction.  Customer-users are expected to give
>vendors greater access to and control over their money and personal
>information, yet at best they can expect the same poor customer service and
>bureaucratic attitudes encountered when dealing with traditional
>transaction processing companies and at worst can expect to be swindled out
>of piles of money and/or have their
>privacy violated as a matter of course.

false, imho. again the consumer maintains complete control. in a sense
they have far greater control. if they don't like a company they
can go somewhere else after only spending a micropayment instead of
a macropayment. you may find that companies increase their level of
service and customer satisfaction. but there will probably bogus uses
that apparently you will gravitate towards, based on your seeming
preference for them.

>Working where I do, everyone around me is on the side of the vendors - who
>make up part of our client base.  On cypherpunks, of course, I'm largely
>preaching to the converted.  There can be a middle ground, however the
>middle ground that's been offered so far still leaves the consumer with the
>sort end of the stick and
>I'm not convinced they're ultimately what's best for business - especially if
>you cling to seemingly outdated ideas like good customer relations, good
>public/social relations, and long range growth relationships over short
>term
>profit pumping.

imagine shareware authors getting cash for their programs based on their
actual use. imagine artists and writers bypassing corporate monoliths
and marketing their work to the public directly, bypassing the enormous
scrape-off that these self-perpetuating bureacracies snarf.

you seem to start from the assumption, "businesses are out to shaft the
little guy". well, that can be true whether you have micropayments
or not. I doubt micropayments would make it any worse. it won't solve
the problem (I agree there is a great greed in places) but it may actually
make it far more difficult for companies to shaft people, once you think
about it. remember, the consumer has total control. how can you get
shafted when you have total control?






From declan at eff.org  Wed Jun 12 02:26:23 1996
From: declan at eff.org (Declan McCullagh)
Date: Wed, 12 Jun 1996 17:26:23 +0800
Subject: CDA decision TOMORROW 9 am!
Message-ID: <Pine.SUN.3.91.960611154828.21337C-100000@eff.org>


The CDA deathwatch is almost over.

The Philadelphia court will announce its decision tomorrow, 6/12, at 9 AM 
EST, according to a fax from the court.

Check the usual web sites for more info and breaking news on the decision:

http://fight-censorship.dementia.org/top/
http://www.eff.org/
http://www.vtw.org/
http://www.aclu.org/
http://www.epic.org/
http://www.cdt.org/

The ACLU is holding a press conference in NYC at 11 am. The ALA/CIEC 
plaintiffs will be holding a press conference in Washington, DC at 12 noon.

For the latest information, subscribe to the fight-censorship-announce
mailing list by sending "subscribe fight-censorship-announce" to
majordomo at vorlon.mit.edu. 

-Declan


// declan at eff.org // I do not represent the EFF // declan at well.com //






From ses at tipper.oit.unc.edu  Wed Jun 12 02:32:58 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Wed, 12 Jun 1996 17:32:58 +0800
Subject: Micropayments are Crap
In-Reply-To: <v03006f04ade3579bc415@[204.162.75.169]>
Message-ID: <Pine.SUN.3.91.960611181936.27362E-100000@tipper.oit.unc.edu>


I've had this argument lots of times, and I tend to flip-flop between 
several positions, but I think you're missing the big big win of 
micropayments(*). Micropayments allow an individual to charge for 
information which is of value to the reader, but the magnitude of which 
is too small to handle by conventional means; for example, a single 
article or comic strip in a newspaper is too cheap to perform a complete 
SET/{VISA,MC,NOVUS) transaction for. The journalist cannot sell the work 
direct- instead she must sell the work through a middleman who takes by 
far the biggest cut. 

 Micropayments allow each author to be her own wire-service. _This_ will 
be the triggering point for the new media. These services can be combined 
into edited newspapers without the editors needing to set up complex 
traditional arrangements (I'd pay for John Young's Daily News :)

Freedom of the Press belongs to those who own the vending machines

Simon


(*) For the purpose of this message, micropayments are defined to be low 
value transactions below the minimum values acceptable for conventional 
payment networks



---
Cause maybe  (maybe)		      | In my mind I'm going to Carolina
you're gonna be the one that saves me | - back in Chapel Hill May 16th.
And after all			      | Email address remains unchanged
You're my firewall -    	      | ........First in Usenet.........






From fletch at ain.bls.com  Wed Jun 12 02:47:16 1996
From: fletch at ain.bls.com (Mike Fletcher)
Date: Wed, 12 Jun 1996 17:47:16 +0800
Subject: Anonymous return addresses
In-Reply-To: <Pine.SV4.3.91.960611172935.20391B-100000@larry.infi.net>
Message-ID: <9606120354.AA16387@outland.ain_dev>


> Can anyone "give away the Ending" of Cliff Stoll's book - and describe 
> the basic methodology used to track back to the German hacker?

	Can't remember the exact details (and I can't remember where
my copy is :), but basically they used the ACK/NAK times in the kermit
protocol to guess his distance.  After tracing him back to some firm
in Va, they worked out to Germany and then the Bundespost ran a phone
trace to find him.  (So all y'all malicious crackers that have the
TLAs trembling in their jackboots remember to tweak your kermit (or
rz) progs to randomize response times. :)

	I'd reccommend reading the book.  It's pretty interesting.  Or
Nova did an episode ~2 years back (whenever the book came out) that
was a quick 1hr version of the whole story.

---
Fletch                                                     __`'/|
fletch at ain.bls.com  "Lisa, in this house we obey the       \ o.O'    ______
404 713-0414(w)      Laws of Thermodynamics!" H. Simpson   =(___)= -| Ack. |
404 315-7264(h) PGP Print: 8D8736A8FC59B2E6 8E675B341E378E43  U      ------





From jimbell at pacifier.com  Wed Jun 12 02:49:32 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 12 Jun 1996 17:49:32 +0800
Subject: Venture capital financing/partnering for unique website ideas/entrepreneurs
Message-ID: <199606120522.WAA18166@mail.pacifier.com>


At 03:19 PM 6/11/96 -0400, Ventureweb at aol.com wrote:
> Re:	Venture Capital Funding/Venture Partnering For
> 	Web Site Developers/Entrepreneurs
>
> Hello;
>
> 	My firm, DataMerge, Inc.  is currently developing a program to
>provide financial backing and strategic assistance for commercially
>viable website development. It is my job to locate individuals with ideas
>and/or plans for creating high profile,  niche market websites that, with
>our assistance,  can be profitably brought to maket.


Hmmmm...   "High profile"?  Check.   "niche market"?  Check.  "profitable"?  Check...



Jim Bell
jimbell at pacifier.com





From mclow at owl.csusm.edu  Wed Jun 12 02:56:18 1996
From: mclow at owl.csusm.edu (Marshall Clow)
Date: Wed, 12 Jun 1996 17:56:18 +0800
Subject: Britain to control crypto - official (fwd from Usenet)
In-Reply-To: <199606112007.QAA01167@nrk.com>
Message-ID: <v03007300ade3fff0f555@[207.67.246.99]>


>The British government quietly announced yesterday that it will
>legislate to restrict crypto. The details are in the attached
>Reuters and PA newswires.
>
[snip]
>    "The TTPs would offer digital signature, data integrity and retrieval, key
>management and other services for which there is a commercial demand," Taylor
>said in a written parliamentary answer.
>
It's been said before, but I'll say it again.
I have no objection with this.

If people wish to safeguard their encryption/signature keys by leaving them with a "trusted third party", then they should be able to do so.

If this is a requirement, then it's hardly a service for which there is a "commercial demand".

I assume that followup news releases (or the aforementioned workshop) will clarify the situation.

-- Marshall

Marshall Clow     Aladdin Systems   <mailto:mclow at mailhost2.csusm.edu>

"We don't have to take it; never have, never will.
Gonna shake it, gonna break it; let's forget it: better still" --The Who, "Tommy"







From stewarts at ix.netcom.com  Wed Jun 12 02:59:52 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 12 Jun 1996 17:59:52 +0800
Subject: "Neil, the government wouldn't tap the phones of American Reporters"
Message-ID: <199606120414.VAA02424@toad.com>


"Neil, the government wouldn't tap the phones of American Reporters"
- Hedrick Smith to his NYT colleague Neil Sheehan, while working
on the Pentagon Papers project - he was incorrect, and his phones
_were_ being tapped....

CSPAN-2 is doing a 25-year retrospective on the Pentagon Papers this week;
Daniel Ellsberg, Hedrick Smith, and others were on tonight,
with people from other sides on later this week.  Cool show so far!

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From serw30 at gibson.cioe.com  Wed Jun 12 03:00:59 1996
From: serw30 at gibson.cioe.com (Eric Wilson)
Date: Wed, 12 Jun 1996 18:00:59 +0800
Subject: Slander of Catholic Church
Message-ID: <1.5.4.32.19960611201845.0066db50@gibson.cioe.com>


At 08:31 AM 6/11/96 -0400, you wrote:
>
>      Tim ,
>          You should stick to your own religion and not criticize other 
>peoples. It is unforunate that the esteem that I once felt for you is 
>dwindling because of your anti-Mormon trash. Perhaps you do not realise 
>that some people take more than an academic interest in their religion 
>;this is unforunate . It is pitiful.You are becomeing the ugly 
>American that foreigners hate; always having an opinion about everything.
>                               moroni
>
>
Hmmm.... This brings up two questions:

1. If you stick to your own religion, aren't you kind of saying the others
are bad (or don't work) anyway? Its hard to be more critical than the "I'm
going to heaven and you're not, because you don't do this...." crowd.

2. Isn't hard NOT to have an opinion about something?

Eric






From blancw at accessone.com  Wed Jun 12 03:23:56 1996
From: blancw at accessone.com (blanc)
Date: Wed, 12 Jun 1996 18:23:56 +0800
Subject: [MISC]  Speaking of Wearables
Message-ID: <01BB57DC.B7852AC0@blancw.accessone.com>


Thought this might be of interest to some.....

---------- Forwarded message ----------
Date: Mon, 10 Jun 1996 16:26:29 -0700 (PDT)
From: Phil Agre <pagre at weber.ucsd.edu>
To: rre at weber.ucsd.edu
Subject: Wearable computing conference August 19-21st

[The world is so wonderfully strange.]

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
This message was forwarded through the Red Rock Eater News Service (RRE).
Send any replies to the original author, listed in the From: field below.
You are welcome to send the message along to others but please do not use
the "redirect" command.  For information on RRE, including instructions
for (un)subscribing, send an empty message to  rre-help at weber.ucsd.edu
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Date: Mon, 10 Jun 1996 18:50:09 -0400
From: Thad E Starner <testarne at tottenhamcourt.media.mit.edu>
Subject: Wearable computing conference August 19-21st

[...]

		 Announcement/Call for Participation
		Workshop on Wearable Computer Systems

Over the past few years, a new technology has been rapidly taking
shape.  It is the technology of wearable computer systems --
battery-operated computer systems worn on the user's body on a belt,
backpack or vest, designed for mobile and predominantly hands-free
operation, often incorporating head-mounted displays and speech input.
Such systems are now being prototyped and investigated in the context
of a wide variety of military, educational and industrial
applications, including maintenance, training, and manufacturing.

On August 19-21, Boeing will host an informal workshop on wearable
computer technology, at the Boeing Customer Services Training Center
in Renton, WA, a few miles east of Seattle-Tacoma International
Airport.  Our intent is to bring together vendors and potential
vendors of these systems, researchers studying this technolgy, and key
application customers for an open discussion of the future of wearable
computer systems technology.  The workshop's technical focus will be
on the platforms, peripherals, software systems and applications
associated with wearable computers.  The format of the meeting will be
as follows:

o There will be several research presentations.  Leading university,
industrial, and government labs will discuss the research they are
doing concerning the design and use of future wearable systems.

o Booth space will be available for vendors to display and demonstrate
their current products. 

o Selected government and industrial developers will describe the
wearable computer applications they are planning or implementing,
and the technical requirements implied by these applications.

o Later in the meeting, participants will separate into breakout
discussion groups of their choice to focus on issues of particular
interest to them.  Each breakout group will present a summary of their
discussion and their recommendations to the main body of the
workshop particpants.  Breakout discussion topics may include

	- what standards need to be established?

	- what are the operating system and user interface software
	  requirements for wearable computers?

	- what basic and applied research should the government fund
	  in this area?

A more detailed list of possible breakout discussion topics is
included on the workshop registration form.  Registrants are requested
to select which topics they believe would be most worthwhile to
address at the meeting.

How to Apply to Participate

Because of space limitations and the informal nature of this workshop,
attendance will be limited to 150. Persons or groups wishing to attend
should submit either a booth request or a research or application
position paper, as described below.  Academic, government, industrial
or vendor researchers and government, industrial or vendor application
developers are invited to submit position papers.  As time permits,
attendees will be asked to give brief talks about their research or
development activities, based on their position papers.  There may not
be time for all attendees to speak to the group.  In that case, the
organizing committee will try to select a representative mix of
research and application talks from among the position papers.

Position papers and booth requests may be submitted by mail to

	Ms. Diane Rush
	Research and Technology
	Boeing Information and Support Services
	P.O. Box 3707, Mail Stop 7L-40
	Seattle, WA 98124-2207

or by fax to 206-865-2965, 

or by Internet mail to diane.rush at iss-rt.boeing.com

We strongly prefer submission via e-mail (ASCII text). 

For related questions, Diane can be reached by phone at 206-865-3211.

Due Dates

Booth space requests and workshop position papers are due by June 19.
The committee's selections will be announced by July 12.

Research Papers

People engaged in research projects on wearable computer systems are
invited to submit a two-page position paper, describing 

	- the problems their research project is addressing
	- results they have achieved 
	- the potential implications of their research on the
	  future of this technology.

Application Papers

People conducting or commencing applications of wearable computers to
military, industrial, medical or other domains are invited to submit
two-page position papers describing their project, including

	- the application they are focused on
	- technical issues/problems they are encountering
	- requirements this application is placing on wearable
	  computer technology.

Vendor/Demo Booths

Booth space in and near the workshop auditorium is limited.  Displays
should be designed to fit within an 8' by 6' area.  Each display will
have access to electrical outlets and will be provided, if they
desire, with a 5' by 2' table.  Booth requests will be filled on
a first-come, first-served basis.

Accomodations

There are several hotels in Renton near the Boeing Customer Services
Training building.  Boeing buses will transport workshop attendees to
and from the meeting at the beginning and end of each workshop day.
The list of recommended hotels will be sent to attendees along with
their selection notification.  These hotels are reserving blocks of
rooms for workshop attendees until July 18.

Further Information About the Workshop

Up-to-date workshop information will be maintained on the World-Wide
Web, at the following address:
 
  http://wearables.www.media.mit.edu/projects/wearables/workshop/

Workshop Organizing Committee

David Mizell
Boeing Information and Support Services

Thomas Caudell
University of New Mexico

Zary Segall
University of Oregon

Dan Siewiorek
Carnegie Mellon University

Thad Starner
Massachusetts Institute of Technology









From ses at tipper.oit.unc.edu  Wed Jun 12 03:39:48 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Wed, 12 Jun 1996 18:39:48 +0800
Subject: Britain to control crypto - official (fwd from Usenet)
In-Reply-To: <199606112007.QAA01167@nrk.com>
Message-ID: <Pine.SUN.3.91.960611223647.28381C-100000@tipper.oit.unc.edu>


On Tue, 11 Jun 1996, David Lesher wrote:

> 
> Fuller details will no doubt be available at a one day workshop
> that the Ministry of Defence is organising at the IEE in Savoy
> Place on the 27th June. The speakers will include directors of
> both CESG (GCHQ's front operation) and DRA, as well as a policeman
> and the data protection registrar. The IEE's phone number is 0171
> 240 1871.

I'm going to be in London on the 27th- any other Cypherpunks ready to 
make a show of it?  

Simon







From schryver at radiks.net  Wed Jun 12 04:03:31 1996
From: schryver at radiks.net (Scott Schryvers)
Date: Wed, 12 Jun 1996 19:03:31 +0800
Subject: [Tiny bit o noise] was Re: Terrorism Hysteria on the net
Message-ID: <199606120655.BAA07112@sr.radiks.net>


At 12:12 PM 6/11/96 -0700, you wrote:
>
>snow  wrote:
>
>>>Give me 15 well trained soldiers(near special forces level) and
>>>I can do it in less than 60 days. Without touching a computer.
>
>Gary Howland <gary at systemics.com> adds:
>>Give me 10 well trained biological warfare scientists and I'll do
>>it in 30 ...
>
>>Anymore bids?  :-)
>
>Yeah, Give me one really sick monkey .....
>
>Brian
One final bid...
 
Give me one nanotech manufacturing facility and I can screw the
Universe. :)
PGP encrypted mail preferred.  
E-Mail me for my key.
Scott J. Schryvers <schryver at radiks.net>






From snow at smoke.suba.com  Wed Jun 12 04:15:49 1996
From: snow at smoke.suba.com (snow)
Date: Wed, 12 Jun 1996 19:15:49 +0800
Subject: plugging in
In-Reply-To: <199606111805.NAA03561@proust.suba.com>
Message-ID: <Pine.LNX.3.93.960612005436.295B-100000@smoke.suba.com>


On Tue, 11 Jun 1996, Alex Strasheim wrote:

> > Indeed -- the notion is that one could do things like put support for
> > encrypted/signed pages or other cryptographic tools (I haven't checked
> > if Netscape mail handles plugins, too) directly into Netscape where
> > ordinary users could smoothly use them.
> 
> Doing tech support at my ISP has made me very skeptical of anything that
> requires a plug in.  Most people aren't willing or able to download and
> install them.  Obviously that's not a problem for large organizations who

	As Mr. Strasheim's front line in tech support, would like to add
capable. Many people simply cannot understand enough of what they are
doing to put things in the right places. 

	It gets very trying some times. See my post on murder. 

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From jamesd at echeque.com  Wed Jun 12 04:17:11 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Wed, 12 Jun 1996 19:17:11 +0800
Subject: Slander of Catholic Church
Message-ID: <199606120647.XAA03328@dns1.noc.best.net>


At 12:40 PM 6/11/96 -0700, Timothy C. May wrote:
> the "net.war" declared by some on
> the Church of Scientology is little different than having a similar war
> against Catholics, Rosicrucians, Parsees, whatever.


There is a very great difference:  Scientology made war on the net.

The Catholics, Rosicrucians, whatever, have not.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From snow at smoke.suba.com  Wed Jun 12 04:21:49 1996
From: snow at smoke.suba.com (snow)
Date: Wed, 12 Jun 1996 19:21:49 +0800
Subject: <NOISE>
In-Reply-To: <gaVcPD5w165w@bwalk.dm.com>
Message-ID: <Pine.LNX.3.93.960612000115.295A-100000@smoke.suba.com>


On Tue, 11 Jun 1996, Dr.Dimitri Vulis KOTM wrote:

> snow <snow at smoke.suba.com> writes:
> ...
> > 	It is almost ridicoulously simple to kill someone in a relatively
> > untraceable fashion. Any person of average intelligence can do a little
> > research (say about 3 hours at a decent (non-chicago) library) and spend
> > an hour or two in thought and come up with a way to target a non- to
> > moderately public figure with out getting caught.
> > 	I can give you 4 right off the top of my head that have a
> > reasonable chance of sucess, and very little chance of discovery.
> 
> Please do - thank you.
> 
> With purely academic interest,

	These methods assume a reasonable amount of stealth and
intelligence on the part of the murder, meaning things like choosing the
appropriate time of day to carry out the attack. Also notice that some of
these methods cause more "collateral" damage than others. These are also
not particluarly suited to a highly placed political victim. Those (as
noted) take more work.

	Remember AT ALL TIMES That you MUST be worried about forensic
evidence. Hair, skin, finger prints, blood etc. TAKE PRECAUTIONS. 

	Also note that I have never tried any of these, nor has anyone I
know--at least to my knowlege. They seem like they would work, but are
not, of course, guarenteed to work. 

	Some generic advise that generally applies in all circumstances:
	1) Get scruffy before hand if possible. Don't shave or wash/comb
your hair or bush your teeth. Wear _decent_ clothes aquired from a second
hand store in colors you don't normally wear (don't deliberately clash,
it is too obvious). If you normally wear shoes, wear boots and vice versa.
Of course dispose of the clothing as soon as possible after the event, and
clean yourself up to whatever is normal for you. Don't bother growning a
beard, it takes too long, and it's sudden appearance and removal could be
questioned. 
	
	1) Wire/tape 6 to 8 large cans of hair spray around the tail pipe
ofvictims car. This assumes 3 things-- 1) Victim drives, 2) You have access
to Victims car (best time is around 4 or 5 in the morning) 3) You are sure
that the victim will be in the car. Most hairspray is at least somewhat
flamable, and when heated by a tail pipe will go off like a bomb.
Thourghly clean the cans before hand to remove any possible remaining
prints and/or other forensic evidence.
	This works best in a suburb or a rural area where a) people are
less likely to be out and about at night, and b) are more likely to own
and regularly use an automobile. 

	2) Aquire a .22 caliber air pistol, clean thoroughly. Get a cigar
and boil it down to get a small amount of "pure" nicoteen. This is a
decently potent poison. Pack a portion of this into the cup end of a
pellet. Wear latex gloves On a busy street approach your victim from
behind as he/she is walking. Shoot him/her (expose the pellet gun as
little as possible. Keep walking steadily. Randomly turn corners, dropping
the gun in the trash at the first opportunity. Gloves a couple of blocks
later. 
	This would work best in a LARGE city. I don't know if you can get
a guarenteed lethal dose of nicoteen into that cup, but you could
substitute a more lethal poison at a risk of more tracability.
	This assumes that there are no cops in the immediate area. It
works on the idea that the small sound of a pellet gun going off will be
lost in the general traffic noise, and that people will be more attentive
to the victim than to random people.

	3) This one is definately NOT for the squemish, or the weak. If
the victim lives alone, or is likely to be alone at home for a length of
time, enter the home. Kill the victim using some sort of poison or other
bloodless method (strangulation, breaking the neck etc)  Carry the body to
the bathroom and drain as much blood from the body as possible. This may
take a while, so use the time to strip as much flesh from the bones as
possible, being careful NOT to mess up the place any more than necessary,
as you will have to clean it. 
	If the victim has a garbage disposal, run as much of the flesh
down it as possible. When as much blood and flesh has been disoposed of as
possible, put the rest in small trash bags. Wash _everything_ as much as
possible. Put these trash bags into a second set of trash bags. Put these
trash bags into used military duffel bags purchased (one at a time) at
different military surplus stores. If you have been able to get most of
the flesh off, it would take much, and with most of the blood gone, the
weight will be gone, so you should be able to carry the rest of the body
off. Deposit the different body parts around the city/state in random
dumpsters etc. The wider you spread the parts the better.

	4) Turn your victim into the BAFT as the leader of an "End time"
right wing gun owning Cult preaching tax evasion & armed revolt against
the Zionist occupation government.
	Ok, I could think of 4 last night, but one slipped my mind
tonight.

	Before anyone kicks off into my ass about this, for four years of
my life I was paid to be prepared to kill at any time, and boredom can
lead to some very strange conversations.  


Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From dholmbrg at ncfcomm.com  Wed Jun 12 04:43:10 1996
From: dholmbrg at ncfcomm.com (Doug Holmberg)
Date: Wed, 12 Jun 1996 19:43:10 +0800
Subject: No Subject
Message-ID: <199606120733.CAA18734@cereal.ncfcomm.com>


Please show me what this list is like, as I read in the message.
dholmbrg at ncfcomm.com






From declan+ at CMU.EDU  Wed Jun 12 05:16:52 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Wed, 12 Jun 1996 20:16:52 +0800
Subject: HotWired article on NEW bill to let FCC set net-stds, repeal CDA
Message-ID: <YljXz4O00YUy0ZwEoj@andrew.cmu.edu>


I spoke with Rep. Lofgren for a while today while I was writing this
piece. I believe she's genuinely well-intentioned, but doesn't
understand the issues. 

Visit HotWired's web site for the full report.

-Declan

---

http://www.hotwired.com/netizen/96/24/index2a.html

   The Hydra
   HotWired Special Report
   by Brock N. Meeks and Declan McCullagh
   Washington, DC, 11 June 
   
   A bill that would attempt to "fix" the potential harm of the
   Communications Decency Act was dropped into the legislative boneyard
   late yesterday by freshman Representative Zoe Lofgren (D-California).
   The bill, dubbed the "Internet Freedom and Child Protection Act,"
   provides neither.
   
   [...]

   Then there are her loopy additions. All Internet service providers,
   under government mandate, will become vendors of "blocking software"
   such as SurfWatch or Cyber Patrol. Lofgren's bill says that all new
   ISP customers must be provided, either free or at a fee, "screening
   software that is designed to permit the customer to limit access to
   material that is unsuitable for children." Of course, nowhere does she
   define what "unsuitable" means.

   However, such vagueness didn't stop Lofgren from proposing that the
   Federal Communications Commission move into the business of setting
   commercial software standards. Under this bill, the FCC is required to
   "prescribe minimum technical standards for screening software."

   [...]

   How does the FCC feel about a new proposed role as "software
   commissioner?" Frankly, they'd rather not be involved, according
   to Mark Corbitt, technology policy advisor to Chairman Reed Hundt.








From mixmaster at remail.ecafe.org  Wed Jun 12 08:26:01 1996
From: mixmaster at remail.ecafe.org (Ecafe Mixmaster Remailer)
Date: Wed, 12 Jun 1996 23:26:01 +0800
Subject: Correction to "Hackerpunks and C2"
Message-ID: <199606121125.LAA17769@avignon.hypereality.co.uk>


There was a minor error in my earlier post. If someone were to notice a
node on the internet receiving a bag with L(In)=L(Posted) *before* any
other nodes on the internet, then one could guess that node had a user who
was the owner of Hackerpunks.





From mixmaster at remail.ecafe.org  Wed Jun 12 10:00:07 1996
From: mixmaster at remail.ecafe.org (Ecafe Mixmaster Remailer)
Date: Thu, 13 Jun 1996 01:00:07 +0800
Subject: Hackerpunks and C2
Message-ID: <199606121255.MAA03340@avignon.hypereality.co.uk>


There was a minor error in my earlier post. If someone were to notice a
node on the internet receiving a bag with L(In)=L(Posted) *before* any
other nodes on the internet, then one could guess that node had a user who
was the owner of Hackerpunks.





From WlkngOwl at unix.asb.com  Wed Jun 12 11:14:01 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Thu, 13 Jun 1996 02:14:01 +0800
Subject: Encrypting forwarding service?
Message-ID: <199606121226.IAA24371@unix.asb.com>



How does this idea sound: a forwarding service/remailer that accepts 
encrypted and forwards it to someone else (specified in the message), 
encrypting the message to that person.

Such a service can be set up at a site with *lots* of keys given to 
it.  This way if one wants to spontaneously send a message to someone 
that she doesn't have a key for, she can use the service.  (Perhaps 
the service would only accept or forward mail from/to people who 
submitted their keys, and possibly eca$h... it could also bounce 
messages back, re-encrypted, if there's a failure...)

This could be used like anonymous remailers to foil traffic analysis, 
but also for people who, in certain situations, don't want/need 
anonymitiy with the person they are corresponding with, and who don't 
necessarily have keys handy.

Comments?

Rob.







---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From dlv at bwalk.dm.com  Wed Jun 12 11:18:27 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Thu, 13 Jun 1996 02:18:27 +0800
Subject: Slander of Catholic Church
In-Reply-To: <199606120647.XAA03328@dns1.noc.best.net>
Message-ID: <wkRePD20w165w@bwalk.dm.com>


jamesd at echeque.com writes:

> At 12:40 PM 6/11/96 -0700, Timothy C. May wrote:
> > the "net.war" declared by some on
> > the Church of Scientology is little different than having a similar war
> > against Catholics, Rosicrucians, Parsees, whatever.
>
>
> There is a very great difference:  Scientology made war on the net.
>
> The Catholics, Rosicrucians, whatever, have not.

Who started it?

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From habs at warwick.com  Wed Jun 12 11:51:23 1996
From: habs at warwick.com (Harry S. Hawk)
Date: Thu, 13 Jun 1996 02:51:23 +0800
Subject: Court Blocks CDA
Message-ID: <199606121202.IAA12765@cmyk.warwick.com>



CNN reports court blocks CDA

-- 
Harry Hawk,     Manager of Interactive Communications
                Warwick Baker & Fiore,  212 941 4438,     habs at warwick.com

The Internet has the potential to set us free -- to learn anything and
do anything, whenever we want. No wonder politicians want to regulate
it -- The Washington Post, November 7, 1995, p. A13., Cyber Liberation
[Column], James K. Glassman





From jya at pipeline.com  Wed Jun 12 12:36:12 1996
From: jya at pipeline.com (John Young)
Date: Thu, 13 Jun 1996 03:36:12 +0800
Subject: New NRC Report Site
Message-ID: <199606121316.NAA08789@pipe2.t1.usa.pipeline.com>


Keith, 
 
 
The entire Web site hosting the NRC report was nuked by an alien or angel
yesterday. Another site is in preparation and we will announce it on
c'punks as soon as it is ready, probably later today. 
 
 
John





From brucem at wichita.fn.net  Wed Jun 12 12:37:29 1996
From: brucem at wichita.fn.net (Bruce M.)
Date: Thu, 13 Jun 1996 03:37:29 +0800
Subject: Terrorism Hysteria on the Net
In-Reply-To: <31BDA18F.2C67412E@systemics.com>
Message-ID: <Pine.BSI.3.91.960612084154.4976A-100000@wichita.fn.net>


On Tue, 11 Jun 1996, Gary Howland wrote:

> >         Give me 15 well trained soldiers(near special forces level) and I
> > can do it in less than 60 days. Without touching a computer.
> 
> Give me 10 well trained biological warfare scientists and I'll do it
> in 30 ...

    Give me 3 ICBM nukes and I'll do it in 1.

                    Bruce M. * brucem at feist.com
        ~---------------------------------------------------~
        "Knowledge enormous makes a god of me." -- John Keats






From scott.harney at bigeasy.com  Wed Jun 12 12:47:12 1996
From: scott.harney at bigeasy.com (Omegaman)
Date: Thu, 13 Jun 1996 03:47:12 +0800
Subject: CDA decision TOMORROW 9 am! (fwd)
Message-ID: <199606121440.IAA00200@betty.bigeasy.com>


Guess I was logged in at the right time this morning.  Judges ruled 
3-0 that the CDA is unconstitutional.  hooray.

I thought a little rejoicing was warranted. :)

me
------------------------------------------------------------
 Omegaman <omega at bigeasy.com>
 PGP Key fingerprint =  6D 31 C3 00 77 8C D1 C2  
                                59 0A 01 E3 AF 81 94 63 
------------------------------------------------------------





From bobpal at cdt.org  Wed Jun 12 13:08:12 1996
From: bobpal at cdt.org (Bob Palacios)
Date: Thu, 13 Jun 1996 04:08:12 +0800
Subject: We Won! Injunction granted against CDA
Message-ID: <v02140b03ade47bfff40a@[204.157.127.16]>


Text of the decision is available at http://www.cdt.org/ciec/.


-----
Bob Palacios, Online Organizer/Sysop     Center for Democracy and Technology
<bobpal at cdt.org>                             1634 Eye Street, NW  Suite 1100
                                                        Washington, DC 20006
http://www.cdt.org                                       (v) +1 202 637 9800
http://www.cdt.org/homes/bobpal/                         (f) +1 202 637 0968

           FIGHT INTERNET CENSORSHIP! Visit http://www.cdt.org/ciec







From declan at well.com  Wed Jun 12 13:24:28 1996
From: declan at well.com (Declan McCullagh)
Date: Thu, 13 Jun 1996 04:24:28 +0800
Subject: Fight-Censorship Dispatch #14: CDA VICTORY!!!
Message-ID: <v01510108ade487198a3b@[204.62.128.229]>





-----------------------------------------------------------------------------
                      Fight-Censorship Dispatch #14
-----------------------------------------------------------------------------
                              CDA VICTORY!!!
-----------------------------------------------------------------------------
         By Declan McCullagh / declan at well.com / Redistribute freely
-----------------------------------------------------------------------------

In this dispatch: Philly judges deal death blow to CDA, 3-0 decision
                  Press confererences and rallies


June 12, 1996

WASHINGTON, DC -- It's finally over, and it's about fucking time.

Our lawsuit seeking to overturn the ill-begotten Communications Decency
Act has succeeded in its first phase, two years after Sen. Jim Exon
(D-NE) first introduced the act. The three-judge panel struck down
both sections of the CDA in a unanimous decision.

Even Judge Ronald A. Buckwalter got a clue in the end.

The ACLU will have the text of its decision online at its web site by 11
am today. HotWired is putting together an extensive special report that
will go live this evening, including interviews with attorneys and
advocates on both sides of the issue.

Justice Department lawyers, unfortunately, declined to be interviewed
for it. Why? Let's just say they're not breaking out the champagne over
at DoJ headquarters over on tenth street.

And now, on to the Supreme Court...


+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+
                       PRESS CONFERENCES AND RALLIES
+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+

ACLU attorneys will hold a press conference at 11 am today at the
group's headquarters: 132 West 43rd Street, 5th floor, NYC. Contact
Emily Whitfield at 212-944-9800 x426, emilyaclu at aol.com. ACLU and ALA
plaintiffs will attend.

At noon today, CIEC representatives including Bruce Ennis (Jenner &
Block), Jerry Berman (CDT), and Bill Burrington (AOL) will hold a press
conference at Jenner & Block, 601 13th St. NW, Washington, DC. Contact
Sydney Rubin at 202-828-8829.

There's a New York City rally in Silicon Alley at 6:30 pm today at 626
Broadway, Suite 3-A. Contact: Shabbir Safdar (VTW) at 718-596-7234,
shabbir at vtw.org.

Pittsburghers will rally in defense of free speech online at 4 pm today
on the steps of the Oakland Branch of the Carnegie Library, on Forbes
Avenue adjacent to the campus of the University of Pittsburgh. Contact:
Josh Knauer at 412-683-6400, josh at envirolink.org.

HotWired is holding a live WiredSide chat with ALA/CIEC attorney Bruce
Ennis this evening.


-----------------------------------------------------------------------------

COPYRIGHT UPDATE: The House markup of HR2441 tentatively scheduled for
June 13 has been postponed indefinitely. My sources tell me that this
probably means the bill's dead this session.

HotWired's live WiredSide chat with ALA/CIEC attorney Bruce Ennis:
  http://www.hotwired.com/wiredside/

Relevant web sites:
  <http://www.aclu.org/>
  <http://www.vtw.org/>
  <http://www.epic.org/>
  <http://www.eff.org/>
  <http://www.ala.org/>
  <http://www.cpsr.org>
  <http://www.cdt.org/>

This document and previous Fight-Censorship Dispatches are archived at:
  <http://fight-censorship.dementia.org/top/>

To subscribe to future Fight-Censorship Dispatches and related
announcements, send "subscribe fight-censorship-announce" in the body
of a message addressed to:
  majordomo at vorlon.mit.edu

-----------------------------------------------------------------------------








From umwalber at cc.UManitoba.CA  Wed Jun 12 13:25:24 1996
From: umwalber at cc.UManitoba.CA (Sean Walberg)
Date: Thu, 13 Jun 1996 04:25:24 +0800
Subject: What constitutes a remailer?
Message-ID: <Pine.SOL.3.91.960612090350.20306A-100000@merak.cc.umanitoba.ca>


What really constitutes a remailer (pseudo-anonymous vs anonymous 
arguments aside)?  For example, the other day I received a message from 
66west.com saying that I had a greeting card waiting, I was to go to a 
certain URL and enter a simple password to retreive my "greeting card".  
Now this card had no return address, no name.  Could this constitute a 
remailer?  A while back there was a thread on how to take some of the 
responsibility off of the remailer operators (the last one in the chain 
more so), could this be a viable alternative?  (Actually, I believe it 
was discussed).  As for tracking, I'm sure the server logs are rotated 
often, and are not kept forever (our student page server here rotates 
daily and logs are kept for 4 days AFAIK), so perhaps this may even be 
less traceable.  Using these greeting cards, what prohibits me from 
sending a letter instead of "happy birthday"?

Will the anti-remailer people crack down on this also?  I can just see 
the law "Thou shalt not send greeting cards via email without photoID" 
:-) 

Sean

------------------------------------------------------------------
Sean Walberg                              umwalber at cc.umanitoba.ca
The Web Guy                  http://home.cc.umanitoba.ca/~umwalber 
UNIX Group, U. of Manitoba          PGP Key Available from Servers






From bryce at digicash.com  Wed Jun 12 13:39:09 1996
From: bryce at digicash.com (bryce at digicash.com)
Date: Thu, 13 Jun 1996 04:39:09 +0800
Subject: Micropayments are Crap
In-Reply-To: <Pine.SUN.3.91.960611181936.27362E-100000@tipper.oit.unc.edu>
Message-ID: <199606121429.QAA14198@digicash.com>



-----BEGIN PGP SIGNED MESSAGE-----

Simon Spero wrote something like:
>
>  Micropayments allow each author to be her own wire-service. _This_ will 
> be the triggering point for the new media. These services can be combined 
> into edited newspapers without the editors needing to set up complex 
> traditional arrangements (I'd pay for John Young's Daily News :)
> 
> Freedom of the Press belongs to those who own the vending machines


There are three things necessary for the New Media Paradigm to
take full effect:

1.  Many-to-many connectivity.  Check.  (infinite bandwidth blah
   blah..)
2.  Micropayments.  Coming soon to an electronic wallet near you.
   (Ecash(tm), bearer bonds, cheap tokens, coupons, blah blah..)
3.  New ratings systems.  Um...  Well, it would be easy to do 
   but few people seem to have really caught on to it yet.  
   I remain hopeful that it will come to pass as millions more
   come on-line and cetera.  I suppose having a certificate
   standard and a public key authentication infrastructure might
   help, although I secretly suspect that the good ole' Web O
   Trust would be sufficient for this purpose.  (After all, you
   only really take ratings from people you know, right?  Or
   people who have a "reviews" column in your local newspaper.)


Of course, despite all of our fond techno-utopian daydreams,
there is no telling whether this New Media Paradigm with its
absolute freedom-of-the-press and its free (or at least cheap)
presses is going to be good or bad for the current pop-culture
millionaires and the ugly tripe that they peddle.


Bryce

#include <stddisclaimer.h> /* Not speaking for anyone else at this time. */
- ----- BEGIN GOODTIMES VIRUS INNOCULATION -----
Once you have read and understood this .sig, you are immune 
to the Good Times virus.  Please help spread this innoculation!
- ----- END GOODTIMES VIRUS INNOCULATION -----



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i
Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2

iQB1AwUBMb7UQkjbHy8sKZitAQGg/wL/SDjAXkMH+pwwMIUONtXaWxDAMjNose0R
BCfQxFhTMqUUl1JwbYaX61X/L3ckm9/83+3uuFNeT/x/dsKcmIhVmalTBobdEWPV
XbvI/fsokUY0lahjmbgcsR0EmriS+F5L
=+T9Y
-----END PGP SIGNATURE-----





From shabbir at vtw.org  Wed Jun 12 14:29:01 1996
From: shabbir at vtw.org (Voters Telecommunications Watch)
Date: Thu, 13 Jun 1996 05:29:01 +0800
Subject: ALERT: We win!  Court rules 3-0 for free speech!
Message-ID: <199606121405.KAA21482@panix3.panix.com>


============================================================================
__     _________        __
\ \   / /_   _\ \      / /          FREE SPEECH WINS IN COURT!
 \ \ / /  | |  \ \ /\ / /          THE COURT DISSES THE CDA 3-0
  \ V /   | |   \ V  V /                    
   \_/    |_|    \_/\_/         NETIZENS CELEBRATE WITH FIREWORKS

              Redistribute this intact until June 15, 1996
                    URL:http://www.vtw.org/speech/

----------------------------------------------------------------------------
Table of Contents
        News
        How can I help spread the word?
        Rally information for NYC and Pittsburgh
        Press information

----------------------------------------------------------------------------
NEWS

WE WIN!

After 18 months of work, netizens finally got the justice they so
richly deserve.  The three-judge panel in Philadelphia issued a ruling
today saying that they had examined the Communications Decency Act,
learned about the Internet as a medium, and concluded that the law is
an inappropriate method of regulating cyberspace.  This decision
establishes an overwhelmingly positive precedent for the final decision
by the Supreme Court, expected early next year.

The famed "Question Mark" icon that had started popping up all over the
WWW changed simultaneously at 9:09am from a question mark to fireworks,
as thousands of Netizens began the mad rush to obtain a copy of the
court decision celebrating their victory.  You can read a copy of the
decision or obtain a copy of the icon yourself at
http://www.vtw.org/speech/

Senator Feingold (D-WI) said today, "This is welcome news for all of us
who not only support free speech, but who also want to see this new
dynamic communications technology develop safe from the threat of
censorship."

Feingold continued, "This issue is larger than so-called 'adult'
expression or communications.  It is about whether the government will
decide what we see, hear, and write."

Join millions of other netizens as they read the decision, rally, celebrate,
and thank the court for taking the time to do what some members in Congress
and the President would not do: apply the First Amendment. 

----------------------------------------------------------------------------
HOW CAN I HELP SPREAD THE WORD

It's crucial that people turn out for the rallies, as well as spread the word
about the decision.  You can help in a number of ways outlined below.

1. ATTEND THE NYC/PITTSBURGH RALLIES
If you are anywhere close to the locations of the Pittsburgh or New York
City rallies, please attend and brings lots of friends!

If you are an Internet provider in New York, please place the following
message in your message of the day:

        THE COURT ISSUED A RULING TODAY IN THE INTERNET FREE SPEECH CASE
        ON THE COMMUNICATIONS DECENCY ACT.  A RALLY IS BEING HELD IN
        NYC AT OUTERNET (BWAY.NET) @ 626 BROADWAY AT 6:30PM.  FOR MORE
        INFORMATION SEE http://www.vtw.org/speech/ OR CALL OUTERNET AT
        212-982-9800.

If you are an Internet provider in the Pittsburgh area, please place the
following message in your message of the day:

        THE COURT ISSUED A RULING TODAY IN THE INTERNET FREE SPEECH CASE
        ON THE COMMUNICATIONS DECENCY ACT.  A RALLY IS BEING HELD ON
        THE STEPS OF THE OAKLAND BRANCH OF THE CARNEGIE LIBRARY AT 4PM.
        FOR MORE INFORMATION SEE http://www.envirolink.org/ OR CALL 
        412-683-6400.

2. LINK TO THE TEXT OF THE COURT'S DECISION
The text of the decision will be posted at http://www.vtw.org/speech#decision
Link to it from your page and help spread the word about th case that
will decide so much of the future of free speech online.

        THE COURT ISSUED A RULING TODAY IN THE INTERNET FREE SPEECH CASE
        ON THE COMMUNICATIONS DECENCY ACT.  WHILE NETIZENS RALLY IN NEW
        YORK AND PITTSBURGH, YOU CAN READ THE DECISION ONLINE AT 
        http://www.vtw.org/speech/index.html#decision

----------------------------------------------------------------------------
RALLY INFORMATION FOR NYC AND PITTSBURGH

NEW YORK RALLY 
WHERE:    Outernet, Inc. (bway.net) @ 626 Broadway, Suite 3-A (third floor)
          (Very close to the Broadway/Lafayette stop on the F train)
WHO:      You and your friends!  Show up, bring friends, and come find
          out how net free speech fared in court.  Here is the current
          speaker list (subject to time, travel, and availability)
                U.S. Representative Jerrold Nadler (D-NY)
                Barry Steinhardt, American Civil Liberties Union (ACLU)
                Danny Weitzner, Center for Democracy and Technology (CDT)
                David Sobel, Electronic Privacy Information Center (EPIC)
                Molly Ker, Echo Communications (echonyc.com)
                Jonathan D. Wallace, author, "Sex, Laws, and Cyberspace"
                Alexis Rosen, Public Access Networks (panix.com)
                Ian Stevelman, Outernet (bway.net)

WHEN:     6:30pm, Wed June 12th, 1996.  Bring yourself, lots of friends,
          and whistles, drums, anything to make a lot of noise with.
MORE INFO:Check http://www.vtw.org/speech or http://www.bway.net/
          Press inquiries should go to Shabbir @ 917 978 8430.  Outernet's
          phone number is 212-982-9800.

PITTSBURGH RALLY 
WHERE:    Steps of the Oakland branch of the Carnegie Library
WHO:      You and your friends!  Show up, bring friends, and come find
          out how net free speech fared in court.
WHEN:     4pm, Wed June 12th, 1996.  Bring yourself, lots of friends,
          and whistles, drums, anything to make a lot of noise with.
MORE INFO:Check http://www.envirolink.org/.  Press inquiries should go
          to 412-683-6400.

----------------------------------------------------------------------------
PRESS INFORMATION

Press inquiries about the New York rally should be directed to Shabbir
J.  Safdar (VTW) at 718-596-2851.  To find out about outlets and
electricity for the rally, or to setup cameras ahead of time, contact
Ian @ Outernet at 212-982-9800.

============================================================================





From Clay.Olbon at dynetics.com  Wed Jun 12 15:24:35 1996
From: Clay.Olbon at dynetics.com (Clay Olbon II)
Date: Thu, 13 Jun 1996 06:24:35 +0800
Subject: Micropayments are Crap
Message-ID: <ADE43BCA-8C08F2@193.239.225.200>


I apologize in advance for this overly long post, but Stephan had a number
of arguments that I disagree with quite strongly.  In general, I think
micropayments are a good idea that should be tested where it counts, in the
marketplace.

	Clay

----------
Stephan Vladimir Bugaj <stephan at studioarchetype.com> wrote:

>Any cryptographic system has ways to circumvent it.  Whether or not they
>are practical is the issue.

How is this an argument against micropayments?  Lets just throw up our
hands and say that all crypto is theoretically breakable, therefore we
won't encrypt anything.

>Because the time limit can be set ridiculously low, making the rates
>artificially high from the viewpoint of the kind of time periods that
>humans work in.

Huh?

>The action of going somewhere that charges a metered rate is initiated by
>the
>user, however to make this safe for the consumer it would have to be
>required
>that there be a 'front door' for every site that charged metered rates
>announcing that if you proceed you'll be billed (and, at what rate).  If
you
>let people charge as soon as you hit their URL, that's malarkey.

Why is this malarkey?  What is wrong with saying "If you want to see my
page, it will cost you $.02?  Why would a "front door" make it any safer
for consumers?  I set my browser so that I spend no more than $1/hour or
$.02 on any one page without asking me.  How difficult is this concept?

>time, they should consider another payment system.  Same thing with
charging
>micropayments for using software.  If Adobe started charging me $5/hr to
use
>Photoshop instead of $500 for the package, I'd stop using photoshop.  In
two
>weeks I'd have already exceeded the price of the whole package.

Of course, there is lots of software that I only use once in a while, yet
spend large $$ on to have sitting on my machine metaphorically gathering
dust.  Micropayments would be very useful for this software.  On the other
hand, there is some software that I may want to buy outright.  This is not
an exclusive system.  BTW, any impression that you have that you are
currently buying unmetered software is false.  Don't you spend xx$/year to
run Photoshop in the form of "product upgrades" - or are you still running
version 1.0?

>The potential for scams exists.  Certainly even a priest in the church of
>the
>free market can see that.  User education is poor, and consumer protection
>laws
>are weakening.  This does not bode well fo r

I tend to disagree with most arguments for "consumer protection", so this
argument falls upon deaf ears.  There are lots of scams with every form of
money (cash, credit, even barter - if I trade you a lawnmower that only
runs for an hour afterwards, I have scammed you), how does this make
micropayments any more undesirable than any other form of payment?

>>uh huh. what if over your lifetime it cost far less than you pay for
>>a shinkwrapped package?
>>
>If that happened, I'd be very suprised.

Name some software that you have used less than 10 times in the past year. 
If you use a computer much, you might be surprised to find that you have a
long list.  I know I do.

>>what if you only needed a quick compilation on
>>a system you don't normally use? I think you will begin to figure out
>>some advantages if you use your imagination to find them (instead of the
>>drawbacks)
>>
>That is a good advantage, you are correct in this.  But there are a number
>of
>instances in which I'd still want software running on a real workstation. 
>If
>people make software only available through micropayments, then that would
>be
>limiting to both the user and the vendor.

What is to say that micropayments won't authorize an extended license for
software you have on YOUR machine - i.e. I download some software, to use
it for a day I pay $1 and get a 1-day license.  The software is local.  Of
course, this doesn't preclude you from paying $1 to run it on a
supercomputer that you wouldn't normally have access to ...

>The payer could set a certain amount of money that is automatically deemed
>acceptable to pay, like the $.02/time-unit example.  This could get
misused
>by a vendor who chooses a unit small enough that a small per-unit charge
>quickly
>adds up.  The payer essentially loses control of payment.

Wrong.  

>But those of use who use certain packages heavily would get
>shafted for our loyal support of a vendor if they decided to pander to the
>skittish masses and charge a rate that was psychologically more appealing
>to
>those who wouldn't otherwise use it.  I only hope that vendors who choose
to
>use micropayments (since they're inevitable) take the small but loyal
power
>user segment into consideration when making the decision about whether or
>not
>to stop selling full packages altogether.

Why would you be shafted?  Do you think vendors would be willing to throw
away your business?  Look at your previous example of the ISPs, some
individuals pay a metered rate, others a flat rate - why would software use
be any different?

>I'm quite tempted to cut up both my credit card and ATM card because of
the
>bullshit administrative fees involved with using them.  Internet
transaction
>fees are even worse.

Of course, now you can get credit cards thay pay you between 1% and 3% per
transaction ...

>Change doesn't bother *me* personally, I just wish more people would
*think*
>about whether or not changes are *appropriate* instead of just *possible*.

Why should people think about this?  Let the market decide - if people try
it and fail, it will go away.  If it suceeds, then it is obviously useful
to some consumers.

>That's not infeasable.  I didn't say anything was infeasable, I just think
>some of the current models of how things might work are bad ideas and
>encourage
>debate.  Both consumers and resistant old-school vendors will have issues
to
>address, and ramming change down people's throats because it's inevitable
or
>'the market dictates it' is a crappy attitude which I don't encourage. 
>Also,
>note for the record that I don't believe that "the market" is a one-to-one
>mapping on to "the people" or even "the consumer".

Well, the market works.  Sorry you don't believe in reality.

>Ha ha ha.  Yeah, looking out for consumer interests is just doom saying
and
>negativism.  The current education level of the general public about
>computers
>is low, and about transactional security is even lower.  It can have
>benefits,
>but there are also serious issues which need to be considered.  Another
>thing
>about the paying a micropayment instead of a macropayment and leaving if
>you don't like it - a lot of companies offer free trial time with their
>service, or a free consultation, etc.  The effects of charging for these
>trial offers is
>unclear - how would that be good for the consumer?

Those poor consumers, what would they do without you looking out for them? 
I personally could care less if someone gets scammed - let the buyer
beware.  

>>imagine shareware authors getting cash for their programs based on their
>>actual use. imagine artists and writers bypassing corporate monoliths
>>and marketing their work to the public directly, bypassing the enormous
>>scrape-off that these self-perpetuating bureacracies snarf.
>>
>This is a good idea.  It could be a good boon for small businesses (unless
>the transaction providers charge prohibitively large fees for their
>services...).  I hope you're right and I'm wrong.  That would be much
better
>for all involved.

If the fees are too large, NO ONE WILL BUY THEM!  Basic economics.

>Your argument works provided the consumer really maintains control.
>You can lose that control.  There do need to be safeguards in such a
system
>that ensure this control.  $.02/nanosecond is, after all, $1.2 billion/
>minute.
>If such a setting were allowed and people habitually allowed $.02/unit
>metering as being automatically acceptable, that could clean out a number
>of digital
>wallets very quickly as unsuspecting customers entered the paid area and
>instantly got dialogue boxes announcing that their wallets were empty.

Do you really think people don't know the difference between $.02/minute
and $.02/nanosecond?  Do you think software cannot easily distinguish the
difference?  Let's argue from a basis in reality here!

>
>ttl
>Stephan
>
>
>-------------------------------------------------------------------
>This signature has been kidnapped by space aliens.
>If you find it you can call (415) 703-8748.
>I work for Studio Archetype, and they don't find any of this funny.


---------------------------------------------------------------------------
Clay Olbon II            | Clay.Olbon at dynetics.com
Systems Engineer         | ph: (810) 589-9930 fax 9934
Dynetics, Inc., Ste 302  | http://www.msen.com/~olbon/olbon.html
550 Stephenson Hwy       | PGP262 public key: on web page
Troy, MI 48083-1109      | pgp print: B97397AD50233C77523FD058BD1BB7C0
                     TANSTAAFL
---------------------------------------------------------------------------






From gelmanl at gwis2.circ.gwu.edu  Wed Jun 12 15:26:01 1996
From: gelmanl at gwis2.circ.gwu.edu (Lauren Amy Gelman)
Date: Thu, 13 Jun 1996 06:26:01 +0800
Subject: Court Blocks CDA
In-Reply-To: <199606121202.IAA12765@cmyk.warwick.com>
Message-ID: <Pine.SOL.3.93.960612102606.5268A-100000@gwis2.circ.gwu.edu>



>From CNN web site:

U.S. court blocks Internet indecency law 

June 12, 1996
Web posted at: 8:56 a.m. EDT

PHILADELPHIA (Reuter) - A special U.S. court panel on Wednesday
issued a preliminary injuction blocking as unconstitutional a new law
prohibiting the distribution of indecent material that would be
accessible
to children over the Internet and other computer networks. 

"As the most participatory form of mass speech yet developed, the
Internet deserves the highest protection from government intrusion," the
three-judge panel said in its decision released Wednesday. 

The case involves the Communications Decency Act signed into law by
President Clinton on Feb.
8. 

The law punishes the distribution to minors of obscene or indecent
material over the Internet or
commerical online services with fines and up to two years in prison. 

The American Civil Liberties Union filed the suit against the Justice
Department the same day the
measure became law. The suit was combined with a separate action
undertaken by major online
services and software giant Microsoft Corp. 

Opponents say the bill is unconstitutional, unenforceable and would
drastically curtail what they
said is the highly democratic nature of speech in "cyberspace." But the
U.S. government said the
law was essential to shield children who have easy access to a growing
amount of pornography
online. 


On Wed, 12 Jun 1996, Harry S. Hawk wrote:

> 
> CNN reports court blocks CDA
> 
> -- 
> Harry Hawk,     Manager of Interactive Communications
>                 Warwick Baker & Fiore,  212 941 4438,     habs at warwick.com
> 
> The Internet has the potential to set us free -- to learn anything and
> do anything, whenever we want. No wonder politicians want to regulate
> it -- The Washington Post, November 7, 1995, p. A13., Cyber Liberation
> [Column], James K. Glassman
> 



----------------------------------------------------------------------------
----------------------------------------------------------------------------
Lauren Amy Gelman				gelmanl at gwis2.circ.gwu.edu
George Washington University			gelman at epic.org
Science, Technology, and Public Policy Program	gelman at acm.org






From frissell at panix.com  Wed Jun 12 15:26:34 1996
From: frissell at panix.com (Duncan Frissell)
Date: Thu, 13 Jun 1996 06:26:34 +0800
Subject: Full Text of CDA Decision is up
Message-ID: <2.2.32.19960612144736.0076b240@popserver.panix.com>


http://www.cdt.org/ciec/decision.txt






From vin at shore.net  Wed Jun 12 15:35:45 1996
From: vin at shore.net (Vin McLellan)
Date: Thu, 13 Jun 1996 06:35:45 +0800
Subject: <noise> Terrorism Hysteria on the Net
Message-ID: <v02140b00ade48b170eb9@[198.115.179.222]>


Oppps!  Sorry Drew, I think I misrepresented you and incorrectly cited you
in reference to snow's comment that the "potential for economic terrorism
is not significantly larger given the existance of the Internet than it was
before."

Appologies to both of you.

         Vin McLellan +The Privacy Guild+ <vin at shore.net>
      53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548
                         <*><*><*><*><*><*><*><*><*>







From frissell at panix.com  Wed Jun 12 15:39:07 1996
From: frissell at panix.com (Duncan Frissell)
Date: Thu, 13 Jun 1996 06:39:07 +0800
Subject: No Kidding
Message-ID: <2.2.32.19960612144312.00756e88@popserver.panix.com>


E.  Conclusion

          Cutting through the acronyms and argot that littered
the hearing testimony, the Internet may fairly be regarded as a
never-ending worldwide conversation.  The Government may not,
through the CDA, interrupt that conversation.  As the most
participatory form of mass speech yet developed, the Internet
deserves the highest protection from governmental intrusion.
          True it is that many find some of the speech on the
Internet to be offensive, and amid the din of cyberspace many
hear discordant voices that they regard as indecent.  The absence
of governmental regulation of Internet content has unquestionably
produced a kind of chaos, but as one of plaintiffs' experts put
it with such resonance at the hearing:
               What achieved success was the very
               chaos that the Internet is.  The
               strength of the Internet is that
               chaos.[23]

Just as the strength of the Internet is chaos, so the strength of
our liberty depends upon the chaos and cacophony of the
unfettered speech the First Amendment protects.
          For these reasons, I without hesitation hold that the
CDA is unconstitutional on its face.

               IN THE UNITED STATES DISTRICT COURT
             FOR THE EASTERN DISTRICT OF PENNSYLVANIA

AMERICAN CIVIL LIBERTIES UNION,  :   CIVIL ACTION
et al.                           :
                                 :
         v.                      :
                                 :
JANET RENO, Attorney General of  :
the United States                :   NO. 96-963

________________________________________________________________

AMERICAN LIBRARY ASSOC.,        :    CIVIL ACTION
INC., et al.                    :
                                :
        v.                      :
                                :
UNITED STATES DEP'T OF          :
JUSTICE, et al.                 :    NO. 96-1458

                               ORDER
          AND NOW, this 11th day of June, 1996, upon
consideration of plaintiffs' motions for preliminary injunction,
and the memoranda of the parties and amici curiae in support and
opposition thereto, and after hearing, and upon the findings of
fact and conclusions of law set forth in the accompanying
Adjudication, it is hereby ORDERED that:
          1.   The motions are GRANTED;
          2.   Defendant Attorney General Janet Reno, and all
acting under her direction and control, are PRELIMINARILY
ENJOINED from enforcing, prosecuting, investigating or reviewing
any matter premised upon:
               (a)  Sections 223(a)(1)(B) and 223(a)(2) of the
Communications Decency Act of 1996 ("the CDA"), Pub. L. No. 104-
104, � 502, 110 Stat. 133, 133-36, to the extent such
enforcement, prosecution, investigation, or review are based upon
allegations other than obscenity or child pornography; and
               (b)  Sections 223(d)(1) and 223(d)(2) of the CDA;
          3.   Pursuant to Fed. R. Civ. P. 65(c), plaintiffs need
not post a bond for this injunction, see Temple Univ. v. White,
941 F.2d 201, 220 (3d Cir. 1991), cert. denied sub nom. Snider v.
Temple Univ., 502 U.S. 1032 (1992); and
          4.   The parties shall advise the Court, in writing, as
to their views regarding the need for further proceedings on the
later of (a) thirty days from the date of this Order, or (b) ten
days after final appellate review of this Order.

                           BY THE COURT:

                          ______________________________
                          Dolores K. Sloviter, C.J.
                          U.S. Court of Appeals
                          For the Third Circuit

                          ______________________________
                          Ronald L. Buckwalter, J.

                          ______________________________
                          Stewart Dalzell, J.






From frissell at panix.com  Wed Jun 12 16:03:25 1996
From: frissell at panix.com (Duncan Frissell)
Date: Thu, 13 Jun 1996 07:03:25 +0800
Subject: Kaos vs Control
Message-ID: <2.2.32.19960612150802.0076e2bc@popserver.panix.com>


With apologies to Maxwell Smart...

Note the most important part of the decision.  The embrace of chaos by the
Chief Judge of the 3rd Circuit Court of Appeals:

"Just as the strength of the Internet is chaos, so the strength of
our liberty depends upon the chaos and cacophony of the
unfettered speech the First Amendment protects.
          For these reasons, I without hesitation hold that the
CDA is unconstitutional on its face."

Chaos wins again.

DCF






From minow at apple.com  Wed Jun 12 16:38:17 1996
From: minow at apple.com (Martin Minow)
Date: Thu, 13 Jun 1996 07:38:17 +0800
Subject: CDA Decision Online
Message-ID: <v02140b00ade495acee5d@[17.128.203.171]>


http://www.aclu.org/court/cdadec.html

(250 KBytes)

Martin.







From ses at tipper.oit.unc.edu  Wed Jun 12 16:51:11 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Thu, 13 Jun 1996 07:51:11 +0800
Subject: [Tiny bit o noise] was Re: Terrorism Hysteria on the net
In-Reply-To: <199606120655.BAA07112@sr.radiks.net>
Message-ID: <Pine.SUN.3.91.960612120732.29559B-100000@tipper.oit.unc.edu>


Give me $1,000,000,000 and I'll buy every household in the United States a 
pizza. Whilst everyone is sitting down arguing about toppings, we'll take 
to the streets and seize power.

Poit!

---
Cause maybe  (maybe)		      | In my mind I'm going to Carolina
you're gonna be the one that saves me | - back in Chapel Hill May 16th.
And after all			      | Email address remains unchanged
You're my firewall -    	      | ........First in Usenet.........





From raph at kiwi.cs.berkeley.edu  Wed Jun 12 17:38:04 1996
From: raph at kiwi.cs.berkeley.edu (Raph Levien)
Date: Thu, 13 Jun 1996 08:38:04 +0800
Subject: Anonymous remailers mentioned in CDA decision
Message-ID: <199606121625.JAA17962@kiwi.cs.berkeley.edu>


Here's a paragraph from the findings in this morning's CDA decision.
I'm happy to see that we're considered an integral part of the
Internet, rather than as a fringe cyber-terrorism threat.

Overall, I found the decision to be balanced, well written, and
extremely thoughtful.

Raph

[ excerpted from http://www.vtw.org/speech/decision.html ]

[ from the undisputed findings of fact ]

           Obstacles to Age Verification on the Internet

          90.  There is no effective way to determine the
identity or the age of a user who is accessing material through
e-mail, mail exploders, newsgroups or chat rooms.  An e-mail
address provides no authoritative information about the
addressee, who may use an e-mail "alias" or an anonymous
remailer.  There is also no universal or reliable listing of e-
mail addresses and corresponding names or telephone numbers, and
any such listing would be or rapidly become incomplete.  For
these reasons, there is no reliable way in many instances for a
sender to know if the e-mail recipient is an adult or a minor.
The difficulty of e-mail age verification is compounded for mail
exploders such as listservs, which automatically send information
to all e-mail addresses on a sender's list.  Government expert
Dr. Olsen agreed that no current technology could give a speaker
assurance that only adults were listed in a particular mail
exploder's mailing list.

[ ... ]

                             Anonymity
          121. Anonymity is important to Internet users who seek
to access sensitive information, such as users of the Critical
Path AIDS Project's Web site, the users, particularly gay youth,
of Queer Resources Directory, and users of Stop Prisoner Rape
(SPR).  Many members of SPR's mailing list have asked to remain
anonymous due to the stigma of prisoner rape.

[ from views submitted by the parties in response to Order dated March
13, 1996 ]

22. Arguably, a valid CDA would create an incentive for overseas
pornographers not to label their speech. If we upheld the CDA,
foreign pornographers could reap the benefit of unfettered access
to American audiences.  A valid CDA might also encourage American
pornographers to relocate in foreign countries or at least use
anonymous remailers from foreign servers.





From Ryan.Russell at sybase.com  Wed Jun 12 17:52:54 1996
From: Ryan.Russell at sybase.com (Ryan Russell/SYBASE)
Date: Thu, 13 Jun 1996 08:52:54 +0800
Subject: Slander of Catholic Church
Message-ID: <9606121645.AA01963@notesgw2.sybase.com>


>Thanks, Attila. I think Paul Penrod and the Archangel Moroni missed my main
>point. I was not singling out Mormonism for special criticism, just using
>it as an example of a "cult" or "religion" which is in many ways even more
>"outre" to many of us than Scientology is. Belief that a body rotting in
>the ground can be baptized into one's church is at least as odd as
>believing that Mankind is descended from the survivors of spaceships
>fleeing an evil overlord.

A point of clarification:

It's not the bodies that are baptized, but the spirits, by proxy.
You don't think we dig 'em up do you?

The point being that even if you've never heard of Christ 
(a billion people in China for example) you've still got a shot.
Most christian religions don't allow for that.

I mention this in case any of the folks who are being subjected to
this discussion on this list were wondering what the heck you
were talking about.  We are a missionary church, after all.

As far as the COS goes...Well, a lot of info that the Mormon church 
would prefer to keep secret has been published, but I don't think
the First Presidency has been running around suing everyone.

     Ryan





From jya at pipeline.com  Wed Jun 12 19:08:00 1996
From: jya at pipeline.com (John Young)
Date: Thu, 13 Jun 1996 10:08:00 +0800
Subject: Anonymous remailers mentioned in CDA decision
Message-ID: <199606121848.SAA05975@pipe2.ny1.usa.pipeline.com>


The right to anonymity on the Net got a big boost during the Q&A at the
ACLU press conference here in NYC on the CDA win -- with a recitation of
its distinguished history in assuring freedom of speech and political
activity. As did the corollary right to strong encryption to assure
protection from intruders of gov-biz-jealous-lovers of all stripes. 
 
 
The CDA decision is a wondrous read for its coverage of so many topics
discussed here; each judge's opinion is separately admirable. 
 
 
And, based, on the remarks of panelists at the conference, it will surely
advance privacy protection measures and support loosening of crypto
controls. 
 
 
But still subject to the unpredictable Supremes, a Solomon cautioned, if
DoJ elects to appeal. 
 
 
 





From tcmay at got.net  Wed Jun 12 19:21:10 1996
From: tcmay at got.net (Timothy C. May)
Date: Thu, 13 Jun 1996 10:21:10 +0800
Subject: Kaos vs Control
Message-ID: <ade4591802021004aba9@[205.199.118.202]>


At 3:08 PM 6/12/96, Duncan Frissell wrote:
>With apologies to Maxwell Smart...

(And to SMERSCH, "Death to Censors")

>Note the most important part of the decision.  The embrace of chaos by the
>Chief Judge of the 3rd Circuit Court of Appeals:
>
>"Just as the strength of the Internet is chaos, so the strength of
>our liberty depends upon the chaos and cacophony of the
>unfettered speech the First Amendment protects.
>          For these reasons, I without hesitation hold that the
>CDA is unconstitutional on its face."
>
>Chaos wins again.


See, all you doubters, "anarchy" is not so bad after all.

(Politically aware people of various stripes fully understood the precise
meaning of "anarchy," and anarchy of various types (anarcho-capitalism,
anarcho-syndicalism, etc.) is well-known. The _popular_ impression of
anarchy-- images of bomb-throwing Russians or Bloods and Crips street
battles--is less charitable. I see little chance that people who don't
understand anarchy derives from "an-archy," "no top/leader/highest level,"
will become educated.)

Kevin Kelly's "Out of Control" makes the chaos/anarchy/self-organization
points in a different way, as do the works of Hayek, D. Friedman, and many
others.

Good to see the courts reaffirming that "chaos" and lack of control by
authorities is a core part of the U.S. system. Maybe the control freaks of
Europe and Asia who have been charting their own authoritarian courses will
give more thought to ensuring liberty even if it more "chaos."

Today is a good day.

--Tim

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From lroth at ios.com  Wed Jun 12 19:32:23 1996
From: lroth at ios.com (by way of Duncan Frissell <frissell@panix.com>)
Date: Thu, 13 Jun 1996 10:32:23 +0800
Subject: Republican Revolution?
Message-ID: <2.2.32.19960612184410.0076ea34@popserver.panix.com>


Now that Internet Kaos!!! has been legalized, I guess it's OK to post this.

To paraphrase Lazarus Long "Avoid strong drink.  It might make you shoot at
tax collectors outside of New York State."  Love those soft and squishy judges.

>From the NY Post, Wednesday, June 12, 1996.

CONVICTION OF TAX MAN'S KILLER GETS TOSSED OUT

By Gregg Birnbaum
Post Correspondent

ALBANY --- The state's top court yesterday threw out the murder conviction
of a Republica Party activist who gunned down the first IRS agent to die in
the line of duty.

The court of Appeals overturned the 1983 conviction of James Bradley, who
asked IRS collection agent Michael Dillon, "Mike are you prepared to meet
your maker?" --- then fired an M-1 rifle at him twice.

Bradley then knelt down to take Dillon's pulse and shot him a third time
before driving to a friend's house to present him with the weapon as a
"souvenir."

Dillon 61, had gone to Bradley's house near Buffalo in September 1983 to
collect the last $332 of a $2,000 lien imposed by the IRS.

When Bradley wouldn't pay up right away, Dillon threatened to seize one of
his cars.  Bradley got his rifle, returned to the kitchen, where Dillon was
sitting and started firing.

In a unanimous unsigned ruling, the Court of Appeals said the trial judge
undermined Bradley's insanity defense by improperly allowing the jury to
also consider a first-degree manslaughter conviction.

That's the charge on which Bradley was convicted.  He was acquitted of
second-degree murder.

At his sentencing, Bradley predicted Dillon wouldn't be the last IRS agent
to die at the hands of an irate taxpayer and said, "I was just helping
President Bonzo get government off our backs," an apparent reference to
then-President Reagan.

The Erie County district attorney said he expected to resubmit the case to a
grand jury.  If Bradley is tried again, he will face a first-degree
manslaughter charge or lesser, his lawyer said.

Before the shooting, Bradley, 76, had long been known as a Republican
campaign worker in the Buffalo area.  He is now in the Mohawk Correctional
Facility in Rome and is said to be ill.

###












From mccoy at communities.com  Wed Jun 12 19:52:59 1996
From: mccoy at communities.com (Jim McCoy)
Date: Thu, 13 Jun 1996 10:52:59 +0800
Subject: Anonymous remailers mentioned in CDA decision
Message-ID: <v02140b00ade4df66918c@[205.162.51.35]>


Raph quotes a few bits of the CDA decision:
[..]
> 22. Arguably, a valid CDA would create an incentive for overseas
> pornographers not to label their speech. If we upheld the CDA,
> foreign pornographers could reap the benefit of unfettered access
> to American audiences.  A valid CDA might also encourage American
> pornographers to relocate in foreign countries or at least use
> anonymous remailers from foreign servers.

It about jobs, that's it...  Let's keep America a major power
in the pornography industry (I can just imagine the commercial :)

jim







From samlb at baynetworks.com  Wed Jun 12 19:56:07 1996
From: samlb at baynetworks.com (Sam Bassett C)
Date: Thu, 13 Jun 1996 10:56:07 +0800
Subject: Born Classified
Message-ID: <199606121924.MAA07982@samsparc2.baynetworks.com>


	According to "The Codebreakers" (if memory serves me), in about 1943
the U.S. and the U.K. negotiated a BRITUS treaty, the details of which were
very secret.  I think that this was the original agreement to share the
British Enigma cryptography results, and possibly the U.S. nuclear results.
	Further, I suspect that one of the provisions of the BRITUS treaty
was that all of the crypto stuff be treated as if British Law (i.e. the
Official Secrets Act) ruled -- everything was secret unless and until the Government said it wasn't any more.
	This was mildly unconstitutional at the time, but could be gotten past
the courts on the excuse that the Constitution defines treaties as "The Highest
Law of the Land".  It has certainly led to a lot of abuses since, but the
bureaucrats love it -- "born classified", indeed!

	Does anyone on the list have any info -- or references -- that would
serve to confirm or deny my guesses?

adTHANKSvance

samlb at baynetworks.com






From bal at martigny.ai.mit.edu  Wed Jun 12 20:18:37 1996
From: bal at martigny.ai.mit.edu (Brian A. LaMacchia)
Date: Thu, 13 Jun 1996 11:18:37 +0800
Subject: No Kidding
In-Reply-To: <199606121914.MAA09944@jobe.shell.portal.com>
Message-ID: <199606121958.MAA17577@toad.com>


   Date: Wed, 12 Jun 1996 12:14:15 -0700
   From: Hal <hfinney at shell.portal.com>
   Sender: owner-cypherpunks at toad.com
   Precedence: bulk

   > The absence
   > of governmental regulation of Internet content has unquestionably
   > produced a kind of chaos, but as one of plaintiffs' experts put
   > it with such resonance at the hearing:
   >                What achieved success was the very
   >                chaos that the Internet is.  The
   >                strength of the Internet is that
   >                chaos.[23]
   > 
   > Just as the strength of the Internet is chaos, so the strength of
   > our liberty depends upon the chaos and cacophony of the
   > unfettered speech the First Amendment protects.

   This is beautifully eloquent.  I hope it will be persuasive with the
   Supreme Court.

   Does anyone know which witness came up with the quote above?  Obviously
   it resonated with the judges.

This quote was from the end of Scott Bradner's recross on March 22.
Here's the excerpt from the trial transcript:

[page 166]
    25                    JUDGE DALZELL:  And indeed, isn't the whole point

[page 167]
     1           that the very exponential growth and utility of the Internet
     2           occurred precisely because governments kept their hands out
     3           of this and didn't set standards that everybody had to
     4           follow?

     5                    THE WITNESS:  Well, it's actually even a little bit
     6           more contorted than that because the governments tried to. 
     7           The U.S. Government and many other governments attempted to
     8           mandate a particular kind of protocol to be used on worldwide
     9           data networks, and this is the OSI protocol suite.  The U.S.
    10           Government mandated its use within the U.S. Government and
    11           with purchasing material with U.S. funds.  This was mandated
    12           in many European countries and in Canada and many other
    13           places around the world.
    14                    That particular suite of protocols has failed to
    15           achieve market success.  What achieved success was the very
    16           chaos that the Internet is.  The strength of the Internet is
    17           that chaos.  It's the ability to have the forum to innovate. 
    18           And certainly a strong standards environment fights hard
    19           against innovation.

					--bal





From hallam at ai.mit.edu  Wed Jun 12 21:00:21 1996
From: hallam at ai.mit.edu (Hallam-Baker)
Date: Thu, 13 Jun 1996 12:00:21 +0800
Subject: Britain to control crypto - official (fwd from Usenet)
In-Reply-To: <4plte7$70i@life.ai.mit.edu>
Message-ID: <31BF3BCA.794B@ai.mit.edu>


Robert Hettinga wrote:
> 
> > The British government quietly announced yesterday that it will
> > legislate to restrict crypto.

This could be a problem. The government is pretty burned out having run out of
ideas a long time ago. Interferring with areas the people understand little of
is a way to avoid making worse mistakes.

Given that we have the worst Home Secretary this century there is little hope
that civil liberties will play any part in any legislation. For those that
don't follow UK politics the government has been methodically extinguishing
civil rights such as the right to demonstrate in public and the right of a
defendant to premptory challenge agains jurors (the prosecution retains the
right).

The key question is how urgently the govt intends to press the point. If they
attach a provision to pre-election criminal justice bill then expect a really
half baked clause. If they go for public comment gathering proceedures then
the govt. is likely to be out of office before anything happens.  With less
than half the public support of the opposition Bob Dole stands more chance of
election than the British Tories.
 
> Does anyone here have any idea what this does to british-affiliated states
> like Anguilla, or the Caymans?

Nothing in the case of most dependent territories. Most territories are either
entirely self governing or have some body which "assists" the govenor. 

Given that we have yet to unify English and Scottish law the process of making
laws is quite complex. Presumably the govt intend to pass laws covering the
whole of the UK, what mechanism they choose for this we will have to wait to
find out.

I would expect the Caymans to act to protect their tax-haven business. This
could mean that they are pro crypto (increase effectiveness) or may mean that
they go anti to avoid being seen as money laundering havens and invite Cuba
style sanctions acts.


		Phill





From markm at voicenet.com  Wed Jun 12 21:02:45 1996
From: markm at voicenet.com (Mark M.)
Date: Thu, 13 Jun 1996 12:02:45 +0800
Subject: Quickremail update
Message-ID: <Pine.LNX.3.93.960612174315.1229A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

I have now released Quickremail v1.0.  This fixes a lot of the bugs present
in the beta version.  Some of the bugs were serious, so I would suggest
getting the newer version.  It is available at
http://www.voicenet.com/~markm/quickremail.1.0.tar.gz .

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMb87I7Zc+sv5siulAQE8dQP/Rrzvd4T/4vF5/KUmPA1mrhxxl+7Mosud
OqykU7Bcg5lMezYuW51eaHlQVqgeMhLaFopXth4su3S9DHB+wv1rYwo4rh8G4Gt9
h0EQ4ekhVi4tzzM1VChdkIE/ZrddvcqSoIvZqGOjv8UrvWxXoKoNQ65IKB+UHvvC
MQAZGT5KvUM=
=Gycx
-----END PGP SIGNATURE-----





From jwilk at iglou.com  Wed Jun 12 21:12:03 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Thu, 13 Jun 1996 12:12:03 +0800
Subject: CDA decision TOMORROW 9 am! (fwd)
Message-ID: <m0uTyHX-00035cC@mail.iglou.com>


At 08:47 AM 6/12/96 +0000, Omegaman wrote:
>Guess I was logged in at the right time this morning.  Judges ruled 
>3-0 that the CDA is unconstitutional.  hooray.
>
>I thought a little rejoicing was warranted. :)
>
>me
>------------------------------------------------------------
> Omegaman <omega at bigeasy.com>
> PGP Key fingerprint =  6D 31 C3 00 77 8C D1 C2  
>                                59 0A 01 E3 AF 81 94 63 
>------------------------------------------------------------
>
>
:-)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From hallam at ai.mit.edu  Wed Jun 12 21:32:39 1996
From: hallam at ai.mit.edu (Hallam-Baker)
Date: Thu, 13 Jun 1996 12:32:39 +0800
Subject: whitehouse queries files on political enemies
In-Reply-To: <4pj38q$o1i@life.ai.mit.edu>
Message-ID: <31BF463C.15FB@ai.mit.edu>


Bill Frantz wrote:
> 
> OBCrypto: William Safire, in his 6/10/96 column on this subject, says,
> "Under Freeh, the anti-encryption zealot hand-picked by the man whose name
> was used on the phony requisitions, the Justice Department's most
> confidential file room has become a walk-in closet for White House pols."

Well Safire should know about Nixon type dirty tricks, after all he worked for
Nixon as a speachwriter and wrote a book about it:-

http://econ158.berkeley.edu/williamsafire.html
http://econ158.berkeley.edu/haldeman.html


>From a pro-crypto point of view it is more advantageous to accept the
administration position that the requests were made in error. After all that 
demonstrates that the govt. is not capable of admininistering sensitive 
information properly even when it is what must surely count as the most 
sensitive information the govt. tracks. If the system is ineffective in 
protecting the files of the party workers of opposed factions then it is 
unlikely to protect the secrecy of less sensitive files.

This aside the general problem is one of authorisation. The current USGovt 
security system is based on principles of security clearances and "need to 
know". But how does the guardian of various personal files know _who_ needs to 
know?

This is a _very_ hard problem, one that I for one would like an answer to.
Unfortunately the USGovt is not like a computer system where the authorisation
policy for information is enforced via ACLs or the like. Perhaps it should be 


		Phill





From strick at versant.com  Wed Jun 12 21:39:24 1996
From: strick at versant.com (strick (henry strickland))
Date: Thu, 13 Jun 1996 12:39:24 +0800
Subject: 121. Anonymity is important to Internet users who seek
Message-ID: <9606122232.AA03825@vp.versant.com>


>From the CDA decision:     ( http://www.vtw.org/speech/decision.html )



				     Anonymity

		  121. Anonymity is important to Internet users who seek

	to access sensitive information, such as users of the Critical

	Path AIDS Project's Web site, the users, particularly gay youth,

	of Queer Resources Directory, and users of Stop Prisoner Rape

	(SPR).  Many members of SPR's mailing list have asked to remain

	anonymous due to the stigma of prisoner rape.




Anonymous remailers are mentioned in this secction:




		   Obstacles to Age Verification on the Internet



		  90.  There is no effective way to determine the

	identity or the age of a user who is accessing material through

	e-mail, mail exploders, newsgroups or chat rooms.  An e-mail

	address provides no authoritative information about the

	addressee, who may use an e-mail "alias" or an anonymous

	remailer.  There is also no universal or reliable listing of e-

	mail addresses and corresponding names or telephone numbers, and

	any such listing would be or rapidly become incomplete.  For

	these reasons, there is no reliable way in many instances for a

	sender to know if the e-mail recipient is an adult or a minor.

	The difficulty of e-mail age verification is compounded for mail

	exploders such as listservs, which automatically send information

	to all e-mail addresses on a sender's list.  Government expert

	Dr. Olsen agreed that no current technology could give a speaker

	assurance that only adults were listed in a particular mail

	exploder's mailing list.








From hfinney at shell.portal.com  Wed Jun 12 21:56:31 1996
From: hfinney at shell.portal.com (Hal)
Date: Thu, 13 Jun 1996 12:56:31 +0800
Subject: No Kidding
Message-ID: <199606121914.MAA09944@jobe.shell.portal.com>


> The absence
> of governmental regulation of Internet content has unquestionably
> produced a kind of chaos, but as one of plaintiffs' experts put
> it with such resonance at the hearing:
>                What achieved success was the very
>                chaos that the Internet is.  The
>                strength of the Internet is that
>                chaos.[23]
> 
> Just as the strength of the Internet is chaos, so the strength of
> our liberty depends upon the chaos and cacophony of the
> unfettered speech the First Amendment protects.

This is beautifully eloquent.  I hope it will be persuasive with the
Supreme Court.

Does anyone know which witness came up with the quote above?  Obviously
it resonated with the judges.

Hal





From llurch at networking.stanford.edu  Wed Jun 12 22:22:51 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Thu, 13 Jun 1996 13:22:51 +0800
Subject: Encrypting forwarding service?
In-Reply-To: <199606121226.IAA24371@unix.asb.com>
Message-ID: <Pine.GUL.3.93.960612123144.7207C-100000@Networking.Stanford.EDU>


On Wed, 12 Jun 1996, Deranged Mutant wrote:

> Such a service can be set up at a site with *lots* of keys given to 
> it.  This way if one wants to spontaneously send a message to someone 
> that she doesn't have a key for, she can use the service.  (Perhaps 
> the service would only accept or forward mail from/to people who 
> submitted their keys, and possibly eca$h... it could also bounce 
> messages back, re-encrypted, if there's a failure...)
> 
> This could be used like anonymous remailers to foil traffic analysis, 
> but also for people who, in certain situations, don't want/need 
> anonymitiy with the person they are corresponding with, and who don't 
> necessarily have keys handy.

US/Canada residents only might want to look at:

 http://www.portal.com/~hfinney/java/pgpmail/PGPMailer.html

Of course it should be accessible through anonymous proxies.

-rich






From dlv at bwalk.dm.com  Wed Jun 12 22:42:00 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Thu, 13 Jun 1996 13:42:00 +0800
Subject: Anonymous remailers mentioned in CDA decision
In-Reply-To: <199606121848.SAA05975@pipe2.ny1.usa.pipeline.com>
Message-ID: <k4oFPD30w165w@bwalk.dm.com>


jya at pipeline.com (John Young) writes:
> But still subject to the unpredictable Supremes, a Solomon cautioned, if
> DoJ elects to appeal.

This statute's language pretty much forces DOJ to appeal, even if they think
the law sucks.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From vznuri at netcom.com  Wed Jun 12 23:05:14 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Thu, 13 Jun 1996 14:05:14 +0800
Subject: Micropayments are Crap
In-Reply-To: <v03006f00ade3a25564ae@[204.162.75.169]>
Message-ID: <199606122005.NAA19329@netcom15.netcom.com>



it seems to me many of mr. Bugaj's complaints refer to the
deficiencies of a capitalist market, such as scams, greedy
companies, etc. he seems to think micropayments may exacerabate
this problem. in any case I agree there are problems with
capitalism, but I think micropayments may have the effect
of ameliorating some of the deficiencies. 

today we have payment systems that are "blocky" or have
"large granularity". many companies function as billing
services. in other words, they sell some product, and would
rather not get into the payment collection business, but the
economics of scale forces them to. the phone company is
forced to send out mail and have a zillion clerks to handle
the returned bills. the country is awash in checks and 
paperwork. I can easily make a good case that micropayments
may have a significant dent in this paradigm such that
companies can focus more on providing services than collecting
cash. the dividends would be obvious and enormous.


I'll skip most responses and focus on a few in particular..

>>somewhat. mainframes aren't totally the mark of the devil. don't you pay
>>your internet provider per hour? how many people do? isn't a Sun pretty
>>
>No, I don't.  I use it too much, so I found an ISP that does not charge metered
>rates.  A lot of people pay by the hour for their ISP, but it may or may not
>be a wise idea for them.  If it's part of their work and they're online all the
>time, they should consider another payment system.  Same thing with charging
>micropayments for using software.  If Adobe started charging me $5/hr to use
>Photoshop instead of $500 for the package, I'd stop using photoshop.  In two
>weeks I'd have already exceeded the price of the whole package.

again, you are making arbitrary assumptions. the figures you cite
are "straw men". OF COURSE micrompayments make no sense if you end
up spending more money. I totally agree with you there, who could
argue? all the micropayment proponents are starting from the
assumption that services you now pay for could be cheaper given
the micropayment model. you seem to think that micropayments mean,
"companies have more opportunity to shaft you". but equally perhaps,
it is more opportunity for the consumer to exercise control with
less at stake.

>
>>much equivalent/similar in processing power & capability to old mainframes?
>>you raise all kinds of objections that make no sense to me.
>>
>Sure it's the same power as an old mainframe.  Big deal.  What exactly does
>that
>do to stregnthen your argument?  It's certainly not as costly to build, costly
>to maintain, or rare as old mainframes...

alright, your mainframe idea is way off for several reasons. first, the
mainframe is not dead, it has just been transformed into Sun and Unix
boxes all over the planet. so even if a system was "like a mainframe",
I wouldn't consider that the mark of the beast as you suggest. furthermore,
mainframes are about CENTRALIZATION. imagine a single computer like
Prodigy that was the bottleneck through which you got all your software
over the net. ok, that would be horrible. it would also be like the
mainframe concept you are criticizing.

but micropayments are not about centralization, they are about 
DISTRIBUTION. imagine a zillion software providers all over the planet.
each can meter you out software at a tiny fee per time. this is 
clearly not like a centralized mainframe situation at all, assuming you can get
similar software from a zillion different places.  it *is* similar
in that you are grabbing cpu cycles from outside your computer, but
this is arguable just a network. mainframes used networks too. does
that make networks evil? no, I don't think so!! surely you are in
favor of networks!!

>>uh huh. what if over your lifetime it cost far less than you pay for
>>a shinkwrapped package?
>>
>If that happened, I'd be very suprised.

that's the kind of savings people who promote micropayments are betting
on. again, I agree that if the consumer ends up paying more in some
way with micropayments, they're doomed to never get off the ground.

>That is a good advantage, you are correct in this.  But there are a number of
>instances in which I'd still want software running on a real workstation.  If
>people make software only available through micropayments, then that would be
>limiting to both the user and the vendor.

as I wrote, I don't believe micropayments are going to be the only
form of transaction in the future. surely nobody else is advocating this
either.

>In some ways.  But those of use who use certain packages heavily would get
>shafted for our loyal support of a vendor if they decided to pander to the
>skittish masses and charge a rate that was psychologically more appealing
>to
>those who wouldn't otherwise use it.  I only hope that vendors who choose to
>use micropayments (since they're inevitable) take the small but loyal power
>user segment into consideration when making the decision about whether or not
>to stop selling full packages altogether.

I imagine that people will have a wide variety of ways to use the software
they want to use. every company that sells software has a lot of plans
right now. I'm sure that micropayments would only be one other way
for the consumer to pay for what he uses. they may become preferrable
in some cases where both the company and consumer agree they are 
benefitting. but companies that shaft their customers, which you seem
to be preoccupied with, imho ultimately go the way of the dodo bird.

>The best model is not the mainframe model promoted by the idea of the "internet
>computer" (aka. Mutant X-Terminal), but a truly distributed system.
>Workstations and PCs can contribute their substantial processing power to a
>distributed system.  The other problem I have with the mainframe model and
>centralized resources is storage.  It's bad enough to have to wait in line for
>a CPU, but the idea of having no direct access to my work is unappealing,
>and for a number of industries impossible.  I doubt designers, for example,
>would
>be willing to leave client work on the big Illustrator server cluster at Adobe.
>Fat pipes connecting fast PCs to even faster servers is the best route.

notice that if you have a zillion mainframes all over the planet, each
one that can serve you, the idea of a mainframe is not all that bad.
what you are really opposing is *bottlenecks*, such as a zillion
people needing one mainframe. I agree the system
must be carefully designed to avoid them.

>>
>I was looking at this from a vendor viewpoint in this particular instance.  The
>TV old guard may not be willing to give up all that big, fat (and reliable) ad
>revenue to the whim of John and Jane Q. Tvwatcher.

neither was the catholic church willing to give up their monopoly
on bible interpretation when the printing press was invented. my
comment is, "yeah, so what?" or perhaps "now you GET IT!! hee, hee"

>Yeah, but the old tends to cling on for dear life.  Welcome to the concept
>of people and institutions that are unwilling to change and do their best to
>postpone those changes.

it will happen, I agree. that's why reality can be so entertaining.
once certain people recognize what micropayments really imply, they
will be aghast like the scientologists are right now. really, I
predict that when you combine all the following:

1. micropayments
2. web technology
3. distributed computing

in a fully seamless and refined way, you are going to have an
entirely new economic system. it will come close to the realization
of Toffler's 3rd wave "information economy". I mean literally, our
economy will be tied in and tightly coupled with cyberspace. when
you put all this together it will make the current web revolution
look like bland corn flakes in comparison.

>That's not infeasable.  I didn't say anything was infeasable, I just think
>some of the current models of how things might work are bad ideas and encourage
>debate.  Both consumers and resistant old-school vendors will have issues to
>address, and ramming change down people's throats because it's inevitable or
>'the market dictates it' is a crappy attitude which I don't encourage. 

an oxymoron. by my definition, "ramming something down someone's throat"
implies the market is opposing it, or at least not openly encouraging it.
I'm all for not ramming anything down anyone's throat. I've been
advocating consumer choice. it won't catch on unless it really is better
than what we have now. it won't solve all problems, but it will
solve some.

your message contains a lot of FUD that is associated with any new
technology. once people play with it, they don't get so upset. there
was a lot of anxiety about the "information superhighway" for a long
time among people I knew. but then they discovered they could surf
the whole internet by just clicking a mouse. wheeeee!! if the
insanely neurotic "cathy" in the comic strips can handle the internet,
then *anyone* can. <g>






From jya at pipeline.com  Wed Jun 12 23:19:54 1996
From: jya at pipeline.com (John Young)
Date: Thu, 13 Jun 1996 14:19:54 +0800
Subject: UK's Trusted Third Parties
Message-ID: <199606130057.AAA26008@pipe2.t2.usa.pipeline.com>


   Thanks to Professor Denning's pointer to this URL for the 
   UK's Trusted Third Parties regulatory intent. 
 
      http://dtiinfo1.dti.gov.uk/cii/encrypt/ 
 
 
   June 11, 1996 
 
 
   STATEMENT ON HMG POLICY CONCERNING USE OF ENCRYPTION ON 
   PUBLIC NETWORKS 
 
 
   PAPER ON REGULATORY INTENT CONCERNING USE OF ENCRYPTION ON 
   PUBLIC NETWORKS 
 
   1.  Summary 
 
   The Government recognises the importance of the development 
   of the Global Information Infrastructure (GII) with respect 
   to the continuing competitiveness of UK companies. Its aim 
   is to facilitate the development of electronic commerce by 
   the introduction of measures which recognise the growing 
   demand for encryption services to safeguard the integrity 
   and confidentiality of electronic information transmitted 
   on public telecommunications networks. 
 
   2.  The policy, which has been decided upon after detailed 
   discussion between Government Departments, involves the 
   licensing and regulation of Trusted Third Parties 
   (hereafter called TTPs) which will provide a range of 
   information security services to their clients, whether 
   they are corporate users or individual citizens. The 
   provision of such information security services will be 
   welcomed by IT users, and will considerably facilitate the 
   establishment of, and industry's participation in, the GII,  
   where trust in the security of communication has been 
   acknowledged to be of paramount importance. The licensing 
   policy will aim to preserve the ability of the intelligence 
   and law enforcement agencies to fight serious crime and 
   terrorism by establishing procedures for disclosure to them 
   of encryption keys, under safeguards similar to those which 
   already exist for warranted interception under the 
   Interception of Communications Act.   
 
   3.  The Government intends to bring forward proposals for 
   legislation following consultation by the Department of 
   Trade and Industry on detailed policy proposals. 
 
   [Balance snipped] 
 
---------- 
 
   Professor Denning also has comments dated June 11 on the 
   NRC cryptography report: 
 
      http://www.cosc.georgetown.edu/~denning/crypto/NRC.txt 
 





From bogus@does.not.exist.com  Wed Jun 12 23:58:54 1996
From: bogus@does.not.exist.com ()
Date: Thu, 13 Jun 1996 14:58:54 +0800
Subject: HACKERPUNKS-OWNER ANSWERS YOUR QUESTIONS
Message-ID: <199606130119.SAA07044@jobe.shell.portal.com>


As we expected - our Announcement-posting generated 
a number of lame Followups. Our Answers follow:

in LACC-Diggest Bill Unruh <unruh at physics.ubc.ca> wrote:

>Actually if I were a "haker" I would be far more worried that this is actually
>a FBI/CIA/NSA/... run site. It sure would be a convenient way to pick off
>whole loads of self styled hackers and tie them in to ongoing investigations.
>"nobody can find out who hides behind alpha.c2.org accounts"
>or who hides behind alpha.c2.org

HACKERPUNKS-OWNER ANSWERS: Actually if you were a "haker", 
you should be worried REGARDLESS of who runs this List: 
FBI/CIA/Stasi agents can trivially create an alias like 
FBI at alpha.c2.org and SUBSCRIBE to this List. They would
know all Information that is available to the List-owner,
except the subscriber-list. But, the subscriber-list is
useless because of Anonymity.

Even if alpha.c2.org were an FBI run Site, its Users
must use Anonymous-remailers to access it. That
preserves their Privasy.

in Newsgroups David Sternlight wrote:

>Remind anyone of the police department that anonymously announced a
>resisters' seminar on how to make bombs so they could find out who to
>watch?

HACKERPUNKS-OWNER ANSWERS: how can they find out who 
to watch if subscribers are Anonymous??

SINCLAIR  DOUGLAS N wrote in cypherpunks:
>I don't have a C2 account, and don't really want to pay for one.
>I trust someone will put the hackerpunks archives on the web so
>the rest of us can read them.

HACKERPUNKS-OWNER ANSWERS: alpha.c2.org Accounts are FREE.

Ecafe Mixmaster Remailer wrote in cypherpunks:
>There was a minor error in my earlier post. If someone were to notice a
>node on the internet receiving a bag with L(In)=L(Posted) *before* any
>other nodes on the internet, then one could guess that node had a user who
>was the owner of Hackerpunks.

HACKERPUNKS-OWNER ANSWERS: There is a minor Error in 
your current Post.  L(In) <> L(Posted) because of prepended
Headers. For Protection, hackerpunks List receives some 
Junk-mail, automatically trashed, to create Noise.

HACKERPUNKS-OWNER _A_D_V_I_S_E_S_ Sameer Parekh and 
GhiO to add Code to their Alpha-remailer to insert 
Random-Size Header 'X-Random-Noise:' before Encryption 
of Messages sent to Users of alpha.c2.org Accounts.
Other Remailers are advised to change the Size of
these Header Lines.

HACKERPUNKS List-bot adds a Random-size Kookie to every
outgoing Message to preserve Privacy of Subscribers.





From tomservo at access.digex.net  Wed Jun 12 23:59:42 1996
From: tomservo at access.digex.net (Scott Fabbri)
Date: Thu, 13 Jun 1996 14:59:42 +0800
Subject: Born Classified
In-Reply-To: <199606121924.MAA07982@samsparc2.baynetworks.com>
Message-ID: <v03006f00ade51ef4eb4c@[164.109.216.51]>

A non-text attachment was scrubbed...
Name: not available
Type: text/enriched
Size: 1957 bytes
Desc: not available
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/19960613/0f2fee37/attachment.bin>

From jwilk at iglou.com  Thu Jun 13 00:58:26 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Thu, 13 Jun 1996 15:58:26 +0800
Subject: PBS show
Message-ID: <m0uU2oX-00035aC@mail.iglou.com>


Hey did any of you guys(and ladies) see the PBS show called, Triumph of the
Nerds: The Rise of Accidental Empires in Silicon Valley. I thought it was
very interesting and informative. (That's coming from a 13 year with the
teachers say have no future) If you saw it I was wondering your feeling on
the show. 

Thank you.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From frissell at panix.com  Thu Jun 13 01:31:51 1996
From: frissell at panix.com (Duncan Frissell)
Date: Thu, 13 Jun 1996 16:31:51 +0800
Subject: Kaos vs Control
Message-ID: <2.2.32.19960613031048.00b411f8@panix.com>


At 07:34 PM 6/12/96 -0700, Martin Minow wrote:

>A copy of the 11th needs to be on everyone's bookshelf.
>
>Martin.
>
>
>

The first volume (at least) of "The Encyclopedia Anglica" is available from
The Gutenberg Project.  It's the 11 ed. of the Brittanica but the name can't
be used.

DCF






From declan+ at CMU.EDU  Thu Jun 13 02:07:50 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Thu, 13 Jun 1996 17:07:50 +0800
Subject: Anonymous remailers mentioned in CDA decision
In-Reply-To: <k4oFPD30w165w@bwalk.dm.com>
Message-ID: <EljtUzK00YUyR7NsIY@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 12-Jun-96 Re: Anonymous remailers
men.. by Dr.Dimitri V. KOTM at bwalk 
> This statute's language pretty much forces DOJ to appeal, even if they think
> the law sucks.

What, precisely, in the statute's language *forces* the DoJ to appeal?

It is the Solicitor General's decision. At close of business today, the
DoJ still hadn't told me whether they would or not. But we expect they
will.

-Declan






From minow at apple.com  Thu Jun 13 02:22:46 1996
From: minow at apple.com (Martin Minow)
Date: Thu, 13 Jun 1996 17:22:46 +0800
Subject: Kaos vs Control
Message-ID: <v02140b03ade52d8aa242@[17.128.201.161]>


Tim May writes:
>
>See, all you doubters, "anarchy" is not so bad after all.
>

Check out the article on Anarchy in the 11th (or 13th) edition of the
Encyclopaedia Brittanica. It was written by Prince Kropotkin
as a philosophical argument in favor of anarchy, and the editors
saw fit to write a rebuttal footnote referring, as I recall,
to the Haymarket (Pullman?) riots.

A copy of the 11th needs to be on everyone's bookshelf.

Martin.







From tcmay at got.net  Thu Jun 13 03:06:41 1996
From: tcmay at got.net (Timothy C. May)
Date: Thu, 13 Jun 1996 18:06:41 +0800
Subject: PBS show
Message-ID: <ade4f0aa050210044853@[205.199.118.202]>


At 3:10 AM 6/13/96, Blake Wehlage wrote:
>Hey did any of you guys(and ladies) see the PBS show called, Triumph of the
>Nerds: The Rise of Accidental Empires in Silicon Valley. I thought it was
>very interesting and informative. (That's coming from a 13 year with the
>teachers say have no future) If you saw it I was wondering your feeling on
>the show.

I caught the show and thought it was pretty good, all in all.

I personally despise the term "nerd," but I won't get into that here.
(Except to say that "nerds," "geeks," and "dweebs" are terms of insult, and
anyone who accepts this labelling by the media and by "jerks" (a comparable
term, by the way) is proably just a dweeb anyone, so I guess the term is
accurate.)

Most of the portrayals of Silicon Valley history was pretty accurate,
especially the 1975-78 "Homebrew Computer Club" days. (I used to go to
about every other one of these, mainly in '77-78, where I sometimes passed
out free samples of the 8080 and stuff like that. A friend of mine at the
time was one of the Apple II motherboard designers, and another was the
first employee hired by Jobs and Woz. Personally, my first personal
computer was a Processor Technology SOL, as I thought the Apple II looked
too much like a toy. Shows you what I knew.)

The first "Byte Shop" opened in late '75 or early '76, a few miles from my
apartment, so I used to go there to see the new machines. This is the store
that bought the first batch of Apple Is (not IIs). Mainly I remember the
Altair, the IMSAI 8080, the Cromemco Dazzler, and so on.

Those were exciting times. But, having worked at Intel during those heady
days, and being pretty active these days on the Net, I'd have to say the
Web, Net, Java, etc. are *just as exciting* (if not more so) than those
days. So, the best years are probably yet to come.

(BTW, I also had an ARPANET account in 1973, when there were only several
sites as nodes.)

Back to the show...

Cringely (actually, Stephens) is pretty good at doing sidebars explaining
computers.

So, a pretty fair history of the industry. Probably the best such show I've
seen.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From frantz at netcom.com  Thu Jun 13 04:51:43 1996
From: frantz at netcom.com (Bill Frantz)
Date: Thu, 13 Jun 1996 19:51:43 +0800
Subject: Insults (was: PBS show)
Message-ID: <199606130747.AAA26956@netcom7.netcom.com>


At 10:26 PM 6/12/96 -0700, Timothy C. May wrote:
>I personally despise the term "nerd," but I won't get into that here.
>(Except to say that "nerds," "geeks," and "dweebs" are terms of insult, and
>anyone who accepts this labelling by the media and by "jerks" (a comparable
>term, by the way) is proably just a dweeb anyone, so I guess the term is
>accurate.)

IMHO the best way to deal with an insult is to make it a badge of pride. 
This is how my ancestors in revolutionary New England dealt with being
called Yankees.  It beats hell out of trying to force the rest of the world
to call your group something different every 10 years of so, like some
groups have been doing.


------------------------------------------------------------------------
Bill Frantz       | The CDA means  | Periwinkle  --  Computer Consulting
(408)356-8506     | lost jobs and  | 16345 Englewood Ave.
frantz at netcom.com | dead teenagers | Los Gatos, CA 95032, USA







From edgar at Garg.Campbell.CA.US  Thu Jun 13 07:15:56 1996
From: edgar at Garg.Campbell.CA.US (Edgar Swank)
Date: Thu, 13 Jun 1996 22:15:56 +0800
Subject: Zimmerman/ViaCrypt?
Message-ID: <0PggPD7w165w@Garg.Campbell.CA.US>


Bruce Baugh recently posted,

    *Has there been any news recently about what's going on with
    commercial versions of PGP?  I've been toying with the idea of
    buying the Windows version from ViaCrypt just to have a PGP that
    doesn't need to shell out to DOS each time it runs, but I'm
    curious as to where, if anywhere, things seem to be going.

First, unless there's been a new release, the so-called Windows
version of ViaCrypt is just a Windows shell that still creates a DOS
window to run PGP. It's a pretty good shell, and it's easy to install,
but that's about it.

There was a big discussion recently on alt.security.pgp about PRZ and
ViaCrypt.  Apparently Phil now wants to produce his own commercial
version of PGP and has "requested" ViaCrypt to sell back the
commercial rights under threat of a lawsuit if they don't.

Phil disagrees with ViaCrypts new "business" version of PGP which
apparently encrypts all messages with an employer-supplied public key
in addition to any specified by the employee.  ViaCrypt has their side
of the argument on their web page.

   http://www.viacrypt.com/

The basis of the possible lawsuit would be that ViaCrypt violated
their agreement not to put any "back door" into any product with the
PGP name. Whether the "business version feature" could be defined as a
"back door" would be the crux of the argument.

-- 
edgar at Garg.Campbell.CA.US (Edgar Swank)
The Land of Garg BBS -- +1 408 378-5108





From jt at freenix.fr  Thu Jun 13 07:41:00 1996
From: jt at freenix.fr (Jerome Thorel)
Date: Thu, 13 Jun 1996 22:41:00 +0800
Subject: lambda bulletin 2.08 / French Telco Act puts the Internet in leash
Message-ID: <v01540b04ade5ac43a3f3@[194.51.213.140]>


netizen's --> Lambda Bulletin 2.08 <-- contents

French Telco Act puts the Internet in leash
+ New rules regulating Internet content
+ First key-escrow encryption rules


As the Communications Decency Act was declared unconstitutional yesterday, June 12, the French Parliament (Senate and Assembly) passed a kind of Telco Act a la francaise last week, June 7. This law, aimed at providing new regulations for the telecommunications market (including the end of telephone monopoly in 1998), stresses two interesting points for Internet users : 1) a kind of CDA amendement was introduced en force in the Senate on Wednesday, June 5, just two days before it was voted Friday, at 3 in the morning. 2) the law establishes the first ever key escrow encryption rules created in industrialised countries. It will create trusted third parties (TTPs), private companies taht would keep encryption keys in custody for law enforcement purposes. It turns out that before the vote of the law, French military circles had already choosen which firms would be well suited to be TTP : Alcatel, Sagem and Bertin. All of them are well connected to the French military complex, and !
are all big defense contractors.

The amendment number 200 in the Loi sur la Reglementation des Telecommunications (LRT) was sponsored by French Senator Larcher and introduced by French telmecom minister Francois Fillon. At first glance, it depenalizes Internet Access Providers for the content of text, images and documents that they are transmitted. But there is an IF. The condition stresses on that they must conform to future recommendations that will be establish by a French government's council : the Comite Superieur de la Telematique. Created in February 1993, the CST has a mission of regulation of Minitel services (text and voice based services), through a professional code of ethics. The CST will no longer depends upon the French telecom ministry, but will be placed under the tutelage of another famous regulation watchdog : the CSA (A for audiovisuel - a kind of French FCC), aimed at regulating radio and TV broadcasts.

The law makes clear that if IAPs don't respond to "black" lists of Internet sites or newsgroups (in case where these sites may be in opposition to French law), the IAP will be held responsible for what it is carrying. These lists will be set up by the CST. Internet organisations and professionnals are scheduled to be members of the new CST -- today, in its "Minitel" form, it has 20 members, magistrates, ministry officials, France Telecom reprsentatives, Minitel providers, family and consumer organisations...  

So, the French amendment smells like the CDA, with the introduction of a so-called reprentative body. In the U.S. the IAP or ISP must control its content. In France this is a centralised body that will do the job. It feels that the French succeeded in what some in the US dreamt : to give the FCC the power to rate sites or content on the Internet. The French State, once again, plays the Big Mother (mother = the Republic) game with a huge sense of precipitation. 

Furthermore, the law broke in great haste -- and mess. Because before the amendment 200, telecom minister Fillon established an interministerial commission to work on guidlines and recommendations to enforce French law on the Internet. It came after a Jewish organisation sued IAPs for transmitting neo-nazi propaganda; and early in May, when 2 IAP directors were arrested for one day, and convicted, for transmission of pedophile pictures. 

The mess comes about because that Fillon didn't wait for the Commission : it was scheduled to publish a report on its work around June 15. Another mess concerns French pro-users organizations. The newly created French Chapter of the Internet Society (ISOC-France) decided, apparently with the government commission's consent, to organize a mailing list consultation on the issue. Another group, the AUI (Association of Internet users), published a report this week about ethics, Internet content selection, and so on. Both organizations were openly ignored by Fillon. He did this even after saying during various interviews that the problem of IAP legal responsability on the Internet will be the result of a "broad consensus".

It turns out, however, that a small pressure group of IAPs (the AFPI) were consulted Monday, June 2, and had the opportunity to read the amendment before its final review in the Senate. The IAPs are quite satisfied now, because they didn't want to be treated as "pedophiles" and "neo-nazi" anymore. But they will have to adopt the CST guidelines.

During my personnal inquiry of the CST last year, I found some clues to understanding how the CST has been working at regulating Minitel services. The CST has a surveillance assignment on the Minitel market (to ensure that each provider follows deontology principles written in his contract with France T�l�com). But surveillance operations are not organized by the CST, but by a small army of France Telecom spook agents in Bordeaux: they are 5 to 8 people regulating hundreds of thousands of services! It is no surprise to learn that France Telecom regularly intervenes in this choice, and that France Telecom itself is a big Minitel provider, through a lot of business affiliates. It turns out that theses spook agents are infiltrating private discussions in adult-oriented forums to check for indecent speech (which may be sanctionned by the CST). Here is what here in France we have inherited to regulate the Internet!

The second important point of this Telco Act concerns encryption. France was already the first country in the OECD to forbid an individual to use any crypto system not approved by the French authorities (ie, the military). Thus, PGP-like software were, de facto, forbidden. The new law introduces the first key-escrow regulation. It frees cryptography use ONLY for digital signature; but to ensure privacy of email messages, however, the liberation of use is under condition : to give encryption keys to a so-called TTP. Some confidential reports in the press said that one or three private companies are already on the list to serve as TTPs for the French government. The first is Bertin & Co., an engineering company that has some competence in cryptography, and the others seem to be Alcatel-Alsthom (a big industrial conglomerate in telecommunications, defense and public-works engineering), and Sagem, another telecom conglomerate. It seems clear that all of these companies were choose!
n according to their defense expertise and good relations with the French military. The mess is that these choices, if confirmed, have been made before the vote on the law, and even before "applications decrees" were published (they may be prepared this summer).
 
France has no NSA. But some big ideas. (During the oil crisis in the 70's, a government commercial stated : "In France we have no oil. But we have good ideas".)







From nobody at REPLAY.COM  Thu Jun 13 08:50:33 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Thu, 13 Jun 1996 23:50:33 +0800
Subject: No Subject
Message-ID: <199606131156.NAA29657@basement.replay.com>


_The Atlanta Journal/The Atlanta Constitution_  6/13/96

...From a 1/2 page article:

     *In Georgia the movement appears to be percolating, too. Robert Costner, president of Electronic Freedom Georgia, says the biggest hurdle his group is trying to clear is the unfamiliarity of legislators with the Internet.
     Laws like the CDA are passed, Costner said, "because people are afraid of the Internet just as people were at one time afraid of the printing press.*







From jya at pipeline.com  Thu Jun 13 08:51:57 1996
From: jya at pipeline.com (John Young)
Date: Thu, 13 Jun 1996 23:51:57 +0800
Subject: New NRC Report Site
Message-ID: <199606131135.LAA25300@pipe2.t2.usa.pipeline.com>


Thanks to Replay Web Development's generosity, the full 434-page NRC
cryptography report of May 30, 1996 is available at: 
 
 
     http://www.replay.com/mirror/nrc/ 
 
 
Our previous URL for the report also links to Replay's site: 
 
 
     http://pwp.usa.pipeline.com/~jya/nrcindex.htm





From jya at pipeline.com  Thu Jun 13 10:59:32 1996
From: jya at pipeline.com (John Young)
Date: Fri, 14 Jun 1996 01:59:32 +0800
Subject: NYT on CDA Win
Message-ID: <199606131127.LAA25041@pipe2.t2.usa.pipeline.com>


   6-13-96. NYP, Page One lead: 
 
   "Judges Turn Back Law To Regulate Internet Decency." 
 
      In a unanimous decision that celebrated the Internet as 
      "the most participatory marketplace of mass speech that 
      this country -- and indeed the world -- has yet seen," 
      a three-judge Federal panel in Philadelphia yesterday 
      declared unconstitutional major parts of a new law 
      intended to regulate indecent material on the global 
      computer network and blocked the law's enforcement. 
 
      The three judges called Government attempts to regulate 
      content on the Internet a "profoundly repugnant" affront 
      to the First Amendment's guarantee of free speech. 
 
      "Just as the strength of the Internet is chaos, so the 
      strength of our liberty depends upon the chaos and 
      cacophony of the unfettered speech the First Amendment 
      protects," Judge Dalzell wrote. 
 
   http://pwp.usa.pipeline.com/~jya/cdawin.txt   (3 articles) 
 
----- 
 
Or, if the http fails, send a CDA_win to <jya at pipeline.com>. 
 
 
 





From frissell at panix.com  Thu Jun 13 12:32:02 1996
From: frissell at panix.com (Duncan Frissell)
Date: Fri, 14 Jun 1996 03:32:02 +0800
Subject: Kaos vs Control
Message-ID: <2.2.32.19960613140607.0075f970@popserver.panix.com>


At 11:31 AM 6/12/96 -0700, Timothy C. May wrote:
>I see little chance that people who don't
>understand anarchy derives from "an-archy," "no top/leader/highest level,"
>will become educated.)

Unless they choose "anarchy" without even knowing it.  As in my Gallup Poll
question to "prove" that 90% of Americans are anarchists:

"Some groups advocate aggressive violence as a means of achieving social
ends.  Do you agree with them?  Do you advocate aggressive violence as a
means of achieving social ends?"

So 90% of the population answer "No" and demonstrate that they are either
anarchists or don't understand the nature of government.

>Good to see the courts reaffirming that "chaos" and lack of control by
>authorities is a core part of the U.S. system. Maybe the control freaks of
>Europe and Asia who have been charting their own authoritarian courses will
>give more thought to ensuring liberty even if it causes more "chaos."

One would hope.  Perhaps reality will have to do it for them.

DCF






From privsoft at ix.netcom.com  Thu Jun 13 14:23:08 1996
From: privsoft at ix.netcom.com (Steve O)
Date: Fri, 14 Jun 1996 05:23:08 +0800
Subject: Tripwire and SATAN for Linux
Message-ID: <1.5.4.16.19960613093127.090fc37a@popd.ix.netcom.com>


Hey guys,
        Can any one point to where i can get Tripwire and SATAN for Linux?
a friend is in dire need. thanks...

Steve O
 Steve O.

"True Utopia can only be reached by an uncensored and secure Internet,
	True Chaos can only be reached by the government,
		True love can only be reached in the movies."
S.O.

"Bang your head, Metal Health will drive you mad!"
Quiet Riot

"Welcome my friend, Welcome to The Machine"
Pink Floyd

"Lonelyness and Emptiness;
 Love and Fulfillment;
 Are all but flashes 
 in the eye of the storm
 of our tormented soul."
S.O.






From ses at tipper.oit.unc.edu  Thu Jun 13 15:51:28 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Fri, 14 Jun 1996 06:51:28 +0800
Subject: Insults (was: PBS show)
In-Reply-To: <199606130747.AAA26956@netcom7.netcom.com>
Message-ID: <Pine.SUN.3.91.960613110936.2157D-100000@tipper.oit.unc.edu>


On Thu, 13 Jun 1996, Bill Frantz wrote:

> At 10:26 PM 6/12/96 -0700, Timothy C. May wrote:
> >I personally despise the term "nerd," but I won't get into that here.
> >(Except to say that "nerds," "geeks," and "dweebs" are terms of insult, and

> IMHO the best way to deal with an insult is to make it a badge of pride. 

Geek Pride! Yes! Time to start Hacked-Up!

"We're Freaks! We're Geeks! We've got RSA, Get Used To It"

---
Cause maybe  (maybe)		      | In my mind I'm going to Carolina
you're gonna be the one that saves me | - back in Chapel Hill May 16th.
And after all			      | Email address remains unchanged
You're my firewall -    	      | ........First in Usenet.........





From froomkin at law.miami.edu  Thu Jun 13 16:31:41 1996
From: froomkin at law.miami.edu (Michael Froomkin)
Date: Fri, 14 Jun 1996 07:31:41 +0800
Subject: Anonymous remailers mentioned in CDA decision
In-Reply-To: <EljtUzK00YUyR7NsIY@andrew.cmu.edu>
Message-ID: <Pine.SUN.3.93.960613114908.23962A-100000@viper.law.miami.edu>


Given the extraordinaryly good findings of facts, the government will have
a very very tough time on appeal.  Shows you what fine lawyering can do.


On Thu, 13 Jun 1996, Declan B. McCullagh wrote:

> Excerpts from internet.cypherpunks: 12-Jun-96 Re: Anonymous remailers
> men.. by Dr.Dimitri V. KOTM at bwalk 
> > This statute's language pretty much forces DOJ to appeal, even if they think
> > the law sucks.
> 
> What, precisely, in the statute's language *forces* the DoJ to appeal?
> 
> It is the Solicitor General's decision. At close of business today, the
> DoJ still hadn't told me whether they would or not. But we expect they
> will.
> 
> -Declan
> 

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin at law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's warm here.  And humid.






From um at c2.org  Thu Jun 13 17:35:54 1996
From: um at c2.org (Ulf Moeller)
Date: Fri, 14 Jun 1996 08:35:54 +0800
Subject: Report from Germany on "backdoor" net-censorship
Message-ID: <9606131610.AA52938@public.uni-hamburg.de>


A short update from Germany: The "ICTF" attorney has half-retracted
their announcement on Usenet. "ICTF" is going to be only an
advisory group for ECO members. They will make recommendations
about newsgroups that might be 'dangerous' to carry, and will
only react on individual articles when they are informed about
articles that would be illegal to keep on the news servers.

The "ICTF" plans to use a modified Cancel message format that
will only affect their members' servers.

He says that the press release was not addressed to the net
(well, they tried their best to hide it...) but to journalists
with no clue.

Of course, political harm has been done, but I am glad that the
Social Democratic Party's net expert has severly critizised this
censorship attempt in a press release and on Usenet.

For those who can read German (if you can't you'll sure find the
most important news on Declan's international censorship page), I
have put up a web page on "ICTF" at http://www.thur.de/ulf/zensur/

In September, we will see what they are really going to do
other than issuing bogus press releases.





From reagle at MIT.EDU  Thu Jun 13 17:38:08 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Fri, 14 Jun 1996 08:38:08 +0800
Subject: PBS show
Message-ID: <9606131649.AA28172@rpcp.mit.edu>


At 10:26 PM 6/12/96 -0700, Timothy C. May wrote:
>I caught the show and thought it was pretty good, all in all.

        I thought so too? When is part II coming on? (I hope it didn't come
right after that, I had to run.) Next week?

>I personally despise the term "nerd," but I won't get into that here.

        Ahhh... it makes them happy. What I find most unnapealing is the
unabashed, "I don't have a life, I live with a computer" mentality. I was
rather taken with that mentality myself for a bit (and I'm sure it
contributed to the RSI), but even then I would have found it painfully
difficult to only associate with one "culture" and only do one thing all day
long. Maybe "nerds" over do it, but they do do other things, like play
magic, or assasin, D&D, or whatever. <grin> And the most
interesting/brilliant computer people that I run into _have_ other interests
beyond computers.

>first employee hired by Jobs and Woz. Personally, my first personal
>computer was a Processor Technology SOL, as I thought the Apple II looked
>too much like a toy. Shows you what I knew.)

        The thing that startled me, was the contrary temporal perspective.
Watching it I felt like, "Hey! I remeber that, I used an Apple II in
kindergarden to write LOGO," or though I didn't have an Altair, I had a
Bailey Arcade. No one here probably remembers, but it was a kick ass game
playing (the best at the time) and programmable machine. I remember
belonging to a mailing-list club and getting a thick envolope of type
written code that I'd dutifully punch into a calculator like entry pad. (All
~20 keys for quadrupely overloaded!!) The cool thing was it had cool (c-64
like) peeks and pokes and you could call a plethora of the pregenerated
graphical things from your own code. Then there was always saving it to the
audio tape... <ack> Ok, so that is the nostalgia bit (hey I remember that),
the other bit was a, wow that was a long time ago. Looking at PC-history
always feels like a contradiction in time.

_______________________
Regards,            Laziness is no more than the habit of resting before you
                    get tired. -Jules Renard
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From jimbell at pacifier.com  Thu Jun 13 17:52:31 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 14 Jun 1996 08:52:31 +0800
Subject: PBS show
Message-ID: <199606131636.JAA22527@mail.pacifier.com>


At 10:26 PM 6/12/96 -0700, Timothy C. May wrote:

>
>Most of the portrayals of Silicon Valley history was pretty accurate,
>especially the 1975-78 "Homebrew Computer Club" days. (I used to go to
>about every other one of these, mainly in '77-78, where I sometimes passed
>out free samples of the 8080 and stuff like that. A friend of mine at the
>time was one of the Apple II motherboard designers, and another was the
>first employee hired by Jobs and Woz. Personally, my first personal
>computer was a Processor Technology SOL, as I thought the Apple II looked
>too much like a toy. Shows you what I knew.)

But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset 
key, upper-case only, 40-character wide display, odd microprocessor, VERY 
SMALL capacity floppies (which were very slow as well), as well as a hostile 
legal situation regarding the building of clones.  Hell, they even objected 
to other companies building boards which plugged into the bus!

Personally, I soured on the Apple II when I followed EDN magazine's attempt 
to build an engineering system with it, called "Project Indecomp."  They ran 
into a boneheaded design problem with the Apple, due to improper clock 
synchronization and bus timing.  They gave up the project, concluding that 
the Apple II was brain-dead.

BTW, Intel shares a substantial proportion of the blame for Apple's choice 
of the 6502.  The decision was made, I've heard, because Intel was still 
trying to get $200 for a slow 8080, while Western Design Center (?) wanted 
only about $20 for a 6502.

And by refusing to build Masatoshi (?) Shima's design for the Z-80, they 
totally lost the race for the 8-bit PC world.  The Z-80 turned into the 
highest-volume 8-bit microprocessor by far, leaving both the 8080 and the 
8085 in the dust, and even the 6502.

I have other, even harsher word for the design of the IBM PC.  Oh yes, the 
Mac sucks bigtime as well, although primarily for legal reasons.


Jim Bell
jimbell at pacifier.com





From frantz at netcom.com  Thu Jun 13 18:50:28 1996
From: frantz at netcom.com (Bill Frantz)
Date: Fri, 14 Jun 1996 09:50:28 +0800
Subject: Tripwire and SATAN for Linux
Message-ID: <199606131803.LAA07464@netcom7.netcom.com>


At  7:25 AM 6/13/96 -0700, Steve O wrote:
>Hey guys,
>        Can any one point to where i can get Tripwire and SATAN for Linux?
>a friend is in dire need. thanks...

>From the notes passed out at Venema and Farmer's "Security Auditing and
Risk Analysis" class:

Archive locations for important auditing software:

COPS            http://www.fish.com/security/cops
Crack           ftp://ftp.win.tue.nl/pub/security/
ipsend (part of
        the IP
        Filter
        package) ftp://coombs.an.edu.au/pub/net/kernel/ip-fil3.0.4.tar.gz
lsof            ftp://coast.cs.perdue.edu/pub/tools/lsof
SATAN           ftp://ftp.win.tue.nl/pub/security/satan.tar.Z
Tiger           ftp://net.tamu.edu/pub/security/TAMU


Also try:

CERT            ftp://cert.org
Gene Spafford   http:/coast.cs.perdue.edu
Wietse Venma    ftp://ftp.win.tue.nl/pub/security


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From frissell at panix.com  Thu Jun 13 18:54:25 1996
From: frissell at panix.com (Duncan Frissell)
Date: Fri, 14 Jun 1996 09:54:25 +0800
Subject: No Subject
Message-ID: <2.2.32.19960613180711.00744574@popserver.panix.com>


"We're sitting here watching the sun rise for the first time and we've never
even seen the sun"

-- Rush Limbaugh about the Internet on today's show.  Rush also opined that
it was impossible to regulate.

DCF






From jseiger at cdt.org  Thu Jun 13 18:55:02 1996
From: jseiger at cdt.org (Jonah Seiger)
Date: Fri, 14 Jun 1996 09:55:02 +0800
Subject: President Clinton's Statement on the CDA Decision
Message-ID: <v02140b0bade606eb2584@[204.157.127.4]>



What's more interesting is what it doesn't say. He is not at all definitive
on whether the gvt will file an appeal...

Jonah

--
                             THE WHITE HOUSE

                      Office of the Press Secretary
___________________________________________________________________________

For Immediate Release                                       June 12, 1996

                         STATEMENT BY THE PRESIDENT

The Justice Department is reviewing today's three judge panel court
decision on the Communications Decency Act.  The opinion just came down
today, and the statute says we have twenty days to make an appeal.

I remain convinced, as I was when I signed the bill, that our Constitution
allows us to help parents by enforcing this Act to prevent children from
being exposed to objectionable material transmitted though computer
networks.  I will continue to do everything I can in my Administration to
give families every available tool to protect their children from these
materials. For example, we vigorously support the development and
widespread availability of products that allow both parents and schools to
block objectionable materials from reaching computers that children use.
And we also support the industry's accelerating efforts to rate Internet
sites so that they are compatible with these blocking techniques.

                                     -30-30-30-

* PROTECT THE INTERNET AND THE FUTURE OF FREE SPEECH IN THE INFORMATION AGE *
      Join the legal challenge against the Communications Decency Act!
               For More Information, Visit the CIEC Web Page
                         http://www.cdt.org/ciec/
                       or email <ciec-info at cdt.org>

--
Jonah Seiger, Policy Analyst           Center for Democracy and Technology
<jseiger at cdt.org>                           1634 Eye Street NW, Suite 1100
                                                      Washington, DC 20006
                                                       (v) +1.202.637.9800
PGP Key via finger                                     (f) +1.202.637.0968
http://www.cdt.org/
http://www.cdt.org/homes/jseiger/








From tcmay at got.net  Thu Jun 13 18:56:40 1996
From: tcmay at got.net (Timothy C. May)
Date: Fri, 14 Jun 1996 09:56:40 +0800
Subject: PBS show
Message-ID: <ade59c7b06021004a5fd@[205.199.118.202]>


At 5:35 PM 6/13/96, jim bell wrote:
>At 10:26 PM 6/12/96 -0700, Timothy C. May wrote:
...
>>first employee hired by Jobs and Woz. Personally, my first personal
>>computer was a Processor Technology SOL, as I thought the Apple II looked
>>too much like a toy. Shows you what I knew.)
>
>But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset
>key, upper-case only, 40-character wide display, odd microprocessor, VERY
>SMALL capacity floppies (which were very slow as well), as well as a hostile
>legal situation regarding the building of clones.  Hell, they even objected
>to other companies building boards which plugged into the bus!

Compared to my SOL, the Apple II would've been more useful, in retrospect.
As to the 40-character display, that was the norm in those days. (My SOL,
and certainly the other machines available to home users at that time, had
only a 40-character-wide display...when in worked.)

The comments about the floppies (" VERY SMALL capacity floppies (which were
very slow as well") is even more off-base. In fact, it was probably Apple's
ability to put _any_ kind of floppies on the Apple II, for a reasonable
price, that ensured its success. Processor Technology was effectively sunk
by delays in getting its "Helios" 8-inch floppy drive working. The bigger
and faster 8-inchers may have been technically superior to Apple's
"Integrated Woz Machine" drivers and 5-inch floppies, but Apple was
shipping. That counts for a _lot_.

>BTW, Intel shares a substantial proportion of the blame for Apple's choice
>of the 6502.  The decision was made, I've heard, because Intel was still
>trying to get $200 for a slow 8080, while Western Design Center (?) wanted
>only about $20 for a 6502.

You need to check your claims more carefully. There are always many reasons
a chip is selected for a design.

>And by refusing to build Masatoshi (?) Shima's design for the Z-80, they
>totally lost the race for the 8-bit PC world.  The Z-80 turned into the
>highest-volume 8-bit microprocessor by far, leaving both the 8080 and the
>8085 in the dust, and even the 6502.

Again, your understanding of the history of Intel, Zilog, and the industry
in general is lacking.

The design and process technology resources were instead committed to the
8086, and history is rather clear about the wisdom of doing that. Intel is
now capitalized at something like $50-70 billion, and Zilog is no longer on
the radar screen.


--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From reagle at MIT.EDU  Thu Jun 13 18:59:13 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Fri, 14 Jun 1996 09:59:13 +0800
Subject: Clinton Backs Internet 'Decency Act'
Message-ID: <9606131809.AA28987@rpcp.mit.edu>


At odds with what gore said.....
                         
>         WASHINGTON (Reuter) - President Clinton says the  
>Communications Decency Act is a legal way to protect children 
>from online obscenity, despite a three-judge panel's ruling that 
>blocks large parts of the act. 
>         ``I remain convinced, as I was when I signed the bill, that  
>our Constitution allows us to help parents by enforcing this Act 
>to prevent children from being exposed to objectionable material 
>transmitted through computer networks,'' Clinton said in a 
>statement Wednesday. 
>         He said he would continue to work to shield children from  
>such material and supports ``the development and widespread 
>availability of products that allow both parents and schools to 
>block objectionable materials from reaching computers that 
>children use.'' 
>         Clinton also applauded the communications industry's efforts  
>to rate Internet sites so they are compatible with blocking 
>techniques. 
>         The act, signed into law as part of the sweeping  
>Telecommunications Act of 1996, prohibits the distribution to 
>minors of indecent or ``patently offensive'' materials over 
>computer networks. 
>         The three judges issued an injunction blocking portions of  
>the Communications Decency Act, but let stand prohibitions 
>against obscenity and child pornography and types of speech that 
>are not constitutionally protected. 
>                
>
>
_______________________
Regards,            Laziness is no more than the habit of resting before you
                    get tired. -Jules Renard
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From root at edmweb.com  Thu Jun 13 19:16:52 1996
From: root at edmweb.com (Steve Reid)
Date: Fri, 14 Jun 1996 10:16:52 +0800
Subject: Zimmerman/Viacrypt
Message-ID: <Pine.BSF.3.91.960613112925.179A-100000@bitbucket.edmweb.com>


> Phil disagrees with ViaCrypts new "business" version of PGP which
> apparently encrypts all messages with an employer-supplied public key
> in addition to any specified by the employee.

Looking at Denning's critique (pro-escrow rant) of the NCR crypto report, 
she mentioned that mutant version:

[http://www.cosc.georgetown.edu/~denning/crypto/NRC.txt]
  "Other corporations are similarly adopting products with data recovery 
  capabilities as they integrate encryption into their systems (even PGP 
  comes with data recovery in Viacrypt's Business Edition)."

IMHO Phil Zimmerman has good reason to object to the mutant version, if
it's going to cause the PGP name to somehow endorse escrow. 

If there really is a demand for escrow, maybe cypherpunks could create a
One Time Pad escrow service. Different custom 'keys' could be produced,
depending on who's asking for the data... <G>

=====================================================================
| Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/)    |
| Email: steve at edmweb.com   Home Page: http://www.edmweb.com/steve/ |
| PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 |
|          -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. --          |
===================================================================:)





From reagle at MIT.EDU  Thu Jun 13 19:27:32 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Fri, 14 Jun 1996 10:27:32 +0800
Subject: Students Beware -- Fla. gov. questions jailing of researcher
Message-ID: <9606131809.AA28979@rpcp.mit.edu>


>Date: Thu, 13 Jun 1996 13:06:00 -0400
>From: reagle at rpcp.mit.edu (Joseph M. Reagle Jr.)
>To: reagle at rpcp.mit.edu
>Subject: Fla. gov. questions jailing of researcher
>
>
>                                         
>        TALLAHASSEE, Fla., June 12 (UPI) -- Gov. Lawton Chiles said Wednesday  
>he has ordered Florida education officials to determine whether a 
>university researcher jailed in a patent dispute should be freed. 
>        Petr Taborsky, an undergraduate chemistry major who worked for $8.50  
>an hour in a laboratory at the University of South Florida, was 
>sentenced in January to 3 1/2 years in a maximum-security prison. 
>        He had refused to sign over to the school a patent for a new way he  
>discovered to use a substance similar to cat litter to purify water. 
>        ``I don't know what he's doing in prison,'' said Harry Singletary,  
>Florida's prisons chief. ``We need prison beds for violent offenders, 
>for repeat offenders. I don't see him as anybody threatening the public 
>safety.'' 
>        Chiles' general counsel, Dexter Douglass, asked the Florida Board of  
>Regents to look into the university's handling of what he called ``this 
>bizarre case.'' 
>        Douglass has also asked the state's attorney general to look into the  
>prosecution of Taborsky, ``particularly the apparent use of state funds 
>for private attorneys to push criminal penalties.'' 
>        USF reportedly has spent more than $320,000 on the Taborsky case, in  
>addition to the costs of staff attorneys. 
>        Taborsky's legal problems stemmed from a testing contract USF signed  
>in 1987 with Florida Progress Corp., a utility conglomerate. 
>        The contract specified that Florida Progress would own all data and  
>discoveries. But when Taborsky was hired to work on the project, he did 
>not sign an employment contract forfeiting the right to profit in 
>anything he might discover. 
>        When he left school in 1988, Taborsky took two notebooks that USF  
>ordered him to return. When he refused, university police charged him 
>with theft. 
>        Taborsky contended the data contained in the notebooks was from  
>research he conducted separate from the Florida Progress project and 
>that the utility showed no interest in it until he discovered the new 
>water-purification method. 
>        When a jury convicted him of theft in 1990, Taborsky was sentenced to  
>a year's house arrest, 15 years' probation and ordered to make no 
>further use of the data. 
>        But he pursued a patent and in 1992 received the first of three for  
>the process. USF lawyers argued that was a violation of his probation, 
>and the court ordered Taborsky to sign over the patent to the 
>university. 
>        He refused, and was sentenced to 3 1/2 years in prison.  
>        Taborsky began prison life five months ago and has been described as  
>a model inmate. He served on a chain gang at first and by May was 
>working at the institution's waste-water treatment plant creating 
>computer programs to monitor the water. 
>        Singletary said within a few days, he hopes Taborsky will be in a  
>minimum-security work-release center closer to where his parents live. 
>        ``I'm looking for the right place to put him until he can be  
>considered for clemency or whatever else is being looked at,'' 
>Singletary said. 
>        But at least one member of the Board of Regents defended the way USF  
>handled the Taborsky case. 
>        ``It doesn't sound any different to me than a guy who steals books  
>out of the library,'' said Regents Chairman James Heekin. 
>        ``What's the big deal?'' he asked.  
>                
>
>
_______________________
Regards,            Laziness is no more than the habit of resting before you
                    get tired. -Jules Renard
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From jimbell at pacifier.com  Thu Jun 13 19:39:37 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 14 Jun 1996 10:39:37 +0800
Subject: PBS show
Message-ID: <199606131831.LAA29180@mail.pacifier.com>


At 10:31 AM 6/13/96 -0700, Timothy C. May wrote:

>
>Compared to my SOL, the Apple II would've been more useful, in retrospect.
>As to the 40-character display, that was the norm in those days. (My SOL,
>and certainly the other machines available to home users at that time, had
>only a 40-character-wide display...when in worked.)
>
>The comments about the floppies (" VERY SMALL capacity floppies (which were
>very slow as well") is even more off-base.

The original Apple II floppy held ONLY 90 kilobytes on a 5" floppy.  How did 
they do such a bad job?

>>BTW, Intel shares a substantial proportion of the blame for Apple's choice
>>of the 6502.  The decision was made, I've heard, because Intel was still
>>trying to get $200 for a slow 8080, while Western Design Center (?) wanted
>>only about $20 for a 6502.
>
>You need to check your claims more carefully. There are always many reasons
>a chip is selected for a design.

Yes, there are, but a 10-to-1 difference in price is a killer for most designs.

>
>>And by refusing to build Masatoshi (?) Shima's design for the Z-80, they
>>totally lost the race for the 8-bit PC world.  The Z-80 turned into the
>>highest-volume 8-bit microprocessor by far, leaving both the 8080 and the
>>8085 in the dust, and even the 6502.
>
>Again, your understanding of the history of Intel, Zilog, and the industry
>in general is lacking.
>
>The design and process technology resources were instead committed to the
>8086, 

The design for the Z-80 was completed and in Intel's hands.  Intel didn't 
want to build the Z-80, they wanted to focus on peripheral chips, so they 
let Shima go and start Zilog.


and history is rather clear about the wisdom of doing that. Intel is
>now capitalized at something like $50-70 billion, and Zilog is no longer on
>the radar screen.

No!  The 8086 wasn't "wise," it was a crock. (The _principle_ of building a 
16-bit microprocessor was just fine, and in fact necessary.  It's their 
product that sucked.)   Brain-dead segmented architecture, 64k per segment 
limitation, 1-megabyte memory limitation.  The only thing that made it 
appear like a wise move (and even then, only in hindsight) was the fact that 
IBM was even more idiotic, and selected it (actually, worse, the 8088!) for 
their PC.  Even a bad standard can be hugely profitable, and that is what 
kept Intel alive.

Furthermore, the only way Intel got the 8086 off the ground was to buy off 
AMD to support the 8086, as opposed to the Z-8000 as they had done in a long 
series of anti-8086 ads in about 1978 or so.  (you do recall the series, 
don't you?  You know, the two guys on the soapboxes?)  They later stiffed 
AMD by refusing to deliver the design for the 386, and they got raked over 
the coals for that a few years ago in court.  Pure fraud.  Intel's 
misbehavior has probably kept the price of the leading-edge generation 
microprocessor at least a factor of 3 higher than it would have been had AMD 
been allowed to compete according to their 1978 agreement.  Much of the 
capitalization you speak of, therefore, was the product of this fraud.

The world would have been far better off if they'd chosen the 68000 for the 
IBM PC.  I suspect the reason IBM didn't was that they thought it would be 
easier to push around tiny Intel rather than the electronics giant Motorola. 
 They were probably right about this limited interpretation, but in exchange 
for a little temporary control they doomed the world to a built-in series of 
design crocks that only began with the innate limitations of the 8088. 
 
Every product for the PC you buy today is more expensive, less reliable, 
harder to install, less compatible, more complicated for less benefit, has 
less competition, and is in general less desirable because of the mistakes 
Intel made in the middle 1970's, and IBM made in 1980 or so.  These mistakes 
weren't repaired in subsequent incarnations of the 286, 386 and others, or 
IBM's AT, etc, because they were _architecture_ problems and software-design 
problems that cannot be "repaired."  

Why is it that you can afford 32 megabytes of DRAM, yet you'd get 
insufficient-memory errors if you're not careful with you CONFIG.SYS and 
AUTOEXEC.BAT?  (Combination of Intel's dumb mistake of a 1-meg memory 
limitation, and IBM's filling of 1/3 of that space with crap.)  Why is it 
that you can't put two color displays on the latest PC's? (IBM's dumb 
mistake:  Memory-mapped video that can't be re-addressed.) Why can't you put 
a dozen peripheral devices into a PC, and you have trouble with even 3-4, 
and are forced to look up all the DMA's, Interrupts, and COM ports to ensure 
no overlap?  (IBM's dumb mistake.)

I could go on, but what's the point?  The PC architecture is pure crap, and 
I'm saying that as a person who uses them daily, and will not own a Mac 
because of Apple's legal misbehavior.


Jim Bell
jimbell at pacifier.com





From bshantz at nwlink.com  Thu Jun 13 19:41:57 1996
From: bshantz at nwlink.com (Brad Shantz)
Date: Fri, 14 Jun 1996 10:41:57 +0800
Subject: PBS show
Message-ID: <199606131824.LAA18841@montana.nwlink.com>


Tim May Wrote:

> I personally despise the term "nerd," but I won't get into that here.
> (Except to say that "nerds," "geeks," and "dweebs" are terms of insult, and
> anyone who accepts this labelling by the media and by "jerks" (a comparable
> term, by the way) is proably just a dweeb anyone, so I guess the term is
> accurate.)

I just caught this show last night.  And enjoyed it.  I 
personally thought that Steve Jobs quoting Picasso with the "True 
artists steal" line in regards to copying others work for personal 
gain was interesting. 

Since I live 10 blocks away from the main MS Campus, I hear 
everything there is to hear about Bill Gates.  So, it was really 
unnecessary for me to watch the hour and a hlaf devoted strictly to 
who Bill stole what from.  **GRIN**
 
> Those were exciting times. But, having worked at Intel during those heady
> days, and being pretty active these days on the Net, I'd have to say the
> Web, Net, Java, etc. are *just as exciting* (if not more so) than those
> days. So, the best years are probably yet to come.

Having started my "prefessional" Internet career at SPRY in 1993, I 
agree that the best of the Internet is yet to come.  Bill Gates said 
in the show last night that it is almost impossible to judge where 
the market will be in a year because things are changing so fast.  
Right now everything is a buzzword.  JAVA, etc...they are all infant 
technologies that if marketed correctly could lead to the next 
revolution.

> (BTW, I also had an ARPANET account in 1973, when there were only several
> sites as nodes.)

I was 2 until August of 1973.   **GRIN**  I didn't even know that the 
pictures on the TV weren't real yet.

> So, a pretty fair history of the industry. Probably the best such show I've
> seen.

I do wish they'd picked a better title though.

Brad


 





From tcmay at got.net  Thu Jun 13 20:05:05 1996
From: tcmay at got.net (Timothy C. May)
Date: Fri, 14 Jun 1996 11:05:05 +0800
Subject: PBS show
Message-ID: <ade5b5c2000210044195@[205.199.118.202]>


At 7:30 PM 6/13/96, jim bell wrote:
>At 10:31 AM 6/13/96 -0700, Timothy C. May wrote:
...
>>The comments about the floppies (" VERY SMALL capacity floppies (which were
>>very slow as well") is even more off-base.
>
>The original Apple II floppy held ONLY 90 kilobytes on a 5" floppy.  How did
>they do such a bad job?

And the cost of these floppies was very low--I seem to recall $150 or $175.
In those days, when 8" externals weighed 50-70 pounds and cost a few
thousand dollars, this was a notable achievement.

Remember, the standards of 1978 are not the standards of today. The
"standard" then, for personal computers that were affordable, was an
external cassette recorder ("TARBELL" standard). Go back and look at issues
of "Byte" or "Interface Age" or "Dr. Dobbs" to see what was really
available.

Given the low cost of the Apple unit, it's a marvel they could do it at
all. The "IWM" was the key. Just plain good design. And "only 90 KB" is
also misleading in implying Apple was behind the times. The IBM PC launched
3 years later had a built-in cassette port and only offered 180K diskette
drives (later upgraded to 360K).

Really, blasting Apple for poor design and for not providing
higher-capacity floppies, when the competition was doing far worse, is
laughable.

>The design for the Z-80 was completed and in Intel's hands.  Intel didn't
>want to build the Z-80, they wanted to focus on peripheral chips, so they
>let Shima go and start Zilog.

Your history is flawed. Faggin and Shima did not have a completed Z-80
design when they left; if they did, Intel would hardly have let them take
it with them when they left! As the Gen Xers would say, "Duh."

Read up on some of the histories of the time. Intel never chose to focus on
"peripherals," they chose to build both. (If anything, EPROMs were the
profit center in the mid- to late-70s, not either processors or
peripherals.)

At the time you are apparently referring to, the mid-70s, Intel had a huge
effort started to develop the "8800." While this was ultimately a failure,
it is supremely stupid to use 20-20 hindsight without looking at more
issues. All development efforts and companies involve lots of decisions,
lots of tradeoffs, lots of hurt feelings, and lots of apparent mistakes.
Arguing that Apple could have introduced a high-capacity floppy in 1978, or
that Intel should have developed the Z-8000, is just plain pointless
nonsense. We could all speculate about how some company should have done
things differently, knowing what we know now.

The rest of Bell's points are just typical PC-microprocessor flame material.

Use what you want to use, just don't rewrite history to fit your theories.

I won't comment further on this thread.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From wxfield at shore.net  Thu Jun 13 20:18:47 1996
From: wxfield at shore.net (Warren)
Date: Fri, 14 Jun 1996 11:18:47 +0800
Subject: PBS show
Message-ID: <v02140701ade5dbad4bc8@[204.167.110.223]>


I enjoyed the show as well...I was a bit young when the Altair was first
published in Radio Elec., but that didn't stop me from trying to build one.
I recall spending 100's of hours piecing it all together - it all made
sense when I 'wrote' 3 hours of code to add a stack of numbers together.

It was (and still is) and addictive feeling to think (back then) "Wow, I
just did the same thing they were doing with Eniac in my bedroom!"

Now then, if we can only get Hollywood to accurately portray computers in
films...there's a hack. ;)

BTW-If you are still 'caught up' in the innovative 'demo or die' theme the
show portrays check out the following site (http://www.be.com/) - I'm sure
many of you have already been there? Are there any "Be" developers here?
What are your thoughts?







From ses at tipper.oit.unc.edu  Thu Jun 13 20:29:15 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Fri, 14 Jun 1996 11:29:15 +0800
Subject: PBS show
In-Reply-To: <v02140701ade5dbad4bc8@[204.167.110.223]>
Message-ID: <Pine.SOL.3.91.960613165700.6058D-100000@helios.oit.unc.edu>


On Thu, 13 Jun 1996, Warren wrote:

> films...there's a hack. ;)
> 
> BTW-If you are still 'caught up' in the innovative 'demo or die' theme the
> show portrays check out the following site (http://www.be.com/) - I'm sure
> many of you have already been there? Are there any "Be" developers here?
> What are your thoughts?

I've got one - though I haven't had much of a chance to play with it so 
far (Be is in the same building as EIT, and I kept running into jlg in 
the lift :-)

They are pretty cool machines - the back panel is the ultimate in geek 
cool (there about as many ports and sockets as a sparc center 1000). The 
software is pretty alpha (they make no bones about that), and I have some 
reservations about their decision to use C++ as the API to just about all 
of the OS (things get pretty fragile when upgrading), but it's still a 
really cool box, and even if BeOS never pans out completely, you can 
still run Linux on it.

If you're in Menlo Park, definitely get a DEMO, it's the coolest new 
machine on the block. 

Simon
p.s
  does anywhere sell reasonably priced replicas of classic crypto 
hardware? 





From norm at netcom.com  Thu Jun 13 20:32:33 1996
From: norm at netcom.com (Norman Hardy)
Date: Fri, 14 Jun 1996 11:32:33 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <ade632bf01021004d335@DialupEudora>


There are two things that they may be speaking of:
1. Causing transient errors to crash the system and cause restarts that may
take many minutes.
2. Actually damage the machines.

I imagine that only a small fraction of the energy required to damage the
hardware is necessary to introduce serious transient errors. IBM used to
test the main frames as they installed them. They had to resist several
inch sparks drawn between the machine and a one meter frame. Software
diagnostics ran during the test. I think that few desk top machines would
survive that.

EMP (Electro Magnetic Impulse), a side effect of nuclear devices, is
purportedly able to damage electronics over distances of many miles. Some
weapons may be designed to enhance this.

Ordinary high explosives can produce a scaled down result. EMP is strategic
only because it  damages electronics that are too far enough to be damaged
by the blast. I suspect that high explosive EMPs are similar in this
regard.

The physics behind this is not abstruse. A significant part of the
explosive energy can be turned into EMP whether the source is nuclear or
chemical. How well it can be directed is probably highly classified. The
"antenna" is vaporized in either case and dissipates much of the energy.
The energy comes out in 10's of microseconds for high explosives and
fractions of a microsecond for nuclear. I don't know how much it takes to
fry an IC but judging from the wrist straps that are recommended for
installing ICs I would guess that it is a fraction of a Joule. (I once
discovered that a one Joule jolt really hurt.)

Faraday cages attenuate EMP by the same factor that they attenuate secrets.
I think that if a blast doesn't damage the cage then neither will the EMP.
Of course the cage may survive but fail to protect the interior
(insufficient attenuation). I don't know whether a cage sufficient for
tempest is sufficient for EMP protection. Comm lines and power cables go
thru the cage and cause problems here as well. Perhaps hefty surge
protectors suffice here. Communications equipment outside the cage should
at least be equipped to recover quickly upon transient error and not tear
donw circuits. Normal error control can then hopefully compensate for the
transient.  (IP, ATM, Frame relay??)

A large capacitor can discharge a lot of power in a short time without
causing nearly so much commotion as an explosion. Discharging a one kg
25000 volt capacitor makes a lot of noise, however. I don't know how well
it can be muffled.







From unicorn at schloss.li  Thu Jun 13 21:08:36 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Fri, 14 Jun 1996 12:08:36 +0800
Subject: Anonymous remailers mentioned in CDA decision
In-Reply-To: <Pine.SUN.3.93.960613114908.23962A-100000@viper.law.miami.edu>
Message-ID: <Pine.SUN.3.93.960613140439.13421A-100000@polaris>


On Thu, 13 Jun 1996, Michael Froomkin wrote:

> Given the extraordinaryly good findings of facts, the government will have
> a very very tough time on appeal.  Shows you what fine lawyering can do.

I, usually a judicial cynic, found the job done by the panel in terms of
findings and judicially noted facts astoundingly complete.

This case has really restored my faith in the ability of the judicial
system to absorb new technologies- not because of the result itself, but
because of the care and weight given to the process.

As Professor Froomkin indicated, appeal will be exceedingly difficult.
Not only are the findings of fact very detailed and extensive, but because
this case did not involve a prosecution, there is no direct way to
point to the evil criminal in a specific, rather than general way.

I think they would be unwise to appeal, but I can also see where the
political considerations would override that basic logic.

I'll poke around a bit and see if I can find out what (if anything) is in
the works.

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From vznuri at netcom.com  Thu Jun 13 22:54:54 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Fri, 14 Jun 1996 13:54:54 +0800
Subject: microcurrency implementation
Message-ID: <199606132044.NAA05426@netcom22.netcom.com>



an interesting system that lets people bill for web pages
using telephone 800 number technology.


------- Forwarded Message

Date: Tue, 11 Jun 1996 15:19:37 -0300
From: Rick McGinnis <rick at dragon.mediadial.com>
Message-Id: <199606111819.PAA07849 at dragon.mediadial.com>

Via-Web Access now perfected!

Instantly bill people over the web through long distance numbers.

	1. Paid in US funds for all 90+ countries using the net!
	2. Payouts are weekly!
	3. Receive $0.25 US for every minute.
	4. Easier than any web billing procedure currently used.
	5. Everyone has a phone.

If you would like to try Via-Web Access, please call...
	Can and US Dial 011-592-583-423
	Other Countries ++592-583-423

The Via-Web Access home page can be found at:
  http://stsim.com/mdc/viaweb/







From hfinney at shell.portal.com  Thu Jun 13 23:01:31 1996
From: hfinney at shell.portal.com (Hal)
Date: Fri, 14 Jun 1996 14:01:31 +0800
Subject: Comments on MicroPayments and the Web
Message-ID: <199606132222.PAA09190@jobe.shell.portal.com>


From: "Mark M." <markm at voicenet.com>
> I think it would be interesting to see how copyright law will be applied to the
> Web if micropayments ever become popular.  Would memory or disk caching be
> considered fair use?  If so, then people could just set up a very large disk
> cache and maybe delete it every month or so.  It would also be a pretty neat
> hack to use a proxy that only cached pages that charged micropayments.
> Companies would not make a lot of money from things like this.  If disk caching
> was not considered to be fair use, people would still turn it on anyway.

Where does the money come from to run this proxy?

Consider two sites, one which acts as a proxy and cache but which
charges something under a penny per page, and another which acts for
free.  Won't the for-pay site be able to afford a larger disk, more
servers, and better net connections?  It will be a superior service.

Micropayments will allow new services and improved quality over what we
have today where we have to rely on charity and advertising as
motivations for much of what we find on the web.

Hal





From unicorn at schloss.li  Thu Jun 13 23:03:19 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Fri, 14 Jun 1996 14:03:19 +0800
Subject: Anonymous remailers mentioned in CDA decision
In-Reply-To: <Pine.SUN.3.93.960613172259.27730B-100000@viper.law.miami.edu>
Message-ID: <Pine.SUN.3.93.960613191656.14537A-100000@polaris>


On Thu, 13 Jun 1996, Michael Froomkin wrote:

> On Thu, 13 Jun 1996, Black Unicorn wrote:
> 
> > I think they would be unwise to appeal, but I can also see where the
> > political considerations would override that basic logic.
> > 
> 
> The unstated assumption, of course, is that the Justice Dept was really
> trying to win...  One wondered, at times...

Excellent point, though I think this would have been a personal decision
on the part of the parties involved rather than a institutional one.

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From dsalenger at dttus.com  Thu Jun 13 23:10:35 1996
From: dsalenger at dttus.com (Daniel Salenger)
Date: Fri, 14 Jun 1996 14:10:35 +0800
Subject: CDA & Clinton
Message-ID: <9605138347.AA834715665@cc2.dttus.com>


     It looks as though even after the temporary court injunction against 
     major portions of the CDA, Clinton still wants to push it:
     
     http://www.yahoo.com/headlines/960612/news/stories/internet_4.html
     
     Very unfortunate.  Please protect us from ourselves Bill.
     
     
     Dan Salenger
     dsalenger at dttus.com






From foodie at netcom.com  Thu Jun 13 23:13:42 1996
From: foodie at netcom.com (Jamie Lawrence)
Date: Fri, 14 Jun 1996 14:13:42 +0800
Subject: Web Based Encrypted Backup
Message-ID: <v02140b01ade634604997@[10.0.2.15]>


Connected Corporation announced DataSafe, a Mac/Windows web based
backup service.

$14.95/Month for 50MB, archival CD-ROM for $24.95 each.

Offers passwords and DES encryption. Storage is on 2 mirrored
sites.

Phone # (508) 270-0035, http://www.connected.com/.

>From thier site:

-------
Security

DataSafe uses the federally approved Data Encryption Standard (DES) with a
56-bit key to encrypt
all of your data before it leaves your PC. This level of encryption is so
powerful, it is not permitted
to be exported outside of the United States (we use a different, but
similarly powerful encryption
scheme for our international customers). You have the option to choose your
own encryption
password, which is never transferred to us over the modem. In this way, no
one but you can read
your data - not when it is in transfer to us, nor when it is being stored
in encrypted format at our
secure operations centers. When this level of encryption is combined with
the fact that we only
transmit the portions of each file that change every day, not the entire
file, the chances that anyone
will be able to read or make use of your data as it travels over the
network are practically eliminated.
DataSafe uses the TCP/IP communications protocol for both its private
dial-up network and
Internet-based services.
--------

I really like the idea of distributed, encrypted backups, but
this strikes me as the kind of thing that has the potential to
get a lot of gullible people in trouble.

Hopefully someone offshore with proven security and a wider choice
of algorithms will compete...

(I don't know if Connected is good at security, so this shouldn't
be construed as a swipe at them. Does anyone know anything about
them?)

-j

--
The signal is the noise.
____________________________________________________________________
Jamie Lawrence   mailto:jal at cyborganic.net  mailto:foodie at netcom.com







From melman at osf.org  Thu Jun 13 23:19:41 1996
From: melman at osf.org (Howard Melman)
Date: Fri, 14 Jun 1996 14:19:41 +0800
Subject: RSAREF down?
Message-ID: <9606132300.AA16648@absolut.osf.org.osf.org>



Anyone know anything about this?

tmp> ftp ftp.rsa.com
Connected to ftp.rsa.com.
220-
220-Welcome to the RSA Data Security, Inc. FTP Archive.
[...]
220-***************** Special Announcement *******************
220-
220-    RSAREF has been taken down until further notice.
220-    We will keep you informed for any new announcement.
220-
220-***********************************************************






From hfinney at shell.portal.com  Thu Jun 13 23:22:15 1996
From: hfinney at shell.portal.com (Hal)
Date: Fri, 14 Jun 1996 14:22:15 +0800
Subject: doubleclick monitoring web browsing habits
Message-ID: <199606132319.QAA14901@jobe.shell.portal.com>


A post on comp.risks described a web adverstising service called
"doubleclick".  As described in its web pages at <URL:
http://ad.doubleclick.net >, this service provides targetted
advertising on the web.

Participating web sites include links to doubleclick to show graphic
images.  Advertisers sign up with doubleclick and specify profiles for
where and when they want their ads to appear.  Doubleclick then selects
an ad for each user who visits a participating site.  Participating sites
get paid for each such hit, and advertisers pay based on how many hits
are expected.

Apparently this is being used quite a bit.  But what I found disturbing
was the scope of the information being collected by doubleclick.  The
various parameters that advertisers can use in setting up their profiles
for where their ads should appear are described at <URL:
http://ad.doubleclick.net/advertising/adreghelp.htm > and include:

  TARGET BY WEB PAGE/SITE CATEGORY
  TARGET BY SERVICE PROVIDER (SP)
  TARGET BY GEOGRAPHIC LOCATION
   We determine a person's geographic location through the physical
   location of their network or through user registration. We have
   created an extensive map of both organization and Internet Service
   Provider (ISP) networks.
  TARGET BY USER'S OPERATING SYSTEM 
  TARGET BY USER'S BROWSER TYPE 
  TARGET BY HIGH-LEVEL INTERNET DOMAIN TYPE 
  TARGET BY ORGANIZATION TYPE (SIC CODE) 
  TARGET BY ORGANIZATION SIZE OR REVENUE
  TARGET BY PERSONAL INTERESTS
   doubleclick.net continues to add to an extensive database of user
   interests from activity on doubleclick.net member web sites as well as
   from publicly available sources like netnews. User interests are kept
   strictly confidential and will not be released to advertisers. We do
   allow advertisers to target ad banners based on user's interests. The
   more your ad banner is targeted at specific user interests, the more
   likely you are to generate a response. Personal interest categories
   include:
   
   Arts and Literature
   Business, Finance, and Economy
   Computers, Software and Internet
   Culture, Religion, and Society
   Education and InstructionalEntertainment
   Government, Politics, and Military
   Health and Medicine
   News
   Recreation and LeisureScience and Technology
   Social Science
   Sports
   Travel

This last category is the really worrisome one.  doubleclick monitors
the web browsing habits of users whenever they hit a doubleclick-
participating site, and builds up databases about users from that, as
well as from usenet posts.  This is exactly what people have been
talking about as an abuse of privacy on the net.

One question is whether enough information to uniquely identify users
is routinely provided by widely used browsers like Netscape.  I have
refrained from telling my Netscape browser my name and email address out
of fear that it would reveal this information; as a result, I can't use
mailto: links, which is annoying (and also suspicious; lynx allows me to
do mailto: without permanently entering an email address).

This points out the need for browser providers to be sensitive to the
privacy needs of their users and to clearly explain when and under what
circumstances private information is revealed.  It also suggests that
services like www.anonymizer.com will be increasingly important for
people to protect their privacy while browsing.

Hal





From Doug.Hughes at Eng.Auburn.EDU  Thu Jun 13 23:40:10 1996
From: Doug.Hughes at Eng.Auburn.EDU (Doug Hughes)
Date: Fri, 14 Jun 1996 14:40:10 +0800
Subject: PBS show
In-Reply-To: <199606131636.JAA22527@mail.pacifier.com>
Message-ID: <doug-9605132214.AA00145887@netman.eng.auburn.edu>




>But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset 
>key, upper-case only, 40-character wide display, odd microprocessor, VERY 
>SMALL capacity floppies (which were very slow as well), as well as a hostile 
>legal situation regarding the building of clones.  Hell, they even objected 
>to other companies building boards which plugged into the bus!
>

The //e made a lot of improvements in this area. uppper+lower case + mouse
text chars support. 80 column cards with double hires graphics. Also,
the floppies weren't that slow compared to the terrible cassette drives in
common use around that time, so some perspective is in order. Clone
situation didn't help them, but then, it didn't help IBM a whole lot either,
though it did wonders for MicroSoft. ;)

Many many many companies developed cards which plugged into the expansion
slots. Problem was, there were too few slots (especially since you
couldn't use slot 3 if you had an 80 column card). :)
(Printer card, modem card, hard disk card, 80 column card, mockingboard/sound
card, graphics tablet/koala pad card, z80 card, RGB graphics card, etc etc..

BTW, what does this have to do with cypherpunks? can we cancel the topic
now?

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug at eng.auburn.edu
		Pro is to Con as progress is to congress





From markm at voicenet.com  Thu Jun 13 23:51:33 1996
From: markm at voicenet.com (Mark M.)
Date: Fri, 14 Jun 1996 14:51:33 +0800
Subject: Comments on MicroPayments and the Web
In-Reply-To: <2.2.32.19960611193553.00cb57a0@mail.teleport.com>
Message-ID: <Pine.LNX.3.93.960613162617.149A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 11 Jun 1996, Alan Olsen wrote:

> 2)  If a dialog comes up for each site that wants to ding you for a bit of
> money, these sites are going to resemble the pay toilets of the net.  People
> will go there if they have to, but avoid them (or crawl under with an old
> browser) if they can.

I think it would be interesting to see how copyright law will be applied to the
Web if micropayments ever become popular.  Would memory or disk caching be
considered fair use?  If so, then people could just set up a very large disk
cache and maybe delete it every month or so.  It would also be a pretty neat
hack to use a proxy that only cached pages that charged micropayments.
Companies would not make a lot of money from things like this.  If disk caching
was not considered to be fair use, people would still turn it on anyway.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMcB6ZrZc+sv5siulAQFEKgP/RmelqsXXDaw48s2bIRlmqYdWWt4pMf0s
kJTtxLrMuaNq0ROOtlMp8AvEKVpAs/JTPbut004a4TpEeoCShHiXw0G+wV/1etdA
qqTTRYiEZqEuhTZriHsz8G0Ia3BNwxeSc5QJ81M1FY4GK/CSVjhb8TM41fBSCKkr
blCNM44O9S0=
=LJWg
-----END PGP SIGNATURE-----





From jimbell at pacifier.com  Fri Jun 14 00:54:03 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 14 Jun 1996 15:54:03 +0800
Subject: PBS show
Message-ID: <199606132226.PAA12067@mail.pacifier.com>


At 12:40 PM 6/13/96 -0400, Warren wrote:
>I enjoyed the show as well...I was a bit young when the Altair was first
>published in Radio Elec., 

Nope.  Popular Electronics.  January, 1975 issue.


Jim Bell
jimbell at pacifier.com





From froomkin at law.miami.edu  Fri Jun 14 01:16:55 1996
From: froomkin at law.miami.edu (Michael Froomkin)
Date: Fri, 14 Jun 1996 16:16:55 +0800
Subject: Anonymous remailers mentioned in CDA decision
In-Reply-To: <Pine.SUN.3.93.960613140439.13421A-100000@polaris>
Message-ID: <Pine.SUN.3.93.960613172259.27730B-100000@viper.law.miami.edu>


On Thu, 13 Jun 1996, Black Unicorn wrote:

> I think they would be unwise to appeal, but I can also see where the
> political considerations would override that basic logic.
> 

The unstated assumption, of course, is that the Justice Dept was really
trying to win...  One wondered, at times...

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin at law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's warm here.  And humid.






From grafolog at netcom.com  Fri Jun 14 02:28:59 1996
From: grafolog at netcom.com (jonathon)
Date: Fri, 14 Jun 1996 17:28:59 +0800
Subject: Insults (was: PBS show)
In-Reply-To: <Pine.SUN.3.91.960613110936.2157D-100000@tipper.oit.unc.edu>
Message-ID: <Pine.3.89.9606140305.A10802-0100000@netcom19>


	Simon:

On Thu, 13 Jun 1996, Simon Spero wrote:

> On Thu, 13 Jun 1996, Bill Frantz wrote:
> > At 10:26 PM 6/12/96 -0700, Timothy C. May wrote:
> > >I personally despise the term "nerd," but I won't get into that here.
> > >(Except to say that "nerds," "geeks," and "dweebs" are terms of insult,
> > IMHO the best way to deal with an insult is to make it a badge of pride. 
> Geek Pride! Yes! Time to start Hacked-Up!
> "We're Freaks! We're Geeks! We've got RSA, Get Used To It"

	Note in passing that both "Baptist" and "Mormon" were 
	originally terms of insult heaped on members of those
	respective faiths.  

        xan

        jonathon
        grafolog at netcom.com



**********************************************************************
*								     *
*	Opinions expressed don't necessarily reflect my own views.   *
*								     *
*	There is no way that they can be construed to represent      *
*	any organization's views.				     *
*								     *
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
*								     *
*       http://members.tripod.com/~graphology/index.html             *
*								     *
***********************************************************************







From WlkngOwl at unix.asb.com  Fri Jun 14 02:29:02 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Fri, 14 Jun 1996 17:29:02 +0800
Subject: Kaos vs Control
Message-ID: <199606140306.XAA22997@unix.asb.com>


On 13 Jun 96 at 10:06, Duncan Frissell wrote:

> At 11:31 AM 6/12/96 -0700, Timothy C. May wrote:
[..]
> >Good to see the courts reaffirming that "chaos" and lack of control by
> >authorities is a core part of the U.S. system. Maybe the control freaks of
> >Europe and Asia who have been charting their own authoritarian courses will
> >give more thought to ensuring liberty even if it causes more "chaos."

> One would hope.  Perhaps reality will have to do it for them.

Reality never did anything for the (Supreme) Court, and certainly not 
a lot of politicians.  But yes, one would hope...

Rob.
 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From hermit at bayview.com  Fri Jun 14 02:29:04 1996
From: hermit at bayview.com (William R. Ward)
Date: Fri, 14 Jun 1996 17:29:04 +0800
Subject: [NOISE] Re: PBS show
In-Reply-To: <9606131649.AA28172@rpcp.mit.edu>
Message-ID: <199606140306.UAA14530@komodo.bayview.com>



I'm delurking here ... just signed up on cypherpunks, though I've
known about it for a long time.

I don't watch TV, don't have cable, and thus can't watch this PBS show
everyon's a-buzz about.  I would like to see it, though.  I would be
most grateful if someone who has taped it could loan me the tape so I
could watch it.

I live in Santa Cruz, CA, and work in Mountain View; surely someone in
the south bay has been taping this?  I hope so.

--Bill.






From snow at smoke.suba.com  Fri Jun 14 02:30:35 1996
From: snow at smoke.suba.com (snow)
Date: Fri, 14 Jun 1996 17:30:35 +0800
Subject: Insults (was: PBS show)
In-Reply-To: <Pine.SUN.3.91.960613110936.2157D-100000@tipper.oit.unc.edu>
Message-ID: <Pine.LNX.3.93.960613213907.140A-100000@smoke.suba.com>


On Thu, 13 Jun 1996, Simon Spero wrote:

> On Thu, 13 Jun 1996, Bill Frantz wrote:
> 
> > At 10:26 PM 6/12/96 -0700, Timothy C. May wrote:
> > >I personally despise the term "nerd," but I won't get into that here.
> > >(Except to say that "nerds," "geeks," and "dweebs" are terms of insult, and
> 
> > IMHO the best way to deal with an insult is to make it a badge of pride. 
> 
> Geek Pride! Yes! Time to start Hacked-Up!
> 
> "We're Freaks! We're Geeks! We've got RSA, Get Used To It"
	
	We're freaks, we're geeks, we've got your data and we're not
afraid to use it?

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From jwilk at iglou.com  Fri Jun 14 02:35:22 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Fri, 14 Jun 1996 17:35:22 +0800
Subject: PBS show
Message-ID: <m0uUPTz-00035cC@mail.iglou.com>


At 09:35 AM 6/13/96 -0800, jim bell wrote:
>At 10:26 PM 6/12/96 -0700, Timothy C. May wrote:
>
>>

>But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset 
>key, upper-case only, 40-character wide display, odd microprocessor, VERY 
>SMALL capacity floppies (which were very slow as well), as well as a hostile 
>legal situation regarding the building of clones.  Hell, they even objected 
>to other companies building boards which plugged into the bus!


I was not a toy it was what started the PC revolution

>I have other, even harsher word for the design of the IBM PC.  Oh yes, the 
>Mac sucks bigtime as well, although primarily for legal reasons.
>

Mac rule they have an awesome GUI (graphical user interface), easy of use it
way up there and they have bitchin' software. 

I know i will regret saying this but:

The mac OS is 3 times better than Windows '95 

(Eat that Bill!)

>Jim Bell
>jimbell at pacifier.com
>
>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From frantz at netcom.com  Fri Jun 14 02:39:23 1996
From: frantz at netcom.com (Bill Frantz)
Date: Fri, 14 Jun 1996 17:39:23 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <199606140308.UAA02340@netcom7.netcom.com>


N.B. Joss at netcom.com was not acceptable to netcom

At  1:13 PM 6/13/96 -0800, Norman Hardy wrote:
>EMP (Electro Magnetic Impulse), a side effect of nuclear devices, is
>purportedly able to damage electronics over distances of many miles. Some
>weapons may be designed to enhance this.

I vaguely remember hearing that a nuclear device exploded high over the
midwest would have significant EMP effects over half the continental USA.

When a USSR pilot flew a "state of the art" fighter out and US intelligence
got their hands on it we were surprised that all the electronics were
vacuum tubes.  However, vacuum tubes are highly resistant to EMP.  (They
arc between elements, rather than fry like ICs.)


>Faraday cages attenuate EMP by the same factor that they attenuate secrets.
>I think that if a blast doesn't damage the cage then neither will the EMP.
>Of course the cage may survive but fail to protect the interior
>(insufficient attenuation). I don't know whether a cage sufficient for
>tempest is sufficient for EMP protection. Comm lines and power cables go
>thru the cage and cause problems here as well. Perhaps hefty surge
>protectors suffice here. Communications equipment outside the cage should
>at least be equipped to recover quickly upon transient error and not tear
>donw circuits. Normal error control can then hopefully compensate for the
>transient.  (IP, ATM, Frame relay??)

Makes you want fiber optic comm cable.  Protection inside the cage probably
depends on how powerful the EMP is.  However, the need for some degree of
stealth in Class III InfoWar will limit the strength of the EMP.


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From ichudov at algebra.com  Fri Jun 14 02:40:40 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Fri, 14 Jun 1996 17:40:40 +0800
Subject: Class III InfoWar: TST Article
In-Reply-To: <ade632bf01021004d335@DialupEudora>
Message-ID: <199606140318.WAA15580@manifold.algebra.com>


Norman Hardy wrote:
> 
> A large capacitor can discharge a lot of power in a short time without
> causing nearly so much commotion as an explosion. Discharging a one kg
> 25000 volt capacitor makes a lot of noise, however. I don't know how well
> it can be muffled.

Isolate it with vacuum?

	- Igor.





From jwilk at iglou.com  Fri Jun 14 02:41:51 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Fri, 14 Jun 1996 17:41:51 +0800
Subject: Insults (was: PBS show)
Message-ID: <m0uUP8C-00035CC@mail.iglou.com>



>Geek Pride! Yes! Time to start Hacked-Up!
>
>"We're Freaks! We're Geeks! We've got RSA, Get Used To It"
>
>---
>Cause maybe  (maybe)		      | In my mind I'm going to Carolina
>you're gonna be the one that saves me | - back in Chapel Hill May 16th.
>And after all			      | Email address remains unchanged
>You're my firewall -    	      | ........First in Usenet.........
>
>
Speak for yourself, man!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From jlasser at rwd.goucher.edu  Fri Jun 14 02:45:25 1996
From: jlasser at rwd.goucher.edu (Moltar Ramone)
Date: Fri, 14 Jun 1996 17:45:25 +0800
Subject: PBS show
In-Reply-To: <199606131831.LAA29180@mail.pacifier.com>
Message-ID: <Pine.SUN.3.91.960613223218.5810A-100000@rwd.goucher.edu>


On Thu, 13 Jun 1996, jim bell wrote:

> >The comments about the floppies (" VERY SMALL capacity floppies (which were
> >very slow as well") is even more off-base.
> 
> The original Apple II floppy held ONLY 90 kilobytes on a 5" floppy.  How did 
> they do such a bad job?

Wrong.  The _original_ apple 2 floppy held about 130K -- competitive with 
other single-density single-sided floppies of the day... 1 1/2 years later, 
they fit 160K on a single-sided single-density floppy, almost as much as 
an IBM double-density single-sided floppy (180K)  (This is related to the 
fact that the apple used 5+3 encoding, while IBM still uses the 
more-obvious but less-efficient 4+4 -- read _Beneath_Apple_DOS_ for more 
details)

----------
Jon Lasser (410)532-7138                         - Obscenity  is a crutch  for
jlasser at rwd.goucher.edu                            inarticulate motherfuckers.
http://www.goucher.edu/~jlasser/
Finger for PGP key (1024/EC001E4D)               - Fuck the CDA.







From grafolog at netcom.com  Fri Jun 14 02:45:59 1996
From: grafolog at netcom.com (jonathon)
Date: Fri, 14 Jun 1996 17:45:59 +0800
Subject: PBS show
In-Reply-To: <199606131636.JAA22527@mail.pacifier.com>
Message-ID: <Pine.3.89.9606140311.A10802-0100000@netcom19>


	Jim:

On Thu, 13 Jun 1996, jim bell wrote:

> But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset 

	I liked my Apple 2e, which had most of the faults you mention.
	And the editor had for it had one feature I haven't seen on any
	editor since.  	

> And by refusing to build Masatoshi (?) Shima's design for the Z-80, they 

	The number one selling computer with a Z-80 chip inside was
	also the number one computer platform which ran CP/M which was
	The Apple 2e.
	
	<< Yes, the Z-870 chip was a third party add on. >>	

> I have other, even harsher word for the design of the IBM PC.  Oh yes, the 
> Mac sucks bigtime as well, although primarily for legal reasons.

	Mainly because it has what has to be the world's most user
	hostile computer interface ever dreamed up, until Win95
	came on the scene.  

        xan

        jonathon
        grafolog at netcom.com

**********************************************************************
*								     *
*	Opinions expressed don't necessarily reflect my own views.   *
*								     *
*	There is no way that they can be construed to represent      *
*	any organization's views.				     *
*								     *
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
*								     *
*       http://members.tripod.com/~graphology/index.html             *
*								     *
***********************************************************************







From declan+ at CMU.EDU  Fri Jun 14 03:23:17 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 14 Jun 1996 18:23:17 +0800
Subject: PBS show
In-Reply-To: <199606131831.LAA29180@mail.pacifier.com>
Message-ID: <IlkDlaO00YUy1ODDgK@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 13-Jun-96 Re: PBS show by jim
bell at pacifier.com 
> The original Apple II floppy held ONLY 90 kilobytes on a 5" floppy.  How did 
> they do such a bad job?

The original Apple II floppy disk drive held 143KB, though you could use
extra tracks if you were ambitious. The drive was a marvel, and was
considerably ahead of its competition. I remember the Commodore 64
drives (1541?) that were just plain slothful.

You could also use the other side of the disk, of course!

-Declan






From jwilk at iglou.com  Fri Jun 14 03:42:06 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Fri, 14 Jun 1996 18:42:06 +0800
Subject: 
Message-ID: <m0uUQLd-000357C@mail.iglou.com>


At 02:07 PM 6/13/96 -0400, Duncan Frissell wrote:
>"We're sitting here watching the sun rise for the first time and we've never
>even seen the sun"
>
>-- Rush Limbaugh about the Internet on today's show.  Rush also opined that
>it was impossible to regulate.
>
They will never be able to regulate the net, look at he first and main use
for it. 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From WlkngOwl at unix.asb.com  Fri Jun 14 04:06:14 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Fri, 14 Jun 1996 19:06:14 +0800
Subject: President Clinton's Statement on the CDA Decision
Message-ID: <199606140312.XAA23119@unix.asb.com>


On 13 Jun 96 at 13:57, Jonah Seiger wrote:

>                              THE WHITE HOUSE
[..]
>                          STATEMENT BY THE PRESIDENT
[..]
> I remain convinced, as I was when I signed the bill, that our Constitution
> allows us to help parents by enforcing this Act to prevent children from
> being exposed to objectionable material transmitted though computer
> networks.  I will continue to do everything I can in my Administration to

Really? Where does it say "...except to help parents protect 
children" in the Bill of Rights?

Hm. Maybe he should have inhaled.  Oxygen is good for reading 
comprehension.

My apologies to non-USers on the list.


Rob.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From ses at tipper.oit.unc.edu  Fri Jun 14 04:07:59 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Fri, 14 Jun 1996 19:07:59 +0800
Subject: PBS show
In-Reply-To: <ade5b5c2000210044195@[205.199.118.202]>
Message-ID: <Pine.SUN.3.91.960614001159.4192A-100000@tipper.oit.unc.edu>


On Thu, 13 Jun 1996, Timothy C. May wrote:

> Given the low cost of the Apple unit, it's a marvel they could do it at
> all. The "IWM" was the key. Just plain good design. And "only 90 KB" is
> also misleading in implying Apple was behind the times. The IBM PC launched
> 3 years later had a built-in cassette port and only offered 180K diskette
> drives (later upgraded to 360K).

Also had more than enough computing power to break knapsack. It's not 
what you've got, it's how you use it.

Interesting gedankenexperiment... how much difference would it have made 
to ULTRA and it's predecessors if bletchley park had rediscovered 
and been able to manfacture semi-reliably primitive transistors? 

Simon



---
Cause maybe  (maybe)		      | In my mind I'm going to Carolina
you're gonna be the one that saves me | - back in Chapel Hill May 16th.
And after all			      | Email address remains unchanged
You're my firewall -    	      | ........First in Usenet.........





From jimbell at pacifier.com  Fri Jun 14 04:28:58 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 14 Jun 1996 19:28:58 +0800
Subject: "Neil, the government wouldn't tap the phones of American  Reporters"
Message-ID: <199606140556.WAA05474@mail.pacifier.com>


At 09:11 PM 6/11/96 -0700, Bill Stewart wrote:
>"Neil, the government wouldn't tap the phones of American Reporters"
>- Hedrick Smith to his NYT colleague Neil Sheehan, while working
>on the Pentagon Papers project - he was incorrect, and his phones
>_were_ being tapped....
>
>CSPAN-2 is doing a 25-year retrospective on the Pentagon Papers this week;
>Daniel Ellsberg, Hedrick Smith, and others were on tonight,
>with people from other sides on later this week.  Cool show so far!
>

While I didn't pay any appreciable attention to the Pentagon Papers case at 
the time, it is worth noting that the only reason that it "occurred" 
(appeared in the media) was that a few reporters decided it was worth 
opposing the government.  Today, this stuff would just pop up on the 
Internet without the approval or participation of the media:  Obviously, 
this is a vast reduction of the influence of the media, and a corresponding 
increase in the power of the individual.  _THIS_ is the kind of thing that 
the government fears; it has cultivated its relationships with the news 
media for many decades, and doesn't want circumstances to change.

The Watergate incident is yet another one of those things which might not 
have "happened" without media people inclined to do it then, but that is no 
longer the truth today.


Jim Bell
jimbell at pacifier.com





From stewarts at ix.netcom.com  Fri Jun 14 06:36:46 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Fri, 14 Jun 1996 21:36:46 +0800
Subject: Semi-Transcript: Pro-CODE hearings on CSPAN-2
Message-ID: <199606140754.AAA25782@toad.com>


I caught part of the Burns S.1726 Pro-CODE hearings on CSPAN-2 tonight.
Various speakers got about 5 minutes each; most had their full testimony
in the printed record in addition to informal speaking.
Then the Senators got to grill them.  I can't type like Kerouac,
so this will be pretty random and sketchy, almost all mistakes are mine...
(Punctuation, spelling, abbrevs. etc. don't count - sorry :-)
There were several rounds of ~4 panelees I caught the first couple
but it's  ~2am.

Lots of people emphasized "We recognize the legitimate needs of
law enforcement, but other things are more important to national security,
and crypto is Inevitable, inevitable, inevitable, so get used to it."

Senator Burns was showing the NTT RSA chips - he had a bit of trouble
remembering which Triple-DES pieces were 56/168/1024 bits, saying
"I have a good memory but it's short :-)"

Pressler arrived late (he's also busy marking up a tax bill where big
airports want one kind of tax and little ones want another - 
used this as an analogy and ducked out soon.)
He held up a copy of Applied Cryptography "I haven't read it all yet", and
commented that he could ship the book out but not the floppy.
"We've all got to take cracks at reading summaries of books like this."
"The Cold War is over" "This is government trying to catch up,
and government is 10-15 years behind." "We have to protect banking,
and protect the ability of the FBI to protect people."

Jim Barksdale of Netscape talked about how fast his company has grown;
as with other speakers like Bidzos, he talked about how if you miss
a market window, you can't catch up.  His background includes military
intelligence and working for a large cell-phone company, and he had
no problem cooperating with the "legitimate needs of law enforcement"
when they had warrants - but he considers the need for encryption to
be more critical, and considers the cat to be out of the bag.  
He put up a poster with a web page www.thawte.com/products/sioux,
a web server product competing directly with Netscape Server and products
from several other people at the table here today - the product's web page
emphasizes how it's not limited by US export controls.  It's SSLeay based.

Zisman from Lotus and Business Software Alliance talked; I missed most of
it and part of Bidzos's.

Jim Bidzos talked about lots of things, including the NTT chips
(Burns held them up - they're small).  Emphasizes NTT biggest company in 
world.  Cat's out of bag, crypto inevitable.  Flamed escrow.
"Bill Gates called the latest escrow proposal 'No proposal'"
Inevitability of real crypto internationally.

Tim Kraus Kopf of Spyglass talked about how Mosaic is OEMed by many
companies, US and overseas, and about his frustration about not being
able to provide good service to his overseas customers - not only
short-key crypto, but can't provide source.  Decided to see how much
crypto was readily available overseas, did AltaVista search for
Apache-SSL, found it all over the world - PacRim, Germany, Australia,
talked about how SSLeay is Australian-written, contains RSA,RC2/4,DES, etc.,
and is used in products like Sioux that competes with his servers and NS's.

Burns asked Barksdale about whether key escrow extends powers of gov't etc.
Barksdale "We're not against key escrow, just mandatory, but it won't work,
there isn't a compromise, there isn't some clever back door, but it
simply won't work.  If we _could_ make it work, we'd have done it
a while ago so we wouldn't be taking our time today"
"We have some national security interests - well what are they -
we can't tell you - that's like talking to a guy who keeps quoting God -
NRC report last week _had_ seen all the details and said it won't work"

Bidzos - to reinvent the software infrastructure to do key escrow would
take 3-5 years, couldn't really trust third parties to do it.
Imagine Netscape and Microsoft waiting 3-5 years doing this instead
of spending their time competing.  

Pressler? Banks?  Bidzos: In my interest the banks don't understand yet
Kraus Kopf: Double encryption anyway - you'll find a safe in the locked room.
Burns: American Bankers' Assoc endorsed the bill.  Can't a warrant let
them get information without needing escrow and wiretaps?
Bidzos: We've heard aministration say the industry wants escrow -
only if you carefully interpret what that means - companies may do
their own, don't understand what justifies radical change that
brings in third parties and mandatory escrow

Wyden: What do you folks think will happen if we don't modernize?
Zisman at Lotus - will really hold back technology - internet growth speed
absolutely levels playing field between largest players and smallest players
trmendously empowering to small business and what we're doing here
interferes with that.  People used to accept 40 bits, don't any more,
though big customers don't think it's a "joke" like some customers say.
this is a lose-lose proposition.

Wyden: Bidzos - we'll hear the Admin saying foreign products aren't as good,
how will we know foreign products contain what they assert?
Bidzos - it's easy - can download source code & read it, see if it works,
and it _does_ work as well or better.  2) test interoperability,
since you can import it and verify it's identical.  German and Japanese chips
very good, use US patents, high school textbooks, etc.
often overlooked cost - we'll have our lunch eaten here in the US as well,
not just overseas markets - say MNC wants secure comms, buys Japanese.

Wyden: Barksdale - concerned that overall the government has consistently
been fighting yesterday's battle - everybody was against smut but
private sector vs. smut cops, fortunately courts making good decisions
- how to catch up and be pro-active instead of behind
Barksdale - we've given fair amount of thought - dump key escrow,
dump limited key lengths, won't work, last war - it's a given.
Understand crypto only a portion of sigint, other ways start at source
or destination - subpoenas, most people who have a mind to do harm
don't use the internet, they use phones.
So what can we do that _does_ work?  Look for new ways, not restricting
old ways to make things that won't work kinda work, worst approach.

John Kerry D-Mass - My state has emormous stake, and I'm former prosecutor,
trying to come to grips with choices - how do you find out what others
selling - are they living up to level of proficiency they're advertising.
Bidzos: Largest corp in world NTT just did the chips, would deny reality
to say otherwise
KrausKopf - advantage in encryption it's easy to verify because if you can
decrypt it you know it works
Bidzos - some of the foreign implementations don't measure up, and 
don't doubt some US entities can exploit, but problem - process by which
deficiencies are resolved is improving rapidly, testing by import to US,
next step may be for overseas products to be incompatible with US so
if you want good security you need to buy South African instead of US,
you can buy over Internet.  They're not as good as we are, improving
rapidly, larger companies _are_ as good.
Kerry - is this inevitiability curve?
Bidzos - yep.  Intelligence folks are very good but their job
isn't to care about whether we lose market share.
K - if you know what we knew?
Z - NRC did know, 13/16 security cleared.  Market inevitability.
too much Focus on key escrow instead of getting intelligence community
equipped to deal with it.
K - Alternatives if escrow won't work?
Z - Escrow in legal sense vs. this stuff.  Impractical, and won't
catch bad guys, unacceptible to market.  Voluntary key recovery
something big companies already do, and warrants can get those from
places that use them.  These discussions going on for a long time,
being brought to a head, need immediate relief and action so we can
have a playing field where we can compete
K - you do accept legitimate needs
Z - sure, but reject idea that current policies affect that
K - so you think it's inevitable that won't work
Z - yeah 
K - do you believe there's potential for cyberterrorism that could
impact either defense comms or financial institutions
Barksdale - sure - that's why we need tight encryption instead of
this loosey-goosey stuff we've got.  Can you imagine pressure on holder
of key escrow for international circumvention to get that file?
KK - security depends on number of doors, not just lock strength.
Bidzos - intelligence worried about increased costs, idiot-proof crypto,
but that's the inevitability we have to accept.  Significant loss of
jobs and revenues if don't act, NSA doesn't understand market forces,
        "other than that they're doing fine" :-)
and risk backlash that could completely lose them any controls,
if we were to raise speed limit to 100 mph, you'd see us investing in
faster police cars
        Burns - in Montana we don't have speed limit :-)
Burns - are y'all saying this policy puts us at more risk than without it
Everybody - yes, we've been saying this for long time,
national security is much stronger with crypto protecting
the computers we're dependent on.

Bidzos?  We get asked what if terrorist brings down airliner?
Well, in this computer age, what if a 12-year-old does?
We need crypto to prevent that sort of problem.

Kerry - market share, clearly understand, trying to balance interests

Wyden - are you discussing software with intelligence community?
new partnership on software side like have with hardware
Bidzos - couldn't agree more - NSA thinks talking AT&T & Motorola is
whole industry.  And without prior consultation, all we've gotten has
been Clipper Chip and key escrow

Barksdale - My CTO talking at NSA? conference Friday, happy to talk
Zisman - expertise exists, much better to invest in intelligence-gathering
techniques than implementing diversionary stuff that won't work

Kerry - if you're US attorney and get a wiretap you can't read,
what happens if can't break - are we saying law enforce needs new tools
Barks - yes sir, just like conversation on street hard to tap
K - so we just have to adjust
B - yes sir
Bidzos - 40-bit agreement between NSA and industry waS that 40-bit
level would be periodically raised - we might not be having this
confrontation if NSA'd done their part and taken us seriously

Kenneth Dam of NRC Panel next on agenda - also brought with him
Jules Katz former deputy USTR, 30 years export control,
Herb Lin, staff director, has whole report
        still in printing but we can get you copies now.  volume August.
        executive summary and full statement available
Keeping confidential info private is very hard.
Criminals, corporate spies, crucial systems vulnerable to all sorts of
people.  Crypto an important, vital tool for protecting citizens privacy
and legitimate business interests.  Bad Guys can also use it.
Feds must weigh issues.  NRC study asked for by Congress.
We have diverse interests, but have strong consensus,
13/16 got cleared for classified materials, unanimously conclude
that debate can be carried out reasonably on unclassified basis.
Wider use of crypto will support everyone's interest even though
will make it harder for law enforcement.  

Don't believe total drop export controls, though relaxing will help. 
DOmestic/Foreign version split bad at home - govt needs to make it
easier for US companies. Should be easy to export DES.  
US world market leadership good for national security.  
No legal limits domestically!

"National security vs. business security" is over-simplistic -
protecting civilian infrastructure stengthens national security.

Escrow promising but unproven, risky - resolving some issues
would require legislation, but there's not enough experience to
base it on anything but speculation - government should pursue
for internal use, developing policy with open public discussion.
Only way to get consensus is Congressional discussion.

Burns - we politicians will take the parts we like and throw
the rest away :-)  Why are National Security folks unwilling
or reluctant to try other approaches?

Dam - Law Enf vs. National Security - N.S. folks recognize responsibility
to protect whole country's security, including infrastructure,
so they're more balanced.  Law Enf has different concerns - they're
interested in surreptitious eavesdropping phone conversations and
data - also want to hold down crime, and computers are growing part of that,
LE under pressure to solve big high-profile crimes fast and pre-empt,
like blowing up World Trade Center.  They have other ways to get info,
e.g. subpoena, warrants, but most people don't keep records of phone calls
that can be subpoenaed, and this is the heart of their concern.

Burns - still vulnerable to terrorism because we're open and free,
but jsut as vulnerable to industrial espionage, need real crypto to prevent.
more risk from industrial than terrorists.  Thought report was very
complete on that.  Wyden?

Wyden: report ought to be real wake-up call for Clinton folks in field.
Very prestigious report.  Mr. Dam - you were at State in 80s, part of team
advocating strong controls, why did you change your mind?
Dam - crypto export wasn't big issue then, world changing fast,
industrial vulnerability criticial, info security in INformation Age.

Dam - wants to allow >DES export for products that make plaintext available.

For people to understand the issues, they'll have to get up to speed on
a lot of issues, but they're not classified ones.

Wyden wants Dam to lead discussions between software folks and NSA-side,
hopes some convergence and cooperation can happen.

===========================================================

Next panel - HP, EDS, etc. 
  
Dan Buchanan - Zion's Data Svcs. in Salt Lake - Bank holding business.
Utah digital Signatures laws.  Computer breakins in financial businesses -
we need strong crypto to be able to compete with foreign banks and
preserve our own assets.  Our biggest asset is the trust we represent
to our customers - essential that we not be limited in use of crypto,
flexible methodologies absolutely critical as computer power increases.

EDS - we're now separate from GM, trading NYSE next monday.
We're world-wide, chasing global electronic commerce markets,
need secure, speedy, efficient communications,
restrictions reduce our competitiveness.
Pleasant calm pro-crypto speech.  Good for Industry, Good for America!

HP - Richard Sevick.
HP speaker showing off his smart card, says 500 million around world,
need stronger crypto than export allows, international competitors.
HP projects 4 billion smart cards in use by Y2000, US companies can't
afford to miss it, need this export liberalization.  It's also an
international problem, not just national - HP working with US and G7
to get international framework for crypto, needs legislative support
from S.1726 - Proposes Crypto engines on servers which don't work
without smartcard "flag chips" to let you use your government-approved
crypto chip to authorize different levels of encryption as needed.
        [WCS comment - yukkk!  I'm trying to be objective, but.....]
Can do shopping at home with security!  Companies can interchange sensitive
info, level of crypto flexible as authorized by national governments.
Pilots this fall with computer vendors, banks, phone companies, expect
approval, want S.1726 to help them export its framework.

Burns - if we're going to live in a micro-chip and supercomputer industry,
why should we hang on to the old vaccuum tube? 
Seen proposals for smart cards for foodstamps/welfare/wic/etc. fraud
prevention because foodstamps are sold on street.

Joel Lisker from MasterCard - MC uses crypto for PINs,
smartcards - 40-bit key way too short, computer hackers can crack in seconds,
can't export strong enough smartcards without long slow negotiations.
Held up Spanish chip-card from Europay, their counterpart in Spain -
if we gave this kind of card to US customer, not clear they could
take it with them in their wallet on trip out of US because export laws.

Burns - are your customers reluctant to do business on phone,
divulging account numbers etc. -

Lisker - younger people usually more comfortable but older
customers more concerned about compromise.

Sevcik - people trust smartcards more with PINs since they can't
be used if stolen.

Burns - some trials of smartcards for foodstamps annoyed bureaucrats
because it doesn't take as many people at the courthouse counting
food stamps.

====================================
aharon friedman digital secured networks technology
        hardware crypto product company in NJ - 512-bit keys
        minimum length needed is 75 bits to be close to unbreakable.
        40 not enough - can buy $400 chip to break 5 hours, etc.
                $300K break 0.18 seconds
        Security agencies would like us to use 56 bits,
                same $300K of off-the-shelf stuff 19 days to break,
                but same $300K of custom chips can break in 3 hours
                        as described in open literature
                doesn't matter if escrow, can break anyway
        Also need key-exchange, public-key eg. RSA 
                govt doesn't allow itself <1024 bit keys
                we're forced to deliver security products that
                        we don't believe provide security.
                        overseas customers aren't stupid, they won't buy it.
        Job loss estimates
        His company has many requests for their technology,
        thinks it's one of the best, 700 foreign companies request it.
        Large Japanese compnay wants to buy lots.  We can't sell 
                and govt dragging feet even for evaluation copies.  We lose.
        American companies want to communicate with foreign companies -
                what can they buy?  They'll buy NTT or Siemens.
        Showed "Applied Crypto" book source code in back,
                any criminal can type it in or buy a scanner.
        Ex-FBI head says "give me 5 hackers and I can bring down US"
                Easier to write crypto code than make a bomb - 
                law-enforcement agencies know this.
        Quotes NYT editorial - clearly it's time to revise policy.

robert bigony senior-vp marketing govt & space motorola in scottsdale
        Moto at center of debate because of products we make.

=====================================================
..... I'm not going to transcribe the rest....
and the recorded Senator Burns wants to get to lunch :-)


                        Bill


#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From caal at hopf.dnai.com  Fri Jun 14 19:02:12 1996
From: caal at hopf.dnai.com (caal at hopf.dnai.com)
Date: Sat, 15 Jun 1996 10:02:12 +0800
Subject: PR firm...
Message-ID: <199606141714.KAA25918@hopf.dnai.com>


sorry guys,

his e-mail is pr at middleberg.com...just in case you want to send him a
message...maybe you know of rogue web site that need to be closed down,
censored, pushed behind an Iron Curtain






From reagle at MIT.EDU  Fri Jun 14 19:07:31 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Sat, 15 Jun 1996 10:07:31 +0800
Subject: PBS show
Message-ID: <9606141444.AA13836@rpcp.mit.edu>


At 10:31 AM 6/13/96 -0700, Timothy C. May wrote:

>The comments about the floppies (" VERY SMALL capacity floppies (which were
>very slow as well") is even more off-base. In fact, it was probably Apple's
>ability to put _any_ kind of floppies on the Apple II, for a reasonable
>price, that ensured its success.

        Just commenting on the niceness of the existence of floppies, I
remember when I got a floppy for the C-64 I was floored. I'd been dumping my
code to audio tape (record it once, change the volume a little, record it
again, change the treble a little, etc. about 3 times to be sure it was on
the tape) for years! Even the c-64's slow drives were FAST in comparison to
sitting by the tape recorder listening for a break in screechy noise to hear
me say "pong 3" or something. <grin> I could store 10 tapes worth of stuff
on a floppy nearly instaneaously, and access it randomly! And once I got the
little cartridge (mach 5) which blanked the screen during floppy access (one
of the major reasons, among other things, the c-64 was so slow) it was like
lightening... <smile>
_______________________
Regards,            The lust for comfort murders the passions 
                    of the soul. -Kahlil Gibran
Joseph  Reagle      http://farnsworth.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From WlkngOwl at unix.asb.com  Fri Jun 14 19:08:30 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sat, 15 Jun 1996 10:08:30 +0800
Subject: doubleclick monitoring web browsing habits
Message-ID: <199606141818.OAA27290@unix.asb.com>


On 13 Jun 96 at 16:19, Hal wrote:

> A post on comp.risks described a web adverstising service called
> "doubleclick".  As described in its web pages at <URL:
> http://ad.doubleclick.net >, this service provides targetted
> advertising on the web.
[..]
> One question is whether enough information to uniquely identify users
> is routinely provided by widely used browsers like Netscape.  I have

Supposedly Netscape has been responsive to this.  One of the changes 
in 2.0 had to do with giving out personal info (and people can verify 
this if they have the servers, etc.)

> refrained from telling my Netscape browser my name and email address out
> of fear that it would reveal this information; as a result, I can't use
> mailto: links, which is annoying (and also suspicious; lynx allows me to
> do mailto: without permanently entering an email address).

Lynx running under Unix can find out who you are on the system by 
checking your user id and the hostname.

Rob.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From quax at interserv.com  Fri Jun 14 19:09:15 1996
From: quax at interserv.com (quax at interserv.com)
Date: Sat, 15 Jun 1996 10:09:15 +0800
Subject: National DNA Data Bank
Message-ID: <199606141410.AA27783@relay.interserv.com>


The New York Times today writes on a report to be released today on the 
establishment of a national DNA data bank to parallel the national fingerprint 
system. The DNA system was authorized in a little-noted provision of the 1994 
Crime Control Act.

The article states that one of the DNA system's main advantage over 
fingerprinting will be in identifying sexual and other bodily assault criminals 
who leave tell-tales, as well as in correcting victims' sometimes faulty 
identification of innocents.


Some civil libertarians are critical of the project as invasive of privacy.

Law enforcement officials and others applaud it, two of whom are OJ's former 
attorneys, Barry Scheck and Peter Neufeld, who run the Innocence Project, a 
program which uses DNA testing to help free those falsely convicted.








From caal at hopf.dnai.com  Fri Jun 14 19:10:28 1996
From: caal at hopf.dnai.com (caal at hopf.dnai.com)
Date: Sat, 15 Jun 1996 10:10:28 +0800
Subject: PR Firm To Tame Net
Message-ID: <199606141558.IAA20308@hopf.dnai.com>


Did anyone on this list read the SF Chronicle article a few days ago about a
PR firm, that "tames rogue Web sites".  It monitors the Web for these sites,
finds the people who created them and tries to convince them to go offline.
"if gentle persuasion doesn't wprk", said the founder, "you need to bring in
the lawyers".  He gives the example of a Kmart Sucks site, created by a
disgruntled employee, and the First Boston site where a former employee
published proprietary salary figures...I guess he doesn't know that making
derogatory comments is LEGAL.

You know, we were talking these days about the Net putting the masses back
in mass media...this guy says these days are over.  His e-mail address is
m.a at ix.netcom.com.






From markm at voicenet.com  Fri Jun 14 19:12:21 1996
From: markm at voicenet.com (Mark M.)
Date: Sat, 15 Jun 1996 10:12:21 +0800
Subject: RSAREF down?
In-Reply-To: <9606132300.AA16648@absolut.osf.org.osf.org>
Message-ID: <Pine.LNX.3.93.960614165445.394B-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Thu, 13 Jun 1996, Howard Melman wrote:

> 
> Anyone know anything about this?
> 
> tmp> ftp ftp.rsa.com
> Connected to ftp.rsa.com.
> 220-
> 220-Welcome to the RSA Data Security, Inc. FTP Archive.
> [...]
> 220-***************** Special Announcement *******************
> 220-
> 220-    RSAREF has been taken down until further notice.
> 220-    We will keep you informed for any new announcement.
> 220-
> 220-***********************************************************

I noticed this a couple of weeks ago.  I don't know what the problem with RSA
is, but RSAREF is available at ftp://ftp.replay.com/pub/replay/pub/crypto/LIBS/
rsa/ .

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMcHS5LZc+sv5siulAQFVUAP7BSrv8Vdu+URobw6M9+9Bu3oV+XSiTege
p4i7rp3IJOi7nY3y0AztejpxGs2gLVF0Puc4wxNZhjakpSk/SZReg2DoqMZgspZo
P0bQii5YQEl24o4rKvcJs4CdS3ed8Wszn8Uar9+rsgPVMU+Sezdt0RkZpyolgMQm
ndMpiboLqcQ=
=IHn2
-----END PGP SIGNATURE-----





From llurch at networking.stanford.edu  Fri Jun 14 19:13:33 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sat, 15 Jun 1996 10:13:33 +0800
Subject: Clinton Backs Internet 'Decency Act'
In-Reply-To: <9606131809.AA28987@rpcp.mit.edu>
Message-ID: <Pine.GUL.3.93.960614103434.22241D-100000@Networking.Stanford.EDU>


On Thu, 13 Jun 1996, Joseph M. Reagle Jr. wrote:

> At odds with what gore said.....
>                          
> >         WASHINGTON (Reuter) - President Clinton says the  
> >Communications Decency Act is a legal way to protect children 
> >from online obscenity, despite a three-judge panel's ruling that 
> >blocks large parts of the act. 
> >         ``I remain convinced, as I was when I signed the bill, that  
> >our Constitution allows us to help parents by enforcing this Act 
> >to prevent children from being exposed to objectionable material 
> >transmitted through computer networks,'' Clinton said in a 
> >statement Wednesday. 

This is also at odds with what Clinton said. The full text of the statement
is available on whitehouse.gov, among other places.

-rich






From nelson at crynwr.com  Fri Jun 14 19:15:17 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 15 Jun 1996 10:15:17 +0800
Subject: 
In-Reply-To: <m0uUQLd-000357C@mail.iglou.com>
Message-ID: <19960614111725.14796.qmail@ns.crynwr.com>


Blake Wehlage writes:

 > They will never be able to regulate the net, look at he first and main use
 > for it. 

What main use?  Flaming assholes who really deserve it?

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676       | +1 315 268 9201 FAX   | the side of freedom.





From jwilk at iglou.com  Fri Jun 14 19:17:33 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 10:17:33 +0800
Subject: [NOISE] Re: PBS show
Message-ID: <m0uUdoy-00035gC@mail.iglou.com>


At 08:06 PM 6/13/96 -0700, William R. Ward wrote:
>
>I'm delurking here ... just signed up on cypherpunks, though I've
>known about it for a long time.
>
>I don't watch TV, don't have cable, and thus can't watch this PBS show
>everyon's a-buzz about.  I would like to see it, though.  I would be
>most grateful if someone who has taped it could loan me the tape so I
>could watch it.
>
>I live in Santa Cruz, CA, and work in Mountain View; surely someone in
>the south bay has been taping this?  I hope so.
>
>--Bill.
>
>
>
Hey Bill, they made VHS tapes for sale it the whole set, I would buy it. It
was based on a book so pick up the book.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From WlkngOwl at unix.asb.com  Fri Jun 14 19:18:00 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sat, 15 Jun 1996 10:18:00 +0800
Subject: Web Based Decrypted Backup
Message-ID: <199606141818.OAA27286@unix.asb.com>


On 13 Jun 96 at 14:23, Jamie Lawrence wrote:

Disconnected Corporation announced SortaSafe, a Mac/Windows web based
backup service.
 
[..]

>From thier site:
> 
> -------
> Insecurity
> 
> SortaSafe uses the federally approved Data Encryption Standard (DES) with a
> 56-bit key to encrypt
> all of your data before it leaves your PC. This level of encryption is so
> powerful, only people with several thousand dollars can decrypt it.

...


 





From dbell at maths.tcd.ie  Fri Jun 14 19:21:50 1996
From: dbell at maths.tcd.ie (Derek Bell)
Date: Sat, 15 Jun 1996 10:21:50 +0800
Subject: [Off-topic] Re: Insults (was: PBS show)
In-Reply-To: <Pine.3.89.9606140305.A10802-0100000@netcom19>
Message-ID: <9606141706.aa16535@salmon.maths.tcd.ie>


In message <Pine.3.89.9606140305.A10802-0100000 at netcom19>, jonathon writes:
>	Note in passing that both "Baptist" and "Mormon" were 
>	originally terms of insult heaped on members of those
>	respective faiths.  

	I think "Quaker" had a similar history..

	Derek Bell






From mpd at netcom.com  Fri Jun 14 19:26:54 1996
From: mpd at netcom.com (Mike Duvos)
Date: Sat, 15 Jun 1996 10:26:54 +0800
Subject: RSAREF down?
In-Reply-To: <9606132300.AA16648@absolut.osf.org.osf.org>
Message-ID: <199606140215.TAA18681@netcom16.netcom.com>


> Anyone know anything about this?
> 
> tmp> ftp ftp.rsa.com
> Connected to ftp.rsa.com.
> 220-
> 220-Welcome to the RSA Data Security, Inc. FTP Archive.
> [...]
> 220-***************** Special Announcement *******************
> 220-
> 220-    RSAREF has been taken down until further notice.
> 220-    We will keep you informed for any new announcement.
> 220-
> 220-***********************************************************

How inconvenient.  I guess people will have to get the software from
one of the many overseas mirror sites. :)

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     mpd at netcom.com     $    via Finger.                      $






From jlasser at rwd.goucher.edu  Fri Jun 14 19:27:10 1996
From: jlasser at rwd.goucher.edu (Moltar Ramone)
Date: Sat, 15 Jun 1996 10:27:10 +0800
Subject: PBS show
In-Reply-To: <ade59c7b06021004a5fd@[205.199.118.202]>
Message-ID: <Pine.SUN.3.91.960613212831.5164A-100000@rwd.goucher.edu>


On Thu, 13 Jun 1996, Timothy C. May wrote:

> >BTW, Intel shares a substantial proportion of the blame for Apple's choice
> >of the 6502.  The decision was made, I've heard, because Intel was still
> >trying to get $200 for a slow 8080, while Western Design Center (?) wanted
> >only about $20 for a 6502.
> 
> You need to check your claims more carefully. There are always many reasons
> a chip is selected for a design.

Well, the machine was originally designed around an 8080, but then Woz 
found the incredible deal on the 6502 and re-worked the machine...

----------
Jon Lasser (410)532-7138                         - Obscenity  is a crutch  for
jlasser at rwd.goucher.edu                            inarticulate motherfuckers.
http://www.goucher.edu/~jlasser/
Finger for PGP key (1024/EC001E4D)               - Fuck the CDA.






From dsmith at prairienet.org  Fri Jun 14 19:28:00 1996
From: dsmith at prairienet.org (David E. Smith)
Date: Sat, 15 Jun 1996 10:28:00 +0800
Subject: PBS show
Message-ID: <1.5.4.32.19960614202430.0067bda4@204.248.40.2>


>I know i will regret saying this but:
>
>The mac OS is 3 times better than Windows '95 
>

Gee, what's three times zero?

dave







From caal at hopf.dnai.com  Fri Jun 14 19:28:53 1996
From: caal at hopf.dnai.com (caal at hopf.dnai.com)
Date: Sat, 15 Jun 1996 10:28:53 +0800
Subject: PR
Message-ID: <199606141733.KAA27294@hopf.dnai.com>


> Public Relations
> 
> --------------------------------------------------------------------
> 
> From           xopher at ptd.net
> Organization   ProLog - PenTeleData, Inc.
> Date           Thu, 13 Jun 1996 00:43:02 GMT
> Newsgroups     alt.fan.unabomber
> Message-ID     <4pnobp$1lh at ns2.ptd.net>
> 
> --------------------------------------------------------------------
> 
> PR firm declares war on 'rogue' Web sites
> 
> Copyright � 1996 Nando.net
> Copyright � 1996 The Associated Press
> 
> SAN FRANCISCO (Jun 10, 1996 10:23 a.m. EDT) -- To advertisers and
> activists, the Internet is
> nirvana -- unlimited space and the chance to get their message to the
> world. To the public relations
> firm of Middleberg and Associates, it's a potential nightmare.
> 
> Before the World Wide Web, people unhappy with individual companies
> were reduced to
> convincing a news organization they had a legitimate gripe or standing
> around handing out leaflets at
> corporate headquarters.
> 
> Now, all it takes is a weekend coding some HTML files and every
> complaint or concern they've
> ever had is instantly available to millions.
> 
> "There was the 'Kmart Sucks' site, created by a disgruntled employee
> who was saying a lot of mean
> and nasty things about Kmart. Then there was the First Boston site,
> where a former employee
> published proprietary salary figures," said Don Middleberg, whose firm
> protects its clients from
> attacks on the Internet.
> 
> "Companies spend small fortunes to create a brand image and something
> called good will," he said.
> "These sites are actively destroying them."
> 
> To counter the threat, Middleberg's firm monitors the Web for what he
> calls "rogue" sites, then finds
> the people who created them and attempts to convince them to go
> off-line.
> 
> "If gentle persuasion doesn't work," he said from his New York office,
> "you need to bring in the
> lawyers."
> 
> Over and above First Amendment concerns, threats of legal action are a
> long way from the golden
> vision of the Web as an democratic leveler rhapsodized about by Howard
> Rheingold, who has
> written several books about the ethos of the Internet.
> 
> "The Internet puts the masses back in mass media. It lets anyone
> publish their manifesto for all the
> world to read," Rheingold said from his home near San Francisco.
> 
> Those days are over, countered Middleberg.
> 
> "Rheingold's perceptions of where things are might have been true a
> few months ago," he said. "But
> this is big business. Things have changed. This is no longer a cottage
> industry. Companies have spent
> millions of dollars on this. They're going to fight to protect their
> sites."
> 
> "If the lawyers decide to go after someone and a company is willing to
> spend the dollars, they
> certainly can threaten and make life very difficult for people."
> 
> It's legally unclear, however, how much power companies actually have.
> Merely making derogatory
> comments is not illegal, said David Maher, co-chair of the
> subcommittee on Internet Trademark
> Issues of the International Trademark Association.
> 
> "If you have an individual who doesn't like Ford motor cars or Burger
> King and says rude things
> about them, the First Amendment provides quite a shield. Just because
> people are saying bad things
> about you, you can't necessarily stop them," he said.
> 
> Not only is truth a defense against libel, but trade libel law
> requires that a company must show it
> actually has been damaged, a higher standard than individuals, who
> must show only that their
> reputations have been damaged, Maher said.
> 
> But legal or not, even the threat might be enough to shut down smaller
> sites, said Jonathan Hall, a
> spokesman for the environmental group Greenpeace -- which maintains an
> active Web site.
> 
> "I wouldn't be surprised if people gave in if they got a call and were
> told to 'remove this or there will
> be legal action.' They might do it because they don't know their legal
> rights," he said.
> 
> Greenpeace does, which is probably why the association of nuclear
> energy producers Middleberg
> recently spoke to considers it such a threat.
> 
> "They are scared to death of groups like Greenpeace, who are very
> clever in how they use the Net
> to get a message out," Middleberg said.
> 
> Not unexpectedly, Middleberg won't name his clients, though he says
> he's added eight to the list in
> the last six months.
> 
> Other public relations firms say they haven't heard of anyone using a
> similar strategy. Curtis Kundred
> of Fleishman Hillard International Communications deemed it a
> short-run approach that will backfire
> in the end.
> 
> "I would hope it's not the job of a public relations firm to muscle
> someone into backing down from
> expressing their beliefs online," added Amy Oringel of InterActive
> Public Relations Inc.
> 
> Up until now, the Web has provided a level playing field, a place
> where "Joe Schmoe can have just
> as much credibility as CNN," said writer Martin A. Lee, whose book
> "Unreliable Sources" was an
> expose of the public relations industry.
> 
> "Money is the great unleveler in this equation," he said. "We seem to
> be in the crux of a shift, when
> the whole equilibrium is shifting from 'a thousand flowers blooming'
> to a corporate market. It's
> disturbing."








From llurch at networking.stanford.edu  Fri Jun 14 19:30:10 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sat, 15 Jun 1996 10:30:10 +0800
Subject: PBS show
In-Reply-To: <v02140701ade5dbad4bc8@[204.167.110.223]>
Message-ID: <Pine.GUL.3.93.960613184135.16782F-100000@Networking.Stanford.EDU>


On Thu, 13 Jun 1996, Warren wrote:

> It was (and still is) and addictive feeling to think (back then) "Wow, I
> just did the same thing they were doing with Eniac in my bedroom!"

Isn't that illegal in some states?

-rich






From drosoff at arc.unm.edu  Fri Jun 14 19:55:11 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Sat, 15 Jun 1996 10:55:11 +0800
Subject: Applied Cryptography - used copy?
Message-ID: <1.5.4.16.19960614211928.326fad06@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

Does anyone have a used copy of Applied Cryptography they'd like to
get rid of? (Reply to drosoff at arc.unm.edu)

===============================================================================
David Rosoff (nihongo o chiisaku dekimasu)  ------------->  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
===
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." <---- "Ulysses", by Alfred, Lord Tennyson

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcHXRBguzHDTdpL5AQFiQgP+Mj545SMMlj70nJzZhFnHiCvNZ0bx/qJy
MFhKIZKX6fGINewAgHwscgPiXpQ1mRndp0K2PGeZi0IeaX7pxqZN3Mr8LEQ48Ltz
CKc8zolmIIq2cRYC2bmeEDbgLNk6arct2XcJ8DMD0hBd9JMtZlX0OUo53li/zz8p
dWEwYo655Sc=
=xnql
-----END PGP SIGNATURE-----






From markm at voicenet.com  Fri Jun 14 19:59:20 1996
From: markm at voicenet.com (Mark M.)
Date: Sat, 15 Jun 1996 10:59:20 +0800
Subject: Does information want to be free?
Message-ID: <Pine.LNX.3.93.960614164556.394A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

For those interested, there is an article in the latest Scientific American
about copyright laws and how they will be applied to the Internet.  It used
the banned French book about the former president as an example of just how
difficult it is to regulate information.  It also addresses whether routers
(or analogously anonymous remailers) should be held liable for any copyright
violations that may pass through them.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMcHQnbZc+sv5siulAQFcGAQAj5/LnS2usgN0ElYuH14inFZfLe3bZ6gW
gyzSsuIjOp21PSfeCerQSM+7Q5DHj4EV1E17q64Npqx+q8I+bBpHOdMJuTJrRSBI
M6dvmAVSB/mgcdO6rvGK5dezWTzofa+4Koo3OxGmiAtnRfcGIIN1ojo/MboIRf/u
6dlThDkaIN4=
=0AlF
-----END PGP SIGNATURE-----





From hfinney at shell.portal.com  Fri Jun 14 20:11:54 1996
From: hfinney at shell.portal.com (Hal)
Date: Sat, 15 Jun 1996 11:11:54 +0800
Subject: doubleclick monitoring web browsing habits
Message-ID: <199606142126.OAA11951@jobe.shell.portal.com>


From: "Deranged Mutant" <WlkngOwl at unix.asb.com>
> Lynx running under Unix can find out who you are on the system by 
> checking your user id and the hostname.

When I run lynx (2.3.7 beta) to <URL:
http://www.anonymizer.com/cgi-bin/snoop.pl >, it says:

   Here's a sampling of the kind of information that a site can collect
   on you (please wait a moment):
 
 
     Your computer is a Unix box.
     Your Internet browser is Lynx.
     You are coming from jobe.shell.portal.com.
     You just visited the Anonymizer Home Page.

No user name here.

Also, when I follow a mailto: link it asks me to input the email address
I want the mail to be from!  So I don't think it is using local user name
information, although certainly that is potentially available to it.

Hal





From rah at shipwright.com  Fri Jun 14 20:12:11 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Sat, 15 Jun 1996 11:12:11 +0800
Subject: Party!
Message-ID: <v03006f15ade77cf202b4@[199.0.65.105]>


-----BEGIN PGP SIGNED MESSAGE-----


The upshot of the attached missive is quite simple, really.

RSVP to Julie Rackliffe, mailto://RACKLIFFE at tcm.org , before say, 2PM EDT on
Monday, and tell her you're coming. Stragglers aren't frowned on, but we
need to do a some capacity planning beforehand. Wanna make sure we print up
enough drink tickets, alert the kitchen and the police, and all that.

Get on your best bib and tucker (jackets and ties for men, "appropriate
business attire" for women).

Go to the Harvard Club, 1 Federal Street, Boston, on Thursday, June 20, 1996
from 5-8 pm.

Collect your two complementary drink tickets.

Thank the folks from OSF, who're sponsoring our first-ever DCSB networking
event.

Hit the table of complementary munchies for some necessary sustenance.

Head to the bar, cash in one (or both) of your drink tickets and...

.................schmooze.



Easy, you say?

Show us how easy.

Be there.


Aloha,
Bob Hettinga
Moderator,
The Digital Commerce Society of Boston

- - --- begin forwarded text


Date: 14 Jun 96 07:43:06 EDT
From: "Julie Rackliffe" <RACKLIFFE at tcm.org>
Subject: Party!
To: "dcsb" <dcsb at ai.mit.edu>
Sender: bounce-dcsb at ai.mit.edu
Precedence: bulk
Reply-To: "Julie Rackliffe" <RACKLIFFE at tcm.org>

Greetings, all and sundry!

I am delighted to announce that my internet connection is now back on line
and I
can receive the MANY MANY RSVPs for next Thursday's party that you've been
trying to get through and they've bounced back. SEND THEM ON!

It's going to be a great time and a perfect opportunity to talk to the
people
you rarely get to talk to, to introduce friends to the dynamic and exciting
world of DCSB and to nosh the best nosh, imbibe just the right amount and
enjoy
a beautiful kick off to a wonderful summer.

Do Come!

If you've tried to send me mail in the last two days, try again. If you sent
it
before that and got no error message, consider yourself golden. Thanks! I
need
responses TODAY!!! (Monday is the very latest and it's not good to toy with
this
volatile museum quality internet link. thanks :)  )

Julie

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
To unsubscribe from this list, send a letter to: Majordomo at ai.mit.edu
In the body of the message, write:  unsubscribe dcsb
Or, to subscribe,           write:  subscribe dcsb
If you have questions, write to me at Owner-DCSB at ai.mit.edu

- - --- end forwarded text

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcHQxvgyLN8bw6ZVAQG06QP/akD1VZumvzGMw552LeCk5YPPICsZt+EG
wyHa69h6t3L3ud9Cla5tiRXHEKapu4S19udVyPFL37k5zPJJFfTQ/p8HGVzJgOYm
Gu1hoJQNLdF244y5x2OuaFLE9RX1C2T0l7zqum+DLMNOqlZ/dHM1+ApKX+CQaAMi
vjryIo7AsHU=
=OlZI
-----END PGP SIGNATURE-----

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From jsled at cory.EECS.Berkeley.EDU  Fri Jun 14 20:13:30 1996
From: jsled at cory.EECS.Berkeley.EDU (Josh Sled)
Date: Sat, 15 Jun 1996 11:13:30 +0800
Subject: PBS show
Message-ID: <199606142023.NAA04410@pasteur.EECS.Berkeley.EDU>


On Thu, 13 Jun 96 23:23 EDT, Blake Wehlage wrote:

>Mac rule they have an awesome GUI (graphical user interface), easy of use it
>way up there and they have bitchin' software. 
>
>I know i will regret saying this but:
>
>The mac OS is 3 times better than Windows '95 

Though I agree with you, and I think OS/2's WorkPlace Shell and
Presentation Manager is about 10 times better than MacOS, this isn't
the place for GUI or OS holy wars...

ObCrypto: Incorporating crpyto into a GUI : strong crypto (RSA, 3DES)
represented as strong locking devices (safe, vault, etc), weak crypto
represented as weak devices (padlock, chain-link)... what do you think?

Joshy







From mixmaster at remail.ecafe.org  Fri Jun 14 20:19:18 1996
From: mixmaster at remail.ecafe.org (Ecafe Mixmaster Remailer)
Date: Sat, 15 Jun 1996 11:19:18 +0800
Subject: Hackerpunks and C2
Message-ID: <199606140215.CAA03053@avignon.hypereality.co.uk>


[ Although this post deals, for concreteness, with a specific mailing list,
I hope that cypherpunks will appreciate how the problem alluded to points
out a weakness in C2's current nym scheme, which is especially exploitable
in the context of general nym based mailing lists being run via similar
servers. ] 

The proposal for a Hackerpunks nym based mailing list is interesting,
however, there are some concerns regarding the susceptibility of the list
to traffic analysis.

The contents of the list will clearly not be secret since anyone can create
a C2 nym and then subscribe. For a given bag of messages, B, let L(B)
denote the bag of the lengths of the messages in B. (A length, x, appearing
n times in L(B) if and only if there are n messages of length x in B.) Let
B_x denote the bag of messages that subscriber x receives. If for any two
subscribers, a and b, L(B_a)=L(B_b), then someone cooperating with many
ISPs could easily guess who was and was not subscribed to the list by
seeing if a customer received a bag of messages, M, with L(M)=L(the bag of
messages actually posted to the list). A solution to this might seem to be
to append to each message posted to the list a pad varying randomly in
length between each subscriber who was to receive a copy.  However, if the
list ownership ever feel into evil hands, the lengths of the pads could be
chosen non-randomly, and thus provide very convincing evidence that someone
receiving messages of the non-randomly chosen lengths was the owner of the
given nym.

There is also a concern that the owner of Hackerpunks could be discovered
with a traffic analysis similar to the one used to determine list
subscribers. This time, let P be the bag of messages (with padding deleted)
posted to the list. If someone were to watch to see if some node on the
Internet received a bag, I, with L(I)=L(P), then that person could guess
that that node had a user who was the owner of the Hackerpunks mailing
list. As before it would, of course, not help the owner of Hackerpunks to
ask their subscribers to help weaken this attack by padding their messages
to random lengths, since a malicious enemy could then determine a
non-random sequence of messages lengths and send the corresponding message
to owner of Hackerpunks for posting. This would only increase the
likelihood that a node receiving those messages had a user who was the
owner of the Hackerpunks mailing list. 

The solution to the two dilemmas seems to be to ask that the C2 re-mailing
code be modified so as ensure that each messages is padded to a fixed size
before encrypting and being sent through the reply block. On the other
hand, this would give away information that anyone receiving messages of
this fixed length was likely the owner of some C2 nym.





From jimbell at pacifier.com  Fri Jun 14 20:22:00 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 15 Jun 1996 11:22:00 +0800
Subject: PBS show
Message-ID: <199606140030.RAA18846@mail.pacifier.com>


At 11:26 AM 6/13/96 +0000, Brad Shantz wrote:

>Since I live 10 blocks away from the main MS Campus, I hear 
>everything there is to hear about Bill Gates.  So, it was really 
>unnecessary for me to watch the hour and a hlaf devoted strictly to 
>who Bill stole what from.  **GRIN**

I only watched a few minutes of the show.  Did they mention that Microsoft 
actually bought the MSDOS operating system from Seattle Computer products?

Also, in about January of 1976, I attended a meeting at a hotel near Kansas 
City International airport, run by MITS (makers of Altair) showing off their 
computer.  (They drove a van around the country and demo'd the computer to 
throngs of...oh...hundreds of people.  

At the time, I had followed the budding microcomputer hobby only a little.  
I specifically recall being told at the show 
of complaints by a company called "Microsoft" that its "4K Basic" was being 
bootlegged.  (Note to the newbies:  The term "4K Basic" meant a Basic 
interpreter that fit in a main memory space of 0.004 megabytes.)   I soon 
learned that they were selling it for about $500, or about 12 cents per 
executable byte.

 
>> Those were exciting times. But, having worked at Intel during those heady
>> days, and being pretty active these days on the Net, I'd have to say the
>> Web, Net, Java, etc. are *just as exciting* (if not more so) than those
>> days. So, the best years are probably yet to come.
>
>Having started my "prefessional" Internet career at SPRY in 1993, I 
>agree that the best of the Internet is yet to come.  Bill Gates said 
>in the show last night that it is almost impossible to judge where 
>the market will be in a year because things are changing so fast.  
>Right now everything is a buzzword.  JAVA, etc...they are all infant 
>technologies that if marketed correctly could lead to the next 
>revolution.

Literally!


Jim Bell
jimbell at pacifier.com





From llurch at networking.stanford.edu  Fri Jun 14 20:26:28 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sat, 15 Jun 1996 11:26:28 +0800
Subject: SMARTcards, free 800 number GUARANTEE PRIVACY!!!
Message-ID: <Pine.GUL.3.93.960614111007.22241H-100000@Networking.Stanford.EDU>


The latest spam to hit my mailbox...

-rich

---------- Forwarded message ----------
Date: Fri, 14 Jun 1996 10:27:33 -0700
From: nta at pwrsite.com
Subject: The INTELECARD - FREE 800#

Check out the BUSINESS BUILDER PWRsite at:

http://www.pwrsite.com  -  Great business products and opportunities PLUS FREE Classified ads !!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Thanks for your Interest about the FREE 800# with the NTA Intelecard !!  

If you would like the Complete info pak mailed to you - Please Email me your Postal Address. Please Specify if you're also interested in becoming a Distributor for this Free 800 #.  Email your Address to:

kal at pwrsite.com             
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The complete info on the NTA Intelecard is also available on our Fax-on-demand at:

703-904-9888  box #  883

The Complete details about  becoming a  NTA Free 800# Intelecard Distributor(make BIG $$)  is available from our Fax-on-Demand at:

703-904-9888  box# 884

or Call Toll Free at:

800-935-5171  ext. 1171 (24 hr recorded message)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Here is the info on the NTA Intelecard and Order form.  You can also order on-line at:

http://www.pwrsite.com

or 

http://www.disneygroup.com   



                           An Open Letter to Business Owners
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

                     "Here's The Information You Requested About Your
                                    Free 800 Telephone Number"

Dear Friend:

In todays Competitive Business Environment an 800# is no longer a luxury.

It's an Absolute Necessity!

Unfortunately even modest volume 800# responses can tie up your office
phone and monopolize your staff's time at all the wrong moments. 

The alternative --- a remote 800# voice mail service --- is the ideal
solution. 

Except for one small detail: they cost at least $25.00 per month plus 18-22
cents per minute. That's $300.00 per year plus an outrageous charge per
minute for all usage!

Compare that to the BEST 800# Phone Deal in the country!

 * Set-up Fee                        	$0.00
 * Monthly Service Charge	$0.00
 * Term Commitment	None	
 * Annual Fee		None	
 * Cost Per Minute		.11/min  (Even lower, if you move fast - see                                                                               below)

This 800# service is yours absolutely FREE when you get your own
InteleCard(sm) --- the most advanced portable business
Telecommunications Center imaginable. 

It's a Virtual "Pocket Office" which puts you right in the thick of the most
Advanced Telecommunications Technology. 

Your incredible "Smart Card" will make the world believe you are sitting at
the helm of a giant multi-national conglomerate! 

This exceptional 800# service puts the control in your hands! 

You can either have the messages captured by your personal voice mailbox
or you can re-route the calls to ring directly into your office or home. 

The choice is yours! 

You can change your mind anytime, anywhere you want --- even have your
calls follow you as you travel!

The InteleCard(sm) does it all for you!

          * Sends, Stores and Retrieves Faxes!
          * Broadcasts Messages!
          * Call Forwarding --- Never miss an important call again!
          * Instant Conference Call Capability --- Up to 70 people worldwide!
          * Message/Pager Notification & Delivery!
          * Speed Dialing --- Program up to 99 numbers!    
          * And...Free 800# Service --- Your personal box accessed through
            your private PIN number!
          * Plus MORE !!

Plus..."The Best Pre-Paid Calling Card In The Business"

          * Only $.22 per minute U.S. (17.5 if you move fast!) 
          * Excellent, low International rates!

Simply put...

 "This Is The Best Telephone Deal You will Ever Get...Period!" 

But, it's not going to be here for long. 

The exceptionally Low Introductory, Promotional rates illustrated above are
only in effect through the 21st of June. After that, normal retail rates
apply. The 800# service goes up to .11 per minute and the calling card
charge increases to .22 per minute. 

But if you order your card before the deadline, your rates are grand-
fathered in for life! 

That means, no matter how high the rates may rise for other subscribers,
you have locked in your bargain basement prices for as long as you have
your card. 

There is a very limited supply of these deeply-discounted, promotional
cards available. Once they are gone, no more will ever be offered again.

                     "Your No-Risk, Unconditional Guarantee"

Inspect your InteleCard(sm) for 30 days entirely at our risk. Closely examine
every one of its exceptional features. Calculate the hundreds of dollars it
will save you year after year. Carefully weigh its unmatched convenience
and ease of use. Then, if for any reason you don't agree it is far and away
the best telecommunications deal you ever made, simply return the unused
card for an immediate refund. No questions asked. 

What could possibly be more fair?

                                      The InteleCard(sm)

                Are You Really Ready For All The Extra Business
                               These Services Will Get You?

                           "No other card even comes close!"

<$> Provides Complete Privacy...Protection for unlisted numbers or from ID
       scanning!

<$> Full Service Calling Card...Covers all 50 states and International calls
       at super-low rates!

<$> Gives You Total Fax Coverage Worldwide...It not only accepts and       
        stores faxes sent to you, it will transmit your faxes anywhere you                             want.  It even allows you to send a pre-stored fax to any of your                               prospects  -  just like the major companies do!

<$> Instant Call Forwarding...Use this service to forward all your calls ---
       even to your cellular phone!

<$> Why Settle for 3-Way Calling From Just Your Office Phone?...The
       InteleCard(sm) let's you conference up to 70 people into the same
       conversation from any phone --- without an operator. You save $50 or
       more in service charges! 

<$> Offers a Concierge Wake-Up Service...Calls you in the morning to get     
        you up in plenty of time for an important appointment!

<$> Reach Out to the World...Allows you to call anywhere in the world and
       also have exceptional call-back rates when you travel abroad. A must
       for the world of international business!

<$> Se Habla Espanol...This card offers instructions in Spanish and (soon) 
        a  lot more languages!

<$> Speed Dialing...Let's you pre-program up to 99 numbers for instant
       access!

<$> Giant Network Broadcasting Capabilities...You can instantly send a fax 
        or broadcast a telephone message to 999 people on the system for the
       price of 1 phone call!  

<$> More Persistent Than A Hound Dog on a Scent...Gets your important
       messages through even while you're running to catch a plane. If the
       line is busy, it will keep calling for up to 4 hours to deliver your
       message.

<$> Money-Saving Sequence Calling...Beat the hotel telephone surcharges.  
       Once you're connected to the toll-free 800#, you can get all your       
       messages and faxes and make as many local or long distance 
       (Including International) calls as you wish!

<$> Your Electronic Secretary...Reminds you of birthdays, anniversaries,
       important meetings, etc. --- up to 1 year into the future!

<$> No Monthly Service Charge...Forget the $25 (or higher) monthly fees
       charged by other services!

<$> No Monthly Minimums...You can use the card as much or as little as 
        you choose!

<$> No Annual Renewal Fee...Your one-time low purchase price covers you             Life

<$> No Surcharge...You only pay for the time you talk --- with absolutely no
       connection fee. This feature alone can save you up to 80 cents per
       call!

<$> Bills in 6-Second Increments...Doesn't gouge you with full minute
        charges like the competition!

<$> Unbeatable Rates...What other card allows someone to call your private
         800# from Hawaii, New York, Alaska, or anywhere else in the U.S. for
         only 11 cents a minute?

<$> Unbelievably Low Cost...This entire collection of high-tech services
       could easily cost you $25...$50...$75 or more a month! Instead, it's
       all yours for a one-time administration fee of only $49.95!

<$> Plus...A Valuable FREE Bonus!

A Full 800# Telephone Service that allows any of your customers or
prospects to listen to your pre-recorded announcements, leave messages,
place orders, or send faxes to you (even if you don't have an office fax
machine) all without tying up your office phone lines or taking the valuable
time of your staff!

Or, if you wish, you can instruct your personal 800# to ring directly to your
office or home. 

It can even follow you around the world! 

The InteleCard(sm) puts you in full command! You can instantly change the
calling format from any phone anytime you wish, as often as you like. There
is no other card or service like it! 

The InteleCard(sm) places an entire portfolio of Advanced
Telecommunications services ready to work for you. 

The Immediate benefits for your business are staggering! 

You'll wonder how you and every one of your key people ever got along
without it!

                    "The InteleCard(sm) is here now and we have it!"

                                     Contact Us at:
                    Telephone: 800-481-7625   Fax: 800-676-8672

Because of the restricted quantity available, each business is limited to
only seven cards.

I urge you to order several today and beat the June 21st deadline. 

Once this supply is exhausted, you will have to purchase the newer, more
expensive cards. 

Remember, there is never a monthly charge or annual renewal fee with the
InteleCard(sm). Many businesses control their costs and internal
communication systems by providing a card to each key employee (not to
mention members of their family!).  

Use the order form at the end of this message to request your
InteleCards(sm) today.

Sincerely,

Kal Schmidt/Barry Disney SKP-1
Network Marketing Group. Inc
Voice 800-481-7625
Fax  800-676-8672


P.S. These deeply discounted promotional rates will expire in just a few
more days. Every card you order before June 21, 1996 will be grand-fathered
in at these low rates forever! Decide how many cards you will need now.
This once-in-a-lifetime opportunity will never be offered by us again!

Here's How To Order Now!

                       "Your No-Risk Unconditional Guarantee"

Inspect your InteleCard(sm) for 30 days entirely at our risk. Closely examine
every one of its exceptional features. Calculate the hundreds of dollars it
will save you year after year. Carefully weigh its unmatched convenience
and ease of use. Then, if for any reason you don't agree it is far and away
the best telecommunications deal you ever made, simply return the unused
card for an immediate refund. No questions asked.  

What could possibly be more fair?

Your rates are even lower if you order before June 21, 1996. You only pay .10
per minute for Voice and Fax Mail and just 17.5 per minute for Calling Card
charges.

Date Ordered:________________
No. Cards Ordered:_____
Amount: $_________
Check No:________   Credit Card

KEEP THIS PORTION FOR YOUR RECORDS

---------- detach before mailing ---------- detach before mailing ----------

USE THIS FORM TO FAX - MAIL - OR PHONE IN YOUR ORDER

For Immediate Priority-Order Processing - Please Fax , Phone, or Email Your Orders.

We pay the shipping costs on all Phone/Fax/Email Orders in the next 24 hrs.

Instant Phone Orders To: 800-481-7625  (24 hrs order line)

Fax To:  800-676-8672 (24 hrs)
Email To: kal at pwrsite.com
On-line ordering at: http://www.pwrsite.com

Mail To: Network Marketing Group, Inc  204 N Oak Suite 213, Owatonna, MN 55060


Please send me _____ (Limit 7) InteleCards(sm) at only $49.95 each,
postpaid. If not satisfied, I reserve the right to return unused cards for a full
refund.

Special:   Order 3 InteleCards(sm) for only $139.50 (You Save $10.35!)
                  Order 4 InteleCards(sm) for only $178.00 (You Save $21.80!)
                  Order 5 InteleCards(sm) for only $217.50 (You Save $32.25!) 
                  Order 7 InteleCards(sm) for only $299.70 (You Save $49.95!)
                    --- It's like getting 1 Card FREE!)

Print Your Name________________________________________________

Telephone Number (______) _______ - ________________

Fax Number          (______) _______ - ________________

Business Name ________________________________________________

Address ______________________________________________________

City _____________________________________State____Zip___________

Enclosed is $_________ 

Circle One:  

Check / Money Order    Payable to: Network Marketing group, Inc

Phonechecks - FAX your check to:  800-676-8672

Credit Card:    Visa      MasterCard     

Credit Card No:________________________________ Exp. Date____/____

Signature________________________
(for email orders you may type your name here or type in CALL ME to have
us call you to privately record your credit card information)

For more information (check your interest) 

____ Please send me information on how I can get the best phone deal for   
my  business/home as well.

____ I may be interested in marketing these cards. Tell me more.

USE THIS FORM TO FAX - MAIL - OR PHONE IN YOUR ORDER


Fax To:  800-676-8672 (24 hrs)
Phone Orders To: 800-481-7625   (24 hrs order line)
Email To: kal at pwrsite.com
On-line Ordering at:  http://www.pwrsite.com

Mail To: Network Marketing Group, inc  204 N Oak Suite 213, Owatonna, MN 55060






From jimbell at pacifier.com  Fri Jun 14 20:27:20 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 15 Jun 1996 11:27:20 +0800
Subject: PBS show
Message-ID: <199606140448.VAA01980@mail.pacifier.com>


At 11:23 PM 6/13/96 EDT, Blake Wehlage wrote:
>At 09:35 AM 6/13/96 -0800, jim bell wrote:

>>But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset 
>>key, upper-case only, 40-character wide display, odd microprocessor, VERY 
>>SMALL capacity floppies (which were very slow as well), as well as a hostile 
>>legal situation regarding the building of clones.  Hell, they even objected 
>>to other companies building boards which plugged into the bus!
>
>
>I was not a toy it was what started the PC revolution

Grandly ignoring the Altair, the TRS-80 Model I, the IMSAI, et al.  Even Jolt!


Jim Bell
jimbell at pacifier.com





From jya at pipeline.com  Fri Jun 14 20:33:27 1996
From: jya at pipeline.com (John Young)
Date: Sat, 15 Jun 1996 11:33:27 +0800
Subject: T & A
Message-ID: <199606141315.NAA25793@pipe1.ny1.usa.pipeline.com>


>From 6-14-96 Financial Times editorial supporting the CDA decision and
challenge to authoritarian regimes using moral righteousness to suppress
free speech: 
 
 
"Freedom to titillate is a small price to pay for freedom to argue." 
 
 
A T&A motto for cypherpunks? 
 





From newslett at compcurr.com  Fri Jun 14 20:34:08 1996
From: newslett at compcurr.com (newslett at compcurr.com)
Date: Sat, 15 Jun 1996 11:34:08 +0800
Subject: Inside Currents
Message-ID: <2.2.32.19960613194159.006b5610@mail.compcurr.com>




Inside Currents
Vol 1, No. 4
June 13, 1996

CONTENTS:

*Computer Encyclopedia & Computer Accessories, now two of your favorite 
 destinations
*CCI Members Talent Bank
*CCI show schedule
*Used/refurbished equipment
*Take our ISP survey and win a 28.8 modem.  
*Tons of free software available on CCI
*Small business resources
*Chat and forums coming soon!
*We list resources for nine major metro areas
*We need more user group listings...and articles, too.

++++++++++++++++++++++++++++++++++++++++++++++++++++



Computer Encyclopedia & Computer Accessories are the fastest growing 
destinations on CCI.  If you haven't checked 'em out yet, see why others 
flock there. You can download a free WebPhone and browse the Computer 
Encyclopedia at 
http://www.currents.net/market/accessories/accessories.html 


Check out the Members' Gallery and follow the path to creating your own
space on the web -- free.  Also create an on-line Resume and be a part of
the CCI Members' Talent Bank.  Both pages are freely accessible by other 
CCI Members and the outside world alike (follow the instructions when creating
your page(s) to obtain your personal URL). 

 http://www.currents.net/general/member/pages/gallery.html
 http://www.currents.net/general/member/resume/talent.html


1996 show schedule for CCI.  Stop by our booth and let us know 
how we're doing:

 *Online Expo, Concourse Expo Center, San Francisco, July 11-13
 *Web.X at PC Expo, Javits Center, NY, June 18-20
 *Online Expo, NY Coliseum, Sept 5-7
 *Internet Expo, Hynes Convention Center, Boston, Oct 16-17
 *Online Expo, LA Convention Center, Oct 24-26
 *Comdex, Las Vegas, Nov 18-22
 *Internet World, Javits Center, Dec 11-13



Used or refurbished equipment could be the way to go, especially 
considering how fast the technology changes.  Look for a new 
used/refurbished equipment buying service here in a few weeks.



Ten people will be selected at random from those who complete the ISP 
survey to win the top-rated DeskPorte 28.8S external modem from Microcom. 
Plus, you'll get the warm fuzzies knowing you helped us inform others 
about who's performing up to snuff, and who isn't. 

http://www.currents.net/ispsurvey.html 



Our Download area is growing by leaps and bounds with tons of  Mac and PC 
shareware and freeware. Check it out at 

http://www.currents.net/resources/download.html 
 


Small business owners and start-ups should look at our Small Business 
Resources area for help in everything from funding to management recruitment.
Why reinvent the wheel when their is so much info at your disposal? Small 
Business Resources are at
 
http://www.currents.net/resources/smbus.html 


Stay tuned--chat and forums coming soon! 
We're planning on establishing forums based on, but not limited to,
Technical Support such as: 

    Internet Help
    Windows 95
    Windows NT
    Macintosh


You've read the cover story, now go to Regions to discover what's going on
in major metro regions around the country [such as]: Northern California, 
Southern California, Chicago, Dallas, Houston, Austin, Atlanta, Boston & 
New York at 

http://www.currents.net/magazine/regional/regional.html


Belong to a user group that's not listed in our User Group area?  Have 
your User Group SYSOP list your group with us online at 

http://www.currents.net/community/userg.html 



We're looking for more (free) professionally-written editorial in almost 
every category and application of personal and business computing that we 
can add to our web site.  If you're interested, contact: Mike McDonnell 
at mmc at compcurr.com



Feedback, feedback, feedback.  Please tell us how we're doing, and what 
you'd like to see on our site in the future. 

http://www.currents.net/general/feedbac.html 






From mpd at netcom.com  Fri Jun 14 20:36:53 1996
From: mpd at netcom.com (Mike Duvos)
Date: Sat, 15 Jun 1996 11:36:53 +0800
Subject: Level30 Newsletter (fwd)
In-Reply-To: <Pine.BSD.3.92.960614025524.25568B-100000@miso.wwa.com>
Message-ID: <199606142250.PAA11350@netcom13.netcom.com>


[Right wing pressure group censorship crap deleted]

Does this document strike anyone else as remarkably similar to the 
propaganda put out by another pressure group, the National Coalition
Against Pornography, which was heavily funded by the millions
Charles Keating stole from his investors?

Have the bozos regrouped, changed their name, and gone online?

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     mpd at netcom.com     $    via Finger.                      $






From jwilk at iglou.com  Fri Jun 14 20:40:32 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 11:40:32 +0800
Subject: PBS show
Message-ID: <m0uUQvq-000357C@mail.iglou.com>


At 09:47 PM 6/13/96 -0800, jim bell wrote:
>At 11:23 PM 6/13/96 EDT, Blake Wehlage wrote:
>>At 09:35 AM 6/13/96 -0800, jim bell wrote:
>
>>>But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset 
>>>key, upper-case only, 40-character wide display, odd microprocessor, VERY 
>>>SMALL capacity floppies (which were very slow as well), as well as a hostile 
>>>legal situation regarding the building of clones.  Hell, they even objected 
>>>to other companies building boards which plugged into the bus!
>>
>>
>>I was not a toy it was what started the PC revolution
>
>Grandly ignoring the Altair, the TRS-80 Model I, the IMSAI, et al.  Even Jolt!
>
>
>Jim Bell
>jimbell at pacifier.com
>
>
It was the first BIG product, sorry my bad. 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From rah at shipwright.com  Fri Jun 14 20:42:51 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Sat, 15 Jun 1996 11:42:51 +0800
Subject: CALL FOR PAPERS
Message-ID: <v03006f03ade712676db2@[199.0.65.105]>



--- begin forwarded text


Date: Thu, 13 Jun 1996 17:39:13 -0700
From: Taher Elgamal <elgamal at netscape.com>
Mime-Version: 1.0
To: ipsec at TIS.COM, ietf-pkix at tandem.com
Subject: CALL FOR PAPERS
Sender: ipsec-approval at neptune.tis.com
Precedence: bulk

CALL FOR PAPERS


Multimedia Data Security

Part of IS&T/SPIE's 1997 Symposium on
Electronic Imaging: Science & Technology
8-14 February 1997
San Jose Convention Center
San Jose, California   USA

Conference Chair: Taher Elgamal, Netscape Communications

The growth of the use of public networks as the platform for multimedia
applications in the past year has made it important to devise mechanisms for
ensuring proper use of intellectual property, and increased the importance
of employing security mechanisms for video and audio data. This conference
will serve as a forum for the exchange of ideas in the areas of security
systems and mechanisms especially in applications that handle large data
volumes.

Papers are solicited in all areas of security systems and algorithms
including but not limited to:

* security systems for imaging applications
* security systems for real-time video applications
* performance studies and comparisons for securing image data
* watermarking and detection of fraudulent copying of intellectual property
* metering schemes for intellectual property usage
* audio and video encryption mechanisms
* key management and security protocols for broadcast applications
* payment systems for online multimedia applications
* content protection mechanisms for online multimedia distribution.

This conference is just one of nearly 30 conferences to be held at the EI'97
symposium. And EI'97 is one of 4 collocated symposia (Electronic Imaging,
Biomedical Optics, Lasers and Applications, and Optoelectronics).

Watch SPIE's web site for the entire Photonics West Call for Papers (late
May-early June):
http://www.spie.org/web/meetings/meetings_home.html

For a printed call for papers or other information:
E-mail: pw97 at spie.org
Fax: 360/647-1445
Phone: 360/676-3290

DEADLINES
Paper Abstracts (for review) Due from Authors:
     15 July 1996

Camera-Ready Abstracts (from accepted authors) Due:
        18 November 1996

Manuscripts Due from all Authors:
     13 January 1997

GUIDELINES FOR SUBMITTING AN ABSTRACT

Send a 500 word abstract of your paper, by 15 July, in ONE of
the following ways:

>>electronic mail in ASCII format (NOT encoded) to abstracts at spie.org
>>The SUBJECT line must include: EI97 (Elgamal)
         (Send one submission per email message.)
Note: There will also be available an interactive abstract submission form
on the web site.

>>mail (please mail 4 hard copies) to:     IS&T/SPIE Electronic Imaging '97
     SPIE, P.O. Box 10, Bellingham, WA  98227-0010
     Shipping Address: 1000 20th Street, Bellingham, WA  98225
     Telephone: 360/676-3290

>>fax to SPIE at 360/647-1445     (Please send one submission per fax.)

Be sure each abstract includes the following:

1. CONFERENCE CHAIR and CONFERENCE TITLE (submit to ONLY ONE conference)
     to which the abstract is submitted

2. AUTHOR LISTING (List principal author first)
     for each author: full name [first(given) last(family] and affiliation,
     mailing address, phone/fax numbers, email

3. ABSTRACT/PAPER TITLE

4. ABSTRACT TEXT: 500 words typed on white paper

5. KEYWORDS: maximum of 5 keywords

6. BRIEF BIOGRAPHY of the principal author: 50-100 words
--
Taher Elgamal	    elgamal at netscape.com
Chief Scientist, Netscape Communications
(T) 415 937 2898, (F) 415 428 4054

--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From perry at alpha.jpunix.com  Fri Jun 14 20:46:15 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Sat, 15 Jun 1996 11:46:15 +0800
Subject: Remailer Operator Liability?
Message-ID: <Pine.NEB.3.93.960614082823.392A-100000@alpha.jpunix.com>


	Now that the CDA decision has been made, I was wondering how this
would affect the liability status of the various remailer operators? In
the past several remailers have opted to discontinue service due to
legal/political pressure. Will this CDA decision help to decrease remailer
operator liability?

 John Perry - perry at alpha.jpunix.com -  PGP-encrypted e-mail welcome!
 WWW - http://www.jpunix.com
 PGP 2.62 key for perry at jpunix.com is on the keyservers.






From anonymous-remailer at shell.portal.com  Fri Jun 14 20:47:40 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sat, 15 Jun 1996 11:47:40 +0800
Subject: [noise] (was Re: PBS show)
Message-ID: <199606141238.FAA07609@jobe.shell.portal.com>


at Thu, 13 Jun 1996 11:30:44 -0800 jim bell <jimbell at pacifier.com> may have written...

>Brain-dead segmented architecture, 64k per segment limitation
code segments, ever hear of code segments?  Data segments maybe?  Ever
actually do any 8086 assembler?  You would have liked them.  In fact,
even the MAC's O/S had them built in as I recall, just not a hardware
limitation with the 68000.  A good programmer was not limited by these.

>1-megabyte memory limitation.  The only thing that made it 
OK, I concede here... But if you actually write code instead
of pasting code together, 1MB is plenty of RAM with this
processor.  What was brain dead was the fact that IBM in it's
infinite wisdom "stole" near half of that for it's poor hardware
designs (640k-1MB range).

flames > /dev/nul
---
Joseph L. (Joe) Moll, Greenville, SC  USA  mailto:oolid at acqic.org
---






From sclawson at bottles.cs.utah.edu  Fri Jun 14 21:01:48 1996
From: sclawson at bottles.cs.utah.edu (steve clawson)
Date: Sat, 15 Jun 1996 12:01:48 +0800
Subject: PBS show
In-Reply-To: <IlkDlaO00YUy1ODDgK@andrew.cmu.edu>
Message-ID: <199606141734.LAA11581@bottles.cs.utah.edu>


Declan B. McCullagh uttered:
> I remember the Commodore 64
> drives (1541?) that were just plain slothful.

     Anyone else remember a program called TurboTape that Compute!
magazine published?  It actually made loading from tape faster than
from a 1541!  One of the cool things about the drive was that it used
GCR recording and had a variable number of sectors per track
(increasing as you went from the middle to the edge of the disk), so
it was able to fit around 180k per side!

     Commodore had some good drives on their PET's, but good old Jack
got burned by the fact that there was only one supplier of the cables
for the interface (IEEE-488, or [GH]PIB) and swore that they'd develop
their own. =) So for the VIC-20 they came up with a serial interface,
but because of problems with the chip they were using (6522 VIA) they
could only recieve a _bit_ at a time. =) On the C-64 they replaced
this chip with one that didn't have the problem (and thus could have
waited until it grabbed 8 bits from the serial line before bothering
the processor), but that would have meant they would have had to
redesign the drive...  Unfortunately, the increased demands of the
video hardware in the C-64 meant that they couldn't keep up with the
drive anymore!  So, in a stroke of genius, they slowed down the
transfer rate. =(

     The Atari 8-bits also used a serial bus for perhipherals, but at
least it ran at a (only somewhat moderately) respectable 9600bps. =)
Unfortunately their drives used the clunky 4:4 encoding for data, so
only held 90k per side.


steve

-- 
// stephen clawson				sclawson at cs.utah.edu
// university of utah			        






From jya at pipeline.com  Fri Jun 14 21:12:26 1996
From: jya at pipeline.com (John Young)
Date: Sat, 15 Jun 1996 12:12:26 +0800
Subject: Cash Is Dying
Message-ID: <199606141129.LAA29891@pipe3.ny2.usa.pipeline.com>


   6-14-96: NYT ad for The New York Times Magazine: 
 
 
   Cash is dirty. 
 
   Cash is heavy. 
 
   Cash is quaint. 
 
   Cash is expensive. 
 
   CASH IS DYING. 
 
   "You believe in banks don't you? That's good, because 
   ultimately money is backed by nothing but your own 
   confidence, habit and faith -- a form of faith as powerful 
   and essential to modern life as any religious belief. The 
   coming digital era will make this plain to everyone, as 
   never before." 
 
   (Continued on Sunday) 
 
   From "Dead as a Dollar" by James Gleick ...the cover 
   article in this week's issue. 
 
--------- 
 
   Yes, the James Gleick whose co-founded Pipeline is near 
   dead as a dollar. Hope his multi-million-dollar PSI-buyout 
   lives. 
 





From jwilk at iglou.com  Fri Jun 14 21:19:25 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 12:19:25 +0800
Subject: PBS show
Message-ID: <m0uUh4J-00035iC@mail.iglou.com>


At 12:51 PM 6/14/96, Josh Sled wrote:
>On Thu, 13 Jun 96 23:23 EDT, Blake Wehlage wrote:
>
>>Mac rule they have an awesome GUI (graphical user interface), easy of use it
>>way up there and they have bitchin' software. 
>>
>>I know i will regret saying this but:
>>
>>The mac OS is 3 times better than Windows '95 
>
>Though I agree with you, and I think OS/2's WorkPlace Shell and
>Presentation Manager is about 10 times better than MacOS, this isn't
>the place for GUI or OS holy wars...
>
>ObCrypto: Incorporating crpyto into a GUI : strong crypto (RSA, 3DES)
>represented as strong locking devices (safe, vault, etc), weak crypto
>represented as weak devices (padlock, chain-link)... what do you think?
>
>Joshy
>
>
>
>
Oh my God someone agrees with me I see the light at the end of the tunnel,
in this window covered world. 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From scott.harney at bigeasy.com  Fri Jun 14 21:35:54 1996
From: scott.harney at bigeasy.com (Omegaman)
Date: Sat, 15 Jun 1996 12:35:54 +0800
Subject: Zimmerman/Viacrypt
Message-ID: <199606141429.IAA01962@betty.bigeasy.com>


-----BEGIN PGP SIGNED MESSAGE-----

> From: Steve Reid <root at edmweb.com>
> 
> > Phil disagrees with ViaCrypts new "business" version of PGP which
> > apparently encrypts all messages with an employer-supplied public key
> > in addition to any specified by the employee.
> 
> Looking at Denning's critique (pro-escrow rant) of the NCR crypto report, 
> she mentioned that mutant version:
> 
> [http://www.cosc.georgetown.edu/~denning/crypto/NRC.txt]
>   "Other corporations are similarly adopting products with data recovery 
>   capabilities as they integrate encryption into their systems (even PGP 
>   comes with data recovery in Viacrypt's Business Edition)."
> 
> IMHO Phil Zimmerman has good reason to object to the mutant version, if
> it's going to cause the PGP name to somehow endorse escrow. 

I don't have a problem with companies escrowing keys or using a 
function like that described for Viacrypt's for official company 
business.  

Employees should be made fully aware, however, that their 
communications are being copied to a company archive.  There should 
be no illusion about the privacy of company communications using 
company-owned software.

For private communications, they should still use a personal copy of 
PGP or other encryption software of their choice.

$.02

me 

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcFkO6b3EfJTqNC9AQFO5QP+N80T9b9qezlnf15hNsc9lIJoMihNVo/1
8d7bK8Hv4HSAc0FicP9JRSU7jKhm4nTDR0XUnmMeEFLEvq6ari1GdYr9K/HFcIWW
AtgC9MGGMqAoCIrMt1oOm9WosrfQcNQfij5ENC8lZlWW01y9YXhXpP9CzcsZmNlz
3rjA7c70MuQ=
=JUw7
-----END PGP SIGNATURE-----
------------------------------------------------------------
 Omegaman <omega at bigeasy.com>
 PGP Key fingerprint =  6D 31 C3 00 77 8C D1 C2  
                             59 0A 01 E3 AF 81 94 63 
------------------------------------------------------------





From jwilk at iglou.com  Fri Jun 14 22:03:52 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 13:03:52 +0800
Subject: PBS show
Message-ID: <m0uUh4G-00035gC@mail.iglou.com>


At 03:24 PM 6/14/96 -0500, David E. Smith wrote:
>>I know i will regret saying this but:
>>
>>The mac OS is 3 times better than Windows '95 
>>
>
>Gee, what's three times zero?
>
>dave
>
>
>
>
48? you can thank the public education system for that answer. 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From Ryan.Russell at sybase.com  Fri Jun 14 22:13:32 1996
From: Ryan.Russell at sybase.com (Ryan Russell/SYBASE)
Date: Sat, 15 Jun 1996 13:13:32 +0800
Subject: PBS show
Message-ID: <9606150041.AA11251@notesgw2.sybase.com>



143K.  Per side.

   Ryan

---------- Previous Message ----------

The original Apple II floppy held ONLY 90 kilobytes on a 5" floppy.  How did 
they do such a bad job?










From llurch at networking.stanford.edu  Fri Jun 14 22:13:33 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sat, 15 Jun 1996 13:13:33 +0800
Subject: SF Bay Area: 6/18 Smart Talk on WhoWhere? (fwd)
Message-ID: <Pine.GUL.3.93.960613184346.16782G-100000@Networking.Stanford.EDU>


FYI. Sounds like a venture capital shindig.

Pity I won't be able to make it. That would have been Highly Amusing.

-rich

---------- Forwarded message ----------
Date: 13 Jun 1996 16:03:52 -0400
From: Leslie Kareckas <lesliek at svi.org>
Newsgroups: ba.smartvalley, ba.announce
Subject: 6/18 Smart Talk on WhoWhere?


    *****************************************************************
                                    
                        PLEASE NOTE NEW LOCATION
                                    
    *****************************************************************
                                    
                               SMART TALK
                                    
                     Sponsored by Smart Valley, Inc.
                    and Gemini Management Consulting


SPEAKER:  Gunjan Sinha
          President, WhoWhere?

TITLE:    WhoWhere?: The Global White Pages of the Internet

DATE:     Tuesday, June 18, 1996

TIME:     7:30 AM - 9:00 AM

LOCATION: Smart Valley, Inc.
          2520 Mission College Blvd.
          Santa Clara

CONTACT:  Isabel Sarkis - IsabelS at svi.org or 408-562-7794

ABSTRACT
WhoWhere? is the largest directory of personal and corporate
phone numbers, physical addresses and e-mail addresses on the
Internet.  As the Net rapidly evolves, defines and redefines
itself, WhoWhere? provides a worldwide collection of fundamental
information which serves both individual and business
communication needs.  It has become the Global White Pages and
enables people to locate others around the world, whether they
are on or off the Net. Gunjan Sinha will share the challenges
associated with building and maintaining this type of directory
and the ways in which it can be utilized.

BIO
Prior to forming WhoWhere? Inc., Gunjan Sinha was the architect
of video servers at Olivetti Advanced Technology, where he
developed interactive video servers. He was also involved with
multiprocessor and distributed server development. Earlier is his
career, Sinha was the co-founder of Viman Software Inc., a
network license management company, which was later acquired by
Central Designs Systems Inc. Sinha holds a Masters in Engineering
Management from Stanford University, and a Masters in Computer
Engineering from the University of California at Santa Cruz.

DIRECTIONS:
Take the Great America Parkway exit North from 101.  Turn right
at the first traffic light (Mission College Boulevard) and go
straight approximately three blocks.  Turn right into the second
UB Networks driveway.  Smart Valley is on the left at 2520
Mission College Blvd. There is ample parking throughout the
campus.

**************************************************************
All are welcome to attend this Smart Talk.  Admission is free to
individual members and all employees of Smart Valley member
companies. Non-members are charged a $5.00 fee. Continental
breakfast is included. Reservations are required as seating is
limited.  RSVP to Isabel Sarkis at IsabelS at svi.org or 408-562-
7794.

Smart Talk announcements can also be found on the Web
(http://www.svi.org).






From steve at miranova.com  Fri Jun 14 22:15:26 1996
From: steve at miranova.com (Steven L Baur)
Date: Sat, 15 Jun 1996 13:15:26 +0800
Subject: doubleclick monitoring web browsing habits
In-Reply-To: <199606141818.OAA27290@unix.asb.com>
Message-ID: <m2lohpykl2.fsf@deanna.miranova.com>


>>>>> "Deranged" == Deranged Mutant <WlkngOwl at unix.asb.com> writes:

Deranged> On 13 Jun 96 at 16:19, Hal wrote:

>> refrained from telling my Netscape browser my name and email
>> address out of fear that it would reveal this information; as a
>> result, I can't use mailto: links, which is annoying (and also
>> suspicious; lynx allows me to do mailto: without permanently
>> entering an email address).

Deranged> Lynx running under Unix can find out who you are on the
Deranged> system by checking your user id and the hostname.

So what?  So can any program you run, and so can Lynx running under
VMS.  The Good Thing about Lynx is that it refuses to put any personal
information in mail sent via mailto: unless you explicitly tell it to
do so.  I like this feature.

-- 
steve at miranova.com baur
Unsolicited commercial e-mail will be proofread for $250/hour.
Andrea Seastrand: For your vote on the Telecom bill, I will vote for anyone
except you in November.





From printing at explicit.com  Fri Jun 14 22:26:53 1996
From: printing at explicit.com (William Knowles)
Date: Sat, 15 Jun 1996 13:26:53 +0800
Subject: Mission Anonymous / U.S. News & World Report
Message-ID: <m0uUU6j-000rQEC@maki.wwa.com>


June 17, 1996 U.S. News & World Report 
Newswatch,  Page 76

Mission Anonymous

Very good write up on Community ConneXion's Anonymizer,
and on new features offered at the Center for Democracy and 
Technology.  

William Knowles
Graphically Explicit

//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\ 
  Graphically Explicit                     
  Printing - Advertising - Interactive  
  1555 Sherman Avenue - Suite 203          
  Evanston IL., 60201-4421                 
  800.570.0471 - printing at explicit.com
  Accept, Embrace, Adapt, Create     
\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//






From vznuri at netcom.com  Fri Jun 14 22:31:33 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Sat, 15 Jun 1996 13:31:33 +0800
Subject: marketing "privacy": a nonproblem?
Message-ID: <199606142032.NAA28132@netcom4.netcom.com>



HF wrote a recent message about the "doubleclick" advertising
service. I don't know much about it but some things he mentioned
sparked my neurons. 

regarding privacy, it seems that there are a lot of different
views and specious arguments. we don't really have a clear idea
in our culture what privacy is or when it is really being 
invaded. is it being invaded when marketers create databases
of users and their preferences? this is a frequent topic of
conversation here. if we are on the side that says "yes", it
seems there is such an enormous industry pushing very hard
from the other side that a so-called "pro-privacy" position is
untenable. are marketers creating the equivalent of what TCM
calls "dossiers"?

I just had a brainstorm that perhaps the problem of marketing
clashing with privacy is completely nonexistent. what marketers
really want is to TARGET PEOPLE'S ATTENTION. they don't necessarily
want to know who those people are!! a rather paradoxical situation,
but the two are NOT the same. 

imagine that a marketer selling Widgets could send a direct mailing to 
people who have an interest in Widgets. now, currently what has
to happen is that marketers have to collect info on various people
and their interests, and then sort that for "widget interest" to
get their mailing list. but the overall database is in a sense
a dossier.

but what we should note is that the marketer DOESN'T CARE at all
about the real identity of the people he is mailing to. in fact
it is totally superfluous. he only wants to send his literature
to people who are interested in widgets, and he doesn't care who
they are or their other interests. in fact, marketers keep track
of "other interests" only insofar as they can be used to correlate
with what they are actually trying to screen for.

so what I am getting at is that I think "dossiers" tend to associate
a lot of information about a real person, in a way that people
can get info on that person given their name or whatever. the point
is that marketers don't really care who is who, and don't really
want to necessarily have a database that gives the real identity
of people. they only need a way of delivering their literature
to people with particular interests.

let me give an example to clarify this. suppose a database existed
somewhere that contained a total profile of me and all my interests.
but I am not called "V.Z.Nuri" in the database, but #3343. furthermore,
there is an "address" in that database, and it can be used to reach
me, but it is unique to that database and can't be found in any other,
and furthermore, no one can correlate that address with my real 
identity.

voila-- the marketer doesn't really want anything more than this. 
yet in a sense my privacy is completely protected. suppose that
police agent tries to query the database to get info on me. if it
really is secure, all he has is info that can never be tied to 
me. such a system creates a very important use for anonymous remailers.
of course digital cash plays a big role in this too.

in the same vein, it is possible for me to "buy" something from a 
company without them knowing that it was in result to them
sending information to so-and-so identity #3343. actually, it could
be set up that I tell them, "I am responding to your direct mail
ad campaign #1634" so they can gauge the efficacy of their advertising,
but they don't know who of their database was involved. 

when I think of "dossiers" I think of info that can be tied to
REAL PEOPLE. but it is quite possible to create an "interest 
distribution system" that would keep marketers happy but still
not be able to be tied to people's real identities. when one thinks
of the horrors of classic privacy abuse, one thinks of the way
the Nazi's grabbed (Dutch?) records to find jews, or the way the
NSA kept files on people and responded to Nixon queries for
radicals. but it seems to me it would be possible to create a system
in which people's interests are tracked, yet their real identities
are dissociated from that information. furthermore, you can dissociate
the mechanism to do so-- anonymous remailers have no connection to
companies that deliver info through them.

notice that much of the above can be achieved in cyberspace with
the use of a pseudonym. if you are signed up through a provider
that protects your identity (most of them do), then you can do
whatever you want in cyberspace and theoretically nothing can
be tied to your new identity. furthermore, if you think you have
accumulated too much "baggage" associated with your current identity,
you can always start afresh.

===

this will sound quite heretic, but I think marketing is actually a
very legitimate business and that cpunks might actually achieve some
of their goals by considering how to create a better marketing system.
in essence, marketing is the attempt to match up people with information
and products that interest them. in a way, this is a very similar
problem to trying to match up people to mailing lists and newsgroups
and articles/files that interest them. spamming is the cyberspatial
equivalent of a problem that existed before cyberspace: junk mail,
so to speak. 

is there an efficient system whereby suppliers and consumers 
can be matched up, but at the same time preserving privacy? 
it seems to me a key question of information technology, perhaps
a "killer app" in this area is just now waiting to be born.
that's all that marketers want, and in fact instead
of seeing them as agents of satan, we should just see them as trying
to fulfill customer desires with their own products-- the essence
of capitalism. the fact that marketers in our culture are so aggressive
speaks of how effective capitalism is.

people see junk mail as "junk", but notice that the junk is in
the eye of the beholder. what if you got on a direct mailing list
that sent you info on products you were considering buying anyway?
in a sense, "junk mail" is mail that we don't care about, not 
merely mail from marketers. we get mail from marketers all the
time that we appreciate!! if someone can create a more foolproof
system that preserves privacy at the same time, all worlds are
satisfied. you have the marketer happy, the consumer happy, and
the privacy protection too.

as long as one tries to defy marketers basic drive of trying to
target people with particular interests, I think this is fighting
the wind or trying to stop the river. but if one could find 
a way of supporting their basic motivation, the scenario becomes 
totally transformed.  building a marketing mechanism that preserves
privacy may do far more for privacy protection in the future
than a zillion remailers. I think the key is to analyze why people
*want* to do things that seem to violate privacy (such as marketers),
and then finding new ways of doing the same thing while preserving privacy,
rather than trying to defy their basic drives (such as collecting
information on potential customers etc.).

===

imagine a massive cyberspace system that was actually a database
of everyone who wanted to register, containing their interests.
it would be an accepted practice that all marketers could use
this system. people would register if the system was actually
effective in only sending them info that they really wanted to
see. it would be like an index into the population the
way Yahoo is currently an index into cyberspace. one could create
guidelines and measures by which spamming could be minimized.
the database might be able to minimize the effect of bad marketers
and indiscriminate mailings etc.  it seems like a very interesting
problem worthy of attention.  the returns for someone who could
pull off such a thing would be tremendous. 

I continue to believe that many problems that people are 
insoluable or in eternal conflict, such as marketers 
and privacy, could be harmonized with some sharp ingenuity.







From jimbell at pacifier.com  Fri Jun 14 22:43:54 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 15 Jun 1996 13:43:54 +0800
Subject: PBS show
Message-ID: <199606140754.AAA09591@mail.pacifier.com>


At 03:55 AM 6/14/96 +0000, jonathon wrote:

>> And by refusing to build Masatoshi (?) Shima's design for the Z-80, they 
>
>	The number one selling computer with a Z-80 chip inside was
>	also the number one computer platform which ran CP/M which was
>	The Apple 2e.
>	
>	<< Yes, the Z-870 chip was a third party add on. >>	


Two things:

1.  Eventually, that claim might have been true.  But that's just because 
there were a large number of smaller-volume CP/M computers  such as Altair, 
IMSAI, CROMEMCO, Northstar, Kaypro, Godbout, Morrow, Heath/Zenith,  and 
numerous others, as well as TRS-80' (Models I, II, and II; most of which ran 
TRSDOS instead of CPM) which cumulatively added up to a number vastly larger 
than Apple-II/Z-80 installations.  And I don't want to leave out the "Big 
Board" Z-80 computer, which put everything on a single large PCB, which was 
about a 1980 product.  Or, for that matter, Sinclair's ZX-80 (?)

2.    If anything, the popularity of the Z-80 processor for the Apple 
revealed just how bad the 6502 and associated Apple software was.  People 
don't generally change (add-in) microprocessors if they're satisfied with 
the underlying computer and available software.  In fact, it's even worse, 
because the one advantage of the Apple was its color display, while none of 
the CP/M software being run on the Z-80 card in the Apple knew about color.



Jim Bell
jimbell at pacifier.com





From schryver at radiks.net  Fri Jun 14 23:51:41 1996
From: schryver at radiks.net (Scott Schryvers)
Date: Sat, 15 Jun 1996 14:51:41 +0800
Subject: Is the list down?
Message-ID: <199606150021.TAA28779@sr.radiks.net>


PGP encrypted mail preferred.  
E-Mail me for my key.
Scott J. Schryvers <schryver at radiks.net>






From printing at explicit.com  Sat Jun 15 00:01:20 1996
From: printing at explicit.com (William Knowles)
Date: Sat, 15 Jun 1996 15:01:20 +0800
Subject: Level30 Newsletter (fwd)
Message-ID: <Pine.BSD.3.92.960614025524.25568B-100000@miso.wwa.com>



---------- Forwarded message ----------

Recently, you requested from our email autoresponder a copy of
The Agincourt Project.  You were not alone.  That document has
made its way around the world.  Law enforcement agencies, public
officials, prosecutors, ISP's and concerned citizens have all been
reading it.

And it has made a difference.  Illegal obscenity and child pornography
IS being removed from the Internet.

And now that the first round of the CDA legal battle is over, and
the focus in the battle against Internet pornography will change
back to the enforcement of local obscenity and child pornography laws.

But the issues are complex, and a single document is just not enough
to keep the public informed.  And so we have started Level30.

Since you had an interest in The Agincourt Project (whatever your
position on it), we thought you'd be interested in Level30.

To receive this biweekly (or more frequently) newsletter, simply send
an e-mail message

     To:  majordomo at databack.com
     Subject:  (leave blank)
     Message:  subscribe level30

About the Purpose - To instruct families on how to safely use the
Internet, and to inform families, law enforcement, the media and
other interested Internet organizations about breaking news in the
fight to keep illegal pornography and child pornography OFF the Internet.

About the Title - This is the Offense Level mandated by the United States
Sentencing Commission for the trafficking of child pornography often
found on the Internet in Usenet newsgroups.  (Base offense level - 17;
if the material involves a prepubescent minor, increase by 2 levels; if
the offense involves distribution, increase by at least 5 levels; if the
offense involves material that portrays sadistic or masochistic conduct
or other depictions of violence, increase by 4 levels; and if a computer
was used to transport or ship the visual depiction, increase by 2 levels.)
(The Sentencing Table can be found at http://www.ussc.gov.)

About the Author -  Paul D. Cardin, P.A

     Member of the Board of Directors of Oklahomans for Children And
         Families (OCAF)
     Author of The Agincourt Project - the electronic expose that explains
         how Internet Service Providers (ISPs) are responsible for the
         distribution of illegal pornography and child pornography
         throughout America.
     Architect of the most effective and successful campaign in the United
         States today to stop the electronic distribution of illegal
         pornography and child pornography.
     Former officer in the Oklahoma Civil Liberties Union

About the Regular Features -

     America's Most Wanted - A list of public corporations that are the
          enemies of America's children and families because of their
          continued electronic distribution of illegal pornography and
          child pornography.
     (Your State Here)'s Most Wanted - A state by state list of ISPs that
          are the enemies of children and families because of their
          continued electronic distribution of illegal pornography and
          child pornography.
     Commentary - Incisive and hard hitting analysis of the legal and
          constitutional issues facing the Internet today.
     Battle Reports - Updates from the front lines, from "war
          correspondents" across the country-
            The court battles over the Communications Decency Amendment.
            The status of OCAF against the Oklahoma ISPs.
            The status of Loving v. Boren - is it a ridiculous waste of
               taxpayers money or will it be the definitive Internet
               court ruling?
          The status of other important electronic obscenity court cases.
          The status of battles yet to be engaged.
     Special Reports -
          Testimonies from the victims of pornography.
          Profiles of the men and women  who are engaged in the battle to
               free our society from its plague.
          Interviews with law enforcement officers, prosecutors, and ISPs.

You should subscribe to Level 30 if:

     You are an INTERNET SERVICE PROVIDER who wants to stop violating
          federal and state obscenity and child pornography laws.
     You are a LAW ENFORCEMENT OFFICER or PROSECUTOR who wants to learn
          how to stop ISPs from violating federal and state obscenity
          and child pornography laws
     You are a PUBLIC OFFICIAL who wants to learn how to keep illegal
          pornography and child pornography off of publicly owned and
          operated computer systems.
     You are a UNIVERSITY OFFICIAL or LIBRARY OFFICIAL who wants to learn
          how to keep illegal pornography and child pornography off of
          your university or library computer system.
     You are a SCHOOL OFFICIAL or TEACHER who wants to learn how to keep
          illegal pornography and child pornography off of your school's
          computer system.
     You belong to a CHILD ADVOCACY or WOMEN's RIGHTS group and you want
          to learn how to fight illegal pornography and child pornography
          on the Internet.
     You belong to a CHURCH or RELIGIOUS GROUP and you want to learn how
          to fight illegal pornography and child pornography on the
          Internet.
     You are a CORPORATE EXECUTIVE or PR OFFICER who wants to learn how
          to avoid extremely damaging publicity for your company.
     You are a REPORTER who wants to stay one step ahead of the above.

     Or, finally.......

     You are a PARENT or GRANDPARENT who wants to learn more about how to
          keep the Internet safe for your children and/or grandchildren.

 Thank you for your time.


--






From sameer at c2.org  Sat Jun 15 00:23:27 1996
From: sameer at c2.org (sameer)
Date: Sat, 15 Jun 1996 15:23:27 +0800
Subject: Mission Anonymous / U.S. News & World Report
In-Reply-To: <m0uUU6j-000rQEC@maki.wwa.com>
Message-ID: <199606150227.TAA00580@infinity.c2.org>


	Thank you.

> 
> June 17, 1996 U.S. News & World Report 
> Newswatch,  Page 76
> 
> Mission Anonymous
> 
> Very good write up on Community ConneXion's Anonymizer,
> and on new features offered at the Center for Democracy and 
> Technology.  
> 
> William Knowles
> Graphically Explicit
> 
> //!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\ 
>   Graphically Explicit                     
>   Printing - Advertising - Interactive  
>   1555 Sherman Avenue - Suite 203          
>   Evanston IL., 60201-4421                 
>   800.570.0471 - printing at explicit.com
>   Accept, Embrace, Adapt, Create     
> \\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//
> 


-- 
Sameer Parekh					Voice:   510-986-8770
Community ConneXion, Inc.			FAX:     510-986-8777
The Internet Privacy Provider
http://www.c2.net/				sameer at c2.net





From frogfarm at yakko.cs.wmich.edu  Sat Jun 15 00:36:21 1996
From: frogfarm at yakko.cs.wmich.edu (Damaged Justice)
Date: Sat, 15 Jun 1996 15:36:21 +0800
Subject: WEB: Child molester database
Message-ID: <199606150240.WAA06155@yakko.cs.wmich.edu>



Along with the arms trafficker page, now we have a "child molester
database":

http://www.greatworld.com/public

Deadbeat Dads, Drug Dealers and more, coming soon according to blurb.

--
http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information
"We think people like seeing somebody in a uniform on the porch."  -US Postal
spokeswoman, quoted in AP, 1/27/96. I don't know about you, but most people I
know who saw someone in uniform on their porch would pull out the shotgun...
 





From ravage at ssz.com  Sat Jun 15 00:38:13 1996
From: ravage at ssz.com (Jim Choate)
Date: Sat, 15 Jun 1996 15:38:13 +0800
Subject: update.275 (fwd)
Message-ID: <199606150224.VAA07948@einstein.ssz.com>


Forwarded message:
>From physnews at aip.org Fri Jun 14 18:39:08 1996
Date: Fri, 14 Jun 96 16:45:16 EDT
From: physnews at aip.org (AIP listserver)
Message-Id: <9606142045.AA11832 at aip.org>
To: physnews-mailing at aip.org
Subject: update.275


PHYSICS NEWS UPDATE                         
The American Institute of Physics Bulletin of Physics News
Number 275  June 14, 1996    by Phillip F. Schewe and Ben Stein

THE FIRST QUANTUM COMMUNICATION USES "TRITS"
INSTEAD OF BITS.  For the first time, physicists have exploited
the laws of quantum mechanics to send data, and with their
technique have conveyed information more efficiently than with
traditional means.     In contrast to a traditional computer, in which
messages consist of tiny electric pulses encoded in binary form
(i.e., streams of 0s and 1s), researchers at the University of
Innsbruck in Austria send messages consisting of single photons
which can be coded as 0s, 1s, and 2s, setting up a base three system
called "trits."  The Innsbruck group (Harald Weinfurter,
harald.weinfurter at uibk.ac.at) converts a single ultraviolet photon
into two photons whose properties are quantum mechanically
interlinked, or "entangled."  Devices then encode a 0, 1, or 2 onto
one of the photons by performing an operation on it (such as
flipping its spin or shifting its phase); since the devices are blind to
the initial state of the photon, they change the overall properties of
the entangled photon pair without determining its final state.  The
two photons are recombined and then the interlinked pair travels
towards a network of detectors.  Two-photon interference creates
three different sets of detection possibilities in the Innsbruck setup
that reveal the quantum state of the entangled pair and whether the
photon was encoded with a  0, 1, or 2.  The physics of
entanglement has been exploited in numerous recent experiments,
to build quantum logic gates (Update 250) and perform an atom-level demonstration of Schrodinger's cat (Update 273), but until
now it has never been used for quantum communication---encoding
a message at one location and receiving it at another. Furthermore,
the same information contained in a typical ASCII character,
normally requiring the use of 8 bits, can also be transmitted using
only 5 trits.  (K. Mattle et al, Physical Review Letters, 17 June
1996.  More information and graphics can be found at
http://www.uibk.ac.at/c/c7/c704/qo/photon/_qdc)

THE CLOSEST EXTRA-SOLAR PLANET yet discovered orbits
the star Lalande 21185, only 8.1 light years from Earth.  George
Gatewood of the University of Pittsburgh observed a telltale wobble
in the light coming from the star, indicating the presence of a
Jupiter-sized planet circling the star in a Saturn-sized orbit. 
Gatewood's data, presented at the meeting of the American
Astronomical Society in Madison, WI, even hinted at the possibility
of other planets in the same solar system. (Washington Post, 12
June.)  Also,  another planet has been found by Geoff Marcy of San
Francisco State and Paul Butler of Berkeley, who announced two
new planets in January 1996.  Their new find is a Jupiter-sized
planet orbiting the star Rho Cancri (40 light years from Earth) at a
distance of only 0.1 astronomical units.  It completes a "year" in
only about two Earth weeks.  (Sky & Telescope, July 1996)

A MOVIE OF THE CRAB NEBULA provides new details about
pulsar dynamics.  At the heart of the nebula is a pulsar (the remnant
of a 1000-year-old supernova) which casts powerful streams of
particles into the surrounding debris-filled medium.  The Hubble
Space Telescope has recorded a sequence of pictures which show
where much of the pulsar's energy goes.  One surprise was how
quickly the landscape alters: noticeable changes in the region around
the pulsar sometimes occurred in a matter of days.  A second
surprise is that the outward flow of energy is confined largely to
two zones: jets shooting out from the poles and wisps of material in
the pulsar's equatorial plane.  (Science News, 8 June; Science, 7
June.)






From declan+ at CMU.EDU  Sat Jun 15 01:03:41 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sat, 15 Jun 1996 16:03:41 +0800
Subject: Does information want to be free?
In-Reply-To: <Pine.LNX.3.93.960614164556.394A-100000@gak>
Message-ID: <4lkW=Qu00YUyN3a9sM@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 14-Jun-96 Does information want to
be.. by "Mark M."@voicenet.com 
> For those interested, there is an article in the latest Scientific American
> about copyright laws and how they will be applied to the Internet.  It used
> the banned French book about the former president as an example of just how
> difficult it is to regulate information.  It also addresses whether routers
> (or analogously anonymous remailers) should be held liable for any copyright
> violations that may pass through them.

ObPlug: _Le Grand Secret_ is at <http://www.cs.cmu.edu/~declan/le-secret/>.

Last month I inteviewed a French government official in conjunction with
an article I was writing. I confess I was amused by how he described
those Internet anarchists who delighted in publicizing books that should
in fact be restricted.

-Declan






From wxfield at shore.net  Sat Jun 15 01:10:40 1996
From: wxfield at shore.net (Warren)
Date: Sat, 15 Jun 1996 16:10:40 +0800
Subject: PBS show
Message-ID: <v02140701ade7dc4ec6d4@[204.167.110.224]>


Blake;

        I agree with you...(re:Apple II was a toy)...

        <smirk>
        Eniac, by comparison was also a toy...(I wonder how many lives it
saved???)


        Heck, Eniac has it 'all over' the Abacus - Gosh, those darn
Babylonians seem so primitive nowadays!



>At 11:23 PM 6/13/96 EDT, Blake Wehlage wrote:
>>At 09:35 AM 6/13/96 -0800, jim bell wrote:
>
>>>But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset
>>>key, upper-case only, 40-character wide display, odd microprocessor, VERY
>>>SMALL capacity floppies (which were very slow as well), as well as a hostile
>>>legal situation regarding the building of clones.  Hell, they even objected
>>>to other companies building boards which plugged into the bus!
>>
>>
>>I was not a toy it was what started the PC revolution
>
>Grandly ignoring the Altair, the TRS-80 Model I, the IMSAI, et al.  Even Jolt!
>
>
>Jim Bell
>jimbell at pacifier.com







From wxfield at shore.net  Sat Jun 15 01:25:44 1996
From: wxfield at shore.net (Warren)
Date: Sat, 15 Jun 1996 16:25:44 +0800
Subject: Fuseable Links - no guarantees??
Message-ID: <v02140702ade7e09bc9e6@[204.167.110.224]>


I have never paid much attention to the protection of firmware or the
technical issues revolving around such schemes...was wondering:

I recently saw an add for a UK based group that says they can take a PIC
OTP micro and read the prom (for a fee, of course) - How the heck is this
done?? I have my suspicion that they (somehow) magically peel off the
ceramic coating (without destroying the chewy center), get a circuit mask
and 'micro probe' the I/O of the IC...they then download the secret recipe
to the afore mentioned 'chewy center'.

Is this close to accurate?? How is it 'done' ???


                                                                -Just Curious







From AwakenToMe at aol.com  Sat Jun 15 01:34:45 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Sat, 15 Jun 1996 16:34:45 +0800
Subject: PBS show
Message-ID: <960615000434_556692955@emout13.mail.aol.com>


In a message dated 96-06-14 23:48:14 EDT, jwilk at iglou.com (Blake Wehlage)
writes:

<< At 12:51 PM 6/14/96, Josh Sled wrote:
 >On Thu, 13 Jun 96 23:23 EDT, Blake Wehlage wrote:
 >
 >>Mac rule they have an awesome GUI (graphical user interface), easy of use
it
 >>way up there and they have bitchin' software. 
 >>
 >>I know i will regret saying this but:
 >>
 >>The mac OS is 3 times better than Windows '95 
 >
 >Though I agree with you, and I think OS/2's WorkPlace Shell and
 >Presentation Manager is about 10 times better than MacOS, this isn't
 >the place for GUI or OS holy wars...
 >
 >ObCrypto: Incorporating crpyto into a GUI : strong crypto (RSA, 3DES)
 >represented as strong locking devices (safe, vault, etc), weak crypto
 >represented as weak devices (padlock, chain-link)... what do you think?
 >
 >Joshy
 >
 >
 >
 >
 Oh my God someone agrees with me I see the light at the end of the tunnel,
 in this window covered world.  >>
WELllllll Id hate to say.... but after coming across A LOT of different users
from both systems.. It has seemed to me that... IN GENERAL, Mac users are
more computer 'illiterate' seeing as the mac's ease of use. Fine for the
everyday person... but not for me. 
Secondly.....as far os the computers software are concerned...... Not much
beats winNT => windows=> PC
THe chips arent 'too' much different. and that leaves me to say..... There's
more PC's out there... which seeing as whats presented..... Leads me to
thinks PC's are 'better' in my eyes.
So... how baout those mets?





From nobody at replay.com  Sat Jun 15 01:38:26 1996
From: nobody at replay.com (Name Withheld by Request)
Date: Sat, 15 Jun 1996 16:38:26 +0800
Subject: alpha.c2.org problem?
Message-ID: <199606150355.FAA12203@basement.replay.com>


For the past two days, all mail to my alias at alpha.c2.org has arrived
with the message stripped out.  All I'm getting is the end remailer's
disclaimer statement.

?????





From jwilk at iglou.com  Sat Jun 15 01:56:27 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 16:56:27 +0800
Subject: [Off-topic] Re: Insults (was: PBS show)
Message-ID: <m0uUmgt-00035UC@mail.iglou.com>


At 05:06 PM 6/14/96 +0100, Derek Bell wrote:
>In message <Pine.3.89.9606140305.A10802-0100000 at netcom19>, jonathon writes:
>>	Note in passing that both "Baptist" and "Mormon" were 
>>	originally terms of insult heaped on members of those
>>	respective faiths.  
>
>	I think "Quaker" had a similar history..
>
>	Derek Bell
>
>
>
I think "hacker, cyberpunk, and phone phreak" are want people think are
insults but me and my friends take them a unthought out complaments. 

P.s. who ever sent me mail calling me pokey should stop hiding behind a
remailer, and show yourself, you coward. 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From nobody at c2.org  Sat Jun 15 02:03:55 1996
From: nobody at c2.org (Anonymous User)
Date: Sat, 15 Jun 1996 17:03:55 +0800
Subject: Hackerpunks and C2
Message-ID: <199606150405.VAA08966@infinity.c2.org>


Ecafe Mixmaster Remailer wrote:
> The proposal for a Hackerpunks nym based mailing list is interesting,
> however, there are some concerns regarding the susceptibility of the list
> to traffic analysis.

I think that the belief of the owner of hackerpunks that s/he won't
be discovered is somewhat naive. Even though your traffic analysis
ideas are right (see below), the most likely way to discover the owner is
his/her unintentional screwup. I just feel like monitoring traffic of 
all internet is too expensive.

Still, the secrecy of the location of the hackerpunks-owner is not such
an important thing (as long as the list is not located in some police
state not honoring free speech). The knowledge of said localtion is 
not even really important since the contents of this list may be
montored anyway by simply subscribing to the list.

> The solution to the two dilemmas seems to be to ask that the C2 re-mailing
> code be modified so as ensure that each messages is padded to a fixed size
> before encrypting and being sent through the reply block. On the other
> hand, this would give away information that anyone receiving messages of
> this fixed length was likely the owner of some C2 nym.

[maybe I saw it on this list] How about this: that every remailer adds
a cookie of size X where

      S == size( message )
      X == 20KB - S + rand( 40KB ) if S < 20KB
      X == 40KB - S + rand( 80KB ) if 20KB <= S < 40KB
      X == 80KB - S + rand( 160KB ) if 40KB <= S < 80KB

and so on. This way, only 2-3 bits of information about size will
be available to traffic analyzers, instead of about 10-12. For the
most typical situation of messages being about 5KB in size, there
is no information leaking.

Of course, if an incoming message contained a cookie, it should be 
dropped by the remailer to be replaced by the new one on the next hop.

Same cookie feature could be added to premail.

Have fun.





From markm at voicenet.com  Sat Jun 15 02:08:09 1996
From: markm at voicenet.com (Mark M.)
Date: Sat, 15 Jun 1996 17:08:09 +0800
Subject: doubleclick monitoring web browsing habits
In-Reply-To: <199606132319.QAA14901@jobe.shell.portal.com>
Message-ID: <Pine.LNX.3.93.960614175916.153A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Thu, 13 Jun 1996, Hal wrote:

> One question is whether enough information to uniquely identify users
> is routinely provided by widely used browsers like Netscape.  I have
> refrained from telling my Netscape browser my name and email address out
> of fear that it would reveal this information; as a result, I can't use
> mailto: links, which is annoying (and also suspicious; lynx allows me to
> do mailto: without permanently entering an email address).

I do this too.  Until recently, it was trivial for a server to either force
the browser to download something via FTP and record the e-mail address or use
the infamous Javascript hack.  I currently have Netscape setup to disable Java,
and issue warnings whenever sending a form via e-mail or accepting a cookie.
I think this will prevent my e-mail address from being revealed to any server,
but it is not enough to satisfy my paranoia.  I would be truely satisfied if
Netscape would prompt for an e-mail address whenever it sends mail or post to
usenet.

> 
> This points out the need for browser providers to be sensitive to the
> privacy needs of their users and to clearly explain when and under what
> circumstances private information is revealed.  It also suggests that
> services like www.anonymizer.com will be increasingly important for
> people to protect their privacy while browsing.

Definitely.  Although they will never be as secure as anonymous remailers
(messages can not be delayed), this will be much better protection against
information gatherers.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMcHiaLZc+sv5siulAQF6DwQAqjNIai5zPDqCUxyCq2Y9BuM7EjUjp7IF
7GhSalQAilThBB+v4N6cQ6glkGOE+9heGBqsob0HKdQdIP2/AdbVCCgobO5JRGy+
kUPpMBve51PWjBu+ey85AlcJIwi0d8Upkb8aC4HYf79UTfzkOd2/84eBY0F5iY4X
iuoTsUwcFt4=
=RfVo
-----END PGP SIGNATURE-----





From AwakenToMe at aol.com  Sat Jun 15 02:12:59 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Sat, 15 Jun 1996 17:12:59 +0800
Subject: PBS show
Message-ID: <960615003243_556707180@emout15.mail.aol.com>


In a message dated 96-06-15 00:22:48 EDT, jwilk at iglou.com (Blake Wehlage)
writes:

<< Well I am now using a PC, I use a MAc for programming and both for
 networking& the internet. So as usual I am plastered as a 13 year old
 "computer illiterate" thanks real big confidence booster. I love my pc & my
 mac, I also love my Apple II it showed me the way of programming (first with
 basic), now I program in C and C++. Oh yea I guess I'm still computer
 illiterate.  >>
Id hate to say it.... But i KNOWW you read the part in my letter about it
being a GENERAL statement.. i seem to recall I put general in all caps too.
Or do those apple 2's only work in all caps... Didnt use those. I used my old
atari 800xl to learn basic back in OOooooo 3rd grade. Damn.. Long time
ago..........
Back to some encryption things.............I have something I need to look up
a little. more..... but Im interested on starting a decryption of a string.
It was encrypted using a password, and a randomly seeded number thats
reseeded for every character in the string i beliveve... let me research it
again... and Ill post some more....





From jwilk at iglou.com  Sat Jun 15 02:15:03 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 17:15:03 +0800
Subject: PBS show
Message-ID: <m0uUn5P-00035gC@mail.iglou.com>


At 05:29 PM 6/13/96 -0800, jim bell wrote:

>
>I only watched a few minutes of the show.  Did they mention that Microsoft 
>actually bought the MSDOS operating system from Seattle Computer products?
>
They mentioned it, also to be correct the original name was QDOS (quick &
dirty Operating System). 
>
>Literally!
>
>
>Jim Bell
>jimbell at pacifier.com
>
>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From jwilk at iglou.com  Sat Jun 15 02:17:23 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 17:17:23 +0800
Subject: PBS show
Message-ID: <m0uUnC7-00035iC@mail.iglou.com>



 I used my old
>atari 800xl to learn basic back in OOooooo 3rd grade. Damn.. Long time
>ago..........

Well I learned BASIC in 3rd grade also but that was only 5 years ago for me. 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From jwilk at iglou.com  Sat Jun 15 02:20:41 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 17:20:41 +0800
Subject: PBS show
Message-ID: <m0uUmsb-00035iC@mail.iglou.com>




>WELllllll Id hate to say.... but after coming across A LOT of different users
>from both systems.. It has seemed to me that... IN GENERAL, Mac users are
>more computer 'illiterate' seeing as the mac's ease of use. Fine for the
>everyday person... but not for me. 
>Secondly.....as far os the computers software are concerned...... Not much
>beats winNT => windows=> PC
>THe chips arent 'too' much different. and that leaves me to say..... There's
>more PC's out there... which seeing as whats presented..... Leads me to
>thinks PC's are 'better' in my eyes.
>So... how baout those mets?
>
>
Well I am now using a PC, I use a MAc for programming and both for
networking& the internet. So as usual I am plastered as a 13 year old
"computer illiterate" thanks real big confidence booster. I love my pc & my
mac, I also love my Apple II it showed me the way of programming (first with
basic), now I program in C and C++. Oh yea I guess I'm still computer
illiterate. 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From jwilk at iglou.com  Sat Jun 15 02:25:13 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sat, 15 Jun 1996 17:25:13 +0800
Subject: The Louisville Desktop Publishing Conference
Message-ID: <m0uUnC3-00035gC@mail.iglou.com>


Hey are any of you guys (& ladies) going to the Louisville (KY) Desktop
Publishing Conference? Well if you are I hope to see you there and mybee we
could have lunch and talk about crypto & any other hot topics. 

The conference is July 30th, 1996. At the Hyatt Regency. Topics include
Beginners & experts look on DTP, Graphic software, Internet, Publishing on
the net, and many more topics. E-mail : INFO at natsem.com for more
information. And you ask how does a 13 year old come up with the 195 dollers
to go? I didn't my mother, Debby Wilkerson, is one of the Presentors. 

Hope to see one or more of you there. 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
<jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
Quote- Does whiskey count as beer? -Homer Simpson          






From jimbell at pacifier.com  Sat Jun 15 02:25:25 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 15 Jun 1996 17:25:25 +0800
Subject: [noise] (was Re: PBS show)
Message-ID: <199606150431.VAA02619@mail.pacifier.com>


At 05:38 AM 6/14/96 -0700, anonymous-remailer at shell.portal.com wrote:
>at Thu, 13 Jun 1996 11:30:44 -0800 jim bell <jimbell at pacifier.com> may have 
written...
>
>>Brain-dead segmented architecture, 64k per segment limitation
>code segments, ever hear of code segments?  Data segments maybe? 

There is nothing wrong, conceptually, with _software_ segments...  In fact, 
even hardware segmentation is okay _IF_ the maximum size of those segments 
will NEVER (in the computer architecture's entire lifetime, and that 
includes later compatible CPU's) be challenged by the largest program and 
data to be run on that machine.  But a 64K byte segment size is truly and 
astoundingly bad design, even for 1976.  Even a 2**24 byte (16 megabytes) 
segment size would have turned into a wall a few years ago.  A 2**32 byte (4 
gigabyte) limit would not be a problem for at least 10 more years.

> Ever actually do any 8086 assembler? 

A minimal amount, fortunately.  Liked 8080 and Z-80 far better.  (Not that I 
think their limited address space is "better," merely that their design 
matched their intended uses far better.)


> You would have liked them.  In fact,
>even the MAC's O/S had them built in as I recall, just not a hardware
>limitation with the 68000.  A good programmer was not limited by these.
>
>>1-megabyte memory limitation.  The only thing that made it 
>OK, I concede here... But if you actually write code instead
>of pasting code together, 1MB is plenty of RAM with this
>processor.

It's still a problem.   I just ran Microsoft Windows Anti-virus a few days 
ago, on a 1.6 gigabyte hard drive, and it said I was "out of conventional 
RAM."  (Not because of "too much code," but because of too much data.)  With 
16 megabytes of DRAM, total, that's a laugh!  Try explaining this problem to 
a person who doesn't understand the distinction between "conventional" and 
extended memory.  They will have no idea that a stupid design decision made 
in 1976 caused a problem in 1996.

Most people don't understand the WHY behind that idiotic 1 megabyte 
limitation, and how it could so easily have been fixed.  As I understand it, 
when they were designing the 8086 the maximum-size package that Intel dealt 
with was a 40-pin ceramic package.  Well, look at the pinout of an 8086 and 
you'll see the problem:  Even with address/data multiplexing, you simply 
can't get more than 20 address bits out of a 40-pin package and keep the 
necessary control and power lines.  That's a limitation, and that's bad, but 
it turns out they made a bad design worse.

The best fix would have been to get a 44 or 48 pin package,(as, for example, 
the Z-8000 did) and dedicate at least 4 more bits to the address, which 
would have been a limitation of 16 megabytes, or 8 more, which would have 
been 256 megabytes.   But the Intel packaging people were apparently given a 
veto on the whole thing, and they stayed with a 40-pin package.  

But here's how they made it worse:  In the 8086 architecture, there are two 
16-bit registers added together (with a 4-bit offset) to form a 20-bit 
address.  Even if the designers were forced to accept that the initial 
implementation of the 8086 would only have a 40-pin package, at the very 
least they could have changed the segment offset to 8 bits or even 12 bits, 
which would have formed a 24 or 28-bit address internal to the 8086, of 
which only the lower 20 bits could be available.  Any computers built with 
this specific chip would be limited to a physical 1-megabyte memory space, 
HOWEVER future implementations of this architecture (for instance, the 
equivalent of the  80286) would have more address lines.  More RAM could be 
installed in them.  

So far, that sounds just like the 80286, right?  Wrong.  (The '286 can only 
access memory space above 1 megabyte by shifting to "protected mode," which 
is incompatible with DOS.)  Unlike the way it actually was with the 8086 vs. 
the 80286, the software would be compatible, because the segment addressing 
would have been identical, and their would no longer be any sort of physical 
1-meg limitation remaining.  In other words, there would be no residual 
conventional memory limitation, and "we'd all live happily ever after."  
(True, programmers would eventually write programs which exceed the memory 
capacity of the 8086, but that would not have affected newer computers.)

Somehow, I think if you could corner one of the 8086 designers, ideally with 
a 12-gauge shotgun, he'd say, "Doh!  We didn't think of that!"  That's 
right, they didn't think of that, because they _JUST_DIDN'T_THINK!_
And over 200 _BILLION_ dollars of money has been spent on computers limited 
by a brain-damaged architecture, when they could just as easily have avoided 
the problem back in 1976 with a trivial fix.
  
The one conceivable defense that Intel could muster would be, "We didn't 
anticipate this.  We didn't intend for the 8086 to be used as a 
general-purpose computer."  True or not in 1976, that defense was not 
available to IBM in 1980:  They were fully aware of the problem, and they 
knew about the 68000, and yet they chose the 8088 anyway.  The same 
short-sighted pig-headedness that would later be demonstrated by Bill Gates 
when he said something like "Nobody will ever need more than 640 kilobytes 
of RAM" was shown by Intel people in the middle 1970's.


>  What was brain dead was the fact that IBM in it's
>infinite wisdom "stole" near half of that for it's poor hardware
>designs (640k-1MB range).

IBM did add to the problem, true, but they "only" cut down the address space 
to 640 from 1 megabyte. Even 1 megabytes would have been an intolerable limitation.   Had 
Intel allowed a logical address space of 256 megabytes or even 16 megabytes, 
the loss of 380 kilobytes would not have been particularly limiting.  
Believe me, I'm not defending IBM, they're both guilty of gross stupidity.

>Joseph L. (Joe) Moll, Greenville, SC  USA  mailto:oolid at acqic.org

Jim Bell
jimbell at pacifier.com





From WlkngOwl at unix.asb.com  Sat Jun 15 02:36:30 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sat, 15 Jun 1996 17:36:30 +0800
Subject: Remailer Operator Liability?
Message-ID: <199606150439.AAA08522@unix.asb.com>


On 14 Jun 96 at 8:34, John A. Perry wrote:

> 	Now that the CDA decision has been made, I was wondering how this
> would affect the liability status of the various remailer operators? In
> the past several remailers have opted to discontinue service due to
> legal/political pressure. Will this CDA decision help to decrease remailer
> operator liability?

Only if a remailer operator intends to fight legal pressure in the 
courts, which requires time, patience, hope and of course, lots of 
money and good lawyers. 

Whether the CDA decision would give one more hope etc. is debatable. 
Wait for a Supreme Ruling from the Court of Elders of the 
Constitution...


Rob.
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From snow at smoke.suba.com  Sat Jun 15 03:44:07 1996
From: snow at smoke.suba.com (snow)
Date: Sat, 15 Jun 1996 18:44:07 +0800
Subject: 
In-Reply-To: <19960614111725.14796.qmail@ns.crynwr.com>
Message-ID: <Pine.LNX.3.93.960615013101.641B-100000@smoke.suba.com>


On 14 Jun 1996 nelson at crynwr.com wrote:

> Blake Wehlage writes:
> 
>  > They will never be able to regulate the net, look at he first and main use
>  > for it. 
> 
> What main use?  Flaming assholes who really deserve it?

	No, distribution of pornography. What takes up most (by volume) of
UseNet? What are the most popular groups? the alt.sex* groups. 

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From snow at smoke.suba.com  Sat Jun 15 03:50:48 1996
From: snow at smoke.suba.com (snow)
Date: Sat, 15 Jun 1996 18:50:48 +0800
Subject: Remailer Operator Liability?
In-Reply-To: <Pine.NEB.3.93.960614082823.392A-100000@alpha.jpunix.com>
Message-ID: <Pine.LNX.3.93.960615013332.641C-100000@smoke.suba.com>


On Fri, 14 Jun 1996, John A. Perry wrote:

> 	Now that the CDA decision has been made, I was wondering how this
> would affect the liability status of the various remailer operators? In
> the past several remailers have opted to discontinue service due to
> legal/political pressure. Will this CDA decision help to decrease remailer
> operator liability?

	I seem to get the idea that the problem is more in the realm of
civil suits than problems with "direct" legality. I say direct, because
IANAL and I don't know the correct way to phrase it. 

	Saying it another way, it currently isn't the FBI that is the
problem, but rather the CO$.

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From bruce at aracnet.com  Sat Jun 15 03:57:39 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Sat, 15 Jun 1996 18:57:39 +0800
Subject: Comments on MicroPayments and the Web
Message-ID: <2.2.32.19960615052947.006d85cc@mail.aracnet.com>


At 03:22 PM 6/13/96 -0700, Hal wrote:

>Consider two sites, one which acts as a proxy and cache but which
>charges something under a penny per page, and another which acts for
>free.  Won't the for-pay site be able to afford a larger disk, more
>servers, and better net connections?  It will be a superior service.

Just like commercial crypto, servers, news clients, and the like are all
superior to the free versions?

--
Bruce Baugh
bruce at aracnet.com
http://www.aracnet.com/~bruce






From hendersn at zeta.org.au  Sat Jun 15 04:34:35 1996
From: hendersn at zeta.org.au (Zed)
Date: Sat, 15 Jun 1996 19:34:35 +0800
Subject: Remailer Operator Liability?
Message-ID: <199606150753.RAA03617@godzilla.zeta.org.au>


>	Now that the CDA decision has been made, I was wondering how this
>would affect the liability status of the various remailer operators? In
>the past several remailers have opted to discontinue service due to
>legal/political pressure. Will this CDA decision help to decrease remailer
>operator liability?

Unlikely. The use of anonymous remailers was given as a reason for why it
was impossible to effectively determine if indecent material was being
distributed to a minor who was using a nym. I think pressure on anonymous
remailers is going to increase as various groups complain that the paw
innocent widdle kiddies are "vulnerable to corruption"(or some bullshit like
that) because their age can be hidden. Read the decision. The CDA _may_ be
declared constitutional if there was an effective and reliable way of
preventing minors from accessing "indecent" material - which anonymous
remailers make harder to do.

On another front, anonymous remailers were brought up in the latest hearing
of the Church of Scientology's court case against Dennis Erlich. Judge Whyte
expressed concern that trade secret status could be destroyed simply by
posting information through an anonymous remailer. Of course, the Church
dearly wants those concerns to be considered valid in law. I expect Whyte to
set a precedent concerning anonymous remailers sometime soon, and it is
unlikely to be a good one.
  Zed(hendersn at zeta.org.au)
"Don't hate the media, become the media" - Jello Biafra
  PGP key on request






From stevenw at best.com  Sat Jun 15 04:43:12 1996
From: stevenw at best.com (Steven Weller)
Date: Sat, 15 Jun 1996 19:43:12 +0800
Subject: Here we go again
Message-ID: <v01540b05ade814d49805@[206.86.1.35]>



Copyright 1996 Nando.net
Copyright 1996 The Associated Press

SEOUL, South Korea (Jun 15, 1996 00:41 a.m. EDT) -- For a Canadian
university student, creating an Internet site on North Korea was simply
opening a small library on the  reclusive nation. For South Korean
authorities, it was threat to national security.

Last week, South Korea declared David Burgess' World Wide Web site
subversive and ordered 14 local computer networks with Internet links to
block public access to it.

The government also said it would punish anyone accessing North Korean web
sites, taking its ideological war with its Marxist enemy into cyberspace.


-------------------------------------------------------------------------
Steven Weller                      |  Technology (n):
                                   |
                                   |     A substitute for adulthood.
stevenw at best.com                   |     Popular with middle-aged men.







From edgar at Garg.Campbell.CA.US  Sat Jun 15 05:31:30 1996
From: edgar at Garg.Campbell.CA.US (Edgar Swank)
Date: Sat, 15 Jun 1996 20:31:30 +0800
Subject: Zimmerman/Viacrypt
Message-ID: <1L3JPD7w165w@Garg.Campbell.CA.US>


Steve Reid recently posted (and sent me an Email copy - thanks Steve),

    > Phil disagrees with ViaCrypts new "business" version of PGP which
    > apparently encrypts all messages with an employer-supplied public key
    > in addition to any specified by the employee.

    Looking at Denning's critique (pro-escrow rant) of the NCR crypto
    report, she mentioned that mutant version:

    [http://www.cosc.georgetown.edu/~denning/crypto/NRC.txt]
      "Other corporations are similarly adopting products with data recovery
      capabilities as they integrate encryption into their systems (even PGP
      comes with data recovery in Viacrypt's Business Edition)."

    IMHO Phil Zimmerman has good reason to object to the mutant
    version, if it's going to cause the PGP name to somehow endorse
    escrow.

Denning is being disengenuous (so what's new). There's a big
difference between voluntary, not-government-sponsored "escrow" like
the type in the "business version" of ViaCrypt, and what Denning and
her friends in the government TLA's want.

Seems to me an employer has a perfect right to monitor his employee's
work product, for which he's being paid a salary and using the
employer's equipment (like business PGP).  If the employee doesn't
like it, he's free to seek employment elsewhere (or start his own
business).  Or he's free to encrypt all his personal Email at home
with a personal copy of ViaCrypt or a copy of free PGP.

-- 
edgar at Garg.Campbell.CA.US (Edgar Swank)
The Land of Garg BBS -- +1 408 378-5108





From Bryan_L_Andrews at ccm.fm.intel.com  Sat Jun 15 06:54:18 1996
From: Bryan_L_Andrews at ccm.fm.intel.com (Bryan L Andrews)
Date: Sat, 15 Jun 1996 21:54:18 +0800
Subject: The Elevator Problem
Message-ID: <Sat, 15 Jun 96 03:51:58 PDT_2@ccm.fm.intel.com>



Text item: 

Rob wrote: 

>This may be old hat, but an earlier post (around the time the Kocher
>RSA-timing attack came out) to the list asked about the "Elevator
>Problem", where two parties who think they share the same secret want
>to confirm it on an open channel.  I came up with an idea for a
>protocol but never got around to posting it, and dropped off the list
>briefly... so pardon me if this is already touched upon.

............

>Comments?



This reminds me of the discussions I've seen over the last few months regarding 
oblivious transfers/zero-based transactions. Good article in Scientific 
American on it a few months ago.

Bryan.


Text item: 






From modemac at netcom.com  Sat Jun 15 08:44:28 1996
From: modemac at netcom.com (Modemac)
Date: Sat, 15 Jun 1996 23:44:28 +0800
Subject: Proposal: PGPmail Plugin for Netscape/Mosaic
Message-ID: <199606151252.FAA13107@netcom21.netcom.com>


I don't know C, unfortunately, otherwise I'd program this myself.  So 
instead I'm putting it up for debate, and to encourage any cypherpunk to 
give it a shot if he/she thinks it's a good idea.

The idea behind this utility is to encourage the use of PGP for sending 
email.  Currently, using PGP with email requires you to compose the 
message, get the recipient's public key, encrypt the message, upload it 
to your system (or transfer it over using the clipboard), and email it.  
It would be much easier if sending a PGP email message was as simple as 
clicking a mouse.  This, this idea for a PGP plugin.  It goes like this:

You create a small text file containing an email address and a PGP public 
key.  Your own email address and key would be the best choice, of course, 
but it doesn't have to be yours.  Place that file on your Web page with a 
unique extension, such as public_key.key.  Include a link to this text 
file on your page, with a standard anchor like this:

<li>Click here to send me a PGP email message

When your Web browser reads a .key file, it invokes the PGPmail plugin 
utility.  This utility calls up a window that allows you to compose your 
email message (just like a standard email form).  When you have finished 
composing the message, you click the "Send" button as usual.  The utility 
then does the following:

- Reads the public key from the .key file.
- PGP-encrypts the message with that public key, using the PGP -eat option.
- Emails that PGP-encrypted message to the address given in the .key file.

The major advantage of this utility is that it would allow you to send an 
email message to anyone who puts their public key onto their Web page in 
this fashion, without having to go through the rigamarole of getting the 
public key, saving it to a file, encrypting the message, emailing the 
message, and then deleting the public key again (to keep from bloating 
your keyring, especially if it's not someone you plan to have a regular 
conversation with).

It would also ensure security on your part, because the PGP encryption 
would take place entirely on your own system.  You wouldn't have to 
depend on a CGI script and someone else's copy of PGP, because the email 
process doesn't take place until *after* you have encrypted the email 
message.

The ability to send a PGP-encrypted email message with one click of the 
mouse would result in an explosion of PGP use over the Web.  It would 
allow safe transactions of private information, such as people already do 
with PGP - but it would be so EASY that anyone with a Web browser could 
do it.





From anonymous-remailer at shell.portal.com  Sat Jun 15 08:44:35 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sat, 15 Jun 1996 23:44:35 +0800
Subject: No Subject
Message-ID: <199606151256.FAA18011@jobe.shell.portal.com>


I have noted a clear change in the tenor of comments regarding the Hackerpunks mailing list.

Initially, there was a mocking tone; recently, however, information and ideas are being shared which may be of mutual benefit regarding privacy and the freedom to express oneself as s/he chooses.

Refreshing! 







From nelson at crynwr.com  Sat Jun 15 09:18:40 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sun, 16 Jun 1996 00:18:40 +0800
Subject: [Slightly less Off-topic] Re: Insults (was: PBS show)
In-Reply-To: <Pine.3.89.9606140305.A10802-0100000@netcom19>
Message-ID: <19960615131801.22116.qmail@ns.crynwr.com>


Derek Bell writes:
 > In message <Pine.3.89.9606140305.A10802-0100000 at netcom19>, jonathon writes:
 > >	Note in passing that both "Baptist" and "Mormon" were 
 > >	originally terms of insult heaped on members of those
 > >	respective faiths.  
 > 
 > 	I think "Quaker" had a similar history..

Yes, as does "Queer".  But the "crypto-" prefix has an additional
meaning that may make its use somewhat problematic.  A "crypto-"
something can be a "fake-" or "hidden-" something.  So if it actually
became popular to be a geek, you'd have cool people becoming
crypto-geeks.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676       | +1 315 268 9201 FAX   | the side of freedom.





From jya at pipeline.com  Sat Jun 15 09:31:26 1996
From: jya at pipeline.com (John Young)
Date: Sun, 16 Jun 1996 00:31:26 +0800
Subject: Dead as a Dollar
Message-ID: <199606151309.NAA10039@pipe2.t1.usa.pipeline.com>


   6-15-96. NYP Mag: 
 
   "Dead as a Dollar." 
 
      For everyone who uses cash, everyone who stores it and 
      everyone who regulates it, a challenge is nearing. The 
      challenge will be to make choices. Some kinds of 
      electronic currency will protect privacy, and some will 
      violate privacy. Some will make crime easier, and some 
      will make it extraordinarily difficult. Some will tax 
      commerce parasitically, and some will catalyze it. The 
      new minters of money will have enormous power to choose 
      -- unless consumers, on the one hand, and Government 
      officials, on the other, decide to make their own 
      choices. 
 
      In the "current climate," as those in Washington tend to 
      say, anything that smacks of an expanded role for the 
      Government is anathema. Policy makers at the Treasury 
      are reluctant even to talk about electronic money on the 
      record. "It's easy to go in and say, 'Oh, we're going to 
      regulate everything,' without knowing what everything 
      is," says a senior Treasury official. "We want to know 
      what everything is." He adds: "There are very serious 
      policy issues -- seigniorage, money laundering, 
      financial- stability issues, consumer issues that are 
      genuinely important that we must address and look hard 
      at. It may be sensible for the Government to issue a 
      card -- that's conceivable -- but what if you issue it 
      and nobody uses it?" 
 
      As money enters a new age, so does counterfeiting. The 
      ultimate threat is the perfect copy -- the virtual coin 
      that proves mathematically identical to the real thing. 
      If money is a string of bits, then someone, some where, 
      can make a perfect copy, and another and another. An 
      arms race is already raging between those working to 
      armor-plate digital cash with doubly and triply secure 
      cryptography and those working to pierce the armor. 
      Security experts assume that nefarious characters, in 
      search of an unending stream of money, are already 
      investing millions in the next stages of research and 
      development. 
 
      For every new idea in tamper resistance, there is a new 
      idea in tampering.... "At least you can cause people to 
      have to spend a lot of money," says Eric Hughes, a 
      cryptography expert. "But doing the second chip is far, 
      far less money than the first. And if you could make a 
      master chip that spoke the right protocol, you could 
      make a little money mint for yourself." 
 
      "Information warfare is going to make people very 
      worried downstream," says Crook at Citicorp. "We have an 
      immense paranoia about how dangerous it's going to be. 
      I think that the security requirements in our industry 
      are going to be more severe than at the Department of 
      Defense." 
 
      Cryptography is as close as modern mathematics comes to 
      magic. 
 
      It's simply a design choice. Smart cards, or their 
      on-line equivalents, could function as blindly as raw 
      cash. They could be even less traceable than in Chaum's 
      system. That is a frightening prospect to law- 
      enforcement authorities. Having finally made life 
      difficult for drug smugglers with heavy cash suitcases, 
      they will not casually allow the manufacture of half- 
      ounce chips that could make possible blind transfers of 
      hundreds of millions of dollars, a money launderer's 
      dream. Even if the Government takes no other action in 
      the electronic-money arena, it will surely move to 
      extend its restrictions on cash to cover digital 
      equivalents. And so far, the large institutions entering 
      the electronic-money arena are leaning toward 
      less-anonymous, less-private approaches than Chaum's, 
      betting that most of us will be willing to sacrifice 
      more pieces of privacy for, say, convenience. Chaum 
      could prove right, but only if the marketplace is 
      willing to cast its votes for privacy. 
 
       [With many remarks by Kawika Daguio.] 
 
   http://pwp.usa.pipeline.com/~jya/deaddoll.txt  (48 kb) 
 
   ----- 
 
   Or, if http fails, DED_dol to <jya at pipeline.com> 
 
   Thanks to JG and NYPaper. 
 
 
 
 
 
 





From a037716t at bcfreenet.seflin.lib.fl.us  Sat Jun 15 09:31:57 1996
From: a037716t at bcfreenet.seflin.lib.fl.us (Michael Camp)
Date: Sun, 16 Jun 1996 00:31:57 +0800
Subject: No Subject
Message-ID: <Pine.3.89.9606150930.F3167-0100000@bcfreenet.seflin.lib.fl.us>



I just subscribed and what the hey is pgp.  Pretty good privacy?  


-Think global, act local, recycle!
Michael Camp
a037716t at bcfreenet.seflin.lib.fl.us







From perry at piermont.com  Sat Jun 15 11:31:59 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 16 Jun 1996 02:31:59 +0800
Subject: Comments on MicroPayments and the Web
In-Reply-To: <2.2.32.19960615052947.006d85cc@mail.aracnet.com>
Message-ID: <199606151454.KAA13331@jekyll.piermont.com>



Bruce Baugh writes:
> Hal wrote:
> >Consider two sites, one which acts as a proxy and cache but which
> >charges something under a penny per page, and another which acts for
> >free.  Won't the for-pay site be able to afford a larger disk, more
> >servers, and better net connections?  It will be a superior service.
> 
> Just like commercial crypto, servers, news clients, and the like are all
> superior to the free versions?

Software and hardware follow different rules.

Free software can often be superior because even tiny contributions by
large numbers of people can all "add up", and software has no cost to
its distribution in free form. A person of limited means who is into
the idea and has good skills and a good concept (like Phil Z.) can get
massive global distribution of their product.

Hardware, however, costs actual dollars, and many people don't have
those in large supply. Connectivity costs, too. Poor folks can't pay
for T3s, at least not at their current prices.

Perry





From declan+ at CMU.EDU  Sat Jun 15 11:33:24 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sun, 16 Jun 1996 02:33:24 +0800
Subject: Remailer Operator Liability?
In-Reply-To: <199606150753.RAA03617@godzilla.zeta.org.au>
Message-ID: <UlkgMQq00YUwQ3hq13@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 15-Jun-96 Re: Remailer Operator
Liabi.. by Zed at zeta.org.au 
> distributed to a minor who was using a nym. I think pressure on anonymous
> remailers is going to increase as various groups complain that the paw
> innocent widdle kiddies are "vulnerable to corruption"(or some bullshit like
> that) because their age can be hidden. Read the decision. The CDA _may_ be

This is true. Yesterday evening I interviewed the director of
enforcement for a TLA here in DC. He expressed his concern about
anonymous remailers and anonymity online. (More on this later.)

The word here in DC is "accountability."

-Declan






From bruce at aracnet.com  Sat Jun 15 12:44:29 1996
From: bruce at aracnet.com (Bruce Baugh)
Date: Sun, 16 Jun 1996 03:44:29 +0800
Subject: Comments on MicroPayments and the Web
Message-ID: <2.2.32.19960615154250.006eb6f0@mail.aracnet.com>


At 10:54 AM 6/15/96 -0400, Perry E. Metzger wrote:

>> Just like commercial crypto, servers, news clients, and the like are all
>> superior to the free versions?
>
>Software and hardware follow different rules.

This is true enough.

On the other hand, it's true that money by itself is not (in my experience)
the deciding factor on the quality of a service provider. I moved some
months ago from the biggest ISP in town to one with a much smaller resource
base but greatly superior service in the areas that mattered to me (fast
news, reliable mail, etc). The guy in charge is making better use of what
he's got.

On the gripping hand, if my current provider had the other provider's bucks,
things could _really_ fly.

--
Bruce Baugh
bruce at aracnet.com
http://www.aracnet.com/~bruce






From WlkngOwl at unix.asb.com  Sat Jun 15 12:52:26 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 16 Jun 1996 03:52:26 +0800
Subject: doubleclick monitoring web browsing habits
Message-ID: <199606151550.LAA02507@unix.asb.com>


On 14 Jun 96 at 14:26, Hal wrote:

> When I run lynx (2.3.7 beta) to <URL:
> http://www.anonymizer.com/cgi-bin/snoop.pl >, it says:
> 
>    Here's a sampling of the kind of information that a site can collect
>    on you (please wait a moment):

>      Your computer is a Unix box.
>      Your Internet browser is Lynx.
>      You are coming from jobe.shell.portal.com.
>      You just visited the Anonymizer Home Page.
> 
> No user name here.

I visited there from Netscape. Didn't give my user name but 
apparently said "You are affiliated with ASB Internet, Inc. ..." and 
then displayed a bunch of advertising info by ISP puts out.

An amusing thought: fill the personal info fields with business 
advertisements.  Perhaps people who surf the web regularly can sell 
advertising space.

(insert smiling emoticon here)

> Also, when I follow a mailto: link it asks me to input the email address
> I want the mail to be from!  So I don't think it is using local user name
> information, although certainly that is potentially available to it.

Have you tried mailing yourself by putting something else in there? I 
remember trying that and seeing from the headers that I sent it (the 
usual "Received by ..." username -> machine paths.) Of course that 
was on a University's computer system, so they may have patched the 
sources.

Rob

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From WlkngOwl at unix.asb.com  Sat Jun 15 12:56:42 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 16 Jun 1996 03:56:42 +0800
Subject: doubleclick monitoring web browsing habits
Message-ID: <199606151550.LAA02510@unix.asb.com>


On 14 Jun 96 at 18:06, Mark M. wrote:
[..]
> but it is not enough to satisfy my paranoia.  I would be truely satisfied if
> Netscape would prompt for an e-mail address whenever it sends mail or post to
> usenet.

When I used to read the list over hks.net (still down, eh?) I would 
change my name (and sometimes address, for quasi-anonymity) with no 
problems... you just have to do that *before* you try to reply.

(Free)Agent newsreader will let you do that as part of the reply as well. 
It'll still show the path and machine that sent news, but it allows 
you to change From:, Reply-To: and Sender: fields. 

Rob.
 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From AwakenToMe at aol.com  Sat Jun 15 13:24:24 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Sun, 16 Jun 1996 04:24:24 +0800
Subject: [noise] (was Re: PBS show)
Message-ID: <960615114849_217908234@emout09.mail.aol.com>


Now what is actually (in depth pleaseeee) protected and real mode?
Has there been any talk of intel possibly fixing this conventional mem
problem in future chips????? Thanks..
Adam







From jya at pipeline.com  Sat Jun 15 13:31:51 1996
From: jya at pipeline.com (John Young)
Date: Sun, 16 Jun 1996 04:31:51 +0800
Subject: Trits
Message-ID: <199606151622.QAA12349@pipe3.ny1.usa.pipeline.com>


   As a complement to Jim Choate's forward on the "trits" 
   communication research, we suggest perusing an interview of 
   the philosopher Paul Virilio. Here're are excerpts from the 
   interview available at: 
 
      http://pwp.usa.pipeline.com/~jya/silence.txt 
 
 
   PAUL VIRILIO: I have to take a detour through physics here, 
   and this is one of the differences between and Baudrillard 
   and myself. Unlike him, I have a formal scientific 
   education (that's why physics and military sciences kept me 
   busy for a very long time). In the past, reality was a 
   matter of mass; then it became mass + force. Today, reality 
   is the outcome of: mass + force + information. Matter has 
   now become truly three-dimensional. This is a clear break. 
   What we have witnessed in Italy, with Berlusconi seizing 
   power, is the first successful media-coup in history. Italy 
   is again Europe's avant-garde, and is showing us where the 
   new political alternative resides - in a realm where "left" 
   or "right" are no longer relevant. The new political 
   alternative is between the old political class on one side, 
   and the new media-class on the other. With Italy, the 
   media-class has now seized power in Europe. It will also 
   happen in the United States, in France, in Spain, and 
   elsewhere. 
 
   CARLOS OLIVEIRA: Do you see some kind of media-fascism 
   looming on the horizon? 
 
   PAUL VIRILIO: No, because what I see is far worse! Due to 
   its overwhelming power, the totalitarianism of the 
   information-medium is going to be even more powerful than 
   the traditional political totalitarianism of the old 
   national-socialist or communist hues. The dangers are 
   looming larger. I repeat: only if one is guarded against 
   its dangers will it be possible to enjoy the positive 
   aspects of the developments in the realm of new 
   technologies. 
 
   CARLOS OLIVEIRA: In your eyes, is there any way out of this 
   rather bleak situation? 
 
   PAUL VIRILIO: An accompanying evil here is the end of 
   writing, as it unfolds through image technology, 
   cinema/film, and television-screen. These new developments 
   threaten the ability to conjure up mental images with 
   oblivion. The typical modern human is characterized by a 
   life under the dictatorship of the screen, to which the 
   written word falls victim. We don't read any more, we 
   hardly write each other - since we can call each other on 
   the phone. Next, we will no longer speak! I'd really like 
   to say: this will indeed be the silence of the lambs! 
 
 
 
 
 
 





From perry at piermont.com  Sat Jun 15 13:32:15 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 16 Jun 1996 04:32:15 +0800
Subject: [noise] (was Re: PBS show)
In-Reply-To: <960615114849_217908234@emout09.mail.aol.com>
Message-ID: <199606151624.MAA13453@jekyll.piermont.com>



AwakenToMe at aol.com writes:
> Now what is actually (in depth pleaseeee) protected and real mode?
> Has there been any talk of intel possibly fixing this conventional mem
> problem in future chips????? Thanks..

We are hitting new lows here, folks.

To quote Elvis Costello, I used to be disgusted, now I try to be amused.

Perry





From abostick at netcom.com  Sat Jun 15 14:02:36 1996
From: abostick at netcom.com (Alan Bostick)
Date: Sun, 16 Jun 1996 05:02:36 +0800
Subject: Here we go again
In-Reply-To: <v01540b05ade814d49805@[206.86.1.35]>
Message-ID: <JEuwx8m9LQ8E085yn@netcom.com>


In article <v01540b05ade814d49805@[206.86.1.35]>,
stevenw at best.com (Steven Weller) wrote:
> 
> Copyright 1996 Nando.net
> Copyright 1996 The Associated Press
> 
> SEOUL, South Korea (Jun 15, 1996 00:41 a.m. EDT) -- For a Canadian
> university student, creating an Internet site on North Korea was simply
> opening a small library on the  reclusive nation. For South Korean
> authorities, it was threat to national security.
> 
> Last week, South Korea declared David Burgess' World Wide Web site
> subversive and ordered 14 local computer networks with Internet links to
> block public access to it.
> 
> The government also said it would punish anyone accessing North Korean web
> sites, taking its ideological war with its Marxist enemy into cyberspace.

I saw this, too.  The online AP report had the URL for the site at the
bottom (http://duke.usask.ca/~burgess/DPRK.html).  The site is no longer
there.

I suspect that a University president or provost or computer services 
manager had it removed.  I suspect that he or she is going to be VERY
embarassed real soon now.

-- 
Alan Bostick               | The Necronomicon was not written by the Mad Arab,
mailto:abostick at netcom.com | it was written by Scott Adams
news:alt.grelb             |      Alan Olsen <alano at teleport.com>
http://www.alumni.caltech.edu/~abostick





From jimbell at pacifier.com  Sat Jun 15 14:27:43 1996
From: jimbell at pacifier.com (jim bell)
Date: Sun, 16 Jun 1996 05:27:43 +0800
Subject: Fuseable Links - no guarantees??
Message-ID: <199606151651.JAA22789@mail.pacifier.com>


At 11:44 PM 6/14/96 -0400, Warren wrote:
>I have never paid much attention to the protection of firmware or the
>technical issues revolving around such schemes...was wondering:
>
>I recently saw an add for a UK based group that says they can take a PIC
>OTP micro and read the prom (for a fee, of course) - How the heck is this
>done?? I have my suspicion that they (somehow) magically peel off the
>ceramic coating (without destroying the chewy center), get a circuit mask
>and 'micro probe' the I/O of the IC...they then download the secret recipe
>to the afore mentioned 'chewy center'.
>
>Is this close to accurate?? How is it 'done' ???


While I have never come even close to needing to attempt this kind of thing, 
long ago it occurred to me that if the "no read" bit was stored in a 
programmable bit, and if the location of that bit was known or could be 
identified, you could expose that particular bit through a tiny mask hole 
and cause the part to be readable again.  Locating that bit (assuming 
there's just one) would be relatively simple:  Take a test part, program it, 
read-lock it, and then expose it to a VERY slowly sliding mask with UV 
behind.  Do this for both axes, to find the bit's location on the chip.

Jim Bell
jimbell at pacifier.com





From jimbell at pacifier.com  Sat Jun 15 15:10:35 1996
From: jimbell at pacifier.com (jim bell)
Date: Sun, 16 Jun 1996 06:10:35 +0800
Subject: Fuseable Links - no guarantees??
Message-ID: <199606151810.LAA25519@mail.pacifier.com>


At 01:46 PM 6/15/96 -0400, Warren wrote:
>Jim;
>
>        I was under the impression that a fuseable link was literally a
>piece of conductive material that you deliberatley 'blow-away' - In most
>cases, couldn't you simply 'tap into' the data side of the fuse, and
>download the info??

If it really is a "fusible link," that usually means a fuse, analogous to 
the much larger kinds used for circuit protection.  There are also 
"anti-fuses" which are high-resistance silicon links which on the 
application of a relatively high voltage, become low-resistance.

However, besides this, there is the typical EPROM-type cell, which can be 
programmed but not erased electrically.  (I'm ignoring cells like EEPROM 
which are designed and constructed to be electrically erased.)  As long as 
the chip contains most of its information in EPROM, that means that the chip 
was fabbed with a EPROM-compatible process, so they'd be more likely to 
include read-protection in EPROM as well.


Jim Bell
jimbell at pacifier.com





From wxfield at shore.net  Sat Jun 15 15:19:02 1996
From: wxfield at shore.net (Warren)
Date: Sun, 16 Jun 1996 06:19:02 +0800
Subject: Fuseable Links - no guarantees??
Message-ID: <v02140701ade8a5dbd914@[204.167.110.204]>


Jim;

        I was under the impression that a fuseable link was literally a
piece of conductive material that you deliberatley 'blow-away' - In most
cases, couldn't you simply 'tap into' the data side of the fuse, and
download the info??


>At 11:44 PM 6/14/96 -0400, Warren wrote:
>>I have never paid much attention to the protection of firmware or the
>>technical issues revolving around such schemes...was wondering:
>>
>>I recently saw an add for a UK based group that says they can take a PIC
>>OTP micro and read the prom (for a fee, of course) - How the heck is this
>>done?? I have my suspicion that they (somehow) magically peel off the
>>ceramic coating (without destroying the chewy center), get a circuit mask
>>and 'micro probe' the I/O of the IC...they then download the secret recipe
>>to the afore mentioned 'chewy center'.
>>
>>Is this close to accurate?? How is it 'done' ???
>
>
>While I have never come even close to needing to attempt this kind of thing,
>long ago it occurred to me that if the "no read" bit was stored in a
>programmable bit, and if the location of that bit was known or could be
>identified, you could expose that particular bit through a tiny mask hole
>and cause the part to be readable again.  Locating that bit (assuming
>there's just one) would be relatively simple:  Take a test part, program it,
>read-lock it, and then expose it to a VERY slowly sliding mask with UV
>behind.  Do this for both axes, to find the bit's location on the chip.
>
>Jim Bell
>jimbell at pacifier.com







From jwilk at iglou.com  Sat Jun 15 15:40:55 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sun, 16 Jun 1996 06:40:55 +0800
Subject: 
Message-ID: <m0uUzit-00035cC@mail.iglou.com>


At 09:33 AM 6/15/96 -0400, Michael Camp wrote:
>
>I just subscribed and what the hey is pgp.  Pretty good privacy?  
>
>
>-Think global, act local, recycle!
>Michael Camp
>a037716t at bcfreenet.seflin.lib.fl.us
>
>
>
>
Good thinking swiffty
Blake Wehlage
<jwilk at iglou.com>
URL: http://www.iglou.com/members/jwilk.html
"World's Youngest Cypherpunk" Age 13






From vipul at pobox.com  Sat Jun 15 15:58:24 1996
From: vipul at pobox.com (Vipul Ved Prakash)
Date: Sun, 16 Jun 1996 06:58:24 +0800
Subject: pretty good reputation
Message-ID: <199606142000.BAA00199@fountainhead.net>


a pretty good detour. 

by what i understand pgp's "web of trust" scheme has flaws. according to 
pgp (alice trusts jane, jane trusts snoopy, bob trusts alice) implies 
bob trusts snoopy. this means that alice trusts jane to the extent, that 
if jane trusts a third person, then a fourth person who trusts alice 
automatically trusts that third person. deducing such results from a 
simple shades of trust system cannot lead to a reliable web of trust.
thats common sense.

what is required is a reputation system wherein trust is  _qualified_ 
rather than _quantified_. its senseless to say i trust him five units.
it will be more appropriate if pgp has a separate tag for "type of trust"
or something like that. 

this kind of thing can be difficult to handle, since it a fuzzy 
parameter. add to the problem a global-system like internet where all 
communication is not person to person. i was wondering if there are 
any working mathematical models for reputation systems, and how 
successful they are.

vipul ved prakash







From reagle at MIT.EDU  Sat Jun 15 16:32:45 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Sun, 16 Jun 1996 07:32:45 +0800
Subject: [Noise] Re: Clinton Backs Internet 'Decency Act'
Message-ID: <9606151900.AA24857@rpcp.mit.edu>


At 10:35 AM 6/14/96 -0700, you wrote:

>This is also at odds with what Clinton said. The full text of the statement
>is available on whitehouse.gov, among other places.

        I don't see how necessarily. (1) He supports the bill, and (2) he
thinks the bill is within the realm of constitutionality, his statement is
rather weak, but I think if you take the two points above, their summation
is obvious and _is_ contrary to the bravado of Gore's MIT commencement
speech. This is not to say he could very well back off to save face, which
is what he is starting to do, and I hope he continues to do... 


 Statement by President Clinton in reaction to Court Decision




                             THE WHITE HOUSE

                      Office of the Press Secretary
___________________________________________________________________________

For Immediate Release                                       June 12, 1996

                         STATEMENT BY THE PRESIDENT

The Justice Department is reviewing today's three judge panel court
decision on the Communications Decency Act.  The opinion just came down
today, and the statute says we have twenty days to make an appeal.

I remain convinced, as I was when I signed the bill, that our Constitution
allows us to help parents by enforcing this Act to prevent children from
being exposed to objectionable material transmitted though computer
networks.  I will continue to do everything I can in my Administration to
give families every available tool to protect their children from these
materials. For example, we vigorously support the development and
widespread availability of products that allow both parents and schools to
block objectionable materials from reaching computers that children use.
And we also support the industry's accelerating efforts to rate Internet
sites so that they are compatible with these blocking techniques.

                               -30-30-30-

_______________________
Regards,            Democracy is where you can say what you think 
                    even if you don't think. -?
Joseph  Reagle      http://rpcp.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From drosoff at arc.unm.edu  Sat Jun 15 16:42:27 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Sun, 16 Jun 1996 07:42:27 +0800
Subject: Remailer Operator Liability?
Message-ID: <1.5.4.16.19960615191232.3aef1846@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

At 10.18 AM 6/15/96 -0400, Declan B. McCullagh wrote:
>Excerpts from internet.cypherpunks: 15-Jun-96 Re: Remailer Operator
>Liabi.. by Zed at zeta.org.au 
>> distributed to a minor who was using a nym. I think pressure on anonymous
>> remailers is going to increase as various groups complain that the paw
>> innocent widdle kiddies are "vulnerable to corruption"(or some bullshit like
>> that) because their age can be hidden. Read the decision. The CDA _may_ be
>
>This is true. Yesterday evening I interviewed the director of
>enforcement for a TLA here in DC. He expressed his concern about
>anonymous remailers and anonymity online. (More on this later.)
>
>The word here in DC is "accountability."
>
>-Declan

Am I the only one who thinks that any kid who is competent enough and smart enough
to use a nym will not only 1) not be warped or corrupted by the horrible porno demons
but also 2) won't even care about porno?

===============================================================================
David Rosoff (nihongo o chiisaku dekimasu)  ------------->  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
===
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." <---- "Ulysses", by Alfred, Lord Tennyson

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcMI4xguzHDTdpL5AQHSUQQAo0YJvapyiC5r2eoY5BDaEEf164zxE+ub
JUw807Ovtsg0SSoyESHOAyO4S8usq4dV8JVJRlmGitAo+p9BJPWe8UYX8u4LU9se
LZoCOkgwomRLdLL4D4/3ALaT/qanTpuJ/NelxGN7871+jSA6qiuL8nSLdTiU3zL8
YHaWo7z1nNI=
=m9F9
-----END PGP SIGNATURE-----






From allyn at allyn.com  Sat Jun 15 16:52:49 1996
From: allyn at allyn.com (Mark Allyn 206-860-9454)
Date: Sun, 16 Jun 1996 07:52:49 +0800
Subject: The FCC wants you!!! (fwd)
Message-ID: <199606151627.JAA26194@mark.allyn.com>


Forwarded message:
>From nanog-owner at merit.edu Sat Jun 15 01:48:51 1996
Date: Sat, 15 Jun 1996 00:12:58 -0700 (PDT)
From: Michael Dillon <michael at memra.com>
To: nanog at merit.edu
Subject: The FCC wants you!!!
Message-ID: <Pine.BSI.3.93.960615001101.4644Q-100000 at sidhe.memra.com>
Organization: Memra Software Inc. - Internet consulting
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-nanog at merit.edu
Precedence: bulk


If you know American ISP's who don't normally hang out on ISP mailing
lists or if you have any contacts in the educational system who are
concerned with the cost of technology, then please forward this message to
them. Here is the opportunity for direct political action that really can
make a difference without requiring well-funded intermediaries and
lobbiests...

Michael Dillon                                   ISP & Internet Consulting
Memra Software Inc.                                 Fax: +1-604-546-3049
http://www.memra.com                             E-mail: michael at memra.com

---------- Forwarded message ----------
Date: Fri, 14 Jun 1996 22:13:01 -0600 (MDT)
From: Dave Hughes <dave at oldcolo.com>
Reply-To: inet-access at earth.com
To: inet-access at earth.com
Subject: Re: Accuracies of My Own
Resent-Date: Fri, 14 Jun 1996 23:14:53 -0500 (CDT)
Resent-From: inet-access at earth.com

Jack Rickard says:
> 
> In any event, my perception is that Dave is always early to the table, and 
> by the time the world is ready to buy something, he's already moved on.  I 
> was vaguely aware of his wireless activities, and somewhat more interested 
> in them with the recent NIIBand proposals.  There ARE some issues and I do 
> hope Dave is successful in steering this toward the 15 km version as 
> opposed to the limited range Wireless LAN version some of the big guys seem 
> to be determined to push through.
> 
> In fact, this is actually a rather key issue specifically for Internet 
> Service Providers and more specifically for those in rural areas.  As a 
> newbie to the mailing list, I may be reintroducing something that has 
> already been done to death.  But this NIIBand could be a huge advantage for 
> small ISP's in rural areas (not JUST academia and K-12 Dave) if done right, 
> and another fiasco if done wrong.  The FCC has this open for comment now. 
>  If Mr. Hughes would provide info on docket numbers and where to write, you 
> all could have a significant impact.  On the one hand, you can offer 24 
> Mbps links by radio at 10-15 km.  On the other, 3COM can do wireless LAN 
> inside a building for about 1000 feet.  All from a stroke of the FCC pen.
> 
> 
Yes, this is a far more significant issue than most ISPs realize - whether
the FCC, in both responding to the Apple-WINForum proposal to allocate
350Mhz of spectrum in the 5Ghz bands for what the FCC dubbed the 
"NII/SUPERNET" Band for 'no licence' wireless - will do that in BOTH
the 'wireless lan' segment AS WELL AS the requested '15 km' segments
and thus permit anyone, including ISPs to have no-comm cost bandwidth
up to 2Mbps between two points, or, with relay, 1Mbps (above and
below T-1) for the cost of the radios. Spread spectrum technology which
is a revolution in radio communications (wide band, digital processor
controlled low power - with no practical interference versus traditional
narrow frequency band high power - with so much interferecne, the 
frquencies have to be licenced and highly controlled).

And yes I, and a too-small handful of others are deep into the issues
at the FCC level as the decision hangs in the balance. Because I
am the Principal Investigator on the $375,700 'Wireless Field Test
for Education Project' I was invited to a roundtable with FCC
Commissioners nominally debating 'wireless for education' two weeks
ago, and, using our real-world wireless project going on in the
San Luis Valley (one school being relaibaly connected now 15 miles
at 115kbs, bypassing US West, from NT-Lan router to Cisco Router
at the POP. Zero local loop cost) and reporting on the other
projects we have examined (8 Belen, New Mexico Schools, conected
T-1 between each other in a WAN - up to 10 miles across the district.
Zero local loop cost (which would normally run $84,000 a year wiht
telco T-1 between schools).

We made an impression, but know what giant forces we are up against.
Some FCC staffers want to 'auction' the longer range (even 15km)
stuff. Some big communications companies, led by the Cellular 
Telecommunications Industry Assn - CTIA, would like all 'no-licence'
that can compete with them to be killed. 

Our arguements, that got a few thinking anyway, was that IF the FCC
rules permit radios to be made which go 15-45 miles, no licence,
no interference, and solve the problem of the 16,000 school
districts whose biggest problem is the cost of bandwidth *between*
school building of a district first, then the cost from the main
hub to the POP, second, then between the student and/or teacher
at home to the school, at 56kbs or above, THEN the problem of
'community' networking will also be solved. For school districts
are coincident where people live and log on from. (ditto ISPs)

We turned a few heads when I showed my calcuations that, if
the 14 School Districts of the SanLuis Valley are connected to
the one central POP at T-1 by US West, it will cost $1.2 million
over 10 years. If by T-1 25mile radios (yeas they exist now)
it will cost $173,000 for the same 10 years. 

Now if ISPs want to strike a blow for economic telecom freedom, 
you can start by accessing our NSF Wireless Field Test web site,
 http://wireless.oldcolo.com  and go into the Regulatory section
where you will find direct documents, links to the FCC, the
Belen Paper, and my long but piercing piece 'The Case for 
Public Spectrum' (and if you are a skeptic about the technology,
read the Paul Baran short papers - the invetor of packet switching)

Then all you have to do to sumbit public comments o the NIIBand
matter is to email:

            96-102 at fcc.gov

and that is the email address for the Docket Item. You *must* comment
before July 15th, or yours will not be considered. (but under the law
and regulation, if you *do* comment, your comments must be summarized
by the staff and presented to the COmmissioners with the staff 
views. 

You do NOT have to comment on all the heavy duty technical issues.
Right from the chief FCC Engineer who drafts the rules, and was
the father of the original Spread Spectrum rules in 1985 he
says that your statemnt of what you NEED, and why, would be
much appreciated. As simple as 'I am an ISP who needs T-1 from
my site, 8 miles to the nearest POP, no licence/cost wirless,
with a radio I can afford' is to the point. (of course the more
you show your technical economic need in sophisticated terms
the better it will be received. The FCC engineers are no dummies
and political handwaving doesn't impress them (it only impresses
the COmmissioners whenthe handwavers are called AT&T or Congress)

I can just about assure you the FCC staff doesn't even know you
exist, as a class, (small ISPs) or what function you serve in the
food chain, or why you shouldn't just pay $650 a month for your
local loop T-1 like anybody else. And unless you email them
(and they now have a policy that email must be taken as seriously
as formal paper mail filings), your colective case won't even
be mentioned when the likes of Motorola, AT&T, CTIA, the NSA
(who gets gas pains when secure wireless is mentioned) are
testifying.

All will not be totally lost if this NPRM does not fly (new
spectrum) for we still have the more congested Part 15, 1 watt
bands. And the 4 NSF types who attended the FCC rountable
were impressed enough with our case that we spent a day with them
and they are about to fund a 'developmental' project that will
be done by TAPR, that may bring you that $500 T-1 plug and play
radio, with range. (by licencing the guts to mfgrs).

Matter of fact I will be in Washington DC at the NSF Monday
on this (being carrie dby my sidekick in radio engineering
matters) and two other matters. One of which will (their idea,
not ours) see part of our team in Ulaanbaatar, Mongolia in
August, linking 8 sites to the satellite Spintlink downlink
site run by Mongolian engineers in an old Soviet lab. (web
page at www.magic.mn already - but they can't get the signal
across town, so crappy is their phone system). So by September
you willbe pinging systems in Mongolia, the last 10km of
which will be wireless.

I always wanted to help set up the Ghengis Khan BBS in a Mongolian
yurt, running OS2 (cause IBM is everywhere), with NAPLPS character
sets (Chinese, Cyrilli Russian, and Mongolian - none of which
are ascii), solar powered, and with spread spectrum radios
linking China to Russia. With nary a Telco in a hundred miles.
And I got a hunch I will have that done before ISPs in NYC
do it.

Dave Hughes
dave at oldcolo.com

Oh yeah, if you http://192.160.122.3  you will reach, by wireless,
the OS2 system in my home. Not blazingly fast beacause I
am trying out a different set of radios. And teh wired 56kbs
frame relay to which it is attached is actuallythe slowest link
in the chain. But its been running 160kbs for almost a year now,
for $0 cost from me to my own Internet service.  








From hfinney at shell.portal.com  Sat Jun 15 17:11:32 1996
From: hfinney at shell.portal.com (Hal)
Date: Sun, 16 Jun 1996 08:11:32 +0800
Subject: Remailer Operator Liability?
Message-ID: <199606151958.MAA01418@jobe.shell.portal.com>


The real problem with remailers and kids, from my experience, is not
kids who use nyms; it is people sending sexual material, unsolicited,
to children.  I have had a few complaints from parents where this has
happened.

I am pretty sure it is illegal, CDA or not, at least if the material
is obscene rather than merely indecent.  As Declan says, the issue is
accountability.  If the remailer operator ends up being considered the
person who sent the mail, he could be in deep trouble.

Hal





From shamrock at netcom.com  Sat Jun 15 17:24:54 1996
From: shamrock at netcom.com (Lucky Green)
Date: Sun, 16 Jun 1996 08:24:54 +0800
Subject: Attorney General wants to "expand crypto laws"
Message-ID: <v02120d49ade8caca1c01@[192.0.2.1]>


I just heard parts of a speech by J. Reno on KCBS. The speech was given in
San Francisco either today or yesterday. According to the announcer, Reno
is calling to "expand the use of cryptography laws". IMHO, this can only
mean restrictions on the domestic use of crypto.

Does anybody on this list have a transcript of her speech?


Disclaimer: My opinions are my own, not those of my employer.

-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.







From hfinney at shell.portal.com  Sat Jun 15 18:17:53 1996
From: hfinney at shell.portal.com (Hal)
Date: Sun, 16 Jun 1996 09:17:53 +0800
Subject: Proposal: PGPmail Plugin for Netscape/Mosaic
Message-ID: <199606152019.NAA02248@jobe.shell.portal.com>


There was a little discussion about this on the coderpunks list, but I
didn't get the impression that anyone was ready to run out and do it.
I'm not sure whether plugins could also be used for receiving mail in
addition to sending, but if so it does seem like a good way to add the
functionality.

Also, as I understand it, Netscape plugins have to be downloaded and
installed ahead of time by the user, so it is not quite true that this
gives one-click PGP access to everyone with a browser; it will only be
for Netscape users who have downloaded and installed the right plugin.
Also, plugins are architecture specific so he would have to be running
the kind of computer for which a plugin is available.

I have a Java applet which sends PGP mail similarly to the model you
describe.  This will work in principle for any browser which supports
Java, and does not require anything to be downloaded or installed ahead
of time (other than the Java-compliant browser).  It is still pretty
rough and is more of a proof of concept than a production program but I
think it is another potential approach.  Look at <URL:
http://www.portal.com/~hfinney/java/java.html > and follow the links to
the PGP compatible mail applet.

Hal





From unicorn at schloss.li  Sat Jun 15 18:49:22 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sun, 16 Jun 1996 09:49:22 +0800
Subject: The Louisville Desktop Publishing Conference
In-Reply-To: <m0uUnC3-00035gC@mail.iglou.com>
Message-ID: <Pine.SUN.3.93.960615171327.25332A-100000@polaris>


On Sat, 15 Jun 1996, Blake Wehlage wrote:

> Hey are any of you guys (& ladies) going to the Louisville (KY) Desktop
> Publishing Conference? Well if you are I hope to see you there and mybee we
> could have lunch and talk about crypto & any other hot topics. 
> 
> The conference is July 30th, 1996. At the Hyatt Regency. Topics include
> Beginners & experts look on DTP, Graphic software, Internet, Publishing on
> the net, and many more topics. E-mail : INFO at natsem.com for more
> information. And you ask how does a 13 year old come up with the 195 dollers
> to go? I didn't my mother, Debby Wilkerson, is one of the Presentors. 
> 
> Hope to see one or more of you there. 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Blake "Pokey" Wehlage Age-13 Gaa- 3.69 (for ice hockey goalie)
> <jwilk at iglou.com> My page- http://www.iglou.com/members/jwilk.html
> Quote- Does whiskey count as beer? -Homer Simpson          
> 


Look, "we" are very pleased at your interest in the list.  "We" are happy
to accept all manner and age of persons be they 13, 31, 113 or 131.  "We"
do not filter messages on a list wide basis (though individuals may).  In
return we ask only that you post things related to crypto and crypto
anarchy.  This may or may not include the law/political/libertarian rants
I post, but it certainly does not include plugs for graphic software
conferences in Kentucky.

This is not a direct mailing list.  It is not a general announcement list.
Mr. Metzger is quite right when he points out that cypherpunks has become
a sewer.  Signal to noise ratio has become so silly as to even begin to
offend >me<.  I appreciate that you have found a new group of interesting
people, ideas and intellects.  Please try to restrain your enthusiasm to
below the point where it causes you to post every single thing that comes
to your mind.

Lets all take pains to counter the birth-growth-broadening-death cycle
that plagues most mailing lists, yes?

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From kooltek at iol.ie  Sat Jun 15 18:50:49 1996
From: kooltek at iol.ie (Hack Watch News)
Date: Sun, 16 Jun 1996 09:50:49 +0800
Subject: Fuseable Links - no guarantees??
Message-ID: <199606152107.WAA28424@GPO.iol.ie>


>At 11:44 PM 6/14/96 -0400, Warren wrote:
>>I have never paid much attention to the protection of firmware or the
>>technical issues revolving around such schemes...was wondering:
>>
>>I recently saw an add for a UK based group that says they can take a PIC
>>OTP micro and read the prom (for a fee, of course) - How the heck is this
>>done?? I have my suspicion that they (somehow) magically peel off the
>>ceramic coating (without destroying the chewy center), get a circuit mask
>>and 'micro probe' the I/O of the IC...they then download the secret recipe
>>to the afore mentioned 'chewy center'.

The advert was probably for a device/program called PICBUSTER. This is
basically a technique of popping the PIC16C84 microcontroller. The chip is
an EEPROM micro. There are a few ways of popping the chip but the simplest
is to ensure that there is set the supply voltage to the programming voltage
less about 0.7 Volts. This is generally done with the aid of a diode such as
the 1N4148. Then the fuses are reset. For normal programming there should be
at least 5 Volts differential. The smaller differential seems to only allow
the protection to be popped. It is not a fusible link as such.

If you want to read the details they are on
http://www.iol.ie/~kooltek/picbust.html

>>
>>Is this close to accurate?? How is it 'done' ???
>
>
>While I have never come even close to needing to attempt this kind of thing, 
>long ago it occurred to me that if the "no read" bit was stored in a 
>programmable bit, and if the location of that bit was known or could be 
>identified, you could expose that particular bit through a tiny mask hole 
>and cause the part to be readable again.  Locating that bit (assuming 
>there's just one) would be relatively simple:  Take a test part, program it, 
>read-lock it, and then expose it to a VERY slowly sliding mask with UV 
>behind.  Do this for both axes, to find the bit's location on the chip.

Apparently the protection fuse in the EPROM versions of the microcontrollers
are fairly readily identifiable. Most of the OTP microcontrollers are
essentially EPROM types without the quartz glass window. 

The commonest procedure for popping these is to first remove the coating and
then to measure accurately where the protection fuse is. Then, with another
that is to be popped, a small hole is drilled over the fuse area. The
drilling operation stops before reaching the silicon die. Then some strong
acid, either Sulphuric or Nitric is dropped in to disolve the coating. Then
a UV lamp is shone on the fuse to reset it.

The latter techique for popping chips is by far the most dangerous. It
requires proper acid handling procedures and good ventilation. 

Another technique is to fool the microncontroller into switching from
internal to external EPROM and then back. This hack generally works on the
8051, 8751, 8052 and 8752 microcontrollers.

I was coincidentally just finishing a section on popping chips for a book
that I am working on :-)

Regards...jmcc
(John McCormac)
********************************************
John McCormac            * Hack Watch News
jmcc at hackwatch.com       * 22 Viewmount, 
Voice&Fax: +353-51-73640 * Waterford,
BBS: +353-51-50143       * Ireland
********************************************

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6

mQCNAzAYPNsAAAEEAPGTHaNyitUTNAwF8BU6mF5PcbLQXdeuHf3xT6UOL+/Od+z+
ZOCAx8Ka9LJBjuQYw8hlqvTV5kceLlrP2HPqmk7YPOw1fQWlpTJof+ZMCxEVd1Qz
TRet2vS/kiRQRYvKOaxoJhqIzUr1g3ovBnIdpKeo4KKULz9XKuxCgZsuLKkVAAUX
tCJKb2huIE1jQ29ybWFjIDxqbWNjQGhhY2t3YXRjaC5jb20+tBJqbWNjQGhhY2t3
YXRjaC5jb20=
=sTfy
-----END PGP PUBLIC KEY BLOCK-----






From unicorn at schloss.li  Sat Jun 15 18:52:21 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sun, 16 Jun 1996 09:52:21 +0800
Subject: Remailer Operator Liability?
In-Reply-To: <Pine.LNX.3.93.960615013332.641C-100000@smoke.suba.com>
Message-ID: <Pine.SUN.3.93.960615172223.25332B-100000@polaris>


On Sat, 15 Jun 1996, snow wrote:

> On Fri, 14 Jun 1996, John A. Perry wrote:
> 
> > 	Now that the CDA decision has been made, I was wondering how this
> > would affect the liability status of the various remailer operators? In
> > the past several remailers have opted to discontinue service due to
> > legal/political pressure. Will this CDA decision help to decrease remailer
> > operator liability?
> 
> 	I seem to get the idea that the problem is more in the realm of
> civil suits than problems with "direct" legality. I say direct, because
> IANAL and I don't know the correct way to phrase it. 

The distinction you seem to be looking for is civil v. criminal.

> 
> 	Saying it another way, it currently isn't the FBI that is the
> problem, but rather the CO$.

I agree.  This is one reason multi-jurisdictional services are going to
have to be formed.  At some point it is going to come down to, quite
simply, a law v. technology issue.  Crypto is simply too difficult, to
slippery to regulate.  See e.g., Clipper, France, ITAR, and other
sillys.  At some point remailers will be too.

Recognize that crypto and anonymous information distribution technologies
are alike in this fashion.

> Petro, Christopher C.
> petro at suba.com <prefered for any non-list stuff>
> snow at crash.suba.com
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From jwilk at iglou.com  Sat Jun 15 18:52:41 1996
From: jwilk at iglou.com (Blake Wehlage)
Date: Sun, 16 Jun 1996 09:52:41 +0800
Subject: CYPHERPUNKS
Message-ID: <m0uV36X-000357C@mail.iglou.com>


Ok, here is the thing I feel and I know that I really am a main factor for
the unraveling of the true meaning of the mailing lists. I have had many
posts that were unappropiate, and very stupid. That is why I am
unsubsribing, and will no longer make posts to the list. You can still reach
me at jwilk at iglou.com

I do though feel I have picked up some very needed knowledge of PGP and
crypto. Thank you. I still will keep the title of youngest cypherpunk with
pride.

Blake Wehlage
<jwilk at iglou.com>
URL: http://www.iglou.com/members/jwilk.html
"World's Youngest Cypherpunk" Age 13






From unicorn at schloss.li  Sat Jun 15 18:54:01 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sun, 16 Jun 1996 09:54:01 +0800
Subject: 
In-Reply-To: <m0uUzit-00035cC@mail.iglou.com>
Message-ID: <Pine.SUN.3.93.960615172900.25332D-100000@polaris>


On Sat, 15 Jun 1996, Blake Wehlage wrote:

> At 09:33 AM 6/15/96 -0400, Michael Camp wrote:
> >
> >I just subscribed and what the hey is pgp.  Pretty good privacy?  
> >
> >
> >-Think global, act local, recycle!
> >Michael Camp
> >a037716t at bcfreenet.seflin.lib.fl.us
> >
> >
> >
> >
> Good thinking swiffty

You know, you were accepted pretty seamlessly when you subscribed.
Perhaps you might reconsider your flame above after reflecting on the
purpose of the list.

> Blake Wehlage
> <jwilk at iglou.com>
> URL: http://www.iglou.com/members/jwilk.html
> "World's Youngest Cypherpunk" Age 13
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From johnhemming at mkn.co.uk  Sat Jun 15 18:57:07 1996
From: johnhemming at mkn.co.uk (John Hemming - CEO MarketNet)
Date: Sun, 16 Jun 1996 09:57:07 +0800
Subject: Proposal: PGPmail Plugin for Netscape/Mosaic
Message-ID: <1996-Jun15-230011.1>


The suggestion of building in PGP keys into web pages is something
that I have operated on http://mkn.co.uk/ for around 10 months.

The program that incorporates this is
ftp://ftp.mkn.co.uk/mktnet/pub/horse.zip which is a PGP implementation
that is independent of PGP per se.







From gary at systemics.com  Sat Jun 15 19:10:11 1996
From: gary at systemics.com (Gary Howland)
Date: Sun, 16 Jun 1996 10:10:11 +0800
Subject: Fuseable Links - no guarantees??
In-Reply-To: <v02140701ade8a5dbd914@[204.167.110.204]>
Message-ID: <31C3343D.2F1CF0FB@systemics.com>


Warren wrote:
> 
> Jim;
> 
>         I was under the impression that a fuseable link was literally a
> piece of conductive material that you deliberatley 'blow-away' - In most
> cases, couldn't you simply 'tap into' the data side of the fuse, and
> download the info??
> 
> >At 11:44 PM 6/14/96 -0400, Warren wrote:
> >>I have never paid much attention to the protection of firmware or the
> >>technical issues revolving around such schemes...was wondering:
> >>
> >>I recently saw an add for a UK based group that says they can take a PIC
> >>OTP micro and read the prom (for a fee, of course) - How the heck is this
> >>done?? I have my suspicion that they (somehow) magically peel off the
> >>ceramic coating (without destroying the chewy center), get a circuit mask
> >>and 'micro probe' the I/O of the IC...they then download the secret recipe
> >>to the afore mentioned 'chewy center'.


Rumour has it that it is done like this:

"To read a protected 16C84 make sure your VPP is 13.5 volts, then VCC should  
be about .5 volt less, I dont know about the accuracy of this one person  
told me he used a diode thet is .6 volts. now write the value 0x001f to the  
fuse 0x2007 about 3-10 times switch back to standard and read the chip. " 

It may or may not work - I would be interested if anyone can confirm it.


Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06





From hfinney at shell.portal.com  Sat Jun 15 19:34:32 1996
From: hfinney at shell.portal.com (Hal)
Date: Sun, 16 Jun 1996 10:34:32 +0800
Subject: pretty good reputation
Message-ID: <199606152009.NAA01934@jobe.shell.portal.com>


From: Vipul Ved Prakash <vipul at pobox.com>
> by what i understand pgp's "web of trust" scheme has flaws. according to 
> pgp (alice trusts jane, jane trusts snoopy, bob trusts alice) implies 
> bob trusts snoopy.

No, this is not true.  PGP does not implement any form of trust
delegation as you have described here.  Rather, each person must
explicitly indicate that they trust someone as a key signer.  Without
that individual action, snoopy and bob in the above example are useless
to alice as key signers.

What PGP does do is that if alice has indicated that she trusts jane and
snoopy, and she needs a key for bob, she can use bob's key signed by
snoopy and snoopy's key signed by jane to decide that she has a good key
for bob.  Just having bob's key signed by snoopy is no good, even if
alice trusts snoopy, because she can't be sure that she actually has
snoopy's key.  So she needs snoopy's key signed by someone else that she
trusts, in this case jane.

> what is required is a reputation system wherein trust is  _qualified_ 
> rather than _quantified_. its senseless to say i trust him five units.
> it will be more appropriate if pgp has a separate tag for "type of trust"
> or something like that. 
> 
> this kind of thing can be difficult to handle, since it a fuzzy 
> parameter. add to the problem a global-system like internet where all 
> communication is not person to person. i was wondering if there are 
> any working mathematical models for reputation systems, and how 
> successful they are.

There was considerable discussion in the design of PGP's key signatures
on this issue, and Phil decided against trying to let people express
publicly how much they trust others.  Among other things, he was afraid
that people would feel compelled to lie for social reasons, leading to
inaccurate trust estimates and weak key validations.

There has been considerable discussion in the "official" Internet
encryption working groups (PEM and its follow-ons, for example) about
issues of trust in the context of Certificate Authorities which exist in
a hierarchical structure and sign each others' as well as end users'
keys.  Different CA's may have different policies about how they check
identity, and figuring out from this how much trust to put in a key
certificate ends up being a potentially messy problem.

I also found a paper several years ago, I think by the USC/ISI
people, about systems which would allow trust delegations in a model more
like the web of trust.  Also some of the recent work by Matt Blaze and
(largely independently) Ron Rivest for generalizations of key
certificates could perhaps serve as a basis for extending trust in a web
model.

Hal Finney





From norm at netcom.com  Sat Jun 15 19:40:22 1996
From: norm at netcom.com (Norman Hardy)
Date: Sun, 16 Jun 1996 10:40:22 +0800
Subject: If you knew what we knew ...
Message-ID: <ade8f39f0002100471d1@DialupEudora>


The following is a paragraph from the executive summary of the NRC Crypto
policy paper: "Cryptography's Role in Securing the Information Society".

The conduct of the debate regarding national cryptography policy has been
complicated because a number of participants have often invoked classified
information that cannot be made public. However, the cleared members of the
National Research Council's Committee to Study National Cryptography Policy
(13 of the 16 committee members) concluded that *the debate over national
cryptography policy can be carried out in a reasonable manner on an
unclassified basis*. Classified material is often important to operational
matters in specific cases, but it is neither essential to the big picture
of why cryptography policy is the way it is nor required for the general
outline of how technology will and policy should evolve in the future.







From nobody at flame.alias.net  Sat Jun 15 19:47:43 1996
From: nobody at flame.alias.net (Anonymous)
Date: Sun, 16 Jun 1996 10:47:43 +0800
Subject: alpha.c2.org in deep shit?
Message-ID: <199606152148.XAA21412@basement.replay.com>


Am I the only one who receives apparently empty messages
for my alpha.c2.org account?





From WlkngOwl at unix.asb.com  Sat Jun 15 20:01:13 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 16 Jun 1996 11:01:13 +0800
Subject: Sorry about that last forward
Message-ID: <199606152301.TAA08100@unix.asb.com>


Sorry about that. My mailer sometimes splits the forwards, so the 
c'punks header is filed correctly but the message goes into my 
general folder.

Rob.
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From cato at df.lth.se  Sat Jun 15 20:03:35 1996
From: cato at df.lth.se (Krister Walfridsson)
Date: Sun, 16 Jun 1996 11:03:35 +0800
Subject: Cryptology and knot theory?
In-Reply-To: <UlkgMQq00YUwQ3hq13@andrew.cmu.edu>
Message-ID: <Pine.VUL.3.91.960616003502.25074B-100000@marvin.df.lth.se>


Hej!

I've finally got the time to read "Cyphernomicon", and in chapter 5 
(Cryptology) and 17 (The Future) I found this, which I think looks 
interesting, since I'm interested in computational topology.

    5.5.9. Miscellaneous Abstract Ideas
             [...stuff deleted...]
             - links to knot theory

    17.10.3. Ciphers are somewhat like knots...the right sequence of moves
             unties them, the wrong sequence only makes them more tangled. 
             ("Knot theory" is becoming a hot topic in math and physics
             (work of Vaughn Jones, string theory, etc.) and I suspect
             there are some links between knot theory and crypto.)
 
Has any work been done along those lines?

I did some searches with AltaVista, but I only found Cyphernomicon...

   /Krister





From unicorn at schloss.li  Sat Jun 15 20:19:58 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sun, 16 Jun 1996 11:19:58 +0800
Subject: pretty good reputation
In-Reply-To: <199606142000.BAA00199@fountainhead.net>
Message-ID: <Pine.SUN.3.93.960615173035.25332E-100000@polaris>


On Sat, 15 Jun 1996, Vipul Ved Prakash wrote:

> a pretty good detour. 
> 
> by what i understand pgp's "web of trust" scheme has flaws. according to 
> pgp (alice trusts jane, jane trusts snoopy, bob trusts alice) implies 
> bob trusts snoopy. this means that alice trusts jane to the extent, that 
> if jane trusts a third person, then a fourth person who trusts alice 
> automatically trusts that third person. deducing such results from a 
> simple shades of trust system cannot lead to a reliable web of trust.
> thats common sense.
> 
> what is required is a reputation system wherein trust is  _qualified_ 
> rather than _quantified_. its senseless to say i trust him five units.
> it will be more appropriate if pgp has a separate tag for "type of trust"
> or something like that. 

Concur.
I suggested this kind of taging of signatures coupled with specific yes/no
questions from pgp to narrow down the meaning and scope of trust extended
by a given signature.


> 
> this kind of thing can be difficult to handle, since it a fuzzy 
> parameter. add to the problem a global-system like internet where all 
> communication is not person to person. i was wondering if there are 
> any working mathematical models for reputation systems, and how 
> successful they are.
> 
> vipul ved prakash
> 
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From WlkngOwl at unix.asb.com  Sat Jun 15 20:40:51 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 16 Jun 1996 11:40:51 +0800
Subject: (Fwd) The FCC wants you!!!
Message-ID: <199606152259.SAA08061@unix.asb.com>


Not crypto related, but some strange spam that hit my box.

I'm just curious as to why this was sent to me, and where my address 
was gleaned from.

------- Forwarded Message Follows -------
Date:          Sat, 15 Jun 1996 00:12:58 -0700 (PDT)
From:          Michael Dillon <michael at memra.com>
To:            nanog at merit.edu
Subject:       The FCC wants you!!!
Organization:  Memra Software Inc. - Internet consulting


If you know American ISP's who don't normally hang out on ISP mailing
lists or if you have any contacts in the educational system who are
concerned with the cost of technology, then please forward this message to
them. Here is the opportunity for direct political action that really can
make a difference without requiring well-funded intermediaries and
lobbiests...

Michael Dillon                                   ISP & Internet Consulting
Memra Software Inc.                                 Fax: +1-604-546-3049
http://www.memra.com                             E-mail: michael at memra.com

---------- Forwarded message ----------
Date: Fri, 14 Jun 1996 22:13:01 -0600 (MDT)
From: Dave Hughes <dave at oldcolo.com>
Reply-To: inet-access at earth.com
To: inet-access at earth.com
Subject: Re: Accuracies of My Own
Resent-Date: Fri, 14 Jun 1996 23:14:53 -0500 (CDT)
Resent-From: inet-access at earth.com

Jack Rickard says:
> 
> In any event, my perception is that Dave is always early to the table, and 
> by the time the world is ready to buy something, he's already moved on.  I 
> was vaguely aware of his wireless activities, and somewhat more interested 
> in them with the recent NIIBand proposals.  There ARE some issues and I do 
> hope Dave is successful in steering this toward the 15 km version as 
> opposed to the limited range Wireless LAN version some of the big guys seem 
> to be determined to push through.
> 
> In fact, this is actually a rather key issue specifically for Internet 
> Service Providers and more specifically for those in rural areas.  As a 
> newbie to the mailing list, I may be reintroducing something that has 
> already been done to death.  But this NIIBand could be a huge advantage for 
> small ISP's in rural areas (not JUST academia and K-12 Dave) if done right, 
> and another fiasco if done wrong.  The FCC has this open for comment now. 
>  If Mr. Hughes would provide info on docket numbers and where to write, you 
> all could have a significant impact.  On the one hand, you can offer 24 
> Mbps links by radio at 10-15 km.  On the other, 3COM can do wireless LAN 
> inside a building for about 1000 feet.  All from a stroke of the FCC pen.
> 
> 
Yes, this is a far more significant issue than most ISPs realize - whether
the FCC, in both responding to the Apple-WINForum proposal to allocate
350Mhz of spectrum in the 5Ghz bands for what the FCC dubbed the 
"NII/SUPERNET" Band for 'no licence' wireless - will do that in BOTH
the 'wireless lan' segment AS WELL AS the requested '15 km' segments
and thus permit anyone, including ISPs to have no-comm cost bandwidth
up to 2Mbps between two points, or, with relay, 1Mbps (above and
below T-1) for the cost of the radios. Spread spectrum technology which
is a revolution in radio communications (wide band, digital processor
controlled low power - with no practical interference versus traditional
narrow frequency band high power - with so much interferecne, the 
frquencies have to be licenced and highly controlled).

And yes I, and a too-small handful of others are deep into the issues
at the FCC level as the decision hangs in the balance. Because I
am the Principal Investigator on the $375,700 'Wireless Field Test
for Education Project' I was invited to a roundtable with FCC
Commissioners nominally debating 'wireless for education' two weeks
ago, and, using our real-world wireless project going on in the
San Luis Valley (one school being relaibaly connected now 15 miles
at 115kbs, bypassing US West, from NT-Lan router to Cisco Router
at the POP. Zero local loop cost) and reporting on the other
projects we have examined (8 Belen, New Mexico Schools, conected
T-1 between each other in a WAN - up to 10 miles across the district.
Zero local loop cost (which would normally run $84,000 a year wiht
telco T-1 between schools).

We made an impression, but know what giant forces we are up against.
Some FCC staffers want to 'auction' the longer range (even 15km)
stuff. Some big communications companies, led by the Cellular 
Telecommunications Industry Assn - CTIA, would like all 'no-licence'
that can compete with them to be killed. 

Our arguements, that got a few thinking anyway, was that IF the FCC
rules permit radios to be made which go 15-45 miles, no licence,
no interference, and solve the problem of the 16,000 school
districts whose biggest problem is the cost of bandwidth *between*
school building of a district first, then the cost from the main
hub to the POP, second, then between the student and/or teacher
at home to the school, at 56kbs or above, THEN the problem of
'community' networking will also be solved. For school districts
are coincident where people live and log on from. (ditto ISPs)

We turned a few heads when I showed my calcuations that, if
the 14 School Districts of the SanLuis Valley are connected to
the one central POP at T-1 by US West, it will cost $1.2 million
over 10 years. If by T-1 25mile radios (yeas they exist now)
it will cost $173,000 for the same 10 years. 

Now if ISPs want to strike a blow for economic telecom freedom, 
you can start by accessing our NSF Wireless Field Test web site,
 http://wireless.oldcolo.com  and go into the Regulatory section
where you will find direct documents, links to the FCC, the
Belen Paper, and my long but piercing piece 'The Case for 
Public Spectrum' (and if you are a skeptic about the technology,
read the Paul Baran short papers - the invetor of packet switching)

Then all you have to do to sumbit public comments o the NIIBand
matter is to email:

            96-102 at fcc.gov

and that is the email address for the Docket Item. You *must* comment
before July 15th, or yours will not be considered. (but under the law
and regulation, if you *do* comment, your comments must be summarized
by the staff and presented to the COmmissioners with the staff 
views. 

You do NOT have to comment on all the heavy duty technical issues.
Right from the chief FCC Engineer who drafts the rules, and was
the father of the original Spread Spectrum rules in 1985 he
says that your statemnt of what you NEED, and why, would be
much appreciated. As simple as 'I am an ISP who needs T-1 from
my site, 8 miles to the nearest POP, no licence/cost wirless,
with a radio I can afford' is to the point. (of course the more
you show your technical economic need in sophisticated terms
the better it will be received. The FCC engineers are no dummies
and political handwaving doesn't impress them (it only impresses
the COmmissioners whenthe handwavers are called AT&T or Congress)

I can just about assure you the FCC staff doesn't even know you
exist, as a class, (small ISPs) or what function you serve in the
food chain, or why you shouldn't just pay $650 a month for your
local loop T-1 like anybody else. And unless you email them
(and they now have a policy that email must be taken as seriously
as formal paper mail filings), your colective case won't even
be mentioned when the likes of Motorola, AT&T, CTIA, the NSA
(who gets gas pains when secure wireless is mentioned) are
testifying.

All will not be totally lost if this NPRM does not fly (new
spectrum) for we still have the more congested Part 15, 1 watt
bands. And the 4 NSF types who attended the FCC rountable
were impressed enough with our case that we spent a day with them
and they are about to fund a 'developmental' project that will
be done by TAPR, that may bring you that $500 T-1 plug and play
radio, with range. (by licencing the guts to mfgrs).

Matter of fact I will be in Washington DC at the NSF Monday
on this (being carrie dby my sidekick in radio engineering
matters) and two other matters. One of which will (their idea,
not ours) see part of our team in Ulaanbaatar, Mongolia in
August, linking 8 sites to the satellite Spintlink downlink
site run by Mongolian engineers in an old Soviet lab. (web
page at www.magic.mn already - but they can't get the signal
across town, so crappy is their phone system). So by September
you willbe pinging systems in Mongolia, the last 10km of
which will be wireless.

I always wanted to help set up the Ghengis Khan BBS in a Mongolian
yurt, running OS2 (cause IBM is everywhere), with NAPLPS character
sets (Chinese, Cyrilli Russian, and Mongolian - none of which
are ascii), solar powered, and with spread spectrum radios
linking China to Russia. With nary a Telco in a hundred miles.
And I got a hunch I will have that done before ISPs in NYC
do it.

Dave Hughes
dave at oldcolo.com

Oh yeah, if you http://192.160.122.3  you will reach, by wireless,
the OS2 system in my home. Not blazingly fast beacause I
am trying out a different set of radios. And teh wired 56kbs
frame relay to which it is attached is actuallythe slowest link
in the chain. But its been running 160kbs for almost a year now,
for $0 cost from me to my own Internet service.  









From perry at piermont.com  Sat Jun 15 21:00:27 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 16 Jun 1996 12:00:27 +0800
Subject: Cryptology and knot theory?
In-Reply-To: <Pine.VUL.3.91.960616003502.25074B-100000@marvin.df.lth.se>
Message-ID: <199606152350.TAA14182@jekyll.piermont.com>



Krister Walfridsson writes:
>     17.10.3. Ciphers are somewhat like knots...the right sequence of moves
>              unties them, the wrong sequence only makes them more tangled. 
>              ("Knot theory" is becoming a hot topic in math and physics
>              (work of Vaughn Jones, string theory, etc.) and I suspect
>              there are some links between knot theory and crypto.)
>  
> Has any work been done along those lines?
> 
> I did some searches with AltaVista, but I only found Cyphernomicon...

I would have my doubts about how interesting the direction could get,
since knot theory is a dead area. The classification problem was fully
solved, and after that things got boring...

Perry





From markm at voicenet.com  Sat Jun 15 21:44:08 1996
From: markm at voicenet.com (Mark M.)
Date: Sun, 16 Jun 1996 12:44:08 +0800
Subject: Proposal: PGPmail Plugin for Netscape/Mosaic
In-Reply-To: <199606152019.NAA02248@jobe.shell.portal.com>
Message-ID: <Pine.LNX.3.93.960615203041.847A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Sat, 15 Jun 1996, Hal wrote:

> There was a little discussion about this on the coderpunks list, but I
> didn't get the impression that anyone was ready to run out and do it.
> I'm not sure whether plugins could also be used for receiving mail in
> addition to sending, but if so it does seem like a good way to add the
> functionality.

Netscape does have support for MIME.  So if PGP/MIME ever becomes more widely
used, the Netscape mail program would decrypt and verify emails automatically.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMcNWVLZc+sv5siulAQECuAP9EuKY4slviJ5W8FajzcO6B8LnT8BJo98W
8LOtXkKi+j8MZyX3jaX2Elpd3xrFzx1fSg4s7ZNQ/0RmfkPXK0TKeex+2Fh7zwME
mMYbLo3MEJuDh38g8FD4LZpnEC+I++X3tns5rlF9zp0LGSwnWiqjfT1w2uJCzGX2
GHncIh40eic=
=pEkp
-----END PGP SIGNATURE-----





From llurch at networking.stanford.edu  Sat Jun 15 21:53:32 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sun, 16 Jun 1996 12:53:32 +0800
Subject: Attorney General wants to "expand crypto laws"
In-Reply-To: <v02120d49ade8caca1c01@[192.0.2.1]>
Message-ID: <Pine.GUL.3.93.960615173651.4873A-100000@Networking.Stanford.EDU>


According to the information at http://www.sfgate.com/~common/, the speech
might be reproadcast on San Francisco's KEST-AM (1450), Monday 12:00 to
12:45 a.m. PT. See listings for other times and stations around the
couuntry.

Unfortunately, I only caught the second half of her speech, missing the
encryption bits. My rommate tells me she came out pro-encryption but very
pro-GAK. 

I don't think transcripts are available, but enterprising individuals may be
able to obtain audiotapes from the Commonwealth Club library.

-rich






From markm at voicenet.com  Sat Jun 15 22:16:16 1996
From: markm at voicenet.com (Mark M.)
Date: Sun, 16 Jun 1996 13:16:16 +0800
Subject: Comments on MicroPayments and the Web
In-Reply-To: <199606132222.PAA09190@jobe.shell.portal.com>
Message-ID: <Pine.LNX.3.93.960615203526.847B-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Thu, 13 Jun 1996, Hal wrote:

> Where does the money come from to run this proxy?
> 
> Consider two sites, one which acts as a proxy and cache but which
> charges something under a penny per page, and another which acts for
> free.  Won't the for-pay site be able to afford a larger disk, more
> servers, and better net connections?  It will be a superior service.
> 
> Micropayments will allow new services and improved quality over what we
> have today where we have to rely on charity and advertising as
> motivations for much of what we find on the web.

Who says that such a proxy needs to be run on a different machine?  For UNIX
users with a SLIP/PPP connection, it is trivial to run a web proxy that could
be pointed to by web browser.  I believe that this is also possible for Mac
and Windoze users.  The point of the proxy is not to keep the user's username
or hostname anonymous, so it does not necessarily need to run on a seperate
host.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMcNXibZc+sv5siulAQFghAP/Ru/+82shqQ4GTNpXiMzjdyRQG3JAYJXz
WEf0tYjdTjIGrBYVbj+ECGsxBe+QXGCQSUrsDx6kVjjUVJ72P9TOccbFJ58EzXOc
YlVIx17kgAN959fnamU8NLd8cvPDwCvevGKnsQzh5nLuwgKx+6Gu22BmFKazfpJZ
Ihei1V9upuQ=
=yXZl
-----END PGP SIGNATURE-----





From dlv at bwalk.dm.com  Sat Jun 15 23:52:33 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Sun, 16 Jun 1996 14:52:33 +0800
Subject: alpha.c2.org in deep shit?
In-Reply-To: <199606152148.XAA21412@basement.replay.com>
Message-ID: <NRFLPD61w165w@bwalk.dm.com>


nobody at flame.alias.net (Anonymous) writes:

> Am I the only one who receives apparently empty messages
> for my alpha.c2.org account?

Your postmaster probably got it too.

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From jya at pipeline.com  Sun Jun 16 00:15:43 1996
From: jya at pipeline.com (John Young)
Date: Sun, 16 Jun 1996 15:15:43 +0800
Subject: Non-Lethal Terrorism
Message-ID: <199606160233.CAA15426@pipe5.t2.usa.pipeline.com>


   For background on the recent cyber-terrorists reports from 
   London, we offer the Council on Foreign Relations' 1995 
   report: 
 
                      NON-LETHAL TECHNOLOGIES 
                 Military Options and Implications 
                Report of an Independent Task Force 
 
   The long history of military operations has been marked by 
   steady increases in the lethality of weapons. U.S. 
   commanders and policymakers face excruciating dilemmas in 
   decisions to use lethal force. They strive to maximize 
   protection of their own troops and to minimize collateral 
   casualties among noncombatants. Authoritarian regimes -- as 
   in Iraq -- and factions in civil wars -- as in Bosnia -- 
   may see fear of American casualties as one factor in 
   deterring intervention against them. Terrorists, guerillas, 
   and other irregular forces often exploit noncombatant 
   populations by mounting attacks from their midst. 
 
   Can technology, ease these dilemmas by providing 
   acceptable, effective non-lethal capabilities to supplement 
   conventional weapons across a broad spectrum of conflict? 
   In major wars or similiar cases of high-level violence, can 
   such capabilities reduce the risk to U.S. forces by, in 
   effect, substituting technology for manpower in performing 
   certain missions, for example, by shutting off power 
   transmission and communications of adversaries? In 
   situations short of traditional warfare -- for example, the 
   humanitarian intervention in Somalia -- can non-lethal 
   systems help provide calibrated coercion proportional to 
   the objectives? How do they relate to the lethal systems on 
   which U.S. forces depend? What policy issues do such 
   technologies pose? In this report a bipartisan task force, 
   including former Air Force and Army chiefs of staff, 
   leading scientists, and other experts, examines these 
   questions. The task force concludes that a number of 
   non-lethal technologies deserve serious consideration in 
   U.S. planning and development for future military 
   contingencies. 
 
 
   http://pwp.usa.pipeline.com/~jya/nltech.htm  (47 kb) 
 
   Beware snooping, consider using the anonymizer at: 
 
   http://www.anonymizer.com 
 
   ----- 
 
   Or, if http fails, NLT_ech to <jya at pipeline.com> 
 
 
 
 
 





From llurch at networking.stanford.edu  Sun Jun 16 00:30:44 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sun, 16 Jun 1996 15:30:44 +0800
Subject: alpha.c2.org in deep shit?
In-Reply-To: <199606152148.XAA21412@basement.replay.com>
Message-ID: <Pine.GUL.3.93.960615202748.4873B-100000@Networking.Stanford.EDU>


On Sat, 15 Jun 1996, Anonymous wrote:

> Am I the only one who receives apparently empty messages
> for my alpha.c2.org account?

No. Since late Thursday.

-rich






From adamsc at io-online.com  Sun Jun 16 00:33:43 1996
From: adamsc at io-online.com (Chris Adams)
Date: Sun, 16 Jun 1996 15:33:43 +0800
Subject: More secure web browser
Message-ID: <199606160255.TAA20231@toad.com>


This is all I got from the anonymizer test site (URL was posted  
recently).
 
<BR> Your Internet browser is IBM-WebExplorer-DLL/v1.1b.
 
<BR> You are coming from .

Seems reasonably private. Unfortunately, it's not an option if you  
don't use OS/2...









From WlkngOwl at unix.asb.com  Sun Jun 16 00:52:39 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 16 Jun 1996 15:52:39 +0800
Subject: pretty good reputation
Message-ID: <199606160331.XAA12152@unix.asb.com>


On 15 Jun 96 at 13:09, Hal wrote:
[..]
> There was considerable discussion in the design of PGP's key signatures
> on this issue, and Phil decided against trying to let people express
> publicly how much they trust others.  Among other things, he was afraid
> that people would feel compelled to lie for social reasons, leading to
> inaccurate trust estimates and weak key validations.

Good point.

Any system with multi-valued or yes/no signatures becomes 
unresolvable in a web, making these values useless beyond an order or 
one or two levels.

We've argued about this before on the list...

Another interesting point, though: feature creep.  Something like 
that may be another intimidating factor that turns people off from 
PGP.

Rob

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From take at barrier-free.co.jp  Sun Jun 16 01:09:50 1996
From: take at barrier-free.co.jp (Hayashi_Tsuyoshi)
Date: Sun, 16 Jun 1996 16:09:50 +0800
Subject: MITI began to develop electronic notary system
Message-ID: <199606160406.NAA00481@ns.barrier-free.co.jp>


A small report.

-----BEGIN PGP SIGNED MESSAGE-----

Sun Jun 16 JST 1996,
Nihon Keizai Shinbun (called as "Nikkei" in Japan),
Side: 1

## XURL: X.16Jun1996JST.newspaper:xy//Nikkei/1/x210y0/
====

# NOTE: [insufficient] translated and summarized by me.
#
#	[untrusted] ... Because I don't use English very
#	well.  Sorry.  I recommend that you will read a
#	English version of Nikkei Shinbun.

o MITI (Japanese Government's Ministry of International
Trade and Industry) began to develop electronic notary
system with some biggest computer company in Japan;
Hitachi, Nihon I.B.M., NEC and Fujitsu.  Some Japanese
bigger bank (such as Daiichi-Kangyo Bank) will also take
part in it.

o It seems to me (by reading this article) that MITI want
to develop Japan-original technology for the electronic
notary system.

o Milestone of the plan:

 - Misc. preparations for it until the end of 1996.
 - Doing experimental examination in 1997.

# I don't know that 1996/1997 are fiscal year (called
# "(kaikei-)nendo" in Japan) or not.  Japanese fiscal year
# starts April in every year.

o This system will be applied for following term:

 1) submitting of public docments to public offices,
 2) electronic commerce,
 3) electronic publishing,
 4) electronic warehouse service.

o IC card will be used in order to store digital key
information.

///

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBMcOHvNYQrW27B3yFAQEO2AP/YZsgZ+cQLrztUIQMmBeOC5X53RVlBldH
SHG/QkydKd37un5OYC5HMUBdqgCWO9jfVtrCdZg10i6QKeWsdz02m2HcmYTcArLv
X9i2+KRuih6eBtxaxKfKV97TZC9bVzbv4J3c+2YEU7C2KNFB/IbwEpoSzu4MOkYo
3uMwGJV9etc=
=h/sH
-----END PGP SIGNATURE-----

- Tsuyoshi Hayashi <take at barrier-free.co.jp>
- PGP public key: http://www.barrier-free.co.jp/take/pgpkey
- (CF 27 34 5B 46 FA 2A 12  D2 4C E3 F7 2A 45 E0 22)
- Barrier Free, Inc. (established on 25 Jan 1996)





From WlkngOwl at unix.asb.com  Sun Jun 16 01:30:39 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 16 Jun 1996 16:30:39 +0800
Subject: More info on this?
Message-ID: <199606160412.AAA12830@unix.asb.com>


Found this on the NY (Cyber)Times site (http://www.nytimes.com)
under This Weeks Stories...


          L exis-Nexis, one of the nation's leading private
          information brokers, has discontinued a new online
          offering that provided access to
          millions of individuals' Social Security numbers, after an
          onslaught of complaints from customers and the credit
          information bureau that originally supplied the data. 

          The service, which was offered by the company for 10 days
          before it was discontinued Monday, was one feature of the
          new "Lexis-Nexis P-Trak Person Locator" that Lexis-Nexis had
          developed to attract new business from law firms and
          law-enforcement agencies. 

          [..]






From hermit at bayview.com  Sun Jun 16 01:35:39 1996
From: hermit at bayview.com (William R. Ward)
Date: Sun, 16 Jun 1996 16:35:39 +0800
Subject: marketing "privacy": a nonproblem?
In-Reply-To: <199606142032.NAA28132@netcom4.netcom.com>
Message-ID: <199606160408.VAA16646@komodo.bayview.com>



Vladimir Nuri writes at length about an anonymous system for getting
on marketer's lists, so that they can target people who want to buy
widgets without having to compile a "dossier" on everyone to determine
who might want a widget.

The problem with this is that finding a list of widget-buyers is not
the only reason marketers collect these "dossiers"... They also do it
to sell/rent the information to other marketers, who may be selling
Thingamajigs or widget related services or something else entirely --
and the information which is extraneous to the widget marketer is
quite useful to the thingamajig vendor or other companies, and selling
that information is profitable for the marketing firm.  This is
probably one reason companies outsource marketing a lot, to take
advantage of the databases they have compiled on the consumers.

Mr. Nuri's scheme is wonderful for cypherpunks; we only get the junk
mail that isn't junk to us (since we're actually interested in widgets
or whatever they're selling), and they don't get to compile a
"dossier" on us.  However it isn't as wonderful for the marketers as
he suggests, or they would already be using such a scheme.

One of the most important tasks for marketers is how to find new
customers, who have never heard of widgets.  For this they need
information on customers to find who might like a widget; if you have
heard of a widget and signed up on Mr. Nuri's list, then that's fine,
but for the rest of us who don't even know what one *is* much less
whether we want one, the marketers need to do their traditional
dossier system.

The Net doesn't really change anything here.  We've had anonymity
through email and telephones for a long time.  But *we* have to call
*them* in order to get on the anonymous widget consumer's list using
Mr. Nuri's system; traditional marketing techniques proactively search
out consumers to get them on the list.

All that aside, I certainly would prefer it if the world worked in a
way to make Mr. Nuri's system practical -- I dislike having "dossiers"
on me kept by every marketer in the world, and do not like unsolicited
advertising, but I just don't believe that we live in that sort of
world.

--Bill Ward






From AwakenToMe at aol.com  Sun Jun 16 02:01:55 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Sun, 16 Jun 1996 17:01:55 +0800
Subject: [noise] (was Re: PBS show)
Message-ID: <960615224725_135852446@emout07.mail.aol.com>


In a message dated 96-06-15 16:15:17 EDT, perry at piermont.com (Perry E.
Metzger) writes:

>
>

new lows??? Its a rather reasonable question about the protected mode on the
intel chips considering the limits of 640K mem...Sorry if Im not as 'versed'
in proteected mode as you,master, seem to be. Oh please teach us lesser ones.
Gee. But..... Is it OK to go over encryption ran in straight ASM to you??
Would that maybe please you a little more oh mentor.
Gee.. Later god.
or is that............. nevermind.






From sophi at best.com  Sun Jun 16 02:08:41 1996
From: sophi at best.com (Greg Kucharo)
Date: Sun, 16 Jun 1996 17:08:41 +0800
Subject: Netscape Mail Security and PGP Plugins
Message-ID: <31C39529.133B6630@best.com>


There hasn't been a lot of discussion on this list about the future
of secure e-mail via Netscape. The most i've seen has come from
Raph Levien on the standards battle between S/Mime and other various
implementations including one using PGP. Raph has said at various
Cypherpunks meetings now that( and not wanting to totally put words in
his mouth) the PGP based implementations have lost ground to S/MIME.
 The reason I believe that this whole area has received so little
quarter on the list is that either few people use Netscape for e-mail
and that few people actually send encrypted e-mail.
 I'm going to try and put together a compendium of web links on this 
so it's a little easier to track the developments and various schemes.
 At the second to last Cypherpunks Bay Area meeting we had a discussion
of crypto GUI's. It's my opinion that Netscape would be an excellent
place to start because it does encryption relatively seemlessly.
Incorporating S/MIME into the mail would be a great step forward in
bringing easy crypto to the general community. Any PGP plugin I would
hope eleviate the many UI problems PGP has.
 A couple of questions I have right off the bat are;
 1. In Hal's Java mail encryptor, what are the legal aspects of
sending code across that contains crypto?
 2. Can any plugin access the Netscape Mail program.
 3. When is S/MIME going to be in Netscape, I tried to find info on the
web site but thier statements about S/MIME seem vague.
 I hope I'm not running over old ground, but this has to be alot more
intresting than discussing that PBS show!

Greg Kucharo
sophi at best.com





From vznuri at netcom.com  Sun Jun 16 02:25:29 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Sun, 16 Jun 1996 17:25:29 +0800
Subject: marketing "privacy": a nonproblem?
In-Reply-To: <199606160408.VAA16646@komodo.bayview.com>
Message-ID: <199606160455.VAA20513@netcom20.netcom.com>


by coincidence I'm logged in at the moment so will reply to
WRW immeidately;


>The problem with this is that finding a list of widget-buyers is not
>the only reason marketers collect these "dossiers"... They also do it
>to sell/rent the information to other marketers, who may be selling
>Thingamajigs or widget related services or something else entirely --
>and the information which is extraneous to the widget marketer is
>quite useful to the thingamajig vendor or other companies, and selling
>that information is profitable for the marketing firm. 

right. a marketing database. I agree. but realize that you can
still do the above without tying the information to *real*people*. the
system is ultimately only for *contacting*people*. you can do this
pseudonymously. the information about people can be dissociated
from their real identity. in all systems prior to cyberspace, one
tied information to real identities and a 3d physical location
called an "address"-- but in cyberspace you have a new kind of
address.

hence, is it possible to fulfill the demands of marketing while
preserving privacy? the point of my essay was to suggest that
perhaps marketing databases are not intrinsically privacy-hostile.

I have no problem with some company creating the marketing database.
just as long as there is some way of dissociating the knowledge
from real identities. in a good system, one does not rely on the
company to do so: they are forced to do so. if one could create
an entire system of money transactions that let them have their
info but at the same time never tied the info to real people, you'd
have privacy.  a crude method that exists today is to only use
pseudonyms when buying merchandise. another method would be to
have companies that do nothing but keep identities secret and
tie numbers with real things-- intermediate agents for purchasing
materials for us that protect our identity in all transactions.

> However it isn't as wonderful for the marketers as
>he suggests, or they would already be using such a scheme.

I believe a system that still lets the marketers have their databases
while preserving privacy .. that was the key idea behind the post.

>One of the most important tasks for marketers is how to find new
>customers, who have never heard of widgets.  For this they need
>information on customers to find who might like a widget; if you have
>heard of a widget and signed up on Mr. Nuri's list, then that's fine,
>but for the rest of us who don't even know what one *is* much less
>whether we want one, the marketers need to do their traditional
>dossier system.

still, they don't need a *real*identity* to do this. privacy==real identity
in my mind. they can still contact "entities" based on their numbers
or pseudonyms without knowing who they are talking to.

>The Net doesn't really change anything here.  We've had anonymity
>through email and telephones for a long time.  But *we* have to call
>*them* in order to get on the anonymous widget consumer's list using
>Mr. Nuri's system; traditional marketing techniques proactively search
>out consumers to get them on the list.

the net changes everything in a big way based on the easy access
to forms of identity camouflage such as anonymity and pseudonymity.

>All that aside, I certainly would prefer it if the world worked in a
>way to make Mr. Nuri's system practical -- I dislike having "dossiers"
>on me kept by every marketer in the world, and do not like unsolicited
>advertising, but I just don't believe that we live in that sort of
>world.

you don't seem to "get" some of the key ideas in the essay, in
particular the essential necessity of *real*identity* for there
to be a compromise of privacy. my point
is that it might be possible for marketers to create "dossier like system"
that actually preserve privacy-- because the dossier alone is not
enough info to tie the information with a real person. suppose
that someone had intimate knowledge about every detail about
person #1343 that is *me*. but they have no way of tying their
information to my real address, my real identity, *unless* I decide
they can do so. (notice I can transact with companies without them
knowing who I am or where I live. that's exactly what I'm talking
about).





From sophi at best.com  Sun Jun 16 02:25:29 1996
From: sophi at best.com (Greg Kucharo)
Date: Sun, 16 Jun 1996 17:25:29 +0800
Subject: Netscape Mail Security and PGP Plugins
Message-ID: <31C39B3C.5E09CCD6@best.com>


Actually there is a web page covering quite a bit

www.c2.org/~raph/pgpmime.html

This is Raph's page and is still under construction. The whole gist of
my last mail was to level more discussion at using Netscape and browsers
in general as a low common denominator way of getting more crypto out
there.





From steve at miranova.com  Sun Jun 16 02:25:49 1996
From: steve at miranova.com (Steven L Baur)
Date: Sun, 16 Jun 1996 17:25:49 +0800
Subject: More secure web browser
In-Reply-To: <199606160255.TAA20231@toad.com>
Message-ID: <m23f3w5nuj.fsf@deanna.miranova.com>


>>>>> "Chris" == Chris Adams <adamsc at io-online.com> writes:

Chris> This is all I got from the anonymizer test site (URL was posted  
Chris> recently).
 
Chris> <BR> Your Internet browser is IBM-WebExplorer-DLL/v1.1b.
 
Chris> <BR> You are coming from .

Chris> Seems reasonably private. Unfortunately, it's not an option if you  
Chris> don't use OS/2...

I doubt it.  You're only `private' wrt hostname because io-online's
reverse DNS tables appear (very) broken.  This has nothing to do with
the browser or the O/S.

-- 
steve at miranova.com baur
Unsolicited commercial e-mail will be proofread for $250/hour.
Andrea Seastrand: For your vote on the Telecom bill, I will vote for anyone
except you in November.





From jamesd at echeque.com  Sun Jun 16 02:28:35 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Sun, 16 Jun 1996 17:28:35 +0800
Subject: [Slightly less Off-topic] Re: Insults (was: PBS show)
Message-ID: <199606160530.WAA07457@dns1.noc.best.net>


At 01:18 PM 6/15/96 -0000, nelson at crynwr.com wrote:
> But the "crypto-" prefix has an additional
> meaning that may make its use somewhat problematic.  A "crypto-"
> something can be a "fake-" or "hidden-" something.  So if it actually
> became popular to be a geek, you'd have cool people becoming
> crypto-geeks.

Incorrect:  Crypto-something means a hidden something, not fake something:  
Most popular usage is "cryptofascist" since fascism is so terribly 
politically incorrect these days, and many fascists are politically 
correct, so they do not call themselves fascist.

Another common usage is crypto-totalitarian.

A crypto-anarchist could mean either someone who seeks to destroy the state 
by higher mathematics, or someone who conceals his real aim of destroying
the state. 

Because cryptography is in many ways subtle attack on the state, with
consequences
far more radical than is at first apparent, those who seek to destroy the state 
by this means often are not obvious anarchists -- crypto-anarchists are often 
crypto-anarchists.

The intended meaning is usually obvious from context:  I have never seen the
word
crypto-anarchist used in the sense of a secret anarchist.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From cato at df.lth.se  Sun Jun 16 02:32:34 1996
From: cato at df.lth.se (Krister Walfridsson)
Date: Sun, 16 Jun 1996 17:32:34 +0800
Subject: Cryptology and knot theory?
In-Reply-To: <199606152350.TAA14182@jekyll.piermont.com>
Message-ID: <Pine.VUL.3.91.960616053537.28315A-100000@marvin.df.lth.se>




On Sat, 15 Jun 1996, Perry E. Metzger wrote:
> I would have my doubts about how interesting the direction could get,
> since knot theory is a dead area. The classification problem was fully
> solved, and after that things got boring...

Well...  I think the theory has become much more interesting after 
the classification, because we know that our problem _can_ be solved,
and our only problem is to do it faster and to get a better understanding
for the subject (there are lots of conjectures which seems simple, but 
whose state is unknown.)
 
I agree that it doesn't look good (since most of our invariants are NP-hard)
but the vassiliev invariants might be used to approximate the other
invariants... (I do not know what has been done in such approximation
theory the last couple of years.)

   /Krister





From declan+ at CMU.EDU  Sun Jun 16 02:40:21 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sun, 16 Jun 1996 17:40:21 +0800
Subject: [Noise] Re: Clinton Backs Internet 'Decency Act'
In-Reply-To: <9606151900.AA24857@rpcp.mit.edu>
Message-ID: <ElktPEi00YUw8TyL0N@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 15-Jun-96 [Noise] Re: Clinton Backs I.. 
by Joseph M. R. Jr. at MIT.EDU 

Rich Graves wrote:
RG>This is also at odds with what Clinton said. The full text of the
RG>statement is available on whitehouse.gov, among other places.

>  
>         I don't see how necessarily. (1) He supports the bill, and (2) he
> thinks the bill is within the realm of constitutionality, his statement is
> rather weak, but I think if you take the two points above, their summation
> is obvious and _is_ contrary to the bravado of Gore's MIT commencement
> speech. This is not to say he could very well back off to save face, which
> is what he is starting to do, and I hope he continues to do... 

It is in fact not at odds with what Clinton said. In fact, Clinton did
not have to go out and defend the law's constitutionality in an official
statement.

He could have just said "my attorneys in the DoJ are reviewing the
opinion and will make a decision to appeal or not within the time given
by law."

-Declan






From WlkngOwl at unix.asb.com  Sun Jun 16 02:43:34 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 16 Jun 1996 17:43:34 +0800
Subject: WEB: Child molester database
Message-ID: <199606160421.AAA13020@unix.asb.com>


On 14 Jun 96 at 22:40, Damaged Justice wrote:

> Along with the arms trafficker page, now we have a "child molester
> database":
> 
> http://www.greatworld.com/public
> 
> Deadbeat Dads, Drug Dealers and more, coming soon according to blurb.

I took a look at the "Crooked Cops" page.  There was an anonymous 
note about this one copy from AL(abama?) who smoked grass while the 
contributer had sex with his daughter in the next room.

Amusing, sort of.

Rob.





From scottst at ionet.net  Sun Jun 16 03:06:17 1996
From: scottst at ionet.net (Scott Staedeli)
Date: Sun, 16 Jun 1996 18:06:17 +0800
Subject: Attorney General wants to "expand crypto laws"
Message-ID: <199606160623.BAA05225@ion1.ionet.net>


   The Nando Time has a short story at:


http://www2.nando.net/newsroom/ntn/info/061596/info2_10501.html

   I have to give Janet some credit for persistance, after 
all the events of the last week, she's still pushing the 
four horsemen.


---
====================================================
Let's see, Dole, Clinton... Do I get another choice?
====================================================





From declan+ at CMU.EDU  Sun Jun 16 03:09:34 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sun, 16 Jun 1996 18:09:34 +0800
Subject: More info on this?
In-Reply-To: <199606160412.AAA12830@unix.asb.com>
Message-ID: <MlkuLGu00YUwQTyElS@andrew.cmu.edu>


I believe the folks at EPIC played a key part in this move by Lexis/Nexis.

-Declan


Excerpts from internet.cypherpunks: 16-Jun-96 More info on this? by
"Deranged Mutant"@unix.a 
>           L exis-Nexis, one of the nation's leading private
>           information brokers, has discontinued a new online
>           offering that provided access to
>           millions of individuals' Social Security numbers, after an
>           onslaught of complaints from customers and the credit
>           information bureau that originally supplied the data. 
>  
>           The service, which was offered by the company for 10 days
>           before it was discontinued Monday, was one feature of the
>           new "Lexis-Nexis P-Trak Person Locator" that Lexis-Nexis had
>           developed to attract new business from law firms and
>           law-enforcement agencies. 







From perry at piermont.com  Sun Jun 16 03:35:42 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 16 Jun 1996 18:35:42 +0800
Subject: [noise] (was Re: PBS show)
In-Reply-To: <960615224725_135852446@emout07.mail.aol.com>
Message-ID: <199606160653.CAA16337@jekyll.piermont.com>



AwakenToMe at aol.com writes:
> new lows??? Its a rather reasonable question about the protected mode on the
> intel chips considering the limits of 640K mem...Sorry if Im not as 'versed'
> in proteected mode as you,master, seem to be. Oh please teach us lesser ones.

Some people really just don't get it, do they.

Let the sewer flow...

.pm





From mix at anon.lcs.mit.edu  Sun Jun 16 03:44:16 1996
From: mix at anon.lcs.mit.edu (lcs Mixmaster Remailer)
Date: Sun, 16 Jun 1996 18:44:16 +0800
Subject: New nym server nym.alias.net
Message-ID: <199606160700.DAA08020@anon.lcs.mit.edu>


I have just set up a new 'nym server on nym.alias.net.  Options
include public-key encrypted replies, multiple and probabilistically
weighted reply-blocks, and fixed size response messages.

Right now the software should be considered in alpha test, so I can't
guarantee it won't crash or do bad things.  However, please feel free
to test it out and send me bug reports.

Send mail to help at nym.alias.net for more information.

- admin at nym.alias.net





From anonymous-remailer at shell.portal.com  Sun Jun 16 04:37:41 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sun, 16 Jun 1996 19:37:41 +0800
Subject: alpha.c2.org in deep shit?
Message-ID: <199606160815.BAA01552@jobe.shell.portal.com>


> > Am I the only one who receives apparently empty messages
> > for my alpha.c2.org account?
> No. Since late Thursday.

What happened?





From nelson at crynwr.com  Sun Jun 16 09:13:54 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Mon, 17 Jun 1996 00:13:54 +0800
Subject: [noise] (was Re: PBS show)
In-Reply-To: <960615224725_135852446@emout07.mail.aol.com>
Message-ID: <19960616114750.26401.qmail@ns.crynwr.com>


Perry E. Metzger writes:
 > 
 > AwakenToMe at aol.com writes:
 > > new lows??? Its a rather reasonable question about the protected mode on the
 > > intel chips considering the limits of 640K mem...Sorry if Im not as 'versed'
 > > in proteected mode as you,master, seem to be. Oh please teach us lesser ones.
 > 
 > Some people really just don't get it, do they.
 > 
 > Let the sewer flow...

Perry, if someone is so clueless as to post a general programming
question to cypherpunks, do you think they're going to "get it"?  You
need to explain it in very   small   words.

This mailing list, cypherpunks, is about encryption.  It's not about
reminiscing about old personal computers (however much fun it is to
do) and showing off our respective ages.  Yes, you may consider this a
Russ-o-gram.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | It's no mistake to err on
Potsdam, NY 13676       | +1 315 268 9201 FAX   | the side of freedom.





From jya at pipeline.com  Sun Jun 16 09:15:15 1996
From: jya at pipeline.com (John Young)
Date: Mon, 17 Jun 1996 00:15:15 +0800
Subject: More info on this?
Message-ID: <199606161159.LAA06198@pipe1.t1.usa.pipeline.com>


>>           Lexis-Nexis, one of the nation's leading private 
>>           information brokers, has discontinued a new online 
>>           offering that provided access to 
>>           millions of individuals' Social Security numbers, after an 
>>           onslaught of complaints from customers and the credit 
>>           information bureau that originally supplied the data.  
 
 
An article in The NYT Sunday on criminal misuse of stolen and sold SS
numbers says: 
 
 
"Such trade in information is legal, and regulation is difficult, perhaps
even more so since a Federal appeals court ruling last week struck down
restrictions and defended the 'chaos and cacophony of the unfettered
speech' on the new medium." 
 
 
 
"The freedom for market aggression is a wisely hidden by the freedom to
argue." 
 
 -- Wealth Through Capitalist Anarchy: Friedman's First Amendment





From rah at shipwright.com  Sun Jun 16 09:36:53 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Mon, 17 Jun 1996 00:36:53 +0800
Subject: Money Laundering
Message-ID: <v03006f01ade9b7222576@[199.0.65.105]>


C'punks,

Earlier this week some people on a british financial services list I lurk
on talked about this book. I forwarded the reference to e$pam, and one of
my e$ list people hunted it down.

It's a book for british financial people on, heh, how not to be a
money-launderer...

Cheers,
Bob Hettinga

--- begin forwarded text


Sender: e$@thumper.vmeng.com
Reply-To: Ian Grigg <iang at systemics.com>
MIME-Version: 1.0
Precedence: Bulk
Date: Sun, 16 Jun 1996 12:06:44 +0200
From: Ian Grigg <iang at systemics.com>
To: Multiple recipients of <e$@thumper.vmeng.com>
Subject: Re: Money Laundering

I received the following information from the author
Nigel Morris-Cotterill <100520.2472 at CompuServe.COM>:

-----------

The Book "How not to be a money launderer" is
ISBN 0 9527365 0 0.

Stockists incude Smiths (Ludgate Circus, Holborn
Circus, Liverpool Street), Hammicks (Chancery Lane),
Lambs (WC2), Dillons and Waterstones (quite a number
of shops around the country including Harrods),
Blackwells, HMSO Birmingham, Bloomsbury, Hong Kong
and a few smaller bookshops around the UK. Any bookshop
can order it. Bookshop price is L20. Some will charge
an ordering fee or a "notification " fee, others will
not. Or you can buy it direct from Silkscreen
Publications, P O Box 1882, Brentwood Essex CM15 0GA,
CWO, for L23 including postage and packing.

Regards

Nigel

--
iang
iang at systemics.com


--- end forwarded text



-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From mixmaster at remail.obscura.com  Sun Jun 16 10:49:27 1996
From: mixmaster at remail.obscura.com (Mixmaster)
Date: Mon, 17 Jun 1996 01:49:27 +0800
Subject: No Subject
Message-ID: <199606161420.HAA16666@sirius.infonex.com>


Depending on how you have your nyms set up, some of those apparently empty messages may be posting "receipts" from remailers. I have received similar and later the messages.






From nobody at nym.alias.net  Sun Jun 16 11:57:39 1996
From: nobody at nym.alias.net (Help Message)
Date: Mon, 17 Jun 1996 02:57:39 +0800
Subject: Instructions for using nym.alias.net
In-Reply-To: <199606161444.KAA10366@anon.lcs.mit.edu>
Message-ID: <199606161445.KAA10373@anon.lcs.mit.edu>


WARNING:  This site is still in "alpha" state, and may have
          bugs. Please test it, but do not rely on it for truly
          sensitive pseudonyms until it has been tested for a while.
          Please report all bugs and problems to <admin at nym.alias.net>
          so that we can fix them.


* SETTING UP A MAIL ALIAS:

To set up an anonymous mail alias on nym.alias.net, you must first
generate a new PGP public/private key pair for use with your mail
alias.  Do this by running "pgp -kg".  You will be asked to choose a
user-id for your new key.  When you are prompted for the user-id, type
something not very descriptive that gives no indication of either your
real identity, the alias name you will choose, or even the
nym.alias.net machine.

Unlike your regular PGP key, you should make an effort to keep your
remailer public key relatively secret, and you should not use it for
any other purpose.  Do not sign it, and do not submit it to any key
servers or give it out to anyone.  To make sure you don't accidentally
sign other messages with your pseudonym's private key, you should
probably choose a new passphrase for your remailer key.  You may also
wish to put a line like:
  MYNAME = <your.real at e-mail.address>
in the file $HOME/.pgp/config.txt (which you can create if it
does not already exist).

Once you have a PGP key for your pseudonym, extract it to a file (for
instance with "pgp -fkxa 'key ID' > tmpfile".

Next, create a reply block for yourself.  First choose some
passphrases for conventional encryption.  Suppose you want your
message encrypted first with your public key, then with shared key
"passphrase_b", then with shared key "passphrase_a".  Create a
remailer message like this ("Latent-Time: +0:00" will prevent any
delay--use something longer for more security.)

 ::
 Request-Remailing-To: you at your.email.address
 Latent-Time: +0:00
 Encrypt-Key: passphrase_a

 **

PGP encrypt this with a remailer's public key (you can get remailer
information from fingering remailer-list at kiwi.cs.berkeley.edu, and you
can get the keys by running "finger pgpkeys at kiwi.cs.berkeley.edu | pgp
-fka").  This will yield a message like this:

 -----BEGIN PGP MESSAGE-----
 Version: 2.6.2

 hIwC/nqSW1QDQfUBBACknZMV93wFS2CH0orlgslmEm+alhjI1eKwbbTTmeRWC5Rg
 /S3vZw+95ZuCZfqxKE0XrgZXzOEwfoyBcpVvf9Pb9D19TqEMTmmL/Jpl1xcxmbJ2
 OGsHpQ/TxpazBCVhdBmPblj5wWvwfG1+ZKpIkQ5hiLJhryQM/TUDarEscs3zdaYA
 AAB5231aMcQ74AKoDZizABMF3Tw+olV4mm4jVo9cMn2B3Rj2XBFl4pV9VL3h0ZQB
 cPY/ytBRyZPugr0NpLgjO+q6mEjCcgQrxpYQ+1PvFPdDx1GmJ5ogZqW+AVHsNqAp
 vRoiG8ZhXs4r3E8liFsNtMMf6CUAsdV2ZoX1Hw==
 =Bla3
 -----END PGP MESSAGE-----

Prepend to this the following header:

 ::
 Encrypted: PGP

And finally add a command to send to the remailer you chose, yielding
a response block for one remailer:

 ::
 Anon-To: remailer at utopia.hacktic.nl
 Latent-Time: +0:00
 Encrypt-Key: passphrase_b

 ::
 Encrypted: PGP

 -----BEGIN PGP MESSAGE-----
 Version: 2.6.2

 hIwC/nqSW1QDQfUBBACknZMV93wFS2CH0orlgslmEm+alhjI1eKwbbTTmeRWC5Rg
 /S3vZw+95ZuCZfqxKE0XrgZXzOEwfoyBcpVvf9Pb9D19TqEMTmmL/Jpl1xcxmbJ2
 OGsHpQ/TxpazBCVhdBmPblj5wWvwfG1+ZKpIkQ5hiLJhryQM/TUDarEscs3zdaYA
 AAB5231aMcQ74AKoDZizABMF3Tw+olV4mm4jVo9cMn2B3Rj2XBFl4pV9VL3h0ZQB
 cPY/ytBRyZPugr0NpLgjO+q6mEjCcgQrxpYQ+1PvFPdDx1GmJ5ogZqW+AVHsNqAp
 vRoiG8ZhXs4r3E8liFsNtMMf6CUAsdV2ZoX1Hw==
 =Bla3
 -----END PGP MESSAGE-----

 **

For greater security, you should repeat this process so that mail to
your pseudonym travels through multiple remailers.  You can simply
encrypt the entire above message with another remailer's public key,
and insert the new cyphertext in a message similar to the example one
above.

Now, to set up a pseudonym on nym.alias.net, you need to mail four
things to config at nym.alias.net:  The pseudonym you wish to use, a
"create" command, your remailer public key, and the response block.
The reply-block must always come last in your mail message.  Thus, if
you wanted to choose the alias <test at nym.alias.net>, you would could a
message like this:

 Config:
 From: test at nym.alias.net
 Nym-Commands: create +acksend name="Full Name of Nym Test User"
 Public-Key:
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 Version: 2.6.2
 
 mQCNAzGf6A8AAAEEAPknqWEUA8U4+l5TFkD5Fj0COten6bbIe5bBb/1MvI+w6mFl
 z06CPb2K/Z1fzjT48ZyxwYR+S3jU3Z96JEFRl99HYh3lTIUiBHW/XtwyefF0y61x
 qYkNuUpSFh9BDBFM7N3uVvaNbzLiFnqCpZLm5ZIfrLcla3qUgkTBtHVi58fRAAUR
 tDhsY3MgbWl4bWFzdGVyIGFkbWluaXN0cmF0b3IgPG1peC1hZG1pbkBhbm9uLmxj
 cy5taXQuZWRxPokAlQMFEDGf6ClEwbR1YufH0QEBX60D/jZ5MFRFIFA1VxTPD5Zj
 Xw2bvqJqFvlwLD5SSHCVfe/ka6ALuxZGFKD/pHpUAkfv1hWqAYsJpi0cf8HSdi23
 bh5dUeLJnHHHDmd9d55MuNYI6WTi+2YoaiJOZT3C70oOuzVXuELZ+nZwV20yxe8y
 4M3b0Xjt9kq2upbCNuHZmQP+
 =jIEc
 -----END PGP PUBLIC KEY BLOCK-----
 Reply-Block:
 ::
 Anon-To: remailer at utopia.hacktic.nl
 Latent-Time: +0:00
 Encrypt-Key: passphrase_b

 ::
 Encrypted: PGP

 -----BEGIN PGP MESSAGE-----
 Version: 2.6.2

 hIwC/nqSW1QDQfUBBACknZMV93wFS2CH0orlgslmEm+alhjI1eKwbbTTmeRWC5Rg
 /S3vZw+95ZuCZfqxKE0XrgZXzOEwfoyBcpVvf9Pb9D19TqEMTmmL/Jpl1xcxmbJ2
 OGsHpQ/TxpazBCVhdBmPblj5wWvwfG1+ZKpIkQ5hiLJhryQM/TUDarEscs3zdaYA
 AAB5231aMcQ74AKoDZizABMF3Tw+olV4mm4jVo9cMn2B3Rj2XBFl4pV9VL3h0ZQB
 cPY/ytBRyZPugr0NpLgjO+q6mEjCcgQrxpYQ+1PvFPdDx1GmJ5ogZqW+AVHsNqAp
 vRoiG8ZhXs4r3E8liFsNtMMf6CUAsdV2ZoX1Hw==
 =Bla3
 -----END PGP MESSAGE-----

Note that the first line of this message was "Config:".  ANY MESSAGE
SENT TO <config at nym.alias.net> WILL BE SILENTLY DISCARDED IF THE FIRST
LINE IS NOT "Config:"!

This message must then be encrypted with the nym.alias.net public key,
and signed by your new remailer public key.  The nym.alias.net public
key is listed here (pipe it to "pgp -fka" to add it to your public
key ring):

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQENAzGzy5AAAAEH/2JjaB4AuQff90Mejru+FVptG4/wPmwK7WteavNXJpYxWoRm
SzxwNz70q4QCLKBR0QnzXqGeGtCB5IE4dIuPIkMiPvRv57rBaDe4qkzNkgwuZiH9
qGMsOSidCf+xaIJyL7RtljKuDSU8KH2OGIdwEpGa20U+9oXabWCpWwVvfJhgxPFF
xhiFLeMzhEUgsVXxIn2ThD8AyHyTUXWd11nvvTeKt+y9qX+7fUDrn6HIl1lFmxQA
RAOc83jjDNgWbanHWG9+1g8KFLkBrEdxJtNQeb/JMSZ122Dxda5CwtMnQGI0mCcr
dHNr1NA6WWaIfV0pR+sluNWFxNYuTk0OFgtg8c0ABRG0Kzxjb25maWdAbnltLmFs
aWFzLm5ldD4vPHNlbmRAbnltLmFsaWFzLm5ldD6JAJUDBRAxumL3RMG0dWLnx9EB
AaRTA/4xIgNrem7Yay0/rFfXgoGHUhWsZVhAlQP1fVEIRYuYEC4Biodwx3nYL31r
9IcgBkm/DUddkfCUfroMr7wbm6GnYnrVLc4dZ9ACCjUVX7n5hvanc8/Efx0yE03l
D+r9n5liz5X4vk65f+DIw1LykM9zTg/4GNwAENn6H5YTtg6Q+IkBFQMFEDG6YVlO
TQ4WC2DxzQEBIvMH/jER9tiQcJG2NvkiOqcIeBSPLb15EPFMg1He3clRIz398ToH
iv4oNKZEjVox3O0zowcUW0zfgtzhlMbudOwgoylCpCxVukuF1tsleoGlvDES0iA8
WdnYftt/rr3awf0j2pmLFbCmEDFaebuYgRXGe5yavaSjFDPzjFZqKwTYs5VnKOjP
XjI0yrem4PXw6K5sOANJKaa6yFrHJ/58iqbV8Rl7p0qNwwIi1nDn5UgpDOFDqWMq
sO9HUjRD2Y+Kmq6qlSg1gKV1hehZuAxHKtJAIZf+MPaI/sRbs79oN5GVwpmqoiZF
vz6bLS+qs69kVwg2RQoY2BSAzyUeT+rw70YfLAc=
=ekCY
-----END PGP PUBLIC KEY BLOCK-----

Create the message to nym.alias.net with the command:
   pgp -seat file config at nym.alias.net -u 'remailer key ID'.
Once you have produced a PGP encrypted and signed message, mail it to
<config at nym.alias.net> (preferably through some anonymous remailers
for maximum security).  If the name you chose is available, this will
create your mail alias.  You can send mail to <list at nym.alias.net> to
get a list of pseudonyms already in use.


* SENDING MAIL FROM YOUR PSEUDONYM

Once you have created a mail alias, you will automatically receive
mail sent to that alias (encrypted with the public key you mailed it).
To send mail from that alias, simply create a mail message, encrypt it
with the nym.alias.net public key, sign it with your remailer key, and
mail it to <send at nym.alias.net>.  Thus, for example, create a file
with (substituting the name you chose for "test"):

 From: test
 To: mail2news at anon.lcs.mit.edu
 Newsgroups: alt.test
 Subject: ignore this nym test

 just a test

If this file is called "testpost", and your remailer public key ID is
"xx testkey", run the command:
   pgp -seat testpost send at nym.alias.net -u 'xx testkey'
This will create a file called "testkey.asc", which you can then mail
to <send at nym.alias.net> to post the above test message to the
newsgroup alt.test.

Any mail you send through send at nym.alias.net will be PGP signed and
dated by the nym.alias.net private key to certify its authenticity.
If you do not wish your mail to be signed, or if your alias has its
own PGP key, you should simply send mail through ordinary remailers
(setting the From: address to be that of your nym) and shouldn't need
to go through send at nym.alias.net.


* CHANGING OR DELETING YOUR MAIL ALIAS

To change either your public, your response block, or the parameters
of your alias, you can simply send another message to
<config at nym.alias.net> as you did to set up the the alias initially
(only without the "Nym-Commands: create" command).  Once again, the
message will have to be both signed and encrypted with
   pgp -seat message -u 'xx testkey'
as described above for sending mail.

To delete your alias entirely, send encrypted and signed mail with
simply the lines:

 From: test
 Nym-Commands: delete

(substituting your real alias name for test).  After deleting your
alias, you should receive PGP-signed mail explicitly acknowledging the
deletion of that alias.  An acknowledgment simply confirming generic
"successful execution" of your request does not indicate that your
alias has been deleted.

There several commands you can give using the "Nym-Commands:" header
in a message to <config at nym.alias.net>.  You can place several on on
line, separated by spaces, or you can place multiple "Nym-Commands:"
headers in the same message.  Valid commands are:

+acksend/-acksend
  Enable/disable an automatical acknowledgment each time a message is
  successfully remailed for your alias through <send at nym.alias.net>.

+cryptrecv/-cryptrecv
  Enable/disable automatic encryption with your public key of messages
  received for your alias.  If public-key encryption is disabled, you
  absolutely must conventionally encrypt your messages if you wish to
  preserve your privacy (conventional is a good idea anyway--see the
  section on security).

+fixedsize/-fixedsize
  When you send the +fixedsize Nym-Command, all messages you receive
  will be padded to exactly the same size (roughly 10K).  This padding
  will take place outside the public key encryption, and so will only
  be useful if you also use shared-key encryption.  If you do used
  shared-key encryption, however, (and you really should), having all
  your messages be the same size will make it significantly harder for
  anyone to do traffic analisys on mail to your nym.

+disable/-disable
  One of the most effective forms of attack on a pseudonymous remailer
  such as this is to flood the system with messages for a particular
  destination.  Moreover, because this alias software does not know a
  message's final destination, it is possible that some joker could
  point an alias at itself (maybe even using two reply-blocks to
  create exponentially increasing levels of traffic).  To protect
  against this, if you receive more than 256 messages in one day, your
  alias will be disabled and further mail to you it will bounce.  You
  will receive mail notifying you of the situation if this happens to
  you.  At this point, you can re-enable your alias by sending a
  message with "Nym-Command: -disable" to <config at nym.alias.net>.

name="My \"Alias\" Name"
  To set up a name to be printed in all your outgoing messages, like
  this:
     From: My "Alias" Name <aliasname at nym.alias.net>
  You can set it with the name= Nym-Command.  Note the outer quotes
  are necessary even if your name does not contain any white space.
  Any quotes and backslashes in your name must be escaped with a
  backslash.

create
  This command must be given when creating a new alias.

delete
  This command deletes your alias and wipes your response block.  As
  described above, you should receive PGP-signed mail explicitly
  acknowledging the deletion of your alias.  An acknowledgment simply
  confirming generic "successful execution" of your request does not
  indicate that your alias has been deleted.


* REPLAY

The remailer keeps a replay cache, and will not accept the same
message twice unless each copy has been separately signed.  Thus, it
is safe to send multiple copies of outgoing E-mail messages through
very long remailer chains, if you are worried about one copy not
getting through.  Whether one or more copies actually make it through,
only one copy will go out.

One side effect of this is, however, that if you PGP sign a test
message and mail in the same message multiple times, it will only work
the first time.

Note that signatures are only considered valid for a week.  Thus, if
mail comes to send at nym.alias.net more than a week after you signed it,
that mail will be dropped.


* MULTIPLE REPLY BLOCKS

Sometimes anonymous remailers can be unreliable, and you would like to
receive two copies of all your messages through two independent
remailer chains.  Alternatively, perhaps you want to send one copy of
each E-mail message you receive to the bit bucket through a long
series of anonymous remailers.  You can assign multiple reply blocks
to your nym by prefixing each with "Reply-Block:" at the end of a
message to <config at nym.alias.net>.  For example, the following message
to <config at nym.alias.net>:

 Config:
 From: test
 Reply-Block:
 ::
 Anon-To: nobody at some.remailer.machine
 Latent-Time: +0:00
 
 Reply-Block:
 ::
 Anon-To: your.real at email.address
 Latent-Time: +1:00

Will setup your alias to send one copy of each message you receive to
"nobody at some.remailer.machine" immediately, and to send a second copy
to "you.real at email.address" after up to one hour of random delay.  Of
course, in order for this to be useful, you should use more complex
reply-blocks which chain through multiple remailers.

It may also make traffic analysis more difficult if you don't always
use the same remailer path.  You can assign a probability to a
remailer block by adding "p=probability" to the remailer block (where
'p' can be any single letter variable name).  For example, consider
the following reply-block:

 Reply-Block: p=0.5
 ::
 Anon-To: you at through.one.remailer
 Latent-Time: +1:00

 Reply-Block: p=0.5
 ::
 Anon-To: you at through.another.remailer
 Latent-Time: +1:00

 Reply-Block: q=0.75
 ::
 Anon-To: nobody at some.remailer.machine
 Latent-Time: +0:00

3/4 of the time, a copy of a message you receive will immediately be
mailed to nobody at some.remailer.machine.  After some random delay, your
message will be mailed to either "you at through.one.remailer" or to
"you at through.another.remailer".  Multiple reply-blocks with the same
probability variable are mutually exclusive.  Thus since the p blocks
are "p=0.5" and "p=0.5", and since 0.5 + 0.5 = 1.0, you are guaranteed
to get a copy of all your mail.  Generally speaking, you will probably
want all the weights associated with a particular variable to add up
to 1.0 unless the reply-block is just for cover traffic.  Bizarre
behavior may occur if your probabilities add up to more than one--this
is not recommended.

While the idea of using many different reply-blocks with small
probabilities may seem appealing for defeating traffic analysis, keep
in mind that each reply block is traceable back to you.  Suppose you
have 10 reply blocks for your 'nym, each with probability 0.1.  If
those reply blocks become compromised, only one of the 10 will have to
be uncovered to find out your real identity.


* SECURITY

If you care about the secrecy of your identity, then the only truly
secure way of of protecting it is by pointing all your response blocks
to usenet newsgroups.

The most important thing to realize about the privacy of your messages
is that anyone can determine your PGP public key ID from looking at an
encrypted message.  That means if you don't conventionally
super-encrypt mail, an observer on the network or at a remailer may be
able to determine which public key corresponds to which nym, and use
this to track messages.  If you redirect your mail to news group
alt.anonymous.messages, observers will be able to determine your
public key ID and observe how much mail you are getting.

For this reason, you should conventionally encrypt your mail in
addition to public-key encrypting it.  If you only want to use
conventional encryption for most mail, you can disable RSA encryption
by sending signed/encrypted mail with 'Nym-Commands: -cryptrecv' to
<config at nym.alias.net>.  There is a large benefit to using public-key
encryption.  If you only use conventional encryption and your
reply-block is compromised, then previously recorded messages sent to
you will be able to be decrypted.  With RSA-encrypted messages, there
is no way for anyone but you to read the message once it has left
nym.alias.net.


* POLICY

Any use of this alias service for illegal purposes is strictly
prohibited.

Do not rely on this nym server to protect your identity.  You should
be relying far more heavily on the integrity of the remailers through
which you chain your replies.  The nym.alias.net service is provided
in the hope that it will be useful, but the administrators can make NO
GUARANTEES WHATSOEVER that your identity will not be compromised.

That said, we will make a reasonable effort to keep the machine secure
and to ensure that your reply block never gets backed up to tape or
otherwise copied.  Note, however, that your PGP public key will get
backed up to tape, and so will likely be available for a while even
after you delete your Nym.  The server also keeps, not backed up, two
additional pieces of information on your nym:  First it counts the
number of messages your alias received in the current 24 hour period,
so as to detect flooding attacks and alias loops with exponential
message explosion (see the description of the -disable Nym-Command for
more info).  Second, the server stores the date of the last day on
which you sent a PGP-signed message to config at nym.alias.net or
send at nym.alias.net.  This is to help garbage-collect inactive accounts
with lost PGP keys at some later point should that become necessary.

Nym.alias.net is the same machine as anon.lcs.mit.edu.  Keep this in
mind when choosing which remailers to chain through.  (In other words,
using mix at anon.lcs.mit.edu as your last hop for mail to nym.alias.net
is probably a good idea if and only if you you also chain through one
more hop than you would otherwise have felt comfortable with.)


* E-MAIL ADDRESSES

<admin at nym.alias.net>
  The address to contact if you are having any problems with
  nym.alias.net.

<help at nym.alias.net>
  Sending mail to this address gets you a copy of this help file.

<remailer-key at nym.alias.net>
  Get the PGP public key for nym.alias.net.

<list at nym.alias.net>
  The address to contact for a list of all taken pseudonyms.

<config at nym.alias.net> 
  The address to which to send configuration messages.  All messages
  to this address must be PGP encrypted and signed with "pgp -seat".
  In addition, THE FIRST LINE OF PGP-SIGNED TEXT IN A MESSAGE TO
  config MUST BE "Config:".  Otherwise your message will be completely
  ignored.

  When sending one or more reply-blocks to <config at nym.alias.net>,
  they must come at the end of the message after any Public-Key: or
  Nym-Command headers.

<send at nym.alias.net>
  To send mail from your alias address, PGP encrypt and sign the
  message with "pgp -seat", and mail it to this address.





From m5 at vail.tivoli.com  Sun Jun 16 12:16:06 1996
From: m5 at vail.tivoli.com (Mike McNally)
Date: Mon, 17 Jun 1996 03:16:06 +0800
Subject: [noise] (was Re: PBS show)
In-Reply-To: <960615224725_135852446@emout07.mail.aol.com>
Message-ID: <31C42C22.4F4@vail.tivoli.com>


AwakenToMe at aol.com wrote a smart-alecky response to Perry:
> ... Later god ...

I seem to recall somebody talking about how much more computer literate
the typical PC user is than typical Mac users.  So which do you use?

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
       m5 at tivoli.com * m101 at io.com          *
      <URL:http://www.io.com/~m101>         * suffering is optional





From AwakenToMe at aol.com  Sun Jun 16 15:30:25 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Mon, 17 Jun 1996 06:30:25 +0800
Subject: [noise] (was Re: PBS show)
Message-ID: <960616142141_557410629@emout15.mail.aol.com>


In a message dated 96-06-16 11:57:22 EDT, nelson at crynwr.com writes:

<< 
 Perry, if someone is so clueless as to post a general programming
 question to cypherpunks, do you think they're going to "get it"?  You
 need to explain it in very   small   words.
 
 This mailing list, cypherpunks, is about encryption.  It's not about
 reminiscing about old personal computers (however much fun it is to
 do) and showing off our respective ages.  Yes, you may consider this a
 Russ-o-gram.
  >>
Yes you are right. BUT its funny. I only asked something about another
mailing that was done yesterday about real-protected mode and the chip
desing. So while its there.. why not take a question outta it!! hehe






From middle-man-admin at nym.jpunix.com  Sun Jun 16 15:36:33 1996
From: middle-man-admin at nym.jpunix.com (middle-man-admin at nym.jpunix.com)
Date: Mon, 17 Jun 1996 06:36:33 +0800
Subject: Bye Bye Middleman
Message-ID: <199606161808.NAA06596@alpha.jpunix.com>


To Whom it may Concern:

	The middleman remailer has not been as robust or reliable as I had
hoped. It relies too heavily on the nym servers and the reliability of the
other remailers that it randomly selects. As you can tell by Raph's list,
middleman has not responded to a ping a ping in some time. I've been
looking at the process for several days now and have come to the
conclusion that it will probably never achieve a level of reliability that
will make it a reasonable remailer. With this in mind, I am formally
announcing the retirement of the middleman Type-II remailer. It was an
interesting experiment but it just didn't pan out. 

				middle-man-admin at nym.jpunix.com







From AwakenToMe at aol.com  Sun Jun 16 15:38:53 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Mon, 17 Jun 1996 06:38:53 +0800
Subject: [noise] (was Re: PBS show)
Message-ID: <960616141050_557406238@emout16.mail.aol.com>


In a message dated 96-06-16 06:17:43 EDT, perry at piermont.com (Perry E.
Metzger) writes:

<< AwakenToMe at aol.com writes:
 > new lows??? Its a rather reasonable question about the protected mode on
the
 > intel chips considering the limits of 640K mem...Sorry if Im not as
'versed'
 > in proteected mode as you,master, seem to be. Oh please teach us lesser
ones.
 
 Some people really just don't get it, do they.
 
 Let the sewer flow...
 
 .pm
  >>
Guess Not. Maybe thats why I subscribe to mailers. So I can learn and share
what I know. Although the internet is such a vast resource..... it is
nevertheless an area where egotistical, hard headed, and very arrogant people
lurk. Take this to heart some of you. Remember... internet is information. 
let the sewer flow?? Man.. get outside one of these days.





From alano at teleport.com  Sun Jun 16 15:53:08 1996
From: alano at teleport.com (Alan Olsen)
Date: Mon, 17 Jun 1996 06:53:08 +0800
Subject: Snake Oil on the Water...
Message-ID: <2.2.32.19960616181936.00cb76fc@mail.teleport.com>


I recieved this on another list.  The snake oil is starting to flow pretty
heavy.  I expect it to get worse...



>Subject: Windows 3.x or Win95 FREEWARE Mail/Encryption Program
>X-UIDL: 788ef8d7083cb4f8e94b2c20183773b5
>
>Date: Sat, 15 Jun 1996 13:26:23 -0600
>To: freematt at coil.com (Matthew Gaylor)
>From: Joe Horn <6mysmesa at 1eagle1.com>
>Subject: Re: Security and Freedom through FREEWARE Mail/Encryption Program.
>
>
>At the following two sites, you may download the FREEWARE Pegasus Mail
>program version 2.3.3 16 bit for windows 3.x or a version for WIN95. The
>unique thing about it, besides its simplicity and that it's a great mail
>program better than Eudora, it has a built in encryption program that is as
>effective as PGP and lots simpler. All you do is agree on a password with
>your correspondent. That simple. The encryption program and the mail program
>were developed in New Zealand, and were legally imported, so the encryption
>program is better than PGP, which is regulated by Federal Cypher Laws.
>Honest.Plus, it's free. The sites are:
>
>http://www.pegasus.usa.com/
>
>or
>
>http://www.env.com/tucows/files/winpm233.zip
>----------------------------------------------------------------------------
>
>
>****************************************************************************
>Subscribe to Freematt's Alerts: Pro-Individual Rights Issues
>Send a blank message to: freematt at coil.com with the words subscribe FA
>on the subject line. List is private and moderated (7-30 messages per week)
>Matthew Gaylor,1933 E. Dublin-Granville Rd.,#176, Columbus, OH  43229
>****************************************************************************
---
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.teleport.com/~alano/          | alano at teleport.com  |






From hfinney at shell.portal.com  Sun Jun 16 16:22:40 1996
From: hfinney at shell.portal.com (Hal)
Date: Mon, 17 Jun 1996 07:22:40 +0800
Subject: alpha.c2.org in deep shit?
Message-ID: <199606161825.LAA02892@jobe.shell.portal.com>


I peeked at a few messages passing through my remailer from alpha.c2.org
(mea culpa) to see whether the problem might be at my end.  As far as
I could tell, the messages were correctly formatted and all, but simply
lacked message bodies.  So it looked like the data being sent from
alpha.c2.org was already messed up and had stripped the bodies.  I set up
an alpha.c2.org alias a few days ago and when I sent mail to myself I
got mail without a body, so I think it is a definate screwup.  I sent a
report of this to remailer-operators list but have not seen a response
yet from Sameer.

Hal





From hfinney at shell.portal.com  Sun Jun 16 16:37:15 1996
From: hfinney at shell.portal.com (Hal)
Date: Mon, 17 Jun 1996 07:37:15 +0800
Subject: Netscape Mail Security and PGP Plugins
Message-ID: <199606161838.LAA03355@jobe.shell.portal.com>


From: Greg Kucharo <sophi at best.com>
>  A couple of questions I have right off the bat are;
>  1. In Hal's Java mail encryptor, what are the legal aspects of
> sending code across that contains crypto?

There are two main issues, export and patent.  Export laws keep it from
being used outside the U.S., and patent laws keep it from being used
within the U.S.  Everyone else should have no problem.

>  2. Can any plugin access the Netscape Mail program.

According to discussion on the coderpunks list, this is not presently
possible:

: From coderpunks-errors at toad.com  Sat Jun  8 18:33:32 1996
: Date: Sat, 8 Jun 1996 18:07:06 -0700 (PDT)
: From: Kurt Thams <thams at thams.com>
: Subject: Re: plugging in
: 
: On Sat, 8 Jun 1996, strick -- henry strickland wrote:
: 
: > > >> >You could hand any websurfer a Netscape PGP plugin without much work
: > > >> >at all, and you could easily build it on lots of platforms. After all,
: > > >> >look at how many platforms that lowly C code like PGP runs on.
: > 
: > not knowing what Netscape plugins do, 
: > let me ask the plumbing question: what would this do, and how?
: > allow users to send/receive encrypted PGP mail in the "netscape mail" window,
: > transparently like Raef's sendmail wrapper?
: > how do you invoke a plugin, when & why? 
: 
: This is not possible yet. The Netscape API doesn't expose the mail service
: to plug-ins. One would think that future versions of Navigator will do
: this, however. 
: 
: -- kurt thams
: -- thams at thams.com

However as has been mentioned here a PGP/MIME mail type could
theoretically be used to activate a handler for that incoming mail.  I
don't know exactly how this would work.  Glancing at the netscape plug
docs near <URL:
http://home.netscape.com/eng/mozilla/2.0/handbook/plugins/ > it appears
that plugins are activated on HTML page downloads, not (necessarily) on
mail receipt.  So unless you typically find your incoming mail on a web
page, it doesn't look like this will work.  I will ask about it on
coderpunks for clarification.

>  3. When is S/MIME going to be in Netscape, I tried to find info on the
> web site but thier statements about S/MIME seem vague.

Sorry, can't help you here.

>  I hope I'm not running over old ground, but this has to be alot more
> intresting than discussing that PBS show!

Agree!

Hal





From drosoff at arc.unm.edu  Sun Jun 16 16:40:54 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Mon, 17 Jun 1996 07:40:54 +0800
Subject: Remailer Operator Liability?
Message-ID: <1.5.4.16.19960616184459.32efa9ca@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

At 12.58 PM 6/15/96 -0700, Hal wrote:

>I am pretty sure it is illegal, CDA or not, at least if the material
>is obscene rather than merely indecent.  As Declan says, the issue is
>accountability.  If the remailer operator ends up being considered the
>person who sent the mail, he could be in deep trouble.

This is the problem I have with the whole issue. Obviously, since nyms
use reply blocks, the remailer operators that are inside the reply block
have no control over what is sent (PGP-encrypted) through their remailer.

If I was to go out into the city, and tack up some porno on a building,
maybe something where kids walk by, then someone would take it down, most
likely, but there would be no tracing it to me, because I would be already
long gone from the building. We should make the best efforts we can to
make remailers fully anonymous. My ideas are more that accept PGP, and
(has this already been suggested and/or rejected?) automatic chaining.
That is, remailer #1 could automatically encrypt and send to #2, #3, ...
#n before going on to its destination. The number of added remailers and
which were used could be made random. (ie, have a list of remailers and
pick from it each time...) Would this work?

===============================================================================
David Rosoff (nihongo o chiisaku dekimasu)  ------------->  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
===
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." <---- "Ulysses", by Alfred, Lord Tennyson



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcRVXhguzHDTdpL5AQFc1wP9GiJ6mXeAOY1x/7g1GrCPsWYEZlS5iq84
wfKwgs1W8L+PBQcbrgdhyK2RKDJ7sFrCbz0eSa3OLbDiw5NeKD0LSDAvxuF3Redu
aUpv4yWdYMz71sHz8MF7TxzdOo5a6dg3XtIaRA3Sbt4i2p9dozm/Xg5h4vhgKwWu
/nG1BhTlNGs=
=O4wy
-----END PGP SIGNATURE-----






From richieb at teleport.com  Sun Jun 16 17:30:46 1996
From: richieb at teleport.com (Rich Burroughs)
Date: Mon, 17 Jun 1996 08:30:46 +0800
Subject: Snake Oil on the Water...
Message-ID: <2.2.32.19960616192749.008f7570@mail.teleport.com>


At 11:19 AM 6/16/96 -0700, Alan Olsen wrote:
>I recieved this on another list.  

Me too :)

>The snake oil is starting to flow pretty heavy.  I expect it to get worse...

Here's the reply I sent to that list.  I cc'd the person who sent the
original message...

===========

At 01:00 PM 6/16/96 -0400, Joe Horn <6mysmesa at 1eagle1.com> wrote:
[snip]
>At the following two sites, you may download the FREEWARE Pegasus Mail
>program version 2.3.3 16 bit for windows 3.x or a version for WIN95.

I like Pmail.  Had I not been an experienced Eudora user before I
tried it (and pretty stuck on the Eudora interface) I would have
probably stuck with it.  Kudos to the Pegasus team for releasing
a freeware program with such excellent filtering capabilites.  It
is much more of a full-fledged program than Eudora Lite, IMHO.

> The
>unique thing about it, besides its simplicity and that it's a great mail
>program better than Eudora, it has a built in encryption program that is as
>effective as PGP and lots simpler. All you do is agree on a password with
>your correspondent. That simple.

This would seem to eliminate the immense benefit of public key
encryption -- that you can send encrypted email to someone you
haven't met, without any prior communication.  If you have
security concerns, they will probably apply to whatever
communication media that you would use to agree on the password.
If I have a secure method to agree on a password with someone,
what the heck do I need crypto for?  ;)

Also, I'm assuming that you can only send encrypted mail to
other Pmail users.  PGP is above those kinds of limitations --
it can be used on many platforms and with many different types
of email packages.

> The encryption program and the mail program
>were developed in New Zealand, and were legally imported, so the encryption
>program is better than PGP, which is regulated by Federal Cypher Laws.

This is misleading, IMHO.

While the export of the US version is "regulated by Federal
Cypher Laws," PGP is not like some products which export a
weaker version to accomodate ITAR.  The version of PGP for people
outside of the US is developed outside of the US, and is just
as strong as the domestic version, AFAIK.

Some people's lives, business, etc. depend on what type of
crypto they use.  I don't think it's really appropriate to make
misleading claims like the one above when the stakes are that
high.

Please drop this claim for your promotional efforts, or back
it up with specific evidence showing how ITAR has weakened
PGP.

>Honest.Plus, it's free. The sites are:
[snip]

For those people who want to use PGP with Pegasus, there's a
nice little plug-in for Pegasus called PGP JN, by John Navas,
which allows you to choose to encrypt with PGP (you need to
have a copy) instead of the Pmail crypto.  It has a few small
drawbacks, IMHO, but I found it much easier to use than PGP
shell interfaces that require cutting text to the clipboard 
first.

John's program is available at:
http://www.aimnet.com/~jnavas/winpmail.html

I really think the Pegasus team would do better to mention
that John's program is available, rather than try to steer
people away from PGP.  PGP JN makes using the basic email
features of PGP more streamlined than most other mail
packages I've used (except Private Idaho, which is not a
full-fledged email package).  I think it would be better to
mention that both options exist, rather than seeking to
convert the masses away from PGP, which is unlikely to
succeed anyway, IMHO.

PC users who use PGP should try Pegasus and PGP JN.

Private Idaho is available from Joel McNamara's page, at:
http://www.eskimo.com/~joelm/


Rich

______________________________________________________________________
Rich Burroughs  richieb at teleport.com  http://www.teleport.com/~richieb
See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon
U.S. State Censorship Page at - http://www.teleport.com/~richieb/state
New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause






From raph at cs.berkeley.edu  Sun Jun 16 17:43:54 1996
From: raph at cs.berkeley.edu (Raph Levien)
Date: Mon, 17 Jun 1996 08:43:54 +0800
Subject: Proposal: PGPmail Plugin for Netscape/Mosaic
In-Reply-To: <199606152019.NAA02248@jobe.shell.portal.com>
Message-ID: <31C491F9.C9C2F80@cs.berkeley.edu>


Mark M. wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On Sat, 15 Jun 1996, Hal wrote:
> 
> > There was a little discussion about this on the coderpunks list, but I
> > didn't get the impression that anyone was ready to run out and do it.
> > I'm not sure whether plugins could also be used for receiving mail in
> > addition to sending, but if so it does seem like a good way to add the
> > functionality.
> 
> Netscape does have support for MIME.  So if PGP/MIME ever becomes more widely
> used, the Netscape mail program would decrypt and verify emails automatically.

I certainly don't want to stand in the way of such a plugin - it
certainly sounds like an interesting idea. However, the problem that
Netscape does not export mail through the plugin API sounds quite
difficult - it seems likely that, barring changes to the plugin API, an
entirely new and parallel mailer would need to be developed.

In the meantime, it is possible to integrate Unix Netscape with PGP
today, using premail. This includes fully seamless and transparent
support for PGP/MIME. In addition, you get support for the anonymous
remailers thrown in for free.

The main problem with the current release (0.43) is the lack of adequate
documentation. The near-mythical "next release" should fix that, when I
finally get it done.

Raph





From raph at cs.berkeley.edu  Sun Jun 16 18:04:10 1996
From: raph at cs.berkeley.edu (Raph Levien)
Date: Mon, 17 Jun 1996 09:04:10 +0800
Subject: Netscape Mail Security and PGP Plugins
In-Reply-To: <31C39529.133B6630@best.com>
Message-ID: <31C494FF.7B1A422@cs.berkeley.edu>


Greg Kucharo wrote:
> 
> There hasn't been a lot of discussion on this list about the future
> of secure e-mail via Netscape. The most i've seen has come from
> Raph Levien on the standards battle between S/Mime and other various
> implementations including one using PGP. Raph has said at various
> Cypherpunks meetings now that( and not wanting to totally put words in
> his mouth) the PGP based implementations have lost ground to S/MIME.

I certainly believe this - PGP now has the first real challenge to its
continued viability.

I would like to emphasize (at the risk of repeating myself) that it now
looks quite possible that the limitations of S/MIME that I discussed at
the next-to-last cpunks meeting will be addressed. It hasn't been
formally decided, though. I'd say this is an important opportunity for
cypherpunks to make themselves heard. S/MIME as it is currently defined
has severe implementation weaknesses. There are two concrete proposals
on the table to fix these problems - lobbying the S/MIME people will
help.

>  The reason I believe that this whole area has received so little
> quarter on the list is that either few people use Netscape for e-mail
> and that few people actually send encrypted e-mail.

Undoubtedly a combination of both.

>  I'm going to try and put together a compendium of web links on this
> so it's a little easier to track the developments and various schemes.
>  At the second to last Cypherpunks Bay Area meeting we had a discussion
> of crypto GUI's. It's my opinion that Netscape would be an excellent
> place to start because it does encryption relatively seemlessly.
> Incorporating S/MIME into the mail would be a great step forward in
> bringing easy crypto to the general community. Any PGP plugin I would
> hope eleviate the many UI problems PGP has.
>  A couple of questions I have right off the bat are;

>  1. In Hal's Java mail encryptor, what are the legal aspects of
> sending code across that contains crypto?

Almost undoubtedly still illegal, unless Pro-CODE passes.

>  2. Can any plugin access the Netscape Mail program.

No. As currently defined, the Netscape API does not export mail.

>  3. When is S/MIME going to be in Netscape, I tried to find info on the
> web site but thier statements about S/MIME seem vague.

I hear conflicting reports on this myself, but my best guess would be
some time this fall - probably just a month or two before PGP 3.0 ships
;-)

>  I hope I'm not running over old ground, but this has to be alot more
> intresting than discussing that PBS show!

Agreed.

Raph





From s1113645 at tesla.cc.uottawa.ca  Sun Jun 16 18:18:52 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Mon, 17 Jun 1996 09:18:52 +0800
Subject: RSA patents in Canada
In-Reply-To: <199606112304.QAA22657@atropos.c2.org>
Message-ID: <Pine.3.89.9606161647.A19358-0100000@tesla.cc.uottawa.ca>




On Tue, 11 Jun 1996 sameer at c2.org wrote:

> 	Anyone have a definitive source on the state of the RSA patent
> in Canada? Thanks.

I keep hearing that it is only patented in the States by virtue of having
been presented in public before the application (which they did to avoid a 
gag order). I know that Schneier and others list it as only patented in 
the States. 

Are you wondering whether some odd provision of NAFTA would give it
protection in Canada? Otherwise it should be public domain. Anyone else
know for certain? 






From perry at alpha.jpunix.com  Sun Jun 16 18:52:26 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Mon, 17 Jun 1996 09:52:26 +0800
Subject: new type2.list/pubring.mix
Message-ID: <Pine.NEB.3.93.960616161536.8886A-100000@alpha.jpunix.com>


-----BEGIN PGP SIGNED MESSAGE-----

Hello everyone,

	A new type2.list/pubring.mix combination that reflects the
retirement of the experimental remailer, middleman, has been posted. You
can get it by web from www.jpunix.com. or by FTP from ftp.jpunix.com.

 John Perry - perry at alpha.jpunix.com -  PGP-encrypted e-mail welcome!
 WWW - http://www.jpunix.com
 PGP 2.62 key for perry at jpunix.com is on the keyservers.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcR58lOTpEThrthvAQGocgP/V3UuU11iwo6Yme295YygWqXekKKxkXXH
4u94vrwkYF3qTT+9W3vrgRuUueOf/xF6FP0FZj14wc0sZ51wAnHvPxpHNxzoXuFH
Z7IAOv7MsSfm8Cn2/kFqK+KAGlaKRFpHzJUZS61Oo2u7HrLvejjNd4ZOfAhZ83m7
opBUlcYqCPA=
=0LW8
-----END PGP SIGNATURE-----





From perry at alpha.jpunix.com  Sun Jun 16 20:37:38 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Mon, 17 Jun 1996 11:37:38 +0800
Subject: alpha.c2.org in deep shit?
In-Reply-To: <199606161825.LAA02892@jobe.shell.portal.com>
Message-ID: <Pine.NEB.3.93.960616181221.1490B-100000@alpha.jpunix.com>


-----BEGIN PGP MESSAGE-----
Version: 2.6.2

hIwDSReYoIbc3PkBA/9xblBrrofx89t5QoJVwCyGB/+futdCXEolwcsQdwWGcDtc
7Vn7orCB8v6iQO+sCgAlYf38ftUxGmzebDd/7eWodTGx8XKnzBIZ9E6bRS38XLRa
XDaipoiNRDi7gX2DA5ADtshTLtUiCjaYurGxGEla2iIMrEacGEyyekdZpUYT1KYA
AAJ17fM4D2X8vpKTtWLr/6REeQvxPU80FpWKa/q1b6wMZ43oG9ZolMONj65hWqX0
mhY+wp/vUsvQ21P/9VzYF0sy9JIAr45VhoDZBBCG0UW23WoOInXko2Kl2UeZmrut
xR/nZm1sMzU+XYr7QG17aOfeezRs/frYEpvuAbrWYNELlPH72OBJ368nSkesiTo+
gELda7vNsD12UTEl7gRAo3WizCY2zsQySLOShEiAX7f5vYco8A6pEwJ4XYs4pGn6
xV4JNUeMjBKGtVkGoZJln3x7W1brgGmRNQbY/dcmCkExOOp+4myRVu0/ufH7n5TO
FWqrb+nqyjgnirqS9DwoqB5JsHiMWU/dJBaCtXH4i1p//oeE9FE82nE2vAOZGMvn
D+MRnheCVRi2TWnwe44PnB+L5z7+J+YJyulGM3bvXhZukjGCAj+EMmWxqkSgc2NS
/xh6efgZNACmQIqxLdsw6TLbh9p+yMaxtaCZU9Bs9jw8dN+7FBZxgFG/hrrI1uh3
oFahFMDXXAUMUs7lFOcxjAWTRRZKKSOG2mg5M5mr8VbY+5BQdcJJeY+jSCnDinUC
wGFfEWlZMV7sdKhzA0YkHJYBgAPtmTaxrHQidPce46FbIeYVRsUOSEtvttYpMjIz
mCVc5ywueUXbUe5UW3KrlV8uxKH3fEIEZ9Pxf3M9XR/aFXysccnzNzbe87XN8PDk
mxzsRzmoD0CgCSAGfNrTdWl8bFQGnEaweMPnSIFzbSJkRcO0oiBU4/dhEFYiPgx5
UD2r0uFNjKPt4KFBbFJLi0mrMuOCaxjhva7i70GQ95b4qVsyOZLN5KYSUnSDxDX4
HFUIrEI/rsw=
=BesD
-----END PGP MESSAGE-----





From reagle at mit.edu  Sun Jun 16 21:07:06 1996
From: reagle at mit.edu (Joseph M. Reagle Jr.)
Date: Mon, 17 Jun 1996 12:07:06 +0800
Subject: Does information want to be free?
Message-ID: <9606162128.AA00301@rpcp.mit.edu>


At 10:41 PM 6/14/96 -0400, Declan B. McCullagh wrote:
>I confess I was amused by how he described
>those Internet anarchists who delighted in publicizing books that should
>in fact be restricted.

        I am amused (though I am not taking sides) by the general lack of
attention or rhetoric that "crypto-anarchists"/"crypherpunks"/whatever,
otherwise privacy respecting people, usually espouse.

        If someone found out all the medical information of cypherpunks list
members and distributed about the Net, how would people feel? (This is a
rhetorical question, and I am familiar and agree with some of the arguments
regarding public interest, public figures, copyright isn't a privacy
protecting mechanism, yada yada yada. Just something to think about, what if
large corporations, public interest groups, lobbeys, or governments can use
this as a precedent against "us".)
_______________________
Regards,            Democracy is where you can say what you think 
                    even if you don't think. -?
Joseph  Reagle      http://rpcp.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From root at HellSpawn  Sun Jun 16 21:52:22 1996
From: root at HellSpawn (Damien Lucifer)
Date: Mon, 17 Jun 1996 12:52:22 +0800
Subject: The Molson Great Web Anonymizer
Message-ID: <Pine.LNX.3.91.960616203924.4401A-100000@HellSpawn>



Actually, they call it the Molson Web Canadianizer, but it looks like an 
anonymizer to me.  You give it a URL and the Canadianizer grabs the URL 
and adds some funny canadian modifications to the page, and sends it back 
to you.  It changes all the links to link through the canadianizer, also, 
which is convenient. 

This page originally allowed you to specify a url, but now it seems they 
only allow you to click and grab a random page. Specifying the address to 
connect to in your browser will solve this though.. Heres the URL:


http://www.molson.com/cgi-bin/cize?url=http://www.your.site.com/the/url







From AwakenToMe at aol.com  Sun Jun 16 22:38:00 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Mon, 17 Jun 1996 13:38:00 +0800
Subject: Java
Message-ID: <960616205402_557578073@emout14.mail.aol.com>


Since I am new here, and its probably been asked one billion times...
.. I've only heard a tiny bit about a problem that existed with security and
Java about 6 months ago.... What was it?





From s1113645 at tesla.cc.uottawa.ca  Sun Jun 16 23:08:04 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Mon, 17 Jun 1996 14:08:04 +0800
Subject: whitehouse queries files on political enemies
In-Reply-To: <199606102021.NAA01025@netcom9.netcom.com>
Message-ID: <Pine.3.89.9606162123.B14926-0100000@tesla.cc.uottawa.ca>




On Mon, 10 Jun 1996, Vladimir Z. Nuri wrote:

> 
> what goes around comes around..
> this reminds me of the old stories of Nixon and the various NSA
> domestic programs mentioned by Bamford ("Puzzle Palace")

Speaking of which, is the second edition actually out yet?





From WlkngOwl at unix.asb.com  Sun Jun 16 23:38:37 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Mon, 17 Jun 1996 14:38:37 +0800
Subject: Snake Oil on the Water...
Message-ID: <199606170049.UAA14796@unix.asb.com>


On 16 Jun 96 at 11:19, Alan Olsen wrote:

> I recieved this on another list.  The snake oil is starting to flow pretty
> heavy.  I expect it to get worse...

> >Subject: Windows 3.x or Win95 FREEWARE Mail/Encryption Program
> >X-UIDL: 788ef8d7083cb4f8e94b2c20183773b5
[..]
> >At the following two sites, you may download the FREEWARE Pegasus Mail
> >program version 2.3.3 16 bit for windows 3.x or a version for WIN95. The
> >unique thing about it, besides its simplicity and that it's a great mail
> >program better than Eudora, it has a built in encryption program that is as

Actually, it is much better than Eudora and has plug-ins for 
encryption.  The native encryption sucks, and the author warns 
against it (it's there as a demo of the crypto API!).

There *is* a PGP-plugin (w/source) that uses PGP to 
encrypt or decrypt mail and add keys.  The last version I saw had 
shitty key management... if you're emailing somebody at an address 
different from the key-id, it didn't prompt you for another key (and 
Pegasus 2.2 sent it out in cleartext!).

I don't like the add on much, but many others do, aware of that flaw 
and some others.

Seems like the person who wrote that message doesn't know what he's 
talking about.

There's a difference between snake oil and a user who doesn't 
understand a product.

Rob.
 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From llurch at networking.stanford.edu  Sun Jun 16 23:41:02 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Mon, 17 Jun 1996 14:41:02 +0800
Subject: Snake Oil on the Water...
In-Reply-To: <2.2.32.19960616192749.008f7570@mail.teleport.com>
Message-ID: <Pine.GUL.3.93.960616185913.7965A-100000@Networking.Stanford.EDU>


On Sun, 16 Jun 1996, Rich Burroughs wrote:

[...]
> Here's the reply I sent to that list.  I cc'd the person who sent the
> original message...
[...]
[referring to http://www.aimnet.com/~jnavas/winpmail.html]
> I really think the Pegasus team would do better to mention
> that John's program is available, rather than try to steer
> people away from PGP.  PGP JN makes using the basic email

AFAIK, "The Pegasus Team" is still one person, and he's not an idiot. The
person who sent the message was some random idiot, not a member of "The
Pegasus Team." Just thought that should be straightened out lest any
unwarranted ill will be left floating around... 

-rich






From root at HellSpawn  Mon Jun 17 00:26:17 1996
From: root at HellSpawn (Damien Lucifer)
Date: Mon, 17 Jun 1996 15:26:17 +0800
Subject: [noise] Re: SM3 ?'s (fwd)
Message-ID: <Pine.LNX.3.91.960616205842.4422A-100000@HellSpawn>




On Sun, 16 Jun 1996 19:09:45 -0400, eron at in-sync.com (Eron Cohen)
wrote:

Don C. Jenkins wrote:

> 3) Now that I am almost convinced that SM3 is the software I wish to
> purchase - I was wondering if there is a way to make it automaticley edit
> out irritating clients from my schedule? Or insert an extra million in my
> bank account?
>

Yes.  We are planning to ship this effect with 3.5 version of Razor
next month. Not only does it remove the clients from your schedule but 
from your entire life using an advanced form of pattern recognition.  We 
need to get this approved by the bureau of tobacco and firearms before we 
are allowed to start shipping it though, because in some places its 
considered a munition.  Once approved we  hope we can open our market to 
annoyed people in other fields too.






From richieb at teleport.com  Mon Jun 17 01:09:58 1996
From: richieb at teleport.com (Rich Burroughs)
Date: Mon, 17 Jun 1996 16:09:58 +0800
Subject: Snake Oil on the Water...
Message-ID: <2.2.32.19960617033306.00921104@mail.teleport.com>


At 07:03 PM 6/16/96 -0700, Rich Graves wrote:
>On Sun, 16 Jun 1996, Rich Burroughs wrote:
>
>AFAIK, "The Pegasus Team" is still one person, and he's not an idiot. The
>person who sent the message was some random idiot, not a member of "The
>Pegasus Team." Just thought that should be straightened out lest any
>unwarranted ill will be left floating around... 

Yes, you're absolutely right, and I owe the Pegasus author a big
apology for assuming that this guy who thinks there's a 40 bit
domestic version of PGP had anything to do with Pegasus.

I really misspoke, and I apologize.

BTW, I've heard that Pmail is progressing quite well.


Rich

______________________________________________________________________
Rich Burroughs  richieb at teleport.com  http://www.teleport.com/~richieb
See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon
U.S. State Censorship Page at - http://www.teleport.com/~richieb/state
New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause






From lzirko at c2.org  Mon Jun 17 01:20:52 1996
From: lzirko at c2.org (Lou Zirko)
Date: Mon, 17 Jun 1996 16:20:52 +0800
Subject: Snake Oil on the Water...
Message-ID: <199606170337.UAA03575@infinity.c2.org>


-----BEGIN PGP SIGNED MESSAGE-----

To: richieb at teleport.com, cypherpunks at toad.com, alano at teleport.com
Date: Sun Jun 16 22:36:53 1996
Now if we could get John to get it to work with the 32-bit version it would 
be even better.

Lou Z.

> John's program is available at:
> http://www.aimnet.com/~jnavas/winpmail.html
> 
> I really think the Pegasus team would do better to mention
> that John's program is available, rather than try to steer
> people away from PGP.  PGP JN makes using the basic email
> features of PGP more streamlined than most other mail
> packages I've used (except Private Idaho, which is not a
> full-fledged email package).  I think it would be better to
> mention that both options exist, rather than seeking to
> convert the masses away from PGP, which is unlikely to
> succeed anyway, IMHO.

Lou Zirko                                (502)383-2175
Zystems                                  lzirko at c2.org
"We're all bozos on this bus" - Nick Danger, Third Eye

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1

iQEVAwUBMcTTBstPRTNbb5z9AQEWpAgAoNBF5M+xyRPRAQjdBR8NpMgwEsb2lROj
Now8Ku1ovNvTDc+Y7ZJ8InN1pyM53SA72LIjXFX5Tjughbkkh+96nXCsdEvStBO2
im4rIA+cv2QmcdhGVScgokUkY5BRiNnCc92bH+zOxmQMx/r7Bx8779phChQebF6P
01GP94Vlwh8lVoM7T4LCfAto5tsgMQVIwbOoYqkeDU1SpSQvz030XpQqaN94oCTh
le7foWIWMJuAD26zetsbWgeEfZpIL/9M4e1dfDbcSJsBBN3Wwzs2XxKYqgbsz7ob
18+4toNNblt6WcPnhvbFzSgf3v0sYUAEcqawg/7QJiCBjNGncBwjJw==
=nVgx
-----END PGP SIGNATURE-----






From alano at teleport.com  Mon Jun 17 01:43:36 1996
From: alano at teleport.com (Alan Olsen)
Date: Mon, 17 Jun 1996 16:43:36 +0800
Subject: Snake Oil on the Water...
Message-ID: <2.2.32.19960617043137.00d111a0@mail.teleport.com>


At 12:27 PM 6/16/96 -0700, Rich Burroughs wrote:

>For those people who want to use PGP with Pegasus, there's a
>nice little plug-in for Pegasus called PGP JN, by John Navas,
>which allows you to choose to encrypt with PGP (you need to
>have a copy) instead of the Pmail crypto.  It has a few small
>drawbacks, IMHO, but I found it much easier to use than PGP
>shell interfaces that require cutting text to the clipboard 
>first.

It is very nice with one major drawback.  It does not support conventional
cryptography with PGP.  This means that it is absolutly useless for use with
nyms.  (Which is one of my main uses for PGP in the first place.)  Other
than that...
---
Alan Olsen -- alano at teleport.com -- Contract Web Design & Instruction
        `finger -l alano at teleport.com` for PGP 2.6.2 key 
                http://www.teleport.com/~alano/ 
  "We had to destroy the Internet in order to save it." - Sen. Exon







From alano at teleport.com  Mon Jun 17 01:44:55 1996
From: alano at teleport.com (Alan Olsen)
Date: Mon, 17 Jun 1996 16:44:55 +0800
Subject: Snake Oil on the Water...
Message-ID: <2.2.32.19960617043139.00d52ba8@mail.teleport.com>


At 08:47 PM 6/16/96 +0000, Deranged Mutant wrote:

>Actually, it is much better than Eudora and has plug-ins for 
>encryption.  The native encryption sucks, and the author warns 
>against it (it's there as a demo of the crypto API!).

I found this part out later.  My mistake for not checking the program docs.

[snip]

>Seems like the person who wrote that message doesn't know what he's 
>talking about.

That is very true.  He is clueless and unrepentantly so.  His private e-mail
to me indicates it in spades.  (As well as being rude and insulting for even
challenging his claims about the program.)

>There's a difference between snake oil and a user who doesn't 
>understand a product.

True.  I was not aware that the author of the program had warned against
using it as well.  Evidently this guy did not read that part as well...

---
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.teleport.com/~alano/          | alano at teleport.com  |






From stewarts at ix.netcom.com  Mon Jun 17 02:03:10 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jun 1996 17:03:10 +0800
Subject: How to find out if the list is down? [ADMINISTRIVIA]
Message-ID: <199606170519.WAA12239@toad.com>


>Subject: Is the list down?

No (and the delay between your posting and my reply
is just because I've been too busy to read it all.)
In general, if the list isn't reaching you, it's occasionally because
mail is stuck between toad.com and your machine, occasionally because
the list is stuck, and occasionally because you've been dropped.

If you send mail to majordomo at toad.com saying
        who cypherpunks
it will send you a list of everyone on the list, possibly including you.
(If it doesn't include you, then you know what's wrong.)
If mail's working, it usually answers pretty fast.  
If mail's jammed, sometimes this kicks it off, and sometimes it stalls,
just like a posting you sent to the entire 1200+ list members would (:-).

And sometimes there's something more subtle going on, in which case you
can send mail to cypherpunks-owner at toad.com and/or owner-cypherpunks at toad.com.

Of course, it could be that nobody's posted anything to the list
in the last 24 hours, which probably means that Hugh's implemented
the Signal-to-Noise-Improver Bot and nothing made it past the filters.....

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From furballs at netcom.com  Mon Jun 17 02:46:02 1996
From: furballs at netcom.com (Paul S. Penrod)
Date: Mon, 17 Jun 1996 17:46:02 +0800
Subject: Slander of Catholic Church
In-Reply-To: <ade31529110210043f6a@[205.199.118.202]>
Message-ID: <Pine.3.89.9606162154.A9589-0100000@netcom19>




On Tue, 11 Jun 1996, Timothy C. May wrote:

> At 5:59 PM 6/11/96, attila wrote:
> 
> >        too strong, moroni  --remember _our_ values; not those of a critic.
> >    last night in FHE I covered the first mob in Jackson County where Bushop
> >    Partridge turned the other cheek to make it easier after the first was
> >    tarred by the mob.
> 
> Thanks, Attila. I think Paul Penrod and the Archangel Moroni missed my main
> point. I was not singling out Mormonism for special criticism, just using
> it as an example of a "cult" or "religion" which is in many ways even more
> "outre" to many of us than Scientology is. Belief that a body rotting in
> the ground can be baptized into one's church is at least as odd as
> believing that Mankind is descended from the survivors of spaceships
> fleeing an evil overlord.

No, Tim, I got your point. What I object to is the use of the list to 
express yet another tangental non-topical thread when we already have the 
"hallowed" Dr. Hallam-Baker pontificating on the virtues and 
existentialism of the marketplace at what I suppose he presumes is at the 
expense of Perry Metzger, the assasination politics bullshit, and various 
other noise producing posts.

What you may not realize is, while the CoS may be interested in 
protecting their reputation, I have not seen spam in this list as the 
result of any critism; however, anti-mormonism runs long and deep, and 
there will be a deluge of postings here should some entrprising 
individual take it upon himself to post the topic elsewhere (which I have 
seen samples of post from this list appear in other usenet groups.)

What I don't want to see is this list get any muddier. 4 Days out of 
pocket and I have 345 messages, most of which gets round filed.

> 
> My point, in using Catholicism as an example (interesting that only my
> brief lines on Mormon views were critiqued...Catholicism must indeed be
> nearly extinct on lists like ours), was that one's man's "criminal cult" is
> another man's "holy religion," and that the "net.war" declared by some on
> the Church of Scientology is little different than having a similar war
> against Catholics, Rosicrucians, Parsees, whatever.

I don't comment on the Catholics as I don't know enough about them to 
render an informed opinion.

As to the free speech and exercising of religion issues, I find that more 
relavent and worthy of the writings that hallmark your thoughtfulness on 
any topic.

> 
> The Church of Scientology is no more a cult than is LDS or
> Catholicism....it is just much newer. Believing that clam consciousness
> suffuses our thoughts is no stranger than are the bizarre claims of most
> religions.
> 
> Talk is of some belief systems being "cults" and others being "religions."
> When the Constitution speaks of "Congress shall make no law regarding the
> establishment of religion...," it is clear that this is not just for
> "recognized" and "established" religions.
> 
> (Before the usual suspects jump in with quibbles, this does not mean that a
> religion may not be constrained in various ways. The laws against polygamy
> constrained the Mormons, the laws against certain drugs constrained certain
> Native American religions, etc. Constitutional law classes are the best
> forum to debate this.)
> 
> I am no supporter of the CoS, nor of any religion. I find it hypocritical
> for folks bashing the "clams" and bombarding a.r.s with copyrighted CoS
> material to now be whining that the clams are "unfairly" using a.r.s.
> 
> I also find it "unsurprising" that the CoS is taking steps to preserve what
> it thinks is its copyrighted, proprietary material.
> 
> (I am  not interested in debating the ins and outs of whether the NOTS
> material should or should not have been published, nor of whether some
> investigators went overboard in investigations of Grady Ward, etc. This
> stuff is boring ephemera to me, just another religious war.)
> 
> --Tim May
> 







From vin at shore.net  Mon Jun 17 03:07:11 1996
From: vin at shore.net (Vin McLellan)
Date: Mon, 17 Jun 1996 18:07:11 +0800
Subject: Zimmerman/ViaCrypt?
Message-ID: <v02140b01adea690a261a@[198.115.179.224]>


Edgar Swank noted:

>There was a big discussion recently on alt.security.pgp about PRZ and
>ViaCrypt.  Apparently Phil now wants to produce his own commercial
>version of PGP and has "requested" ViaCrypt to sell back the
>commercial rights under threat of a lawsuit if they don't.
>
>Phil disagrees with ViaCrypts new "business" version of PGP which
>apparently encrypts all messages with an employer-supplied public key
>in addition to any specified by the employee.  ViaCrypt has their side
>of the argument on their web page. <http://www.viacrypt.com/>

        PRZ is becoming a businessman.  Nothing wrong about that --
business is what makes the cars shine and the toilets flush.  To me,
however, it seems self-servingly pious to seek to reclaim previously sold
rights on the grounds that a corporate customer should not have the right
to set up an escrow key for company communications.

        There's another debate due about whether an employee should have
the right to also -- on company time, over company nets, etc. -- use e-mail
with a private (non-escrowed) encryption to secure personnal
communications.  I, predicably, think the employee should have such a right
-- as part of the permissible and acceptable "personal space" allowed an
employee.  (Just as he/she should be allowed to make unmonitored personal
phone calls, and go to the bathroom when the urge strikes.)  Today, this
level of privilege is probably an artifact of white collar or professional
employment;  not an employee's or citizen's right, but rather a perk
associated with the independence granted a valued employee who expects and
demands it.

>The basis of the possible lawsuit would be that ViaCrypt violated
>their agreement not to put any "back door" into any product with the
>PGP name. Whether the "business version feature" could be defined as a
>"back door" would be the crux of the argument.

        That's an argument that should be laughed out of court.  And off
the Net even sooner.  (Although Phil is so much of a hero to most of us,
for his own productive efforts and for having endured the DoJ's squeeze, he
probably got an outrageously tolerant hearing on alt.security.pgp.)

 Steve Reid <root at edmweb.com> added:

>>IMHO Phil Zimmerman has good reason to object to the mutant version, >>if
>>it's going to cause the PGP name to somehow endorse escrow.

        Balderdash! There is nothing corrupt or nasty about escrow, per se
-- the issue is who gets access to the escow key and under what conditions.
If the legitimate owner of the protected information totally controls the
escrow key, there is no issue.  In business communications, key escow is
just another dimension in backup.

>>If there really is a demand for escrow, maybe cypherpunks could create a
>>One Time Pad escrow service. Different custom 'keys' could be produced,
>>depending on who's asking for the data... <G>

        There is a demand for escrow.  For a while, seven or eight years
ago, I collected tales of all the weak commercial crypto system which were
then being busted.  One of the most striking things was the number -- four
or five commercial products that I recall, Lotus 1,2,3 being the most
prominent -- which were cracked by legitimate administrators desperate to
retrieve something encypted by an employee who had lost his/her key.

        Suerte,
                                _Vin

         Vin McLellan +The Privacy Guild+ <vin at shore.net>
      53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548
                         <*><*><*><*><*><*><*><*><*>







From stewarts at ix.netcom.com  Mon Jun 17 03:34:27 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jun 1996 18:34:27 +0800
Subject: Remailer Operator Liability? [NOISY RESPONSE]
Message-ID: <199606170649.XAA13162@toad.com>


>> distributed to a minor who was using a nym. I think pressure on anonymous
>> remailers is going to increase as various groups complain that the paw
>> innocent widdle kiddies are "vulnerable to corruption"(or some bullshit like
>> that) because their age can be hidden. Read the decision. The CDA _may_ be
>
>This is true. Yesterday evening I interviewed the director of
>enforcement for a TLA here in DC. He expressed his concern about
>anonymous remailers and anonymity online. (More on this later.)
>
>The word here in DC is "accountability."

You can always attract government officials by offerering them
other bureauspeakisms, like "plausible deniability" and
"convenient leak mechanisms for 'reputable sources'".

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From stewarts at ix.netcom.com  Mon Jun 17 04:27:25 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Mon, 17 Jun 1996 19:27:25 +0800
Subject: Does information want to be free?
Message-ID: <199606170744.AAA13912@toad.com>


>>I confess I was amused by how he described those Internet anarchists
>> who delighted in publicizing books that should in fact be restricted.
>        I am amused (though I am not taking sides) by the general lack of
>attention or rhetoric that "crypto-anarchists"/"cypherpunks"/whatever,
>otherwise privacy respecting people, usually espouse.

Many of us do care about those privacy issues - computers are very good
at combining information from multiple sources, and crypto is about the
only technology that lets you change the balance of power away from
computerized centralization to individual-controlled decentralization.

On the other hand, the phrase "books that should in fact be restricted"
is viewed by many of us to be a synonym for "the empty set"; "books about
government leaders which should be restricted" is an even emptier set,
whether they're true, bogus, or some of each.

In general, a Cypherpunk(tm) approach to protecting private information
is not to advocate laws against distributing it, but to build tools to 
let you protect it while giving it to people that you _do_ want to have it;
perhaps to use individual contracts to protect the information,
but also to build tools to support contractual agreements and
identify leaks.  In some cases, boycotting organizations that violate
privacy is a good idea (and building alternatives can support boycotts);
flaming them for rudeness is another approach :-), and helping organizations
understand the privacy implications of what they're doing and helping
them use privacy-preserving methods instead of hanging an SSN on everything
is another good cypherpunks activity.  On the other hand, building
anonymous publishing systems so people can blow the whistle on their
government officials is a good thing, even though it may be used by
people rude enough to pry into people's private lives.

Also, while publishing one politician's cancer experience may be rude,
publishing a recent American president's growing senility should have
been done more aggressively, as should publishing the moral failures
of his Vice president....

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From frissell at panix.com  Mon Jun 17 06:48:09 1996
From: frissell at panix.com (Duncan Frissell)
Date: Mon, 17 Jun 1996 21:48:09 +0800
Subject: Remailer Operator Liability?
Message-ID: <2.2.32.19960617102038.00b7949c@panix.com>


At 05:53 PM 6/15/96 +1000, Zed wrote:
>
>Unlikely. The use of anonymous remailers was given as a reason for why it
>was impossible to effectively determine if indecent material was being
>distributed to a minor who was using a nym. I think pressure on anonymous
>remailers is going to increase as various groups complain that the paw
>innocent widdle kiddies are "vulnerable to corruption"(or some bullshit like
>that) because their age can be hidden. Read the decision. The CDA _may_ be
>declared constitutional if there was an effective and reliable way of
>preventing minors from accessing "indecent" material - which anonymous
>remailers make harder to do.

However, even if remailers didn't exist, kiddies could still be unknowingly
reached via mailing lists (anyone know who came up with the term "email
exploder" that the Court used instead of "mailing list"?), freenet accounts,
un- age verified accounts opened anywhere on earth, or borrowed accounts.
The decision mentioned some of this.

DCF






From nobody at REPLAY.COM  Mon Jun 17 06:52:07 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Mon, 17 Jun 1996 21:52:07 +0800
Subject: UK users about to get clippered
Message-ID: <199606171003.MAA21827@basement.replay.com>


If you live the UK, brace yourself for HMG's "Clipper" annoucement
later this week.  Look particularly carefully at the escrow agencies.


- Remailereuters






From frissell at panix.com  Mon Jun 17 07:04:46 1996
From: frissell at panix.com (Duncan Frissell)
Date: Mon, 17 Jun 1996 22:04:46 +0800
Subject: Remailer Operator Liability?
Message-ID: <2.2.32.19960617102043.00b73358@panix.com>


At 05:53 PM 6/15/96 +1000, Zed wrote:
>On another front, anonymous remailers were brought up in the latest hearing
>of the Church of Scientology's court case against Dennis Erlich. Judge Whyte
>expressed concern that trade secret status could be destroyed simply by
>posting information through an anonymous remailer. 

Of course, trade secret status could also be destroyed by posting something
straight without anonymity.  And were one judgment proof one's exposure as
the poster would be meaningless.  Even a completely non-anonymous account
may be hard to trace if you have a common name and the account is based
somewhere far from home.  If you open an account on a Dutch system using
your (common) name, you might be hard to find.

It's the ease of publication not the anonymity that makes the Net dangerous
for trade secrets.

DCF

"If the most common given name on earth is Mohammed and the most common
surname is Lee does that mean that the most common name is Mohammed Lee?"






From declan+ at CMU.EDU  Mon Jun 17 10:05:19 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Tue, 18 Jun 1996 01:05:19 +0800
Subject: Remailer Operator Liability?
In-Reply-To: <2.2.32.19960617102038.00b7949c@panix.com>
Message-ID: <UllJ=kK00YUyI3Snos@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 17-Jun-96 Re: Remailer Operator
Liabi.. by Duncan Frissell at panix.co 
> However, even if remailers didn't exist, kiddies could still be unknowingly
> reached via mailing lists (anyone know who came up with the term "email
> exploder" that the Court used instead of "mailing list"?), freenet accounts,
> un- age verified accounts opened anywhere on earth, or borrowed accounts.
> The decision mentioned some of this.

I believe we used the term "email exploder" instead of "mailing list,"
particularly in cross-examination and closing arguments, to convey the
idea that such a device is often used for conversation, not just one-way
communication.

The fight-censorship list (mail exploder?) is part of the lawsuit, and
my sworn testimony included:

  the list sometimes includes material that could be considered
"indecent" or   "patently offensive."  Minors are not excluded from this
list.

-Declan






From ses at tipper.oit.unc.edu  Mon Jun 17 10:17:05 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Tue, 18 Jun 1996 01:17:05 +0800
Subject: UK users about to get clippered
In-Reply-To: <199606171003.MAA21827@basement.replay.com>
Message-ID: <Pine.SUN.3.91.960617083538.11474A-100000@tipper.oit.unc.edu>


This has been slightly discussed on cypherpunks already. The url for the 
DTI report has been posted, and somebody mentioned an IEE meeting where 
things are supposed to be unveiled on the 27th. 


I'm in the UK at the moment - I asked if there were any plans for a 
cypherpunks presence at the meeting, but didn't get any responses. 
It's currently a DTI white-paper, and is not inevitable with 
appropriate lobbying 

Simon





From frissell at panix.com  Mon Jun 17 11:40:23 1996
From: frissell at panix.com (Duncan Frissell)
Date: Tue, 18 Jun 1996 02:40:23 +0800
Subject: Remailer Operator Liability?
Message-ID: <2.2.32.19960617134543.00766238@popserver.panix.com>


At 08:43 AM 6/17/96 -0400, Declan B. McCullagh wrote:

>I believe we used the term "email exploder" instead of "mailing list,"
>particularly in cross-examination and closing arguments, to convey the
>idea that such a device is often used for conversation, not just one-way
>communication.

Was this term invented during the hearings or has anyone heard of it before?

DCF






From sinclai at ecf.toronto.edu  Mon Jun 17 13:09:18 1996
From: sinclai at ecf.toronto.edu (SINCLAIR DOUGLAS N)
Date: Tue, 18 Jun 1996 04:09:18 +0800
Subject: RSA patents in Canada
In-Reply-To: <Pine.3.89.9606161647.A19358-0100000@tesla.cc.uottawa.ca>
Message-ID: <96Jun17.095732edt.10195@cannon.ecf.toronto.edu>


> On Tue, 11 Jun 1996 sameer at c2.org wrote:
> 
> > 	Anyone have a definitive source on the state of the RSA patent
> > in Canada? Thanks.
> 
> I keep hearing that it is only patented in the States by virtue of having
> been presented in public before the application (which they did to avoid a 
> gag order). I know that Schneier and others list it as only patented in 
> the States. 
> 
> Are you wondering whether some odd provision of NAFTA would give it
> protection in Canada? Otherwise it should be public domain. Anyone else
> know for certain? 

My understanding was that it couldn't be patented in Canada, because
Canadian law does not acknowledge patents on algorithms.





From adam at homeport.org  Mon Jun 17 13:30:08 1996
From: adam at homeport.org (Adam Shostack)
Date: Tue, 18 Jun 1996 04:30:08 +0800
Subject: The Molson Great Web Anonymizer
In-Reply-To: <Pine.LNX.3.91.960616203924.4401A-100000@HellSpawn>
Message-ID: <199606171516.KAA21408@homeport.org>


Except that Molson is doubtless doing substantial analysis of where
its users go.  Chaining is no use, since the URL gets passed in the
clear.

Web proxies will need to add encrypted URL support to do chaining.
This doesn't require anything on the browser, except SSL.  (Proper
trafic analysis prevention might require mixing of streams, which
implies delays, which amy be unacceptable for most web browsing.)

(Wei pointed this out a long time ago; real time traffic is tough to
protect.)

Adam


Damien Lucifer wrote:

| Actually, they call it the Molson Web Canadianizer, but it looks like an 
| anonymizer to me.  You give it a URL and the Canadianizer grabs the URL 
| and adds some funny canadian modifications to the page, and sends it back 
| to you.  It changes all the links to link through the canadianizer, also, 
| which is convenient. 
| 
| This page originally allowed you to specify a url, but now it seems they 
| only allow you to click and grab a random page. Specifying the address to 
| connect to in your browser will solve this though.. Heres the URL:
| 
| 
| http://www.molson.com/cgi-bin/cize?url=http://www.your.site.com/the/url
| 
| 


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From raph at CS.Berkeley.EDU  Mon Jun 17 13:52:39 1996
From: raph at CS.Berkeley.EDU (Raph Levien)
Date: Tue, 18 Jun 1996 04:52:39 +0800
Subject: List of reliable remailers
Message-ID: <199606171350.GAA22019@kiwi.cs.berkeley.edu>


   I operate a remailer pinging service which collects detailed
information about remailer features and reliability.

   To use it, just finger remailer-list at kiwi.cs.berkeley.edu

   There is also a Web version of the same information, plus lots of
interesting links to remailer-related resources, at:
http://www.cs.berkeley.edu/~raph/remailer-list.html

   This information is used by premail, a remailer chaining and PGP
encrypting client for outgoing mail. For more information, see:
http://www.c2.org/~raph/premail.html

   For the PGP public keys of the remailers, finger
pgpkeys at kiwi.cs.berkeley.edu

This is the current info:

                                 REMAILER LIST

   This is an automatically generated listing of remailers. The first
   part of the listing shows the remailers along with configuration
   options and special features for each of the remailers. The second
   part shows the 12-day history, and average latency and uptime for each
   remailer. You can also get this list by fingering
   remailer-list at kiwi.cs.berkeley.edu.

$remailer{"extropia"} = "<remail at miron.vip.best.com> cpunk pgp special";
$remailer{"portal"} = "<hfinney at shell.portal.com> cpunk pgp hash";
$remailer{"alumni"} = "<hal at alumni.caltech.edu> cpunk pgp hash";
$remailer{"c2"} = "<remail at c2.org> eric pgp hash reord";
$remailer{"penet"} = "<anon at anon.penet.fi> penet post";
$remailer{"flame"} = "<remailer at flame.alias.net> cpunk mix pgp. hash latent cut post reord";
$remailer{"mix"} = "<mixmaster at remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?";
$remailer{"replay"} = "<remailer at replay.com> cpunk mix pgp hash latent cut post ek";
$remailer{"ecafe"} = "<cpunk at remail.ecafe.org> cpunk mix";
$remailer{"amnesia"} = "<amnesia at chardos.connix.com> cpunk mix pgp hash latent cut ksub";
$remailer{'alpha'} = '<alias at alpha.c2.org> alpha pgp';
$remailer{'nymrod'} = '<nymrod at nym.jpunix.com> alpha pgp';
$remailer{"lead"} = "<mix at zifi.genetics.utah.edu> cpunk pgp hash latent cut ek";
$remailer{"treehole"} = "<remailer at mockingbird.alias.net> cpunk pgp hash latent cut ek";
$remailer{"exon"} = "<remailer at remailer.nl.com> cpunk pgp hash latent cut ek";
$remailer{"vegas"} = "<remailer at vegas.gateway.com> cpunk pgp hash latent cut";
$remailer{"haystack"} = "<haystack at holy.cow.net> cpunk mix pgp hash latent cut ek";
$remailer{"ncognito"} = "<ncognito at rigel.cyberpass.net> mix cpunk pgp hash latent";
catalyst at netcom.com is _not_ a remailer.
lmccarth at ducie.cs.umass.edu is _not_ a remailer.
usura at replay.com is _not_ a remailer.

Groups of remailers sharing a machine or operator:
(c2 alpha)
(flame replay)
(alumni portal)

Use "premail -getkeys pgpkeys at kiwi.cs.berkeley.edu" to get PGP keys
for the remailers. Fingering this address works too.

Note: The remailer list now includes information for the alpha
nymserver.

Last update: Mon 17 Jun 96 6:46:17 PDT
remailer  email address                        history  latency  uptime
-----------------------------------------------------------------------
replay   remailer at replay.com              ****+*+***+*     6:14  99.98%
alumni   hal at alumni.caltech.edu           #######**#+#     2:57  99.97%
ecafe    cpunk at remail.ecafe.org           *##.-#+--#+#    50:08  99.96%
vegas    remailer at vegas.gateway.com       -** **+*#*+#     6:21  99.90%
mix      mixmaster at remail.obscura.com     .-+++++++-+   3:15:05  99.90%
c2       remail at c2.org                    -++-++++-++   1:07:45  99.89%
flame    remailer at flame.alias.net         +++++++++++   1:05:51  99.76%
penet    anon at anon.penet.fi               _______._    60:16:03  99.64%
portal   hfinney at shell.portal.com         ##*###  ##+#     2:46  99.49%
nymrod   nymrod at nym.jpunix.com             +**#++*+* *     9:43  99.45%
lead     mix at zifi.genetics.utah.edu       +-++++++++++    45:49  99.29%
exon     remailer at remailer.nl.com         *** *++***+*     5:07  99.23%
haystack haystack at holy.cow.net            *#* +--#*-*+    23:51  99.18%
amnesia  amnesia at chardos.connix.com       ------- ---   3:19:01  96.26%
extropia remail at miron.vip.best.com        ---.-- ----   6:23:54  94.00%
ncognito ncognito at rigel.cyberpass.net      -....- ..   14:29:58  89.44%
treehole remailer at mockingbird.alias.net   +-++++++      3:28:59  62.60%
alpha    alias at alpha.c2.org               ++***+-         37:51  49.39%

   History key
     * # response in less than 5 minutes.
     * * response in less than 1 hour.
     * + response in less than 4 hours.
     * - response in less than 24 hours.
     * . response in more than 1 day.
     * _ response came back too late (more than 2 days).

   cpunk
          A major class of remailers. Supports Request-Remailing-To:
          field.
          
   eric
          A variant of the cpunk style. Uses Anon-Send-To: instead.
          
   penet
          The third class of remailers (at least for right now). Uses
          X-Anon-To: in the header.
          
   pgp
          Remailer supports encryption with PGP. A period after the
          keyword means that the short name, rather than the full email
          address, should be used as the encryption key ID.
          
   hash
          Supports ## pasting, so anything can be put into the headers of
          outgoing messages.
          
   ksub
          Remailer always kills subject header, even in non-pgp mode.
          
   nsub
          Remailer always preserves subject header, even in pgp mode.
          
   latent
          Supports Matt Ghio's Latent-Time: option.
          
   cut
          Supports Matt Ghio's Cutmarks: option.
          
   post
          Post to Usenet using Post-To: or Anon-Post-To: header.
          
   ek
          Encrypt responses in reply blocks using Encrypt-Key: header.
          
   special
          Accepts only pgp encrypted messages.
          
   mix
          Can accept messages in Mixmaster format.
          
   reord
          Attempts to foil traffic analysis by reordering messages. Note:
          I'm relying on the word of the remailer operator here, and
          haven't verified the reord info myself.

   mon
          Remailer has been known to monitor contents of private email.
          
   filter
          Remailer has been known to filter messages based on content. If
          not listed in conjunction with mon, then only messages destined
          for public forums are subject to filtering.
          

Raph Levien





From trei at process.com  Mon Jun 17 15:34:47 1996
From: trei at process.com (Peter Trei)
Date: Tue, 18 Jun 1996 06:34:47 +0800
Subject: PBS show
Message-ID: <199606171517.IAA21218@toad.com>


Received: from toad.com [140.174.2.1] by alcor.process.com
           with SMTP-OpenVMS via TCP/IP; Thu, 13 Jun 1996 14:15 -0400
Received: (from majordom at localhost) by toad.com (8.7.5/8.7.3) id JAA03979 for cypherpunks-outgoing; Thu, 13 Jun 1996 09:36:36 -0700 (PDT)
Received: from mail.pacifier.com (root at mail.pacifier.com [199.2.117.164]) by toad.com (8.7.5/8.7.3) with ESMTP id JAA03971 for <cypherpunks at toad.com>; Thu, 13 Jun 1996 09:36:30 -0700 (PDT)
Received: from ip9.van1.pacifier.com (ip9.van1.pacifier.com [206.163.4.9]) by mail.pacifier.com (8.7.5/8.7.3) with SMTP id JAA22527; Thu, 13 Jun 1996 09:36:13 -0700 (PDT)
Message-Id: <199606131636.JAA22527 at mail.pacifier.com>
X-Sender: jimbell at mail.pacifier.com
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 13 Jun 1996 09:35:16 -0800
To: tcmay at got.net (Timothy C. May), cypherpunks at toad.com
From: jim bell <jimbell at pacifier.com>
Subject: Re: PBS show
Sender: owner-cypherpunks at toad.com
Precedence: bulk

Jim Bell wrote:

>But the Apple II WAS a toy!  Non-detached keyboard, poor placement of reset 
>key, upper-case only, 40-character wide display, odd microprocessor, VERY 
>SMALL capacity floppies (which were very slow as well), as well as a hostile 
>legal situation regarding the building of clones.  Hell, they even objected 
>to other companies building boards which plugged into the bus!

The reason for the 40 column screen was quite simple - many customers
did not want to shell out a few hundred dollars for a monitor, and
instead installed a cheap RF modulator and used an old TV for a
screen. The resolution of a TV is inadequate for 80 coumn text (think
about the smallest easily readable text you've seen on braodcast or
cable).

The Apple ][ did not include the RF modulator because it wasn't FCC
certified with one - but every dealer also sold $20 modulators tailored for
the machine. With the unshielded plastic case, I could wipe out any other
TV within 30 feet - a significant distance for a NYC apartment dweller,
which I was at the time.

While it was not the first machine I programmed (the PDP-8e has that dubious
honor, circa 1971), I learned a lot from my Apple ][. Among other feats, I 
added lower case support to Apple Kermit, and implemented Life in 
6502 assembler using HIRES graphics.

Peter Trei
trei at process.com

Peter Trei
Senior Software Engineer
Purveyor Development Team                                
Process Software Corporation
http://www.process.com
trei at process.com





From jya at pipeline.com  Mon Jun 17 16:08:03 1996
From: jya at pipeline.com (John Young)
Date: Tue, 18 Jun 1996 07:08:03 +0800
Subject: Spy Tech
Message-ID: <199606171533.PAA14512@pipe3.ny3.usa.pipeline.com>


   Three feathers for spying technology: 
 
   TST: "MI6 stole secrets from French navy." 
 
      Top secret technology for tracking nuclear submarines 
      has been stolen from a French naval base by MI6, 
      Britain's foreign intelligence service, after a French 
      civilian engineer was paid thousands of pounds to betray 
      one of his country's most closely guarded secrets to an 
      MI6 front company which posed as a technical defence 
      consultancy and publishing house. 
 
   TST: "High-flying gliders replace satellites." 
 
      Solar powered gliders circling above cities could 
      provide a cheap alternative to satellites for global 
      communication systems, according to a group of American 
      scientists. 
 
   WaJo: "Israel Asks White House to Place Curbs On 3 U.S. 
   Satellite-Surveillance Firms." 
 
      The request is regarded as "very sensitive," according 
      to one U.S. official, because Israeli officials say it 
      relates to their national security concerns. However, 
      officials of the affected U.S. companies charge it 
      amounts to unfair competition because an Israeli company 
      is about to enter the space surveillance business and it 
      wouldn't face similar restrictions. 
 
 
   http://pwp.usa.pipeline.com/~jya/tekspy.txt  (18 kb) 
 
   Spy surf: http://www.anonymizer.com 
 
   Or, TEK_spy 
 





From rah at shipwright.com  Mon Jun 17 16:18:12 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Tue, 18 Jun 1996 07:18:12 +0800
Subject: Gilbert & Cypherpunk...
In-Reply-To: <2.2.32.19960617102038.00b7949c@panix.com>
Message-ID: <v03006f0aadeb295fb6c0@[199.0.65.105]>


At 8:43 AM -0400 6/17/96, Declan B. McCullagh wrote:
> I believe we used the term "email exploder" instead of "mailing list,"
> particularly in cross-examination and closing arguments, to convey the
> idea that such a device is often used for conversation, not just one-way
> communication.

Ah. Probably related to that famous proto-cypherpunk character in the
Gilbert and Sullivan operetta Utopia, Ltd., the Anonymous Royal
Mail-Exploder....

<hyuk!>

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From jya at pipeline.com  Mon Jun 17 16:30:20 1996
From: jya at pipeline.com (John Young)
Date: Tue, 18 Jun 1996 07:30:20 +0800
Subject: The Ultima Spy Book
Message-ID: <199606171540.PAA14807@pipe3.ny3.usa.pipeline.com>


   The Ultimate Spy Book 
   by H. Keith Melton 
   (Dorling Kindersley, London) 
   DK Publishing, New York 
   First American edition, 1996. $29.95. 
   ISBN 0-7894-0443-5 
 
   Over 600 illustrations of the tools and tricks of spycraft 
   for killing, betraying, deceiving, surveilling, encrypting, 
   decrypting, communicating, burgling, recruitment and 
   training, fucking up and rotting in jail, and flacking spy 
   fluff until tip-canoe-ed. 
 
--------- 
 
   Eye pix of cipher devices: 
 
   Kryha, Bolton, Hebern, M-94:      
 
      http://pwp.usa.pipeline.com/~jya/cd1.jpg 
 
   Hagelin's M-209 and CD-57: 
 
      http://pwp.usa.pipeline.com/~jya/cd2.jpg 
 
   Enigma: 
 
      http://pwp.usa.pipeline.com/~jya/enigma1.jpg 
 
   Enigma innards and Geheimschreiber: 
 
      http://pwp.usa.pipeline.com/~jya/enigma2.jpg 
 
   Purple: 
 
      http://pwp.usa.pipeline.com/~jya/purple.jpg 
 
---------- 
 
   CYA: http://www.anonymizer.com 
 





From mixmaster at remail.obscura.com  Mon Jun 17 17:37:59 1996
From: mixmaster at remail.obscura.com (Mixmaster)
Date: Tue, 18 Jun 1996 08:37:59 +0800
Subject: No Subject
Message-ID: <199606171540.IAA02659@sirius.infonex.com>


At 06:14 PM 6/16/96 -0500, "John A. Perry" wrote:
:-----BEGIN PGP MESSAGE-----
:Version: 2.6.2
:
:hIwDSReYoIbc3PkBA/9xblBrrofx89t5QoJVwCyGB/+futdCXEolwcsQdwWGcDtc
:7Vn7orCB8v6iQO+sCgAlYf38ftUxGmzebDd/7eWodTGx8XKnzBIZ9E6bRS38XLRa
:XDaipoiNRDi7gX2DA5ADtshTLtUiCjaYurGxGEla2iIMrEacGEyyekdZpUYT1KYA
:AAJ17fM4D2X8vpKTtWLr/6REeQvxPU80FpWKa/q1b6wMZ43oG9ZolMONj65hWqX0
:mhY+wp/vUsvQ21P/9VzYF0sy9JIAr45VhoDZBBCG0UW23WoOInXko2Kl2UeZmrut
:xR/nZm1sMzU+XYr7QG17aOfeezRs/frYEpvuAbrWYNELlPH72OBJ368nSkesiTo+
:gELda7vNsD12UTEl7gRAo3WizCY2zsQySLOShEiAX7f5vYco8A6pEwJ4XYs4pGn6
:xV4JNUeMjBKGtVkGoZJln3x7W1brgGmRNQbY/dcmCkExOOp+4myRVu0/ufH7n5TO
:FWqrb+nqyjgnirqS9DwoqB5JsHiMWU/dJBaCtXH4i1p//oeE9FE82nE2vAOZGMvn
:D+MRnheCVRi2TWnwe44PnB+L5z7+J+YJyulGM3bvXhZukjGCAj+EMmWxqkSgc2NS
:/xh6efgZNACmQIqxLdsw6TLbh9p+yMaxtaCZU9Bs9jw8dN+7FBZxgFG/hrrI1uh3
:oFahFMDXXAUMUs7lFOcxjAWTRRZKKSOG2mg5M5mr8VbY+5BQdcJJeY+jSCnDinUC
:wGFfEWlZMV7sdKhzA0YkHJYBgAPtmTaxrHQidPce46FbIeYVRsUOSEtvttYpMjIz
:mCVc5ywueUXbUe5UW3KrlV8uxKH3fEIEZ9Pxf3M9XR/aFXysccnzNzbe87XN8PDk
:mxzsRzmoD0CgCSAGfNrTdWl8bFQGnEaweMPnSIFzbSJkRcO0oiBU4/dhEFYiPgx5
:UD2r0uFNjKPt4KFBbFJLi0mrMuOCaxjhva7i70GQ95b4qVsyOZLN5KYSUnSDxDX4
:HFUIrEI/rsw=
:=BesD
:-----END PGP MESSAGE-----
:
My Cypherpunk's New Member's Package did not contain the key to decypher this obviously witty and succinct message; I would appreciate an individual with full membership to pgp this and post it for the benefit of others.

Anyone with key id 86DCDCF9 come on down!

Thanks.

   







From cp at proust.suba.com  Mon Jun 17 17:39:38 1996
From: cp at proust.suba.com (Alex Strasheim)
Date: Tue, 18 Jun 1996 08:39:38 +0800
Subject: Remailer Operator Liability?
In-Reply-To: <UllJ=kK00YUyI3Snos@andrew.cmu.edu>
Message-ID: <199606171557.KAA03404@proust.suba.com>


> (anyone know who came up with the term "email exploder" that the Court 
> used instead of "mailing list"?)

The only time I've ever heard the term was in conjunction with the email 
sent out by the Clinton campaign during the last election.  

I probably misunderstood what was going on, but at the time I assumed that
it was a little different than a mail list.  My impression was that it
was for broadcasting rather than disucssing (ie., only the campaign could
use it), and that it was hierarchical in nature (mail goes to a dozen or a
hundred "exploders" who then send it out to a couple of hundred thousand
individuals). 








From perry at piermont.com  Mon Jun 17 18:05:44 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 18 Jun 1996 09:05:44 +0800
Subject: Remailer Operator Liability?
In-Reply-To: <2.2.32.19960617134543.00766238@popserver.panix.com>
Message-ID: <199606171703.NAA19819@jekyll.piermont.com>



Duncan Frissell writes:
> At 08:43 AM 6/17/96 -0400, Declan B. McCullagh wrote:
> 
> >I believe we used the term "email exploder" instead of "mailing list,"
> >particularly in cross-examination and closing arguments, to convey the
> >idea that such a device is often used for conversation, not just one-way
> >communication.
> 
> Was this term invented during the hearings or has anyone heard of it before?

It is not common, but it used to be used in the early days a lot. I
don't think I've heard it much since '85 or so.

Perry





From ses at tipper.oit.unc.edu  Mon Jun 17 18:51:37 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Tue, 18 Jun 1996 09:51:37 +0800
Subject: Remailer Operator Liability?
In-Reply-To: <2.2.32.19960617134543.00766238@popserver.panix.com>
Message-ID: <Pine.PCW.3.94.960617184654.7343B-100000@CISPPP>


I've heard and used mail exploder before. Usually it's with the
connotations of a piece of software or equipment, rather than a list of
names - they're not synonyms.

Simon

On Mon, 17 Jun 1996, Duncan Frissell wrote:

> At 08:43 AM 6/17/96 -0400, Declan B. McCullagh wrote:
> 
> >I believe we used the term "email exploder" instead of "mailing list,"
> >particularly in cross-examination and closing arguments, to convey the
> >idea that such a device is often used for conversation, not just one-way
> >communication.
> 
> Was this term invented during the hearings or has anyone heard of it before?
> 
> DCF
> 
> 






From stephan at studioarchetype.com  Mon Jun 17 19:08:54 1996
From: stephan at studioarchetype.com (Stephan Vladimir Bugaj)
Date: Tue, 18 Jun 1996 10:08:54 +0800
Subject: Micropayments are Crap
In-Reply-To: <v03006f00ade3a25564ae@[204.162.75.169]>
Message-ID: <v03006f00adeae1c27e39@[204.162.75.169]>


There is too much traffic on the Cypherpunks list for me - personally - to be
able to follow a single discussion very consistantly (maybe I should write
better filters...).  So I will address your last email generally.  I agree
that many of my points are points about capitalism in general, but
micropayments are the latest capitalist craze and serves to  underscore
some of these problems.  Perhaps you are right that they can ameliorate
some of the problems of capitalism, but I think there is also a great
potential for abuse and profit bloating that will serve only to exascerbate
the problems.  Sometimes 'straw men' are needed to make example cases of
what *can* happen before people leap ahead without thinking, and can only
in retrospect commiserate with eachother about what did happen...  the FUD
that is associated with any new technology should be better analyzed by the
few who care about the future rather than those who just worship the future
to ensure that the decisions which are made by this almighty 'market'
(again, I distinguish this from either the 'people' or the 'consumers') are
the right ones.  Again, I realize the market does not oppose this idea, but
that doesn't mean that some people won't feel that the idea is being
'rammed down their throats'.  Sometimes people forget that technologists
and their venture capitalist backers aren't the best representative sample
of the world's population, nor are they a reliable source of objective
information about the correlation between the 'market' and the 'polit'.

Micropayments might be a great idea (though I see potential flaws which, if
addressed, would only serve to make the idea great in implementation as
well as in theory - yet people will resist addressing these potential flaws
and rely on hindsight to fix problems that do arise). I'm just proposing
the ridiculous notion that this and other technologies be preceeded by
forthought and public debate before their implementation.  No matter how
much one reifies techology, it all comes back to people in the end.


ttl
Stephan


-------------------------------------------------------------------
This signature has been kidnapped by space aliens.
If you find it you can call (415) 703-8748.
I work for Studio Archetype, and they don't find any of this funny.







From jimbell at pacifier.com  Mon Jun 17 19:21:52 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 18 Jun 1996 10:21:52 +0800
Subject: UK users about to get clippered
Message-ID: <199606171820.LAA29791@mail.pacifier.com>


At 12:03 PM 6/17/96 +0200, Anonymous wrote:
>If you live the UK, brace yourself for HMG's "Clipper" annoucement
>later this week.  Look particularly carefully at the escrow agencies.
>- Remailereuters

And it should go over even less well than American Clipper.  When that was 
proposed, in April of 1993, there was no standard encryption chip nor the 
immediate prospect of one.  Someone might, at least arguably, have been 
attracted to Clipper with the argument that it's better than no encryption 
at all.  However, now that the NTT chip has been revealed, nobody is going 
to be under the illusion that it's "Clipper or nothing."


Jim Bell
jimbell at pacifier.com





From frantz at netcom.com  Mon Jun 17 19:27:56 1996
From: frantz at netcom.com (Bill Frantz)
Date: Tue, 18 Jun 1996 10:27:56 +0800
Subject: Remailer Operator Liability?
Message-ID: <199606171852.LAA03186@netcom7.netcom.com>


>(anyone know who came up with the term "email
>exploder" that the Court used instead of "mailing list"?)

Brendan P Kehoe's "Zen and the Art of the Internet" (1993) discussing
mailing lists says (p11), "Any mail sent to that address will "explode" out
to each person named in a file maintained on a computer at ..." 

I have seen it used elsewhere as well. 

Bill


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From sdudar at solutions.net  Mon Jun 17 19:32:02 1996
From: sdudar at solutions.net (sdudar at solutions.net)
Date: Tue, 18 Jun 1996 10:32:02 +0800
Subject: alpha.c2.org in deep shit?
Message-ID: <2.2.16.19960617134123.4e17463c@mail.solutions.net>


Huh?


At 06:14 PM 6/16/96 -0500, you wrote:
>-----BEGIN PGP MESSAGE-----
>Version: 2.6.2
>
>hIwDSReYoIbc3PkBA/9xblBrrofx89t5QoJVwCyGB/+futdCXEolwcsQdwWGcDtc
>7Vn7orCB8v6iQO+sCgAlYf38ftUxGmzebDd/7eWodTGx8XKnzBIZ9E6bRS38XLRa
>XDaipoiNRDi7gX2DA5ADtshTLtUiCjaYurGxGEla2iIMrEacGEyyekdZpUYT1KYA
>AAJ17fM4D2X8vpKTtWLr/6REeQvxPU80FpWKa/q1b6wMZ43oG9ZolMONj65hWqX0
>mhY+wp/vUsvQ21P/9VzYF0sy9JIAr45VhoDZBBCG0UW23WoOInXko2Kl2UeZmrut
>xR/nZm1sMzU+XYr7QG17aOfeezRs/frYEpvuAbrWYNELlPH72OBJ368nSkesiTo+
>gELda7vNsD12UTEl7gRAo3WizCY2zsQySLOShEiAX7f5vYco8A6pEwJ4XYs4pGn6
>xV4JNUeMjBKGtVkGoZJln3x7W1brgGmRNQbY/dcmCkExOOp+4myRVu0/ufH7n5TO
>FWqrb+nqyjgnirqS9DwoqB5JsHiMWU/dJBaCtXH4i1p//oeE9FE82nE2vAOZGMvn
>D+MRnheCVRi2TWnwe44PnB+L5z7+J+YJyulGM3bvXhZukjGCAj+EMmWxqkSgc2NS
>/xh6efgZNACmQIqxLdsw6TLbh9p+yMaxtaCZU9Bs9jw8dN+7FBZxgFG/hrrI1uh3
>oFahFMDXXAUMUs7lFOcxjAWTRRZKKSOG2mg5M5mr8VbY+5BQdcJJeY+jSCnDinUC
>wGFfEWlZMV7sdKhzA0YkHJYBgAPtmTaxrHQidPce46FbIeYVRsUOSEtvttYpMjIz
>mCVc5ywueUXbUe5UW3KrlV8uxKH3fEIEZ9Pxf3M9XR/aFXysccnzNzbe87XN8PDk
>mxzsRzmoD0CgCSAGfNrTdWl8bFQGnEaweMPnSIFzbSJkRcO0oiBU4/dhEFYiPgx5
>UD2r0uFNjKPt4KFBbFJLi0mrMuOCaxjhva7i70GQ95b4qVsyOZLN5KYSUnSDxDX4
>HFUIrEI/rsw=
>=BesD
>-----END PGP MESSAGE-----
>
>






From shamrock at netcom.com  Mon Jun 17 19:37:04 1996
From: shamrock at netcom.com (Lucky Green)
Date: Tue, 18 Jun 1996 10:37:04 +0800
Subject: Remailer Operator Liability?
Message-ID: <v02120d52adeb5e9f2fe4@[192.0.2.1]>


At 9:45 6/17/96, Duncan Frissell wrote:
>At 08:43 AM 6/17/96 -0400, Declan B. McCullagh wrote:
>
>>I believe we used the term "email exploder" instead of "mailing list,"
>>particularly in cross-examination and closing arguments, to convey the
>>idea that such a device is often used for conversation, not just one-way
>>communication.
>
>Was this term invented during the hearings or has anyone heard of it before?

I have heard of it before. I believe "mail exploder" is a rather old term.



-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
   Disclaimer: My opinions are my own.







From vhd at pobox.com  Mon Jun 17 19:49:12 1996
From: vhd at pobox.com (Computer Virus Help Desk)
Date: Tue, 18 Jun 1996 10:49:12 +0800
Subject: Blowfish Reliability
Message-ID: <2.2.32.19960617182604.0067dfa0@indy.net>


Can anyone say with any degree of certainty what resources it would require
to crack a file encrypted with 160 Bit Blowfish?  Many Thanks!

CVHD






From design at pathfinder.com  Mon Jun 17 20:24:13 1996
From: design at pathfinder.com (design at pathfinder.com)
Date: Tue, 18 Jun 1996 11:24:13 +0800
Subject: Pathfinder's New Look
Message-ID: <199606171752.NAA00909@tigger.dev.pathfinder.com.pathfinder.com>


Dear Pathfinder Member:

We're excited to announce a major redesign of Pathfinder, your home on the
Net, and invite you to come and check it out at http://pathfinder.com!

The NEW look of Pathfinder is our response to your feedback. We've made it
FASTER LOADING, EASIER TO NAVIGATE and added even more DAILY and
INTERACTIVE content.  And, we've taken advantage of the latest technologies
like Java to make your Pathfinder experience more informative and fun.

Whether it's up-to-the-minute news and weather, the latest sports scores,
stock quotes or today's celebrity gossip - you can now find it all at the
click of a mouse.  If you don't see what you're looking for just click on
the SEARCH button and we'll help you find it -   if it's on Pathfinder or
somewhere else on the Net.

When we launched in October 1994, Pathfinder was considered a
ground-breaking effort on the Web.  Today, Pathfinder is a true super-site,
containing more than 150,000 web pages from over 90 of the biggest names in
news, information and entertainment - names you trust like Time, Money,
Sports Illustrated, Entertainment Weekly, People and Fortune.

Much more important than our size, however, is our loyal base of Pathfinder
users.  With your help and support Pathfinder has grown from just a large
web site into a vibrant virtual community of members and ideas.

We'd be very interested in your feedback on our new look - just click on
the "Welcome" banner at the top of the homepage and you can send us all
your thoughts and ideas.  And, if you find you have any questions while
visiting Pathfinder, be sure to check out our new online HELP area.

Sincerely,


Marie Blue
Director of Consumer Marketing

P.S.  Stay tuned for details on our exciting new product, PATHFINDER
PERSONAL EDITION.  It's a fully personalizable and customizable online news
and information service  plus - get the information you want, when you want
it!  See our homepage for more information.





From vznuri at netcom.com  Mon Jun 17 20:43:04 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Tue, 18 Jun 1996 11:43:04 +0800
Subject: Micropayments are Crap
In-Reply-To: <v03006f00adeae1c27e39@[204.162.75.169]>
Message-ID: <199606171945.MAA12205@netcom4.netcom.com>


Mr. Bugaj makes some very good points about micropayments
being a current capitalist fad etc, and I think his idea
that venture capitalists do not necessarily exactly represent
the interests of the population is interesting.
his general message seems to be "lets look before we leap".

I tend to agree that abuses of micropayments will be possible
and one of the difficult hurdles for the system to overcome.
I don't know how pathological or difficult they will be. 
intuitively it seems like they will be less severe than
existing problems that have largely already been solved
by bank technologies. however it is quite possible (perhaps
even probable) that entirely new problems are going to
arise with the introduction of micropaymens.

so I wonder if people have ideas on some of the key problems
that might arise with micropayments. it would be very useful
to try to "head them off at the pass" and imagine what the
implications of micropayments are going to be.

here are two main problems I see right off the bat:

1. taxation. I suspect once the digital economy begins to 
get off the ground, the government is going to want to tax
it, and in a way that is enforced technologically. I wouldn't
be surprised if there are future proposals for "clipper like"
technology that integrates taxation mechanisms right into
the billing networks, mandatorily-- i.e. it is not up to the
person to report it; they simply can't escape the reporting. 

 furthermore when people
begin to realize that "anyone" can effectively "create" cash,
I expect to witness a lot of legislative panic ala today's
pornography or whatever. (digital pornography is going to be extremely
trivial in social implications compared to the ramifications of
digital cash).

the taxation problem is a part of a much larger problem: that
of good government. could it be that microcurrency will affect
our government? I think so. cyberspace has already begun to
have discernable and palpable effects on government. and it
is only beginning.  so what I would like to say is that if we
solved the problem of having a good government, issues like
taxation would take care of themselves.

2. copyrights. the issue of copyrights is not even resolved today.
when serious cash starts to be associated with cyberspace you
are going to see a lot of incredibly agitated people, especially
lawyers. I imagine systems will evolve that are similar to 
a technology that has evolved by which radio stations pay music
companies whenever they play artists songs. (if any cpunks could
elaborate on this system, I think it is an excellent preliminary
example of how a microcurrency-like system would interact with
a copyright situation).  I think similar standards are going to
be developed by which web page designers build up their pages,
and a distribution mechanism of charges will be intrinsic. 
the author will get their desired "cut" of every transaction,
the site editor will get some kind of cut, etc.   

this really revolutionizes the idea of a magazine or editor. 
suddenly anyone on the net can become an editor or writer,
and become as financially successful as the market will support.
the "scrape off" due to enormous bureacracies (media conglomerates)
is going to vanish and be funneled into a renaissance of artistry
I suspect.








From safemail at ntrnet.net  Mon Jun 17 21:33:14 1996
From: safemail at ntrnet.net (M.Wagoner 1)
Date: Tue, 18 Jun 1996 12:33:14 +0800
Subject: SafE Mail Corporation
Message-ID: <199606172121.RAA00883@ns1.ntrnet.net>



We would like someone to be able or should I say try and crack our
encryption. IT IS IMPOSSIBLE.




Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.



Randy Estridge
SafE Mail Corporation  






From dsmith at prairienet.org  Mon Jun 17 21:36:07 1996
From: dsmith at prairienet.org (David E. Smith)
Date: Tue, 18 Jun 1996 12:36:07 +0800
Subject: Snake Oil on the Water...
Message-ID: <1.5.4.32.19960617204240.00679dc0@204.248.40.2>


At 12:27 PM 16-06-96 -0700, it was written:

>>At the following two sites, you may download the FREEWARE Pegasus Mail
>>program version 2.3.3 16 bit for windows 3.x or a version for WIN95.
>
>I like Pmail.  Had I not been an experienced Eudora user before I
>tried it (and pretty stuck on the Eudora interface) I would have
>probably stuck with it.  Kudos to the Pegasus team for releasing
>a freeware program with such excellent filtering capabilites.  It
>is much more of a full-fledged program than Eudora Lite, IMHO.
>
>> The
>>unique thing about it, besides its simplicity and that it's a great mail
>>program better than Eudora, it has a built in encryption program that is as
>>effective as PGP and lots simpler. All you do is agree on a password with
>>your correspondent. That simple.

The "encryption" built into PMail is - and the author admits
this - crap.  He wrote the encryptor interface, which is
essentially Message XOR Password, as a demonstration.  Then
the JN PGP interface was written.

>> The encryption program and the mail program
>>were developed in New Zealand, and were legally imported, so the encryption
>>program is better than PGP, which is regulated by Federal Cypher Laws.
>
>This is misleading, IMHO.

Mild understatement.

>PC users who use PGP should try Pegasus and PGP JN.

Been there, done that.  It's a nice combo, but could
be a little better.

>Private Idaho is available from Joel McNamara's page, at:
>http://www.eskimo.com/~joelm/

Been there, done that.  It's also a nice program, but
nowhere near a full featured mail client.  That's
by design, as I understand.


dave







From hua at XENON.chromatic.com  Mon Jun 17 21:53:09 1996
From: hua at XENON.chromatic.com (Ernest Hua)
Date: Tue, 18 Jun 1996 12:53:09 +0800
Subject: You bet they have/are: NSA/CIA to snoop INSIDE the U.S.???
In-Reply-To: <199606090736.AAA29479@primenet.com>
Message-ID: <199606172205.PAA06449@server1.chromatic.com>



> anyone who believes the FBI and a host of other U.S. agencies even 
> less scrupulous does not wiretap without permits, has been standing behind 
> the door. generally, it does not matter if the information learned is 
> admissable in court  --they never admit wiretapping in the first place as  
> the agency themselves, in many cases, *did*not*wiretap*  --but the agency 
> does buy info from usually unsavory "contractors" who do wiretap.

Here is where I'm totally amazed (aghast ... maybe I'm just too naive):
(And, yes, I have asked this question, in different words, to a lawyer
crowd.)

It is clear that if the FBI/CIA/NSA/ATF/DoS intercepts a message with
some very important content, like, say, I (Ernest Hua) was plotting to
kill Hillary, then they can use that information to start investigating
my activities, even if the intercept turned out to be illegal.  Those
who saw the content of this intercept is not required by law to "forget"
that they ever saw it.

In this day and age, having discretionary access to information is a lot
of power which the average citizen does not have.  Even just the ability
for an entity to see information which it legally may not intercept
gives that entity a lot more power than I would ever want to grant them.
I am sure a networked video camera in every room, street corner, and
passenger car is one of the FBI's wet dreams.

No thanks.

Human beings are human beings, and we all have flaws.  That is why there
are companies in Britain selling videos of people caught in the act of
doing something private in a public place.

(Of course, if I were Hillary in this scenario, then I would wish that
the FBI/et al has god-like powers to do anything to stop me, but that
would be an emotionally charged argument and not a rational one.)

Ern







From frissell at panix.com  Mon Jun 17 21:57:25 1996
From: frissell at panix.com (Duncan Frissell)
Date: Tue, 18 Jun 1996 12:57:25 +0800
Subject: Rating Problems
Message-ID: <2.2.32.19960617201720.00753fc0@popserver.panix.com>


The recent CDA decision pointed out some of the problems involved in rating
Net content.  For example, the court spent a lot of time talking about Cyber
Patrol software and the CyberNOT list "containing approximately 7000 sites
in twelve categories.  The software is designed to enable parents to
selectively block access to any or all of the twelve CyberNOT categories
simply by checking boxes in the Cyber Patrol Headquarters (the Cyber Patrol
program manager).  These
categories are:"

          Violence/Profanity:  Extreme cruelty, physical or
          emotional acts against any animal or person which are
          primarily intended to hurt or inflict pain.  Obscene
          words, phrases, and profanity defined as text that uses
          George Carlin's seven censored words more often than
          once every fifty messages or pages.

Violence against plants is OK, however.  Likewise Cypherpunks which probably
meets the 1 bad word per 50 messages standard.  I wonder if they use
Carlin's original or updated 7 Words.

          Partial Nudity:  Full or partial exposure of the human
          anatomy except when exposing genitalia.

          Nudity:  Any exposure of the human genitalia.

Only in pictures.  Text-only full-frontal nudity is OK.  Looks like baby
pictures are out though.

          Sexual Acts (graphic or text):  Pictures or text
          exposing anyone or anything involved in explicit sexual
          acts and lewd and lascivious behavior, including
          masturbation, copulation, pedophilia, intimacy and
          involving nude or partially nude people in
          heterosexual, bisexual, lesbian or homosexual
          encounters.  Also includes phone sex ads, dating
          services, adult personals, CD-ROM and videos.

Bestiality is not covered though.

          Gross Depictions (graphic or text):  Pictures or
          descriptive text of anyone or anything which are
          crudely vulgar, deficient in civility or behavior, or
          showing scatological impropriety.  Includes such
          depictions as maiming, bloody figures, indecent
          depiction of bodily functions.

There goes all of Pop Culture.  Certainly deficient in behavior.

          Racism/Ethnic Impropriety:  Prejudice or discrimination
          against any race or ethnic culture.  Ethnic or racist
          jokes and slurs.  Any text that elevates one race over
          another.

Luckily, all other forms of discrimination are OK.  Women, crips, queers,
Jews, and old folk watch out.  How politically incorrect of Cyber Patrol. 

          Satanic/Cult:  Worship of the devil; affinity for evil,
          wickedness.  Sects or groups that potentially coerce
          individuals to grow, and keep, membership.

Does that include evangelicals?  They're not Satanic but they certainly
encourage membership growth.  Some evangelicals can be quite coercive.  And
why Satanists?  Don't we have freedom of religion in this country?
Remember, the Supremes *did* throw out the Hialeah Sanitaria Animal
Sacrifice Ordinance.

          Drugs/Drug Culture:  Topics dealing with the use of
          illegal drugs for entertainment.  This would exclude
          current illegal drugs used for medicinal purposes
          (e.g., drugs used to treat victims of AIDS).  Includes
          substances used for other than their primary purpose to
          alter the individual's state of mind such as glue
          sniffing.

I'm glad my drug pages are limited to the non-entertaining uses of illegal
drugs.  Purely analgesic purposes only.

          Militant/Extremist:  Extremely aggressive and combative
          behaviors, radicalism, advocacy of extreme political
          measures.  Topics include extreme political groups that
          advocate violence as a means to achieve their goal.

There goes www.whitehouse.gov.  They certainly "advocate violence as a means
to achieve their goal."  Pretty aggressive and combative as well.  Radical.
Advocate extreme political measures.

          Gambling:  Of or relating to lotteries, casinos,
          betting, numbers games, on-line sports or financial
          betting including non-monetary dares.

There goes www.wsj.com.  *All* financial betting.

          Questionable/Illegal:  Material or activities of a
          dubious nature which may be illegal in any or all
          jurisdictions, such as illegal business schemes, chain
          letters, software piracy, and copyright infringement.

Which jurisdictions -- Singapore?  Do they mean just US jurisdictions or all
jurisdictions.  Is offshore banking dubious?  It's not illegal.

          Alcohol, Beer & Wine:  Material pertaining to the sale
          or consumption of alcoholic beverages.  Also includes
          sites and information relating to tobacco products.

Poor Joe Camel.  If Health Nazis are bad for adults, why are they good for
children?  Note guns aren't on the banned list so www.nra.org is safe for
the kiddies.

DCF






From vipul at pobox.com  Mon Jun 17 22:04:03 1996
From: vipul at pobox.com (Vipul Ved Prakash)
Date: Tue, 18 Jun 1996 13:04:03 +0800
Subject: pretty good reputation
In-Reply-To: <199606161926.PAA10867@unix.asb.com>
Message-ID: <199606160732.MAA00213@fountainhead.net>



Deranged Mutant wrote:
> > first, i would like to make it clear that i have no personal grudges against 
> 
> I never thought you did...

That was simply to ensure a flame free discussion. Almost anything I talk about
on my local bbs echos (back in India) turns out to be a flame war, specially
if its related to _touchy_ software like PGP :)
 
> > pgp, i have some interest in reputation systems which i am trying to pursue.
> > since pgp tries to model a reputation system and is being used world-wide,
> > i am using pgp as a model for discussion.
> 
> That's the point, though. PGP *does not* try to model a reputation 
> system.  When you sign keys, you only attest that you are sure that 
> that key belongs to the person whose name is on it.  A signature says 
> *nothing* about a person's reputation.
> This is meant to be used separately by each user of PGP.  If Alice 
> knows Bob personally, then she knows how trustworthy Bob is when he 
> signs a key, in relation to her.  This is not meant to be shared with 
> anyone else, and has no meaning to anyone else except Alice.

in that case if alice receives a key signed by bob, she would know
the key is good. and there is no need for the two other fields. 
infact the reason why i felt pgp is trying to model a reputation system 
if because of these two fields that carry trust values.
 
> You can't set up a global web of trust. It's computationally 
> infeasable, esp. with contradictions, to resolve.  It's also 
> meaningless.  Say Alice trusts Bob.  Bob trusts Carol.  Carol trusts 
> Don.  Should Alice trust Don? No... subjective factors like "trust" 
> don't commute.

this is precisely what i wanted to know. can there be a model wherein one
can compute a trust-like parameter? if yes in what ways should this parameter
be modified and qualified. or conversely what kind of qualification/modification
is required for computing trust?
 
> > copule of things you mentioned are intresting. in a reputation system the 
> > trust parameters are fuzzy and there are lot of layers (since we
> > are talking of a web of users), so we can't mix it with the liar paradox.
> 
> Yes we can.  There's been work done with the Liar paradox using fuzzy 
> logic.  Also other work in repuation webs ("Say the president of a 
> company asks all his vice presidents for their opinions about each 
> other, so he can appoint a successor.  How does he resolve 
> contradictions, when all he has are their opinions about each 
> other?").

lets say a reputation system involves alice, bob, carol and don. Computing
trust parameter with respect to each other can lead to situtions where
alice trusts bob x% and has y% proof that he is a liar, after considering 
all other relations. If this x% > y% she'll believe him, if not she won't.
thats why i feel the liar paradox doesn't really pose much of a threat.    
 
> > as far as halting problem goes, again can we reduce a reputation system to 
> > halting problem?  Infact alonzo church and some other scientists made
> > symbolic equivalents of turing's machine which could determine the broad 
> > limits of automatic computation. is there any research being done on reputation
> > systems that involves church's thesis? 
> 
> I mispoke slightly: I mentioned the halting problem in terms there 
> being non-computable functions.  There are people on the list (and 
> elsewhere) who don't have an inkling about the halting problem, and 
> propose security/reputation systems that fly in the face of it.
> 
> I've been working on a proof or discussion of a "Very Generalized 
> Halting Problem" that basically says that you can check that 
> something is "not x" from a set of tests to see if that something is 
> not "x"... if it fails at least one test, you know it's not "x", but 
> if it doesn't fail any, because such a set must be incomplete 
> (Goedel's Theorem...), you are never sure that it's "x".
> 
> How this relates to a reputation system? If you set up a global 
> reputation network where people tag each other in degrees of trust, 
> you try for completeness and end up with .  People will 
> contradict each other and there will be no way to resolve it.  Alice 
> says Bob is trustworthy to a degree, and Bob says Carol is 
> trustworthy to a degree, but Carol says Alice is untrustoworthy 
> (rates Alice lower).

There will be inconsistency only if trust/untrust values are absolute.
that is you either trust someone or you don't. i am talking of a system
wherein trust values lie between 0..1 which are derived from a set of
tags. in that case bob alice trusts bob x% bob trusts carol y% and carol
trusts alice z%. if z < x, z < y simply implies alice trusts bob, bob trusts
carol more than carol trusts alice. so the system will be relative rather than
absolute. a person who is trusted by more people will carry greater weight
and people trusted by him will carry higher weight too. this way snoopy
who is not trusted by many people will automatically have a weak relationship
with others.
 
> There's the other point that someone else on the list (Perry?) brought up:
> if people publicly rate each other, there may be social/political 
> pressure to give some people lower or higher ratings.

again these ratings will be decided in a web rather that on one-to-one basis.
that way the social/political pressure can be reduced though not completely
eliminated.
 
> And again, being a private rating system means 1) I don't offend 
> anyone since no one else knows how I rate them, and 2) there are no 
> contradictions because I am not relying on other's ratings to 
> determine how I rate them.
> 
> BTW, some work using fuzzy logic in terms of how people rate each 
> other is being done at the Group for Logic and Formal Semantics at 
> the University at Stony Brook (in Stony Brook, NY).  I went to school 
> there and still help out in the Philosophy Department and the 
> G.L.F.S. with some programming etc.  It isn't exactly the same as 
> ratings systems, but its close enough.

if any research work is freely available i'll be really interested. 

best,
vipul.
 





From lzirko at c2.org  Mon Jun 17 22:05:52 1996
From: lzirko at c2.org (Lou Zirko)
Date: Tue, 18 Jun 1996 13:05:52 +0800
Subject: Snake Oil on the Water...
Message-ID: <199606172145.OAA16451@infinity.c2.org>


-----BEGIN PGP SIGNED MESSAGE-----

To: dsmith at prairienet.org, richieb at teleport.com, cypherpunks at toad.com,
 secure at commtouch.com
Date: Mon Jun 17 16:44:10 1996
Pronto Secure, currently in beta 6.16, is shaping up as a fine 
all-inclusive mail package that supports PGP.  You might want to take a 
look at it at:

Beta Testers residing in the USA are invited to download the beta from:

        http://www.commtouch.com/secus/secus1.htm

Non US residents should download from:

        http://www.commtouch.com/secnon/secintl1.htm

I have been with it since beta 1 and it definately has come a long way.  
Platforms supported are the MS GUI.  It is a 16-bit app.  I currently run 
it under NT 3.51 w/ 32-bit PGP executables.

Take a look.

Lou Z.


Lou Zirko                                (502)383-2175
Zystems                                  lzirko at c2.org
"We're all bozos on this bus" - Nick Danger, Third Eye

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1

iQEVAwUBMcXR4ctPRTNbb5z9AQH8Tgf/aCWChVMTKFyv+NpADQqosnMO2C7EAj/Z
o+O2KwQ91YVaRpkmJjrHzQuP+ou6YKHi5hH9SLRbN5Ox4/8YMmaOIRjqOrTmgta8
+fMBAtJ01AyWW9ZZh0sfEqM32RQ8Pt+x2Q8+MuyuEU/9vaeGhbb7DksGA8y2ht/5
uDKBUtrGgxAS7Yr2VRJVJXNd1b7eFdKGFUhBJJo9ig11/ICHcXVbUqpQ9Iqi2aRT
hoRRVtiMawCJznXaYid+2fami/pgtq/i00kV9y4ge3TOooxM4KZB3LZziCbS8R4d
AfaG9dj0wP50/zDhFxdExVc6NbQzTyr3kY+4z/47qkIZZ3wn5paezw==
=FO3b
-----END PGP SIGNATURE-----






From s1113645 at tesla.cc.uottawa.ca  Mon Jun 17 22:06:59 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Tue, 18 Jun 1996 13:06:59 +0800
Subject: [whoops]Re: Politeness...
In-Reply-To: <Pine.3.89.9606171623.C15968-0100000@tesla.cc.uottawa.ca>
Message-ID: <Pine.3.89.9606171731.D15968-0100000@tesla.cc.uottawa.ca>




On Mon, 17 Jun 1996 I wrote:

> I don't want to imagine how bad the traffic will get on IETF mailing 
> lists to standardize trust comments. 

Whoops. Mental laziness, replace trust with belief throughout that post.





From warpdriv at mindport.net  Mon Jun 17 22:20:47 1996
From: warpdriv at mindport.net (..)
Date: Tue, 18 Jun 1996 13:20:47 +0800
Subject: Non-Lethal Terrorism
Message-ID: <01BB5C5E.E998B140@polaris.mindport.net>


if you get the opportunity, check out the beyond 2000, nextstep and invention shows on the discovery channel. albeit, they may be a bit dated, the stuff is often enlightening. tuit, r&d of stunguns, dazzlers, flypaper, tanglers and lo-grade chemical agents has been underway for some time in labs arouns the world. lethality is not as popular as it once was. some of these devices do, however, work through excruciating, if nondamaging, pain.

tony

----------
From: 	John Young[SMTP:jya at pipeline.com]
Sent: 	Saturday, June 15, 1996 10:33 PM
To: 	cypherpunks at toad.com
Subject: 	Non-Lethal Terrorism

 
                      NON-LETHAL TECHNOLOGIES 
                 Military Options and Implications 
                Report of an Independent Task Force 
 
   http://pwp.usa.pipeline.com/~jya/nltech.htm  (47 kb) 
 
   Beware snooping, consider using the anonymizer at: 
 
   http://www.anonymizer.com 
 
   ----- 
 
   Or, if http fails, NLT_ech to <jya at pipeline.com> 
 
 
 
 
 








From sameer at c2.org  Mon Jun 17 22:21:35 1996
From: sameer at c2.org (sameer)
Date: Tue, 18 Jun 1996 13:21:35 +0800
Subject: alpha.c2.org in deep shit?
In-Reply-To: <199606161825.LAA02892@jobe.shell.portal.com>
Message-ID: <199606171817.LAA26885@infinity.c2.org>


	It should be fixed soon. Note that this is a free service and
maintaining it is at the bottom of our priority list.

> 
> I peeked at a few messages passing through my remailer from alpha.c2.org
> (mea culpa) to see whether the problem might be at my end.  As far as
> I could tell, the messages were correctly formatted and all, but simply
> lacked message bodies.  So it looked like the data being sent from
> alpha.c2.org was already messed up and had stripped the bodies.  I set up
> an alpha.c2.org alias a few days ago and when I sent mail to myself I
> got mail without a body, so I think it is a definate screwup.  I sent a
> report of this to remailer-operators list but have not seen a response
> yet from Sameer.
> 
> Hal
> 


-- 
Sameer Parekh					Voice:   510-986-8770
Community ConneXion, Inc.			FAX:     510-986-8777
The Internet Privacy Provider
http://www.c2.net/				sameer at c2.net





From s1113645 at tesla.cc.uottawa.ca  Mon Jun 17 22:25:51 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Tue, 18 Jun 1996 13:25:51 +0800
Subject: Politeness, trust and ice cream.
In-Reply-To: <199606090728.CAA21978@manifold.algebra.com>
Message-ID: <Pine.3.89.9606171623.C15968-0100000@tesla.cc.uottawa.ca>




On Sun, 9 Jun 1996 ichudov at algebra.com wrote:

Fascinating stuff about polite gun-owners deleted.

> If we think about anonymous computer contractors and anonymous
> employers, the interesting question is how to maintain reputations and
> how to check references.

I think it comes down to "who watches the watchers". Do you trust 
Business Week's ratings of so and so management consultant? Do you trust 
The Cypherpunk Guide To Business Magazines's ratings of Business Week's 
ratings of consultants? How about Joe Usenet's assessment of the above on
misc.stocks.slander? This begins to resemble the problem of the pgp Web 
of Trust. This problem already exists in the non-anonymous 
flesh-and-paper world. Who do you trust to tell you who to trust (and so on)?
Do you trust journalists who take ad money?

Presumably, once a decent profit model evolves for net publishing, there 
will be some incentive for customers to give you their opinions, and for 
others to gather them. Do you have a clear path of trust (or faith 
or some other quality) proceeding either to them or to their stated 
customers? 

I forsee many variations of trust webs to determine the quality of
ratings. Eg. I am 50% in agreement with Hal's taste in ice cream, 10% in
agreement with Declan's and 75% with the Economist's. I have signed this
with my key. Do the math to see how much you trust my assessment of Tim
Horton's chocolate pecan fudge. You decide how to do the math. Tim and Hal
had some really nice articles on this last month 

---Begin PGC Comment---
KeyID 0xF00

C1: Payment-Statement: I have not been payed to make the above 
endorsement.

C2: Coercion-Statement: I have not been coerced into making the above 
statement  

---Begin PGC Signature---
13235097u13251-9233u5v123rsdf;lkhjs -882351932u4v
---End   PGc Signature---
Pretty Good Commentary is a copyrighted trademark of KeyID 0xF00
---End   PGC Comment---

Reminds me that I should grab an AI book real soon now. 

Another thing one could use is a pseudonymous open-booking protocol (I 
didn't read Eric's post, so I don't know if it's any good) to determine 
if alleged customers are the real article. Offhand, I'd venture a guess 
that we'd see the above problem again, which hints at the importance of a 
good generalized trust or agreement calculus (and calculator) for formalized 
comments.

I don't want to imagine how bad the traffic will get on IETF mailing 
lists to standardize trust comments. 





From m5 at vail.tivoli.com  Mon Jun 17 22:32:53 1996
From: m5 at vail.tivoli.com (Mike McNally)
Date: Tue, 18 Jun 1996 13:32:53 +0800
Subject: Rating Problems
In-Reply-To: <2.2.32.19960617201720.00753fc0@popserver.panix.com>
Message-ID: <31C5D761.718@vail.tivoli.com>


Duncan Frissell wrote:
> 
> The recent CDA decision pointed out some of the problems involved in
> rating Net content.  

That reminds me.  As someone who hasn't yet given up on WiReD in disgust
(instead, I get it and read it faithfully in disgust), I was particularly
pissed-off at the latest "Kids Net Rights" issue.  Jonathan Katz
huffs and puffs about how "nobody in the digital world" protests the
idea of rating schemes to keep non-adults away from information, and 
indeed claims that "the digerati" (grrr) are pushing rating schemes with
great gusto to save themselves from censorship.

I guess by "nobody", he probably means "nobody who hangs out in the same
trendy espresso bars as the WiReD trendmeisters".  I've seen plenty of
invective directed at the concept of rating systems in general, from
a variety of people including Tim May and li'l ol' me.  That's been here
and on some various newsgroups.

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
       m5 at tivoli.com * m101 at io.com          *
      <URL:http://www.io.com/~m101>         * suffering is optional





From perry at piermont.com  Mon Jun 17 22:45:28 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Tue, 18 Jun 1996 13:45:28 +0800
Subject: SafE Mail Corporation
In-Reply-To: <199606172121.RAA00883@ns1.ntrnet.net>
Message-ID: <199606172238.SAA20263@jekyll.piermont.com>



M.Wagoner (1) writes:
> We would like someone to be able or should I say try and crack our
> encryption. IT IS IMPOSSIBLE.
> 
> Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.
> 
> Randy Estridge
> SafE Mail Corporation  

I checked the web site, and found the following snake oil aroma
(caused largely by the idiotic commentary and the word "proprietary"
on the encryption algorithm...)

------
* SafE Mail utilizes a short 22 character Public Key which I realize
  is "great" for key exchange. Does this short Public Key the
  encription code vulnerable to attack?

       No! The Public Key is generated by a "One Way Hash Function"
       when the owner of the software names a private key or
       passwords. This makes the encryption code secure and not
       vulnerable to attack by unautorized individuals.

[Perry's comments: 1) personal pet peve -- using quote marks for
emphasis. 2) Er, whats this crap? I understand perhaps generating RSA
keys off of a passphrase, but that wouldn't help you with key
exchange -- your public key is 1024 bits no matter what you do. As for
the rest...]
[...]
* Is Safe Mail really secure?

       We believe so. Unlike other encryption software, SafE Mail,
       through its proprietary encryption algorithm, leaves neither a
       backdoor nor a master key for any third party decryption of an
       encrypted file. To achieve extra security, SafE Mail allows an
       unlimited number of multiple encryptions without corrupting the
       original file. The output encrypted file bears no hint to the
       size or type of the original file
[Perry's comments: Yeah, like PGP has a back door or anything, or like
it prevents superencipherment, or like it leaks what your file was...]
-------

Having read the web site, the thing looks like it offers no advantage
at all over PGP and that it might be a piece of junk. I say stick with
whats known to be good and is free. PGP's price is certainly right,
especially when you consider what crap the "commercial" stuff like
this usually is.

Oh, and to the folks at Safe Mail: I will happily test out the quality
of your software for my standard consulting rate. My time is, however,
too valuable to waste on stuff like this without being paid. If other
people want to have a good time testing your product out, let them
feel free.

Perry






From hfinney at shell.portal.com  Mon Jun 17 23:05:54 1996
From: hfinney at shell.portal.com (Hal)
Date: Tue, 18 Jun 1996 14:05:54 +0800
Subject: pretty good reputation
Message-ID: <199606172256.PAA09652@jobe.shell.portal.com>


Here are some references to the material on reputations I mentioned
before.

ftp://prospero.isi.edu/pub/papers/security/insurance-cccs94.ps
     * Charlie Lai, Gennady Medvinsky, and B. Clifford Neuman.
       Endorsements, Licensing, and Insurance for Distributed System
       Services, In Proceedings of 2nd the ACM Conference on Computer and
       Communication Security November 1994.

This discusses some concepts related to extending trust relationships
through a network.

ftp://research.att.com/dist/mab/policymaker.ps
	"Decentralized Trust Management" by Matt Blaze et al

This suggests a formal way of specifying trust relationships among keys.
In effect you have little programs that get activated by certain keys, or
by certain signatures.  It is a very flexible methodology which could be
adapted to many ways of specifying trust relationships.

http://theory.lcs.mit.edu/~rivest/sdsi.ps (or .tex)
	"Simple Distributed Security Infrastructure" by Ron Rivest and
	Butler Lampson

This is a key certificate structure which is somewhere between a
hierarchical and a web of trust system, somewhat influenced by Blaze's
ideas.  It is pretty limited though in the kinds of trust delegation it
allows.  You can accept another person's signatures on specific keys but
you can't mark him as a generally-accepted signer.  However you can
develop chains of signatures as in PGP and perhaps some extra mechanism
could be used to decide when to trust them.

Hal






From dsmith at prairienet.org  Mon Jun 17 23:28:05 1996
From: dsmith at prairienet.org (David E. Smith)
Date: Tue, 18 Jun 1996 14:28:05 +0800
Subject: Damn, that snake oil is tasty! [was Re: SafE Mail Corporation]
Message-ID: <199606180011.TAA10450@firefly.prairienet.org>


> 
> We would like someone to be able or should I say try and crack our
> encryption. IT IS IMPOSSIBLE.
> 

Mmmm... flamebait.

> 
> Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.
> 

The highlights:

>
>Because we believe our encryption algorithm for SafE Mail
>is so strong and unbreakable, we will offer five free copies
>of SafE Mail or cash equivalent, to anyone capable of cracking
>a SafE Mail encrypted file. 

Uh, okay... but, uh, if we break the encryption, doesn't
that make the package damn near useless?


Also, they charge $40 (!!) shipping and handling for their
free demo.  



----- David Smith, Thinker Of Deep Thoughts :)
http://www.prairienet.org/~dsmith/library.html





From raph at cs.berkeley.edu  Mon Jun 17 23:32:41 1996
From: raph at cs.berkeley.edu (Raph Levien)
Date: Tue, 18 Jun 1996 14:32:41 +0800
Subject: Are Intrested in a new approach to Cryptography???????
In-Reply-To: <199606172131.RAA00953@ns1.ntrnet.net>
Message-ID: <31C61F7A.3C30CB2B@cs.berkeley.edu>


M.Wagoner (1) wrote:
> 
> We have superior Russian Encryption that cannot be broken. We would love to
> send you a copy of this software as a challenge to do so. Do you do such things?
> Our encryption far exceeds the military standard of 1024 bit encryption,
> hundreds of times over. I was told that if anyone could break this, it would
> be your organization or anyone else associated with the 'Cypher Punks'.

Basically, we are not interested. We are not a free cryptanalysis
service. Besides, we already have effectively unbreakable encryption -
our main interest is integrating ciphers that have already stood the
test of time into useful applications.

Best of luck, though.

Raph





From s1113645 at tesla.cc.uottawa.ca  Mon Jun 17 23:39:47 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Tue, 18 Jun 1996 14:39:47 +0800
Subject: [Noise] Re: Java
In-Reply-To: <199606042238.SAA09594@jekyll.piermont.com>
Message-ID: <Pine.3.89.9606171924.B20059-0100000@tesla.cc.uottawa.ca>




On Tue, 4 Jun 1996, Perry E. Metzger wrote:

> Who said anything about C, Detweiler. Smalltalk. Scheme. Postscript. 
> There are dozens of them out there. All of them are totally machine
> independent. You could run Smalltalk images byte for byte identical on
> large numbers of different processors years and years and years
> ago. Byte codes aren't new either -- Smalltalk's virtual machine, PSL
> and others had them decades ago.

One thing that might distinguish Smalltalk's comparative market faliure from 
Java's apparent market success, apart from the hype, is the lack of a 
free implementation for windows or even an easy to use free version for 
dos (both of the dos ones I tried failed to work for some reason).

A good free class lib for net programming and GUI programming would have
helped too (something more substantial than the windowing primitives it
comes with). Java has all these things. (One thing that detractors of
Smalltalk claim is that it is slow--slower than Java. However there is a
research dialect from Sun called Self which is supposed to be 50% as fast
as C.)

Also if one looks on the commercial side of things, developper versions
(which are wonderful) are much more expensive than the equivalent visual
basic (having purchased and tried a cheaper smalltalk for a course, I
would have far preferred staying with it rather than c++ or VB. Hopefully
Java does what it couldn't. However it is never too late, there is always
market for very easy to learn and program OO languages that aren't c++.
If you care so much Perry, you could always give it a try.)






From s1113645 at tesla.cc.uottawa.ca  Mon Jun 17 23:40:35 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Tue, 18 Jun 1996 14:40:35 +0800
Subject: 
In-Reply-To: <199606082209.RAA19856@manifold.algebra.com>
Message-ID: <Pine.3.89.9606171910.C20059-0100000@tesla.cc.uottawa.ca>




On Sat, 8 Jun 1996 ichudov at algebra.com wrote:

> Since corrupt officials are likely to have more anonymous cash that
> phreedom phighters, guess who will win.
> 
> Also, think about this: lots of people have someone they'd like
> to assassinate but do not actually do it because of lack of anonymity
> and associated hassles (like dealing with assassins non-anonymously,
> abundance of traces, possible confession of the assassin and so on).
> With your assassination clearinghouse these hassles go away. I think it
> would present an excellent prospect for reducing the population.

I could see an easy possibility for sting operations with the added 
feature that you can have assassinated all the supected assassins (ie anybody
that may have come near whatever surveillance there may have been).
Why bother with courts and trials? 

I still think assassination politics is self-terminating.

> Maybe *that* will help the whales and trees, because of the effect on demand.

Don't you mean supply? Stores and physical companies are easier to target
than consumers. But the only remaining environmentalists or for that
matter any other people with strong views will be net-based pseudonyms.
Usenet flamewars, editorials and talk shows just don't seem dying for, imho. 






From dsmith at prairienet.org  Tue Jun 18 00:10:58 1996
From: dsmith at prairienet.org (David E. Smith)
Date: Tue, 18 Jun 1996 15:10:58 +0800
Subject: Rating Problems
Message-ID: <199606172345.SAA07563@firefly.prairienet.org>


> The recent CDA decision pointed out some of the problems involved in 
rating
> Net content.  For example, the court spent a lot of time talking about
>  Cyber
> Patrol software and the CyberNOT list "containing approximately 7000 
sites

Do we just ignore the fact that these lists are outdated within
seconds of release?  Even if they can be automatically distributed
via the net (maybe by forcing your Web browser to use their page
as your home page and automagically downloading to you a new update),
the list will still be outdated by days or weeks.  This is one of
the big problems with all of these types of filters.

>           Violence/Profanity:  Extreme cruelty, physical or
>           emotional acts against any animal or person which are
>           primarily intended to hurt or inflict pain.  Obscene
>           words, phrases, and profanity defined as text that uses
>           George Carlin's seven censored words more often than
>           once every fifty messages or pages.

Gee, is this real or simulated violence?  I don't suppose I can
go surfing over to the Mortal Kombat website now...
 
>           Satanic/Cult:  Worship of the devil; affinity for evil,
>           wickedness.  Sects or groups that potentially coerce
>           individuals to grow, and keep, membership.
> 
> Does that include evangelicals?  They're not Satanic but they certainly
> encourage membership growth.  Some evangelicals can be quite coercive.  
And
> why Satanists?  Don't we have freedom of religion in this country?
> Remember, the Supremes *did* throw out the Hialeah Sanitaria Animal
> Sacrifice Ordinance.

What about Co$?  They might be a cult, depending upon who you ask.
And, what about us harmless, life-affirming Witches?  The name
alone will probably trigger a lot of filters.


I think the point of all this is that unless/until a "smart" filter can
be devised, there can't / won't be a good filtering package that will
please everyone, or even a majority of someones.  Good luck.

dave



----- David E. Smith, dsmith at prairienet.org
PO Box 324 Cape Girardeau MO USA 63702-0324
http://www.prairienet.org/~dsmith/dave.html
"fighting ultimage cosmic evil...
           ... one bean burrito at a time."






From Chris.Claborne at SanDiegoCA.ncr.com  Tue Jun 18 00:19:56 1996
From: Chris.Claborne at SanDiegoCA.ncr.com (Chris Claborne)
Date: Tue, 18 Jun 1996 15:19:56 +0800
Subject: San Diego Cypherpunks Physical Meeting
Message-ID: <2.2.32.19960617222426.00758244@opus.SanDiegoCA.NCR.com>


San Diego Area CPUNKS symposium  Thursday, June 20th, 1996

   Invitation to all Cypherpunks to join the San Diego crowd at "The Mission
Cafe & Coffee Shop" were I hope to get an update of Lance Cottrell's
anonymous e-mail server, "mixmaster", exchange keys, and discuss other
topical CP stuff.  There's always the semi-topical discussions; Internet
Service Provider in San Diego (providing, anonymous remailers and other
privacy services), stelth communications, latest Cypherpunk goings-on,
Internet happenings (like recent Federal court decision).

   Don't forget to bring your public key  fingerprint.  If you can figure
out how to get it on the back of a business card, that would be cool.  

Place: The Mission Cafe & Coffee Shop
       3795 Mission Bl in Mission Beach.
       488-9060


Time:1800

Their Directions:
	8 west to Mission Beach Ingram Exit
	Take west mission bay drive
	Go right on Mission Blvd.

	On the corner of San Jose and mission blvd.
	It is located between roller coaster and garnett.
	It's kind of 40s looking building...  funky looking 
        (their description, not mine)

They serve stuff to eat, coffee stuff, and beer.

See you there!

New guy, bring your key fingerprint.

Drop me a note if you plan to attend.


     2
 -- C  --

                                        ...  __o
                                       ..   -\<,
Chris.Claborne at SanDiegoCA.NCR   .Com   ...(*)/(*).        CI$: 76340.2422
http://bordeaux.sandiegoca.ncr.com/
PGP Pub Key fingerprint =  7E BF 38 3F 24 A7 D1 B0 54 44 96 AA 10 D0 5D 51
Avail on Pub Key server.
Dreams.  They're just screen savers for the brain.






From blancw at MICROSOFT.com  Tue Jun 18 00:39:58 1996
From: blancw at MICROSOFT.com (Blanc Weber)
Date: Tue, 18 Jun 1996 15:39:58 +0800
Subject: Micropayments are Crap
Message-ID: <c=US%a=_%p=msft%l=RED-81-MSG-960617212404Z-33164@tide21.microsoft.com>


>From: 	Vladimir Z. Nuri
>
>this really revolutionizes the idea of a magazine or editor. 
>suddenly anyone on the net can become an editor or writer,
>and become as financially successful as the market will support.
................................................................


Really.  This will be a tremendous boon for individuals, with great
potential for capitalistic profits, what with all those consumers
(otherwise known as "people") benefitting from the large variety of
services available through the Almighty Free Market (The Now
All-Oneness, All HTML One-Stop-Shop).

   ..
Blanc





From lzirko at c2.org  Tue Jun 18 01:16:21 1996
From: lzirko at c2.org (Lou Zirko)
Date: Tue, 18 Jun 1996 16:16:21 +0800
Subject: Snake Oil on the Water...
Message-ID: <199606180000.RAA28399@infinity.c2.org>


-----BEGIN PGP SIGNED MESSAGE-----

To: dsmith at prairienet.org, cypherpunks at toad.com
Date: Mon Jun 17 18:59:49 1996
They have started mentioning the product on their web pages and provide a 
link to the beta site for sign-ups etc.  Since 6.x I have not yet 
experienced a product crash, except with a disk full condition which was 
reported to them earlier today.  BTW, would you be interested in setting up 
a secure channel for testing?

Lou Z.

Lou Zirko                                (502)383-2175
Zystems                                  lzirko at c2.org
"We're all bozos on this bus" - Nick Danger, Third Eye

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1

iQEVAwUBMcXxrctPRTNbb5z9AQGfwAgAn7PYnixstxM13Bm6/VTEJp0J7b7e4kh8
evPhPIrsfgWskZzQY/YJtNtaV8p7hphPMeOewGpZ/lXhuPPZeHwLWmFTx/cmX5po
g8imoxfwPheHaVtj2R2mdvEyL7Xfiz/YZDJ2E9pyqN7euIrx+xPwbDVqedv87TC3
sFwJecbSpAmGwR2f5V7SrVx+uQcdQ+NzUyOhcToYRnbl7gydEyuGQpQNpn7uyi8S
fpvqyoKMwU/ki6xLKIHBPmp8ZQK0AeWnOQl80oGbG7jUGveW9ESs5BwrtXSQPDlI
4SXv1T1UGlVF+DtLFgGHP5agGhl4KT+c5z4ZUTc+BzqSs5aqYmB8yA==
=4txl
-----END PGP SIGNATURE-----






From erehwon at c2.org  Tue Jun 18 01:48:23 1996
From: erehwon at c2.org (William Knowles)
Date: Tue, 18 Jun 1996 16:48:23 +0800
Subject: Pickle Angels?!?  (Humour)(Noise)
Message-ID: <Pine.SUN.3.91.960617192342.11481A-100000@infinity.c2.org>


On today's Sally Jesse Raphel was Curtis Swiva?
founder of the Guardian Angels talking about his new record
of eating pickles.  He plans to break the record for eating 
22 hot dogs in 12 minutes.  The whole rest of the stage was
full of drag queens, and other rejects from the Jerry Springer
show.  Curtis must be really hard up to get his mug on TV! 


William Knowles
erehwon at c2.org

--
William Knowles    <erehwon at c2.org>
PGP mail welcome & prefered / KeyID 1024/2C34BCF9
PGP Fingerprint 55 0C 78 3C C9 44 DE   5A 3C B4 60 9C 00 FB BD
Finger for public key
--







From grafolog at netcom.com  Tue Jun 18 01:52:39 1996
From: grafolog at netcom.com (jonathon)
Date: Tue, 18 Jun 1996 16:52:39 +0800
Subject: SafE Mail Corporation
In-Reply-To: <2.2.32.19960618002536.007510d8@popmail.crl.com>
Message-ID: <Pine.SUN.3.94.960618032754.22996A-100000@netcom3>


On Mon, 17 Jun 1996, Sandy Sandfort wrote:

	<< Somebody else wrote the first two lines >> 

> >We would like someone to be able or should I say try and 
> >crack our encryption. IT IS IMPOSSIBLE.

	With a 22 character public key
	One way hash function 
	50 Kb/second encryption  

> "Attention `Hackers'" they said if you crack their 
> unbreakable SafE Mail code, you get 5 free copies of ...

	I didn't get that far -- the above lines convinced
	me that it was hype.  
	
	Especially their errors about PGP --- if they can't quote
	their competition correctly, I can only assume that their own
	data about their program is equally misrepresented.  

> SafE Mail!  Oh, that's a really primo prize, broken 

	The free demo costs $40.00 for shipping and handling
	+ sales tax.   << Wish I could remember the exact wording
	of the statute that states what reasonable shipping and
	handling charges are -- I suspect this exceeds them. >> 

> Since cracking their encryption is IMPOSSIBLE, I suggest 
> they make the stakes interesting--$100,000, or hell, a cool
> million.  After all, it's unbreakable.  It's not like they

	An insurance policy from Lloyds of London will 
	probably cost them less than that, and will pay out
	more than that , when they do pay it out.

        xan

        jonathon
        grafolog at netcom.com








From ses at tipper.oit.unc.edu  Tue Jun 18 02:02:44 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Tue, 18 Jun 1996 17:02:44 +0800
Subject: Britain to control crypto - official (fwd from Usenet)
In-Reply-To: <199606112007.QAA01167@nrk.com>
Message-ID: <Pine.SUN.3.91.960617193805.12894B@tipper.oit.unc.edu>


Some more thoughts...

1) What activities will require TTP licencing? Will all certification
agencies be required to be licenced? What about if I sign a friends
key? Or if I hold a key signing party and offer to sign the key of
anyone showing a valid drivers licence or other picture ID?

2) Will all certification agencies be required to require disclosure
of private keying material before issuing a certificate?

3) Will laws be made requiring all commercial transactions using
public key certificates to be performed using certificates issued by
a TTP in order for such transactions to be valid?

4) Will LEAs be permitted to impersonate a non-consenting third party
for the purposes of allowing a conversation to be intercepted?
(blatant violation of the 4th ammendme... oh shit- never mind).

Simon.
---
Cause maybe  (maybe)		      | In my mind I'm going to Carolina
you're gonna be the one that saves me | - back in Chapel Hill May 16th.
And after all			      | Email address remains unchanged
You're my firewall -    	      | ........First in Usenet.........





From sandfort at crl.com  Tue Jun 18 02:15:10 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Tue, 18 Jun 1996 17:15:10 +0800
Subject: SafE Mail Corporation
Message-ID: <2.2.32.19960618002536.007510d8@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

At 05:21 PM 6/17/96 -0400, M.Wagoner (1) wrote:
>
>We would like someone to be able or should I say try and 
>crack our encryption. IT IS IMPOSSIBLE.

>Our Web site is http://www.sfmc.com  Phone number is 
>1-800-252-9938.

So I pulled up the Web site to see what sort of reward they
offered to the successful cracker.  Under the heading 
"Attention `Hackers'" they said if you crack their 
unbreakable SafE Mail code, you get 5 free copies of ...
SafE Mail!  Oh, that's a really primo prize, broken 
software.  Duh.

Since cracking their encryption is IMPOSSIBLE, I suggest 
they make the stakes interesting--$100,000, or hell, a cool
million.  After all, it's unbreakable.  It's not like they
will have to pay up or anything.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







From snow at smoke.suba.com  Tue Jun 18 02:15:35 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 18 Jun 1996 17:15:35 +0800
Subject: SafE Mail Corporation
In-Reply-To: <199606172121.RAA00883@ns1.ntrnet.net>
Message-ID: <Pine.LNX.3.93.960617222613.329A-100000@smoke.suba.com>


On Mon, 17 Jun 1996, M.Wagoner (1) wrote:

> 
> We would like someone to be able or should I say try and crack our
> encryption. IT IS IMPOSSIBLE.
> Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.

	Try putting your money where your mouth is.


Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From jeremey at forequest.com  Tue Jun 18 02:26:15 1996
From: jeremey at forequest.com (Jeremey Barrett)
Date: Tue, 18 Jun 1996 17:26:15 +0800
Subject: SafE Mail Corporation
In-Reply-To: <199606172121.RAA00883@ns1.ntrnet.net>
Message-ID: <Pine.BSI.3.93.960617203709.15881B-100000@descartes.forequest.com>


Umm... how bout some details on your "proprietary" algorithms.  How exactly
is the public/private key pair generated? etc etc etc...

And WTF is "INTERNET-compatible"?  And what qualifies your product as
"INTERNET-compatible" and PGP as not "INTERNET-compatible"?

>From your "Confidence" web page, it seems that a password effectively
*IS* the private key, and on another page you state that the "public key"
is exactly 22 characters, generated "using a one way hash function", perhaps
some hash or variant of a hash of the password.  Pretty feeble.

On Mon, 17 Jun 1996, M.Wagoner (1) wrote:

> 
> We would like someone to be able or should I say try and crack our
> encryption. IT IS IMPOSSIBLE.
> 
> 
> 
> 
> Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.
> 
> 
> 
> Randy Estridge
> SafE Mail Corporation  
> 
> 

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Jeremey Barrett
Senior Software Engineer			jeremey at forequest.com 
The ForeQuest Company       			http://www.forequest.com/

   "less is more."
		-- Mies van de Rohe.

   Ken Thompson has an automobile which he helped design.  Unlike most
   automobiles, it has neither speedometer, nor gas gage, nor any of the
   numerous idiot lights which plague the modern driver.  Rather, if the
   driver makes any mistake, a giant "?" lights up in the center of the
   dashboard.  "The experienced driver", he says, "will usually know
   what's wrong."

		-- 'fortune` output






From unicorn at schloss.li  Tue Jun 18 03:19:25 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 18 Jun 1996 18:19:25 +0800
Subject: SafE Mail Corporation
In-Reply-To: <199606172121.RAA00883@ns1.ntrnet.net>
Message-ID: <Pine.SUN.3.93.960618020516.20947A-100000@polaris>


On Mon, 17 Jun 1996, M.Wagoner (1) wrote:

> We would like someone to be able or should I say try and crack our
> encryption. IT IS IMPOSSIBLE.

With the above you have saved me the trouble of even trying.

Your appraoch to cryptography betrays such ignorance that nothing which
your "corporation" produces could be of the slightest redeeming value.

(Bloody snake oil venders)

Now go away.

> 
> Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.
> 

Clearly a waste of good storage space.

> 
> Randy Estridge
> SafE Mail Corporation  
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From geeman at best.com  Tue Jun 18 03:22:05 1996
From: geeman at best.com (geeman at best.com)
Date: Tue, 18 Jun 1996 18:22:05 +0800
Subject: FYA: SafE Mail Corporation
Message-ID: <01BB5C9B.68A2B300@geeman.vip.best.com>



from their web site.
choose fix-pitch font to view this masterpiece:   
==============================================================

                        SafE Mail? and RSA� algorithms comparison table 

                   |  SafE Mail(TM)              |   RSA  (RC4+MD5)
-------------------+-----------------------------+--------------------
 Programm          | SafE Mail(TM) for Win 1.12  | Entrust 1.1r1
                   | SafE Mail(TM) for DOS 1.12  |
                   |                             |
 Performance Speed | ~4400kB/Sec (In addition to | ~770kB/Sec (Only
 (Results based on | Encryption also performs    | does Encryption)
 33mHz SunSparcs   | Compression, Error          |
 Station)          | Correction, Internet        |
                   | Compatibility and Electronic|
                   | Signature at the same time).|
                   |                             |
 Compression       | Yes, up to 85%              | No, increases
                   |                             | file size by up
                   |                             | to 40%
                   |                             |
 Internet          | Yes                         | No
 Compatibility     |                             |
                   |                             |
 Electronic        | Yes                         | Yes
 Signature         |                             |
                   |                             |
 Public Key        | Yes                         | Yes
 Distribution      |                             |
                   |                             |
 Length of Public  | 22 characters only          | Over 1200 characters
 Key               |                               | can distribute on the 
                   |                             | diskettes only
                   |                             |
 Integrity Checking| Yes                         | Yes
                   |                             |
 Error Correction  | 9 different levels, selected| None Available
                   | by user.                    |
                   |                             |
 Best Attack       | No known way                | Statistical
                   |                             | Analysis
                   |                             |








From WlkngOwl at unix.asb.com  Tue Jun 18 03:25:13 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 18 Jun 1996 18:25:13 +0800
Subject: Royalties (was "Re: Micropayments are Crap", which is a boring s
Message-ID: <199606180545.BAA03098@unix.asb.com>


On 17 Jun 96 at 12:45, Vladimir Z. Nuri wrote:

[..]
> 2. copyrights. the issue of copyrights is not even resolved today.
> when serious cash starts to be associated with cyberspace you
> are going to see a lot of incredibly agitated people, especially
> lawyers. I imagine systems will evolve that are similar to 
> a technology that has evolved by which radio stations pay music
> companies whenever they play artists songs. (if any cpunks could
> elaborate on this system, I think it is an excellent preliminary
> example of how a microcurrency-like system would interact with
> a copyright situation).  I think similar standards are going to

Excellent example? I dunno. At the non-commercial station I work, 
once a year or every other year ASCAP or BMI, for a two week period, 
wants our playlists... not the usual playlists, but detailed ones 
which even the most anal-retentive people hate to fill out: the 
performer, the song writer (not always the same), album and song 
titles, record label, and if music is ASCAP, BMI, etc.  Includes not 
only songs but them music, background music, etc.

I don't remember the rates, but non-commercial stations pay a lower rate than 
commercial ones.  Royalties are supposedly divied out to songwriters 
(and performers?) or record companies based on how much airplay they 
received, which I guess is averaged out for the whole year.  I don't 
know if they survey all radio stations around the same time or space 
it out for different areas and different stations throughout the 
year.  Touch luck for artists who get some airplay but not enough to 
make it on the lists, of course.

Digital area: possibility that people will feel because it's 
computerized, EVERYTHING can be kept track of.    This is 
problematic, aside from privacy reasons, because the big royalty 
makers get less and the smaller people get more.  Parallel with 
experiemtal Nielson-ratings tech... a special cable box that did the 
monitoring for you, and even had an electronic eye that could tell if 
anyone was in the room, or if they were sleeping or reading the paper 
rather than watching... apparently every station got much lower 
ratings than when people generously filled out booklets, so the 
stations threatened to set up an alternate system, so I don't know if 
that system was adopted.

I'm curious as to how royalities are divied up from the cassette tax, 
since everyone with blank casssettes is, of course, violating 
copyrights according to some logic.

Will people want royalities for reselling?  There was a flack a few 
years ago from some big record distributors over used CD sales.  They 
refused to supply some of the big chains if they continued to sell 
used CDs without giving them a cut.

Rob





From adamsc at io-online.com  Tue Jun 18 03:30:59 1996
From: adamsc at io-online.com (Chris Adams)
Date: Tue, 18 Jun 1996 18:30:59 +0800
Subject: More secure web browser
Message-ID: <199606180547.WAA10509@toad.com>


>Chris> This is all I got from the anonymizer test site (URL was posted  
>Chris> recently).
>Chris> <BR> Your Internet browser is IBM-WebExplorer-DLL/v1.1b.
>Chris> <BR> You are coming from .
>Chris> Seems reasonably private. Unfortunately, it's not an option if you  
>Chris> don't use OS/2...
>I doubt it.  You're only `private' wrt hostname because io-online's
>reverse DNS tables appear (very) broken.  This has nothing to do with
>the browser or the O/S.

I wasn't referring to that. I was referring to the fact that ALL it had
was WebExplorer and the hostname. Some of the other browsers release a
LOT of extra information...
BTW, no OS-supremacy was intendeded - merely a realization of the fact
that WebExplorer is an OS/2 only product.

                                                                                                                                                                                                                                             







From adamsc at io-online.com  Tue Jun 18 03:31:29 1996
From: adamsc at io-online.com (Chris Adams)
Date: Tue, 18 Jun 1996 18:31:29 +0800
Subject: Netscape Mail Security and PGP Plugins
Message-ID: <199606180604.XAA11073@toad.com>


>However as has been mentioned here a PGP/MIME mail type could
>theoretically be used to activate a handler for that incoming mail.  I
>don't know exactly how this would work.  Glancing at the netscape plug
>docs near <URL:
>http://home.netscape.com/eng/mozilla/2.0/handbook/plugins/ > it appears
>that plugins are activated on HTML page downloads, not (necessarily) on
>mail receipt.  So unless you typically find your incoming mail on a web
>page, it doesn't look like this will work.  I will ask about it on
>coderpunks for clarification.

Netscape 2 seems to support HTML in email files.  Has anyone tested it
with a plugin?

                                                                                                                                                                                                                                             







From ses at tipper.oit.unc.edu  Tue Jun 18 03:33:00 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Tue, 18 Jun 1996 18:33:00 +0800
Subject: [Noise] Re: Java
In-Reply-To: <Pine.3.89.9606171924.B20059-0100000@tesla.cc.uottawa.ca>
Message-ID: <Pine.PCW.3.94.960618071727.2111A-100000@CISPPP>




On Mon, 17 Jun 1996 s1113645 at tesla.cc.uottawa.ca wrote:
> 
> helped too (something more substantial than the windowing primitives it
> comes with). Java has all these things. (One thing that detractors of
> Smalltalk claim is that it is slow--slower than Java. However there is a
> research dialect from Sun called Self which is supposed to be 50% as fast
> as C.)

Smalltalk was in fact the first object oriented language to ever be
tweaked enough to be useful (smalltalk-80 is where JIT came from). 

Self is a completely different kettle of ball-games; it's older than java,
and based on a totally different conception of OOP. The only major 
language Ican think of that's from the same family is newton script. Self
does away with the concept of classes, and instead uses prototypes to
inherit from. The main design principle seems to have been: create a
language that's as slow as possible, then see how well you can optimise it
:)

Simon






From jeremey at forequest.com  Tue Jun 18 03:38:51 1996
From: jeremey at forequest.com (Jeremey Barrett)
Date: Tue, 18 Jun 1996 18:38:51 +0800
Subject: Damn, that snake oil is tasty! [was Re: SafE Mail Corporation]
In-Reply-To: <199606180011.TAA10450@firefly.prairienet.org>
Message-ID: <Pine.BSI.3.93.960617230851.16661A-100000@descartes.forequest.com>


On Mon, 17 Jun 1996, David E. Smith wrote:

> >
> >Because we believe our encryption algorithm for SafE Mail
> >is so strong and unbreakable, we will offer five free copies
> >of SafE Mail or cash equivalent, to anyone capable of cracking
> >a SafE Mail encrypted file. 
> 
> Uh, okay... but, uh, if we break the encryption, doesn't
> that make the package damn near useless?
> 
> 
> Also, they charge $40 (!!) shipping and handling for their
> free demo.  
> 

Yea... and you have to go to North Carolina to pick up your prize....fun :)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Jeremey Barrett
Senior Software Engineer			jeremey at forequest.com 
The ForeQuest Company       			http://www.forequest.com/

   "less is more."
		-- Mies van de Rohe.

   Ken Thompson has an automobile which he helped design.  Unlike most
   automobiles, it has neither speedometer, nor gas gage, nor any of the
   numerous idiot lights which plague the modern driver.  Rather, if the
   driver makes any mistake, a giant "?" lights up in the center of the
   dashboard.  "The experienced driver", he says, "will usually know
   what's wrong."

		-- 'fortune` output






From tcmay at got.net  Tue Jun 18 03:44:58 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 18 Jun 1996 18:44:58 +0800
Subject: Fuseable Links - no guarantees??
Message-ID: <adeb915b01021004b1a6@[205.199.118.202]>


At 3:44 AM 6/15/96, Warren wrote:
>I have never paid much attention to the protection of firmware or the
>technical issues revolving around such schemes...was wondering:
>
>I recently saw an add for a UK based group that says they can take a PIC
>OTP micro and read the prom (for a fee, of course) - How the heck is this
>done?? I have my suspicion that they (somehow) magically peel off the
>ceramic coating (without destroying the chewy center), get a circuit mask
>and 'micro probe' the I/O of the IC...they then download the secret recipe
>to the afore mentioned 'chewy center'.
>
>Is this close to accurate?? How is it 'done' ???

I don't know of any modern chips that have "ceramic coatings." (Some chips,
esp. CPUs, are still ceramic-packaged, but in these cases the metal or
ceramic lids are easily removed.)

Most chips are plastic-packaged, and plasma ashers and/or chemical baths
will expose the chip surface easily enough.

Once exposed, various methods exist to read internal voltage levels. For
example, electron beams in a scanning electron microscope (SEM) can fairly
easily read at least surface potentials. Whether a SEM in voltage-contrast
mode can read voltages on lower levels depends on a lot of things, and I
can't even make a guess here as to whether OTP (one-time programmable)
memories from particular vendors can have internal nodes probed.

With enough money, many things are possible.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From unicorn at schloss.li  Tue Jun 18 03:48:51 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 18 Jun 1996 18:48:51 +0800
Subject: The Ultima Spy Book
In-Reply-To: <199606171540.PAA14807@pipe3.ny3.usa.pipeline.com>
Message-ID: <Pine.SUN.3.93.960618023421.20947C-100000@polaris>


On Mon, 17 Jun 1996, John Young wrote:

>    The Ultimate Spy Book 
>    by H. Keith Melton 
>    (Dorling Kindersley, London) 
>    DK Publishing, New York 
>    First American edition, 1996. $29.95. 
>    ISBN 0-7894-0443-5 
>  
>    Over 600 illustrations of the tools and tricks of spycraft 
>    for killing, betraying, deceiving, surveilling, encrypting, 
>    decrypting, communicating, burgling, recruitment and 
>    training, fucking up and rotting in jail, and flacking spy 
>    fluff until tip-canoe-ed. 


Most of which is 25-30 years out of date.  The remainder is either 5-10
years out of date, or so simple to be useful despite being anything but a
secret anymore.

Still cool for the history buff.

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From WlkngOwl at unix.asb.com  Tue Jun 18 03:54:31 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 18 Jun 1996 18:54:31 +0800
Subject: SafE Mail Corporation
Message-ID: <199606180613.CAA15373@unix.asb.com>


What the heck: I'm bored tonight...

Well, not that bored.  Don't need another 'tear snake-oil to bits or 
is this a damned troll' thread.  Why does "M. Wagoner" sound 
familiar?

On 17 Jun 96 at 17:21, "M.Wagoner" (safemail at ntrnet.net) wrote:

> We would like someone to be able or should I say try and crack our
> encryption. IT IS IMPOSSIBLE.
> 
> Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.
> 
> Randy Estridge
> SafE Mail Corporation  

Uh oh. I checked the page.  Claimed Public Key, Sigs, Error 
Correction, Compression, lots of nice stuff.   They kind of got the 
vocabulary down. Only in a fuzzy way. Hypes "INTERNET Compatible" is 
if that means anything, a "22 character public key" (no, it's not a 
type.  twenty-two character public key, in several places said that), 
proprietary algorithm, etc. etc.

Yawn,

Rob.

---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From sandfort at crl.com  Tue Jun 18 03:56:09 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Tue, 18 Jun 1996 18:56:09 +0800
Subject: Rating Problems
In-Reply-To: <199606172345.SAA07563@firefly.prairienet.org>
Message-ID: <Pine.SUN.3.91.960617202616.20874B-100000@crl12.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

On Mon, 17 Jun 1996, David E. Smith wrote:

> Do we just ignore the fact that these lists [Cyber Patrol, etc.]
> are outdated within seconds of release?  

Yes, because they are still largely effective for their intended
purpose.  Just as crypto is ultimately economics, so to is blocking
software.  Parents who wish to make the Internet "safer" for their
children will be happy with a 95% solution.  That's the way it is
with X-rated videos and magazines.  While it's not impossible for
kids to get their hands on them, it isn't easy.  And that's good
enough.

> I think the point of all this is that unless/until a "smart"
> filter can be devised, there can't / won't be a good filtering
> package that will please everyone, or even a majority of 
> someones.  

I disagree.  I'm sure almost every parent will find a filter 
that's "good enough" for them.  As evidence, look at the current
situation.  Many (most?) parents object to some of the content on
broadcast television.  Though they could put a lock on the set or
remove it entirely, few do.  It's just too much trouble.  Instead,
they forbid their kids to watch certain shows or otherwise limit
the time and topics they allow their kids to watch.  Not perfect,
but good enough.  It will be the same with filters.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~







From WlkngOwl at unix.asb.com  Tue Jun 18 04:04:18 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 18 Jun 1996 19:04:18 +0800
Subject: pretty bad idea (was Re: pretty good reputation)
Message-ID: <199606180215.WAA28846@unix.asb.com>


On 16 Jun 96 at 12:32, Vipul Ved Prakash wrote:

[..]
> > That's the point, though. PGP *does not* try to model a reputation 
> > system.  When you sign keys, you only attest that you are sure that 
> > that key belongs to the person whose name is on it.  A signature says 
> > *nothing* about a person's reputation.
[..]
> in that case if alice receives a key signed by bob, she would know
> the key is good.

Pretty-good, yes. (Assuming she trusts anything signed by Bob.)

>                                ... and there is no need for the two other fields. 
> infact the reason why i felt pgp is trying to model a reputation system 
> if because of these two fields that carry trust values.

Those are private/personal trust values only. Alice rates Bob on how 
well she'd trust a key signed by Bob.

This is subjective for Alice, based on her relationship with Bob. She 
may not know him well and assign him a low rating.  Or she may know 
him all too well, and give him a low rating.  This has no meaning for 
Carol, or Don, or anyone else, since they have different (if any at 
all) relationships with Bob.

> > You can't set up a global web of trust. It's computationally 
> > infeasable, esp. with contradictions, to resolve.  It's also 
> > meaningless.  Say Alice trusts Bob.  Bob trusts Carol.  Carol trusts 
> > Don.  Should Alice trust Don? No... subjective factors like "trust" 
> > don't commute.
> 
> this is precisely what i wanted to know. can there be a model wherein one
> can compute a trust-like parameter? if yes in what ways should this parameter

No, at least not one with meaning.

There are many factors that would go into one's rating of another: 
how well one knows the other; part history; bias for or against 
another because of thing like race, religion, political viewpoint, 
favorite OS, skills/talent or lack thereof, etc.  People's ratings of 
each other change as well... just imagine global ratings of a once 
overly well-liked famous person who after several years is now 
infamous (or an infamous person who is now forgiven).  And again, 
social pressure to give someone a certain rating...

[..]
> lets say a reputation system involves alice, bob, carol and don. Computing
> trust parameter with respect to each other can lead to situtions where
> alice trusts bob x% and has y% proof that he is a liar, after considering 
> all other relations. If this x% > y% she'll believe him, if not she won't.

Generally x+y=1 in this scheme. 

But lets say for a moment they are separate: x = trust level; y = mixtrust
level, independent of x... that makes little sense, since if y>.5, then Bob
isn't trustworthy, but why is x > y? x and y would always have to be
adjusted for each other... (so it's better off to use something like
x+y=1).

> thats why i feel the liar paradox doesn't really pose much of a
> threat.    

But even then, For Alice, x(Bob) > y(Bob), so Bob is trustworthy. For 
Bob though, x(Alice) < y(Alice).  So what of Carol? She does not yet 
know Alice and Bob, and sees their ratings about each other [Note: 
some people would assign ratings based on others; others would assign 
ratings based on personal experience... another problem with a global 
rating scheme].

Carol asks Alice about Bob, who says he's trustworthy.  She asks Bob
about Alice, who says Alice is untrustworthy.  If Alice is correct, 
then according to Bob she's not worth listening to, but then why 
listen to Bob.  If Bob is correct, Alice isn't worth listening to, 
but then again, maybe Bob isn't since she says Bob is... so why 
should Carol bother with any of them.

Ok, in real life it's possible to meet two people, one of him is a 
liar but not so much as to admit another is more truthful... and that 
truthful person agrees.  It's actually quite common... but how does a 
third person who doesn't know any of them figure it out? How does a 
computer program using a formula?

But given a system with several variables (ie, several people rating each
other) you'll have something that's even harder to resolve.  Given a 
global system with thousands or millions of variables... how does one 
make sense of all those ratings about a particular aspect of one 
person?

[..]
> There will be inconsistency only if trust/untrust values are absolute.
> that is you either trust someone or you don't. i am talking of a system
> wherein trust values lie between 0..1 which are derived from a set of

Oh no.  There's also a lot of inconsistency there too.  Doesn't 
matter if you use boolean or fuzzy values.

> tags. in that case bob alice trusts bob x% bob trusts carol y% and carol
> trusts alice z%. if z < x, z < y simply implies alice trusts bob, bob trusts
> carol more than carol trusts alice. so the system will be relative rather than

You're ignoring how much Alice trusts Bob, how much Carol trusts Bob 
and how much Alice trusts Carol.

> absolute. a person who is trusted by more people will carry greater
> weight

Why should that person carry more weight? (more weight than who else?)
What if all the people who trust that person are idiots?  Why should 
I, or you, or anyone else care about somebody more or less because "x 
number of people trust so-and-so"?

> and people trusted by him will carry higher weight too. this way snoopy

There's another flaw.  And what if those people trust him? 
Exponentially increasing trust?

> who is not trusted by many people will automatically have a weak relationship
> with others.

Not many people know Snoopy, so he has no trust level.  Nobody wants 
to get to know Snoopy just because he has no trust level.  He's 
locked out.

Bad idea.

> > There's the other point that someone else on the list (Perry?) brought up:
> > if people publicly rate each other, there may be social/political 
> > pressure to give some people lower or higher ratings.
> 
> again these ratings will be decided in a web rather that on one-to-one basis.
> that way the social/political pressure can be reduced though not completely
> eliminated.

No. Individuals put their ratings in the web to skew or confuse 
things.

Rob.


 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From unicorn at schloss.li  Tue Jun 18 04:15:41 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Tue, 18 Jun 1996 19:15:41 +0800
Subject: You bet they have/are: NSA/CIA to snoop INSIDE the U.S.???
In-Reply-To: <199606172205.PAA06449@server1.chromatic.com>
Message-ID: <Pine.SUN.3.93.960618020945.20947B-100000@polaris>


On Mon, 17 Jun 1996, Ernest Hua wrote:

> > anyone who believes the FBI and a host of other U.S. agencies even 
> > less scrupulous does not wiretap without permits, has been standing behind 
> > the door. generally, it does not matter if the information learned is 
> > admissable in court  --they never admit wiretapping in the first place as  
> > the agency themselves, in many cases, *did*not*wiretap*  --but the agency 
> > does buy info from usually unsavory "contractors" who do wiretap.
> 
> Here is where I'm totally amazed (aghast ... maybe I'm just too naive):
> (And, yes, I have asked this question, in different words, to a lawyer
> crowd.)
> 
> It is clear that if the FBI/CIA/NSA/ATF/DoS intercepts a message with
> some very important content, like, say, I (Ernest Hua) was plotting to
> kill Hillary, then they can use that information to start investigating
> my activities, even if the intercept turned out to be illegal.  Those
> who saw the content of this intercept is not required by law to "forget"
> that they ever saw it.

If they intend to prosecute in a U.S. court they are.

Which crowd of lawyers was this?  Must have been after open bar.

Look it up, the doctrine is called "fruit of the poisonous tree."

In your example, the evidence would be refered to the FBI or the Secret
Service, or more likely both provided the intercept clerk's superior
wanted to even expose the existance of the intercept program to begin
with- unlikely in my experience.  From there, it being fairly clear that
the intercept was illegal to the FBI / Secret Service, they may visit and
see if they can dig up a plausible explanation as to how they "really" got
interested in your activities, but refering to the intercept is right out.

See e.g., United States v. United States District Court (Keith), 407 U.S.
297 (1972); Alderman v. United States, 394 U.S. 165 (1969).

Warantless surveillance can only be used in criminal prosecutions where
the "primary purpose" of the surveillance is intelligence.  United States
v. Megahey, 553 F.Supp. 1180, 1189-1190 (E.D.N.Y. 1982).

That evidence will have to survive a hearing on exclusion.  Highly
unlikely if you were accidently overheard.

Judges are protective of their jurisdiction.

> 
> Ern
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From sandfort at crl.com  Tue Jun 18 04:18:56 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Tue, 18 Jun 1996 19:18:56 +0800
Subject: THIS IS SORT OF ... CRYPTIC
Message-ID: <Pine.SUN.3.91.960617204251.20874C-100000@crl12.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                          SANDY SANDFORT
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C'punks,

I'm not sure what this item is about.  Anybody know?


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
---------- Forwarded message ----------
Date: Mon, 17 Jun 1996 14:31:16 -0700 (PDT)
From: CHINANET Moderator <cnm at SDSC.EDU>
To: chinanet-tech at sdsc.edu
Subject: CINET-L Newsletter, Issue No. 69 (CN96-012), June 16, 1996

  Optic Fiber Automatic Surveillance Network Ready in Three Years

The construction of the national optic fiber automatic surveillance network
has been going on smoothly. The three surveillance stations located from
Beijing to Tianjin are operating normally. It was estimated that the
construction of another 23 surveillance stations will be completed by July.
People concerned also estimate that the construction of the national optic
fiber automatic surveillance network, installed with 500 surveillance
stations, will be completed within three years.  (Info at AsiaInfo.Com, June 5,
1996)
                             ____   ____   ____






From mccoy at communities.com  Tue Jun 18 04:27:55 1996
From: mccoy at communities.com (Jim McCoy)
Date: Tue, 18 Jun 1996 19:27:55 +0800
Subject: [Noise] Re: Java
Message-ID: <v02140b00adec16f3c650@[205.162.51.35]>



s1113645 at tesla.cc.uottawa.ca writes:
> [...](One thing that detractors of
> Smalltalk claim is that it is slow--slower than Java. However there is a
> research dialect from Sun called Self which is supposed to be 50% as fast
> as C.)

Self also give a new meaning to phrase "code bloat."  A 'Hello, world!'
that requires more than a megabyte kind of kills any enthusiasm one might
or a language which otherwise takes a neat slant message passing...
[Although I gave up before version 4.0 so maybe things have gotten better]

jim







From ichudov at algebra.com  Tue Jun 18 04:31:41 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Tue, 18 Jun 1996 19:31:41 +0800
Subject: "Termination"?
In-Reply-To: <199606180422.VAA03104@mail.pacifier.com>
Message-ID: <199606180432.XAA25307@manifold.algebra.com>


jim bell wrote:
> 
> At 07:54 PM 6/17/96 -0400, s1113645 at tesla.cc.uottawa.ca wrote:
> >
> >
> >On Sat, 8 Jun 1996 ichudov at algebra.com wrote:
> >
> >> Since corrupt officials are likely to have more anonymous cash that
> >> phreedom phighters, guess who will win.
> 
> Remember, Chudov was wrong about this.  It's not just the amount of money 
> you have, it's whether you can identify people as your "enemies."

Well, why. If I were a corrupt politician, I'd start with exterminating
all posters to Cypherpunks, starting with you (with exception of a
couple of people). 

As a Russian, I can see that you lack the feeling of proper scale when
you think about exterminations. This is forgivable since you have never
seen them. There is no need to exercise any discretion or even fairness
if you have enough cash and a good assassination clearinghouse.

I'd also set up a number of fake clearinghouses and assassinate those
who provide *your* clearinghouse with anonymous services (if your 
clearinghouse is run anonymously).

> >I still think assassination politics is self-terminating.
> 
> It would probably be more accurate to say that it is "self-limiting."  

I think that it is a fine idea and a neat experiment (Russians love
such experiments, you know), but it will go way farther than you think.

Again, many governments would appreciate the nice opportunity to reach 
their political goals by assassination means.

> Think back to integral calculus, where the area under an infinitely long 
> curve may be finite.  If we think of X as being time, and the rate of deaths 
> as the height of the curve above Y=0, the total number of deaths is 
> reflected in the area.  Some death rate schedules will integrate to a 
> finite, limited number of deaths.  Even if reality doesn't quite approach 
> this optimum situation, it MAY approach a much better reality where the 
> eventual rate of deaths is far lower than the status quo.

There are some interesting people who do not like spending hard earned
$$ on clothes, heated water pools, and Bentleys. They'd rather prefer
the fun of seeing their neighbors disappear and their families terrified.

Number of such people won't really decline over time.

	- Igor.





From jimbell at pacifier.com  Tue Jun 18 04:41:32 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 18 Jun 1996 19:41:32 +0800
Subject: "Termination"?
Message-ID: <199606180425.VAA03222@mail.pacifier.com>


At 07:54 PM 6/17/96 -0400, s1113645 at tesla.cc.uottawa.ca wrote:
>
>
>On Sat, 8 Jun 1996 ichudov at algebra.com wrote:
>
>> Since corrupt officials are likely to have more anonymous cash that
>> phreedom phighters, guess who will win.

Remember, Chudov was wrong about this.  It's not just the amount of money 
you have, it's whether you can identify people as your "enemies."

>> Also, think about this: lots of people have someone they'd like
>> to assassinate but do not actually do it because of lack of anonymity
>> and associated hassles (like dealing with assassins non-anonymously,
>> abundance of traces, possible confession of the assassin and so on).
>> With your assassination clearinghouse these hassles go away. I think it
>> would present an excellent prospect for reducing the population.
>
>I could see an easy possibility for sting operations with the added 
>feature that you can have assassinated all the supected assassins (ie anybody
>that may have come near whatever surveillance there may have been).
>Why bother with courts and trials? 
>
>I still think assassination politics is self-terminating.

It would probably be more accurate to say that it is "self-limiting."  
There's a difference, you know. There may never be a "last" AP death.  
However, AP deaths may (and probably will) eventually become comparatively 
rare, precisely because they so straightforwardly obtained if there is a 
justification for them.  That will cause the behavior of people to change, 
to avoid doing anything which draws the ire of somebody else.

Think back to integral calculus, where the area under an infinitely long 
curve may be finite.  If we think of X as being time, and the rate of deaths 
as the height of the curve above Y=0, the total number of deaths is 
reflected in the area.  Some death rate schedules will integrate to a 
finite, limited number of deaths.  Even if reality doesn't quite approach 
this optimum situation, it MAY approach a much better reality where the 
eventual rate of deaths is far lower than the status quo.

However, the system will only self-limit to the extent that overt agression 
among people will be eliminated.  If nobody agresses against you, you will 
have no reason to agress against anyone else.  Therefore, the system cannot 
end in a dictatorship.

>> Maybe *that* will help the whales and trees, because of the effect on 
demand.
>
>Don't you mean supply? Stores and physical companies are easier to target
>than consumers. But the only remaining environmentalists or for that
>matter any other people with strong views will be net-based pseudonyms.
>Usenet flamewars, editorials and talk shows just don't seem dying for, imho. 

It is true that there may be a strong deterrent against "people with strong 
views."  However, as I pointed out to the head of a 'Net freedom 
organization (who was worried about his future!), the only reason our 
society NEEDS figurehead people such as him is to change unpopular policies 
that are forced on the rest of us.  Once AP begins operating, you don't have 
to stick your neck out to deter agression against you, and you don't need 
heads of organizations such as him, or for that matter organizations either.

Quite simply, why do you need the head of the ACLU, or for that matter the 
ACLU as an organization, if you can target anybody who violates the rights 
that the ACLU currently protects?  

Jim Bell
jimbell at pacifier.com





From jad at dsddhc.com  Tue Jun 18 04:43:43 1996
From: jad at dsddhc.com (John Deters)
Date: Tue, 18 Jun 1996 19:43:43 +0800
Subject: SafE Mail Corporation
Message-ID: <2.2.32.19960618043122.0095e0a4@labg30>


At 05:21 PM 6/17/96 -0400, you wrote:
>We would like someone to be able or should I say try and crack our
>encryption. IT IS IMPOSSIBLE.
>
>Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.
>
>Randy Estridge
>SafE Mail Corporation  

Well, when I read this letter, I was sure it was a troll.  I was amazed to
find that not only are these people serious, but they're convicing other
people to buy into this nonsense!

Almost every page on their web site contains factual errors that range from
misleading to incorrect to slander.

Here's a gem from the comparison page:  http://www.sfmc.com/comp.html

Security of different programs 

                | Public  | Compres.| Error   | ITERNET        
   Program      | Key     |         | Correct.| Compatib.  
  --------------+---------+---------+---------+----------
  SafE Mail(TM) |   YES   |   YES   |   YES   |   YES 
  PGP           |   YES   |   NO    |   NO    |   NO
  PEM           |   YES   |   NO    |   NO    |   Yes
  --------------+---------+---------+---------+----------

[ So, how many of you were surprised to learn that PGP is not Internet
compatible, and doesn't do compression?  I'm sure Mr. Zimmerman will be
quite amazed! ]

--

>From their FAQ:  http://www.sfmc.com/faqu.html

* SafE Mail� utilizes a short 22 character Public Key which I realize is
"great" for key exchange. Does this short Public Key the encription code
vulnerable to attack?
     No! The Public Key is generated by a "One Way Hash Function" when the
owner of the software names a private key or passwords. This makes the
encryption code secure and not vulnerable to attack by unautorized individuals. 

* Is SafE Mail� software a solution to concerns about under age or general
viewing of obscene material on the INTERNET?

     Yes! Remember SafE Mail� will encrypt virtually any type of computer
generated files including pictures, video and audio. 

* How can SafE Mail� be used for exchanging sensitive or obscene materials
over the INTERNET?

     Image provider and Subscriber should both utilize SafE Mail� software.
Upon exchange of Public Keys by both parties, Image provider can transmit
encrypted files that can be decrypted by Subscriber with his public and
private keys. Files encrypted with SafE Mail� will be a strong barrier to
any unauthorized viewing. 

[So, remember, the next time you wish to break the law by transmitting
obscene images (which have been shown in court already to be illegal), use
SafE Mail�.]

--

More from the comparisons page:  http://www.sfmc.com/comp.html

SafE Mail� and RSA� algorithms comparison table 

                   |  SafE Mail(TM)              |   RSA  (RC4+MD5)
-------------------+-----------------------------+--------------------
 Programm          | SafE Mail(TM) for Win 1.12  | Entrust 1.1r1
                   | SafE Mail(TM) for DOS 1.12  |
                   |                             |
 Performance Speed | ~4400kB/Sec (In addition to | ~770kB/Sec (Only
 (Results based on | Encryption also performs    | does Encryption)
 33mHz SunSparcs   | Compression, Error          |
 Station)          | Correction, Internet        |
                   | Compatibility and Electronic|
                   | Signature at the same time).|
                   |                             |
 Compression       | Yes, up to 85%              | No, increases
                   |                             | file size by up
                   |                             | to 40%
                   |                             |
 Internet          | Yes                         | No
 Compatibility     |                             |
                   |                             |
 Electronic        | Yes                         | Yes
 Signature         |                             |
                   |                             |
 Public Key        | Yes                         | Yes
 Distribution      |                             |
                   |                             |
 Length of Public  | 22 characters only          | Over 1200 characters
 Key               |                               | can distribute on the 
                   |                             | diskettes only
                   |                             |
 Integrity Checking| Yes                         | Yes
                   |                             |
 Error Correction  | 9 different levels, selected| None Available
                   | by user.                    |
                   |                             |
 Best Attack       | No known way                | Statistical
                   |                             | Analysis
                   |                             |

[ Where to begin?  I wonder if it's their DOS or Windows version that runs
on the 33MHz SparcStation?  Oh, and I love the "no known way" to attack them. ]

--

What are the trade magazines saying about SafE Mail�?  Well, this is from
that traditional bastion of reporting integrity, the Carolina Computer News,
June 1995:  http://www.sfmc.com/scop02.html

" ...SafE Mail� is designed to be a powerfull business and personal
communications tool, ideal for public or private network communications.
SafE Mail� provides the least expensive, fastest, INTERNET compatible,
secure file transmission on the ma rket today. SafE Mail� has a unique
encryption algorithm.
It's encryption key is longer than any other similar product currently
available on the market today. The user can define the distortion/error
correction level which determines the length of the encryption key. The
longer the key length, the more difficult it is to break. SafE Mail� employs
the Public Key Distribution algorithm. Unlike currently available encryption
algorithms (DES,RSA), SafE Mail� generates a unique 22 character public key
for each user. Des has no public key generator and the RSA Public Key
becomes larger (up to several kilobytes) as the number of recipients
increase. SafE Mail� error correction is capable of restoring a binary file
having 15% distortion errors or an ASCII file with 30% errors. SafE Mail�
excellent compression capability allows an ASCII file to be deflated by
almost 85%!... " 

[ If you read the quotes from the various magazines, you probably won't be
surprised at the list of quality magazine names that have been taken in by
these hucksters:  Byte, PC Week, PC Today, and others. ]

--

However, it gets even better than this.  The capstone (if you'll pardon the
pun) of these folks is their contest, described at http://www.sfmc.com/cont.html
If you can break their security, you'll win FIVE FREE COPIES of SafE Mail�!
Gosh, how can we pass up such an opportunity?

-j, ROTFLOL  :-)
--
J. Deters
>From Senator C. Burns' Pro-CODE bill, which I support and you can find at:
http://www.senate.gov/member/mt/burns/general/billtext.htm
"  (2) Miniaturization, disturbed computing, and reduced transmission
 costs make communication via electronic networks a reality."
+---------------------------------------------------------+
| NET:     jad at dsddhc.com (work)    jad at pclink.com (home) |
| PSTN:    1 612 375 3116 (work)    1 612 894 8507 (home) |
| ICBM:  44^58'33"N by 93^16'42"W Elev. ~=290m (work)     |
| PGP Key ID:  768 / 15FFA875                             |
+---------------------------------------------------------+






From shamrock at netcom.com  Tue Jun 18 04:52:15 1996
From: shamrock at netcom.com (Lucky Green)
Date: Tue, 18 Jun 1996 19:52:15 +0800
Subject: SafE Mail Corporation
Message-ID: <v02120d56adec0a567ae3@[192.0.2.1]>


At 17:21 6/17/96, M.Wagoner (1 wrote:
>We would like someone to be able or should I say try and crack our
>encryption. IT IS IMPOSSIBLE.

Sigh. Yet another one...

Unless you make source code available, you will be at best ignored, and at
worst sued by users of your product should they discover that your
unbreakable encryption isn't so unbreakable after all. Unless you use a
hardware RNG and OTPs, your statement that it is impossible to break your
encryption software is simply false. Do not expect that individuals who do
have clue are going to waste their time on trying to break an encryption
scheme invented by someone that so obviously doesn't know what he is doing.

Go back to bed.



-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
   Disclaimer: My opinions are my own.







From jimbell at pacifier.com  Tue Jun 18 05:08:41 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 18 Jun 1996 20:08:41 +0800
Subject: "Termination"?
Message-ID: <199606180422.VAA03104@mail.pacifier.com>


At 07:54 PM 6/17/96 -0400, s1113645 at tesla.cc.uottawa.ca wrote:
>
>
>On Sat, 8 Jun 1996 ichudov at algebra.com wrote:
>
>> Since corrupt officials are likely to have more anonymous cash that
>> phreedom phighters, guess who will win.

Remember, Chudov was wrong about this.  It's not just the amount of money 
you have, it's whether you can identify people as your "enemies."

>> Also, think about this: lots of people have someone they'd like
>> to assassinate but do not actually do it because of lack of anonymity
>> and associated hassles (like dealing with assassins non-anonymously,
>> abundance of traces, possible confession of the assassin and so on).
>> With your assassination clearinghouse these hassles go away. I think it
>> would present an excellent prospect for reducing the population.
>
>I could see an easy possibility for sting operations with the added 
>feature that you can have assassinated all the supected assassins (ie anybody
>that may have come near whatever surveillance there may have been).
>Why bother with courts and trials? 
>
>I still think assassination politics is self-terminating.

It would probably be more accurate to say that it is "self-limiting."  
There's a difference, you know. There may never be a "last" AP death.  
However, AP deaths may (and probably will) eventually become comparatively 
rare, precisely because they so straightforwardly obtained if there is a 
justification for them.  That will cause the behavior of people to change, 
to avoid doing anything which draws the ire of somebody else.

Think back to integral calculus, where the area under an infinitely long 
curve may be finite.  If we think of X as being time, and the rate of deaths 
as the height of the curve above Y=0, the total number of deaths is 
reflected in the area.  Some death rate schedules will integrate to a 
finite, limited number of deaths.  Even if reality doesn't quite approach 
this optimum situation, it MAY approach a much better reality where the 
eventual rate of deaths is far lower than the status quo.

However, the system will only self-limit to the extent that overt agression 
among people will be eliminated.  If nobody agresses against you, you will 
have no reason to agress against anyone else.  Therefore, the system cannot 
end in a dictatorship.

>> Maybe *that* will help the whales and trees, because of the effect on 
demand.
>
>Don't you mean supply? Stores and physical companies are easier to target
>than consumers. But the only remaining environmentalists or for that
>matter any other people with strong views will be net-based pseudonyms.
>Usenet flamewars, editorials and talk shows just don't seem dying for, imho. 

It is true that there may be a strong deterrent against "people with strong 
views."  However, as I pointed out to the head of a 'Net freedom 
organization (who was worried about his future!), the only reason our 
society NEEDS figurehead people such as him is to change unpopular policies 
that are forced on the rest of us.  Once AP begins operating, you don't have 
to stick your neck out to deter agression against you, and you don't need 
heads of organizations such as him, or for that matter organizations either.

Quite simply, why do you need the head of the ACLU, or for that matter the 
ACLU as an organization, if you can target anybody who violates the rights 
that the ACLU currently protects?  

Jim Bell
jimbell at pacifier.com





From jimbell at pacifier.com  Tue Jun 18 05:34:46 1996
From: jimbell at pacifier.com (jim bell)
Date: Tue, 18 Jun 1996 20:34:46 +0800
Subject: Britain to control crypto - official (fwd from Usenet)
Message-ID: <199606180611.XAA08571@mail.pacifier.com>


At 07:38 PM 6/17/96 -0400, Simon Spero wrote:

>4) Will LEAs be permitted to impersonate a non-consenting third party
>for the purposes of allowing a conversation to be intercepted?
>(blatant violation of the 4th ammendme... oh shit- never mind).

You may recall discussions on CP many months ago concerning the extent to 
which an Internet provider would be obligated to obey a cop with a warrant 
who asks for (for example) a "data wiretap" of a customer.  I happen to 
believe that one of the things that's going to have to be settled, and 
settled soon, is a ban on governments coercing people (ISP's, etc) to 
violate their contracts with others.

If my ISP enters into a contract with me to (among other things) tell me if 
my data is tapped, OR he agrees to send me a certification of non-tap status 
daily as long as it's valid and cease sending them when tapping starts, etc, 
presumably if he fulfils his part of the agreement I will soon learn of a 
tap.  

One of the things that was particularly important to the Founding Fathers 
was what they referred to as "Impairment of Contracts," which meant as I 
recall the act of government passing laws and rules which affect my ability 
to contract with you.  Not surprisingly, they didn't like that, such 
restrictions.  If their desires were respected, presumably there would be no 
way for the government to come between two contractors to get one to betray 
the other.


Jim Bell
jimbell at pacifier.com





From tcmay at got.net  Tue Jun 18 05:55:40 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 18 Jun 1996 20:55:40 +0800
Subject: "Mail Exploders"
Message-ID: <adeb9d950202100490f8@[205.199.118.202]>


At 7:23 PM 6/17/96, Lucky Green wrote:
>At 9:45 6/17/96, Duncan Frissell wrote:
>>At 08:43 AM 6/17/96 -0400, Declan B. McCullagh wrote:
>>
>>>I believe we used the term "email exploder" instead of "mailing list,"
>>>particularly in cross-examination and closing arguments, to convey the
>>>idea that such a device is often used for conversation, not just one-way
>>>communication.
>>
>>Was this term invented during the hearings or has anyone heard of it before?
>
>I have heard of it before. I believe "mail exploder" is a rather old term.

I haven't heard the term in many a year, but it fits with the "Internet =
explosives instructions" slant in popular opinion.

"Those nerds are getting their revenge by developing "mail exploders" and
spreading mayhem across the Net."

I wonder where they got their technical information?

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From vulcao at netvision.net.il  Tue Jun 18 06:59:57 1996
From: vulcao at netvision.net.il (Michael Pak)
Date: Tue, 18 Jun 1996 21:59:57 +0800
Subject: David Kahn's "The Codebreakers", a new version. (question)
Message-ID: <31C67EFC.167E@netvision.net.il>


Hi there.

  I have noticed while browsing through http://www.amazon.com
that in December 1996 a new version of "The Codebreakers" will be
published. The complete title says:
"The Codebreakers : The Comprehensive History of Secret Communication
from Ancient Times to the Internet"

Does anyone know if it will also include the complete 1967 edition,
or just the abridged 1973 one? I have managed to locate one copy of
the 1967 edition in our central library and found that there is quite
a lot of information that I fear the writer might want to ommit in this
new edition.
Does anyone have any more info about it?

Thanks a lot,
Michael Pak
Tel-Aviv
Israel.





From perry at alpha.jpunix.com  Tue Jun 18 07:50:32 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Tue, 18 Jun 1996 22:50:32 +0800
Subject: alpha.c2.org in deep shit?
In-Reply-To: <2.2.16.19960617134123.4e17463c@mail.solutions.net>
Message-ID: <Pine.NEB.3.93.960618053739.15150C-100000@alpha.jpunix.com>


-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 17 Jun 1996 sdudar at solutions.net wrote:

> Huh?
> 
> 
> At 06:14 PM 6/16/96 -0500, you wrote:
> >-----BEGIN PGP MESSAGE-----
> >Version: 2.6.2
> >
> >hIwDSReYoIbc3PkBA/9xblBrrofx89t5QoJVwCyGB/+futdCXEolwcsQdwWGcDtc
> >7Vn7orCB8v6iQO+sCgAlYf38ftUxGmzebDd/7eWodTGx8XKnzBIZ9E6bRS38XLRa


Give it a rest willya?? I hit a bad keystroke sequence. That's all. It's a
mistake. Please don't turn this into the never-ending thread. Sheesh!

 John Perry - perry at alpha.jpunix.com -  PGP-encrypted e-mail welcome!
 WWW - http://www.jpunix.com
 PGP 2.62 key for perry at jpunix.com is on the keyservers.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcaHWFOTpEThrthvAQEFcQP/WZ+EeM8MdJzUTtJMO8Cs1B42zyZA7NVH
9Gd47ITEni4lB+ARGRD18CyBHpFJnyWuTQETVzfV53XXkc7tKZJCMQeuGWdayinQ
euy/badMgHU5vly+eA3gFbO+anlBoM4ml/8VQ8uVjbW1SHjJW53VO2MZ8aqTRl5i
K9HPk/7iEvg=
=Qohf
-----END PGP SIGNATURE-----





From jya at pipeline.com  Tue Jun 18 08:59:23 1996
From: jya at pipeline.com (John Young)
Date: Tue, 18 Jun 1996 23:59:23 +0800
Subject: "Mail Exploders"
Message-ID: <199606181221.MAA28806@pipe1.ny2.usa.pipeline.com>


   On Nerd AOL using explosive mail, this Cyberia-L pointer:  
  
      http://infolawalert.com/stories/061496a.html  
 
   [Excerpts]  
 
   Cyber Promotions sends a collection of short ads, written 
   as if they were newspaper classifieds, to upward of 900,000 
   recipients, 600,000 of whom are America OnLine subscribers. 
 
   America OnLine contends that its computer systems have been 
   swamped by Cyber Promotion's mass mailings, especially when 
   5,000 undeliverable messages start to pile up each day. ... 
 
   When the mailings continued, an AOL employee collected a 
   bunch of Cyber Promotions's undeliverable messages and 
   redirected them to UUNET, a large Internet service provider 
   used by Cyber Promotions. 
 
   According to Cyber Promotions' complaint, this "stunt, 
   known as an 'e-mail bomb,' was knowingly and maliciously 
   sent to UUNET by AOL in order to severely tie up and/or 
   bring down UUNET's computer system." UUNET subsequently 
   cancelled Cyber Promotion's account. 
 
   According to Cyber Promotions' complaint, AOL bombed 
   another service provider used by Cyber Promotions. ... 
 
 
 
 
 
 





From anonymous-remailer at shell.portal.com  Tue Jun 18 10:46:50 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Wed, 19 Jun 1996 01:46:50 +0800
Subject: test
Message-ID: <199606181316.GAA01816@jobe.shell.portal.com>


In approximately 2 weeks the export controls on strong cryptography
will be lifted.  Not sure about escrow provisions.

You heard it here first.






From schryver at radiks.net  Tue Jun 18 12:17:29 1996
From: schryver at radiks.net (Scott Schryvers)
Date: Wed, 19 Jun 1996 03:17:29 +0800
Subject: Snake_Oil_punks was Re: SafE Mail Corporation
Message-ID: <199606181340.IAA24761@sr.radiks.net>


Talked with Randy of Safe Mail Corporation on the phone.  

Among the stuff he claimed was that

        PGP has the secret key in its public key!

        Found out that not only does this algorithm use 22 characters.  
        The characters are the ones only found on the keyboard.

        SafeMail uses a proprietary Russian algorithm.

        
Not only is this company misquoting it's making up as it goes along. :)






From warlord at MIT.EDU  Tue Jun 18 13:15:41 1996
From: warlord at MIT.EDU (Derek Atkins)
Date: Wed, 19 Jun 1996 04:15:41 +0800
Subject: Snake_Oil_punks was Re: SafE Mail Corporation
In-Reply-To: <199606181340.IAA24761@sr.radiks.net>
Message-ID: <199606181421.KAA28339@toxicwaste.media.mit.edu>


> Talked with Randy of Safe Mail Corporation on the phone.  
>         PGP has the secret key in its public key!

Huh?  Can you explain what this means?  I'd sure like to know.

-derek





From tmpeters at calvanet.calvacom.fr  Tue Jun 18 13:59:33 1996
From: tmpeters at calvanet.calvacom.fr (TM Peters)
Date: Wed, 19 Jun 1996 04:59:33 +0800
Subject: Federal key registration agency
Message-ID: <199606181427.QAA10162@ns.calvacom.fr>


Compuserve Online Today Daily Edition, 15 June 1996:

Attorney General Janet Reno is advancing a plan to establish a new agency
overseeing all digital encryption, saying that would make it tougher for
criminals and terrorists to use the Internet to carry out crimes.

Speaking to the Commonwealth Club of California in San Francisco, Reno said
her plan would require people to register with the new agency the secret
codes -- or "keys" -- they use to encrypt messages online.

Reporting on this speech, Sandra Ann Harris of United Press International
adds, "Federal authorities could then obtain the information they need to
decipher the encryptions using a court order and secretly monitor electronic
communication on the Internet the same way wiretaps are used to monitor
telephone conversations of suspected criminals."

Reno added, "We look only to make existing law apply to new technology,"
adding new computer programs designed to crack the new complicated
encryptions take too long to be useful to law enforcement.  "Some of our
most important prosecutions have depended on wire taps."

She also said registration of keys might end up being a worldwide
requirement, since the Internet is used increasingly for international
communication, commerce, and criminal enterprise.

Reno told the group that effectively regulting electronic encryption will
depend on fiding a blance between protecting privacy interests while
stopping criminals from cashing in on the new technology.

"If we do our job right citizens will enjoy the Information Age without
being victimized" by high technology, Reno said.

United Press International
Charles Bowen
  









From pjb at ny.ubs.com  Tue Jun 18 14:42:09 1996
From: pjb at ny.ubs.com (Paul J. Bell)
Date: Wed, 19 Jun 1996 05:42:09 +0800
Subject: Whats new at Bletchley Park
Message-ID: <9606181455.AA04450@sherry.ny.ubs.com>


Greetings;

I have just returned from spending a week at Bletchley Park, and have the following 
to report:

On Thursday, 6 June, we had the official switch-on of the rebuilt Colossus. 
There is still a lot of work to be done on Colossus, but that which is there 
is definitely working.  What remains is to fill in the holes to expand it to 
the full five wide system that was the Mark-II machine.

The switch-on was accompanied by a reasonable sized media affair with many 
of the original Colossus users present.  Also in attendance was Tommy Flowers, 
the designer of the original, along with his wife and son.  It was the first 
time that his wife had seen or even heard a lot about Colossus. Dr. Flowers, 
now in his nineties, has a wonderful memory and is a first class gentleman. 
It was a real pleasure to spend some time with him. There was a lot of local 
media coverage, but as yet I have seen nothing in international media, such as 
The (London) Times or the Financial Times, both of whom were represented at the 
switch-on.


During this time, I also installed a new Sun Netra-I server at BP.  This server 
was most kindly donated by Sun Micro Systems.   Many thanks to Scott, who set 
the direction for this gift, and to Matthew, Michael and Steven at Sun-UK for 
all their efforts in making this happen.

A four GByte disk farm was also donated by BoxHill Systems.  Thanks to Carol, 
Ben, Philip, etal at BoxHill for this contribution.

This server will provide Internet and WWW access to BP and will serve as the 
BP mailhost.  Once we have the communications facilities in place, the server, 
elgar, will be on-line.  I'll keep the net informed re: our progress in that 
direction.

Once on-line, Tony Sale has a lot of very cool  ideas for web pages, including 
an interactive, GUI-based  Enigma emulation.  Tony and James Bristow also plan 
to move their existing Web pages to elgar.

The plans to make BP into a one-of-a-kind museum are well underway.  Many 
improvements and added facilities have been added since I was there in April, 
including a nice bar and restaurant in the original Hut Four.  Again I will 
keep the net up-to-date until the Web server is generally available.  

I strongly urge everyone who has the opportunity to visit BP to do so.  At 
this point they are open every other weekend, but will, at some point in the 
future, improve on that. 

If you have any questions, e-mail me, or for 'open weekend status' call BP 
directly at: (011 44) 1 908 640404.

Many thanks to my friends and colleagues at Bletchley Park; Roger, Peter, Tony, 
Harry, Margaret, etc, for their hospitality and kindness.


	-paul (pjb at 23kgroup.com)






From dcrocker at brandenburg.com  Tue Jun 18 14:43:08 1996
From: dcrocker at brandenburg.com (Dave Crocker)
Date: Wed, 19 Jun 1996 05:43:08 +0800
Subject: Netscape Mail Security and PGP Plugins
In-Reply-To: <31C39529.133B6630@best.com>
Message-ID: <v03007434adec7c817a36@[205.214.160.97]>


At 10:01 PM -0700 6/15/96, Greg Kucharo wrote:
>There hasn't been a lot of discussion on this list about the future
>of secure e-mail via Netscape. The most i've seen has come from

	Folks might also want to look at the notes and discussion that took
place, surrounding the February workshop put on by the Internet Mail
Consortium.  Check out the appropriate links under <http://www.imc.org>.

	This, of course, has nothing specific to netscape since it's
browser appears as nothing more than one more Internet mail user agent.

d/

--------------------
Dave Crocker                                            +1 408 246 8253
Brandenburg Consulting                             fax: +1 408 249 6205
675 Spruce Dr.                                 dcrocker at brandenburg.com
Sunnyvale CA 94086 USA                       http://www.brandenburg.com

Internet Mail Consortium               http://www.imc.org, info at imc.org







From moroni at scranton.com  Tue Jun 18 14:44:34 1996
From: moroni at scranton.com (Moroni)
Date: Wed, 19 Jun 1996 05:44:34 +0800
Subject: Class III InfoWar: TST Article
In-Reply-To: <ade632bf01021004d335@DialupEudora>
Message-ID: <Pine.LNX.3.91.960618111220.32248C-100000@user1.scranton.com>


    What are the effects of an EMP on the persons releasing the bomb 
,those in te vacinity and what is the distance that the bomb has a 
physical effect on people. Also ,is there any knowledge of reusable EMP 
bombs yet?
                              TIA






From m5 at vail.tivoli.com  Tue Jun 18 15:02:15 1996
From: m5 at vail.tivoli.com (Mike McNally)
Date: Wed, 19 Jun 1996 06:02:15 +0800
Subject: Federal key registration agency
In-Reply-To: <199606181427.QAA10162@ns.calvacom.fr>
Message-ID: <31C6C938.3CFD@vail.tivoli.com>


> Compuserve Online Today Daily Edition, 15 June 1996:
> 
> Attorney General Janet Reno ... said her plan would require people to
> register with the new agency the secret codes -- or "keys" -- they use 
> to encrypt messages online.

This would be the "Bad Cop" line, for those playing along at home.

[ "Gosh, can't you help us VP Al Gore?" the people beg.  "Well, I'll
  see what I can do, but Reno is really mean and nasty.  I'll try to
  reason with her though.  Wish me luck." ]

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
       m5 at tivoli.com * m101 at io.com          *
      <URL:http://www.io.com/~m101>         * suffering is optional





From moroni at scranton.com  Tue Jun 18 16:03:25 1996
From: moroni at scranton.com (Moroni)
Date: Wed, 19 Jun 1996 07:03:25 +0800
Subject: Applied Cryptography - used copy?
In-Reply-To: <1.5.4.16.19960614211928.326fad06@arc.unm.edu>
Message-ID: <Pine.LNX.3.91.960618113856.32248D-100000@user1.scranton.com>


      Hi,
          Didn't I read that with the new Applied Cryptography there was a 
diskette or cd included that had all the programs on it? I noticed a copy 
at the B Dalton and when I looked at it it contained no cd or diskette. 
Was the aforementioned new edition with disk/cd a limited edition 
available through the mail only?
                       TIA,
                           moroni






From wxfield at shore.net  Tue Jun 18 17:06:29 1996
From: wxfield at shore.net (Warren)
Date: Wed, 19 Jun 1996 08:06:29 +0800
Subject: Fuseable Links - no guarantees??
Message-ID: <v02140700adec85bc80af@[204.167.110.204]>





>I don't know of any modern chips that have "ceramic coatings." (Some chips,
>esp. CPUs, are still ceramic-packaged, but in these cases the metal or
>ceramic lids are easily removed.)
>
>Most chips are plastic-packaged, and plasma ashers and/or chemical baths
>will expose the chip surface easily enough.

Yep....I guess my age was showing  ;-)


_______
Warren Crossfield
Programmer/MacOS
"Buy a Pentium - so you can restart Windoze faster!"







From ses at tipper.oit.unc.edu  Tue Jun 18 17:08:38 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Wed, 19 Jun 1996 08:08:38 +0800
Subject: Snake_Oil_punks was Re: SafE Mail Corporation
In-Reply-To: <199606181421.KAA28339@toxicwaste.media.mit.edu>
Message-ID: <Pine.PCW.3.94.960618172346.2103D-100000@CISPPP>




On Tue, 18 Jun 1996, Derek Atkins wrote:

> > Talked with Randy of Safe Mail Corporation on the phone.  
> >         PGP has the secret key in its public key!
> 
> Huh?  Can you explain what this means?  I'd sure like to know.

It's obvious, silly. The public key exponent has the private key exponent
embedded in it,  information theory and modular arithmetic be damned :)

Simon







From llurch at networking.stanford.edu  Tue Jun 18 17:27:36 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Wed, 19 Jun 1996 08:27:36 +0800
Subject: Time (of CyberPorn fame) puts up a nice CDA page; commentary from PED
Message-ID: <Pine.GUL.3.93.960618101613.19977B-100000@Networking.Stanford.EDU>


Netly-L is the mailing list that goes with www.netlynews.com. The traffic is
quite low, and occasionally something entertaining comes by.

-rich

---------- Forwarded message ---------- 
Date: Tue, 18 Jun 1996 05:58:20 -0400   
From: Philip Elmer-DeWitt <ped at well.com>
Reply-To: netly-l at pathfinder.com
To: Multiple recipients of list <netly-l at relay.pathfinder.com>
Subject: Re: So...

Chris, a couple of omissions in your very good techwatch CDA extravaganza
(http://pathfinder.com/technology/netdecency/)

1) the screening software sidebar in this week's TIME (preferably with live
pointers)
2) John Perry Barlow's TIME essay from late 1995 (search TIME for "this
bill is full of shit")

I could argue the omission of the "cyberporn" cover round or flat.


Philip Elmer-DeWitt                                             ped at well.com
TIME Magazine        ped at cis.compuserve.com        philiped at aol.com






From rah at shipwright.com  Tue Jun 18 17:35:03 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Wed, 19 Jun 1996 08:35:03 +0800
Subject: Federal key registration agency
In-Reply-To: <199606181427.QAA10162@ns.calvacom.fr>
Message-ID: <v03006f08adec99aa5e9d@[199.0.65.105]>


At 10:27 AM -0400 6/18/96, TM Peters wrote:
> "If we do our job right citizens will enjoy the Information Age without
> being victimized" by high technology, Reno said.
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Just by their government. Sheesh...

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From ir003022 at interramp.com  Tue Jun 18 17:46:26 1996
From: ir003022 at interramp.com (Pascal Mattiocco)
Date: Wed, 19 Jun 1996 08:46:26 +0800
Subject: unsuscribe
Message-ID: <31C6F6B2.2D6C@interramp.com>


unsuscribe





From WlkngOwl at unix.asb.com  Tue Jun 18 17:53:09 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Wed, 19 Jun 1996 08:53:09 +0800
Subject: Pickle Angels?!?  (Humour)(Noise)
Message-ID: <199606181845.OAA01910@unix.asb.com>


On 17 Jun 96 at 19:35, William Knowles wrote:

> On today's Sally Jesse Raphel was Curtis Swiva?
> founder of the Guardian Angels talking about his new record
> of eating pickles.  He plans to break the record for eating 
> 22 hot dogs in 12 minutes....

I can see it now...

"In a rather ironic twist of fate, Curtis Sliwa was the first person 
charged with violating the Communications Decency Act (upheld by the 
Supreme Court) after a web-surfer in Tennessee complained about 
digitized pictures of himself breaking the world's record for eating 
hot dogs which were posted on his web page..."


Rob.
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From vin at shore.net  Tue Jun 18 18:07:36 1996
From: vin at shore.net (Vin McLellan)
Date: Wed, 19 Jun 1996 09:07:36 +0800
Subject: "Mail Exploders"
Message-ID: <v02140b03adec9a570eca@[206.243.160.205]>


        Wonderful tale!  I can see that -- maybe, just maybe -- AOL or
another targeted online community (a semi-moderated mailing list or even a
semi-moderated newsgroup) could be slapped for just bouncing the SPAM back
at the sender.

        I bet they could get away with it, however, if they appended a
brief polite notice that this mailing exceeds some (anti-spam) perimeters
that the subscribers of AOL (or other online community) agreed -- in their
intial subscriber contracts -- to have AOL refuse for them.

        (Which text, of course, would add to the reply mail burden for the
Spammer's IAP.)

        The only meaningful control on SPAM I can see is to start enforcing
a chain of contracts that forbid it (without reference to content) from the
backbone back through the IAPs to the users.  (I think Long-Morrow at Yale
had a nice paper on this a couple of years back.) But this sort of
auto-return mechanism could make a dent on the super-Spanners now.

        Yea for AOL!

        Suerte,
                        _Vin

>   On Nerd AOL using explosive mail, this Cyberia-L pointer:
>
>      http://infolawalert.com/stories/061496a.html
>
>   [Excerpts]
>
>   Cyber Promotions sends a collection of short ads, written
>   as if they were newspaper classifieds, to upward of 900,000
>   recipients, 600,000 of whom are America OnLine subscribers.
>
>   America OnLine contends that its computer systems have been
>   swamped by Cyber Promotion's mass mailings, especially when
>   5,000 undeliverable messages start to pile up each day. ...
>
>   When the mailings continued, an AOL employee collected a
>   bunch of Cyber Promotions's undeliverable messages and
>   redirected them to UUNET, a large Internet service provider
>   used by Cyber Promotions.
>
>   According to Cyber Promotions' complaint, this "stunt,
>   known as an 'e-mail bomb,' was knowingly and maliciously
>   sent to UUNET by AOL in order to severely tie up and/or
>   bring down UUNET's computer system." UUNET subsequently
>   cancelled Cyber Promotion's account.
>
>   According to Cyber Promotions' complaint, AOL bombed
>   another service provider used by Cyber Promotions. ...
>
>
>
>
>
>

         Vin McLellan +The Privacy Guild+ <vin at shore.net>
      53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548
                         <*><*><*><*><*><*><*><*><*>







From long-morrow at CS.YALE.EDU  Tue Jun 18 18:11:31 1996
From: long-morrow at CS.YALE.EDU (long-morrow at CS.YALE.EDU)
Date: Wed, 19 Jun 1996 09:11:31 +0800
Subject: "Mail Exploders"
Message-ID: <199606181800.OAA18621@SPARKY.CF.CS.YALE.EDU>



From: vin at shore.net (Vin McLellan)
>        The only meaningful control on SPAM I can see is to start enforcing
>a chain of contracts that forbid it (without reference to content) from the
>backbone back through the IAPs to the users.  (I think Long-Morrow at Yale
>had a nice paper on this a couple of years back.) But this sort of
>auto-return mechanism could make a dent on the super-Spanners now.

Actually the paper was written by our Assistant Chairman 
(Dunne-Bob at CS.Yale.EDU).  I only made the paper available via FTP, Gopher,
WWW and email.

ftp://www.cs.yale.edu/pub/dunne/jurimetrics/
gopher://www.cs.yale.edu/11/pub/dunne/jurimetrics/
http://www.cs.yale.edu/pub/dunne/jurimetrics/jurimetrics.html
mailto:majordomo at cs.yale.edu
                        ( put 'get sneakers jurimetrics.txt' in message body )
 
H. Morrow Long, Mgr of Dev., Yale Univ., Comp Sci Dept, 011 AKW, New Haven, CT
06520-8285,	VOICE:	(203)-432-{1248,1254}		FAX:	(203)-432-0593
INET: Long-Morrow at CS.Yale.EDU UUCP: yale!Long-Morrow BITNET: Long-Morrow at YaleCS
WWW:	http://www.cs.yale.edu/users/long-morrow.html






From steve at miranova.com  Tue Jun 18 18:13:59 1996
From: steve at miranova.com (Steven L Baur)
Date: Wed, 19 Jun 1996 09:13:59 +0800
Subject: Remailer Operator Liability?
In-Reply-To: <199606171703.NAA19819@jekyll.piermont.com>
Message-ID: <m2ybllm0cn.fsf@deanna.miranova.com>


>>>>> "Perry" == Perry E Metzger <perry at piermont.com> writes:

Perry> Duncan Frissell writes:
>> At 08:43 AM 6/17/96 -0400, Declan B. McCullagh wrote:
>> 
>> >I believe we used the term "email exploder" instead of "mailing list,"
>> >particularly in cross-examination and closing arguments, to convey the
>> >idea that such a device is often used for conversation, not just one-way
>> >communication.
>> 
>> Was this term invented during the hearings or has anyone heard of it before?

Perry> It is not common, but it used to be used in the early days a lot. I
Perry> don't think I've heard it much since '85 or so.

The term is used commonly in the Linux community due to the
vger.rutgers.edu bottleneck most of the development mailing lists go
through.  There's too much volume for one machine to handle, so
exploders are used to relay outgoing email by domain name.  This has
to mean that the subscriber list is distributed via the exploders,
though I'm not familiar with exactly how they're doing it.

At any rate, the way they are used put it in direct contradiction to
Declan's quote above, since they are *only* used as a broadcast
mechanism.
-- 
steve at miranova.com baur
Unsolicited commercial e-mail will be proofread for $250/hour.
Andrea Seastrand: For your vote on the Telecom bill, I will vote for anyone
except you in November.





From jimbell at pacifier.com  Tue Jun 18 18:30:38 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 19 Jun 1996 09:30:38 +0800
Subject: Federal key registration agency
Message-ID: <199606181838.LAA08913@mail.pacifier.com>


At 04:27 PM 6/18/96 +0200, TM Peters wrote:
>Compuserve Online Today Daily Edition, 15 June 1996:
>
>Attorney General Janet Reno is advancing a plan to establish a new agency
>overseeing all digital encryption, saying that would make it tougher for
>criminals and terrorists to use the Internet to carry out crimes.
[...]
>Reno added, "We look only to make existing law apply to new technology,"

Such a claim is bogus.  "existing law" already "applies" to new technology.  
It's just that this only means that cops think they have a right to wiretap. 
 It does not mean that they are able to usefully understand the meaning of 
what they hear.


>adding new computer programs designed to crack the new complicated
>encryptions take too long to be useful to law enforcement. 

Like a billion years too long, huh?

> "Some of our
>most important prosecutions have depended on wire taps."

But is the average citizen substantially impacted by crimes that would be 
assisted by good encryption?  Probably not.  

>She also said registration of keys might end up being a worldwide
>requirement, since the Internet is used increasingly for international
>communication, commerce, and criminal enterprise.

She forgot to mention REVOLUTION.

>Reno told the group that effectively regulating electronic encryption will
>depend on finding a balance between protecting privacy interests while
>stopping criminals from cashing in on the new technology.

I see no need for a "balance."  I think that the advent of good encryption 
has the effect of increasing the security of individuals.


>"If we do our job right citizens will enjoy the Information Age without
>being victimized" by high technology, Reno said.

Maybe she should have said, "without toppling the government-employed 
parasites from their positions of power."



>United Press International
>Charles Bowen

Another one of those organizations threatened by media-bypass.
Jim Bell
jimbell at pacifier.com





From frantz at netcom.com  Tue Jun 18 18:37:12 1996
From: frantz at netcom.com (Bill Frantz)
Date: Wed, 19 Jun 1996 09:37:12 +0800
Subject: SafE Mail Corporation
Message-ID: <199606181804.LAA13022@netcom8.netcom.com>


At 12:55 AM 6/18/96 -0700, Lucky Green wrote:
>At 17:21 6/17/96, M.Wagoner (1 wrote:
>>We would like someone to be able or should I say try and crack our
>>encryption. IT IS IMPOSSIBLE.
>
>Sigh. Yet another one...
>
>Unless you make source code available, you will be at best ignored, and at
>worst sued by users of your product should they discover that your
>unbreakable encryption isn't so unbreakable after all. Unless you use a
>hardware RNG and OTPs, your statement that it is impossible to break your
>encryption software is simply false

Don't even assume that hardware RNGs and OTPs by themselves make a system
unbreakable.  Go see NSA's web site on the Verona intercepts to see what
people who know what they are doing can do when users slip up using a OTP
system.  http://www.nsa.gov:8080/

I'm with Lucky (and many others) 100% on this one.  Snake Oil.


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From vin at shore.net  Tue Jun 18 18:45:02 1996
From: vin at shore.net (Vin McLellan)
Date: Wed, 19 Jun 1996 09:45:02 +0800
Subject: Source Laundering <was: You bet they have/are: NSA/CIA to snoop INSIDE theU.S.???>
Message-ID: <v02140b01adec77b9e9ea@[206.243.160.205]>


        Mr. Nobody, an anonymous source of no repute, posted a pretty savvy
analysis of the politics of unauthorized wiretaps a week back:

>   anyone who believes the FBI and a host of other U.S. agencies even
>   less scrupulous does not wiretap without permits, has been standing
>   behind the door. generally, it does not matter if the information
>learned is
>    admissable in court  --they never admit wiretapping in the first place as
>    the agency themselves, in many cases, *did*not*wiretap*  --but the
>  agency does buy info from usually unsavory "contractors" who do wiretap.

        This conforms to my information too.  Back in the mid-80s, I  took
a wiretap counterintelligence class with a lot of cops, PIs, and oil
company securitymen.  (The quietest guy in the class, a balding little
whimp at the tech bench behind me, was a PI by the name of John Walker, who
later drew some attention with his overseas business interests.  The
weirdiest guy in the class was another PI who kept trying to talk to the
other guys about their work but was jerked around because everyone knew he
was always wired and at the end of the day would rush back to his hotel
room to put the tapes through a voice stress analyser.  I would have said
the most dangerous guys in the room were the grizzled Malasian oilmen, but
in hindsight Walker probably takes the prize.)

        The instructors were big Ray Jarvis (now of Jarvis Security,) an
ex-Marine reputed to have recently been the CIA's top wireman, and Allan
Bell (now of Dektor Counterintelligence,) the former director of the US
Army's spy shop R&D (who probably has as many secret patents as Friedman
did) -- both smart, thoughtful, amiable guys who knew their tradecraft
cold.

        What I remember most of the week long class was Ray Jarvis standing
before my classmates and estimating that maybe 10-15 percent of the
domestic wiretapping and bugging -- circa '85 -- by US police agencies was
legally authorized.  He paused and looked around the room for the
consensus. Half the room (mostly big city US cops) paused, looked off in
the distance for a moment, then nodded.

         My sense is that lawmen typically planted the relevant information
in the hands (or mouths) of a maluable "trusted source" when they did the
wire themselves.  If a subcontractor did it for them (on a purposely vague
assignment,) they just didn't ask how the "trusted source" managed to get
the information.  Either way, it worked like money laundering.  Source
laundering, you could call it.

        The cops didn't seem to view themselves as angels, but they were
usually utterly certain the guys they were targeting were the scum of the
earth.  Maybe they were. My expectation was that most of the illicit wires
would be focused on the drug trade (where cops feel like the Border Patrol
in El Paso, hopelessly outclassed by their opponents) but -- at least at
that time -- the scuttlebutt seemed to indicate it was much more broadly
used in criminal investigations. Both wiretaps and bugs are just so damn
easy to place, so cheap, so deniable, and (done properly) so untracable,
the temptation was virtually irresistable.  And there seemed to be a whole
subculture of master wiremen, trained by the US Govt, accepting bids from
both the Law and corporate security agents.

        (Outside the US, particularly in the oil business, it sounded like
the Wild West before Judge Bean showed up.   I've never doubted that the
cost of a DES-cracking special purpose computer has been buried among the
expense chits of many multinationals, certainly in the Big Oil Government
budgets.  I'd love to talk to the NSA guys who went in with Desert Storm to
find out what the Iraqis picked up from Kawaiti government/oil IS
installations;-)

        I don't expect much has changed, except everything has gotten
smaller, cheaper, and (with datacom) vastly more automated.  What those
guys knew in the 80s were the phone systems (poor design left many PBXs
with back doors, some of which could even be triggered remotely) but we've
all learned new tricks -- and the NSA and others always concentrated on
CompSec.

>        as for the NSA/CIA spying on US citizens --they dont, they spy on
>    British citizens with facilities provided by M5 and M6.  in return,
>    British M5/6 agents spy on U.S. citizens from Langely or Gaithersberg, or
>    wherever.  The fact they just happen to share information is an
>    "accident."

         In this, I doubt Mr. Nobody.  I can't see either the Brits nor the
Yanks willing to trust the other nation's bureaucratic system to keep
in-country spying secret.  The rule was: governments leak... eventually.
And the fallout of Revelation would be awesome.  (And there were so many
safer options.)

        I suppose, however, Nobody's scheme fits the "laundered source"
model too.  I recall talk of this sort of arrangement mostly to cover US
citizen to US citizen phone links across the US border.  I'm not even sure
the NSA couldn't legitimately do this, but after the Church Committee
hearings in the 1970s, everyone wanted to keep their numbers low.  (The
extreme was the FBI, of course, which would show up annually to report
what? 7 or 11 authorized wiretaps for the year.   Everyone barely able to
control their snickers.)

        My apologies if Memory Lane took up too much bandwidth, but the
politics of crypto have a heritage that's ever more relevant.  (Witness all
the direct and indirect reference to Kahn and Bamford's work on this List.)

        A thought:  Being pessimistic lately, and assuming our elected US
pols continue their subservience to the spy agencies, I have a question.
How difficult would be it to concoct a encryption-based scheme which would
hold escrow keys in some sort of serialized time-sensitive one-way account
-- a device that would make it all but impossible to get a key out of the
account without leaving a permanent record that it was retrieved.  How many
were retrieved?  When? By whom?

        Is there such a scheme?  How does/could it work?

        In defending privacy,  Accountability is a very powerful weapon.
(Remember those FBI reports of 7-11 wiretaps?) I'd love to see such a
tamperproof recording device imposed upon the FBI's access to its new
Master Wiretap circuits, for example -- with a legislatively-mandated
revelation of the unforgable results,  something comparable to the current
law in criminal cases, and maybe with some 5-year sunshine provison for
national security cases.

        Such a scheme might be all we can get if this Administration or a
future one gets a version of Clipper mandated.

        Cynics like many of you on this list may not realize how
desperately these guys want to keep to the shadows.  Bright Lights and
Accountability ought to be a Cypherpunk Goal -- even when the tide is
running against us.  A well-documented tamperproof accounting scheme to
document the use of these intrusive powers could result in a potentially
powerful piece of legislation.

        Suerte,
                        _Vin

         Vin McLellan +The Privacy Guild+ <vin at shore.net>
      53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548
                         <*><*><*><*><*><*><*><*><*>







From rodger at interramp.com  Tue Jun 18 19:01:48 1996
From: rodger at interramp.com (Will Rodger)
Date: Wed, 19 Jun 1996 10:01:48 +0800
Subject: Applied Cryptography - used copy?
Message-ID: <1.5.4.32.19960618180535.0069c35c@pop3.interramp.com>


At 11:43 AM 6/18/96 -0400, you wrote:
>      Hi,
>          Didn't I read that with the new Applied Cryptography there was a 
>diskette or cd included that had all the programs on it? I noticed a copy 
>at the B Dalton and when I looked at it it contained no cd or diskette. 
>Was the aforementioned new edition with disk/cd a limited edition 
>available through the mail only?
>                       TIA,
>                           moroni
>
>
Mail only. And, of course, you have to live somewhere Schneier can legally
send you the stuff. $40 the set in MS-DOS, $120 for two-year sub., updated
2X/yr.

Will Rodger
Washington Bureau Chief
Inter at ctive Week






From chris.liljenstolpe at SSDS.com  Tue Jun 18 19:43:33 1996
From: chris.liljenstolpe at SSDS.com (Christopher Liljenstolpe)
Date: Wed, 19 Jun 1996 10:43:33 +0800
Subject: SafE Mail Corporation
In-Reply-To: <199606172121.RAA00883@ns1.ntrnet.net>
Message-ID: <31c7022a.17827605@denver.ssds.com>


Please get a clue before designing crypto or allowing your marketing
people loose on the net.

This smells of snake-oil and your pages are full of inacuracies:

1) What is Internet-compatable (PGP works fine over the net, but it is
not).  If you mean RFC or other standard compatable (i.e. MOSS,
S/MIME, PEM), you aren't conformant to any standards.

2) 22 character Public keys are a joke

3) No crypto system is unbreakable unless you are doing some
permutation of OTP.  Public key systems are definately compromisable
with the appropriate application of compute power.

If you do not have a clue, don't play with those that do.



On Mon, 17 Jun 1996 17:21:36 -0400, the sage safemail at ntrnet.net
(M.Wagoner (1)) scribed:

>
>We would like someone to be able or should I say try and crack our
>encryption. IT IS IMPOSSIBLE.
>
>
>
>
>Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.
>
>
>
>Randy Estridge
>SafE Mail Corporation  
>
>


--
   ( (   | (               Chris Liljenstolpe <Chris.Liljenstolpe at ssds.com>
    ) ) (|  ), inc.        SSDS, Inc; 8400 Normandale Lake Blvd.; Suite 993
   business driven         Bloomington, MN   55437; 
 technology solutions      TEL 612.921.2392  FAX 612.921.2395   Fram Fram Free!
 PGP Key 1024/E8546BD5     FE 43 BD A6 3C 13 6C DB  89 B3 E4 A1 BF 6D 2A A9





From stephan at studioarchetype.com  Tue Jun 18 19:43:38 1996
From: stephan at studioarchetype.com (Stephan Vladimir Bugaj)
Date: Wed, 19 Jun 1996 10:43:38 +0800
Subject: Micropayments, Anarchy, It's All The Same... ;P
In-Reply-To: <199606181405.KAA52510@osceola.gate.net>
Message-ID: <v03006f05adec4223c7d1@[204.162.75.169]>


>>that is associated with any new technology should be better analyzed by the
>>few who care about the future rather than those who just worship the future
>>to ensure that the decisions which are made by this almighty 'market'
>>(again, I distinguish this from either the 'people' or the 'consumers')
>
>Er...just how did you draw that distinction? I seem to have missed it.
>I suppose that by believing the free marketplace best satisfies peoples'
>and consumers' needs (not perfectly, just best) that I am a worshiper
>here. So be it, but see if you can explain the difference between
>non-marketplace decisionmaking and bureaucrat decisionmaking for me.
>
>
>
The distinction that I'm making is that the 'market' is governed by both
consumers and producers.  As such, what the market will bear can and sometimes
does diverge from what consumers want.  Taking a really silly example, let's
say you want a blue car, but the auto industry decided that blue cars
constituted
too few of their sales to justify the purchase of blue paint.  However,
they did
this study in Malibu, where everyone wanted a red car, because some
statistician
felt that was the perfect demographic for their line of cars.  He was
wrong.  Now
middle America, who loves blue cars, can't get any.  They have to settle for
red cars as the next best thing.  Next year the market will probably
readjust and blue cars will again be available, but for the year the bulk
of consumers had little say in market decisions.  Producers can and will
also 'dump'
undesirable products on the market as we have all seen before.  Sometimes
consumers complain, sometimes they just groan and bear it.  But the fact of the
matter is that the 'market' is comprised of two main elements: 'consumers' and
'producers' and the market climate is not solely determined by consumers'
needs.
Bureaucratic (government) decision making is no better.  Keep in mind, however,
that capitalist organizations (producers) are themselves bureaucratic
institutions.  Therefore, bureaucracy plays a central role in the free
(sic) market.  A balance between the power of the public and private sector
generally
best represents the peoples' and consumers' needs.

How the market diverges from the polit is clear.  The market is only concerned
with consumers, and this leaves out the poor, who are undeniably part of the
polity.  In fact, if you take just the technology market, that market is
primarily
producer-to-producer (business-to-business) and the traditional consumer
(an individual or family) is a relatively recent addition to this market.
Interbusiness concerns still drive this market.


>>'rammed down their throats'.  Sometimes people forget that technologists
>>and their venture capitalist backers aren't the best representative sample
>>of the world's population, nor are they a reliable source of objective
>>information about the correlation between the 'market' and the 'polit'.
>
>They aren't the best, they are simply more reliable than Hillary
>Clinton and co. are.
>
>
There are two ways to go on this.  It's important to realize that while
government officials are professional politicans with all the moral and
ethical compromise
that this entails, they are also ultimately responsible to their
constituency.  The role of government is different than the role of
business, and I for one would
not be willing to give up democratic government (ragardless of its
hypocracies and flaws) in favor of a business bureaucracy as our national
ruling hegemony.

Businesses, especially ones governed by unmitigated capitalists, are
responsible
only to profit.  The social darwinist perspective of most capitalists is
such that
this profit can come at any cost, and things will 'work themselves out'
according to natural (sic) social selection.  This is a morally and
ethically dangerous
viewpoint to have.

The polity is supposed to be able to count on their government to be their
voice
of power against the transgressions of more powerful individuals at the top of
the capitalist power structure.  This is not usually the case, as
government officials rely on these powerbrokers for their jobs and
kickbacks, but at least in
the United States the people have theoretical constitutional recourses against
serious infringements of their rights.  While centralized government has
serious
problems, weakening the federal protection of the bill of rights would
serve only
to increase the ability of the powerful to abuse the polity (and create
chaos since 50 different sets of state laws would provide an amazing web of
loopholes
for would-be tyrants).

Our government is supposed to be kept in check by the people, and I believe
that
is what people like the Cypherpunks are and should be doing.  However, don't go
running to Laissez Faire capitalists as your comrades in arms in the
struggle to
keep powerful institutions out of your personal lives, because you'll be
more than
just disappointed if you help private sector powerbrokers whittle away the
protective powers of the public sector.

Morally I'm more Anarchist than Centrist, but I'm also willing to face reality.

>Agreed. The most forthright possible debate comes on cypherpunks IMO.
>The least forthright comes from the government/media complex. Crypto-
>anarchists aren't proposing utopia, just improvement -- which is a
>much easier standard to meet considering what we have. I am sure
>there will be problems and frauds, just as there were Ford Pintos.
>Note that the Pinto phenomenon was possible in spite of pervasive
>and growing govt. regulation, yet the response: Even more regulation.
>Hmmmmm.
>JMR
>
>
There needs to be a balance between too much regulation, and too little.
The public sector has a system of checks and balances which doesn't always
work, but is institutionalized and respected.  The private sector, however,
is not so accountable and their only checks and balances are the laws that
we the people are obligated to insist be enforced.  Morality and justice
break down easily in the face of bribes and hush-money, but with an
institutionalized system of justice there is at least a modicum of
accountability which is necessary for a society(ies) which is far too
immature for true Anarchism.

Keep in mind the role that capitalists played along side the government in
Nazi Germany, (unchecked) power corrupts - regardless of whether you're in
the public sector or the private sector.  (Yes, capitalism was technically
regulated in Nazi Germany, but that is not the point.)

I am as unwilling to support Laissez Faire capitalism as I am to support
an intrusive and restrictive government.

ttl
Stephan

-------------------------------------------------------------------
This signature has been kidnapped by space aliens.
If you find it you can call (415) 703-8748.
I work for Studio Archetype, and they don't find any of this funny.







From unicorn at schloss.li  Tue Jun 18 20:20:08 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Wed, 19 Jun 1996 11:20:08 +0800
Subject: Safemail
Message-ID: <Pine.SUN.3.93.960618161653.20055B-100000@polaris>




If the below is accurate, your company is in even more trouble.  I do hope
no one would think of RECORDING a conversation with a safemail
represenative.  I admit that it would be valuable to an attorney looking
to sue Safe Mail, but it's not a very nice thing to do.  Even if its
legal. (which it would be in most states).

---------- Forwarded message ----------
Date: Tue, 18 Jun 1996 08:39:12 -0500
From: Scott Schryvers <schryver at radiks.net>
To: cypherpunks at toad.com
Subject: Snake_Oil_punks was Re: SafE Mail Corporation

Talked with Randy of Safe Mail Corporation on the phone.  

Among the stuff he claimed was that

        PGP has the secret key in its public key!

        Found out that not only does this algorithm use 22 characters.  
        The characters are the ones only found on the keyboard.

        SafeMail uses a proprietary Russian algorithm.

        
Not only is this company misquoting it's making up as it goes along. :)






From frissell at panix.com  Tue Jun 18 20:41:05 1996
From: frissell at panix.com (Duncan Frissell)
Date: Wed, 19 Jun 1996 11:41:05 +0800
Subject: Micropayments, Anarchy, It's All The Same... ;P
Message-ID: <2.2.32.19960618205114.0098dd20@popserver.panix.com>


At 12:02 PM 6/18/96 -0700, Stephan Vladimir Bugaj wrote:

>How the market diverges from the polit is clear.  The market is only concerned
>with consumers, and this leaves out the poor, who are undeniably part of the
>polity.

The poor are consumers and indeed can regularly outbid the middle class and
rich for resources (if they couldn't, poor neighborhoods would never grow in
size but they do all the time.)

DCF






From unicorn at schloss.li  Tue Jun 18 20:57:07 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Wed, 19 Jun 1996 11:57:07 +0800
Subject: SafE Mail Corporation
In-Reply-To: <199606181250.IAA00625@ns1.ntrnet.net>
Message-ID: <Pine.SUN.3.93.960618154407.20055A-100000@polaris>


On Tue, 18 Jun 1996, M.Wagoner (1) wrote:

> Thanks for responding.

You're lucky I even bothered to take the two minutes it required to do
that.

> >> We would like someone to be able or should I say try and crack our
> >> encryption. IT IS IMPOSSIBLE.
> >
> >With the above you have saved me the trouble of even trying.
> 
> 
> I can understand your reaction but this is a brand new approach to
> crypotrography that no one else has thought about doing.

Any approach to "cryotrography" [sic] which includes absolute statements
about unbreakability (like your quote above) betrays such ignorance about
the nature of the science as to render it a literal glowing neon brand on
your forehead reading :DO NOT PURCHASE CRYPTO FROM THIS MAN: and
accompanied by a loud speaker repeating same at 100dB.

Using cow feces to encrypt messages is also a brand new approach which no
one else has thought about doing.  That hardly means it is worth more than
the feces itself.

> >Your appraoch to cryptography betrays such ignorance that nothing which
> >your "corporation" produces could be of the slightest redeeming value.
> >
> >(Bloody snake oil venders)
> >
> >Now go away.

> I really wish I knew what you meant by this. If I made you upset, I apoligize.

It means I consider your product dirt.  Cryptography is about economics.
I'm not going to spend time teaching you the tenants of the science
itself though it is clear you need such a lecture.  Try reading "Applied
Cryptography" for starters.

Calling a given cypher "uncrackable" is simple fiction or ignorance.

I might add that I am an attorney licensed to practice in the District of
Columbia, among other jurisdictions.  Having looked at your web page and
the comparisons you make to PGP I can tell you without much qualification
at all that it is at worst defamation and fraud.  I would not at all be
surprised to find that each sale of product you make constitutes a count
of wire fraud (18 U.S.C.A. sections 1341, 1343) and a count of mail fraud
if the product is shipped via the mails.  I also believe that ViaCrypt and
whoever else may have claim to the rights to market PGP commercially has a
clear action of defamation, tortious interference with contract and
depending on the state, unlawful sales interference.  The fraud element
would activate punative damages provisions.

Should any of these parties come to me asking for advice I would direct
them immediately to the nearest courthouse.

Tell me, is your "corporation" licensed to do business in any state?  Is
it licensed as a corporation?  Limited Liabiltiy? Many states impose
sanctions, including administrative disolution and fines, for the use of
misleading corporate forms or names while conducting interstate commerce
(which you are clearly doing).

> >> Our Web site is http://www.sfmc.com  Phone number is 1-800-252-9938.
> >Clearly a waste of good storage space.
> >
> Again thanks for your comments.

Mr. Estridge, were I your attorney, and I thank my lucky stars that I am
not, I would suggest that you post a retraction immediately, and forward a
very polite letter of apology to ViaCrypt and perhaps Mr. Zimmerman.

Maybe they are too busy to sue you, report you to the better business
bureau, the FTC, or the state attorney general and the postmaster.

> >> Randy Estridge
> >> SafE Mail Corporation  

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From dsmith at prairienet.org  Tue Jun 18 21:11:54 1996
From: dsmith at prairienet.org (David E. Smith)
Date: Wed, 19 Jun 1996 12:11:54 +0800
Subject: Snake_Oil_punks was Re: SafE Mail Corporation
Message-ID: <199606182152.QAA04586@firefly.prairienet.org>


[Snake oil alert!]
 
>         PGP has the secret key in its public key!
> 
>         Found out that not only does this algorithm use 22 characters.  
>         The characters are the ones only found on the keyboard.
> 
>         SafeMail uses a proprietary Russian algorithm.
> 
> Not only is this company misquoting it's making up as it goes along. :)
> 
> 

Okay, then I hereby claim the secret key 1234567890qwertyuiop+- as
my public key.  Now, by running that through the SafeMail
Russian algorithm, I get "Nyet!"

Would somebody please give these chums a clue or two, or
mailbomb their sorry asses, or something?


dave




----- David E. Smith, dsmith at prairienet.org
PO Box 324 Cape Girardeau MO USA 63702-0324
http://www.prairienet.org/~dsmith/dave.html
"fighting ultimate cosmic evil...
           ... one bean burrito at a time."






From snow at smoke.suba.com  Tue Jun 18 21:15:15 1996
From: snow at smoke.suba.com (snow)
Date: Wed, 19 Jun 1996 12:15:15 +0800
Subject: Applied Cryptography - used copy?
In-Reply-To: <Pine.LNX.3.91.960618113856.32248D-100000@user1.scranton.com>
Message-ID: <Pine.LNX.3.93.960618160657.1635A-100000@smoke.suba.com>


On Tue, 18 Jun 1996, Moroni wrote:

>       Hi,
>           Didn't I read that with the new Applied Cryptography there was a 
> diskette or cd included that had all the programs on it? I noticed a copy 
> at the B Dalton and when I looked at it it contained no cd or diskette. 
> Was the aforementioned new edition with disk/cd a limited edition 
> available through the mail only?

	I just purchased Applied Cryptography yesterday, and it included
no disk. There was mention of a disk, and the author noted that the disk
couldn't be shipped overseas due to ITAR restrictions, so I assumed that
the disk wasn't included so that the book could be shipped overseas with
out difficulty.  

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From vznuri at netcom.com  Tue Jun 18 21:26:22 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Wed, 19 Jun 1996 12:26:22 +0800
Subject: example: microcurrency & music
In-Reply-To: <199606180545.BAA03098@unix.asb.com>
Message-ID: <199606182042.NAA01101@netcom6.netcom.com>



Mr. Deranged Mutant nicely expands on the royalty system for
musicians via radio I was alluding to. I'm glad a person with
firsthand knowledge of this can speak on it, because I think
in the future, people may look back on the radio royalty
system as one of the first examples of a microcurrency-like
system supporting intellectual property without a lot of
laws or roving cyber policemen protecting copyrights.

it seems to me many believe that you can only make money
on intellectual property if copyright laws are strengthened
and enforced with an iron fist. I tend to suspect however
that people are generally willing to support intellectual
property. what is definitely true is that you are going
to have scofflaws and pirates that try to cheat the system--
but you will have those even with laws. as long as there
is enough revenue to support some industry, I don't think
one can really make a good case for creating draconian
restrictions such as the whitehouse or some other congressional
committees/ studies are currently proposing for copyright law.

>> a technology that has evolved by which radio stations pay music
>> companies whenever they play artists songs. (if any cpunks could
>> elaborate on this system, I think it is an excellent preliminary
>> example of how a microcurrency-like system would interact with
>> a copyright situation). 
>
>Excellent example? I dunno. At the non-commercial station I work, 
>once a year or every other year ASCAP or BMI, for a two week period, 
>wants our playlists... not the usual playlists, but detailed ones 
>which even the most anal-retentive people hate to fill out: the 
>performer, the song writer (not always the same), album and song 
>titles, record label, and if music is ASCAP, BMI, etc.  Includes not 
>only songs but them music, background music, etc.

ok, so the form that it takes involves a lot of paper work for you.
I was under the impression that commercial stations had it all 
automated, is this not correct? so what effectively happens is that
they play whatever they want, and the billing system will take
care of the correct allocations. it seems to me a playlist ought
to be computerized anyway, eh? are you suggesting your radio station
is doing it all by hand?  wouldn't this generally be the exception?

>I don't remember the rates, but non-commercial stations pay a lower rate than 
>commercial ones.  Royalties are supposedly divied out to songwriters 
>(and performers?) or record companies based on how much airplay they 
>received, which I guess is averaged out for the whole year.  I don't 
>know if they survey all radio stations around the same time or space 
>it out for different areas and different stations throughout the 
>year.

what you are seeing is record companies tailoring the price of their
"product" to different markets. now imagine that all of the above could
be replaced by a system whereby individual artists release their
recordings digitally and totally bypass the media industry bureacracy.
it's enough to give a gluttonous mogul massive nightmares <g>. I believe
such a thing will be happening in the near future. 

imagine radio stations that run over web pages-- I mean, literally, anyone 
could create their own playlists, programming, and radio stations in the
exact way that people select arbitrary material to put on their
web pages today. imagine software written to pick
different music. imagine a microcurrency system that pays the 
songwriters & musicians automatically when songs are played anywhere
in cyberspace. these are the kinds of ideas that microcurrency makes
possible to anyone with a smidgeon of imagination.

>  Touch luck for artists who get some airplay but not enough to 
>make it on the lists, of course.

theoretically the lists record exactly what radio stations play.
an automated system is possible in which there is no fudge factor
due to reporting discrepancies. furthermore keep in mind that even
if these low-played artists got on the lists, they may not
make enough money to make it worth putting them there. remember
the playlists are used to measure the number of times songs are
played and pay out accordingly, isn't that correct?

>Digital area: possibility that people will feel because it's 
>computerized, EVERYTHING can be kept track of.    This is 
>problematic, aside from privacy reasons, because the big royalty 
>makers get less and the smaller people get more. 

sorry, again I feel that privacy is a term that is often misused
as I have been pointing out in another thread. how is it a violation
of privacy if a system keeps track of exactly how often songs are played,
for the purposes of compensation? what you are alluding to is the
fudge factor that is involved in reporting. sorry, I think you are
abusing the term "privacy" if you are using it to apply to 
situations involving minor duplicities such as false reporting. however
this would be a classic cpunk dogma, such as in conflating the idea
of tax evasion or identity subterfuges with "privacy"..

 Parallel with 
>experiemtal Nielson-ratings tech... a special cable box that did the 
>monitoring for you, and even had an electronic eye that could tell if 
>anyone was in the room, or if they were sleeping or reading the paper 
>rather than watching...

but this is not analogous at all.  imagine that the system knows
how often a song is played, but doesn't keep track of who played
it. such a system is straightforward to implement in cyberspace.
another example of how I have been suggesting that information
collection (related to billinj) and privacy are not always in conflict.
and frankly I'm annoyed at how easily people are mixing up these
clearly distinct ideas.

 apparently every station got much lower 
>ratings than when people generously filled out booklets, so the 
>stations threatened to set up an alternate system, so I don't know if 
>that system was adopted.

oh, so a theoretically more accurate system gave different results, so 
therefore the more accurate system is BAD? classic "status quo" logic.
the market ultimately will not support this argument more than a 
temporary amount of time. a given company with a monopoly on ratings
collection can only enforce their ideas as long as they have a 
monopoly. if someone else comes out with a better rating system
that gives different results, the market will still tend to 
gravitate toward it. not necessarily immediately.

>I'm curious as to how royalities are divied up from the cassette tax, 
>since everyone with blank casssettes is, of course, violating 
>copyrights according to some logic.

are you saying there is now a tax on blank cassettes? I wasn't aware
of that.

>Will people want royalities for reselling?  There was a flack a few 
>years ago from some big record distributors over used CD sales.  They 
>refused to supply some of the big chains if they continued to sell 
>used CDs without giving them a cut.

I know, big media conglomerates are always ranting at congress etc.
the DAT tape stuff is a good example. I suspect the media 
dinosaurs don't have the slightest whiff of a clue about what
the future is going to entail. as J.G. once said of the media
merger mongering, "rearranging the deck chairs on the titanic".
its funny how much big bureacracies begin to look like the government,
no matter what side of the coin, public or private. the incident
you refer to reminds me of the ingenuity that government bureacrats
look for ways to tax novel changes in the economy.

in their current form of massive scrape-off for promoting
the bureacracy (listen to Pink Floyd's song on the subject, "which 
one of you is pink?") media conglomerates are doomed to extinction in the 
very near future-- the day that microcurrency becomes feasible.
it will tend to become a sellers' market, where the sellers are
artists. of course none of this is even remotely conceivable
by today's standards. that's why it's entirely correct. <g>







From don at wero.cs.byu.edu  Tue Jun 18 23:00:28 1996
From: don at wero.cs.byu.edu (Don)
Date: Wed, 19 Jun 1996 14:00:28 +0800
Subject: FYA: SafE Mail Corporation
In-Reply-To: <01BB5C9B.68A2B300@geeman.vip.best.com>
Message-ID: <m2n320aoy9.fsf@wero.cs.byu.edu>


geeman at BEST.COM ("geeman at best.com") writes:

> 
>                    |  SafE Mail(TM)              |   RSA  (RC4+MD5)
> -------------------+-----------------------------+--------------------

>  Best Attack       | No known way                | Statistical

Hmm, I suppose "Captain Crunch Decoder Ring" doesn't count as a "known way".

Incidently, I read this through nntp.hks.net, which has 75 messages available.
It's been a long time since hks was serving cpunks, I hope this means they're
back up.

Don
-- 
<don at cs.byu.edu> http://students.cs.byu.edu/~don  PGP 0x994B8F39  fRee cRyPTo!
  "It is not worth an intelligent man's time to be in the majority.  By 
  definition, there are already enough people to do that." - G. H. Hardy
** This user insured by the Smith, Wesson, & Zimmermann insurance company **





From AwakenToMe at aol.com  Wed Jun 19 00:40:56 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Wed, 19 Jun 1996 15:40:56 +0800
Subject: SafE Mail Corporation
Message-ID: <960618175621_137771316@emout16.mail.aol.com>


In a message dated 96-06-18 02:34:54 EDT, sandfort at crl.com (Sandy Sandfort)
writes:

<< C'punks,
 
 At 05:21 PM 6/17/96 -0400, M.Wagoner (1) wrote:
 >
 >We would like someone to be able or should I say try and 
 >crack our encryption. IT IS IMPOSSIBLE.
 
 >Our Web site is http://www.sfmc.com  Phone number is 
 >1-800-252-9938.
 
 So I pulled up the Web site to see what sort of reward they
 offered to the successful cracker.  Under the heading 
 "Attention `Hackers'" they said if you crack their 
 unbreakable SafE Mail code, you get 5 free copies of ...
 SafE Mail!  Oh, that's a really primo prize, broken 
 software.  Duh.
 
 Since cracking their encryption is IMPOSSIBLE, I suggest 
 they make the stakes interesting--$100,000, or hell, a cool
 million.  After all, it's unbreakable.  It's not like they
 will have to pay up or anything.
 
 
  S a n d y
  >>
Very good point. Hell I have a book that offers $1,000 to crack a little
string.
How much does everyone here actually talk about the techniques of
decryption?? Is is something any of you are well versed at and would welcome
any questions to?
Thanks.....
                Adam





From hfinney at shell.portal.com  Wed Jun 19 02:10:40 1996
From: hfinney at shell.portal.com (Hal)
Date: Wed, 19 Jun 1996 17:10:40 +0800
Subject: Recipients get the postage
Message-ID: <199606190005.RAA18148@jobe.shell.portal.com>


-----BEGIN PGP SIGNED MESSAGE-----

I was reading old threads on remailers, where various ideas were
suggested to reduce abuse.  One was to charge postage, in order to
discourage spam and somewhat discourage nastygrams, as well as to
compensate the remailer operator for his risks.  A variant was to tell
the recipient that he had anonymous mail waiting, and possibly charge him
to receive it.

I had a different idea, which has probably been suggested before: make
the sender of the anonymous mail pay, but pass the money to the
recipient.

All my complaints come from people who have received mail, never from
people who have sent it.  So obviously the steps we take need to make
recipients happier.  Paying them is one way to do it.

Of course there are lots of details: how much should be charged, will
recipients really be so thrilled when a "fuck you" note has a nickel
wrapped in it, how will they cash their checks, etc.  If ecash
were used this might be a motivation for people to open an account.

Nym servers could be funded by the nym owners to pay for a certain number
of messages.  Since the nym owner ends up receiving the cash it doesn't
actually cost him anything and he can easily afford to keep a pool of
cash in the nym server to keep the messages coming through.

Remailers which wanted to apply this rule would have to deposit the money
and immediately withdraw the same amount to include in the outgoing mail.
Users would basically have to trust the remailers to do this honestly.
Maybe it only needs to be done when the mail goes to a non-remail end
user destination, not for the intermediate links in the chain.

Postings to newgroups and mailing lists would make the cash available to
the first one who grabs it.  It can be a fun game; we've done it here
occasionally.  This might also motivate people to sign up for ecash.

Just a thought -

Hal

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQBVAwUBMcdENBnMLJtOy9MBAQFbpAH+NCq3HMN4+ar6UVWBFxvhAQ2OCu+EehX7
CgnLButTRJEM4OdOEsBaLzYBdi5bk0acelSpE/Zqj1S46bD2UQt50w==
=2NAN
-----END PGP SIGNATURE-----





From jimbell at pacifier.com  Wed Jun 19 02:55:13 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 19 Jun 1996 17:55:13 +0800
Subject: Digital Cash application
Message-ID: <199606190339.UAA07400@mail.pacifier.com>


In 1996, the Libertarian Party will apparently qualify for Federal matching 
funds for its Presidential political campaign.  That does not mean that it 
will _accept_ them, being stolen goods.  However, a few years ago I heard of 
an idea that they should accept the money, and return it to the people, a 
small amount at a time, to whomever asks for it.  Besides returning the 
stolen money to its rightful owners, that would produce substantial positive 
publicity for the Libertarian party, embarrassment for the Democrats and 
Republicans, while at the same time reducing the amount of money available 
for the D's and the R's.


But there's been a practical question of how to actively do this, 
economically.  Issuing checks and mailing them costs money, and they're 
traceable, etc.    The advent of digital cash suggests an answer: Make the 
payments in the form of digital cash, payable on the Web.  This will 
encourage the use of digital cash, and provide a sudden infusion that will 
promote other uses.  There's another advantage, however.  Since "Netizens" 
are somewhat biased towards libertarianism, this will have the effect of 
keeping more of this money "in the family" as it were, while at the same 
time being open, technically, to everyone who can get on the 'net. 


Jim Bell
jimbell at pacifier.com





From harka at nycmetro.com  Wed Jun 19 03:46:44 1996
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Wed, 19 Jun 1996 18:46:44 +0800
Subject: Federal key registrat
Message-ID: <TCPSMTP.16.6.18.-13.50.54.2780269260.1176890@nycmetro.com>


 -=> Quoting In:jimbell at pacifier.com to Harka <=-
 
 > "Some of our
 >most important prosecutions have depended on wire taps."

 In> But is the average citizen substantially impacted by crimes that would
 In> be  assisted by good encryption?  Probably not.  
 
 And how about: "Would not the average citizen be assisted by good encryption to NOT be impacted by (certain) crimes?"
 And from that perspective, shouldn't the protection of millions of "average" citizens have much more importance than the "unprotection" (i.e. Clipper) of a few godfathers, who _might_ use e-mail and who _might_ use crypto?
 
 
 >Reno told the group that effectively regulating electronic encryption will
 >depend on finding a balance between protecting privacy interests while
 >stopping criminals from cashing in on the new technology.

 In> I see no need for a "balance."  I think that the advent of good
 In> encryption  has the effect of increasing the security of individuals.
 
 
 Absolutely. As somebody a few days ago already mentioned in connection with the CDA, the gov.'s have enjoyed a lot of centralized power so far. A medium like the Net is the antithesis to that kind of centralization. Now all over the world gov.'s try to
 hold on to the "old" way, which _only_ works if things are regulated, censored, outlawed etc.. That is what ensures the survival of centralized and hierarchical structures.
 But they are failing to realize, that people's conciousness changes _away_ from such limiting ways towards more open and natural relationships. The Net is maybe the (currently) most important medium in that process and will be hopefully the last nail in 
 the coffin of governments, as we know 'em.


 Harka

... "If cryptography is outlawed, no outlaw will use clipper" -:)
___ Blue Wave/386 v2.30 [NR]







From cwe at it.kth.se  Wed Jun 19 04:35:40 1996
From: cwe at it.kth.se (Christian Wettergren)
Date: Wed, 19 Jun 1996 19:35:40 +0800
Subject: Fuseable Links - no guarantees??
In-Reply-To: <adeb915b01021004b1a6@[205.199.118.202]>
Message-ID: <199606190641.IAA10766@piraya.electrum.kth.se>



| >I recently saw an add for a UK based group that says they can take a PIC
| >OTP micro and read the prom (for a fee, of course) - How the heck is this
| >done??

According to the FAQ for satellite piracy, whatever that is called, it is
quite simple for some models of PICs. 

Many of the OTP PICs have a wipe mode for reusal. Apply a certain voltage,
the programming voltage, and the memory is wiped and a fuse is restored so
the memory is programmable again.

Approx a year ago some people on this scene discovered that one could restore
the fuse without erasing the memory content. They applied the programming
voltage minus 0.5V (or something similar). The idea is that there is a voltage
drop across the fuse, and this modified voltage level just barely "manages
it" across the fuse. The voltage level is however not enough to spark the
memory erasure mechanism off.

So I guess one can look at the circuitry and apply non-standard voltage and
current values, or even non-standard timing values -- and do bad things
to these circuits. So this begs the question: Is there anyone who has looked
at "computer security" issues at this level? Is this just bad implementations
of these circuits or are there a fundamentally hard problem in this?

(I'd guess you'll find the FAQ if you search for the words "satellite piracy
PIC OTP" on Alta Vista.)

-Christian





From norm at netcom.com  Wed Jun 19 04:48:38 1996
From: norm at netcom.com (Norman Hardy)
Date: Wed, 19 Jun 1996 19:48:38 +0800
Subject: Class III InfoWar: TST Article
Message-ID: <aded506700021004a6bc@DialupEudora>


At 7:15 AM 6/18/96, Moroni wrote:
>    What are the effects of an EMP on the persons releasing the bomb
>,those in te vacinity and what is the distance that the bomb has a
>physical effect on people. Also ,is there any knowledge of reusable EMP
>bombs yet?
>                              TIA
....
Interesting idea. I have no idea about impact on humans.
The capacitor connected to some wierd shape antenna all assembled in
a vacuume to muffle the sound upon discharge would probably be
reusable. It also probably provides only a fraction of the energy of
a high explosive version.







From stewarts at ix.netcom.com  Wed Jun 19 04:53:36 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 19 Jun 1996 19:53:36 +0800
Subject: Federal key registration agency [NOISE]
Message-ID: <199606190619.XAA07277@toad.com>


At 10:20 AM 6/18/96 -0500, you wrote:
>> Compuserve Online Today Daily Edition, 15 June 1996:
>> 
>> Attorney General Janet Reno ... said her plan would require people to
>> register with the new agency the secret codes -- or "keys" -- they use 
>> to encrypt messages online.
>
>This would be the "Bad Cop" line, for those playing along at home.

Problem is, she's the one playing Good Cop. :-)


#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From nobody at c2.org  Wed Jun 19 06:04:50 1996
From: nobody at c2.org (Anonymous User)
Date: Wed, 19 Jun 1996 21:04:50 +0800
Subject: Federal key registration agency
Message-ID: <199606190505.WAA12079@infinity.c2.org>


>Compuserve Online Today Daily Edition, 15 June 1996:
>
>Speaking to the Commonwealth Club of California in San Francisco, Reno said
>her plan would require people to register with the new agency the secret
>codes -- or "keys" -- they use to encrypt messages online.
>
>Reporting on this speech, Sandra Ann Harris of United Press International
>adds, "Federal authorities could then obtain the information they need to
>decipher the encryptions using a court order and secretly monitor electronic
>communication on the Internet the same way wiretaps are used to monitor
>telephone conversations of suspected criminals."

   Consider the logic of this statement.  If some *criminal* has registered his/her secret key with the government, then why the hell would s/he then encrypt an incrimating message knowing the government could crack it?!
   Great plan, Janet.....


Medea








From stewarts at ix.netcom.com  Wed Jun 19 06:25:54 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 19 Jun 1996 21:25:54 +0800
Subject: Applied Cryptography disks / EMP noise.
Message-ID: <199606190619.XAA07271@toad.com>


At 11:43 AM 6/18/96 -0400, you wrote:
>      Hi,
>          Didn't I read that with the new Applied Cryptography there was a 
>diskette or cd included that had all the programs on it? I noticed a copy 
>at the B Dalton and when I looked at it it contained no cd or diskette. 
>Was the aforementioned new edition with disk/cd a limited edition 
>available through the mail only?

If you look at the inside back cover of the book you'll find
instructions for ordering the diskette, just as there were with
Edition 1.  Distributing the diskette with the book was too much trouble for
the publisher, given the ITAR issues.  The disks that Phil Karn applied
for export permission for had just the code from the book typed in,
and not any other material that may have been on the official disks,
but they still denied it.

As far as EMP goes, there are three interesting kinds of EMP generators
1) Nuclear weapons, detonated at high altitude to get wide spread
        EMP effects.  The folks who drop such things generally
        clear out of the territory very fast before the explosion.
2) Mythical portable devices for attacking computer facilities -
        the folks who set off these don't exist, so they don't
        need to worry about the effects.
3) Very large capacitor/inductor banks at defense contractors like 
        Harry Diamond Labs in New Mexico, which are used to test
        electronic equipment (up to airplane size) for EMP-resistance.  
        They're supposedly quite impressive structures (the buildings 
        used for the equipment under test are all wood) and the folks
        who run them are careful about lots of things when using them.

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From nobody at flame.alias.net  Wed Jun 19 07:00:54 1996
From: nobody at flame.alias.net (Anonymous)
Date: Wed, 19 Jun 1996 22:00:54 +0800
Subject: This might be interesting...
Message-ID: <199606190745.JAA21883@basement.replay.com>


Do an AltaVista Query on:

	url:bmh.com crypto*







From um at c2.org  Wed Jun 19 07:58:37 1996
From: um at c2.org (Ulf Moeller)
Date: Wed, 19 Jun 1996 22:58:37 +0800
Subject: German Federal Bank opposes e-cash
Message-ID: <m0uWKRm-0000B2C@ulf.mali.sub.org>


[What follows is my translation of a Reuters news item as seen on a
mailing list.]

"Risks with computer money"

Frankfurt - the Federal Bank has once more warned against security risks
with computer money. There is the danger that "Cyber-Money" stored in
computers be counterfeited, said Directory Board member Edgar Meister
at a conference in Schwaebisch-Hall. In addition there were the danger
of money laundry, because the computer money could be wired across
borders without problems. Meister announced that, if necessary, the EU
Central Banks would take counter-measures, should computer money and
re-loadable payment cards endanger the monetary policy. (rtr/18.6.96)





From perry at piermont.com  Wed Jun 19 16:42:54 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 20 Jun 1996 07:42:54 +0800
Subject: SafE Mail Corporation
In-Reply-To: <Pine.SUN.3.93.960618154407.20055A-100000@polaris>
Message-ID: <199606191542.LAA25691@jekyll.piermont.com>



Black Unicorn writes:
> Calling a given cypher "uncrackable" is simple fiction or ignorance.

I will point out for the benefit of all that technically there is one
cipher that is unbreakable if it is properly implemented -- the one
time pad. However, Black Unicorn's point is generally correct --
information theory dictates that any system other than a one time pad
can in theory be broken by brute force once you have ciphertext longer
than the unicity distance, which is typically quite short. Unicity
distance depends only on the redundancy of the language and the key
length in bits (well, technically, the base two log of the number
possible keys, but they are usually the same for conventional
cryptosystems -- it would make a difference for stuff like RSA but
since no one ever really cares about the unicity distance in practice
since that sort of brute force search is uninteresting...)

Perry





From geeman at best.com  Wed Jun 19 16:57:05 1996
From: geeman at best.com (geeman at best.com)
Date: Thu, 20 Jun 1996 07:57:05 +0800
Subject: Fuseable Links - no guarantees??
Message-ID: <01BB5DC1.392DE140@geeman.vip.best.com>




----------
From: 	Christian Wettergren[SMTP:cwe at it.kth.se]
Sent: 	Tuesday, June 18, 1996 11:40 PM
To: 	Timothy C. May
Cc: 	cypherpunks at toad.com
Subject: 	Re: Fuseable Links - no guarantees?? 


So I guess one can look at the circuitry and apply non-standard voltage and
current values, or even non-standard timing values -- and do bad things
to these circuits. So this begs the question: Is there anyone who has looked
at "computer security" issues at this level? 

>>> Of course, many have.






From reagle at MIT.EDU  Wed Jun 19 17:27:57 1996
From: reagle at MIT.EDU (Joseph M. Reagle Jr.)
Date: Thu, 20 Jun 1996 08:27:57 +0800
Subject: Safemail
Message-ID: <9606191626.AA24637@rpcp.mit.edu>


At 04:19 PM 6/18/96 -0400, you wrote:

>        SafeMail uses a proprietary Russian algorithm.

        Maybe it is GOST. Schneir covers it, and there is a white paper on
it at the b_crypt site.
_______________________
Regards,            Democracy is where you can say what you think 
                    even if you don't think. -
Joseph  Reagle      http://rpcp.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From iang at cs.berkeley.edu  Wed Jun 19 17:55:04 1996
From: iang at cs.berkeley.edu (Ian Goldberg)
Date: Thu, 20 Jun 1996 08:55:04 +0800
Subject: Digital Cash application
In-Reply-To: <199606190339.UAA07400@mail.pacifier.com>
Message-ID: <4q9cag$lld@abraham.cs.berkeley.edu>


-----BEGIN PGP SIGNED MESSAGE-----

In article <199606190339.UAA07400 at mail.pacifier.com>,
jim bell  <jimbell at pacifier.com> wrote:
>But there's been a practical question of how to actively do this, 
>economically.  Issuing checks and mailing them costs money, and they're 
>traceable, etc.    The advent of digital cash suggests an answer: Make the 
>payments in the form of digital cash, payable on the Web.  This will 
>encourage the use of digital cash, and provide a sudden infusion that will 
>promote other uses.  There's another advantage, however.  Since "Netizens" 
>are somewhat biased towards libertarianism, this will have the effect of 
>keeping more of this money "in the family" as it were, while at the same 
>time being open, technically, to everyone who can get on the 'net. 

Well, this has been around for quite a while:

http://www.SkylineMall.com/lpva/donate.html

(it's the Libertarian Party of Virginia; they accept ecash and First Virtual).

   - Ian

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcg0e0ZRiTErSPb1AQFuawQAgmMtM9UK9/X6Yw3mA7I0emxCTBbcetiK
bG6e9U7BCGlXI/FYC7cu0Jcj0DoGM+lRlF84nzhKBsUqL1A1lKYSIEULLxNab5nc
rU/jlYQ5+PalsbO0NdkIugahg1iw6bSjto3xlbWfaoP78QldzDQ+3KoR4+DSxExc
K4fyQMq0zJM=
=lLyl
-----END PGP SIGNATURE-----





From hua at XENON.chromatic.com  Wed Jun 19 18:06:12 1996
From: hua at XENON.chromatic.com (Ernest Hua)
Date: Thu, 20 Jun 1996 09:06:12 +0800
Subject: You bet they have/are: NSA/CIA to snoop INSIDE the U.S.???
In-Reply-To: <Pine.SUN.3.93.960618020945.20947B-100000@polaris>
Message-ID: <199606191725.KAA26806@server1.chromatic.com>



> > It is clear that if the FBI/CIA/NSA/ATF/DoS intercepts a message with
> > some very important content, like, say, I (Ernest Hua) was plotting to
> > kill Hillary, then they can use that information to start investigating
> > my activities, even if the intercept turned out to be illegal.  Those
> > who saw the content of this intercept is not required by law to "forget"
> > that they ever saw it.
> 
> If they intend to prosecute in a U.S. court they are.
>
> Which crowd of lawyers was this?  Must have been after open bar.

An US DoJ attorney, but that may not say much.

> Look it up, the doctrine is called "fruit of the poisonous tree."

We discussed this doctine, but it was pointed out to me that as long
as they can come up with some plausible alternative reason for having
the information related to the intercept (say, they were bugging some
suspicious neighbor and "accidentally" tap the wrong phone line) then
I would never find out that the real intercept ever took place.

By law, technically, the phone company/tapping party would have to
let me know that I had been tapped in 30 days.  In practice, I wonder.

> That evidence will have to survive a hearing on exclusion.  Highly
> unlikely if you were accidently overheard.

Yes.  We discussed this part too.

Ern







From hua at XENON.chromatic.com  Wed Jun 19 18:07:44 1996
From: hua at XENON.chromatic.com (Ernest Hua)
Date: Thu, 20 Jun 1996 09:07:44 +0800
Subject: Source Laundering <was: You bet they have/are: NSA/CIA to snoop INSIDE the U.S.???>
In-Reply-To: <v02140b01adec77b9e9ea@[206.243.160.205]>
Message-ID: <199606191734.KAA26918@server1.chromatic.com>



This would be most cool.  In fact, cypherpunks should patent it,
and reap licensing fees from government/military use (keeping it
free for civilian use).

Ern

>         A thought:  Being pessimistic lately, and assuming our elected US
> pols continue their subservience to the spy agencies, I have a question.
> How difficult would be it to concoct a encryption-based scheme which would
> hold escrow keys in some sort of serialized time-sensitive one-way account
> -- a device that would make it all but impossible to get a key out of the
> account without leaving a permanent record that it was retrieved.  How many
> were retrieved?  When? By whom?
>
>         Is there such a scheme?  How does/could it work?
>
>         In defending privacy,  Accountability is a very powerful weapon.
> (Remember those FBI reports of 7-11 wiretaps?) I'd love to see such a
> tamperproof recording device imposed upon the FBI's access to its new
> Master Wiretap circuits, for example -- with a legislatively-mandated
> revelation of the unforgable results,  something comparable to the current
> law in criminal cases, and maybe with some 5-year sunshine provison for
> national security cases.
>
>         Such a scheme might be all we can get if this Administration or a
> future one gets a version of Clipper mandated.
> 
>         Cynics like many of you on this list may not realize how
> desperately these guys want to keep to the shadows.  Bright Lights and
> Accountability ought to be a Cypherpunk Goal -- even when the tide is
> running against us.  A well-documented tamperproof accounting scheme to
> document the use of these intrusive powers could result in a potentially
> powerful piece of legislation.







From declan at well.com  Wed Jun 19 18:11:02 1996
From: declan at well.com (Declan McCullagh)
Date: Thu, 20 Jun 1996 09:11:02 +0800
Subject: Oil Change software snoops through hard drive
Message-ID: <v01510115adedec5bd37a@[204.62.128.229]>


Alan forwarded this to me. Thought it might be interesting. -Declan

-------------------------------
Heads up: Privacy & Continuous Access Ks implicated by new software

This press release for a new product - a software agent - has
implications for privacy and continuing access issues, because it works
by scanning user's hard disks and automatically providing software
updates.
Unanswered Qs:
1) What other kinds of info does/can it troll for?
2) What does it do when it finds unregistered software?
3) Does it implicate ECPA?
4) Will updates be available through other means?
5) Must a user affirmatively grant permission to the software agent?
6) Can a user decline or limit the agent's access?
7) What uses may the agent's owner make of data collected?
etc.

Alan L
---
press release:

*** "Digital Oil Change"

CyberMedia announced today at PC Expo that it plans to automatically
"service"
personal computer software via the Net with a newly unveiled product
called
Oil Change. The company reports that Oil Change automatically replaces
outdated, bug-ridden software and hardware drivers with clean updates.
CyberMedia says the product is designed to use the Net to find, download,
and
install updates to Microsoft Windows 95 software applications and
drivers. Oil
Change reportedly tracks all currently installed versions and revisions
of all
Windows 95 software and hardware drivers on a PC, and then dials into
CyberMedia's Internet Web Server for related updates. Users in need of an
update are alerted by Oil Change with a description of what the update
will
do, and then the product finds the update on a software manufacturer's
Web
site, downloads, and installs it. Beginning today, CyberMedia says it
will
offer a free beta version of Oil Change for a limited time at its Web
site.







From perry at piermont.com  Wed Jun 19 18:17:14 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 20 Jun 1996 09:17:14 +0800
Subject: The IESG: Protocol Action: MIME Security with Pretty Good Privacy (PGP) to Proposed Standard
Message-ID: <199606191746.NAA25894@jekyll.piermont.com>



------- Forwarded Message

To: IETF-Announce:;
Cc: RFC Editor <rfc-editor at isi.edu>
Cc: Internet Architecture Board <iab at isi.edu>
From: The IESG <iesg-secretary at CNRI.Reston.VA.US>
Subject: Protocol Action: MIME Security with Pretty Good Privacy (PGP) to
	 Proposed Standard
Date: Wed, 19 Jun 96 11:06:28 -0400
Message-ID:  <9606191106.aa22287 at IETF.CNRI.Reston.VA.US>



  The IESG has approved the Internet-Draft "MIME Security with Pretty
  Good Privacy (PGP)" <draft-elkins-pem-pgp-04.txt> as a Proposed
  Standard. This has been reviewed in the IETF but is not the product
  of an IETF Working Group.

  The IESG contact persons are Harald Alvestrand, Keith Moore, and Jeff
  Schiller.

Technical Summary

  This document describes how Pretty Good Privacy (PGP) can be used to
  provide privacy and authentication using the Multipurpose Internet
  Mail Extensions (MIME) security content types described in RFC1847.

Working Group Summary

  This document was not the product of an IETF working group but was
  reviewed via a 4 week IETF wide last call. The last call failed to
  raise any significant issues.

Protocol Quality

  This document was reviewed for the IESG by Jeffrey I. Schiller. The
  protocol provides for an elegant way of encapsulating PGP objects
  within a MIME framework by making use of Security Multiparts for MIME
  (RFC1847). This  permits a MIME aware user agent to read  and process
  PGP  signed and/or encrypted messages, yet it provides sufficient
  backwards compatibility for users with non-MIME aware mail user
  agents to make use of PGP directly to manually process messages
  prepared with this protocol.




------- End of Forwarded Message






From harka at nycmetro.com  Wed Jun 19 18:33:25 1996
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Thu, 20 Jun 1996 09:33:25 +0800
Subject: Federal key registrat
Message-ID: <TCPSMTP.16.6.19.14.18.54.2780269260.1177549@nycmetro.com>


 -=> Quoting In:nobody at c2.org to Harka <=-
 
 >Speaking to the Commonwealth Club of California in San Francisco, Reno said
 >her plan would require people to register with the new agency the secret
 >codes -- or "keys" -- they use to encrypt messages online.
 

My keys? Sure Janet, no problem. 
pgp -kg (80000 times)
Now can I email the hundred meg to you?

:)

Harka
___ Blue Wave/386 v2.30 [NR]







From iang at cs.berkeley.edu  Wed Jun 19 18:35:39 1996
From: iang at cs.berkeley.edu (Ian Goldberg)
Date: Thu, 20 Jun 1996 09:35:39 +0800
Subject: German Federal Bank opposes e-cash
In-Reply-To: <m0uWKRm-0000B2C@ulf.mali.sub.org>
Message-ID: <4q9cqs$ln7@abraham.cs.berkeley.edu>


-----BEGIN PGP SIGNED MESSAGE-----

In article <m0uWKRm-0000B2C at ulf.mali.sub.org>, Ulf Moeller <um at c2.org> wrote:
>[What follows is my translation of a Reuters news item as seen on a
>mailing list.]
>
>"Risks with computer money"
>
>Frankfurt - the Federal Bank has once more warned against security risks
>with computer money. There is the danger that "Cyber-Money" stored in
>computers be counterfeited, said Directory Board member Edgar Meister
>at a conference in Schwaebisch-Hall. In addition there were the danger
>of money laundry, because the computer money could be wired across
>borders without problems. Meister announced that, if necessary, the EU
>Central Banks would take counter-measures, should computer money and
>re-loadable payment cards endanger the monetary policy. (rtr/18.6.96)

That's very interesting, especially considering Deutsche Bank has signed
on to be an ecash mint (http://www.digicash.com/publish/ec_pres5.html)...

I don't get this worry about counterfeiting.  It would seem to be harder to
counterfeit ecash than paper cash (though, admittedly, it would be harder to
track, but it would almost certainly have to be an "inside job").  Maybe
the journalists are just misinformed, or possibly the banking people?

   - Ian

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcg2lEZRiTErSPb1AQHq3gQAtpd9y56lCh1IZT/PErb19LAvgmMwu9G2
PAe7OZdW/e342zRhDbua8hPYCFRnlqEKXjRchsUifn+Nv9ZYp8p8at0CRQdi6PVD
KIEhAv+j4Dhd4KRe4GIAVTfNZKsdBfxrjvm79zNi7se0aYjt6SD612OPzdrVor1n
iNnwMtWUWdM=
=TgGg
-----END PGP SIGNATURE-----





From declan at well.com  Wed Jun 19 18:42:33 1996
From: declan at well.com (Declan McCullagh)
Date: Thu, 20 Jun 1996 09:42:33 +0800
Subject: Digital Cash application
Message-ID: <v01510116adedf36279ef@[204.62.128.229]>


Jim:

This is a nice idea, but it's not going to happen.

Yes, Harry Browne has raised enough money to qualify for matching funds
from the FEC. But he's unable to give out the cash or use it to pay down
the gvt debt since doing so could violate FEC regulations. The FEC is also
unwilling only to certify Browne for matching funds without giving it to
him -- he's got to take the money and spend it on campaign foo and nothing
else, says the government. Finally, once they give you cash you have to
meet a higher degree of scrutiny, which costs money in lawyers and
accountants.

Talk about bureaucracy.

At least this is what the party tells me. I'll be covering their
convention, which is in DC a few weeks from now.

-Declan


>In 1996, the Libertarian Party will apparently qualify for Federal matching
>funds for its Presidential political campaign.  That does not mean that it
>will _accept_ them, being stolen goods.  However, a few years ago I heard of
>an idea that they should accept the money, and return it to the people, a
>small amount at a time, to whomever asks for it.  Besides returning the
>stolen money to its rightful owners, that would produce substantial positive
>publicity for the Libertarian party, embarrassment for the Democrats and
>Republicans, while at the same time reducing the amount of money available
>for the D's and the R's.
>
>
>But there's been a practical question of how to actively do this,
>economically.  Issuing checks and mailing them costs money, and they're
>traceable, etc.    The advent of digital cash suggests an answer: Make the
>payments in the form of digital cash, payable on the Web.  This will
>encourage the use of digital cash, and provide a sudden infusion that will
>promote other uses.  There's another advantage, however.  Since "Netizens"
>are somewhat biased towards libertarianism, this will have the effect of
>keeping more of this money "in the family" as it were, while at the same
>time being open, technically, to everyone who can get on the 'net.
>
>
>Jim Bell
>jimbell at pacifier.com







From pcw at access.digex.net  Wed Jun 19 18:58:02 1996
From: pcw at access.digex.net (Peter Wayner)
Date: Thu, 20 Jun 1996 09:58:02 +0800
Subject: [Free Beer] Talk on "Can Secrets be Stopped?" at Comp Lit.
Message-ID: <199606191756.NAA11735@access5.digex.net>



After the talk tonight at Computer Literacy, I plan on buying a 
round or two of beers for cypherpunks. It's just a way of saying
"thank you" to the endless stream of information that the list
generates. I don't think I could have written the book without
the help of many on the list. 

The talk begins at Computer Literacy (2590 North First Street at
the corner of Trimble) at 6:30. It will cover some simple ways
to hide information (steganography) and it will be given at a 
very general level. The bookstore invited me to give the talk
to flog my book "Disappearing Cryptography." (For info about
the book, check out my web page http://access.digex.net/~pcw/pcwpage.html
)

The beer begins flowing at the Tide House after the talk and questions.
This is the Tide House at 65 North San Pedro at San Pedro Square
in downtown San Jose. They inform me that they offer validated
parking at some garage next door. 

The password for the evening will be "swordfish". I've gotten
to know some list members over the years via email and it would
be nice to meet you in person. 

For more information, call the bookstore at 408-435-5015. I would
also appreciate it if you could email me so I could get a preliminary
head count. Feel free to come at the last minute, but try and
send some notice.

-Peter Wayner





From declan at well.com  Wed Jun 19 19:06:11 1996
From: declan at well.com (Declan McCullagh)
Date: Thu, 20 Jun 1996 10:06:11 +0800
Subject: Digital Cash application
Message-ID: <v0151011cadee02de1d68@[204.62.128.229]>


Whether it's a good idea or not -- and I'm told that it could violate FEC
rules -- it's not going to happen.

A campaign spokesperson told me that "Harry refuses" to take the cash, period.

-Declan



>At 01:24 PM 6/19/96 -0500, Declan McCullagh wrote:
>>Jim:
>>
>>This is a nice idea, but it's not going to happen.
>>
>>Yes, Harry Browne has raised enough money to qualify for matching funds
>>from the FEC. But he's unable to give out the cash or use it to pay down
>>the gvt debt since doing so could violate FEC regulations. The FEC is also
>>unwilling only to certify Browne for matching funds without giving it to
>>him -- he's got to take the money and spend it on campaign foo and nothing
>>else, says the government. Finally, once they give you cash you have to
>>meet a higher degree of scrutiny, which costs money in lawyers and
>>accountants.
>>Talk about bureaucracy.
>>At least this is what the party tells me. I'll be covering their
>>convention, which is in DC a few weeks from now.
>
>It seems to me that since paying people funds that were stolen from them
>would produce good publicity, which by definition could be argued to be
>spending it on the campaign.  Sure, it's a non-traditional tactic, but that
>doesn't mean it's in violation of the campaign law.  They could also email
>along a set of libertarian literature, and the recipient would certify that
>he would promote the libertarian cause and work for the election of the
>candidate, etc, etc.
>
>As for "lawyers and accountants":  I'm sure there are enough
>libertarian-leaning lawyers and accountants around who would be willing to
>help out to make this project a net positive.  Remember, the publicity is
>the important thing.
>
>
>
>>
>>-Declan
>>
>>
>>>In 1996, the Libertarian Party will apparently qualify for Federal matching
>>>funds for its Presidential political campaign.  That does not mean that it
>>>will _accept_ them, being stolen goods.  However, a few years ago I heard of
>>>an idea that they should accept the money, and return it to the people, a
>>>small amount at a time, to whomever asks for it.  Besides returning the
>>>stolen money to its rightful owners, that would produce substantial positive
>>>publicity for the Libertarian party, embarrassment for the Democrats and
>>>Republicans, while at the same time reducing the amount of money available
>>>for the D's and the R's.
>>>
>>>
>>>But there's been a practical question of how to actively do this,
>>>economically.  Issuing checks and mailing them costs money, and they're
>>>traceable, etc.    The advent of digital cash suggests an answer: Make the
>>>payments in the form of digital cash, payable on the Web.  This will
>>>encourage the use of digital cash, and provide a sudden infusion that will
>>>promote other uses.  There's another advantage, however.  Since "Netizens"
>>>are somewhat biased towards libertarianism, this will have the effect of
>>>keeping more of this money "in the family" as it were, while at the same
>>>time being open, technically, to everyone who can get on the 'net.
>>>
>>>
>>>Jim Bell
>>>jimbell at pacifier.com
>>
>>
>>
>>
>Jim Bell
>jimbell at pacifier.com







From perry at piermont.com  Wed Jun 19 19:15:40 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 20 Jun 1996 10:15:40 +0800
Subject: German Federal Bank opposes e-cash
In-Reply-To: <4q9cqs$ln7@abraham.cs.berkeley.edu>
Message-ID: <199606191849.OAA26090@jekyll.piermont.com>



Ian Goldberg writes:
> I don't get this worry about counterfeiting.  It would seem to be harder to
> counterfeit ecash than paper cash (though, admittedly, it would be harder to
> track, but it would almost certainly have to be an "inside job").  Maybe
> the journalists are just misinformed, or possibly the banking people?

I think that the fear is that counterfeit E-Cash is much easier to
pass and much more "perfect", though I think that with proper controls
the system is indeed more secure than paper currency.

.pm





From jimbell at pacifier.com  Wed Jun 19 19:22:48 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 20 Jun 1996 10:22:48 +0800
Subject: Digital Cash application
Message-ID: <199606191813.LAA27918@mail.pacifier.com>


At 01:24 PM 6/19/96 -0500, Declan McCullagh wrote:
>Jim:
>
>This is a nice idea, but it's not going to happen.
>
>Yes, Harry Browne has raised enough money to qualify for matching funds
>from the FEC. But he's unable to give out the cash or use it to pay down
>the gvt debt since doing so could violate FEC regulations. The FEC is also
>unwilling only to certify Browne for matching funds without giving it to
>him -- he's got to take the money and spend it on campaign foo and nothing
>else, says the government. Finally, once they give you cash you have to
>meet a higher degree of scrutiny, which costs money in lawyers and
>accountants.
>Talk about bureaucracy.
>At least this is what the party tells me. I'll be covering their
>convention, which is in DC a few weeks from now.

It seems to me that since paying people funds that were stolen from them 
would produce good publicity, which by definition could be argued to be 
spending it on the campaign.  Sure, it's a non-traditional tactic, but that 
doesn't mean it's in violation of the campaign law.  They could also email 
along a set of libertarian literature, and the recipient would certify that 
he would promote the libertarian cause and work for the election of the 
candidate, etc, etc.

As for "lawyers and accountants":  I'm sure there are enough 
libertarian-leaning lawyers and accountants around who would be willing to 
help out to make this project a net positive.  Remember, the publicity is 
the important thing.



>
>-Declan
>
>
>>In 1996, the Libertarian Party will apparently qualify for Federal matching
>>funds for its Presidential political campaign.  That does not mean that it
>>will _accept_ them, being stolen goods.  However, a few years ago I heard of
>>an idea that they should accept the money, and return it to the people, a
>>small amount at a time, to whomever asks for it.  Besides returning the
>>stolen money to its rightful owners, that would produce substantial positive
>>publicity for the Libertarian party, embarrassment for the Democrats and
>>Republicans, while at the same time reducing the amount of money available
>>for the D's and the R's.
>>
>>
>>But there's been a practical question of how to actively do this,
>>economically.  Issuing checks and mailing them costs money, and they're
>>traceable, etc.    The advent of digital cash suggests an answer: Make the
>>payments in the form of digital cash, payable on the Web.  This will
>>encourage the use of digital cash, and provide a sudden infusion that will
>>promote other uses.  There's another advantage, however.  Since "Netizens"
>>are somewhat biased towards libertarianism, this will have the effect of
>>keeping more of this money "in the family" as it were, while at the same
>>time being open, technically, to everyone who can get on the 'net.
>>
>>
>>Jim Bell
>>jimbell at pacifier.com
>
>
>
>
Jim Bell
jimbell at pacifier.com





From se7en at dis.org  Wed Jun 19 19:47:10 1996
From: se7en at dis.org (se7en)
Date: Thu, 20 Jun 1996 10:47:10 +0800
Subject: MasterCard Seeks Revision in On-Line Bill
Message-ID: <Pine.BSI.3.91.960619122424.3783D-100000@kizmiaz.dis.org>




A MasterCard International official told a congressional committee 
Wednesday that encryption technology is "vital to the development and 
security" of a number of its products, including its smart card program.

Joel Lisker, MasterCard International senior vice president for security 
and risk management, testified in support of the "Promotion of Commerce 
On-Line an the Digital Era Act" bill.

But he urged that the legislation be amended to address security concerns 
arising from the resale and reexportation of encryption technology.

The bill, sponsored by Sen. Conrad Burns, R-Mont., would allow the 
unrestricted exportation of mass-market or public-domain encryption 
programs and permit the exportation of encryption technologies if similar 
programs are available outside the United States.

Encryption permits a message to be changed into a code that will keep 
information inaccessible to persons not authorized to have that information.

The bill would promote "cryptographic competition" by making it easier 
for U.S. companies to export encryption technology and remain competitive 
with foreign firms that can sell their products freely here, Mr. Lisker 
observed.

But Mr. Lisker urged that the bill be amended to increase the penalties 
for the rexportation and resale of this technology to questionable 
buyers, including criminals. "Modernizing the federal regulatory approach 
to encryption technology must be accomplished without weakening the 
ability of law enforcement agencies to pursue criminal activity," he 
testified.

Also submitting testimony at Wednesday's hearing before the Senate 
Subcommittee on science, technology, and space were representatives from 
Lotus, Netscape, Electronic Data Systems Corp., and America Online.


se7en






From se7en at dis.org  Wed Jun 19 20:03:33 1996
From: se7en at dis.org (se7en)
Date: Thu, 20 Jun 1996 11:03:33 +0800
Subject: Electronic Transaction Hardware Source
Message-ID: <Pine.BSI.3.91.960619131808.3920E-100000@kizmiaz.dis.org>




Hypercom, 2851 W. Kathleen Road, Pheonix, AZ 85023, Tel: (602) 866-5399 
Fax: (602) 866-5380, (800) 578-2436 is advertising the following:

ICR1 Smart Card Reader and T7E Terminal;
CS7GC Signature Capture PIN Pad;
S8 Secure PIN Pad;
T7P Credit/Debit Terminal with Integrated Printer;
T7PRA Cellular Terminal

Have phun boys!!


se7en






From droelke at rdxsunhost.aud.alcatel.com  Wed Jun 19 20:10:36 1996
From: droelke at rdxsunhost.aud.alcatel.com (Daniel R. Oelke)
Date: Thu, 20 Jun 1996 11:10:36 +0800
Subject: Safemail
Message-ID: <9606191910.AA11834@spirit.aud.alcatel.com>


> 
> >        SafeMail uses a proprietary Russian algorithm.
> 
>         Maybe it is GOST. Schneir covers it, and there is a white paper on
> it at the b_crypt site.
> 

I spoke with a fellow there for about 20 minutes today about their 
program.  Sounded like these guys are just front-ends and 
obviously know nothing about the technology.  (Couldn't
answer how many bits of the "22 character" key were in use)

He did assure me it wasn't GOST, or anything published.
Story was that a Russian emigrant (sp?) came over to the US 
and this is his algorithm.  Apparently this person is 
not willing (at this time) to put the algorithm out for
public review. 

I spent most of my time pushing for some sort of peer review.
Supposedly they have talked with Schneier and Denning, about
the method but neither has done more than talk with them 
briefly about the method.  (I understood from what 
he said that they weren't willing to pay Bruce what it
would take to do a through review. ;-)

I also spent some time educating them about PGP
and how it does do compression, ASCII armour, etc.

All in all they guy was plesant enough, but no real 
details on how the system works.  What I got was that
they "private" key is what you type in.  This is then 
hashed (he even used the word hash) into a 22 character
public key that you share with your friends.  
Even at 8 bits/charcter, 176 bits doesn't sound secure
for a public key algorithm, but then again this isn't
RSA we are looking at.

All in all it still sounds like snake oil to me!

Dan

------------------------------------------------------------------
Dan Oelke                                  Alcatel Network Systems
droelke at aud.alcatel.com                             Richardson, TX






From Stef at nma.com  Wed Jun 19 20:47:56 1996
From: Stef at nma.com (Einar Stefferud)
Date: Thu, 20 Jun 1996 11:47:56 +0800
Subject: Micropayments: myth?
In-Reply-To: <Pine.SGI.3.91.960610213300.11005B-100000@fully.organic.com>
Message-ID: <13618.835214087@odin.nma.com>


Your analogy breaks because you do not provide for the corresponding
of connections between the gas tank and the dashboard indicator for
the case of buying small items from many different vendors.

I can see each vendor site giving you a "gas gauge" indicator, either
showing how much you have cumulatively charged at a given site, or how
much is left on your prepaid site account (these are the same thing in
terms of adding up charges), but I fail to see how your analog applies
outside the local control of each vendor site.

In short, you have again shown that microcharging systems are limited
to local accumulations.  Your gas tank example is limited to the car
you are driving, and does not tell you anything about anything else.

Unfortunately, you appear to be applying the idea to a collection of
vendors which you wish to visit, which means that someone somewhere
must be getting the disparate charges from different vendors to update
your singular gas gauge.

Drawing analogies is great fun, but all analogies break at some point
in their life, because they abstract away enough detail to paint a
simplified picture.  Sometime this leads to complete failure to map as
intended.

Best...\Stef

>From Brian Behlendorf's message Mon, 10 Jun 1996 21:49:05 -0700 (PDT):
}
[snip]....
}
}Now, let's consider bridging this metaphor into the micropayments world.  
}Imagine that surfing the web is like driving a car - you'll dribble out 
}small amounts of money over a period of time, but as long as you watch 
}your speedometer (the rate at which you spend money) and the fuel tank 
}levels (the amount of coinage in your wallet), you are in control of your 
}spending rates.  Whether you approve every micropayment explicitly, or 
}you set a minimum level below which requests for payments are automagically 
}granted, is up to you.  Me, I'd probably be alright with just about any 
}site I go to asking for less than $.02 for any action I take.  Anything 
}above that, I want to be explicitly asked.  My user interface has a gas 
}gauge and a speedometer in the upper-right-hand corner instead of a 
}throbbing "N".  When my levels are low, I go visit my bank and "refill" 
}my wallet.  Voila!
}
}The billing happens, as others have previously noted, entirely at the 
}client side.  There's no reason the wallet or web browser can't keep a 
}log of expenditures, and there's no chance for spoofery at that point 
}(the wallet knows where it sent money).  
}
}And yes, I am presuming a system involving transfers of digitally signed 
}tokens of some sort.  I don't think this is a mistaken presumption.  
}
}	Brian
}
}--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--
}brian at organic.com  |  We're hiring!  http://www.organic.com/Home/Info/Jobs/
}





From tbyfield at panix.com  Wed Jun 19 20:57:35 1996
From: tbyfield at panix.com (t byfield)
Date: Thu, 20 Jun 1996 11:57:35 +0800
Subject: Dutch smartcard alert: De Waag, Amsterdam, 6/19 1900 hrs
Message-ID: <v02140b09adee262aa88c@DialupEudora>


Any C'punks and/or interested parties who happen to be in Amsterdam might
want to pay a visit to De Waag this Friday night, ~7pm: AFAIK, the
Chipknip--the electronic cash system tested in Arnhem--is making its public
debut in the restaurant/cafe "In De Waag." It looks like a bad standard,
imo: smartcards storing x<fl50, PIN-card dependent ( -> True Name),
transaction records kept (duration unknown) by the implementing company,
Interpay. If you're interested in the standard ("VIC"?), get in touch with
Interpay: they _have_ released the payment boxes (real cute: an LCD screen,
a green "ja" button and a yellow "?" button), and I've seen a Rabobank
wallet-reader. For now, the cards stay in De Waag. Full rollout should be
about the end of this year.

Ted







From furballs at netcom.com  Wed Jun 19 21:32:51 1996
From: furballs at netcom.com (Paul S. Penrod)
Date: Thu, 20 Jun 1996 12:32:51 +0800
Subject: Current status of RSA patent...
Message-ID: <Pine.3.89.9606191052.A14088-0100000@netcom6>



Can anyone provide additional information on the RSA patent status? 
If memory serves me, it is due to expire sometime in 1997. 

Also, what are the ramifications of deploying software based around it, 
such as PGP 2.62i (from UK)?

...Paul

-------------------------------------------------------------------------

"Faced with the choice between changing one's mind and proving that there
 is no need to do so, almost everybody gets busy on the proof"

                                            -- John Kenneth Galbraith

"Success is attending a funeral as a spectator"

                                            -- E. BonAnno 

-------------------------------------------------------------------------






From shamrock at netcom.com  Wed Jun 19 21:55:03 1996
From: shamrock at netcom.com (Lucky Green)
Date: Thu, 20 Jun 1996 12:55:03 +0800
Subject: Federal key registration agency
Message-ID: <v02120d59aded35019abf@[192.0.2.1]>


At 16:27 6/18/96, TM Peters wrote:

>Speaking to the Commonwealth Club of California in San Francisco, Reno said
>her plan would require people to register with the new agency the secret
>codes -- or "keys" -- they use to encrypt messages online.

The cat is out of the bag. Janet Reno is calling for mandatory Government
Access to Keys. Not that her statement would surprise anyone on this list.
Still, I believe the administration has never before publicly stated that
people will be _required_ to deposit their encryption keys with the
government. I wonder what the penalties for failure to comply with this
requirement will be.

[I have requested a transcript of Reno's speech from the Commonwealth Club.
I will make the relevant parts available as soon as I get it].



-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
   Disclaimer: My opinions are my own.







From se7en at dis.org  Wed Jun 19 22:03:31 1996
From: se7en at dis.org (se7en)
Date: Thu, 20 Jun 1996 13:03:31 +0800
Subject: On-Line Security Eyed For Florida St. ID Tool
Message-ID: <Pine.BSI.3.91.960619123743.3783G-100000@kizmiaz.dis.org>




V-One Corp. said it will be supplying a key security component to the 
smart card identification and transaction system that Florida State 
University is developing.

When the system, SmartWorld, is deployed later this year, students will 
gain access through the Internet to a host of applications touching on 
many aspects of campus life. Electronic financial transactions over the 
network will be secured through mutial authentication and encryption 
aided by the smart card.

V-One said it will provide its SmartGate "middleware," which allows 
virtually any application to run securely on public networks like the 
Internet. The agreement also provides for cross-training between V-One 
and Florida State personnel, and V-One technology will be incorporated in 
demonstrations that Florida State's Card Application Technology Center 
makes in marketing its system to other universities and colleges, 
government agencies, and other organizations.


se7en






From jimbell at pacifier.com  Wed Jun 19 22:31:30 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 20 Jun 1996 13:31:30 +0800
Subject: German Federal Bank opposes e-cash
Message-ID: <199606192009.NAA04661@mail.pacifier.com>


At 12:25 PM 6/19/96 +0200, Ulf Moeller wrote:
>[What follows is my translation of a Reuters news item as seen on a
>mailing list.]
>
>"Risks with computer money"
>
>Frankfurt - the Federal Bank has once more warned against security risks
>with computer money. There is the danger that "Cyber-Money" stored in
>computers be counterfeited, said Directory Board member Edgar Meister
>at a conference in Schwaebisch-Hall.

Then the banks just need to be more careful about issuing it, huh?

>In addition there were the danger
>of money laundry, because the computer money could be wired across
>borders without problems. 

Which, interestingly enough, is exactly the reason citizens should support 
it.  Barry Goldwater, the 1964 US Presidential candidate, said something 
like "Any government that is powerful enough to give you everything you 
want, is powerful enough to take away everything you have."    It was true, 
then, and it's true today.

Fast-forward to 1996:  Any government powerful enough to be able to 
eliminate money-laundering is powerful enough to eliminate all of our 
rights. I'm not willing to take that risk, and the way I see it, people who 
see digital cash as an undesirable risk to government are a risk to me.


Meister announced that, if necessary, the EU
>Central Banks would take counter-measures, should computer money and
>re-loadable payment cards endanger the monetary policy. (rtr/18.6.96)

Maybe somebody should tell Herr Meister that should actions of government be 
threatening, "Citizens would take counter-measures, should restrictions on 
computer money and reloadable payment cards endanger their rights."

Jim Bell
jimbell at pacifier.com





From warlord at MIT.EDU  Wed Jun 19 22:32:01 1996
From: warlord at MIT.EDU (Derek Atkins)
Date: Thu, 20 Jun 1996 13:32:01 +0800
Subject: Current status of RSA patent...
In-Reply-To: <Pine.3.89.9606191052.A14088-0100000@netcom6>
Message-ID: <199606191956.PAA17079@toxicwaste.media.mit.edu>


> Can anyone provide additional information on the RSA patent status? 
> If memory serves me, it is due to expire sometime in 1997. 

I think you need to replaces your SIMMs, your memory is faulty.  RSA
lives until 2000 (or 2003, I forget); 1997 is Diffie-Helman.

> Also, what are the ramifications of deploying software based around it, 
> such as PGP 2.62i (from UK)?

What you think would happen based on the fact that the patent hasn't
expired.

-derek






From somogyi at digmedia.com  Wed Jun 19 22:33:50 1996
From: somogyi at digmedia.com (Stephan Somogyi)
Date: Thu, 20 Jun 1996 13:33:50 +0800
Subject: German Federal Bank opposes e-cash
In-Reply-To: <m0uWKRm-0000B2C@ulf.mali.sub.org>
Message-ID: <v03007500adee319399c6@[198.93.25.98]>


At 10:19 -0700 19.6.96, Ian Goldberg wrote:

> Maybe the journalists are just misinformed, or possibly the banking
> people?

When I met with the head of payment systems for the German federal bank
late last year, he seemed pretty with it and knowledgable about the
relevant issues.

> That's very interesting, especially considering Deutsche Bank has signed
> on to be an ecash mint

At the risk of providing redundant information, the Deutsche Bank is a
commercial bank that has nothing to do with the Deutsche Bundesbank,
which is the central bank.

Personally, I don't think too much should be read into the
announcement. It contains no fundamentally new information and is
simply a public articulation of on otherwise obvious state of affairs.
(Or did anyone really think that the central banks weren't paying close
attention to these goings on?)

Stephan

________________________________________________________________________
Stephan Somogyi                Mr Gyroscope                Digital Media







From grafolog at netcom.com  Wed Jun 19 22:46:47 1996
From: grafolog at netcom.com (jonathon)
Date: Thu, 20 Jun 1996 13:46:47 +0800
Subject: "Mail Exploders"
In-Reply-To: <v02140b03adec9a570eca@[206.243.160.205]>
Message-ID: <Pine.SUN.3.94.960619152722.9011B-100000@netcom2>


	Vin:

On Tue, 18 Jun 1996, Vin McLellan wrote:

> semi-moderated newsgroup) could be slapped for just bouncing the SPAM back
> at the sender.

	Cyberpromotions VS AOL is about AOL returning to CyberPromotions
	E-Mail for whom there was no user on AOL.
	
	CyberPromotions had a number of "User Unknown" addresses in
	its list, as as a consequence, they bounced back to the 
	sender.    And like most bounce messages, the majority of them
	wre for individual address.

	<< In effect, CyberPromotions mailbombed itself, by having
	so many invalid addresses, that their system was swamped, 
	when those messages came back.  << I suspect that people
 	that didn't like the e-mail also contributed to that. >> >>

	This was all discussed on Listmanager several months ago. 

> that the subscribers of AOL (or other online community) agreed -- in their
> intial subscriber contracts -- to have AOL refuse for them.

           I misplaced a procmail recipe that automatically
	   returns to sender any mail that the recipient is BCC'd.
	   Very usfull for those with shell accounts.  

> a chain of contracts that forbid it (without reference to content) from the
> backbone back through the IAPs to the users.  (I think Long-Morrow at Yale

	MCI has announced that any domain that originates spam
	that travels through their system is subject to being
	cut off of their system.   They appear to be following
	through with that policy.  

	Sprint doesn't care what travels through their system.  

        xan

        jonathon
        grafolog at netcom.com



	NETCOM --- when only the worst in internet service will suffice.







From jimbell at pacifier.com  Wed Jun 19 23:15:01 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 20 Jun 1996 14:15:01 +0800
Subject: Digital Cash application
Message-ID: <199606192305.QAA16832@mail.pacifier.com>


At 02:20 PM 6/19/96 -0500, Declan McCullagh wrote:
>Whether it's a good idea or not -

Don't bury your head in the sand too early.

>- and I'm told that it could violate FEC
>rules -

_ANYTHING_ could "violate FEC rules."  The issue is, "could this be done in 
a way that would NOT violate any such rules.  Or, more generally, could this 
be done in a way that would challenge or even obliterate FEC rules.  If you 
ask a lawyer for the course of action to take that will, guaranteed, not 
raise any eyebrows, he'll give you one speech.  If, on the other, you ask 
him if a tactic violates black-letter law, for certain, he'll give you another.

>- it's not going to happen.
>A campaign spokesperson told me that "Harry refuses" to take the cash, period.

(How certain are you that they understand the ramifications of this?)

This year, maybe not.  However that doesn't mean that there shouldn't be a 
debate on the subject.  Technology may allow a rip-roaring debate among the 
public, not just the Libertarian Party, and e-cash may implement this 
stolen-property return in a way designed to cause the most consternation and 
embarrassment among those in power.

Remember, if it has been decided, a year ago, that doing this was "okay", 
chances are good that Harry Browne WOULD be willing to do so now.  Trying to 
ignore the issue won't make it go away.

Jim Bell
jimbell at pacifier.com





From ichudov at algebra.com  Wed Jun 19 23:30:25 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Thu, 20 Jun 1996 14:30:25 +0800
Subject: Safemail
In-Reply-To: <9606191626.AA24637@rpcp.mit.edu>
Message-ID: <199606192352.SAA10970@manifold.algebra.com>


Joseph M. Reagle Jr. wrote:
> 
> At 04:19 PM 6/18/96 -0400, you wrote:
> 
> >        SafeMail uses a proprietary Russian algorithm.
> 
>         Maybe it is GOST. Schneir covers it, and there is a white paper on
> it at the b_crypt site.

But GOST isn't based on public key cryptography, it is a symmetric
algorithm, right?

And these guys claim that they use PK cryptography.

	- Igor.





From unicorn at schloss.li  Wed Jun 19 23:31:29 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Thu, 20 Jun 1996 14:31:29 +0800
Subject: MasterCard Seeks Revision in On-Line Bill
In-Reply-To: <Pine.BSI.3.91.960619122424.3783D-100000@kizmiaz.dis.org>
Message-ID: <Pine.SUN.3.93.960619193424.444A-100000@polaris>


On Wed, 19 Jun 1996, se7en wrote:

> 
> 
> A MasterCard International official told a congressional committee 
> Wednesday that encryption technology is "vital to the development and 
> security" of a number of its products, including its smart card program.
> 
> Joel Lisker, MasterCard International senior vice president for security 
> and risk management, testified in support of the "Promotion of Commerce 
> On-Line an the Digital Era Act" bill.


Hmm.  Mr. Lisker is a friend of mine.  I think I'll give him a call.


---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From furballs at netcom.com  Thu Jun 20 00:10:44 1996
From: furballs at netcom.com (Paul S. Penrod)
Date: Thu, 20 Jun 1996 15:10:44 +0800
Subject: Current status of RSA patent...
In-Reply-To: <199606191956.PAA17079@toxicwaste.media.mit.edu>
Message-ID: <Pine.3.89.9606191305.A8074-0100000@netcom>




On Wed, 19 Jun 1996, Derek Atkins wrote:

> > Can anyone provide additional information on the RSA patent status? 
> > If memory serves me, it is due to expire sometime in 1997. 
> 
> I think you need to replaces your SIMMs, your memory is faulty.  RSA
> lives until 2000 (or 2003, I forget); 1997 is Diffie-Helman.

SIMM replacment on both sides of the aisle.

Patent # 	4.200.770
Date:	 	3/29/80
Expiration:	3/29/97
Inventor(s)	Hellman, Diffie, Merkle
Coverage:	Diffie-Hellman Key Exchange

Patent #	4,405,829
Date:		9/20/83
Expiration:	9/20/2000
Inventor(s)	Rivest, Shamir, Adleman
Coverage:	RSA

> 
> > Also, what are the ramifications of deploying software based around it, 
> > such as PGP 2.62i (from UK)?
> 
> What you think would happen based on the fact that the patent hasn't
> expired.
> 

PGP 2.6.2i is not US codebase, and RSA is not patented outside the US 
according to Bruce Schneiner. Therefore, if a product was deployed into 
the US using a non-US codebase, it is unclear to me what legal 
jurisdiction (if any) RSA may have in these circumstances.

...Paul





From mixmaster at remail.obscura.com  Thu Jun 20 00:22:21 1996
From: mixmaster at remail.obscura.com (Mixmaster)
Date: Thu, 20 Jun 1996 15:22:21 +0800
Subject: No Subject
Message-ID: <199606200029.RAA20928@sirius.infonex.com>


FYI: "Cash Crunch" _Wall Street Journal_ by Neal Templin 6/17/96

     "Companies are coming up with ways to deal with one of the biggest obstacles to on-line purchases: how to pay for what you buy"






From lucre at alpha.c2.org  Thu Jun 20 01:04:48 1996
From: lucre at alpha.c2.org (lucre at alpha.c2.org)
Date: Thu, 20 Jun 1996 16:04:48 +0800
Subject: -lucre 0.8.1: ecash library for Unix available (with source, no blinding)
Message-ID: <199606192133.OAA22813@infinity.c2.org>


-----BEGIN PGP SIGNED MESSAGE-----

We are pleased to announce the 0.8.1 ALPHA release of -lucre, a C library
which implements the protocols of ecash(tm).  This library was developed for
research purposes, so source is available, but to avoid patent issues,
blinding of coins is not currently supported.  Please read the README
(appended below) for more detailed information.

You can currently get -lucre by anonymous ftp to csclub.uwaterloo.ca, in the
directory /pub/-lucre.

If you need to reach us, the development team for -lucre, you can try
<lucre at alpha.c2.org>.  Our public key is in the README, below.  There is
also a mailing list set up for discussing the library.  To subscribe,
send email to <majordomo at c2.org> with a message (_not subject_) of
"subscribe dev-lucre".

We are providing this library so that people can study how ecash works,
and possibly come up with innovative ways of incorporating ecash into
existing systems.  Paying for remailers, for example, is a topic that
seems to come up again and again on some mailing lists.  Hopefully, it
will also encourage more people to open an account with Mark Twain Bank;
the more people who are using ecash, and the more shops that accept ecash,
the better the system will be.  We believe in open systems, not "security
through obscurity", or the "trust me" model of security, and so we saw
a full-source release to be important.

The distribution comes with the library itself, as well as a very simple
ecash client.  The client should be usable to accept or pay ecash (or, if
you discover it doesn't fit your needs, you can change it yourself), but,
of course, you don't get the anonymity offered by the patented blinding
feature of ecash.

The README is attached below; please read it, as it contains more useful
information about the use of this library.


- -lucre version 0.8.1 README
- ---------------------------

This is version 0.8.1 of -lucre (We pronounce it ``dash lucre''; you can
pronounce it however you like), the Unofficial Cypherpunks Release of Ecash
(or ``Coderpunks'', if you want).  As the ``-l'' indicates, this is a C
library that implements the protocols of DigiCash's ecash (version
1.8.5, the kind used by Mark Twain Bank, not EUnet).  This is an ALPHA
release.  That is, future release may not even adhere to the same API.
This library was developed for, and is provided for, research purposes;
adjust your expectations of support accordingly.  As far as we know,
- -lucre will only work on Unix-style machines; it is unlikely that
we will release a Windows or Mac version.

- -lucre provides all of the basic things you would like (payment requests,
payments, deposits, withdrawals, opening accounts).  The format of the
wallet is somewhat different from that of DigiCash's standard client,
so it would probably be tough to use both that and -lucre with the same
MT bank account (maybe not, though; we haven't tried).

Most of the information used to produce this program came from
information published on the Web, Usenet, and various mailing lists, and
from analysis of the output of a logging packet forwarder.  The rest was
obtained from talking to various people, and from simple experimentation.
Because these are not ``official'' sources, some things may be incorrect.
Use at your own risk; there is always the possibility, when using ecash,
that your money will vanish into the bowels of the network.

To use this code, you will need the SSLeay package, which you can get from
ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/SSLeay-0.5.2a.tar.gz, and the
Berkeley db package, which you can get from
ftp://ftp.cs.berkeley.edu/pub/4bsd/db.1.85.tar.gz.  Note especially that
the use of SSLeay is subject to restrictions in some countries, including the
US.  Also, as distributed, this package does _not_ do blinding of withdrawn
coins, as that process is patented by Dr. David Chaum.  If you manage to
license the patent, or if you fall under the ``Experimental Use Exception''
(in the US, and possibly other places), it's up to you to add in the blinding
code yourself.  In any case, and especially if you plan to use ecash
for commercial purposes, we would recommend that you contact competent legal
counsel.  Note that DigiCash publishes an ``official'' library for ecash,
though (at time of writing) it is much higher-level, and without source
available.  If that library would suit your needs, you are probably better off
using it instead of -lucre.

This library is _not_ in the public domain.  Currently, you may not modify
it, redistribute it, or distribute any program linked to it (dynamically
or staticly), without our explicit permission (signed by the public key
below).  This restriction is a reflection of the ALPHA version of the
library; it is likely that future versions will have more lenient
licensing agreements.

Some things we would like to put in future versions:

o Resending aborted withdrawals: the code to do this is in there, but the
   bank seems to think the repeated withdrawal message is a new withdrawal
   [We lost $0.23 learning this... :-( ].  We'll look into this further.

o An interface into resending and cancelling payments: all of the right info
   is currently being stored in the databases; only convenient functions
   to actually do the work are needed.

o Make the function names more parallel: currently, some are like
   ``wallet_open'' and some are like ``free_msg'' (we're talking about
   verb-object order, here).  This isn't a big deal, especially if you
   have lucre.h in front of you.

o Put in better differentiation of error conditions, and more logging.

o More complete client-to-client communications.  Right now it is limited
   to payment requests and payments.

We are, of course, open to suggestions [and ecash donations! :-) ].

You can reach us, the development team for -lucre, at either of the
addresses below (in fact, use both, as the nym servers seem to be flaky).
Better yet, there is a mailing list to discuss the library; send mail
to majordomo at c2.org with body "subscribe dev-lucre" to subscribe.

Type bits/keyID    Date       User ID
pub  1024/E9E2AC75 1996/06/13 Development team for -lucre <lucre at alpha.c2.org>
          Key fingerprint =  63 94 0D F7 D9 6F 2D E5  08 0F EE 19 CB 6B A9 17 
sig       E9E2AC75             Development team for -lucre <lucre at alpha.c2.org>
                              Development team for -lucre <lucre at nym.jpunix.com>
sig       E9E2AC75             Development team for -lucre <lucre at alpha.c2.org>


- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzHANI0AAAEEANYAvtkmYoH/Mav1A8fuwm+ZsDD4t3NY7nYd6zBKkepLLHWd
Ue1Wnyr3mFHcrQBbJshwOJOCCUvYwDHST1TOqssaK/vAVavvubD8kRam+SET04b/
477krJbCycnbBJ5FSugR4kKKs3S3BkrFWIJaBVTSzsocp+eGrrpcpsjp4qx1AAUR
tDBEZXZlbG9wbWVudCB0ZWFtIGZvciAtbHVjcmUgPGx1Y3JlQGFscGhhLmMyLm9y
Zz6JAJUDBRAxwDTfulymyOnirHUBAeqmBACfy2V57n/kAWMaUT5cFjW/C9ErL9JD
2ej5xr2vXNsYqXVIGGAc1ZNWIRKdxIp5fs+eBwf6mPRcwHe62a50hp9nTmhNnNCr
HLLr6g4KkIgNslYtIma+U7ojysAWrcU0Ng8dse8bheO6OiXPoBVI+stp9Uijl60f
tTOCPEP9ldY34LQyRGV2ZWxvcG1lbnQgdGVhbSBmb3IgLWx1Y3JlIDxsdWNyZUBu
eW0uanB1bml4LmNvbT6JAJUDBRAxxegrulymyOnirHUBAb+MBADErPAtQdo4X8UU
8uGrFsDvSIfzRVgaz+HarEB1PNW5gsEiw9xhHizT6cKM0L9F7BCJWye2jHDm8DSP
a5GdQNEmg+siFOw7+97hELqOzJsOjTBrF+mZ5flEeGQJHKub1D5hRChIqI/bwa5A
6e8AKbLB+mfaO2hfXJtnlroUx9foTg==
=GvP2
- -----END PGP PUBLIC KEY BLOCK-----


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMchcGbpcpsjp4qx1AQEVrQQArRPfJgQQq7rRgIl5mBoS5Ju2Hq4aR7u3
mV90yLTHpQq8mC59O2NCxtJzRqfnA9sASVWDZWFudwmzwj6V6f6Kwxb8i8PO4EZ0
28A+BBf+jtpDNG2bsTYxEbIxQM1eE+GuUjSatbW0sYW3J3df7YeYyQAVU/7b2dni
+BLOnD4tqvw=
=Jozg
-----END PGP SIGNATURE-----





From unicorn at schloss.li  Thu Jun 20 01:25:29 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Thu, 20 Jun 1996 16:25:29 +0800
Subject: Gov. archives - NSA (fwd)
Message-ID: <Pine.SUN.3.93.960619194214.444C-100000@polaris>




New ideas about where the "totally new russian crypto" proffered by
"mailsafe" might come from:

---------- Forwarded message ----------
Date: Tue, 04 Jun 1996 12:13:22 -0500
From: Brian Durham <bdurham at metronet.com>
To: cypherpunks at toad.com
Subject: Re: Gov. archives - NSA

http://www.nsa.gov:8080/

Interesting information about Soviet one-time pad ciphers and about 
crypto-related documents from the WW2 era that are being declassified.






From declan+ at CMU.EDU  Thu Jun 20 01:48:53 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Thu, 20 Jun 1996 16:48:53 +0800
Subject: Digital Cash application
In-Reply-To: <199606191813.LAA27918@mail.pacifier.com>
Message-ID: <Qlm=og_00YUyEZadge@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 19-Jun-96 Re: Digital Cash
application by jim bell at pacifier.com 
> It seems to me that since paying people funds that were stolen from them 
> would produce good publicity, which by definition could be argued to be 
> spending it on the campaign.  Sure, it's a non-traditional tactic, but that 
> doesn't mean it's in violation of the campaign law.  They could also email 
> along a set of libertarian literature, and the recipient would certify that 
> he would promote the libertarian cause and work for the election of the 
> candidate, etc, etc.

Jim: I've worked on a presidential campaign before and can tell you that
if the FEC is likely to consider something a violation, the campaign is
not going to skirt the line.

That said, perhaps the law is outdated and needs to be changed. The
portion of the campaign finance law, as intepreted by the FEC, barring
online services from providing free accounts to political candidates, is
now being scrutinized in Congress. Rep. White will introduce a reform
bill in about two weeks.

-Declan






From jimbell at pacifier.com  Thu Jun 20 01:55:54 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 20 Jun 1996 16:55:54 +0800
Subject: MasterCard Seeks Revision in On-Line Bill
Message-ID: <199606200301.UAA00392@mail.pacifier.com>


This kind of testimony shows exactly why we (individual citizens) can't 
trust corporations to guard our interests in the crypto arena:


At 12:25 PM 6/19/96 -0700, se7en wrote:
>Joel Lisker, MasterCard International senior vice president for security 
>and risk management, testified in support of the "Promotion of Commerce 
>On-Line an the Digital Era Act" bill.
>
>But he urged that the legislation be amended to address security concerns 
>arising from the resale and reexportation of encryption technology.
>
[..]
>But Mr. Lisker urged that the bill be amended to increase the penalties 
>for the rexportation and resale of this technology to questionable 
>buyers, including criminals. "Modernizing the federal regulatory approach 
>to encryption technology must be accomplished without weakening the 
>ability of law enforcement agencies to pursue criminal activity," he 
>testified.

Look at this closely, and Mastercard's position, and you'll notice that 
Lisker has no obvious professional interest in encouraging the _increasing_ 
of penalities for the "reexportation and resale of this technology to 
questionable buyers, including criminals."  (In a contest between Mastercard 
armed with good encryption, and criminals armed with similar tools, 
Mastercard will win, because winning simply involves keeping the crooks away 
from its money.)  Lisker is also presumably smart enough to know that few 
people are going to go into an "Encryption Store" and say, "I'm a criminal!  
Could I buy your best encryption, please?"    

Yet, despite no obvious reason for Lisker's interest, he's pushing the "no 
crypto to bad guys" buttons, so he's obviously sucking up to the politicians 
in an area he has no reason to.  It sounds to me like a deal is being 
struck, and I'm certain the public will be on the short end of that deal.

Why can these thugs just accept the fact that crypto will get into the hands 
of people that governments don't want it to?

Jim Bell
jimbell at pacifier.com





From vin at shore.net  Thu Jun 20 03:13:50 1996
From: vin at shore.net (Vin McLellan)
Date: Thu, 20 Jun 1996 18:13:50 +0800
Subject: Current status of RSA patent...
Message-ID: <v02140b08adee89ac1f47@[206.243.161.221]>


"Paul S. Penrod" <furballs at netcom.com> suggested:

>PGP 2.6.2i is not US codebase, and RSA is not patented outside the US
>according to Bruce Schneiner. Therefore, if a product was deployed into
>the US using a non-US codebase, it is unclear to me what legal
>jurisdiction (if any) RSA may have in these circumstances.

        The relevant issue is not the code-base.  Copyright "protects" the
code.  A patent is a proprietary claim on a design for a device, in this
case RSA's PKC.  A nation issues a patent as an acknowledgement and
validation of a proprietary claim on a specific design, for a non-obvious
device, for a limited period, enforcable within the boundries of its
jurisdiction.

        Nice try.

        2.6.X-ui doesn't use Rivest's RASREF cryptographic toolkit like the
US version does, but it does impliment the patented RSA "device."  You can
bring it into the US, but if you try to sell it in the US and make money
from the design --without giving RSA its due -- they're gonna get ya!

        RSA has no "legal jurisdiction,"  in the US or elsewhere.  (Few
companies do;-)  But I can understand how, hanging around a Libertarian
cabal like C'punks, you might forget that sovereignty rests in the State.
Wishful thinking, lad.

        Suerte,
                        _Vin

         Vin McLellan +The Privacy Guild+ <vin at shore.net>
      53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548
                         <*><*><*><*><*><*><*><*><*>







From WlkngOwl at unix.asb.com  Thu Jun 20 03:16:42 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Thu, 20 Jun 1996 18:16:42 +0800
Subject: Current status of RSA patent...
Message-ID: <199606200543.BAA29268@unix.asb.com>


On 19 Jun 96 at 13:25, Paul S. Penrod wrote:

> PGP 2.6.2i is not US codebase, and RSA is not patented outside the US 
> according to Bruce Schneiner. Therefore, if a product was deployed into 

Note that Bruce's expertise is in cryptography, not patent law.

> the US using a non-US codebase, it is unclear to me what legal 
> jurisdiction (if any) RSA may have in these circumstances.

It's a violation of RSA's patent wherever RSA is patented (in the US 
only, I believe).  Doesn't matter who wrote the code, or where.

Oh yeah: PGP 2.6ui or 2.6.3i is based on US versions.  I believe they 
still use some of PRZ's code.

And don't forget that IDEA is patented by Ascom Tech AG.

Rob.


---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From jimbell at pacifier.com  Thu Jun 20 03:18:02 1996
From: jimbell at pacifier.com (jim bell)
Date: Thu, 20 Jun 1996 18:18:02 +0800
Subject: Digital Cash application
Message-ID: <199606200312.UAA01155@mail.pacifier.com>


At 10:53 PM 6/19/96 -0400, Declan B. McCullagh wrote:
>Excerpts from internet.cypherpunks: 19-Jun-96 Re: Digital Cash
>application by jim bell at pacifier.com 
>> It seems to me that since paying people funds that were stolen from them 
>> would produce good publicity, which by definition could be argued to be 
>> spending it on the campaign.  Sure, it's a non-traditional tactic, but that 
>> doesn't mean it's in violation of the campaign law.  They could also email 
>> along a set of libertarian literature, and the recipient would certify that 
>> he would promote the libertarian cause and work for the election of the 
>> candidate, etc, etc.
>
>Jim: I've worked on a presidential campaign before and can tell you that
>if the FEC is likely to consider something a violation, the campaign is
>not going to skirt the line.
>
>That said, perhaps the law is outdated and needs to be changed.


The following two paragraphs were sent to me by a person familiar with 
Oregon Libertarian politics over the last 15 years:


"Good idea.  Something like this was done in the early '80's in Oregon.
There was a $1 checkoff to the political party of one's choice on the
Oregon income tax form, and the LPO was the recipient of a grand or so of
money stolen from taxpayers.  Gary Chipman came up with the idea of
sending $1 bills to LPO members and registered Oregon libertarians with a
fundraising letter touting us as the only party that would really give
them their money back."

"Interestingly, the mailing raised more in donations than it cost in stolen
money and postage, and got us good press too.  The legislature promptly
abolished the checkoff during their next session."

[end of quote]

There may be a CLUE here:  Laws and regulations tend to be written based on 
what the writer can imagine, and are updated based on what has happened.  We 
can probably agree that "standard" (non-libertarian) politics would not have 
anticipated such an idea, and moreover you can also suppose that 20+ years 
of D's and R's politics would not have resulted in an example of such a 
tactic being used.  Thus, there is no obvious reason to believe that this 
kind of tactic would have already been prohibited.

We can agree that D's and R's won't like it, as is obvious from what the 
Oregon legislature did, but rather than merely presume that it is illegal, 
why not take the position that unless it is clearly outlawed, then it must 
be considered a legal tactic?  It would be a valid goal to eliminate the 
system, as it apparently did in Oregon.  Don't give up before the race.


Jim Bell
jimbell at pacifier.com





From ichudov at algebra.com  Thu Jun 20 03:33:06 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Thu, 20 Jun 1996 18:33:06 +0800
Subject: Federal key registration agency
In-Reply-To: <v02120d59aded35019abf@[192.0.2.1]>
Message-ID: <199606200248.VAA26690@manifold.algebra.com>


Lucky Green wrote:
> At 16:27 6/18/96, TM Peters wrote:
> >Speaking to the Commonwealth Club of California in San Francisco, Reno said
> >her plan would require people to register with the new agency the secret
> >codes -- or "keys" -- they use to encrypt messages online.
> 
> The cat is out of the bag. Janet Reno is calling for mandatory Government
> Access to Keys. Not that her statement would surprise anyone on this list.
> Still, I believe the administration has never before publicly stated that
> people will be _required_ to deposit their encryption keys with the
> government. I wonder what the penalties for failure to comply with this
> requirement will be.
> 

A couple of questions [admittedly, I am not the best expect in American
politics]: 

1) Is there anything real that individual citizens can do?
2) Would it be helpful to kick democrats out of office and replace
them with republicans? In other words, are republicans any better
than democrats in respecting citizens' right to protecting their
privacy from the government?

	- Igor.





From drosoff at ARC.unm.EDU  Thu Jun 20 03:36:06 1996
From: drosoff at ARC.unm.EDU (David Rosoff)
Date: Thu, 20 Jun 1996 18:36:06 +0800
Subject: Anything is Possible
Message-ID: <1.5.4.16.19960620032806.3b7f4ab8@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

On 17 Jun 96 at 17:21, "M.Wagoner" (safemail at ntrnet.net) wrote:

> We would like someone to be able or should I say try and crack our
> encryption. IT IS IMPOSSIBLE.

Mmm hmm. Sure. And the Titanic was unsinkable, except for that
damned iceberg. And does anyone remember the great train robbery
of Britain? I could go on forever. There are no absolutes,
especially in cryptography. I would be willing to bet that the 
Safe Mail execs encrypt their company mail with PGP. Maybe some
day, in my spare five minutes, I'll crack it - but I'll have
to be really damn bored. And why would I bother - you've already
proven its fault.

===============================================================================
David Rosoff (nihongo o chiisaku dekimasu)  ------------->  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu or get from keyservers
pub  1024/D37692F9 1995/07/01 David Rosoff <drosoff at arc.unm.edu>
          Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
I accept anonymous mail. If I didn't sign it, you don't know I wrote it.
===
"Made weak by time and fate, but strong in will / To strive, to seek, to find--
and not to yield." <---- "Ulysses", by Alfred, Lord Tennyson

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcjB7RguzHDTdpL5AQFW1AP/T2a2v2PSL2yMKsMZUtsSptCUZ1+peQ2y
Wuk0dB+qyUU+of2dDv1XR/P+SQ5Q5YsOPOtZSocZIF2cKDuDG5sLreHoCDwlApZD
CFHQd1RtrTPFq4btd5QGK6w0gGcR/vkrfk8x1yZd+1UfPIrOUKRBXcnDUZqwWKFu
qCOuvCkGNmY=
=+98t
-----END PGP SIGNATURE-----






From cwe at it.kth.se  Thu Jun 20 03:47:14 1996
From: cwe at it.kth.se (Christian Wettergren)
Date: Thu, 20 Jun 1996 18:47:14 +0800
Subject: Fuseable Links - no guarantees??
In-Reply-To: <01BB5DC1.392DE140@geeman.vip.best.com>
Message-ID: <199606200625.IAA03588@piraya.electrum.kth.se>



| So I guess one can look at the circuitry and apply non-standard voltage and
| current values, or even non-standard timing values -- and do bad things
| to these circuits. So this begs the question: Is there anyone who has looked
| at "computer security" issues at this level? 
| 
| >>> Of course, many have.

Does anyone have any pointers to papers or literature on this?

-Christian






From jamesd at echeque.com  Thu Jun 20 04:15:15 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Thu, 20 Jun 1996 19:15:15 +0800
Subject: Does information want to be free?
Message-ID: <199606200731.AAA26703@dns1.noc.best.net>


At 05:26 PM 6/16/96 -0400, Joseph M. Reagle Jr. wrote:
>        If someone found out all the medical information of cypherpunks list
> members and distributed about the Net, how would people feel? 

It would worry me far less than the fact that my medical records are
accessible to the government.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From snow at smoke.suba.com  Thu Jun 20 04:47:39 1996
From: snow at smoke.suba.com (snow)
Date: Thu, 20 Jun 1996 19:47:39 +0800
Subject: Federal key registration agency
In-Reply-To: <199606200248.VAA26690@manifold.algebra.com>
Message-ID: <Pine.LNX.3.93.960620023531.509A-100000@smoke.suba.com>


On Wed, 19 Jun 1996, Igor Chudov @ home wrote:
> Lucky Green wrote:
> > At 16:27 6/18/96, TM Peters wrote:
> > >Speaking to the Commonwealth Club of California in San Francisco, Reno said
> > >her plan would require people to register with the new agency the secret
> > government. I wonder what the penalties for failure to comply with this
> > requirement will be.
> A couple of questions [admittedly, I am not the best expect in American
> politics]:
 
> 1) Is there anything real that individual citizens can do?
	
	1) Refuse to escrow keys. 
	2) Scream bloody murder about the scheme.
	3) Vote libertarian.
	

> 2) Would it be helpful to kick democrats out of office and replace
> them with republicans? In other words, are republicans any better
> than democrats in respecting citizens' right to protecting their
> privacy from the government?

	There is no difference between pigs and men. At least not to this
donkey's eyes. 

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From tonie at efn.org  Thu Jun 20 04:50:30 1996
From: tonie at efn.org (Tonie Nathan)
Date: Thu, 20 Jun 1996 19:50:30 +0800
Subject: Matching funds
Message-ID: <199606200837.BAA17016@haus.efn.org>


In 1996, the Libertarian Party will apparently qualify for Federal matching
>>>funds for its Presidential political campaign.  That does not mean that it
>>>will _accept_ them, being stolen goods.  However, a few years ago I heard of
>>>an idea that they should accept the money, and return it to the people, a
>>>small amount at a time, to whomever asks for it.  Besides returning the
>>>stolen money to its rightful owners, that would produce substantial positive
>>>publicity for the Libertarian party, embarrassment for the Democrats and
>>>Republicans, while at the same time reducing the amount of money available
>>>for the D's and the R's.
>>>
>>>

You can buy a helluva lot more publicity with the matching funds.  I'm not
advocating this, just pointing it out.

Tonie






From erehwon at c2.org  Thu Jun 20 05:07:52 1996
From: erehwon at c2.org (William Knowles)
Date: Thu, 20 Jun 1996 20:07:52 +0800
Subject: Federal Key Registration Agency
Message-ID: <Pine.SUN.3.91.960620014132.14548A-100000@infinity.c2.org>


-----BEGIN PGP SIGNED MESSAGE-----


On Wed, 19 Jun 1996, Igor Chudov wondered:
>Lucky Green wrote:
> At 16:27 6/18/96, TM Peters wrote:
> >Speaking to the Commonwealth Club of California in San Francisco, Reno said
> >her plan would require people to register with the new agency the secret
> >codes -- or "keys" -- they use to encrypt messages online.
> 
>: The cat is out of the bag. Janet Reno is calling for mandatory Government
>: Access to Keys. Not that her statement would surprise anyone on this list.
>: Still, I believe the administration has never before publicly stated that
>: people will be _required_ to deposit their encryption keys with the
>: government. I wonder what the penalties for failure to comply with this
>: requirement will be.
 

> A couple of questions [admittedly, I am not the best expect in American
> politics]: 

> 1) Is there anything real that individual citizens can do?

Keep your PGP262.zip disks in ziplock bags and cache them in the backyard,
forests,The golf courses.  Get a GPS location and escrow the locations with
with trusted friends using Secret Share.  Payout to Jim Bell's AP service.  
Move to Canada?

William Knowles
erehwon at c2.org
Finger for public key




 
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcke1AURbnwsNLz5AQHmMQQA2TFznKaMSM9uayXkvpcq/SsYg1hLnNKW
4v+NKSAVoDSGyn96VPxH1zEDP+dHk2MS173ocIUcaCm3VzRbBp6qnukAzTjGxjns
PVFFS5dsicx+wR4LFxWhUy/7fjvP6BUTLUwPvQGuXZyh8jof1uuL8FYXPtku6tSG
a78TvfAgknU=
=IZFJ
-----END PGP SIGNATURE-----






From stewarts at ix.netcom.com  Thu Jun 20 05:44:45 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Thu, 20 Jun 1996 20:44:45 +0800
Subject: Federal key registration agency
Message-ID: <199606200854.BAA06982@toad.com>


At 09:48 PM 6/19/96 -0500, ichudov at algebra.com (Igor Chudov) wrote:
>A couple of questions [admittedly, I am not the best expect in American
>politics]: 
>1) Is there anything real that individual citizens can do?
Agitate - it worked well when Clipper first came out.
Write code to do things regular people want to do, so that they'll
be trying to ban existing material instead of new material,
and so people will get used to using encryption.  PGP is nice, but
imagine if everyone who used Netscape had windows popping up that said
"Encrypting your message to $RECIPIENT.  Cc: to the FBI? [Yes] [No]"

>2) Would it be helpful to kick democrats out of office and replace
>them with republicans? In other words, are republicans any better
>than democrats in respecting citizens' right to protecting their
>privacy from the government?

Remember that the Clipper initiative and development started
during the Presidency of ex-CIA-director and all-around sleazemeister
George Bush.  You could say it was dumb luck that it came out
during Clinton's watch, so he got the credit/blame, but the folks who
are pushing it have the political savvy to know they'd have far less luck
with a lame-duck Bush proposal during a Clinton "Reinventing Government"
than by waiting until Clinton's securely in office, giving him some credit,
and having the Republicans who were around when it started supporting
them as well.  [Or they could have expected Bush to be re-elected,
and figured announcing it before the election wouldn't help.  Or the
product could have just been late :-)]

Not much difference; if anything, Democrats are usually more in favor
of free speech than Republicans, and would be more likely to oppose it.
They're both a pretty sad lot, though there are occasional Congresscritters
who sometimes get it.  Now, kicking out Democrats and Republicans and
replacing them with Libertarians, Perotistas, Greens, or even Reds would have
a positive effect, at least for a little while, but that's a bit more work. :-)


#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From tonie at efn.org  Thu Jun 20 06:25:51 1996
From: tonie at efn.org (Tonie Nathan)
Date: Thu, 20 Jun 1996 21:25:51 +0800
Subject: Take the money, Harry.
Message-ID: <199606200831.BAA16798@haus.efn.org>


>  Jim, 
Harry should take the money.  As Ayn Rand said, "Don't let your morality be
used against you."

   I believe in the philosophy of law.  As long as it's legal, each person
can take whatever he is legally entitled to from the government's stolen
money, as long as he/she doesn't ADVOCATE that the coercive tax system be
retained.   Many will not take grants, or welfare, but they are legally
entitled to it.  As for the moral entitlement, that is a matter for them to
work out for themselves. After all, we have to drive on government (tax
supported) roads, etc.

Tonie






From nobody at vegas.gateway.com  Thu Jun 20 06:52:44 1996
From: nobody at vegas.gateway.com (Anonymous Remail Service)
Date: Thu, 20 Jun 1996 21:52:44 +0800
Subject: Congress is at it again
Message-ID: <199606201020.GAA28570@black-ice.gateway.com>


HOME RECORDING RIGHTS COALITION ALERT !!


IMMINENT CONGRESSIONAL ACTION ON NII COPYRIGHT BILL
THREATENS CONSUMER ELECTRONICS PRODUCTS


The House of Representatives Subcommittee on Courts and Intellectual
Property will meet in the next few days to vote on H.R. 2441, the "NII
Copyright Protection Act." If you or your business are in the
congressional district of one of the Members of Congress listed below,
please call the Subcommittee member who represents you NOW.  Tell his
office that this badly imbalanced bill shouldn't be voted on unless
and until the following problem is addressed.   If passed in its
current form, H.R. 2441 would:

 o make it a crime to manufacture the next generation of VCRs,
personal computers and other digital devices needed for recreational
and educational use by adding a sweeping and overbroad new Section
1201 to the Copyright Act.

If you need more information, check out the HRRC home page at 
http://www.access.digex.net/~hrrc/ or call toll free 1-800-282-8273.

ACTION NEEDED NOW!!!

Please immediately prepare a  letter to send (use the draft letter
below as a model) - keep it short. --AND CALL -- the Member of the
House Judiciary Subcommittee on Courts and Intellectual Property who
represents you (see list).  These contacts must be made NO LATER THAN
Tuesday, June 18, and preferably sooner. In addition, please forward
this alert on to your friends and colleagues.

Please address all letters as indicated in the list below to
Washington, DC  20515.  All phone and fax (f) numbers are area code
(202):

The Honorable Carlos Moorhead R-CA 
2346 RHOB
225-4176
f:226-1279


The Honorable James Sensenbrenner R-WI
2332 RHOB
225-5101
f:225-3190


The Honorable George Gekas R-PA
2410 RHOB
225-4315
f: 225-8440


The Honorable Howard Coble R-NC 
403 CHOB
225-3065
f:225-8611


The Honorable Elton Gallegly R-CA 
2441 RHOB
225-5811
f:225-1100


The Honorable Charles Canady R-FL 
1222 LHOB
225-1252
f:225-2279


The Honorable Bob Goodlatte R-NC 
123 CHOB
225-5431
f: 225-9681


The Honorable Martin Hoke R-OH
212 CHOB
225-5871
f:226-0994


The Honorable Sonny Bono R-CA
512 CHOB
225-5330
f:225-2961


The Honorable John Conyers, Jr. D-MI
2426 RHOB
225-5126
f:225-0072


The Honorable Patricia Schroeder D-CO
2307 RHOB
225-4431
f:225-5842


The Honorable Howard Berman D-CA
2231 RHOB
225-4695
f:225-5279


The Honorable Rick Boucher D-VA
2245 RHOB
225-3861
f:225-0442


The Honorable Jerry Nadler D-NY
109 CHOB
225-5635
f:225-6923


The Honorable Xavier Becerra D-CA
1119 LHOB
225-6235
f:225-2202



 SAMPLE LETTER

The Honorable                        
Address
Washington, DC  20515

Dear Rep. ____________:

I have learned that Section 1201 of the NII Copyright Protection Act
(H.R. 2441) could take away my right to use new digital video
technology for my personal recording. It also could delay or even
prevent these new products from being available to consumers.

If I record television programs, I do it for my personal use and
convenience. The Supreme Court's "Betamax" decision confirmed my right
to do this. Section 1201 will change the current law so that I may not
be able to do this in the future with new digital video products.

I understand that a House subcommittee vote on this bill is planned
for next week. I realize that the copyright issue is complex, but
please remember to protect my rights as a consumer. I hope you will
vote against H.R. 2441 as drafted. Will you please let me know your
position on this issue?

Sincerely,

YOUR NAME
Thank you.












From frissell at panix.com  Thu Jun 20 07:09:00 1996
From: frissell at panix.com (Duncan Frissell)
Date: Thu, 20 Jun 1996 22:09:00 +0800
Subject: Safemail
Message-ID: <2.2.32.19960620103633.00b83078@panix.com>


At 02:10 PM 6/19/96 CDT, Daniel R. Oelke wrote:

>He did assure me it wasn't GOST, or anything published.
>Story was that a Russian emigrant (sp?) came over to the US 
>and this is his algorithm.  Apparently this person is 
>not willing (at this time) to put the algorithm out for
>public review. 

"Howdy.  Since I just met you in this bar and really like you I wanted to
tell you about this Russian sailor I met.  His ship is in port for only a
few more hours and he has all these Russian gold coins that he wants to
sell.  Now you know he can't sell the coins in those commie countries so
he's so desperate for cash that he'll sell them for just $100 an ounce.
I've got $5,000 right here in this envelope why don't you take $5,000 out of
your bank and we'll meet him and make some fast dough."

I think that sailor has a great new secret algorithm as well.

DCF






From anonymous-remailer at shell.portal.com  Thu Jun 20 07:38:15 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Thu, 20 Jun 1996 22:38:15 +0800
Subject: FBI utters root passsword to the Constitution
Message-ID: <199606201102.EAA00947@jobe.shell.portal.com>


FBI InfoSec Guru Randy Perlman (Prilamen? Filament?) was interviewed on
CNN BizNews this morning by Deborah Marchini:  "Hackers" are menacing the 
net and society.  

Marchini prompted him but he concurred:  Hackers are a *THREAT TO 
NATIONAL SECURITY*.  There you have it, the root password to the 
Constitution.  Illegal wiretapping, assassination, anything is now justified
in the defense of our NATIONAL INFORMATION INFRASTRUCTURE.

bd







From jya at pipeline.com  Thu Jun 20 09:01:11 1996
From: jya at pipeline.com (John Young)
Date: Fri, 21 Jun 1996 00:01:11 +0800
Subject: HUS_tle
Message-ID: <199606201207.MAA15079@pipe1.ny2.usa.pipeline.com>


   6-20-96. NYP: 
 
   "Counterfeiters of a New Stripe Give Japan One More Worry." 
 
      The pachinko caper echoes far beyond Japan, serving as 
      a cautionary tale as the world moves toward digital 
      cash, with money reduced to ones and zeros on a card or 
      in a computer. It could be far easier to manipulate 
      computer codes than to rob a bank or create counterfeit 
      bills. 
 
      "This is a tip-of-the-iceberg problem," said Peter G. 
      Neumann, a computer security hustler at SRI. "You are 
      going to put a lot of money out there and someone is 
      going to figure out how to take it away from you." 
 
      "Electronic money, digital cash, the Internet -- it's so 
      convenient and so many people envision a dreamy future," 
      another sec-hawker drooled. "But once you consider the 
      security, it's quite vulnerable." 
 
 
   http://pwp.usa.pipeline.com/~jya/hustle.txt   (12 kb) 
 
   HUS_tle 
 
 





From declan+ at CMU.EDU  Thu Jun 20 10:08:07 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 21 Jun 1996 01:08:07 +0800
Subject: Congress is at it again
In-Reply-To: <199606201020.GAA28570@black-ice.gateway.com>
Message-ID: <0lmI_vm00YUw82dYQb@andrew.cmu.edu>


There's no imminent Congressinal action here, folks. Note that HR2441
may be revived next year, but we have a reprieve for now.

-Declan


Excerpts from internet.cypherpunks: 20-Jun-96 Congress is at it again by
Anonymous R. Service at veg 
> IMMINENT CONGRESSIONAL ACTION ON NII COPYRIGHT BILL
> THREATENS CONSUMER ELECTRONICS PRODUCTS
>  
>  
> The House of Representatives Subcommittee on Courts and Intellectual
> Property will meet in the next few days to vote on H.R. 2441, the "NII
> Copyright Protection Act." If you or your business are in the
> congressional district of one of the Members of Congress listed below,
> please call the Subcommittee member who represents you NOW.  Tell his
> office that this badly imbalanced bill shouldn't be voted on unless
> and until the following problem is addressed.   If passed in its
> current form, H.R. 2441 would:
>  
>  o make it a crime to manufacture the next generation of VCRs,
> personal computers and other digital devices needed for recreational
> and educational use by adding a sweeping and overbroad new Section
> 1201 to the Copyright Act.
>  
> If you need more information, check out the HRRC home page at 
> http://www.access.digex.net/~hrrc/ or call toll free 1-800-282-8273.
>  
> ACTION NEEDED NOW!!!
>  
> Please immediately prepare a  letter to send (use the draft letter
> below as a model) - keep it short. --AND CALL -- the Member of the
> House Judiciary Subcommittee on Courts and Intellectual Property who
> represents you (see list).  These contacts must be made NO LATER THAN
> Tuesday, June 18, and preferably sooner. In addition, please forward
> this alert on to your friends and colleagues.






From WlkngOwl at unix.asb.com  Thu Jun 20 10:34:01 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Fri, 21 Jun 1996 01:34:01 +0800
Subject: Does information want to be free?
Message-ID: <199606201314.JAA22342@unix.asb.com>


On 20 Jun 96 at 0:24, jamesd at echeque.com wrote:

> At 05:26 PM 6/16/96 -0400, Joseph M. Reagle Jr. wrote:
> >        If someone found out all the medical information of cypherpunks list
> > members and distributed about the Net, how would people feel? 
> 
> It would worry me far less than the fact that my medical records are
> accessible to the government.

Or rather, that the government tends to have (read: covet) information which
the rest of us don't have (often about ourselves).

Rob.
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From rah at shipwright.com  Thu Jun 20 12:49:44 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 21 Jun 1996 03:49:44 +0800
Subject: DCSB: Electronic Commerce: The State of the Art
Message-ID: <v03006f00adef03e56abe@[199.0.65.105]>


-----BEGIN PGP SIGNED MESSAGE-----




                 The Digital Commerce Society of Boston

                               Presents

                             Peter Loshin,
                              Author of
          Electronic Commerce: Online Ordering and Digital Money


                "Electronic Commerce: The State of the Art"


                        Tuesday, June 2, 1996
                               12 - 2 PM
                   The Downtown Harvard Club of Boston
                     One Federal Street, Boston, MA


Pete Loshin has been writing about networking, the Internet and electronic
commerce for the past two years; before that he worked as a TCP/IP
networking engineer for a Cambridge research lab and systems manager for a
major publishing company.  Books currently available include _Electronic
Commerce: Online Ordering and Digital Money_ and _TCP/IP for Everyone_.
Pete plans to launch an Internet commerce newsletter this fall.


The future always looks shinier, more efficient and more pleasant than the
present.  The same holds true for the future of electronic commerce, but a
lot of people are not waiting for the clean and bright future of SET and
unrestricted crypto.  They are doing business right now, over the Internet,
and what they do will affect the way we do business well into the next
century.  Electronic commerce is still largely an art, and after lunch on
Monday July 2 Pete will talk a little bit about the state of that art.



This meeting of the Digital Commerce Society of Boston will be held on
Tuesday, July 2, 1996 from 12pm - 2pm at the Downtown Branch of the
Harvard Club of Boston, One Federal Street. The price for lunch is $27.50.
This price includes lunch, room rental, and the speaker's lunch. ;-).  The
Harvard Club *does* have dress code: jackets and ties for men, and
"appropriate business attire" for women.

We need to receive a company check, or money order, (or if we *really* know
you, a personal check) payable to "The Harvard Club of Boston", by
Saturday, June 29, or you won't be on the list for lunch.  Checks
payable to anyone else but The Harvard Club of Boston will have to be sent
back.

Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston,
Massachusetts, 02131. Again, they *must* be made payable to "The Harvard
Club of Boston".

If anyone has questions, or has a problem with these arrangements (We've had
to work with glacial A/P departments more than once, for instance), please
let us know via e-mail, and we'll see if we can work something out.

Planned speakers for the following few months are:

 August      Duane Hewitt     Idea Futures
 September   Tatsuo Tanaka    Some Economics of Digital Cash

We are actively searching for future speakers.  If you are in Boston on the
first Tuesday of the month, and you would like to make a presentation to the
Society, please send e-mail to the DCSB Program Commmittee, care of Robert
Hettinga, rah at shipwright.com .

For more information about the Digital Commerce Society of Boston, send
"info dcsb" in the body of a message to majordomo at ai.mit.edu .  If you want
to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a
message to majordomo at ai.mit.edu .

Looking forward to seeing you there!

Cheers,
Robert Hettinga
Moderator,
The Digital Commerce Society of Boston



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMclWIvgyLN8bw6ZVAQHTKQP+IPEGyKdwqIC3TcECkuem35RF/dK9WDtr
A3YpRXTU4+4nOaI+KMDK5hH0vV7qOI0t+l3fKdRYjHRBk3tp4GPy/B2GylJFTWtE
STYDza4xdghiq/d4IkZW0mn3XF7bK2YlsR8Xqe1dLXkpuoEmi4daiaby4Bwqf35W
4cXLQdRqZ0U=
=2CcC
-----END PGP SIGNATURE-----

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From adam at homeport.org  Thu Jun 20 13:00:22 1996
From: adam at homeport.org (Adam Shostack)
Date: Fri, 21 Jun 1996 04:00:22 +0800
Subject: Safemail
In-Reply-To: <9606191910.AA11834@spirit.aud.alcatel.com>
Message-ID: <199606201529.KAA02594@homeport.org>


Not to defend the safemail folks, but this does remind me of something
that NeXT did with Eliptic curve based systems; there was no storage
of the private key, it was generated from the passphrase at run time.
It was a side discussion, maybe with Andrew Lorenstien?  Andrew?



Daniel R. Oelke wrote:

| All in all they guy was plesant enough, but no real 
| details on how the system works.  What I got was that
| they "private" key is what you type in.  This is then 
| hashed (he even used the word hash) into a 22 character
| public key that you share with your friends.  
| Even at 8 bits/charcter, 176 bits doesn't sound secure
| for a public key algorithm, but then again this isn't
| RSA we are looking at.


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From stevenw at best.com  Thu Jun 20 14:02:37 1996
From: stevenw at best.com (Steven Weller)
Date: Fri, 21 Jun 1996 05:02:37 +0800
Subject: [SF Bay Area] Security And Freedom through Encryption Forum
Message-ID: <v01540b02adef1b32a600@[206.86.1.35]>



Seen on the net:


SAFE: Security And Freedom through Encryption Forum, July 1, 1996
=================================================================

   For a national encryption policy that promotes commerce and protects
   privacy


http://www.crypto.com/safe


NOTE: Please register for and reserve your free ticket at
 http://www.crypto.com/safe/sign.html
so you don't miss out!  Space is limited!


Save the Date! July 1, 1996 Stanford University, Stanford, California



  Event Information, Speakers, and Agenda



   On July 1, 1996 in the heart of California's Silicon Valley, members
   of Congress and prominent computer industry leaders and privacy
   advocates will meet to discuss the need to reform U.S. encryption
   policy.

   Encryption technologies, the "locks and keys" of the Information Age,
   are an essential component of a secure and trusted Global Information
   Infrastructure. Every day, millions of dollars in commercial
   transactions and the private communications of individuals traverse
   the global network. All are vulnerable to the prying eyes of
   industrial spies, hackers, and rogue foreign governments.

   Computer users need strong encryption technology to protect themselves
   online, and U.S. businesses need the ability to export strong
   encryption in order to build a secure Global Information
   Infrastructure.

   Yet current U.S. export controls and other limits on encryption
   technology are limiting the widespread availability of strong,
   easy-to-use privacy and security products. As a result, these policies
   are stifling the growth of electronic commerce, preventing computer
   users from protecting their privacy, and handicapping U.S. industry in
   the global marketplace. Until these cold war barriers are removed, the
   full potential of the Internet and the future of electronic commerce
   will never be realized.

   National and local press are encouraged to attend this high profile
   event. For more information, please contact Danielle Kolb or Alan
   Davidson at the Center for Democracy and Technology, +1 202 637 9800.


     _________________________________________________________________



Event Information

     * Location:Kresge Auditorium at Stanford University, Stanford,
       California
     * Date: July 1, 1996, 9:00 am - 4:00 pm
     * Admission: Reserve your Free Ticket Today!
                  http://www.crypto.com/safe/sign.html


Confirmed Participants Include:



   Industry Leaders and Cryptographers:
     * Marc Andreeson, Vice President, Netscape Communications Corp.
     * James Bidzos, President, RSA Data Security
     * Eric Schmidt, Chief Technical Officer, Sun Microsystems
     * Brad Silverberg, Senior Vice President, Microsoft Corp.
     * Computer security experts Matt Blaze and Eric Thompson

   Members of Congress:
     * Rep. Anna Eshoo (D-CA)
     * Rep. Tom Campbell (R-CA)
     * Rep. Zoe Lofgren (D-CA)
     * Sen. Conrad Burns (R-MT)
     * Sen. Patrick Leahy (D-VT) (by satellite)

   Demonstrations of Encryption Products and Techniques:

     * SAFE Forum Educational Demo Team:

      Company
                         Contact/Demo Person
                                                          Technologies
  _______________________________________________________________________

 Cisco
                     Marcy Shrader/Elizabeth Kaufman
                                                  Router card, routers
 Cybercash
                     Shannon McElyea
                                                  Digital cash/
                                                  online transactions
 Cygnus
                     Philip Peake
                                                  Kerberos
 Cylink
                     Paula Dunne
                                                  Sniffing/cracker demo
 Digital[*]
                     Steve Monticone
                                                  Firewall tunnel,
                                                  workstations, various
 Milky Way
                     Dave Della Maggiore
                                                  firewalls
 Mytech
                     Ann Brown
                                                  Biometric encryption
 National Semiconductor
                     Kate Peters/Larry Van Valkenburgh
                                                  PCMCIA cards/devices
 PGP
                     Jesse Anton
                                                  email, encrypting phone
 RSA
                     Kurt Stammberger
                                                  S/MIME, various


 [* Not absolutely confirmed yet, but very interested and confirming
 participation with company.]


   Additional invited guest include prominant industry leaders, privacy
   advocates, security experts, and Members of Congress. Watch
   http://www.crypto.com/safe/safe_program.html for updates.


     _________________________________________________________________

  Sponsors Of The SAFE Forum:

America Online
American Civil Liberties Union
Americans for Tax Reform
AT&T
Business Software Alliance
Center for Democracy and Technology
Center for National Security Studies
Commercial Internet eXchange
CompuServe Incorporated
Computer Professionals for Social Responsibility
Cylink Corporation
EDS
Electronic Frontier Foundation
Electronic Messaging Association
Electronic Privacy Information Center
Information Technology Association of America
IEEE - USA
Media Institute
Microsoft Corporation
National Association of Manufacturers
Netcom Online Communication Services
Netscape Communications Corporation
Novell, Inc.
Oracle Corporation
Pacific Telesis Group
Prodigy, Inc.
Progress and Freedom Foundation
Securities Industry Association
Software Publishers Association
Sybase, Inc.
Voters Telecommunications Watch
Wired Magazine

  __________________________________________________________________________
--
<HTML><A HREF="http://www.eff.org/~mech/">    Stanton McCandlish
</A><HR><A HREF="mailto:mech at eff.org">        mech at eff.org
</A><P><A HREF="http://www.eff.org/">         Electronic Frontier Foundation
</A><P>        Online Activist    </HTML>

-------------------------------------------------------------------------
Steven Weller                      |  Technology (n):
                                   |
                                   |     A substitute for adulthood.
stevenw at best.com                   |     Popular with middle-aged men.







From exalt at miworld.net  Thu Jun 20 14:31:17 1996
From: exalt at miworld.net (Intense)
Date: Fri, 21 Jun 1996 05:31:17 +0800
Subject: Current status of RSA patent...
In-Reply-To: <Pine.3.89.9606191052.A14088-0100000@netcom6>
Message-ID: <Pine.LNX.3.91.960620105421.115A-100000@invictor.miworld.net>



does not matter - it will be renewed in the interest of the government
The goverment want's there backdoor...  would you expect less?

the only pgp I will use is that from MIT
it has no back door


               *          <exalt at miworld.net>           *


On Wed, 19 Jun 1996, Paul S. Penrod wrote:

> 
> Can anyone provide additional information on the RSA patent status? 
> If memory serves me, it is due to expire sometime in 1997. 
> 
> Also, what are the ramifications of deploying software based around it, 
> such as PGP 2.62i (from UK)?
> 
> ...Paul
> 
> -------------------------------------------------------------------------
> 
> "Faced with the choice between changing one's mind and proving that there
>  is no need to do so, almost everybody gets busy on the proof"
> 
>                                             -- John Kenneth Galbraith
> 
> "Success is attending a funeral as a spectator"
> 
>                                             -- E. BonAnno 
> 
> -------------------------------------------------------------------------
> 
> 
> 





From rah at shipwright.com  Thu Jun 20 14:35:19 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Fri, 21 Jun 1996 05:35:19 +0800
Subject: DCSB: Electronic Commerce: The State of the Art
Message-ID: <v03006f04adef19a686d0@[199.0.65.105]>


-----BEGIN PGP SIGNED MESSAGE-----

>                  The Digital Commerce Society of Boston
>
>                                Presents
>
>                              Peter Loshin,
>                               Author of
>           Electronic Commerce: Online Ordering and Digital Money
>
>
>                 "Electronic Commerce: The State of the Art"
>
>
>                         Tuesday, June 2, 1996
                                   ^^^^^^

Heh. Just testing. ;-)

The real date is, of course, Tuesday, *July* 2, 1996.

My apologies!

Cheers,
Robert Hettinga
Moderator,
The Digital Commerce Society of Boston





-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMclqGvgyLN8bw6ZVAQHIcgP/WSt1fl5qnFIQ4bX8UP4SCOXNELJ/Y5c8
5AOOL6o307YP0iOzUN8wh6mJx8QkpdXmfYIYA039CmAetRK0DLs6sfP12yRfuHi8
36+7LRAIqCZnM9XVu/LEmtlZaiy6YhFDxq0qIXf8Iie4mA201W+g4I1PgG0nV8qX
3jeyh/+mD4I=
=qj8W
-----END PGP SIGNATURE-----

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws',
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From adam at homeport.org  Thu Jun 20 15:17:17 1996
From: adam at homeport.org (Adam Shostack)
Date: Fri, 21 Jun 1996 06:17:17 +0800
Subject: Fastest DES?
Message-ID: <199606201639.LAA02824@homeport.org>


I can't find UFC (Ultra fast crypt) on idea.sec.dsi.unimi.it.  Could
someone point me to some very fast DES code?  I'm planning to
surgically implant it in a product that uses DES to test a few
theories, so other ciphers aren't interesting; needs to be fast des.

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From grafolog at netcom.com  Thu Jun 20 15:21:49 1996
From: grafolog at netcom.com (jonathon)
Date: Fri, 21 Jun 1996 06:21:49 +0800
Subject: Access Via Anonymous Re-Mailers (fwd)
Message-ID: <Pine.SUN.3.94.960620132244.17963B-100000@netcom17>



---------- Forwarded message ----------
Date: Wed, 19 Jun 1996 13:38:29 -0400
From: Matthew Gaylor <freematt at coil.com>
To: Matthew Gaylor <freematt at coil.com>
Subject: Access Via Anonymous Re-Mailers

Harvard University, Kennedy School of Government Information Infrastructure
Project

Symposium on the Global Information Infrastructure: Information, Policy &
International Infrastructure Cambridge, MA, January 28-30, 1996

Risk-Free Access Into The Global Information Infrastructure Via Anonymous
Re-Mailers

by Paul A. Strassmann, US Military Academy, West Point; and Senior Advisor,
SAIC  and William Marlow, Senior Vice President, Science Applications
International Corporation (SAIC)

Quoted portions are excerpted from Raph Levien's Remailer List.

The Context

By far the greatest threat to the commercial, economic and political
viability of the Global Information Infrastructure will come from
information terrorists. Information terrorism has ceased to be an amateur
effort and has migrated into the hands of well organized, highly trained
expert professionals. Information terrorist attacks can be expected to
become a decisive element of any combined threat to the economic and social
integrity of the international community. Nations whose life-line becomes
increasingly dependent on information networks should realize that there is
no sanctuary from information-based assaults. Commercial organizations,
especially in telecommunications, finance, transportation and power
generation offer choice targets to massive disruption.

Information terrorism, as a particularly virulent form of information
warfare, is a unique phenomenon in the history of warfare and crime. For
the last two hundred years the theory of warfare has been guided by
"force-exchange" equations in which the outcome was determined by the rate
of attrition of each opposing force. In information attacks these equations
do not apply because the attacker remains hidden and cannot be retaliated
against.

Since biblical times, crimes have been deterred by the prospects of
punishment. For that, the criminal had to be apprehended. Yet information
crimes have the unique characteristic that apprehension is impossible,
since even identification of the criminal is not feasible. Information
crimes can be committed easily without leaving any telltale evidence such
as fingerprints, traces of poison or bullets.

Changes Introduced By Anonymous Re-Mailers

The introduction of Anonymous Re-mailers into the Internet has altered the
capacity to balance attack and counter-attack, or crime and punishment. The
widespread use and easy access to acquiring the capacity to launch
anonymous messages and software has so far not received adequate attention
from a policy and legal standpoint. This topic is sufficiently technical
that it has been largely avoided by experts who have so far concentrated on
debating social, legal, political and economic consequences of the Global
Information Infrastructure. Yet, unless there is a thorough understanding
of the technologies that make the Anonymous Re-mailers sources of a
pathological danger, there is little hope that effective preventive
measures and safeguards can be put in place.

In many respects, the avoidance of technical discussions about some of the
pathological aspects of the Internet remind me of the state of medical
diagnosis prior to the recognition that bacteriology, prophylactics and
inoculation can be only applied following the acceptance of rigorous,
analytic and experimental disciplines.

Our Agenda

The purpose of this paper is to bring to the attention of policy-makers
some of the relevant facts about Anonymous Re-mailers. All of the material
quoted here comes from public sources which are easily accessible to
anyone. The wide-spread current uses of Anonymous Re-mailers should be
sufficient warning that this topic cannot be considered any more as
something hidden, confidential or inappropriate for public discussion.

We find many similarities in the initial denials to the threats from AIDS
by the medical and public health establishment. We are dismayed by the
avoidance of a candid assessment by public officials about the
vulnerability of the Global Information Infrastructure to destructive
information epidemics. The purpose of this paper is to increase the
awareness of potentially deadly risks that may inhibit the potential gains
from the creation of a global information community.

What Is A Re-Mailer?

A re-mailer allows anyone to post messages to newsgroups or to individuals
while remaining anonymous. The identity of the sender is hidden from the
recipient and remains practically untraceable.

An anonymous re-mailer is a program that runs on a computer somewhere on
the Internet. When you send mail to the re-mailer address, the re-mailer
takes your name and your address off of the mail message and forwards it to
its next destination. The recipient gets mail that has no evidence of where
it originally came from, at least not in the headers. You might give away
your secret identity in the body of the message, but that would be the
sender's own fault.

Anonymous re-mailers can be "chained" so that a message is passed on from
one anonymous re-mailer to another, in two or more separate anonymous
"hops" as a way of making physical tracing or monitoring increasingly
difficult.

One of the most prominent anonymous re-mailers is <anon.penet.fi> is in
Finland. It is frequently used by the Russian (ex-KGB) criminal element.
<Anon.penet.fi> assigns a numeric identification to each address from which
it receives mail. Internet recipients can reply to that secret number.
<anon.penet.fi> will also assign to them another anonymous number, and then
forward the reply. This creates a double-blind situation where two people
could have an ongoing exchange and never know who the other person was.
This method of communication is favorite for engaging services of
cybercriminals and for authorizing payment for their acts through a third
party.

<Anon.penet.fi> can be also used to post a message to Usenet as well. The
message can be read by thousands of people, and anyone can send an
anonymous reply to the secret Finnish identity. The readers of this paper
can easily avail themselves of these services without any special training.
Detailed instructions for the use of a remailer service are usually
included in the "help" software posted in the remailer's files. For
example:

To get an anonymous re-mailer address follow the following instruction.
First, you should send mail to: <help at anon.penet.fi>. You'll get back a
nice help file automatically. Next, send mail to <ping at anon.penet.fi>. This
will allocate your number--from now on you'll be something like
<anXXXXXX at anon.penet.fi>, where XXXXXX is your number. Once you have
received your anonymous address you can use it like your normal e-mail
address.

These capabilities are not trivial, but a source of an exhaustive body of
software and communications know-how which can be learned best by
consulting one of the many tutorials about this topic, such
as<ftp.csua.berkeley.edu: /pub/cypherpunks/re-mailer/hal's.remailer.gz>:

Cyberpunk re-mailers allow a person to send mail with no trace of identity.
To use a re-mailer simply do the following:

Add the header Request-Remailing-To: and sending to one of the addresses
listed below. These headers must be typed in exactly. Mail without these
headers is either rejected or delivered to the re-mailer administrators.If
you cannot add the required headers, place two colons (::) on the very
first line of your message, then on the next line type
Request-Remailing-To: and the address you want to send anonymously to. Skip
a line, and then begin the message. By using this method you can send the
message through more than one re-mailer which will certainly ensure that it
will be anonymous. Many re-mailers only allow one recipient per message. A
number of standard Cyberpunk Re-mailers are        available.

There is a wealth of easily accessible step-by-step instructional material
available on the Internet how to use re-mailers and how to evade
countermeasures or possibility of detection from any source. Re-mailer
operators are in frequent contact with each other and exhibit many of the
fraternal habits that previously were shared between amateur radio
operators. Some of the most interesting sources of information are:

Andr� Bacard's anonymous re-mailer FAQ is an excellent nontechnical
introduction.

For a different take on Net anonymity, see L.Detweiler's home page.

Tools

Private Idaho is an anonymous re-mailer utility for Windows, supporting
PGP, the cypherpunks re-mailers,and Mixmaster, and the <alpha.c2.org> alias
server. It too automatically configures itself based on this re-mailer
list.        <ChainMail> is a re-mailer chaining utility for Mac users, by
Jonathan Rochkind. To use it, you need Eudora, MacPGP, and applescript, in
addition to a number of applescript scripting additions. <Privtool> is a
PGP-aware mailer that also supports Mixmaster. The Community ConneXion has
put the Web-premail gateway on its SSL server. That means that you can send
anonymous email from the Web without exposing your message in the clear on
the connection between your Web browser and the gateway. Sameer Parekh's
NEXUS Berkeley / Community ConneXion has a web page set up for sending
anonymous mail from your Web client.        Michael Hobbs has set up Web
gateway to premail. Now you can send anonymous email directly from your Web
browser. Don't use this for extremely sensitive stuff, though, because it
isn't quite as secure as running premail yourself (in particular, the
connection between your Web browser and the gateway is not
encrypted). A good source for re-mailer information is the Anonymity,
re-mailers, and your privacy page compiled by  "Galactus". This is also the
best place to look for information about anon.penet.fi.

Matt Ghio's re-mailer list is available by finger
ingremailer.help.all at chaos.taylored.com. This file also has all the public
keys for PGP-friendly re-mailers. Matt also has a pinging service similar
to this one, available by fingering re-mailer-list at chaos.taylored.com.
Chaos is having problems getting recognized on the Net. Try
re-mailer.help.all at 204.95.228.28 and see if that works any better. Newer
information can be gotten by sending mail to
mg5n+re-mailers at andrew.cmu.edu. Help for the Alpha alias server (also
available in a plain email version. This is the best way to create an alias
for anonymous replies to mail. Not only is it the most cryptographically
secure, but you get to pick the alias nickname of your choice. The email
addresses are of the form <alias at alpha.c2.org>. Highly recommended. Usura's
home page has a bunch of re-mailer related stuff on it, including a help
page on chaining re-mailers.       The Armadillo re-mailer now has its own
Web page. Crown re-mailer help and statistics. Ecafe re-mailer has its own
Web page, including quickie info about how to use the re-mailer without
encryption or any other extras.

Other resources

You want to send secure mail to someone, but don't know their key. Where
are you going to get it? Try the keyserver at MIT. Vince Cate's Cryptorebel
and Cypherpunk page has pointers to lots of cypherpunk resources. John
Perry's jpunix page has info on his MX service for hidden re-mailers, as
well as cool links for Mixmaster and other stuff. Lance Cottrell's home
page, which has his Chain script, the Mixmaster re-mailer client (including
Sun        binaries!) as well as other cypberpunk related topics. Vince
Gambino's re-mailer page has a good collection of re-mailer help files.

Where Do You Find Re-Mailers?

Computers that offer remailing capabilities are operated by individuals or
organizations as a public service, almost always at no charge because it
costs so little to set one up. They are available globally. We offer a
partial list of re-mailers:

$remailer{"extropia"} = "<remail at extropia.wimsey.com> cpunk pgp special";
$remailer{"portal"} = "<hfinney at shell.portal.com> cpunk pgp hash";
$remailer{"alumni"} = "<hal at alumni.caltech.edu> cpunk pgp hash";
$remailer{"bsu-cs"} = "<nowhere at bsu-cs.bsu.edu> cpunk hash ksub";
$remailer{"c2"} = "<remail at c2.org> eric pgp hash reord";
$remailer{"penet"} = "<anon at anon.penet.fi> penet post";
$remailer{"ideath"} = "<remailer at ideath.goldenbear.com> cpunk hash ksub
reord";        $remailer{"hacktic"} = "<remailer at utopia.hacktic.nl> cpunk
mix pgp hash latent cut post ek";        $remailer{"flame"} =
"<remailer at flame.alias.net> cpunk mix pgp. hash latent cut post ek reord";
$remailer{"rahul"} = "<homer at rahul.net> cpunk pgp hash filter";
$remailer{"mix"} = "<mixmaster at remail.obscura.com> cpunk mix pgp hash
latent cut ek ksub        reord ?";        $remailer{"syrinx"} =
"<syrinx at c2.org> cpunk pgp hash cut reord mix post";
$remailer{"ford"} = "<remailer at bi-node.zerberus.de> cpunk pgp hash ksub";
$remailer{"hroller"} = "<hroller at c2.org> cpunk pgp hash latent ek";
$remailer{"vishnu"} = "<mixmaster at vishnu.alias.net> cpunk mix pgp. hash
latent cut ek ksub        reord";        $remailer{"robo"} = "<robo at c2.org>
cpunk hash mix";        $remailer{"replay"} = "<remailer at replay.com> cpunk
mix pgp hash latent cut post ek";        $remailer{"spook"} =
"<remailer at valhalla.phoenix.net> cpunk mix pgp hash latent cut ek reord";
$remailer{"rmadillo"} = "<remailer at armadillo.com> mix cpunk pgp hash
latent cut";        $remailer{"ecafe"} = "<cpunk at remail.ecafe.org> cpunk
mix";        $remailer{"wmono"} = "<wmono at valhalla.phoenix.net> cpunk mix
pgp. hash latent cut ek";        $remailer{"shinobi"} =
"<remailer at shinobi.alias.net> cpunk mix hash latent cut ek reorder";
$remailer{"amnesia"} = "<amnesia at chardos.connix.com> cpunk mix pgp hash
latent cut ek        ksub";        $remailer{"gondolin"} =
"<mix at remail.gondolin.org> cpunk mix pgp hash latent cut ek reord";
$remailer{'alpha'} = '<alias at alpha.c2.org> alpha pgp';
$remailer{'gondonym'} = '<alias at nym.gondolin.org> alpha pgp';        Much
of the knowledge about the characteristics of these re-mailers is available
from        <remailer-list at kiwi.cs.berkeley.edu>

Role Of Encryption

For added protection, users of Anonymous Re-mailers tend to encrypt their
messages just in case one of the remailing links are compromised. PGP
(Pretty Good Privacy) encryption is favored because it is freely available
and easy to use. A typical digital signature would look like this:

-----BEGIN PGP SIGNATURE-----     Version: 2.6.2

iQCVAwUBMPDy4WV5hLjHqWbdAQEqYwQAm+o313Cm2ebAsMiPIwmd1WwnkPXEaYe9
pGR5ja8BKSZQi4TAEQOQwQJaghI8QqZFdcctVYLm569I1/8ah0qyJ+4fOfUiAMda
Sa2nvJR7pnr6EXrUFe1QoSauCASP/QRYcKgB5vaaOOuxyXnQfdK39AqaKy8lPYbw
MfUiYaMREu4=     =9CJW     -----END PGP SIGNATURE-----

For responses the sender will choose a passphrase. This phrase will be used
to encrypt messages sent back to you. The encryption will be single-key
encryption, not PGP's normal public-private key encryption. The reason for
this is that public key encryption is usually not necessary in such cases.
Single-key encryption does not require a database (such as in the widely
used <anon.penet.fi> database for mapping aliases onto addresses), thus
increasing the security of communications among anonymous users.

When a recipient responds to the e-mail, his response will be encrypted
with the sender's pass-phrase. The sender can read the response by saving
it to a file and using PGP on it. PGP will ask for the passphrase, enter
the sender's reply, which will make it possible for the recipient to see
the response to the e-mail. This feature allows both parties to be securely
encrypted, protecting privacy and anonymity in both directions.

How Reliable Are The Re-Mailers?

The knowledge about the characteristics, reliability and trustworthiness of
re-mailers is widely distributed through various bulletin boards. These are
consulted by persons deeply immersed in Internet-related developments.
There is an agile and very active global community that keeps track of the
average latency time, uptime of frequently used re-mailers. They post their
findings, which in many cases is superior to what a commercial customer is
likely to find out about their own data center performance, or about the
service quality offered by Compuserve, America-On-Line of Prodigy. Here is
an excerpt from such a bulletin:

hacktic  remailer at utopia.hacktic.nl       **** *******     7:10  99.85% c2
remail at c2.org                    -.-++ ++-.-+  2:10:42  99.83%
rmadillo remailer at armadillo.com           +++++ ++++++    37:03  99.69%
flame    remailer at flame.alias.net         ** * *******    14:55  99.64% mix
mixmaster at remail.obscura.com     _ _-__...-++ 17:40:48  99.21% amnesia
amnesia at chardos.connix.com        -+ +--+---   2:04:43  99.20% ecafe
cpunk at remail.ecafe.org           ## ##-## #--  1:26:54  99.06% extropia
remail at extropia.wimsey.com       .- -.----_. 13:48:11  99.04% replay
remailer at replay.com               + +** *****     5:36  98.84% shinobi
remailer at shinobi.alias.net       -- -- - - +     54:43  98.78% spook
remailer at valhalla.phoenix.net    *  ***** - *    35:07  98.36% vishnu
mixmaster at vishnu.alias.net       **      #-*#     7:44  98.20% bsu-cs
nowhere at bsu-cs.bsu.edu              #  # ##.#    28:07  97.78% gondolin
mix at remail.gondolin.org           - --_.----   9:45:55  97.62% wmono
wmono at valhalla.phoenix.net          **  *   *    12:23  97.57% hroller
hroller at c2.org                   #*+### -.. #  1:37:24  96.71% ford
remailer at bi-node.zerberus.de     ._...--._.  21:21:22  95.83% portal
hfinney at shell.portal.com         ########*#      27:36  95.55% alumni
hal at alumni.caltech.edu           #     # *  +    25:47  95.29% penet
anon at anon.penet.fi                  . -- --   13:55:20  87.78% rahul
homer at rahul.net                  +* *+**+*  #     4:34  93.71% robo
robo at c2.org                       #-##            5:59  27.86% History key
# response in less than 5 minutes.   * response in less than 1 hour.   +
response in less than 4 hours.   - response in less than 24 hours.   .
response in less than 2 days.

Specialization Of Services

The operators of various re-mailers are specialized in that they cater to
select communities of Internet dwellers. They offer unique services to
customers who are seeking different degrees of anonymity. Cognoscenti in
the field can readily identify remailers who offer meets diffferent tastes
and preferences. Here is an example of remailer characterizations:

<cpunk> A major class of remailers. Supports Request-Remailing-To: field.
<eric> A variant of the cpunk style. Uses Anon-Send-To: instead. <penet>
The third class of remailers (at least for right now). Uses X-Anon-To: in
the header. <pgp> Remailer supports encryption with PGP. A period after the
keyword means that the short name, rather than the full email address,
should be used as the encryption key ID. <hash> Supports ## pasting, so
anything can be put into the headers of outgoing messages. <ksub> Re-mailer
always kills subject header, even in non-pgp mode. <nsub> Re-mailer always
preserves subject header, even in pgp mode. <latent> Supports Matt Ghio's
Latent-Time: option. <cut> Supports Matt Ghio's Cutmarks: option. <post>
Post to Usenet using Post-To: or Anon-Post-To: header. <ek> Encrypt
responses in reply blocks using Encrypt-Key: header. <special> Accepts only
pgp encrypted messages. <mix> Can accept messages in Mixmaster format.
<reord> Claims to foil traffic analysis by reordering messages. <mon>
Re-mailer has been known to monitor contents of private email. <filter>
Re-mailer has been known to filter messages based on content. If not listed
in conjunction with <mon>, then only messages destined for public <alpha>
Supports nyms according to the protocol used by alpha.c2.org. This list
will be featuring reliability and latency measurements soon for these
nymservers.

A fascinating example of specialization is a re-mailer service advertising
the capacity to defeat "traffic analysis" used by intelligence agencies.
All mail to each destination is first sent through <remail at sitename> which
is a standard "cypherpunk" re-mailer with PGP with a few added features.
The outgoing mail is not forwarded immediately upon receipt. Outgoing
messages are stored in a pool until five minutes after each hour, when all
messages in the pool are re-transmitted in a random order, ignoring the
order in which they came in. Each message from the re-mailer is sent
through a random path of other re-mailers in the re-mailernet. This usually
involves between five to 20 "hops" from one re-mailer to another. In each
case care is taken for at least one of the "hops" to be in a country with
especially relaxed laws concerning electronic messages. Such measures would
greatly complicate any tracing that may be contemplated by a
law-enforcement agency.

Why Re-Mailers?

E-mail is as fast and casual as a voice phone call, but can be stored and
retrieved with infinitely greater efficiency than paper letters or taped
conversations. An e-mail message can be re-broadcast the world over, by
anyone who comes across a copy of the transmission. Parts of any message
can be extracted, edited and easily modified. Meanwhile, the e-mail address
of the originator remains a label of its origin. If the storage of that
message is not protected - and it rarely is - it can be accessed by anyone
who takes the trouble to rummage through any of the many archived computer
records that may have received such message. A casual e-mail exchange, with
an identifying address, can be then used to compromise the originator. As
e-mail traffic takes over an ever increasing share of personal
communications, inspection of e-mail traffic can yield more comprehensive
evidence than just about any wire-tapping efforts. E-mail-tapping is less
expensive, more thorough and less forgiving than any other means for
monitoring personal communications. Without protection of privacy, browsing
through e-mail archives would become the preferred way for gathering
evidence in law enforcement cases. It would also be used as the favorite
means for collecting incriminating statements by lawyers engaged in civil
litigation.

In casual e-mail exchanges it is easy to make an error. When the message is
archived it could be used to haunt a person for decades afterwards. A
message intended for a particular individual may be passed on to hundreds
or even thousands of others. Unless its origin is anonymous, all e-mail can
be traced through identifying addresses that preserve the name of the
originator - as well as the names of those who forwarded it - wherever the
message traversed. Unless a message is handled anonymously, a trace is left
about everyone who received it or passed it on. It would be like a letter
that not only identifies the name and address of its author, but also
fingerprints of anyone who ever touched it.

It is one of the fundamental strengths of the Internet that it offers an
almost universal capacity for free expression of ideas. A person's opinions
can be sent anywhere in the world in a matter of minutes, with the
originator's name displayed at the top. Is it consistent with the rights to
individual privacy and freedom of expression to have one's name clearly
associated with a message than may be easily disseminated to unintended
recipients?

The issues here are the rights to the freedom of speech and to the rights
to personal privacy. Having the right to free speech may work well in the
case of verbal expression, but it may cease to have its intended purpose in
face of retaliation that may take place decades later. In a system that
theoretically can have infinitely large memory and indefinitely long
remembrance, the freedom of expression and become abused and perverted by a
government that does not respect individual rights.

With the widespread acceptance of Internet-mediated communications it was
recognized that the simplest way of securing privacy is through anonymity.
That's how anonymous re-mailers came into being. Given the technical
characteristics of Internet, there is nothing to prevent anyone to set up a
private (or public) anonymous remailing service. Any attempt to prohibit or
regulate the use of anonymous re-mailers is technically unfeasible. In a
democratic society it becomes politically unacceptable to suppress
remailers as potential sources of criminal acts. Such absolute prohibitions
would never pass through a legislative process in a free society.

Conclusion

Anonymous re-mailers are here to stay. Like in the case of many virulent
diseases, there is very little a free society can do to prohibit travel or
exposure to sources of infection. The best one can do is to start treating
the pathologies inherent in the Internet in the same way as we have learned
to deal with infectious epidemics. That calls for constructing new
institutions and processes that are analogues to inoculation, immunization,
prophylactics, clean water supply, sewers, hygiene, early detection of
outbreaks of diseases, quarantine, the offices of health examiners, the
Center of Disease Control and the World Health Organization.

The introduction of most of these restrictive means, imposed mostly by
government, were often opposed by those who saw in public health
injunctions infringement of individual rights. In due course an informed
electorate found it expedient to accept most of the sanitary measures for
disease control a bargain that was well worth it.

The history of public health teaches us that suppression of any disease
must be preceded by a thorough understanding of its behavior, its method of
transmission and how it creates its own ecology. As in the case of
smallpox, yellow fever, flu epidemics, AIDS or malaria, it will take
disasters before the public may accept that some forms of restrictions on
the electronic freedom of speech and privacy may be worthwhile.

It was the purpose of this paper to explain the characteristics of
anonymous remailers as one of the potential sources of infectious threats
to the well-being of our information-based civilization. We trust that this
will be seen as a useful contribution to an already raging debate of how to
find a balance between the desirable and the dangerous.

Paul at Strassmann.com and William_Marlow at cpqm.saic.com will be pleased to
respond to identifiable commentators on the points of view expressed
herein.



****************************************************************************
Subscribe to Freematt's Alerts: Pro-Individual Rights Issues
Send a blank message to: freematt at coil.com with the words subscribe FA
on the subject line. List is private and moderated (7-30 messages per week)
Matthew Gaylor,1933 E. Dublin-Granville Rd.,#176, Columbus, OH  43229
****************************************************************************







From s1113645 at tesla.cc.uottawa.ca  Thu Jun 20 16:23:49 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Fri, 21 Jun 1996 07:23:49 +0800
Subject: Federal Key Registration Agency
In-Reply-To: <Pine.SUN.3.91.960620014132.14548A-100000@infinity.c2.org>
Message-ID: <Pine.3.89.9606201224.B27834-0100000@tesla.cc.uottawa.ca>




On Thu, 20 Jun 1996, William Knowles wrote:

> Keep your PGP262.zip disks in ziplock bags and cache them in the backyard,
> forests,The golf courses.  Get a GPS location and escrow the locations with
> with trusted friends using Secret Share.  Payout to Jim Bell's AP service.  
> Move to Canada?

As was recently demonstrated by the passage of a "designer drug law" whose
main purpose was to increase jail time for pot, which nobody in Canada had
asked for and was widely opposed, when the US wants Canada to pass a law,
Canada passes that law. If Washington gives us GAK, it's little brother
Ottawa won't be too far behind. 






From RogErick at aol.com  Thu Jun 20 17:12:39 1996
From: RogErick at aol.com (RogErick at aol.com)
Date: Fri, 21 Jun 1996 08:12:39 +0800
Subject: Take the money, Harry, re.
Message-ID: <960620131908_221438508@emout15.mail.aol.com>


>Harry should take the money.  As Ayn Rand said, "Don't let your morality be
>used against you."
>
>   I believe in the philosophy of law.  As long as it's legal, each person
>can take whatever he is legally entitled to from the government's stolen
>money, as long as he/she doesn't ADVOCATE that the coercive tax system be
>retained.   Many will not take grants, or welfare, but they are legally
>entitled to it.  As for the moral entitlement, that is a matter for them to
>work out for themselves. After all, we have to drive on government (tax
>supported) roads, etc.
>
>Tonie

  I agree with you, Tonie, as usual.
   I struggled with this, for years, until I had a dream.  I was on a 
battlefield, pinned down by enemy fire, and I was out of ammunition.  
There was plenty of slave labor stuff around, on the corpses of enemy 
soldiers, but of course, I couldn't use that, morally,  because it was 
made available by force.
  So I made a decision, and I didn't die in my sleep.

  If libertarians deprive themselves of what is legal, they impoverish 
themselves, relative to the more socialistic others, and the the cancer 
continues to gather strength by taking ours for themselves.
  But that is no reason to continue it in law, when we have the power to 
reverse or negate the law itself, that legalizes theft.
  In a future dream, I will free the slaves with the fruits of their 
forced labor, so they will be forced no more.  I think all libertarians 
fundamentally want to do this.
  So...We need to trust elected libertarians, not to be seduced by 
existing collectivist power, to use it at any and every opportunity, to  
return all power to the individual.   Otherwise, what is the point?
  P.S.  I am unable to afford to go the the National Convention.  Sorry 
to miss seeing all of you who are going.

Roger






From me at muddcs.cs.hmc.edu  Thu Jun 20 17:15:15 1996
From: me at muddcs.cs.hmc.edu (Michael Elkins)
Date: Fri, 21 Jun 1996 08:15:15 +0800
Subject: where'd Bal's PKS go?
Message-ID: <199606201724.KAA07394@muddcs.cs.hmc.edu>


Did it move?  I hadn't seen any announcement of this...

me
-- 
Michael Elkins <me at cs.hmc.edu>			http://www.cs.hmc.edu/~me
PGP key fingerprint = EB B1 68 32 3F B5 54 F9  6C AF 4E 94 5A EB 90 EC





From jimbell at pacifier.com  Thu Jun 20 17:35:23 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 21 Jun 1996 08:35:23 +0800
Subject: Current status of RSA patent...
Message-ID: <199606201757.KAA08100@mail.pacifier.com>


At 10:59 AM 6/20/96 -0400, Intense wrote:
>
>does not matter - it will be renewed in the interest of the government
>The goverment want's there backdoor...  would you expect less?

As far as I know, patents can't be "renewed."  I've heard they can be 
"re-issued," amended, but to my knowledge that doesn't extend their term.

Jim Bell
jimbell at pacifier.com





From llurch at networking.stanford.edu  Thu Jun 20 17:39:10 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Fri, 21 Jun 1996 08:39:10 +0800
Subject: Oil Change software snoops through hard drive
In-Reply-To: <v01510115adedec5bd37a@[204.62.128.229]>
Message-ID: <Pine.GUL.3.93.960620104638.4657A-100000@Networking.Stanford.EDU>


On Wed, 19 Jun 1996, Declan McCullagh wrote:

> Alan forwarded this to me. Thought it might be interesting. -Declan
[..].]
> Unanswered Qs:
> 1) What other kinds of info does/can it troll for?
> 2) What does it do when it finds unregistered software?
> 3) Does it implicate ECPA?
> 4) Will updates be available through other means?
> 5) Must a user affirmatively grant permission to the software agent?
> 6) Can a user decline or limit the agent's access?
> 7) What uses may the agent's owner make of data collected?
> etc.

Well, if you want definitive answers, use Stan Mitchell's File Monitor,
ftp://ftp.ora.com/pub/examples/windows/win95.update/schulman.html#w95fmon

But free to fear-monger in any case...

-rich






From maldrich at grci.com  Thu Jun 20 18:01:44 1996
From: maldrich at grci.com (Mark O. Aldrich)
Date: Fri, 21 Jun 1996 09:01:44 +0800
Subject: This might be interesting...
In-Reply-To: <199606190745.JAA21883@basement.replay.com>
Message-ID: <Pine.SCO.3.93.960620131352.11272C-100000@grctechs.va.grci.com>


On Wed, 19 Jun 1996, Anonymous wrote:

> Do an AltaVista Query on:
> 
> 	url:bmh.com crypto*

Mmmmm.  Mmmmm.  Mmmmmm.  Looks pretty tasty.  Those boys and girls at BMH
obviously have fun jobs. 

Anyone have a password for this site?  The links look cool, but you can't
get at 'em without a password or a hack...

------------------------------------------------------------------------- 
|Just as the strength of the Internet is  |Mark Aldrich                 |
|chaos, so the strength of our liberty    |GRCI INFOSEC Engineering     |
|depends upon the chaos and cacophony of  |maldrich at grci.com            |
|the unfettered speech the First Amendment|MAldrich at dockmaster.ncsc.mil |
|Protects  - Federal Judges on the CDA    |                             |
|_______________________________________________________________________|
|The author is PGP Empowered.  Public key at:  finger maldrich at grci.com |
|    The opinions expressed herein are strictly those of the author     |
|         and my employer gets no credit for them whatsoever.           |
-------------------------------------------------------------------------






From alano at teleport.com  Thu Jun 20 18:08:33 1996
From: alano at teleport.com (Alan Olsen)
Date: Fri, 21 Jun 1996 09:08:33 +0800
Subject: Congress is at it again
Message-ID: <2.2.32.19960620173912.00cde130@mail.teleport.com>


At 08:23 AM 6/20/96 -0400, you wrote:
>There's no imminent Congressinal action here, folks. Note that HR2441
>may be revived next year, but we have a reprieve for now.

I hate to be cynical, but I seem to remember the same thing being said about
the CDA and the Digital Telephony bills.

Things have a strange habit of getting snuck through at the last moment...
---
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.teleport.com/~alano/          | alano at teleport.com  |






From joseph at genome.wi.mit.edu  Thu Jun 20 18:11:32 1996
From: joseph at genome.wi.mit.edu (Joseph Sokol-Margolis)
Date: Fri, 21 Jun 1996 09:11:32 +0800
Subject: This might be interesting...
In-Reply-To: <199606190745.JAA21883@basement.replay.com>
Message-ID: <v03007101adef4d62f738@[18.157.1.107]>


At 1:15 PM -04006/20/96, you wrote:
> On Wed, 19 Jun 1996, Anonymous wrote:
>
> > Do an AltaVista Query on:
> >
> > 	url:bmh.com crypto*
>
> Mmmmm.  Mmmmm.  Mmmmmm.  Looks pretty tasty.  Those boys and girls at BMH
> obviously have fun jobs.
>
> Anyone have a password for this site?  The links look cool, but you can't
> get at 'em without a password or a hack...

Found out how to get a password. Sort of. I explored some of the site and
found this page http://www.bmh.com/ARPA/SynthEnv.html down at the bottom it
says:

Access to the password protected sections of our K/A database may be
obtained by request to
Debbie Adair. Please send an e-mail message explaining your need for
access. Be sure to include a
day time phone number and any pertinent information regarding your
employer/command.
<adair at bmh.com>


I guess it might be military only.



Joseph Sokol-Margolis
joseph at genome.wi.mit.edu
Systems Administrator







From andrew_loewenstern at il.us.swissbank.com  Thu Jun 20 18:30:40 1996
From: andrew_loewenstern at il.us.swissbank.com (Andrew Loewenstern)
Date: Fri, 21 Jun 1996 09:30:40 +0800
Subject: Safemail
In-Reply-To: <199606201529.KAA02594@homeport.org>
Message-ID: <9606201728.AA00969@ch1d157nwk>


Adam Shostack writes:
>  Not to defend the safemail folks, but this does remind me of
>  something that NeXT did with Eliptic curve based systems;
>  there was no storage of the private key, it was generated from
>  the passphrase at run time.

Yup, NeXT did this with their "For Your Eyes Only" demo and the crypto  
extensions for their Mail application.  Although NeXT used an algorithm  
called "FEE" (Fast Elpitic Encryption), you can do it with RSA by hashing the  
passphrase, seeding a random number generator, generating a random prime,  
etc...  It works but it adds a lot of processing time to encryption and  
decryption.

There are other, more serious, drawbacks to such a scheme though.  You can't  
change your passphrase without changing your public key.  People can try to  
guess your passphrase with only your public key.  Crack can guess peoples  
account passwords something like 24% of the time.  I doubt the average joe  
would use much better passphrases for their secret key.  That's a scary  
thought!!  At least with PGP someone has to get a copy of the encrypted  
secret key first.


One interesting thing about NeXT's software is that the Mail application has  
crypto hooks.  The crypto code is in a drop-in bundle that extends the app  
at runtime.  This isn't just a generic interface, but the internationally  
shipped Mail software calls methods in the external bundle that are  
definitely crypto related.  Also, much of the crypto and key management user  
interface ships with the main Mail package.  It is hidden without the crypto  
bundle, but if you peek around with InterfaceBuilder you can see that it is  
there.


andrew





From lzirko at c2.org  Thu Jun 20 18:57:59 1996
From: lzirko at c2.org (Lou Zirko)
Date: Fri, 21 Jun 1996 09:57:59 +0800
Subject: where'd Bal's PKS go?
Message-ID: <199606201826.LAA28040@infinity.c2.org>


-----BEGIN PGP SIGNED MESSAGE-----

To: me at muddcs.cs.hmc.edu, cypherpunks at toad.com
Date: Thu Jun 20 13:26:14 1996
> Did it move?  I hadn't seen any announcement of this...
> 
> me
> -- 
> Michael Elkins <me at cs.hmc.edu>                        
http://www.cs.hmc.edu/~me
> PGP key fingerprint = EB B1 68 32 3F B5 54 F9  6C AF 4E 94 5A EB 90 EC
> 
> 

This is the error i get.  Could we have a rUnaway process?

   ----- Transcript of session follows -----
<<< RCPT To:<pgp-public-keys at BIG-SCREW.MIT.EDU>
<<< DATA
sh: fork failed - too many processes
554 "|/u1/jis/newkeyserver/bin/pks-mail.sh 
/u1/jis/newkeyserver/etc/pksd.conf"... unknown mailer error 1

Lou Zirko                                (502)383-2175
Zystems                                  lzirko at c2.org
"We're all bozos on this bus" - Nick Danger, Third Eye

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1

iQEVAwUBMcmX4MtPRTNbb5z9AQE3mgf/dIQjOBpeaw83FaqnQIj4oaZySYqboUyD
J9/EoaF8kwQmPgeQzCj866AY39H7M7srgurz1YXKu7LrMWBuTkobJnsE/tX2TK+y
AvTUXtQUlite2rL4uV7664F2rG2r0UfMnjjxv7fhul1Ayg7M2k7jVTLKDD9h21Y9
84ZJnVlka7TId5cmAzSWme0/qHyhuIkkgzEP27jxPeg+v9WM2qgMY3kva9W4yCEk
pBxaC7HwJI7vfaurY4dgggakEr4yarBvyITRebYAa02ub8lHTsgAXYsF2I53OPZG
nyphOgst4itOME8g0ePpLKFQ8PLn7M/9qdK7oh7JX0jt5dLpJsvE/Q==
=7Y05
-----END PGP SIGNATURE-----






From vznuri at netcom.com  Thu Jun 20 19:07:14 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Fri, 21 Jun 1996 10:07:14 +0800
Subject: Micropayments: myth?
In-Reply-To: <13618.835214087@odin.nma.com>
Message-ID: <199606201905.MAA29199@netcom21.netcom.com>



more dazed and confused responses on microcurrency... why are people
making this so complicated???

From: Einar Stefferud <Stef at nma.com>
>
>Your analogy breaks because you do not provide for the corresponding
>of connections between the gas tank and the dashboard indicator for
>the case of buying small items from many different vendors.
>
>I can see each vendor site giving you a "gas gauge" indicator, either
>showing how much you have cumulatively charged at a given site, or how
>much is left on your prepaid site account (these are the same thing in
>terms of adding up charges), but I fail to see how your analog applies
>outside the local control of each vendor site.

the *vendor* *does*not* control the "gas gauge". the gauge is presented
by your LOCAL SOFTWARE. (for those late into this, the gas gauge analogy
is used as a visual metaphor for the way a browser would keep track
of microcharges).  it would make *no*sense* for each provider to
create their own gauge. they might create one for their own site
of your transactions, but you absolutely must have a tracking mechanism
that is built into your own software and NOT under the control of the
outside agency. 

don't people get this? with microcurrency, you don't say to a 
seller, "bill me for this item". it would rarely work like that at
all. instead, it is, "here is my money, please give me the item". 
the money exchange is always part of the complete transaction. 
billing is an archaic concept in this paradigm that is superfluous.
you only need it when you can't have instantaneous transactions.

>In short, you have again shown that microcharging systems are limited
>to local accumulations.  Your gas tank example is limited to the car
>you are driving, and does not tell you anything about anything else.

the gas gauge analogy seemed transparently obvious to me. 
you are proving a rule I've noted in cyberspace, that if anything
can be misunderstood, it will be.  you are confusing yourself. 

the analogy would be more like the
following: you can drive on different roads, and some take more
gas than others. but the roads cannot themselves suck gas
out of your tank or change your gas meter.

>Unfortunately, you appear to be applying the idea to a collection of
>vendors which you wish to visit, which means that someone somewhere
>must be getting the disparate charges from different vendors to update
>your singular gas gauge.

NO, NO, NO!!!! your local software controls your gas gauge. NOBODY
ELSE. furthermore, the site *never* grabs money from you. this is
a *billing* paradigm. you either send money, or no money can
be transferred. the site can *request* money but such a system
would only be automatic if the charge fell within the minimal limits
set by the user (i.e. max $1.00 per hour, max 5c per transaction,
max 10 transactions per minute, or whatever--  all this is 
trivial to implement)

>Drawing analogies is great fun, but all analogies break at some point
>in their life, because they abstract away enough detail to paint a
>simplified picture.  Sometime this leads to complete failure to map as
>intended.

analogies are meant to help people understand something simple. if the
thing itself is simple, and people can't even understand it in
the simple state, often the analogy will confuse them even further.

>}The billing happens, as others have previously noted, entirely at the 
>}client side.  There's no reason the wallet or web browser can't keep a 
>}log of expenditures, and there's no chance for spoofery at that point 
>}(the wallet knows where it sent money).  

I wish people would stop talking about BILLING in regard to microcurrency.
I believe it is mostly a flawed concept that is not largely going to
apply to microcurrency. perhaps some other term is appropriate, any
takers? it seems to me a lot of the misconceptions I've been seeing
are based on the idea that BILLING would somehow be involved. 
billing is involved in cash systems in which you dissociate the
transfer of material from the transaction. this will generally
not happen with microcurrency imho, and it is largely only useful
with transactions that allow coupling of the material and the money
in one swipe, such as for a http file download or whatever.






From Paul.Rarey at Clorox.com  Thu Jun 20 19:27:46 1996
From: Paul.Rarey at Clorox.com (Paul Rarey)
Date: Fri, 21 Jun 1996 10:27:46 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606201905.MAA29199@netcom21.netcom.com>
Message-ID: <960620130516.ZM32734@maverick.clorox.com>


On Jun 20, 12:05, Vladimir Z. Nuri wrote:
> Subject: Re: Micropayments: myth?

[ snip ]

>don't people get this? with microcurrency, you don't say to a 
>seller, "bill me for this item". it would rarely work like that at
>all. instead, it is, "here is my money, please give me the item". 

What is the authentication process for the "money" your are "giving" in this 
scenario?

Cheers!
[ psr ]





From me at muddcs.cs.hmc.edu  Thu Jun 20 19:28:04 1996
From: me at muddcs.cs.hmc.edu (Michael Elkins)
Date: Fri, 21 Jun 1996 10:28:04 +0800
Subject: Current status of RSA patent...
In-Reply-To: <Pine.LNX.3.91.960620105421.115A-100000@invictor.miworld.net>
Message-ID: <199606202028.NAA18713@muddcs.cs.hmc.edu>


Intense writes:
> does not matter - it will be renewed in the interest of the government
> The goverment want's there backdoor...  would you expect less?
> 
> the only pgp I will use is that from MIT
> it has no back door

This does not make sense...  If you believe that RSA has a back door, then
PGP _must_ have a back door because PGP uses it!  It does not matter if
it was independently coded and reviewed.  There could still be a back door
if it was made that way intentionally.

me
-- 
Michael Elkins <me at cs.hmc.edu>			http://www.cs.hmc.edu/~me
PGP key fingerprint = EB B1 68 32 3F B5 54 F9  6C AF 4E 94 5A EB 90 EC





From perry at piermont.com  Thu Jun 20 19:41:00 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Fri, 21 Jun 1996 10:41:00 +0800
Subject: Current status of RSA patent...
In-Reply-To: <Pine.LNX.3.91.960620105421.115A-100000@invictor.miworld.net>
Message-ID: <199606202101.RAA29560@jekyll.piermont.com>



Intense writes:
> does not matter - it will be renewed in the interest of the government
> The goverment want's there backdoor...  would you expect less?
> 
> the only pgp I will use is that from MIT
> it has no back door

Been popping magic mushrooms again?





From jimbell at pacifier.com  Thu Jun 20 19:54:06 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 21 Jun 1996 10:54:06 +0800
Subject: Take the money, Harry.
Message-ID: <199606202051.NAA03879@mail.pacifier.com>


At 01:25 AM 6/20/96 -0800, Tonie Nathan wrote:
>>  Jim, 
>Harry should take the money.  As Ayn Rand said, "Don't let your morality be
>used against you."
>
>   I believe in the philosophy of law.  As long as it's legal, each person
>can take whatever he is legally entitled to from the government's stolen
>money, as long as he/she doesn't ADVOCATE that the coercive tax system be
>retained.   Many will not take grants, or welfare, but they are legally
>entitled to it.  As for the moral entitlement, that is a matter for them to
>work out for themselves. After all, we have to drive on government (tax
>supported) roads, etc.
>
>Tonie

[for the record, Tonie Nathan was the 1976 (?) Libertarian Vice Presidential 
Candidate.  Right, Tonie?]

I think the issue is fairly clear-cut, from a libertarian standpoint, _IF_ 
the money is accepted simply to be returned to the people it was stolen 
from.  That reduces the size of the net theft, produces publicity, and wakes 
the public up.

Jim Bell
jimbell at pacifier.com





From dnew at yuan.fv.com  Thu Jun 20 20:33:39 1996
From: dnew at yuan.fv.com (Darren New)
Date: Fri, 21 Jun 1996 11:33:39 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606202143.OAA04899@netcom13.netcom.com>
Message-ID: <Pine.LNX.3.93.960620151331.2161B-100000@yuan.fv.com>


> [...] "float" theoretically
> evaporates with microcurrency)

Ah, hmmm? How do you buy your microcurrency? Who has the float while you
have cyberbucks on your disk.  The float doesn't evaporate. It just goes
different places.

--
 Darren New / Dir. of Custom Software Design / First Virtual Holdings Inc.
  http://www.fv.com or info at fv.com  -=|=-  PGP Key: ftp://ftp.fv.com/pub/fv






From mccoy at communities.com  Thu Jun 20 20:36:34 1996
From: mccoy at communities.com (Jim McCoy)
Date: Fri, 21 Jun 1996 11:36:34 +0800
Subject: Oil Change software snoops through hard drive
Message-ID: <v02140b00adef81075f5b@[205.162.51.35]>


Declan writes:
> Alan forwarded this to me. Thought it might be interesting. -Declan
[...auto updating software...]
> Unanswered Qs:
[...intersting questions which are raised by such a service...]

I saw no mention of authentication between the Oil Change client and server,
so the first question that I had was "how do you know if you are actually
connecting to the legitimate Oil Change server?"

Since the updates are via dialup a few bridge clips in the right location
would be all it takes to have the call re-routed to someone else's server
(and if the update is done over the net hijacking the system is not much
harder...) Once you have people getting your server instead of the Oil
Change server you _own_ their machine.  You can install whatever trojan
horses or backdoors you want under the guise of an update or direct the
user to pull a hacked update from a server you designate (and it wouldly
not be hard to set up a dummy software package so that even if you later
lose your override of the system or remove it to cover your tracks the
system continues to keep your backdoors installed.)  This is some very bad
mojo.

A little social engineering or midnight wiring and there will be a lot of
people in a world of pain. Nothing like designing a system which takes your
weak spot and makes it a security problem for every one of your customers...

jim







From WlkngOwl at unix.asb.com  Thu Jun 20 20:43:06 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Fri, 21 Jun 1996 11:43:06 +0800
Subject: Safemail
Message-ID: <199606202137.RAA02239@unix.asb.com>


On 20 Jun 96 at 10:29, Adam Shostack wrote in cypherpunks at toad.com:

> Not to defend the safemail folks, but this does remind me of something
> that NeXT did with Eliptic curve based systems; there was no storage
> of the private key, it was generated from the passphrase at run time.
> It was a side discussion, maybe with Andrew Lorenstien?  Andrew?

> Daniel R. Oelke wrote:

The HKS archives are still down, but a while back on the coderpunks 
list was an interestng idea about hashing a passphrase to seed a 
crypto PRNG and used the first good set of primes etc. for a secret 
and private key pair.  Only the private key is saved in such a case.

Rob
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From exalt at miworld.net  Thu Jun 20 20:50:24 1996
From: exalt at miworld.net (Intense)
Date: Fri, 21 Jun 1996 11:50:24 +0800
Subject: Current status of RSA patent...
In-Reply-To: <199606202101.RAA29560@jekyll.piermont.com>
Message-ID: <Pine.LNX.3.91.960620173417.120B-100000@invictor.miworld.net>



On Thu, 20 Jun 1996, Perry E. Metzger wrote:

> 
> Intense writes:
> > does not matter - it will be renewed in the interest of the government
> > The goverment want's there backdoor...  would you expect less?
> > 
> > the only pgp I will use is that from MIT
> > it has no back door
> 
> Been popping magic mushrooms again?
> 
> 

ive not had one of those in a long time :>


               *          <exalt at miworld.net>           *







From froomkin at law.miami.edu  Thu Jun 20 21:32:48 1996
From: froomkin at law.miami.edu (Michael Froomkin)
Date: Fri, 21 Jun 1996 12:32:48 +0800
Subject: Access Via Anonymous Re-Mailers (fwd)
In-Reply-To: <Pine.SUN.3.94.960620132244.17963B-100000@netcom17>
Message-ID: <Pine.SUN.3.94.960620160739.18365A-100000@viper.law.miami.edu>


Thank you for posting this piece of nonsense, discussed some time ago on
this list, when a pointer to the URL would have been amply sufficient. 

For another view, including a backhanded dismissal of those arguments,
see, 

http://www.law.miami.edu/~froomkin/arbitr.htm

[Moving to  http://www.law.miami.edu/~froomkin/articles/arbitr.htm 
at some point....]

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin at law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's hot here.  And humid.







From jimbell at pacifier.com  Thu Jun 20 21:33:09 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 21 Jun 1996 12:33:09 +0800
Subject: [SF Bay Area] Security And Freedom through Encryption Forum
Message-ID: <199606201959.MAA00994@mail.pacifier.com>


>SAFE: Security And Freedom through Encryption Forum, July 1, 1996
>=================================================================
>   For a national encryption policy that promotes commerce and protects
>   privacy
>   Encryption technologies, the "locks and keys" of the Information Age,
>   are an essential component of a secure and trusted Global Information
>   Infrastructure. Every day, millions of dollars in commercial
>   transactions and the private communications of individuals traverse
>   the global network. All are vulnerable to the prying eyes of
>   industrial spies, hackers, and rogue foreign governments.

I'm more worried about rogue DOMESTIC governments, myself.
Jim Bell
jimbell at pacifier.com





From bobf at efn.org  Thu Jun 20 21:46:11 1996
From: bobf at efn.org (Bob Fauvre)
Date: Fri, 21 Jun 1996 12:46:11 +0800
Subject: NWLibs> Take the money, Harry.
In-Reply-To: <199606200831.BAA16798@haus.efn.org>
Message-ID: <Pine.SUN.3.91.960620162126.27290B-100000@garcia.efn.org>



Right on, Tonie!

bobf
On Thu, 20 Jun 1996, Tonie Nathan wrote:

> >  Jim, 
> Harry should take the money.  As Ayn Rand said, "Don't let your morality be
> used against you."
> 
>    I believe in the philosophy of law.  As long as it's legal, each person
> can take whatever he is legally entitled to from the government's stolen
> money, as long as he/she doesn't ADVOCATE that the coercive tax system be
> retained.   Many will not take grants, or welfare, but they are legally
> entitled to it.  As for the moral entitlement, that is a matter for them to
> work out for themselves. After all, we have to drive on government (tax
> supported) roads, etc.
> 
> Tonie
> 





From Stef at nma.com  Thu Jun 20 22:24:56 1996
From: Stef at nma.com (Einar Stefferud)
Date: Fri, 21 Jun 1996 13:24:56 +0800
Subject: Micropayments: myth?
In-Reply-To: <199606201905.MAA29199@netcom21.netcom.com>
Message-ID: <16750.835302666@odin.nma.com>


Hmmm,,, In general, when someone says something this is misunderstood,
it is upon the speaker to make it understandable, though it of course
helps if the listener is trying to understand.

Shall we continue to argue about which of us are being responsible
speakers/listeners, or disucuss the subject at hand.

I fear that I did not see in yoru text any mention of requiring the
transfer of microcurency during the transaction.  Yes, of course, if
you solve the microcurrency problem, so that I am actually
transferring value while my "gas gauge" is measuring the flow.

But, without a solution to the microcurrency problem, you are speaking
in entirely hypothetical terms.  

This started as a discussion of micro-charging and micro-payment, and
now is a discussion of micro-currency, ala eCash.  As such, I have
nothing to contribute;-).,..

I somehow missed the conversion signals;-)...Cheers...\Stef

>From your message Thu, 20 Jun 96 12:05:55 -0700:
}
}
}more dazed and confused responses on microcurrency... why are people
}making this so complicated???
}
}From: Einar Stefferud <Stef at nma.com>
}>
}>Your analogy breaks because you do not provide for the corresponding
}>of connections between the gas tank and the dashboard indicator for
}>the case of buying small items from many different vendors.
}>
}>I can see each vendor site giving you a "gas gauge" indicator, either
}>showing how much you have cumulatively charged at a given site, or how
}>much is left on your prepaid site account (these are the same thing in
}>terms of adding up charges), but I fail to see how your analog applies
}>outside the local control of each vendor site.
}
}the *vendor* *does*not* control the "gas gauge". the gauge is presented
}by your LOCAL SOFTWARE. (for those late into this, the gas gauge analogy
}is used as a visual metaphor for the way a browser would keep track
}of microcharges).  it would make *no*sense* for each provider to
}create their own gauge. they might create one for their own site
}of your transactions, but you absolutely must have a tracking mechanism
}that is built into your own software and NOT under the control of the
}outside agency. 
}
}don't people get this? with microcurrency, you don't say to a 
}seller, "bill me for this item". it would rarely work like that at
}all. instead, it is, "here is my money, please give me the item". 
}the money exchange is always part of the complete transaction. 
}billing is an archaic concept in this paradigm that is superfluous.
}you only need it when you can't have instantaneous transactions.
}
}>In short, you have again shown that microcharging systems are limited
}>to local accumulations.  Your gas tank example is limited to the car
}>you are driving, and does not tell you anything about anything else.
}
}the gas gauge analogy seemed transparently obvious to me. 
}you are proving a rule I've noted in cyberspace, that if anything
}can be misunderstood, it will be.  you are confusing yourself. 
}
}the analogy would be more like the
}following: you can drive on different roads, and some take more
}gas than others. but the roads cannot themselves suck gas
}out of your tank or change your gas meter.
}
}>Unfortunately, you appear to be applying the idea to a collection of
}>vendors which you wish to visit, which means that someone somewhere
}>must be getting the disparate charges from different vendors to update
}>your singular gas gauge.
}
}NO, NO, NO!!!! your local software controls your gas gauge. NOBODY
}ELSE. furthermore, the site *never* grabs money from you. this is
}a *billing* paradigm. you either send money, or no money can
}be transferred. the site can *request* money but such a system
}would only be automatic if the charge fell within the minimal limits
}set by the user (i.e. max $1.00 per hour, max 5c per transaction,
}max 10 transactions per minute, or whatever--  all this is 
}trivial to implement)
}
}>Drawing analogies is great fun, but all analogies break at some point
}>in their life, because they abstract away enough detail to paint a
}>simplified picture.  Sometime this leads to complete failure to map as
}>intended.
}
}analogies are meant to help people understand something simple. if the
}thing itself is simple, and people can't even understand it in
}the simple state, often the analogy will confuse them even further.
}
}>}The billing happens, as others have previously noted, entirely at the 
}>}client side.  There's no reason the wallet or web browser can't keep a 
}>}log of expenditures, and there's no chance for spoofery at that point 
}>}(the wallet knows where it sent money).  
}
}I wish people would stop talking about BILLING in regard to microcurrency.
}I believe it is mostly a flawed concept that is not largely going to
}apply to microcurrency. perhaps some other term is appropriate, any
}takers? it seems to me a lot of the misconceptions I've been seeing
}are based on the idea that BILLING would somehow be involved. 
}billing is involved in cash systems in which you dissociate the
}transfer of material from the transaction. this will generally
}not happen with microcurrency imho, and it is largely only useful
}with transactions that allow coupling of the material and the money
}in one swipe, such as for a http file download or whatever.
}





From reagle at rpcp.mit.edu  Thu Jun 20 22:48:41 1996
From: reagle at rpcp.mit.edu (Joseph M. Reagle Jr.)
Date: Fri, 21 Jun 1996 13:48:41 +0800
Subject: Search for WWW consultants.
Message-ID: <9606202345.AA07200@rpcp.mit.edu>


        If anyone out there is interested in doing some SSL work, talk to
David Normandin at the number below. Feel free to forward this to people you
know that would be interested in doing this sort of work in the Boston area.

>X-Sender: ceim at careerenhancement.com (Unverified)
>Date: Thu, 20 Jun 1996 15:37:04 -0500
>To: reagle at rpcp.mit.edu
>From: concepts at careercncepts.com (Career enhancement)
>Subject: Search for WWW consultants.
>
>Hi Joe, thanks for helping me with this. What I'm looking for are skill sets
>in secured socket layers for the WWW, and those with search engines
>skills.These are very HOT,long term assignments with rates paying between
>60 & 90 on an hourly rate. In addition I also have multiple needs for CGI &
>Perl scripting consultants. Please have them forward thier information to
>me via e-mail, fax @ 617-270-4443 or call me @ 617-270-4441. Again thanks
>for your help and good luck in NY. David Normandin
_______________________
Regards,            Democracy is where you can say what you think 
                    even if you don't think. -
Joseph  Reagle      http://rpcp.mit.edu/~reagle/home.html
reagle at mit.edu      E0 D5 B2 05 B6 12 DA 65  BE 4D E3 C1 6A 66 25 4E






From vznuri at netcom.com  Thu Jun 20 22:54:05 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Fri, 21 Jun 1996 13:54:05 +0800
Subject: Micropayments: myth?
In-Reply-To: <16750.835302666@odin.nma.com>
Message-ID: <199606202143.OAA04899@netcom13.netcom.com>


a brief epistle as to the point as I can make it:

there are two money models that people are continuously conflating here:

1. I send money to someone who is selling something. they send me
that something. by definition, no billing was involved here.

2. I send a request to someone who is selling something. they send
me the something, along with a bill, which I have to pay, or possibly
decide not to. (the thing may arrive before or after the bill, 
wehther I pay, etc)

(2) is a whole class of systems in existence today, such as your cable
bill, your phone bill, etc.  much of these systems *might* be 
better implemented as (1) if/when (1) becomes available. (example,
your tv is charged micromoney, etc). but not *all* of them will be. 
(example: maybe phone companies prefer to accumulate chages and bill
at end of month. also, major "float" issues are often involved
here, although in that case not in their favor. "float" theoretically
evaporates with microcurrency)

regarding (2), it would be *possible* to have a billing system
that involved microcharges, but frankly I don't think this will
be very feasible or a wide use of the system. (1) and microcurrency
go together. (2) and microcurrency do not. is this fairly apparent
or should I give more examples?

lets say I consider hitting a web page that has a "rate" of 2c. I would not
call that a "bill". I haven't hit the page yet or requested a service.
but when I hit the page, the page says, "send me 2c". I would not 
call that a bill so much either in the classic sense-- it would be
like saying a cashier bills you when you hand them cash. well, yes,
in a strange way I guess but not really.

note that (1) presupposes that you actually have a cash type system.
systems such as credit cards whereby the payment is not necessarily
ensured, stuff like defaulting or rejecting a purchase etc. don't
fit in too well with microcurrency, in which we are talking about cash.





From exalt at miworld.net  Thu Jun 20 23:53:08 1996
From: exalt at miworld.net (Intense)
Date: Fri, 21 Jun 1996 14:53:08 +0800
Subject: Current status of RSA patent...
In-Reply-To: <199606201757.KAA08100@mail.pacifier.com>
Message-ID: <Pine.LNX.3.91.960620173131.120A-100000@invictor.miworld.net>


On Thu, 20 Jun 1996, jim bell wrote:

> At 10:59 AM 6/20/96 -0400, Intense wrote:
> >
> >does not matter - it will be renewed in the interest of the government
> >The goverment want's there backdoor...  would you expect less?
> 
> As far as I know, patents can't be "renewed."  I've heard they can be 
> "re-issued," amended, but to my knowledge that doesn't extend their term.

That is probably true...  But, i am sure that goverment is going to want 
to keep there backdoors, they have showed no interest in it's citizens 
priviciy as of yet...  and i doubt they have changed... 

MdS


               *          <exalt at miworld.net>           *








From froomkin at law.miami.edu  Thu Jun 20 23:57:40 1996
From: froomkin at law.miami.edu (Michael Froomkin)
Date: Fri, 21 Jun 1996 14:57:40 +0800
Subject: Federal Key Registration Agency
In-Reply-To: <Pine.3.89.9606201224.B27834-0100000@tesla.cc.uottawa.ca>
Message-ID: <Pine.SUN.3.94.960620211746.20271D-100000@viper.law.miami.edu>


I have seen the text of the speech.  The wire service accounts wildly,
wildly exaggerate.  This is a non-story...except for AG Reno's assertion
that it would take the government a year to break one DES message with a
"supercomputer".  She presumably believes this.  We know the number for
known plaintext attacks, but assuming you don't have a known plaintext,
what's a more reasonable assumption? 

[This message may have been dictated with Dragon Dictate 2.01. 
Please be alert for unintentional word substitutions.]

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin at law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's hot here.  And humid.






From tcmay at got.net  Fri Jun 21 00:31:18 1996
From: tcmay at got.net (Timothy C. May)
Date: Fri, 21 Jun 1996 15:31:18 +0800
Subject: Stop Cross-Copying (Re: Take the money, Harry, re.)
Message-ID: <adef526200021004eca4@[205.199.118.202]>


At 5:19 PM 6/20/96, RogErick at aol.com wrote:

>  I agree with you, Tonie, as usual.
>   I struggled with this, for years, until I had a dream.  I was on a
>battlefield, pinned down by enemy fire, and I was out of ammunition.
....


Hey, folks, I'm a libertarian, and even voted for John Hospers in 1972. But
the Cypherpunks mailing list has over 1200 subscribers, and cross-copying
to it for these debates is not a good idea. I presume the same is true
about cross-copying Cypherpunks stuff onto "nwlibertarians at teleport.co,"
but I can't say for sure.

What I know is that wide cross-posting (or cross-copying) is the bane of
lists these days. There are so many lists, so much overlap, that the
temptation is great to cc: any conceivably-related list.

Hey, no one speaks for Cypherpunks, least of all me, but I think
cross-copying between libertarian, or digital commerce, or Wobbly, or
International Socialist Women of Color, or Unabomber Brigade mailing lists
to the Cypherpunks list is inappropriate.

--Tim May, member of Cypherpunks list, but not the others

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From tcmay at got.net  Fri Jun 21 01:04:16 1996
From: tcmay at got.net (Timothy C. May)
Date: Fri, 21 Jun 1996 16:04:16 +0800
Subject: Safemail
Message-ID: <adef550a010210048c61@[205.199.118.202]>


At 5:32 PM 6/20/96, Deranged Mutant wrote:
>On 20 Jun 96 at 10:29, Adam Shostack wrote in cypherpunks at toad.com:
>
>> Not to defend the safemail folks, but this does remind me of something
>> that NeXT did with Eliptic curve based systems; there was no storage
>> of the private key, it was generated from the passphrase at run time.
>> It was a side discussion, maybe with Andrew Lorenstien?  Andrew?
>
>> Daniel R. Oelke wrote:
>
>The HKS archives are still down, but a while back on the coderpunks
>list was an interestng idea about hashing a passphrase to seed a
>crypto PRNG and used the first good set of primes etc. for a secret
>and private key pair.  Only the private key is saved in such a case.

I haven't seen this particular idea, but a general point to always bear in
mind is that "entropy doesn't increase" (despite what you may have heard
about that other kind of entropy....).

To wit, if there are N bits of entropy in a passphrase (or whatever is the
basic key, be it typed in, read from a floppy, whatever), then no amount of
deterministic crunching by a PRNG (or whatever) will increase this.

(I say "deterministic" in the sense that all parties presumably need to run
the same PRNG and get the same output from the same "seed" (= passphrase,
in this scheme). Thus, the PRNG cannot add additional randomness or
entropy. Unless I am misunderstanding the proposal...)

So, if the passphrase is 22 characters, as in the "Safemail" proposal (such
as it is), that's all that can be gotten. Period. There just aren't enough
"places" in the space of starting points. Anyone with access to the
algorithms used to process the 22 characters (154 bits if 7 bits are used
for each character) can brute force search the space in a relatively short
time. (If the later processing algorithms are supposed to be "secret," then
of course this a cryptographic faux pas of the first magnitude, usually
dismissed as "security through obscurity.")

By the way, amongst other defects, "Safemail" is a pretty bad name for a
company, being that RSA Data Security has or had a product called
"MailSafe."

(The same thing happened with the Web search tool made by "Architext."
There was a Macintosh hypertext program with the same name, which I bought
in 1990. Someone I knew who worked for Architext was confused by my
denunciation of Architext....such name collisions make for interesting
situations.)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From jya at pipeline.com  Fri Jun 21 01:22:39 1996
From: jya at pipeline.com (John Young)
Date: Fri, 21 Jun 1996 16:22:39 +0800
Subject: The Rise of the Virtual State
Message-ID: <199606210056.AAA26214@pipe1.t2.usa.pipeline.com>


   Foreign Affairs, July/August, 1996. 
 
   "The Rise of the Virtual State" [Excerpts] 
 
      Richard Rosecrance, UCLA Professor of Political Science 
 
 
   Amid the supposed clamor of contending cultures and 
   civilizations, a new reality is emerging. The nation-state 
   is becoming a tighter, more vigorous unit capable of 
   sustaining the pressures of worldwide competition. 
   Developed states are putting aside military, political, and 
   territorial ambitions as they struggle not for cultural 
   dominance but for a greater share of world output. 
   Countries are not uniting as civilizations and girding for 
   conflict with one another. Instead, they are downsizing -- 
   in function if not in geographic form. Today and for the 
   foreseeable future, the only international civilization 
   worthy of the name is the governing economic culture of the 
   world market. 
 
   Timeworn methods of augmenting national power and wealth 
   are no longer effective. Like the headquarters of a virtual 
   corporation, the virtual state determines overall strategy 
   and invests in its people rather than amassing expensive 
   production capacity. It contracts out other functions to 
   states that specialize in or need them. Imperial Great  
   Britain may have been the model for the nineteenth century, 
   but Hong Kong will be the model for the 21st. 
 
   As a result of these trends, the world may increasingly 
   become divided into "head" and "body" nations, or nations 
   representing some combination of those two functions. 
   The world is embarked on a progressive emancipation from 
   land as a determinant of production and power. 
 
   Diminishing their command of real estate and productive 
   assets, nations are downsizing, in functional if not in 
   geographic terms. Small nations have attained peak 
   efficiency and competitiveness, and even large nations have 
   begun to think small. If durable access to assets elsewhere 
   can be assured, the need to physically possess them 
   diminishes. 
 
   The virtual state is an agile entity operating in twin 
   jurisdictions: abroad and at home. It is as prepared to 
   mine gains overseas as in the domestic economy. But in 
   large countries, internationalization operates 
   differentially. Political and economic decision-makers have 
   begun to recast their horizons, but middle managers and 
   workers lag behind. They expect too much and give and learn 
   too little. That is why the dawn of the virtual state must 
   also be the sunrise of international education and 
   training. The virtual state cannot satisfy all its 
   citizens. The possibility of commanding economic power in 
   the sense of effective state control has greatly declined. 
   Displaced workers and businesspeople must be willing to 
   look abroad for opportunities. In the United States, they 
   can do this only if American education prepares the way. 
 
   ---------- 
 
   http://pwp.usa.pipeline.com/~jya/vstate.txt   (39 kb) 
 
   VST_ate 
 
 
 
 
 
 
 





From frogfarm at yakko.cs.wmich.edu  Fri Jun 21 01:33:05 1996
From: frogfarm at yakko.cs.wmich.edu (Damaged Justice)
Date: Fri, 21 Jun 1996 16:33:05 +0800
Subject: Bal's PKS; pgp.net?
Message-ID: <199606210100.VAA15440@yakko.cs.wmich.edu>


In addition to Bal's public key server being unavailable...

www.pgp.net yields University of Paderborn's Mathematics department in
Germany, with a link to a page in English which currently doesn't exist.

--
The word "gaijin" literally means "foreign person". Many Westerners like to
think that the Japanese use it in the same way as the Grand Dragon of the Ku
Klux Klan uses "nigger", but it ain't really true. They use it when they mean
"nigger", but they also sometimes use it to mean "honorable nigger".
 - Bill Lambert in soc.couples.intercultural
 





From WlkngOwl at unix.asb.com  Fri Jun 21 01:36:10 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Fri, 21 Jun 1996 16:36:10 +0800
Subject: Safemail
Message-ID: <199606210343.XAA10443@unix.asb.com>


On 20 Jun 96 at 12:28, Andrew Loewenstern wrote:
[..]
> There are other, more serious, drawbacks to such a scheme though.  You can't  
> change your passphrase without changing your public key.  People can try to  
> guess your passphrase with only your public key.  Crack can guess peoples  
> account passwords something like 24% of the time.  I doubt the average joe  
> would use much better passphrases for their secret key.  That's a scary  
> thought!!  At least with PGP someone has to get a copy of the encrypted  
> secret key first.

You could require *very good* passphrases.

Rather than changing a passphrase, revoke the key. Perhaps expire 
keys after a certain period of time.

Longer lasting keys (such as a digital timestamp service) would save 
private keys with a protected password instead.

 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From fredfjr at netserver.nti.net  Fri Jun 21 06:26:41 1996
From: fredfjr at netserver.nti.net (Frederick H. Fisher, JR.)
Date: Fri, 21 Jun 1996 21:26:41 +0800
Subject: where'd Bal's PKS go?
Message-ID: <1.5.4.32.19960621040145.00688c10@nti.net>


-----BEGIN PGP SIGNED MESSAGE-----

At 10:24 AM 6/20/96 -0700, you wrote:
>Did it move?  I hadn't seen any announcement of this...

I just visited the site earlier tonight and it seemed to be working...it took me a couple of tries but I was  able to extract a key from there.

But just to make sure, the one I visited is at:

http://www-swiss.ai.mit.edu/~bal/pks-commands.html



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcodwlzzEIlY82+tAQF/BQP9HrT1ThbfmxcTWHZ6V55eAqVJysC2g1yU
T2cCHvXGxYvCf7jU4YyJMUgNThCbIC/GIv6MZzZ4SPaej8jky5qs+KH6urDEXwXe
d2YBeXihOxQ/5lEBMgniB61DcPjvcK4nl8MhVsn+3r+/9c5/kfTNEXAMK820gIEc
94BO0/MFf0I=
=A1Um
-----END PGP SIGNATURE-----






From jimbell at pacifier.com  Fri Jun 21 06:27:34 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 21 Jun 1996 21:27:34 +0800
Subject: Current status of RSA patent...
Message-ID: <199606210424.VAA28110@mail.pacifier.com>


At 05:32 PM 6/20/96 -0400, Intense wrote:
>On Thu, 20 Jun 1996, jim bell wrote:
>
>> At 10:59 AM 6/20/96 -0400, Intense wrote:
>> >
>> >does not matter - it will be renewed in the interest of the government
>> >The goverment want's there backdoor...  would you expect less?
>> 
>> As far as I know, patents can't be "renewed."  I've heard they can be 
>> "re-issued," amended, but to my knowledge that doesn't extend their term.
>
>That is probably true...  But, i am sure that goverment is going to want 
>to keep there backdoors, they have showed no interest in it's citizens 
>priviciy as of yet...  and i doubt they have changed... 

Yes, it's true.  I happen to believe that the only purpose the government 
had in granting patents on public key and RSA is to help keep it from the 
public.  They did a fair job, but the patents expire in 1-4 years and it'll 
be too late by then.  Their attempts to foist the Clipper standard on us 
didn't work.

Jim Bell
jimbell at pacifier.com





From exalt at miworld.net  Fri Jun 21 06:27:58 1996
From: exalt at miworld.net (Intense)
Date: Fri, 21 Jun 1996 21:27:58 +0800
Subject: Current status of RSA patent...
In-Reply-To: <199606210424.VAA28110@mail.pacifier.com>
Message-ID: <Pine.LNX.3.91.960621003157.2092D-100000@invictor.miworld.net>



On Thu, 20 Jun 1996, jim bell wrote:

> At 05:32 PM 6/20/96 -0400, Intense wrote:
> 
> Yes, it's true.  I happen to believe that the only purpose the government 
> had in granting patents on public key and RSA is to help keep it from the 
> public.  They did a fair job, but the patents expire in 1-4 years and it'll 
> be too late by then.  Their attempts to foist the Clipper standard on us 
> didn't work.

Tho, I do belive, that the goverment wil never stop in it's quest to own 
its citizens.   This is changing the subject to much so i wont write on 
it...  :)

anyway..; 

Matt


               *          <exalt at miworld.net>           *








From tcmay at got.net  Fri Jun 21 06:44:45 1996
From: tcmay at got.net (Timothy C. May)
Date: Fri, 21 Jun 1996 21:44:45 +0800
Subject: "Filegate" may be good news for us
Message-ID: <adef772602021004900e@[205.199.118.202]>



The current flap over the Clinton Administration's request for and receipt
of FBI dossiers is being called "Filegate." The Administration has claimed
the requests were innocent, and based on outmoded Secret Service lists. The
Secret Service denies this, and says the list did not come from them. Some
say the list was of "Clinton's enemies," as it contained mostly leading
Republicans and Bush Administration staffers (even including former Sec. of
State Jim Baker).

Investigations are underway, and Att. General Janet Reno is suggesting that
Whitewater special prosecutor Kenneth Starr handled this investigation.

Why is this good news for us? (Besides the partisan issue of embarrassing
and degrading the current government, which is always a good thing.)

Because it underscores how difficult it is, even with ostensible
safeguards, to control the distribution of dossiers, secret files, and
surveillance reports. If the White House can order up several hundred
supposedly-secret FBI dossiers on leading Republicans and political
enemies, imagine what they could do with "voluntarily escrowed" crypto
keys!

(We all know all this, of course. My point is that this is providing a
timely demonstration of how little government can be trusted to keep its
secrets.)

In this political year, this "Filegate" flap may effectively table any
serious discussions of Reno-type GAK.

Not all news is bad.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From shabbir at vtw.org  Fri Jun 21 06:44:54 1996
From: shabbir at vtw.org (Voters Telecommunications Watch)
Date: Fri, 21 Jun 1996 21:44:54 +0800
Subject: ALERT: Crypto hearings in D.C. 6/26/96, submit your comments through WWW!
Message-ID: <199606210520.BAA19235@panix3.panix.com>


=============================================================================
          ____                  _              _   _
         / ___|_ __ _   _ _ __ | |_ ___       | \ | | _____      _____
        | |   | '__| | | | '_ \| __/ _ \ _____|  \| |/ _ \ \ /\ / / __|
        | |___| |  | |_| | |_) | || (_) |_____| |\  |  __/\ V  V /\__ \
         \____|_|   \__, | .__/ \__\___/      |_| \_|\___| \_/\_/ |___/
                    |___/|_|

           SECOND SET OF CRYPTO HEARINGS (S.1726) SET FOR 6/26/96 IN
        WASHINGTON D.C.  IF YOU CAN'T BE THERE, YOU CAN STILL HAVE YOUR
              COMMENTS ENTERED INTO THE RECORD AT WWW.CRYPTO.COM

                              Date: June 21, 1996

         URL:http://www.crypto.com/            crypto-news at panix.com
           If you redistribute this, please do so in its entirety,
                         with the banner intact.
-----------------------------------------------------------------------------
Table of Contents
        News
        How to receive crypto-news
        Security And Freedom through Encryption forum: July 1, 1996
        Press contacts

-----------------------------------------------------------------------------
NEWS

The sponsors of the Pro-CODE bill (S.1726) will hold the second of
two hearings on the encryption issue in Washington D.C. this coming
Wednesday, June 26.  Witnesses scheduled to testify at the hearing, which
will focus on the Burns/Leahy Pro-CODE bill (S. 1726) include:

* Phil Zimmermann, Inventor of PGP
* Whit Diffie, Father of Public-Key Cryptography
* Jerry Berman, Executive Director, Center for Democracy and Technology
* Matt Blaze, Cryptographer
* Phil Karn, Cryptographer
* Barbara Simons, Chair of US Public Policy Committee, ACM
* Marc Rotenberg, Director, Electronic Privacy Information Center
* AND YOU!! (See below for details)

The hearing will focus on the need to reform US encryption policies,
proposals to relax export controls on encryption, and the privacy issues
raised by the current policy.

Senator Burns (R-MT), Senator Leahy (D-VT) and the other sponsors of the
Pro-CODE bill want to hear from the Net.community about why encryption is
important to privacy and security on the Internet.

If you're like most of American, you cannot take a day off just to attend
the hearings to make your voice heard.  Luckily, you can use the
handy World Wide Web form to express your opinion and have it entered
into the record.

Please be sure to visit http://www.crypto.com/ and add your voice to the
debate over encryption policy on Capitol Hill.  Responses will be tabulated
and the results, along with selected statements, will be included in the
Congressional Record by Senator Conrad Burns.  The results will also be
featured during the Security and Freedom through Encryption Forum (SAFE) on
July 1 (details on that event are attached below).  If you find the WWW
form too constraining, or you do not have access to the World Wide Web,
send your testimony to Shabbir J. Safdar (shabbir at panix.com) who will
make sure it gets into the record.

To add your voice to the crypto debate in Congress, visit:

   http://www.crypto.com/

-----------------------------------------------------------------------------
ATTEND THE SAFE FORUM - JULY 1, 1996 STANFORD CALIFORNIA

On July 1, 1996, in the heart of California's Silicon Valley at Stanford
University, members of Congress, prominent computer industry leaders and
privacy advocates will meet to discuss the need to reform U.S. encryption
policy.

The event is FREE and open to the public, but space is limited and is going
fast.  To find out more, and to reserve your free ticket, visit the SAFE
Forum Web Page at:

  http://www.crypto.com/safe

CONFIRMED SPEAKERS INCLUDE:

Among other prominent industry leaders, cryptographers, privacy advocates
and members of Congress, confirmed speakers include"

Industry Leaders and Cryptographers        Members of Congress

* Marc Andreeson, Netscape                 * Rep. Anna Eshoo (D-CA)
* Jim Bidzos, RSA                          * Rep. Tom Campbell (R-CA)
* Eric Schmidt, Sun Microsystems           * Rep. Zoe Lofgren (D-CA)
* Brad Silverberg, Microsoft               * Sen. Conrad Burns (R-MT)
* Phil Zimmermann, PGP Inc                   * Sen. Patrick Leahy (D-VT)
* Matt Blaze, AT&T                         * Sen. Larry Pressler (R-SD)
* Bruce Schneier, Counterpane Systems

Privacy Advocates and Legal Experts:

* Michael Froomkin, U. of Miami Law School
* Jerry Berman, Center for Democracy and Technology
* Grover Norquist, Americans for Tax Reform (invited)
* Ken Dam, U. of Chicago Law School (invited)

This event will be "cybercast", with full audio and still video clips,
live online with the help of MediaCast.  Details on the cybercast are
available at http://www.crypto.com/safe/

SAFE FORUM SPONSORS

This important discussion on the need for an alterative policy to protect
privacy and security and promote commerce on the Global Information
Infrastructure is being made possible by the generous support of the
following companies and public interest organizations:

America Online
Americans for Tax Reform
AT&T
Business Software Alliance
Center for Democracy and Technology
Center for National Security Studies
Commercial Internet eXchange
CompuServe Incorporated
Computer Professionals for Social Responsibility
Cylink Corporation
EDS
Electronic Frontier Foundation
Electronic Messaging Association
Electronic Privacy Information Center
Information Technology Association of America
IEEE - USA
MediaCast
Media Institute
Microsoft Corporation
Netcom Online Communication Services
Netscape Communications Corporation
Novell, Inc.
Oracle Corporation
Pacific Telesis
PGP Inc.
Prodigy, Inc.
Progress and Freedom Foundation
Securities Industry Association
Software Publishers Association
Sybase, Inc.
Voters Telecommunications Watch
Wired Magazine

Please visit the SAFE Forum Home Page for more information
(http://www.crypto.com/safe/)

-----------------------------------------------------------------------------
HOW TO RECEIVE CRYPTO-NEWS

To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com)
or send mail to majordomo at panix.com with "subscribe crypto-news" in the body
of the message.
-----------------------------------------------------------------------------
PRESS CONTACT INFORMATION

Press inquiries on Crypto-News should be directed to
	Shabbir J. Safdar (VTW) at +1.718.596.2851 or shabbir at vtw.org
	Jonah Seiger (CDT) at +1.202.637.9800 or jseiger at cdt.org

-----------------------------------------------------------------------------
End crypto-news
=============================================================================







From WlkngOwl at unix.asb.com  Fri Jun 21 06:49:34 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Fri, 21 Jun 1996 21:49:34 +0800
Subject: Backdoors (was Re: Current status of RSA patent...)
Message-ID: <199606210523.BAA12172@unix.asb.com>


On 20 Jun 96 at 17:32, Intense wrote:

> That is probably true...  But, i am sure that goverment is going to want 
> to keep there [sic] backdoors, they have showed no interest in
  ^^^^^^^^^^^^^^^^^^^^
> it's [sic] citizens priviciy [sic] as of yet...  and i doubt they have changed... 

Please elaborate on what backdoors the government already has that it 
wants to keep.

Rob.
 





From WlkngOwl at unix.asb.com  Fri Jun 21 07:10:23 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Fri, 21 Jun 1996 22:10:23 +0800
Subject: Oil Change software snoops through hard drive
Message-ID: <199606210528.BAA12254@unix.asb.com>


On 20 Jun 96 at 14:42, Jim McCoy wrote:

[Stuff about trojans deleted]

To heck with trojans... how does it know what version of NiftyMail 
you are using?  So what if you make up a dummy directory and dummy 
files with proper CRCs for NiftyMail v2.0, so Oil Change upgrades you 
to a real version of NiftyMail v2.1.  Gives a whole new avenue for 
software piracy here...

...Or does it keep a central database of registered NiftyMail users?
Does it pass along things like serial numbers embedded in software?

And is info on who owns what software kept private? Or will you be 
spammed/junk-mailed direct marketing info?

Yes. Many questions.

Rob.

---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From tcmay at got.net  Fri Jun 21 07:29:22 1996
From: tcmay at got.net (Timothy C. May)
Date: Fri, 21 Jun 1996 22:29:22 +0800
Subject: Recipients get the postage
Message-ID: <adef7a0e030210043ecb@[205.199.118.202]>


At 12:05 AM 6/19/96, Hal wrote:

>I was reading old threads on remailers, where various ideas were
>suggested to reduce abuse.  One was to charge postage, in order to
>discourage spam and somewhat discourage nastygrams, as well as to
>compensate the remailer operator for his risks.  A variant was to tell
>the recipient that he had anonymous mail waiting, and possibly charge him
>to receive it.
>
>I had a different idea, which has probably been suggested before: make
>the sender of the anonymous mail pay, but pass the money to the
>recipient.

An interesting variant; I would certainly like to see _any_ of the various
digital postage ideas tried. Alas, none have (save for Sameer's option for
charging for remailings).

However, I can see some problems which I think would arise with Hal's
"recipient gets postage" scheme.

* in an ecology of several types of remailers, some not charging postage,
some charging postage (with subcategories of some giving the postage to the
recipient and some keeping the postage for themselves), who would use the
postage variant?

(This is a recurring situation where some services are free and some are
not. I fully realize that some paid services prosper (duh!, as we still
have thriving economies) even where free alternatives exist. That the
various newspapers continue to sell, or that premium t.v. channels on cable
thrive, when "free" alternatives exist is just one example. How paid
remailers would compete with free remailers is a topic we've written much
about.)

* the "cost" of remailing is not borne by the recipient, in the current
situation, so why should a "remailer gets postage" system have advantages?

* a recipient may "demand" payment for remailed messages, e.g., by adopting
a policy of saying "Unless I find 37 digicents per 10KB of size, I will
dump the message...so if you want to reach me, pay me." This "works" by the
simple expedient of being a demand that is adhered to. (In this case, the
recipient of a message is "selling" a commodity: access to him. The senders
of messages can either accept his terms or reject them.)

[Note: Current e-mail systems are not very market-based. Metering is almost
nonexistent, and it's as if anyone could mail a ton or two of horse manure
to anyone for no cost. I expect this to eventually change, and one way it
could change is for mail clients to refuse to accept delivery unless
certain conditions were met (who the sender is, how much payment is
attached, etc.). The ontology of physical package and mail delivery systems
has some lessons, though not all translate easily into the Internet
domain.]

* but it seems to make little sense for a remailer, absent such a demanded
price, to give up his postage fee to a recipient!

I'm not saying such a system could not work, only that I would not expect a
free market ecology of remailers to evolve this as a stable evolutionary
strategy.

I would expect a more likely future stable strategy to include some
combination of payments demanded by remailers and some payment or the like
demanded by terminal recipients.


>All my complaints come from people who have received mail, never from
>people who have sent it.  So obviously the steps we take need to make
>recipients happier.  Paying them is one way to do it.

Not to be flippant, but the job of making recipients happier is probably
not ours. We don't know whether a digital dime will make them happier for
receiving a threat, or a flame, or a 10 MB coredump file. This is why it is
up to the recipient to set policies, prices, etc.

(Ditto for the remailers, as only they know how much it is worth to them to
remail a given message, depending on packet size, perceived risk to them,
etc.)

Again, I always enjoy gedankenexperiments about digital postage. But I am
chagrinned that nearly four years after the first remailers we are still
operating in thought experiment mode for the most part.

I believe this is because there really is very little market at this time
for anonymous remailings. Those who mostly use remailers appear to be
willing to use casual-grade remailers, with few of the real Chaumian
protections. And they are not very concerned about reliablity, cover
traffic, etc.

Digital postage would be a bothersome wrinkle and would be routed-around by
most.

Ergo, no commercial-grade remailers, no insistence on robustness and
reliability, no digital postage, and no interest by Microsoft!

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From declan+ at CMU.EDU  Fri Jun 21 07:49:23 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 21 Jun 1996 22:49:23 +0800
Subject: Safemail
In-Reply-To: <199606201529.KAA02594@homeport.org>
Message-ID: <YlmXHtG00YUyF6QrYK@andrew.cmu.edu>


And more generally, this is what NeXT's developer documentation has to
say about services... Good stuff.

-Declan

----

Examples of a Few Possible Services

Here are a few examples of services that have already been implemented
to give you an idea of what can be done with NeXTSTEP's services
mechanism:

* Encryption
An encryption service can convert data to a more secure form.  For
example, Mail can place a mail message on the pasteboard as a standard
Rich Text Format (RTF) document, and another application could encrypt
the document and place it back into mail as unreadable ASCII text, or as
a document to be opened only by another external decryption application.



Excerpts from internet.cypherpunks: 20-Jun-96 Re: Safemail by Andrew
Loewenstern at il.us 
> One interesting thing about NeXT's software is that the Mail
application has  
>  
> crypto hooks.  The crypto code is in a drop-in bundle that extends the app  
> at runtime.  This isn't just a generic interface, but the internationally  
> shipped Mail software calls methods in the external bundle that are  
> definitely crypto related.  Also, much of the crypto and key
management user  
>  
> interface ships with the main Mail package.  It is hidden without the
crypto  
>  
> bundle, but if you peek around with InterfaceBuilder you can see that it is  
> there.






From declan+ at CMU.EDU  Fri Jun 21 08:01:39 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 21 Jun 1996 23:01:39 +0800
Subject: Congress is at it again
In-Reply-To: <2.2.32.19960620173912.00cde130@mail.teleport.com>
Message-ID: <QlmX_O_00YUyJ6QpB=@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 20-Jun-96 Re: Congress is at it
again by Alan Olsen at teleport.com 
> At 08:23 AM 6/20/96 -0400, you wrote:
> >There's no imminent Congressinal action here, folks. Note that HR2441
> >may be revived next year, but we have a reprieve for now.
>  
> I hate to be cynical, but I seem to remember the same thing being said about
> the CDA and the Digital Telephony bills.
>  
> Things have a strange habit of getting snuck through at the last moment...

Hey, I'm cynical too. But I'm also a realist.

If the bill starts showing any signs of life, I'll be the first one
covering it and pushing the sucker back in its grave unless it's changed
radically. But right now it's a fetid rotting carcass, and ain't going
nowhere.

-Declan






From jimbell at pacifier.com  Fri Jun 21 08:21:16 1996
From: jimbell at pacifier.com (jim bell)
Date: Fri, 21 Jun 1996 23:21:16 +0800
Subject: Federal Key Registration Agency
Message-ID: <199606210601.XAA03610@mail.pacifier.com>


At 09:20 PM 6/20/96 -0400, Michael Froomkin wrote:
>I have seen the text of the speech.  The wire service accounts wildly,
>wildly exaggerate.  This is a non-story...except for AG Reno's assertion
>that it would take the government a year to break one DES message with a
>"supercomputer".  She presumably believes this.  We know the number for
>known plaintext attacks, but assuming you don't have a known plaintext,
>what's a more reasonable assumption? 

If done in parallel, on a dedicated, 200 MHz custom chip, my WAG says that 
such a chip could try, and statistically analyze the results of 10 million 
DES codes per second.   (it would do the decrypts on a number of parallel 
DES blocks, and look for typical ASCII code pattern probabilities, again all 
in parallel.)  A typical cracking system might have 100 boards of 100 such 
chips, or perhaps a 100 billion such decrypts per second.  Checking the 
keyspace would require 2**19 seconds, or about a half million seconds, or 6 
days.  Average decrypt, of course, in 3 days.


Jim Bell
jimbell at pacifier.com





From declan+ at CMU.EDU  Fri Jun 21 08:37:13 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Fri, 21 Jun 1996 23:37:13 +0800
Subject: Safemail
In-Reply-To: <199606201529.KAA02594@homeport.org>
Message-ID: <glmX7oe00YUyR6Qn9w@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 20-Jun-96 Re: Safemail by Adam
Shostack at homeport.o 
> Not to defend the safemail folks, but this does remind me of something
> that NeXT did with Eliptic curve based systems; there was no storage
> of the private key, it was generated from the passphrase at run time.
> It was a side discussion, maybe with Andrew Lorenstien?  Andrew?

Might you be thinking of ForYourEyesOnly, by R. Crandall and J. Martin?

It was distributed as a demo program with Release 2 of the NeXTstep
operating system, along with such nifty apps as a Mandelbrot generator
that used the 56001 onboard DSP. (I've never used it, though.)

Here's the help file that comes with ForYourEyesOnly. I had to grab it
with SegHoarker.

-Declan (Registered NeXT Developer)

---

General
ForYourEyesOnly is a message encryption utility.  The basic idea is that
secret messages may be sent via mail, or simply stored as encrypted
(.encr) files.  The notion of Public Key encryption requires that each
participant have a pair of keys: a "Private Key" and an associated
"Public Key."  Everyone's Public Key is known to everyone (hence the
name public).  Private Keys on the other hand are just like passwords;
that is, you commit your Private Key to memory.

Keys
You create your Public Key via the Registration... menu item.  When your
(at least 8-character) Private Key is entered, the associated Public Key
is computed for you.  Again, note that the Public Key is safe, i.e. it
can be broadcast to the whole world.  Your Private Key, on the other
hand, should never be disclosed beyond your chosen group of confidantes
(which group can of course be just a singleton--you).

ForYourEyesOnly allows for groups (larger than just yourself) to share a
Private/Public Key pair.  For example, a sales department can have one
common Private Key, so that any member of sales may read mail that was
encrypted using the associated Public Key for sales.  In this "group"
mode, a new sales member is presumably given the Private Key verbally,
on a garden walk, or during a loud evening at a local tavern, etc.

Decryption
The decryption procedure is dealt with first in case you have just
received an encrypted document and don't know what to do with it.  If
this is the case you may, for example, have double clicked a .encr file
icon from mail and have landed here.  By entering a correct Private Key
in the Message Window and pressing the Decrypt button you will obtain a
decrypted file.

You might wonder how someone could have sent you an encryption if you
have not yet registered a Private Key.
Well, you might just have joined a department all of whose workers are
using a single Private/Public Key pair for intra-office mail.  In this
case, all you need do is find the departmental Private Key for
decryption.
    
The .encr icons can be dragged to/from Mail or to/from Browser.

Encrypting files
A Plaintext message may be encrypted by entering the recipient's Public
Key (if it has not already appeared automatically, as it does when the
recipient initiated a mail exchange), and your own Private Key, then
pressing the Encrypt button.  (As above, a Public Key must have been
obtained at some point in the past via the Registration menu item). Note
that "Plaintext" is actually a theoretical term from encryption theory,
and means the original, understandable text.  What you can actually
send, though, is text and/or pictures, etc., much the same way that you
can mail multimedia files.  We call all of this Plaintext, and the
encryption algorithm chews up everything you are sending in order to
create the .encr file.
(NOTE: You can encrypt any kind of file, but at this Release you cannot
send directories (folders)).  

The encrypted file icon will appear in the icon well at the top of the
message window and can be dragged to the file browser or another
application.  The encrypted message can also be sent via the Services
menu by selecting the Mail menu and the Document menu item under that. 
A file can also be encrypted and saved to disk in a place you specify by
selecting the Encrypt, then Save As... menu item under the Document menu.

Instant Rebounding
Note that ForYourEyesOnly automatically transmits the Public Key of the
sender along with the message itself.  Thus, when you decrypt a mail
message you will get an automatic display of the other party's Public
Key.  This convenience means that once you have decrypted the incoming
message, you can easily "rebound", that is shoot a message back, simply
by editing the Plaintext area and hitting the Encrypt button.  This
instant rebounding works because both necessary keys are properly in
place as soon as you decrypt.   

Importing files
Files can be dragged in from the browser to the content of the message
window, or selected using the Import File... menu item in the Document
menu.

Exporting files
Files in a received Plaintext message can be exported by dragging them
from the message window content or by double clicking them to launch the
appropriate application.

Our proprietary algorithm
One enjoyable aspect of working on encryption algorithms is that Help
information pertaining to the algorithm itself should be vacuous; i.e.,
the less said, the better.  Just one remark: the algorithm uses number
theory but, in not using factorization, is distinct from the celebrated
RSA method.








From tcmay at got.net  Fri Jun 21 09:09:42 1996
From: tcmay at got.net (Timothy C. May)
Date: Sat, 22 Jun 1996 00:09:42 +0800
Subject: NWLibs> Stop Cross-Copying (Re: Take the money, Harry, re.)
Message-ID: <adef8e3705021004fb39@[205.199.118.202]>


At 5:21 AM 6/21/96, jim bell wrote:

>The subject was the use of digital cash for accepting Federal matching
>funds.  I cross-posted ONE message.  It was appropriately on-topic in both
>areas.
>
>Okay?

No, not okay.

The resulting torrent of messages from and to Tonie Nathan, and about Tonie
Nathan, had no connection to anything related to the CP list.

I didn't single you out as the instigator of the cross-copying, as I had no
idea of who it was.... (but now that I know it was you, I can't really say
I'm surprised).

When messages are cross-copied, warning should be included saying that the
message is going to more than one mailing list, and perhaps why this was
deemed necessary. And most importantly, urging follow-up posts to carefull
consider which groups are appropriate.

(Many people don't even bother to edit the To: and Cc: fields, resulting in
a pile-up of copied names. I try to excise out all recipients except
"cypherpunks at toad.com," figuring anyone not reading the list is not worth
sending a separate copy to.)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From tcmay at got.net  Fri Jun 21 09:17:00 1996
From: tcmay at got.net (Timothy C. May)
Date: Sat, 22 Jun 1996 00:17:00 +0800
Subject: Bashing "Wired"
Message-ID: <adef87be0402100475e8@[205.199.118.202]>


At 10:08 PM 6/17/96, Mike McNally wrote:

>That reminds me.  As someone who hasn't yet given up on WiReD in disgust
>(instead, I get it and read it faithfully in disgust), I was particularly
>pissed-off at the latest "Kids Net Rights" issue.  Jonathan Katz
>huffs and puffs about how "nobody in the digital world" protests the
>idea of rating schemes to keep non-adults away from information, and
>indeed claims that "the digerati" (grrr) are pushing rating schemes with
>great gusto to save themselves from censorship.
>
>I guess by "nobody", he probably means "nobody who hangs out in the same
>trendy espresso bars as the WiReD trendmeisters".  I've seen plenty of
>invective directed at the concept of rating systems in general, from
>a variety of people including Tim May and li'l ol' me.  That's been here
>and on some various newsgroups.

Indeed, I have not only written _against_ such mandatory rating and
age-declaration schemes, I have also written about how such schemes may be
used counter to the intended purposes (e.g., the way LolitaWatch helps
connoisseurs of young girls locate targets).

I happened to pick up that issue of "Wired" today and skimmed it at the
bookstore. The same old points of view recycled, refried, retreaded, and
ready to be retired. I suspect that author didn't know about our criticisms
because we're not published in "Wired," nor in "Netly News" and other such
travesties. Most importantly, we're not journalists, "online activists," or
moonlighting science fiction writers, and so we don't count.

Nearly every issue of "Wired" has the usual columnists, the usual feature
writers, and the usual focus on _personalities_ over substance. (Who the
fuck cares that on a long drive through the desert Jean Louis Gassee opined
to a budding Hunter S. Thompson that "that makes my nipples hard"? I
stopped reading that issue of "Wired" when this shit bubbled up out of the
sewer.)

(I'd go back exclusively to "Scientific American," except they now charge
$4.95 for a much-thinner magazine than the old thick and meaty issues of
the 60s and 70s, where an issue sold for 60 cents, then 75 cents, then
$1.00, etc. Also, the old article format has been replaced by shorter,
flashier, more personality-oriented pieces. Still, better than the fluff of
"Wired," which is "tired.")

And notice that increasingly the "journalists" are the quoted thinkers and
strategists in important areas? Someone majors in English, starts writing
for "Netizen" or "HotWired," and the next thing you know they're debating
crypto policy with Conrad Burns and Dorothy Denning. We're in an age where
the medium truly is the message.

I do think "Wired" has a few good items, buried deeply in the muck. I
dislike their typography and color styles (but then, who doesn't?), but
mostly I dislike their hipper-than-thou techno-freneticism. The hundreds of
little sound bytes about technolog, what's hot and what's not
(wired--tired), the focus on ephemeral personalities (a la "People," it's
true inspiration), well, it all makes me glad to never spend more than 15
minutes flipping through it at the newstand.

Someone told me recently that "Wired" is either already public, or is about
to go public (stock-wise), with an estimated market capitalization of $400
million. (I guess some of those journalists are suddenly very rich....)

Caveat emptor.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From jimbell at pacifier.com  Fri Jun 21 10:18:40 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 22 Jun 1996 01:18:40 +0800
Subject: NWLibs> Stop Cross-Copying (Re: Take the money, Harry, re.)
Message-ID: <199606210424.VAA28106@mail.pacifier.com>


At 07:14 PM 6/20/96 -0700, Timothy C. May wrote:
>At 5:19 PM 6/20/96, RogErick at aol.com wrote:
>
>>  I agree with you, Tonie, as usual.
>>   I struggled with this, for years, until I had a dream.  I was on a
>>battlefield, pinned down by enemy fire, and I was out of ammunition.
>....
>
>
>Hey, folks, I'm a libertarian, and even voted for John Hospers in 1972. But
>the Cypherpunks mailing list has over 1200 subscribers, and cross-copying
>to it for these debates is not a good idea. I presume the same is true
>about cross-copying Cypherpunks stuff onto "nwlibertarians at teleport.co,"
>but I can't say for sure.
>
>What I know is that wide cross-posting (or cross-copying) is the bane of
>lists these days. There are so many lists, so much overlap, that the
>temptation is great to cc: any conceivably-related list.
>
>Hey, no one speaks for Cypherpunks, least of all me, but I think
>cross-copying between libertarian, or digital commerce, or Wobbly, or
>International Socialist Women of Color, or Unabomber Brigade mailing lists
>to the Cypherpunks list is inappropriate.

The subject was the use of digital cash for accepting Federal matching 
funds.  I cross-posted ONE message.  It was appropriately on-topic in both areas.

Okay?

Jim Bell
jimbell at pacifier.com





From gary at systemics.com  Fri Jun 21 13:15:49 1996
From: gary at systemics.com (Gary Howland)
Date: Sat, 22 Jun 1996 04:15:49 +0800
Subject: This might be interesting...
In-Reply-To: <199606190745.JAA21883@basement.replay.com>
Message-ID: <31CA6413.61133CF4@systemics.com>


Joseph Sokol-Margolis wrote:
> 
> At 1:15 PM -04006/20/96, you wrote:
> > On Wed, 19 Jun 1996, Anonymous wrote:
> >
> > > Do an AltaVista Query on:
> > >
> > >     url:bmh.com crypto*
> >
> > Mmmmm.  Mmmmm.  Mmmmmm.  Looks pretty tasty.  Those boys and girls at BMH
> > obviously have fun jobs.
> >
> > Anyone have a password for this site?  The links look cool, but you can't
> > get at 'em without a password or a hack...

The /ARPA/misc directory is accessible.

 
> I guess it might be military only.

Somehow I doubt this ...


Found in http://www.bmh.com/ARPA/Development_Intro.html:

- These documents are unclassified and in draft format. They will be updated quarterly
- and issued in a final version at the time the software is validated. Please refer any
- questions, comments, or recommendations to:

I don't think these pages are anything to get excited about (although
of course it won't surprise me if some journalist gets excited)


Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06





From gary at systemics.com  Fri Jun 21 13:48:44 1996
From: gary at systemics.com (Gary Howland)
Date: Sat, 22 Jun 1996 04:48:44 +0800
Subject: Safemail
In-Reply-To: <adef550a010210048c61@[205.199.118.202]>
Message-ID: <31CA5F34.5656AEC7@systemics.com>


Timothy C. May wrote:
> 
> I haven't seen this particular idea, but a general point to always bear in
> mind is that "entropy doesn't increase" (despite what you may have heard
> about that other kind of entropy....).
> 
> To wit, if there are N bits of entropy in a passphrase (or whatever is the
> basic key, be it typed in, read from a floppy, whatever), then no amount of
> deterministic crunching by a PRNG (or whatever) will increase this.
> 
> (I say "deterministic" in the sense that all parties presumably need to run
> the same PRNG and get the same output from the same "seed" (= passphrase,
> in this scheme). Thus, the PRNG cannot add additional randomness or
> entropy. Unless I am misunderstanding the proposal...)
> 
> So, if the passphrase is 22 characters, as in the "Safemail" proposal (such
> as it is), that's all that can be gotten. Period. There just aren't enough
> "places" in the space of starting points. Anyone with access to the
> algorithms used to process the 22 characters (154 bits if 7 bits are used
> for each character) can brute force search the space in a relatively short
> time. (If the later processing algorithms are supposed to be "secret," then
> of course this a cryptographic faux pas of the first magnitude, usually
> dismissed as "security through obscurity.")


Generally agreed, but I would like to mention a couple of points.  I would
argue that 154 bits of entropy is enough, but then I would also argue that
a 22 character passphrase is unlikely to generate these 154 bits of entropy.

Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06





From tjic at OpenMarket.com  Fri Jun 21 13:58:01 1996
From: tjic at OpenMarket.com (Travis J.I. Corcoran)
Date: Sat, 22 Jun 1996 04:58:01 +0800
Subject: DCSB: Electronic Commerce: The State of the Art
In-Reply-To: <19960621090343293.AAA253@geoff>
Message-ID: <199606211415.KAA09062@cranmore.openmarket.com>


-----BEGIN PGP SIGNED MESSAGE-----

Message-Signature-Date: Fri Jun 21 10:14:59 1996

>  From: geoff at commtouch.co.il (geoff)
>  Date: Fri, 21 Jun 1996 12:03:48 +0300
>  
>  The signature on the message attached below did not verify.
>  
>  Please let me know if people agree that this would be a useful 
>  service, or is it inappropriate ?

I use a lisp package for emacs that I wrote to automatically verify
signatures on incoming mail, so I already see the 10% of messages
which are improperly signed displayed in a red "bad signature" font.
Thus, I'd have no need of this service.

Further, it makes philisophical/political sense to me to have
verification distributed.  Every node should be doing it's own
security.

Be aware of CC's before replying to this.

- -- 
TJIC (Travis J.I. Corcoran)  http://www.openmarket.com/personal/tjic/index.html

                             Member EFF, GOAL, NRA.
                 opinions (TJIC) != opinions (employer (TJIC))
         "Buy a rifle, encrypt your data, and wait for the Revolution!"
	PGP encrypted mail preferred.   Ask me about dragbar-time.el for emacs.



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Auto-signed by mail-secure.el 1.006 using mailcrypt
Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface

iQCVAwUBMcqubYJYfGX+MQb5AQFP5AQAzrePx1jhIfE/iHT0abqvOPQxpQ795/vk
CEJBSNLM91S3tSFXtcTvqYWRvE8BksT6l4JqwVhmDWN8U3UV60pJVqbwoLbH3bvs
fQcPT+HxvFDknrVIvQibwpOB9Pw9PCyV1mfMkyOjsJzRTCJe7XiFT7TS0bZA+VvX
Ls0Jpjozvnk=
=0x7g
-----END PGP SIGNATURE-----





From declan at well.com  Fri Jun 21 14:03:39 1996
From: declan at well.com (Declan McCullagh)
Date: Sat, 22 Jun 1996 05:03:39 +0800
Subject: HotWired -- The Tenth Justice (6/20/96)
Message-ID: <Pine.3.89.9606210654.A13870-0100000@well>


Check out today's HotWired at http://www.hotwired.com/ for the full article.

-Declan

--------------

http://www.hotwired.com/netizen/96/25/campaign_dispatch4a.html

HotWired: The Netizen
The Tenth Justice

by Brock N. Meeks (brock at well.com) and Declan McCullagh (declan at well.com)
Washington, DC, 20 June 1996

   Little known and unheralded outside judicial circles, U.S. Solicitor
   General Drew Days will soon play a key role in the continuing saga of
   the Communications Decency Act: it's now up to Days to vote thumbs up
   or down on sending the case to the Supreme Court.

   Days's decision carries enormous weight with the Supreme Court
   justices. "The solicitor general is known as the tenth justice," says
   Llew Gibbons, Temple University law fellow. "He has that much power
   before the court. It's a level of credibility nobody else has."

   Although the solicitor general - the No. 3 spot in the Department of
   Justice - is a political appointee, the job has historically been
   above politics; as Gibbons says, the solicitor general's real client
   is the Constitution. At the same time, it's a coveted position widely
   seen as a steppingstone to a seat on the Supreme Court, as it was for
   Thurgood Marshall.
   
   In addition, the job's independence allows the solicitor general to
   rule according to his understanding of constitutional law, not party
   allegiance - which is why Days's decision on the CDA will carry so
   much weight with the high court.
   
   Nonetheless, as independent and influential as Days may be, should he
   decide not to send the case on, he could still be overruled by
   Attorney General Janet Reno.

   Days has traveled this road before. Shortly after he took office in
   1993, he wrote a decision arguing that the Bush administration had
   screwed up in sending a controversial child pornography case to the
   Supreme Court. The court, having already decided to take the case,
   reversed itself and, on the strength of Days's argument, sent it back
   to the appeals court.

[...]
   






From declan at eff.org  Fri Jun 21 14:16:10 1996
From: declan at eff.org (Declan McCullagh)
Date: Sat, 22 Jun 1996 05:16:10 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
Message-ID: <Pine.SUN.3.91.960621065022.12815F-100000@eff.org>


Two things:

1. The letter was copied to Mark Heilbrun, and a phone number is helpfully
provided below.
   
2. D'Amato was copied to encourage him to claim jurisdiction over part of
this legislation, yank it into the banking committee, and delay, delay,
delay. 

-Declan
declan at well.com

--------------------------------------------------------------------------
  
                          United States Senate
                     Select Committee on Intelligence
 
                             June 7, 1996
                                                   SSCI #96-2219B
 
 The Honorable Patrick J. Leahy
 United States Senator
 Senate Russell Building, Room 433
 Washington, D.C. 20510-4502
 
 Dear Pat:
 
      We write to express our concerns about legislation you have sponsored
 which would impact directly upon federal encryption policy, including export
 control policy.  Recognizing that American innovation in encryption
 technology is unequaled, we appreciate the need to balance US economic
 competitiveness with the need to safeguard national security interests.  As
 such, it is our belief that this legislation requires careful study and
 reflection and that the Senate and the Congress as a whole should proceed
 with caution until all of the implications of such an initiative are fully
 discerned.  Along these lines, it is our understanding that industry
 representatives are currently meeting with the Administration to discuss new
 policy initiatives to address this issue.  Also, both the Congress and the
 Administration have undertaken to conduct a thorough analysis of a two-year
 congressionally-mandated study on federal encryption policy that was
 facilitated by the National Research Council.  We therefore feel that your
 legislation initiative at this time is premature.
 
      We appreciate your efforts to bring some needed clarity to United
 States policy in this area and wish to keep the lines open for discussion
 and debate on this important issue.  The staff point of contact on this
 issue is our Committee Counsel, Mark Heilbrun, who can be reached at
 224-1700.
                                 Sincerely,
 Arlen Specter                                   J. Robert Kerrey
 Chairman                                        Vice-Chairman
 
 cc:  The Honorable Alfonse D'Amato
      Chairman, Senate Committee on Banking

--------------------------------------------------------------------------






From perry at piermont.com  Fri Jun 21 14:40:52 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sat, 22 Jun 1996 05:40:52 +0800
Subject: Federal Key Registration Agency
In-Reply-To: <Pine.SUN.3.94.960620211746.20271D-100000@viper.law.miami.edu>
Message-ID: <199606211154.HAA02180@jekyll.piermont.com>



Michael Froomkin writes:
> I have seen the text of the speech.  The wire service accounts wildly,
> wildly exaggerate.  This is a non-story...except for AG Reno's assertion
> that it would take the government a year to break one DES message with a
> "supercomputer".  She presumably believes this.  We know the number for
> known plaintext attacks, but assuming you don't have a known plaintext,
> what's a more reasonable assumption? 

Known plaintext isn't needed for any brute force DES attack. Indeed,
our own Dave Wagner showed in a paper not that long ago how to
automate the process of detecting a good key.

The numbers in the Blaze et al paper are very realistic on this. A
year is total bull -- not even within several orders of magnitude of
accuracy.

Perry





From mhw at wittsend.com  Fri Jun 21 14:45:47 1996
From: mhw at wittsend.com (Michael H. Warfield)
Date: Sat, 22 Jun 1996 05:45:47 +0800
Subject: Current status of RSA patent...
In-Reply-To: <Pine.LNX.3.91.960620173131.120A-100000@invictor.miworld.net>
Message-ID: <m0uWu3y-0000w4C@wittsend.com>


Intense enscribed thusly:

> On Thu, 20 Jun 1996, jim bell wrote:

> > At 10:59 AM 6/20/96 -0400, Intense wrote:

> > >does not matter - it will be renewed in the interest of the government
> > >The goverment want's there backdoor...  would you expect less?
         ^^^^^^^^^ ^^^^^^ ^^^^^              ^
> > As far as I know, patents can't be "renewed."  I've heard they can be 
> > "re-issued," amended, but to my knowledge that doesn't extend their term.
> 
> That is probably true...  But, i am sure that goverment is going to want 
                                 ^              ^^^^^^^^^
> to keep there backdoors, they have showed no interest in it's citizens 
          ^^^^^                                            ^^^^
> priviciy as of yet...  and i doubt they have changed... 
  ^^^^^^^^                   ^
> MdS

	Uh....  Wait a minute.  I don't normally pick on spelling and
grammar errors (heaven knows - I make enough myself) but this discussion,
over patents and laws, seems to be involving someone bent on setting a
record for ridiculous errors.  Is "Intense" a child?  (Actually my children,
all three of them, would not make these mistakes!)  We see here a discussion
over points of patent law and government policy, and Jim seems to be having
a battle of wits with a half-armed opponent.

>                *          <exalt at miworld.net>           *

	Mike
-- 
 Michael H. Warfield    |  (770) 985-6132   |  mhw at WittsEnd.com
  (The Mad Wizard)      |  (770) 925-8248   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!





From shamrock at netcom.com  Fri Jun 21 14:48:51 1996
From: shamrock at netcom.com (Lucky Green)
Date: Sat, 22 Jun 1996 05:48:51 +0800
Subject: Recipients get the postage
Message-ID: <v02120d78adf01a8ebfbd@[192.0.2.1]>


At 22:27 6/20/96, Timothy C. May wrote:

>Again, I always enjoy gedankenexperiments about digital postage. But I am
>chagrinned that nearly four years after the first remailers we are still
>operating in thought experiment mode for the most part.
>
>I believe this is because there really is very little market at this time
>for anonymous remailings. Those who mostly use remailers appear to be
>willing to use casual-grade remailers, with few of the real Chaumian
>protections. And they are not very concerned about reliablity, cover
>traffic, etc.

While it is true that there is a relatively small market for remailers and
therefore insufficient incentive to spend great efforts on developing
for-pay remailers, there is a relatively simple technical modification to
Ecash that might lower the development barrier to a level at which for-pay
remailers may be deployed.

Clearly, the task of designing a new remailer architecture as well as a
payment system suitable for use in such an architecture is prohibitive at
the current market size. If currently deployed remailer and payment systems
could be modified to interoperate, developing for-pay remailers would be
considerably easier.

Unfortunately, there are technical reasons that have kept the two main
contenders for building such a hybrid system, Mixmaster and Ecash, from
interoperating in a smooth fashion.

Mixmaster has certain constraints on the maximum number of bytes a
potential payment sting can have. [Note: the constraint is in the Mixmaster
header, it has nothing to do with total message size].

To stay within that limit, the client used to access the Ecash wallet would
have to be able to specify the exact denominations of coins to be used to
make a payment of a given amount. Neither DigiCash's current Ecash client,
nor the recently released official Ecash API allow for this level of
control over the composition of a payment.

When there is a fully working implementation of Ecash that allows the
detailed control required to create payment messages that Mixmaster can
incorporate in its messages, implementing for-pay remailers should be
trivial.

It is difficult to predict at this time if such out of the box for-pay
remailer will be commercially viable



-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
   Disclaimer: My opinions are my own.







From erehwon at c2.org  Fri Jun 21 15:03:47 1996
From: erehwon at c2.org (William Knowles)
Date: Sat, 22 Jun 1996 06:03:47 +0800
Subject: Federal Key Registration Agency
In-Reply-To: <199606210601.XAA03610@mail.pacifier.com>
Message-ID: <Pine.SUN.3.91.960621030154.14703C-100000@infinity.c2.org>


On Thu, 20 Jun 1996, jim bell wrote:

> At 09:20 PM 6/20/96 -0400, Michael Froomkin wrote:
> >I have seen the text of the speech.  The wire service accounts wildly,
> >wildly exaggerate.  This is a non-story...except for AG Reno's assertion
> >that it would take the government a year to break one DES message with a
> >"supercomputer".  She presumably believes this.  We know the number for
> >known plaintext attacks, but assuming you don't have a known plaintext,
> >what's a more reasonable assumption? 
> 
> If done in parallel, on a dedicated, 200 MHz custom chip, my WAG says that 
> such a chip could try, and statistically analyze the results of 10 million 
> DES codes per second.   (it would do the decrypts on a number of parallel 
> DES blocks, and look for typical ASCII code pattern probabilities, again all 
> in parallel.)  A typical cracking system might have 100 boards of 100 such 
> chips, or perhaps a 100 billion such decrypts per second.  Checking the 
> keyspace would require 2**19 seconds, or about a half million seconds, or 6 
> days.  Average decrypt, of course, in 3 days.


For a guy that used to be in my killfile, I agree with Jim on this one.


William Knowles
erehwon at c2.org
Finger for public key



--







From alewine at dcez.com  Fri Jun 21 15:29:42 1996
From: alewine at dcez.com (Alan Lewine)
Date: Sat, 22 Jun 1996 06:29:42 +0800
Subject: Oil Change software snoops through hard drive
In-Reply-To: <Pine.GUL.3.93.960620104638.4657A-100000@Networking.Stanford.EDU>
Message-ID: <31CA063E.350B@dcez.com>


But this isn't MS's RegWiz. It's capabilities sound much greater, and 
it's not clear how to opt out, etc. from the press release:
<< Oil
Change reportedly tracks all currently installed versions and revisions
of all
Windows 95 software and hardware drivers on a PC, and then dials into
CyberMedia's Internet Web Server for related updates.>>
is this thing scary? I don't know. Does software like it have potential 
for abuse? Absolutely. Fear mongering? I don't think so. Just a Heads up.

Alan Lewine
------
Rich Graves wrote:
> 
> On Wed, 19 Jun 1996, Declan McCullagh wrote:
> 
> > Alan forwarded this to me. Thought it might be interesting. -Declan
> [..].]
> > Unanswered Qs:
> > 1) What other kinds of info does/can it troll for?
> > 2) What does it do when it finds unregistered software?
> > 3) Does it implicate ECPA?
> > 4) Will updates be available through other means?
> > 5) Must a user affirmatively grant permission to the software agent?
> > 6) Can a user decline or limit the agent's access?
> > 7) What uses may the agent's owner make of data collected?
> > etc.
> 
> Well, if you want definitive answers, use Stan Mitchell's File Monitor,
> ftp://ftp.ora.com/pub/examples/windows/win95.update/schulman.html#w95fmon> 
> But free to fear-monger in any case...
> 
> -rich





From iang at cs.berkeley.edu  Fri Jun 21 16:31:19 1996
From: iang at cs.berkeley.edu (Ian Goldberg)
Date: Sat, 22 Jun 1996 07:31:19 +0800
Subject: Recipients get the postage
In-Reply-To: <adef7a0e030210043ecb@[205.199.118.202]>
Message-ID: <4qelkm$2js@abraham.cs.berkeley.edu>


-----BEGIN PGP SIGNED MESSAGE-----

In article <adef7a0e030210043ecb@[205.199.118.202]>,
Timothy C. May <tcmay at got.net> wrote:
>Again, I always enjoy gedankenexperiments about digital postage. But I am
>chagrinned that nearly four years after the first remailers we are still
>operating in thought experiment mode for the most part.
>
>I believe this is because there really is very little market at this time
>for anonymous remailings. Those who mostly use remailers appear to be
>willing to use casual-grade remailers, with few of the real Chaumian
>protections. And they are not very concerned about reliablity, cover
>traffic, etc.

I disagree.  I think the main reason that postage has not appeared for
remailers is that there is no good way to integrate Chaumian cash into
applications.  Now, with two (count 'em!) libraries for ecash starting
to become available, we will hopefully see people working to put ecash
code into MUAs, remailers, etc.

   - Ian "and I'll be one of them..."

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcrZx0ZRiTErSPb1AQGzpQP/eioP2bfiiwefGQgBzkyxl3E3kj/9Hpqs
/5BdtDNtq4AZFdDZxXAc7vRUlKKihWeuLACEAHJ4mjfHg7xPiz92a/rMyEcRKkZ6
pbWwsmxR9OJat4g4Y6DzVm2wXAfaQG7WCZQh2gfKxElDkM53QqslOl3BrJ7xuVOU
x2BSpwIfI4s=
=Wtwx
-----END PGP SIGNATURE-----





From geeman at best.com  Fri Jun 21 16:33:26 1996
From: geeman at best.com (geeman at best.com)
Date: Sat, 22 Jun 1996 07:33:26 +0800
Subject: FW: Bashing "Wired"
Message-ID: <01BB5F54.908A60A0@geeman.vip.best.com>



----------
From: 	Timothy C. May[SMTP:tcmay at got.net]
Sent: 	Thursday, June 20, 1996 11:19 PM
To: 	cypherpunks at toad.com
Subject: 	Bashing "Wired"

..... elided...

And notice that increasingly the "journalists" are the quoted thinkers and
strategists in important areas? Someone majors in English, starts writing
for "Netizen" or "HotWired," and the next thing you know they're debating
crypto policy with Conrad Burns and Dorothy Denning. We're in an age where
the medium truly is the message

thanks for the deconstruction on 'WiReD' - --- your last comment reminds me of Cliff Stoll's position that the Web fosters what he calls 'cacocracy' --- a community of yakking posturers with nothing to say.

I recommend his "Silicon Snake Oil" to all.
Cheers.






From attila at primenet.com  Fri Jun 21 16:34:37 1996
From: attila at primenet.com (attila)
Date: Sat, 22 Jun 1996 07:34:37 +0800
Subject: Current status of RSA patent... (fwd)
Message-ID: <199606211457.HAA23311@primenet.com>


Addressed to: Paul S. Penrod <furballs at netcom.com>
              Cypherpunks <cypherpunks at toad.com>

** Reply to note from Paul S. Penrod <furballs at netcom.com> 06/19/96 10:14am -0700
  
        I think most of the basics were covered in the list response, 
    except each had a piece or two to say, part of which was usually
    incorrect, and none caught the scope of the issue in its fullness.
 
        Until a patent is sucessfully challenged _and_ "destroyed," it 
    is resumed valid in the country of issue, regardless of the
    source of a competing product which may have been manufactured in a
    country where patents mean little, if anything.  --e.g.  any
    country other than the U.S., Canada, and Western Europe.
 
        GOOD patents, with claims which are both narrow enough to 
    define what is patentable and broad enough to cover "work-arounds,"
    are expensive to obtain:  >$10,000 domestic plus foreign costs. 
    there are arcane rules as to the time of filing for foreign patents
    if they are to be valid, often requiring separate efforts, and
    different claims, in each jurisdiction.
 
        smaller companies are obviously at a disadvantage since 
    resources, particularly in development houses, are small. 
    development companies tend to recover their expenses with immediate
    product (much smarter than waiting for the patent office to declare
    you King Kong) thereby also avoiding being beaten in the market
    window by an also-ran product.
 
        An alternative theory is to pray that a Fortune 100 releases 
    product which violates your patents.  Caveat:  it is still your
    responsibility to "protect" your product and not lose your rights
    by default. This is expensive and further requires that you reduce
    your theory to practice -- you do reduce the theory to practice,
    you are in a very weak position --again, unless you are IBM, AT&T,
    etc.  who practice law by intimidation and burying the opposition
    in excessive and frivolous paperwork.
 
        Then there is the problem of the capital required to litigate 
    an interloper.  When I attempted to litigate the Fortune #1 company
    10 years ago --the MINIMUM advance fee requested by every lawyer
    (even ones I have previously consider fiends) was $2 MILLION; 
    which, although still less than the contractual royalty claim, was
    not exactly in my bank account!  --and, the greedy bastards also
    wanted 10-15 years to collect and 33-50% of the recovery plus 
    expenses.
 
        So, I litigated the claim myself (9 months), and won in Federal 
    District Court. I was lucky, with a never-used-in-the-US law
    degree; the five other companies in the same bag received nothing
    on their claims:  they could not afford the legal expenses.  I did
    not like lawyers as a breed prior to this incident, and I like them
    significantly less now. we will not discuss the issue of respect or
    their value as a food substitute (really.., they taste just like
    chicken).
 
        patents are further cluttered by the fact it averages 3 years 
    to obtain a patent, and technology moves far too fast.  then, even 
    with fundamental patents such as RSA is holding one of, there are
    the legal challenges as to both the validity and whether or not it
    expresses claims which are both original and non-obvious.
    
        non-obvious is a key factor --you can not patent the "fact:" 
    "a chunk of sodium tossed into a toilet ball often destroys the
    toilet...."
 
        lastly, particulary in software, there is the challenge: 
    "...all knowledge should be _free_!"  Well, that is fine and good,
    but how do you pay researchers?  have them pump gas all week and 
    donate research time on the weekends?  very few researchers have
    the piece of mind to be creative when their children are starving. 
    --oh, well, we still have the unmarried nerds who require only 
    space to sleep (standing up), BigMacs and chips....
 
        from my perspective, the patent system is absurd --not because 
    of the protection it purports to provide, but that it is 

        a)  ridiculously slow and arcane, dominated by how a lawyer 
            who has no clue, writes _claims_, in words, defining what 
            is unique; and 

        b)  it is insufficient to deal with _intellectual_ property
            rights which can not always be reduced to a simple
            mechanical/hydraulic drawing and some words _claiming_ its
            uniqueness.  

        The real rub in patents is that _words_, not the technical
    definitions and diagrams, or even the "experts" in trial, that wins 
    patent litigation.  The circuit diagram or the mathematical 
    equation is noting more than a sidebar note. Therefore, patents 
    have become a weapon, a weapon of the established to intimidate the
    new kid on the block.
 
        what are the chances for meaningful patent reform?  slim to 
    none. why?  it will offend the lawyers, and their $10,000 words!

        any of you have been involved in patent litigation must realize
    the absurdity of a Federal jury deciding the validity of high-tech 
    patents.

        and, if you, the developer, take the product to market, you run
    the risk of a major company patenting _your_ idea and litigating 
    you!  but "I have prior art you scream!" --yes, and they will have 
    notebooks with a paper trail and you will have none. what does the 
    legal system require? paper trail.

        personally, I think RSA has been most generous in their 
    licensing: a personal use license of the basic algorithm is free. 
    How do you suppose PGP really exists?  it's free!  RSA has done 
    more to advance cryptography with this policy than any other in many
    years.  the political and public relations benefits to our rights 
    to cryptography and the public relations bonanza for public 
    awareness is not even estimable, let alone measurable.  The Federal
    persecution of Phil Zimmerman was a PR bonanza and a rallying cry.

        on the other hand, the Free Software group, despite the 
    tremendous value to those of us who develop, does nothing to
    protect our basic freedoms, and place the issue before the U.S. 
    (and world) forum.                                                   
    
        whether or not we like like RSA's "charismatic" leader, 
    give credit where credit is due.  if you are creating a commercial 
    product, you pay royalties. 

        remember, patents and patent royalties are a trade-off in the 
    system.  would you not expect royalties for your patent? I know I 
    do; have collected many; and, hope to be able to continue to 
    collect same, despite by dislike of the current U.S. Patent Office.

        that's all, folks!
        



--
Fuck off, Uncle Sam. Cyberspace is where democracy lives!






From bal at martigny.ai.mit.edu  Fri Jun 21 16:35:15 1996
From: bal at martigny.ai.mit.edu (Brian A. LaMacchia)
Date: Sat, 22 Jun 1996 07:35:15 +0800
Subject: where'd Bal's PKS go?
In-Reply-To: <199606201724.KAA07394@muddcs.cs.hmc.edu>
Message-ID: <199606211629.JAA08017@toad.com>


   Date: Thu, 20 Jun 1996 10:24:12 -0700
   From: me at muddcs.cs.hmc.edu (Michael Elkins)
   X-Mailer: Mutt 0.34
   Mime-Version: 1.0
   Sender: owner-cypherpunks at toad.com
   Precedence: bulk

   Did it move?  I hadn't seen any announcement of this...

No, it hasn't moved, but the server it was running on got "upgraded" and
some things were (or still are) broken.  The e-mail based keyserver and
the older WWW interface were working as of Wed. night.  The new WWW
keyserver code compiles but has some bugs I'm still trying to work out.;
I hope to have it back on-line soon.

Sorry for the problems, folks

					--bal





From se7en at dis.org  Fri Jun 21 16:59:43 1996
From: se7en at dis.org (se7en)
Date: Sat, 22 Jun 1996 07:59:43 +0800
Subject: Bankers, Check Your Email
In-Reply-To: <Pine.SUN.3.91.960620234855.1920A-100000@infinity.c2.org>
Message-ID: <Pine.BSI.3.91.960621093935.12292C-100000@kizmiaz.dis.org>




On Fri, 21 Jun 1996, William Knowles wrote:

> I belive you are thinking of Vince Cate's operation in Anguilla
> 
> http://www.offshore.com.ai/
> 
> Poke around his personal web page and you will find yourself calling
> your travel agent for the next plan down.  Offshore.com is the closest
> site you are going to come to that will have Sterling's 'Islands in 
> the Net' coming to mind very quickly.  There is other links to offshore
> business, corporations, lawyers, Everything you need to break free from 
> doing business in whatever country you are in now.
>  
> > Another bank offered a diplomatic passport and its related diplomatic 
> > pouches (off limits for US and other goverments) for a minimum 
> > investment. This was in the Seychilles Islands.
> 
> Seychelles, One of the few places where communism works.  Offers
> a wonderful service if you can afford it, For 1 million U.S.D. 
> You can stay in the Seychelles without worry of being extradited
> to another country, i.e. if you were the poor bastard that nearly
> crushed Barring's Bank in the U.K. and you invested here, well the
> govt would protect you from the authorites in that country (Singapore)
> 
> The Seychelles does have an Internet connection but I have yet to 
> find the providers contact e-mail address.  Some enterprising 
> hacker might want to look into this further for offering Net service
> to future residents of the Seychelles.

The offshore domain you mention would be the one. He does warn that it is 
a financial data haven, and not a criminal data haven, as you can still 
be prosecuted under their local laws for such activities. 

The Seychilles Islands is also correct. I found the article, and it is as 
you suggest. Diplomatic rights start at $10 Million investment level.

se7en





From geoff at commtouch.co.il  Fri Jun 21 17:01:08 1996
From: geoff at commtouch.co.il (geoff)
Date: Sat, 22 Jun 1996 08:01:08 +0800
Subject: DCSB: Electronic Commerce: The State of the Art
Message-ID: <19960621090343293.AAA253@geoff>


The signature on the message attached below did not verify.

Pronto Secure has the neat feature of doing signature checking on the 
fly. 

In the process of testing PSecure I have collected from the 
keyservers, the keys of most people on the list who pgp sign their 
messages. (Another neat feature of PSecure makes this a one click task)

I could quite easily perform the service of bouncing messages with bad 
signature back to the list.

Please let me know if people agree that this would be a useful 
service, or is it inappropriate ?

My experience over the past few months is that around 10% of all signed 
traffic on the list checks with a BAD SIGNATURE!

Geoff Klein
Pronto Secure Product Manager.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: bin00001.bin
Type: application/octet-stream
Size: 5228 bytes
Desc: "badsig"
URL: <https://lists.cpunks.org/pipermail/cypherpunks-legacy/attachments/19960622/88c02ae5/attachment.bin>

From ogren at cris.com  Fri Jun 21 17:16:40 1996
From: ogren at cris.com (David F. Ogren)
Date: Sat, 22 Jun 1996 08:16:40 +0800
Subject: Win95 Blowfish Implementation
Message-ID: <199606211918.PAA11089@darius.cris.com>


-----BEGIN PGP SIGNED MESSAGE-----


I am nearing completion of the alpha version of my Win95 Blowfish 
implementation aka "Hootie" (I couldn't resist).  Both the 
pre-releases and final version of Hootie will be freeware.

But before I do so, I want to double check by information on the 
rights to the following algorithms.  I'm only interested in US 
patents, since I won't be able to export it anyway.

So correct me if any of the following statements are incorrect:

1. Blowfish is not patented and can be used without royalty.
2. SHA can be used without royalty.
3. MD5 can be used without royalty if the RSAREF library is used, 
and if the proper credit is given to RSA.

Also, can the MD5 algorithm be used outside the RSAREF library?  In 
other words, can I rewrite the code to take in effect MFC classes?

I'll post more information about Hootie later. It's not an 
earthshattering or groundbreaking program.  I wrote it largely as a 
learning excercise in MSVC++, but it's a functional program with a 
good user interface so I decided to release it.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcr1IfBB6nnGJuMRAQGIKgP/V8b6AY7dfbK2EBbVcJ01nfSs5svCaCau
BNC32zW+/0pzoZrz0C8eTUubOhFFwPMzng3QI9A7J197I64UdPtn4crYV8qDjJRU
LeeGhffduh6Jhubd6V5q7VjauQ4khR/Q3kvHvWhA6INBNe9/mQzezaf8HwUr/Tk6
+B9ikYxIUmo=
=6vI/
-----END PGP SIGNATURE-----
--
David F. Ogren
ogren at concentric.net (alternate address: dfogren at msn.com)
PGP Key ID: 0xC626E311
PGP Key Fingerprint: 24 23 CD 15 BF 8D D1 DE  81 71 84 C8 2C E0 4B 01
(public key available via server or by sending a message to
ogren at concentric.net with a subject of GETPGPKEY)





From jimbell at pacifier.com  Fri Jun 21 18:10:34 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 22 Jun 1996 09:10:34 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
Message-ID: <199606211849.LAA04215@mail.pacifier.com>


At 06:51 AM 6/21/96 -0700, Declan McCullagh wrote:
>Two things:
>1. The letter was copied to Mark Heilbrun, and a phone number is helpfully
>provided below.
>2. D'Amato was copied to encourage him to claim jurisdiction over part of
>this legislation, yank it into the banking committee, and delay, delay,
>delay. 
>
>-Declan
>declan at well.com

>                          United States Senate
>                     Select Committee on Intelligence
> 
>                             June 7, 1996
>                                                   SSCI #96-2219B
> 
> The Honorable Patrick J. Leahy
> United States Senator
> Senate Russell Building, Room 433
> Washington, D.C. 20510-4502
> 
> Dear Pat:
[rest of letter to Leahy deleted]


Since "everybody" is supposed to agree that the Leahy encryption bill is 
dead, dead, dead, I don't see this as being any kind of problem.  It was 
disliked by Clinton and the Denning-types, and with the exception of a short 
flurry of mistaken optimism around here, it was roundly excoriated here as 
well.  

The one thing I found disgustingly amusing was the statement from the letter:

>     Also, both the Congress and the
> Administration have undertaken to conduct a thorough analysis of a two-year
> congressionally-mandated study on federal encryption policy that was
> facilitated by the National Research Council.  We therefore feel that your
> legislation initiative at this time is premature.

They seem to have to do an "analysis" of a two-year study.  Harrummmph!
 
Jim Bell
jimbell at pacifier.com





From unicorn at schloss.li  Fri Jun 21 19:25:51 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sat, 22 Jun 1996 10:25:51 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
In-Reply-To: <199606211849.LAA04215@mail.pacifier.com>
Message-ID: <Pine.SUN.3.93.960621170212.3961B-100000@polaris>


On Fri, 21 Jun 1996, jim bell wrote:

> [rest of letter to Leahy deleted]

> Since "everybody" is supposed to agree that the Leahy encryption bill is 
> dead, dead, dead, I don't see this as being any kind of problem.  It was 
> disliked by Clinton and the Denning-types, and with the exception of a short 
> flurry of mistaken optimism around here, it was roundly excoriated here as 
> well.  

To which which Leahy Bill are you referring?

> Jim Bell
> jimbell at pacifier.com

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From hacksaw at holly.ColoState.EDU  Fri Jun 21 19:33:05 1996
From: hacksaw at holly.ColoState.EDU (Marc Hopkins)
Date: Sat, 22 Jun 1996 10:33:05 +0800
Subject: unsuscribe
Message-ID: <Pine.A32.3.91.960621144854.52010A-100000@holly.ACNS.ColoState.EDU>


unsuscribe






From se7en at dis.org  Fri Jun 21 19:36:05 1996
From: se7en at dis.org (se7en)
Date: Sat, 22 Jun 1996 10:36:05 +0800
Subject: Science Lessons in the Mountains of New Mexico
Message-ID: <Pine.BSI.3.91.960621133903.12753A-100000@kizmiaz.dis.org>




Cryptography may not academic science's only contribution to making 
business work in an unpredictable, technology-driven world. If a growing 
community of natural scientists, social scientists, and business 
theorists are right, then the cryptographic algorithms taht make 
electronic transactions secure will soon seem downright prosaic.

This unusual admixture of pure researchers and real-world practitioners 
tends to congregate around research institutions in New Mexico, which has 
been a scientific hotbed ever since the atomic bomb project of the 1940s.

The current thinkers are looking into not just mathematical complexity, 
but complexity itself. Complexity theory. Complex systems of any 
definition--the weather, perhaps, or the human immune system, or the 
organizational behavior of insects--and how their workings and 
adaptations might hold lessons for other fields, not least business.
 
It all comes together at the Santa Fe Institute, at a hilltop cul de sac 
just far enough removed from the New Mexico tourist mecca to give a small 
community of visiting researchers the distance and quiet they need to 
contemplate anything from the microbial to the cosmic.

The Santa Fe Institute was founded in 1984 on the idea that molecular 
biologists, cosmologists, and virtually any other specialists could make 
interdisciplinary breakthroughs through shared perspectives. 

"Putting people together from different fields is what we do," said 
institute vice president L.M. "Mike" Simmons. "The theme is 
multidisciplinary research on complex systems."

"This is a place where people can get away, exchange ideas, and learn 
from each other--to harness creativity at the boundries between fields."

In a classic example, immune-system research cross-pollinated with 
computer science and produced a computer security technique that protects 
against viruses and other attacks.

Business and economics are very much in the mix with earth sciences, 
genetics, and advanced products of computer science like adaptive 
computation, machine learning, and artificial life. Software guru Esther 
Dyson, retired BankAmerica Corp. chairman Leland Prussia, and Stewart 
Brand of Whole Earth Catalog fame are institute trustees.
 
Kenneth Arrow, the Stanford University economist and Nobel Prize winner, 
sits on the institute's science board. The board's co-chairmen are 
trustees Murray Gell-Mann, a Nobel Laureate in physics from California 
Institute of Technology, and John Holland, a leading complexity theorist 
from the University of Michigan.

Prof. Gell-Mann happens to be "in residence" on the subject of 
"complexity, entropy, and teh physics of information."

In 1994, Santa Fe Institute launched a Business Network for Complex 
Systems Research. The more than 25 members include Allied/Signal, Boston 
Consulting Group, John Deere, Ernst & Young, McKinsey & Co., Pacific 
Bell, Shell, and one financial services representative--Citicorp.

The members each pay $25,000 a year to support the institute's complex 
systems research. In return, they have access to the research and the 
scientists, meet periodically to pursue and share lessons, and nad send 
representatives to summer school to rub shoulders with doctoral fellows.

Citicorp has sadi little about its involvement or what it gets out of it. 
"They've been a big supporter since our first economics program in 1987," 
Mr. Simmons said. "I can only conclude that they support the mission of 
pure research."

Citicorp has gone so far as to endow a Santa Fe Institute professorship, 
held by Stanford economist Brain Arthur, who directs the program on "The 
Economy as a Complex Adaptive System." Mr. Arthur has done some deep 
thinking about how knowledge- and information-based economic forces turn 
the iron law of diminishing returns on its head. His notion of 
"increasing returns"--defined by Wired magazine as "the more you sell, 
the more you sell"--influenced the Justice Department in its decision to 
block the proposed Microsoft-Intuit merger last year.

Mr. Arthur presumably has influenced Citicorp's strategic thinking. Colin 
Crook, the bank's chief technology officer, quotes him liberally in 
campaigning for a more "adaptive" organization and culture.

Meanwhile, the Citicorp-Santa Fe axis is spawning synergistic byproducts 
of its own.

The Financial Services Technology Consortium, a group of 14 mostly large 
U.S. banks that Citicorp organized to explore and test emerging payment 
and communications technologies, has worked closely with the Department 
of Energy's national research laboratories. Santa Fe is conveniently 
situated between two of them--Sandia, to the south in Albuquerque, and 
Los Alamos, a half-hour drive northwest--and many consortium meetings 
have been held in the area on such subjects as data security, biometric 
identification, and fraud control. 

Plenty of Los Alamos brainpower--Mr. Simmons himself spent much of his 
career there--is now concentrated at the Santa Fe Institute.

The Smart Card Forum, another initiative of Mr. Crook's Citicorp 
technology office, has parallel Santa Fe connections that may be getting 
stronger. Catherine Allen, the former Citibank vice president and 
founding chairman of the Smart Card Forum, has settled in New Mexico to 
launch a consulting firm, the Santa Fe Group. She expects to keep working 
for the forum and on card-technology advances while pursuing new ideas 
and business opportunities in emerging management and complexity theories.

Ms. Allen has developed close ties to the Santa Fe Center for Management 
Strategy, which has been trying to link the Santa Fe Institute principles 
with business problems in a seminar series called "Complexity and 
Strategy in Action." The collaboration may result in one or more ongoing 
forums to expose business people from various industries and disciplines 
to the new ideas. 

The management center was organized by Howard Sherman, a successful 
franchising enteprenuer, one-time philosophy professor, and member of the 
Santa Fe Institute's business network, whose intellectual quest runs from 
Plato and Aristotle through Kant to Einstein and Brian Arthur.

"Brian Arthur has said that all business problems and failures are 
cognitive problems and failures," Mr. Sherman said. "I am interested in 
the impact of complexity on what he and I call "the cognitive."

se7en

-------------------------------------------------------------------------

Resources:

Los Alamos National Laboratory
Industrial Partnership Office
Irene Gabel 505-665-2133

The Santa Fe Group
Catherine Allen
505-466-6434

Santa Fe Institute
Bruce Abell or Mike Simmons
505-984-8800

Santa Fe Center for Management Strategy
Howard Sherman
505-466-7901

Sandia National Laboratories
Technology Transfer and
Commercialization Center
Warren Siemens 505-843-4200







From unicorn at schloss.li  Fri Jun 21 19:58:02 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sat, 22 Jun 1996 10:58:02 +0800
Subject: Cash Is Dying
In-Reply-To: <199606141129.LAA29891@pipe3.ny2.usa.pipeline.com>
Message-ID: <Pine.SUN.3.93.960621172722.3961C-100000@polaris>


On Fri, 14 Jun 1996, John Young wrote:

>    6-14-96: NYT ad for The New York Times Magazine: 
>  
>  
>    Cash is dirty. 
>  
>    Cash is heavy. 
>  
>    Cash is quaint. 
>  
>    Cash is expensive. 
>  
>    CASH IS DYING. 

Someone stole my article.
---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From janzen at idacom.hp.com  Fri Jun 21 20:03:35 1996
From: janzen at idacom.hp.com (Martin Janzen)
Date: Sat, 22 Jun 1996 11:03:35 +0800
Subject: DCSB: Electronic Commerce: The State of the Art
In-Reply-To: <19960621090343293.AAA253@geoff>
Message-ID: <9606211927.AA14661@sabel.idacom.hp.com>


-----BEGIN PGP SIGNED MESSAGE-----

Geoff Klein writes:
> [...]
> In the process of testing PSecure I have collected from the 
> keyservers, the keys of most people on the list who pgp sign their 
> messages. (Another neat feature of PSecure makes this a one click task)

> I could quite easily perform the service of bouncing messages with bad 
> signature back to the list.

> Please let me know if people agree that this would be a useful 
> service, or is it inappropriate ?

Bounced messages would probably be considered inappropriate noise by
most list members.  However, what about bouncing the message back to the
sender only?  This alerts him to a possible problem -- a bad keyserver
entry, an attempted forgery, a mail transmission error, etc. -- without
bothering everyone else.

MJ

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcr3eG3Fsi8cupgZAQGprwP/RwVsYIiMZ5ZmMTM+d6i/p4u6sUdV0Jye
MFtPX79z2mcW8Mr7LpWqYNZojbr2lLvBie9kIsjKJDdYcvMrs5/5Mgagm4TlKIss
mRHve7HuijdTO17p8heHdjbIYo2Rk57O/8oYafHU9hit3+dpsX7OdQB3oFKH0Uy2
MQKry5CU+qc=
=k0VT
-----END PGP SIGNATURE-----





From tcmay at got.net  Fri Jun 21 20:05:10 1996
From: tcmay at got.net (Timothy C. May)
Date: Sat, 22 Jun 1996 11:05:10 +0800
Subject: Oil Change software snoops through hard drive
Message-ID: <adf03dbc080210043817@[205.199.118.202]>


At 2:17 AM 6/21/96, Alan Lewine wrote:
>But this isn't MS's RegWiz. It's capabilities sound much greater, and
>it's not clear how to opt out, etc. from the press release:
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Not buying it and not installing it would appear to be an easy way to "opt out."

(Unless the rumors are true that U.S. Programmer-General Janet Reno will
soon propose "software registration escrow," a voluntary program to meet
the legitimate needs of law enforcement by requiring the voluntary
installation of such programs as Oil Change. Know as "GAP," for "Government
Access to Programs," this system will ensure that child pornographers and
nuclear terrorists will not get access to forbidden programs.)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From editor at cdt.org  Fri Jun 21 20:12:13 1996
From: editor at cdt.org (Bob Palacios)
Date: Sat, 22 Jun 1996 11:12:13 +0800
Subject: CDT Policy Post 2.25 -  Senate Encryption Hearing to be "Cybercast" Live Online6/26
Message-ID: <v02140b05adf0b873d9b1@[204.157.127.16]>


-----------------------------------------------------------------------------
    _____ _____ _______
   / ____|  __ \__   __|   ____        ___               ____             __
  | |    | |  | | | |     / __ \____  / (_)______  __   / __ \____  _____/ /_
  | |    | |  | | | |    / /_/ / __ \/ / / ___/ / / /  / /_/ / __ \/ ___/ __/
  | |____| |__| | | |   / ____/ /_/ / / / /__/ /_/ /  / ____/ /_/ (__  ) /_
   \_____|_____/  |_|  /_/    \____/_/_/\___/\__, /  /_/    \____/____/\__/
   The Center for Democracy and Technology  /____/     Volume 2, Number 25
----------------------------------------------------------------------------
      A briefing on public policy issues affecting civil liberties online
----------------------------------------------------------------------------
 CDT POLICY POST Volume 2, Number 25                        June 21, 1996

 CONTENTS: (1) June 26 Senate Encryption Hering to be "Cybercast" Live Online
           (2) Submit Your Comments for the Hearing Record
           (3) Attend the S.A.F.E. Forum on Encryption - July 1, Stanford, CA
           (4) How to Subscribe/Unsubscribe
           (5) About CDT, contacting us

  ** This document may be redistributed freely with this banner intact **
        Excerpts may be re-posted with permission of <editor at cdt.org>
         ** This document looks best when viewed in COURIER font **
-----------------------------------------------------------------------------

(1) SENATE ENCRYPTION HEARING TO BE "CYBERCAST" LIVE ON THE NET JUNE 26

In a historic first that demonstrates the increasing power of the Internet
Community as a political force, HotWired, DIGEX, the Voters
Telecommunications Watch, and the Center for Democracy and Technology have
teamed up to provide a live, interactive "cybercast" of the Senate Commerce
Subcommittee encryption hearing on Wednesday June 26.

The "cybercast" will provide netizens concerned about privacy and security
on the Internet the ability to participate in the hearing, ask questions of
the witnesses, and submit comments for the record.  Details on how you can
participate are printed below.

This hearing is the second encryption hearing held before the Senate
Subcommittee on Science, Space and Technology; the first hearing was held
on June 12.  Subcommittee Chair Sen. Conrad Burns (R-MT) presided over both
hearings.

Witnesses scheduled to testify at the hearing, which will focus on the
Burns/Leahy Pro-CODE bill (S. 1726) include:

* Phil Zimmermann, Inventor of PGP
* Whit Diffie, Father of Public-Key Cryptography
* Jerry Berman, Executive Director, Center for Democracy and Technology
* Matt Blaze, Cryptographer
* Phil Karn, Cryptographer
* Barbara Simons, Chair of US Public Policy Committee, ACM
* Marc Rotenberg, Director, Electronic Privacy Information Center
* AND YOU!! (See below for details)

The hearing will focus on the need to reform US encryption policies,
proposals to relax export controls on encryption, and the privacy issues
raised by the current policy.  Specific information on the schedule,
including approximate times the witnesses will testify, will be posted
within the next few days at the URLs listed below.

HOW TO JOIN THE HEARING LIVE ONLINE

The following sites contain detailed information on how you can
participate. Please visit these sites often for the latest information:

* http://www.senate.gov/~burns/crypto.htm
* http://www.crypto.com/
* http://www.cdt.org/crypto/
* http://www.hotwired.com/wiredside/
* http://www.digex.net/crypto/

INSTRUCTIONS:  On Wednesday June 26, 1996, between 9:00 am ET and 1:00
               pm ET, point your web browser at:

                   http://www.hotwired.com/wiredside/

WHAT YOU NEED: You will need to have RealAudio properly installed on
               your computer in order to participate in this event.  You

               can download RealAudio software *FREE* by visiting
               (http://www.realaudio.com/)

               All netizens with realauido capabilities can listen to
               the hearing live online. In order to participate in the
               accompaning chat session (and to ask questions of the
               witnesses) you will need to be a member of HotWired.
               Membership is *FREE*! Visit http://www.hotwired.com/ for
               details.
________________________________________________________________________

TELL CONGRESS WHY ENCRYPTION IS IMPORTANT TO YOU - ADD YOUR VOICE TO THE
CONGRESSIONAL RECORD

Senator Burns, Senator Patrick Leahy (D-VT) and the other sponosors of the
Pro-CODE bill want to hear from the Net.community about why encryption is
important to privacy and security on the Internet.

Please be sure to visit http://www.crypto.com/ and add your voice to the
debate over encryption policy on Capitol Hill.  Responses will be tabulated
and the results, along with selected statements, will be included in the
Congressional Record by Senator Conrad Burns.  The restults will also be
featured during the Security and Freedom through Encryption Forum (SAFE) on
July 1 (details on that event are attached below).

To add your voice to the crypto debate in Congress, visit:

   http://www.crypto.com/submit/

________________________________________________________________________

ATTEND THE SAFE FORUM - JULY 1, 1996 STANFORD CALIFORNIA

On July 1, 1996, in the heart of California's Silicon Valley at Stanford
University, members of Congress, prominent computer industry leaders and
privacy advocates will meet to discuss the need to reform U.S. encryption
policy.

The event is FREE and open to the public, but space is limited and is going
fast.  To find out more, and to reserve your free ticket, visit the SAFE
Forum Web Page at:

  http://www.crypto.com/safe/

CONFIRMED SPEAKERS INCLUDE:

Among other prominant industry leaders, cryptographers, privacy advocates
and members of Congress, confirmed speakers include:

Industry Leaders and Cryptographers        Members of Congress

* Marc Andreeson, Netscape                 * Rep. Anna Eshoo (D-CA)
* Jim Bidzos, RSA                          * Rep. Tom Campbell (R-CA)
* Eric Schmidt, Sun Microsystems           * Rep. Zoe Lofgren (D-CA)
* Brad Silverberg, Microsoft               * Sen. Conrad Burns (R-MT)
* Phil Zimmermann, PGP Inc                 * Sen. Patrick Leahy (D-VT)
* Matt Blaze, AT&T                         * Sen. Larry Pressler (R-SD)
* Bruce Schneier, Counterpane Systems

Privacy Advocates and Legal Experts:

* Michael Froomkin, U. of Miami Law School
* Jerry Berman, Center for Democracy and Technology
* Grover Norquist, Americans for Tax Reform (invited)
* Ken Dam, U. of Chicago Law School (invited)

This event will be "cybercast", whith full audio and still video clips,
live online with the help of MediaCast.  Details on the cybercast are
available at http://www.crypto.com/safe/

SAFE FORUM SPONSORS

This important discussion on the need for an alterative policy to protect
privacy and security and promote commerce on the Global Information
Infrastructure is being made possible by the generous support of the
following companies and public interest organizations:

America Online
Americans for Tax Reform
AT&T
Business Software Alliance
Center for Democracy and Technology
Center for National Security Studies
Commercial Internet eXchange
CompuServe Incorporated
Computer Professionals for Social Responsibility
Cylink Corporation
EDS
Electronic Frontier Foundation
Electronic Messaging Association
Electronic Privacy Information Center
Information Technology Association of America
IEEE - USA
MediaCast
Media Institute
Microsoft Corporation
Netcom Online Communication Services
Netscape Communications Corporation
Novell, Inc.
Oracle Corporation
Pacific Telesis
PGP Inc.
Prodigy, Inc.
Progress and Freedom Foundation
Securities Industry Association
Software Publishers Association
Sybase, Inc.
Voters Telecommunications Watch
Wired Magazine

Please visit the SAFE Forum Home Page for more information.
(http://www.crypto.com/safe/)

------------------------------------------------------------------------
(4) SUBSCRIPTION INFORMATION

Be sure you are up to date on the latest public policy issues affecting
civil liberties online and how they will affect you! Subscribe to the CDT
Policy Post news distribution list.  CDT Policy Posts, the regular news
publication of the Center For Democracy and Technology, are received by
nearly 10,000 Internet users, industry leaders, policy makers and
activists, and have become the leading source for information about
critical free speech and privacy issues affecting the Internet and other
interactive communications media.

To subscribe to CDT's Policy Post list, send mail to

     policy-posts-request at cdt.org

with a subject:

     subscribe policy-posts

If you ever wish to remove yourself from the list, send mail to the
above address with a subject of:

     unsubscribe policy-posts

-----------------------------------------------------------------------
(5) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US

The Center for Democracy and Technology is a non-profit public interest
organization based in Washington, DC. The Center's mission is to develop
and advocate public policies that advance democratic values and
constitutional civil liberties in new computer and communications
technologies.

Contacting us:

General information:  info at cdt.org
World Wide Web:       URL:http://www.cdt.org/
FTP                   URL:ftp://ftp.cdt.org/pub/cdt/

Snail Mail:  The Center for Democracy and Technology
             1634 Eye Street NW * Suite 1100 * Washington, DC 20006
             (v) +1.202.637.9800 * (f) +1.202.637.0968

-----------------------------------------------------------------------
End Policy Post 2.25                                            6/21/96
-----------------------------------------------------------------------







From minow at apple.com  Fri Jun 21 20:13:57 1996
From: minow at apple.com (Martin Minow)
Date: Sat, 22 Jun 1996 11:13:57 +0800
Subject: "Filegate" may be good news for us
Message-ID: <v02140b03adf0b54b6a82@[17.202.12.102]>


>The current flap over the Clinton Administration's request for and receipt
>of FBI dossiers is being called "Filegate." The Administration has claimed
>the requests were innocent, and based on outmoded Secret Service lists. The
>Secret Service denies this, and says the list did not come from them. ...

>Why is this good news for us? (Besides the partisan issue of embarrassing
>and degrading the current government, which is always a good thing.)
>
>Because it underscores how difficult it is, even with ostensible
>safeguards, to control the distribution of dossiers, secret files, and
>surveillance reports.

Another reason is that it shows the problems with sensitive data even if
people have *legitimate* access to that data (i.e., assuming that there
was no mischief involved.

Ignoring all privacy issues, escrowed encryption keys will be extremely
valuable as they will allow insight into financial transactions. Thus,
they will be very attractive targets for economic espionage.

Martin Minow
minow at apple.com







From unicorn at schloss.li  Fri Jun 21 21:02:09 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sat, 22 Jun 1996 12:02:09 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
In-Reply-To: <199606212219.PAA15671@mail.pacifier.com>
Message-ID: <Pine.SUN.3.93.960621181926.3961D-100000@polaris>


On Fri, 21 Jun 1996, jim bell wrote:

> At 05:03 PM 6/21/96 -0400, Black Unicorn wrote:
> >On Fri, 21 Jun 1996, jim bell wrote:
> >> Since "everybody" is supposed to agree that the Leahy encryption bill is 
> >> dead, dead, dead, I don't see this as being any kind of problem.  It was 
> >> disliked by Clinton and the Denning-types, and with the exception of a short 
> >> flurry of mistaken optimism around here, it was roundly excoriated here as 
> >> well.  
> >
> >To which which Leahy Bill are you referring?
> 
> The one introduced on February 26, 1996.

I think the above message was refering to "procode" however.

> Jim Bell
> jimbell at pacifier.com
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From nelson at crynwr.com  Fri Jun 21 21:20:26 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 22 Jun 1996 12:20:26 +0800
Subject: Cash Is Dying
In-Reply-To: <199606141129.LAA29891@pipe3.ny2.usa.pipeline.com>
Message-ID: <19960621223557.21390.qmail@ns.crynwr.com>


On Fri, 14 Jun 1996, John Young wrote:

>    6-14-96: NYT ad for The New York Times Magazine: 
>  
>  
>    Cash is dirty. 
>  
>    Cash is heavy. 
>  
>    Cash is quaint. 
>  
>    Cash is expensive. 
>  
>    CASH IS DYING. 

Cash is anonymous.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade;
Potsdam, NY 13676       | +1 315 268 9201 FAX   | governments coerce.





From raph at cs.berkeley.edu  Fri Jun 21 21:23:58 1996
From: raph at cs.berkeley.edu (Raph Levien)
Date: Sat, 22 Jun 1996 12:23:58 +0800
Subject: Federal Key Registration Agency
In-Reply-To: <Pine.SUN.3.94.960620211746.20271D-100000@viper.law.miami.edu>
Message-ID: <31CB030B.6BE0@cs.berkeley.edu>


Perry E. Metzger wrote:
> 
> Michael Froomkin writes:
> > I have seen the text of the speech.  The wire service accounts wildly,
> > wildly exaggerate.  This is a non-story...except for AG Reno's assertion
> > that it would take the government a year to break one DES message with a
> > "supercomputer".  She presumably believes this.  We know the number for
> > known plaintext attacks, but assuming you don't have a known plaintext,
> > what's a more reasonable assumption?
> 
> Known plaintext isn't needed for any brute force DES attack. Indeed,
> our own Dave Wagner showed in a paper not that long ago how to
> automate the process of detecting a good key.
> 
> The numbers in the Blaze et al paper are very realistic on this. A
> year is total bull -- not even within several orders of magnitude of
> accuracy.

Further, known plaintext is actually a very reasonable assumption. In 
S/MIME, for example, the first 8-byte block of text is almost certain to 
be 43 6f 6e 74 65 6e 74 2d, (i.e. the string "Content-"). This makes the 
process of analyzing the results trivial.

Raph





From unicorn at schloss.li  Fri Jun 21 21:49:40 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sat, 22 Jun 1996 12:49:40 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
In-Reply-To: <199606212303.QAA18192@mail.pacifier.com>
Message-ID: <Pine.SUN.3.93.960621190453.17997B-100000@polaris>


On Fri, 21 Jun 1996, jim bell wrote:

> At 06:19 PM 6/21/96 -0400, Black Unicorn wrote:
> >On Fri, 21 Jun 1996, jim bell wrote:
> 
> >> >> Since "everybody" is supposed to agree that the Leahy encryption bill is 

> >> >To which which Leahy Bill are you referring?
> >> 
> >> The one introduced on February 26, 1996.
> >
> >I think the above message was refering to "procode" however.

> Certainly not by name.  It merely referred to legislation that Leahy "sponsored." 
>  Leahy _did_ seem to act like he was in favor of the Burns bill, as well,  
> after ECPA got the bad press, and maybe he's a co-sponsor of the Procode 
> bill as well.  Even so, the letter did not appear to be CC:'d to Burns, so I 
> conclude that it was intended to refer to at least the ECPA, if not both bills.  

Specter wrote to Leahy because the two of them get along well.  (Recall
the Clipper hearings for example) and because Specter and Burns do not.

It may also explain things to realize that Leahy wrote the circular asking
for other Senators to support the bill.  Specter is probably responding to
that.

Leahy's office has been the point unit for crypto initatives because their
legal staff are the only ones who really understand what is going on or
are able to answer questions intelligently.

Be careful with your assumptions and take replies to e-mail please.

> 
> Jim Bell
> jimbell at pacifier.com
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From hua at XENON.chromatic.com  Fri Jun 21 22:07:13 1996
From: hua at XENON.chromatic.com (Ernest Hua)
Date: Sat, 22 Jun 1996 13:07:13 +0800
Subject: For the public record: My submission for the crypto hearings (LONG)
Message-ID: <199606212158.OAA03503@server1.chromatic.com>



I would encourage others to submit their opinions ASAP at:

    http://www.crypto.com

Ern

------- Forwarded Message

Date: Fri, 21 Jun 1996 17:47:51 -0400 (EDT)
From: hua at chromatic.com
Subject: Testimony submitted for Congressional hearings on 6/26/96

The following testimony was submitted from http://www.crypto.com/submit/
Please contact Shabbir J. Safdar at shabbir at vtw.org if any information is not 
correct.

Do you use encryption technogies today (e.g., PGP, etc..):
 no

If no, why not:
 Because it is not built in to a lot of the products I use today (e.g.  email 
programs)

As an Internet user, security and encryption are crucial to my
privacy because:
 Both 1 and 2 equally

Tell us more about why you would (or would not) use strong
encryption as an individual Internet user:
 Unlike murder, terrorism, burglary, etc, there are activities which
are socially "borderline", meaning that some people want to outlaw
but some people don't.  There are activities which may be embarassing
to publicly acknowledge, but aren't really illegal.

I firmly believe in our legal system, but I also firmly believe that
there are questionable laws, and today's criminals and trouble makers
could be tomorrow's civil right advocates or Nobel peace prize
winners or freedom fighters.

Encryption does not allow these "questionable" people to murder or
harm anyone.  It is just software.  It is not a knife or a gun.

Unlike what the FBI wants everyone to believe, encryption does not
mean hackers can now break into the Federal Reserve and destroy the
US banking system (in fact, encryption, among many other technologies,
help protect these systems in the first place).

As a business owner or employee, security and encryption are
critical to my business because:
 Both 1 and 2 equally

Tell us more about why you would (or would not) use strong
encryption as a business user of the Internet:
 Hackers, viruses, industrial espionage, privacy, network traffic
control, time stamping, etc.

I don't believe, for a moment, that being a government official
exempts a person from having character flaws or less-than-saintly
behavior.  I don't think they are necessarily any WORSE either,
but I believe everyone is human to some degree.  There are honest
mistakes, there are less-than-honest mistakes, and there may, on
rare occasions, be horrible evil.  We must hold people in power
(governmental and otherwise) to high standards, but we cannot
lower our guard just because we expect them to be saintly.

Given what you know about Key Escrow systems:
 I would use an escrow system only if I could choose the key holder (including 
my friends, lawyer, accountant, etc.)

Do you think that the government should be able, under certain
circumstances, for a limited time, and only with the specific authorization
of a Judge, have the authority to conduct electronic surveillance in order
protect public safety and national security?
 Yes

Tell us why or why not:
 I think the government should have the resources to be "above
current technology".  They can invest in super-wiz-bang decryption
and surveillance technology that the ordinary person cannot buy
or make.  However, if the ordinary person can buy or make it, then
it is silly to think that a law will make a criminal NOT buy or
make it.  Just look at the illegal weapons trade as an example.

Encryption should be illegal if it a morally, ethically bad thing
to possess or use.  However, making it illegal just because it
becomes extremely inconvenient for law enforcement is like
requiring that every room in every house be installed with a
government-approved video camera, just in case you were involved in
some illegal activity.  Afterall, significant percentages of child
abuse or child molestation (or pick your favorite emotionally-charged
crime) are done within the comfort of the child's home.

This last idea, about the cameras in every room, is not that far off
in some countries.  Britain has cameras in many public areas already.
It would be law enforcement's (excuse the language) "wet dream" to
have such all-seeing access.  The only reason they have not asked for
it is because it would never be acceptable to the public.

But, unlike video cameras, encryption is something which very few
people understand yet, so the FBI can feel okay about asking for
something which only a few "hackers" and "liberals" are against.

What does strict control of encryption buy law enforcement?
Not much.

Encryption is only hides information, but the more globally accepted
illegal behaviors are far more tangible than information.  A murder
assumes that there is a missing person or dead body or traces to be
recovered.  A molested child assumes that there is a child who is
harmed.  No amount of super-military strength encryption can hide
these physical things.

So this issue becomes one of why should we give up privacy for the
sheer convenience of the law enforcement community.

There is also the question of why, no matter how much escrowing,
should there be a strength limitation on encryption?

Who ELSE is trying to decode this stuff besides law enforcement,
who presummably has access to the escrowed keys?

This aspect of the pro-escrow proposals raises all sorts of
questions about just how much hidden abuse is there in the
government.

If you are not a US citizen (and live out side the US) and you
use encryption, please tell us what you use and how you obtained it.
 I am now a citizen, but I was previously a citizen of Taiwan during
some very tough times.  The government was honest about violation of
privacy:  On the phones were clear warnings stating that you should
NOT talk about political issues over the phone; you may be tapped.

That's not a nice situation, but at least they were honest about how
widespread the use of wiretaps would be.  And those were exceptional
times of crisis.

But we, in the US, are not in a time of military-grade crisis.  There
is no foreseeable need for wide-spread imposition of martial law.
There is no uprising, no wide-spread terrorism of any sort.  I just
do not see the need for the surveillance powers that the FBI wants.

Business name:Chromatic Research
Street:615 Tasman Drive, Sunnyvale
State:CA
Zip code:94089-1707
Phone number:(408) 752-9375
Business WWW URL:http://www.chromatic.com
Description of business:
High performance media processors for personal computers.

------- End of Forwarded Message







From jimbell at pacifier.com  Fri Jun 21 22:11:14 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 22 Jun 1996 13:11:14 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
Message-ID: <199606212303.QAA18192@mail.pacifier.com>


At 06:19 PM 6/21/96 -0400, Black Unicorn wrote:
>On Fri, 21 Jun 1996, jim bell wrote:

>> >> Since "everybody" is supposed to agree that the Leahy encryption bill is 
>> >> dead, dead, dead, I don't see this as being any kind of problem.  It was 
>> >> disliked by Clinton and the Denning-types, and with the exception of a short 
>> >> flurry of mistaken optimism around here, it was roundly excoriated here as 
>> >> well.  
>> >
>> >To which which Leahy Bill are you referring?
>> 
>> The one introduced on February 26, 1996.
>
>I think the above message was refering to "procode" however.


Certainly not by name.  It merely referred to legislation that Leahy "sponsored." 
 Leahy _did_ seem to act like he was in favor of the Burns bill, as well,  
after ECPA got the bad press, and maybe he's a co-sponsor of the Procode 
bill as well.  Even so, the letter did not appear to be CC:'d to Burns, so I 
conclude that it was intended to refer to at least the ECPA, if not both bills.  



                          United States Senate
                     Select Committee on Intelligence
 
                             June 7, 1996
                                                   SSCI #96-2219B
 
 The Honorable Patrick J. Leahy
 United States Senator
 Senate Russell Building, Room 433
 Washington, D.C. 20510-4502
 
 Dear Pat:
 
      We write to express our concerns about legislation you have sponsored
 which would impact directly upon federal encryption policy, including export
 control policy.  Recognizing that American innovation in encryption
 technology is unequaled, we appreciate the need to balance US economic
 competitiveness with the need to safeguard national security interests.  As
 such, it is our belief that this legislation requires careful study and
 reflection and that the Senate and the Congress as a whole should proceed
 with caution until all of the implications of such an initiative are fully
 discerned.  Along these lines, it is our understanding that industry
 representatives are currently meeting with the Administration to discuss new
 policy initiatives to address this issue.  Also, both the Congress and the
 Administration have undertaken to conduct a thorough analysis of a two-year
 congressionally-mandated study on federal encryption policy that was
 facilitated by the National Research Council.  We therefore feel that your
 legislation initiative at this time is premature.
 
      We appreciate your efforts to bring some needed clarity to United
 States policy in this area and wish to keep the lines open for discussion
 and debate on this important issue.  The staff point of contact on this
 issue is our Committee Counsel, Mark Heilbrun, who can be reached at
 224-1700.
                                 Sincerely,
 Arlen Specter                                   J. Robert Kerrey
 Chairman                                        Vice-Chairman
 
 cc:  The Honorable Alfonse D'Amato
      Chairman, Senate Committee on Banking

--------------------------------------------------------------------------



Jim Bell
jimbell at pacifier.com





From jimbell at pacifier.com  Sat Jun 22 01:22:45 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 22 Jun 1996 16:22:45 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
Message-ID: <199606212219.PAA15671@mail.pacifier.com>


At 05:03 PM 6/21/96 -0400, Black Unicorn wrote:
>On Fri, 21 Jun 1996, jim bell wrote:
>> Since "everybody" is supposed to agree that the Leahy encryption bill is 
>> dead, dead, dead, I don't see this as being any kind of problem.  It was 
>> disliked by Clinton and the Denning-types, and with the exception of a short 
>> flurry of mistaken optimism around here, it was roundly excoriated here as 
>> well.  
>
>To which which Leahy Bill are you referring?

The one introduced on February 26, 1996.
Jim Bell
jimbell at pacifier.com





From drosoff at arc.unm.edu  Sat Jun 22 03:04:00 1996
From: drosoff at arc.unm.edu (David Rosoff)
Date: Sat, 22 Jun 1996 18:04:00 +0800
Subject: Federal Key Registration Agency
Message-ID: <1.5.4.16.19960622015728.32e7eb0e@arc.unm.edu>


-----BEGIN PGP SIGNED MESSAGE-----

At 03.05 AM 6/21/96 -0700, William Knowles wrote:
>On Thu, 20 Jun 1996, jim bell wrote:

>> If done in parallel, on a dedicated, 200 MHz custom chip, my WAG says that 
>> such a chip could try, and statistically analyze the results of 10 million 
>> DES codes per second.   (it would do the decrypts on a number of parallel 
>> DES blocks, and look for typical ASCII code pattern probabilities, again all 
>> in parallel.)  A typical cracking system might have 100 boards of 100 such 
>> chips, or perhaps a 100 billion such decrypts per second.  Checking the 
>> keyspace would require 2**19 seconds, or about a half million seconds, or 6 
>> days.  Average decrypt, of course, in 3 days.

Wasn't there a crypto paper three or four years ago that said if custom chips
were used, a million dollar custom machine could crack a DES key in less
than a day?

===============================================================================
David Rosoff (nihongo o sukoshi dekiru)  ---------------->  drosoff at arc.unm.edu
For PGP key 0xD37692F9, finger drosoff at acoma.arc.unm.edu
0xD37692F9  Key fingerprint =  25 7D AA 01 85 41 43 89  50 5A 33 76 F1 F1 99 67
Non-technical beginner's guide to PGP ---> http://www.arc.unm.edu/~drosoff/pgp/
Anonymous ok, PGP ok.  If it's not PGP-signed, you know that I didn't write it.
=== === === === === === === === === === === === === === === === === === === ===
"Truth is stranger than fiction, especially when truth is being defined by the
O.J. Simpson Defense Team." -Dave Barry

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMctQlxguzHDTdpL5AQE0MgP9GAtJIBZRhV+VIIqiojiZsO5qz3vqN3xe
5UQ0W1uRxZgckLOs5h57/IiDhAGTwzoB1x4pOKlbsp/Pv2zgDNl5hTAUJiQIKpHX
vdcyJBUYRUCCfHuZfRxXVeEhhWMzSowLvWNVyapLSwFo6exY1ozMgcchy1YSx1sd
kEpJtlUegiE=
=MfyQ
-----END PGP SIGNATURE-----






From unicorn at schloss.li  Sat Jun 22 03:11:53 1996
From: unicorn at schloss.li (Black Unicorn)
Date: Sat, 22 Jun 1996 18:11:53 +0800
Subject: Cash Is Dying
In-Reply-To: <Pine.SUN.3.94.960621221335.28317A-100000@viper.law.miami.edu>
Message-ID: <Pine.SUN.3.93.960621221236.930A-100000@polaris>


On Fri, 21 Jun 1996, Michael Froomkin wrote:

> On Fri, 21 Jun 1996, Black Unicorn wrote:
> 
> > On Fri, 14 Jun 1996, John Young wrote:
> > 
> > >    6-14-96: NYT ad for The New York Times Magazine: 
> > 
> > Someone stole my article.
> > ---
> 
> It was an ok article, but if failed to talk about the privacy costs of
> ecash schemes currently on offer.

His or mine?  :)

> 
> A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
> Associate Professor of Law | 
> U. Miami School of Law     | froomkin at law.miami.edu
> P.O. Box 248087            | http://www.law.miami.edu/~froomkin
> Coral Gables, FL 33124 USA | It's hot here.  And humid.
> 

---
My preferred and soon to be permanent e-mail address:unicorn at schloss.li
"In fact, had Bancroft not existed,       potestas scientiae in usu est
Franklin might have had to invent him."    in nihilum nil posse reverti
00B9289C28DC0E55  E16D5378B81E1C96 - Finger for Current Key Information
Opp. Counsel: For all your expert testimony needs: jimbell at pacifier.com






From froomkin at law.miami.edu  Sat Jun 22 03:22:44 1996
From: froomkin at law.miami.edu (Michael Froomkin)
Date: Sat, 22 Jun 1996 18:22:44 +0800
Subject: Cash Is Dying
In-Reply-To: <Pine.SUN.3.93.960621172722.3961C-100000@polaris>
Message-ID: <Pine.SUN.3.94.960621221335.28317A-100000@viper.law.miami.edu>


On Fri, 21 Jun 1996, Black Unicorn wrote:

> On Fri, 14 Jun 1996, John Young wrote:
> 
> >    6-14-96: NYT ad for The New York Times Magazine: 
> 
> Someone stole my article.
> ---

It was an ok article, but if failed to talk about the privacy costs of
ecash schemes currently on offer.

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin at law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's hot here.  And humid.






From tcmay at got.net  Sat Jun 22 03:27:33 1996
From: tcmay at got.net (Timothy C. May)
Date: Sat, 22 Jun 1996 18:27:33 +0800
Subject: Science Lessons in the Mountains of New Mexico
Message-ID: <adf0a1270a0210049374@[205.199.118.202]>


At 8:39 PM 6/21/96, se7en wrote:
>Cryptography may not academic science's only contribution to making
>business work in an unpredictable, technology-driven world. If a growing
>community of natural scientists, social scientists, and business
>theorists are right, then the cryptographic algorithms taht make
>electronic transactions secure will soon seem downright prosaic.
>
>This unusual admixture of pure researchers and real-world practitioners
>tends to congregate around research institutions in New Mexico, which has
>been a scientific hotbed ever since the atomic bomb project of the 1940s.
...


Se7en,

I am curious. Did you write this, or is this a forwarded article?

If you wrote this, it is very typical of journalistic treatments, and is
well-written. You have a career in journalism ahead of you (or perhaps you
currently are a journalist, under another name, in which case you should
still indicate what your actual journalistic name is, as I doubt you write
under the name "se7en."

If you did not write this, then you need to start including indications
about who did write it, and where it appeared, and that it's a forwarded
article.


--Tim May


Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From remailer at yap.pactitle.com  Sat Jun 22 06:22:24 1996
From: remailer at yap.pactitle.com (Yap Remailer)
Date: Sat, 22 Jun 1996 21:22:24 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
In-Reply-To: <Pine.SUN.3.91.960621065022.12815F-100000@eff.org>
Message-ID: <199606220715.AAA18944@yap.pactitle.com>


In article <Pine.SUN.3.91.960621065022.12815F-100000 at eff.org> Declan McCullagh <declan at eff.org> writes:

Don't confuse Kerry and Kerrey.  This was not Kerry from
Massachusetts.





From snow at smoke.suba.com  Sat Jun 22 06:36:51 1996
From: snow at smoke.suba.com (snow)
Date: Sat, 22 Jun 1996 21:36:51 +0800
Subject: Cash Is Dying
In-Reply-To: <19960621223557.21390.qmail@ns.crynwr.com>
Message-ID: <Pine.LNX.3.93.960622020457.630A-100000@smoke.suba.com>


On 21 Jun 1996 nelson at crynwr.com wrote:
> On Fri, 14 Jun 1996, John Young wrote:
> >    6-14-96: NYT ad for The New York Times Magazine: 
> >    Cash is dirty. 
> >    Cash is heavy. 
> >    Cash is quaint. 
> >    Cash is expensive. 
> >    CASH IS DYING. 
> Cash is anonymous.

	And will remain as long as it still is. E-cash is a great idea,
and I hope to see it _really_ working soon, but it will not be anonymous
anytime in the forseable future.

	Also, people won't trust it. Not the people that read this list, I
trust some of the people here, and if they say it works, I trust that. Not
just one, but _all_ of the group I trust. No, people like my parents and
other relatives. People smart enough to read the papers, and smart enough
not to trust everything the "experts" say. 

	Cash is easy, cash is plentiful, you can hold cash in your hand
and KNOW that you have it.

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From stewarts at ix.netcom.com  Sat Jun 22 06:40:34 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 22 Jun 1996 21:40:34 +0800
Subject: Federal Key Registration Agency
Message-ID: <199606220714.AAA25885@toad.com>


>Michael Froomkin writes:
>> I have seen the text of the speech.  The wire service accounts wildly,
>> wildly exaggerate.  This is a non-story...except for AG Reno's assertion
>> that it would take the government a year to break one DES message with a
>> "supercomputer".  She presumably believes this.  ....

At 07:54 AM 6/21/96 -0400, Perry wrote:
>The numbers in the Blaze et al paper are very realistic on this. A
>year is total bull -- not even within several orders of magnitude of
>accuracy.

Actually, it may even be low - Cray-type supercomputers aren't particularly
designed for the bit-twiddling you need to do DES well.  An application-
specific cracking machine can do it several orders of magnitude faster
for a smaller amount of money.  Wiener's design was two orders of magnitude
more cost-effective than the two previous designs (Peter Wayner's content-
addressible-memory design and somebody-from-DEC's GaAs chip design were
both about $50M for a 1-day crack), and those were substantial breakthroughs
when they came out.  

But yes, she's giving out very misleading numbers for what cracking DES 
really costs, and I'd assume she's way too competent to be doing so
by accident - or at least she should be...

As far as Jim Bell's cracking cost estimates go, a Wiener-style machine
would cost about $1M for a 3.5-hour crack, or about 7 keys per day
with known plaintext.  If the on-chip penalty for detecting probable patterns
instead of specific ones is small (e.g. first cut is to accept keys which
have all the high-bits zero, which is 1/256 of the total), you should be
able to do better than three days per crack, especially if it's also not
too expensive to haul the key-schedule out of the chip on the 1/256 hits.
Double the cost if you think there's a random initialization vector,
and do other minor annoying things to the chip design if you're checking
for several popular known plaintexts and other creeping featurism,
and you're still close.  You may be willing to feed the hits from the
first round set of crunching into a more normal computer as well...

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From stewarts at ix.netcom.com  Sat Jun 22 06:47:22 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 22 Jun 1996 21:47:22 +0800
Subject: Win95 Blowfish Implementation
Message-ID: <199606220824.BAA26724@toad.com>


>So correct me if any of the following statements are incorrect:
>1. Blowfish is not patented and can be used without royalty.

According to Schneier's book (which should be authoritative,
since it's his algorithm), the algorithm is unpatented
and the C code in the back of the book is public domain.

>2. SHA can be used without royalty.
Yup.  Use SHA-1 rather than the original SHA, though; the NSA
"updated" it in ways that do appear to strengthen it.

>3. MD5 can be used without royalty if the RSAREF library is used, 
>and if the proper credit is given to RSA.
>Also, can the MD5 algorithm be used outside the RSAREF library?  In 
>other words, can I rewrite the code to take in effect MFC classes?

Yeah.  I think there's even an RFC that comments on it.

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From WlkngOwl at unix.asb.com  Sat Jun 22 06:47:57 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sat, 22 Jun 1996 21:47:57 +0800
Subject: Science Lessons in the Mountains of New Mexico
Message-ID: <199606220915.FAA16203@unix.asb.com>


So where did you get this promotional hype? At least quote your 
sources. (Or did you write this?)

The tone of that piece sounds like an advert telling me to invest $$$ 
into Santa Fe Inst.

On 21 Jun 96 at 13:39, se7en wrote:
[..]
> The current thinkers are looking into not just mathematical complexity, 
> but complexity itself. Complexity theory. Complex systems of any 
> definition--the weather, perhaps, or the human immune system, or the 
> organizational behavior of insects--and how their workings and 
> adaptations might hold lessons for other fields, not least business.
[..]

Methinks "Complexity theory" (aka Dynamical Systems Theory) is 
wonderful hype to get research grants.  Certain people think by 
throwing money into this area that they can predict better, when much 
of theory deals with how these systems *cannot* be well predicted in 
*some* areas of behavior.  Other people over-mystify the complexity of 
a system and declare *nothing* can be predicted, of course.

Something akin to 60s-70s electrical utility exces bragging to each 
other on golf courses about how they own nuke plants.  Hip thing now 
is for the company to invest in research or use methods based on 
"Chaos Theory"... you'll be really cool at parties if you drop those 
words to people. Any form of analysis that uses lots of variables 
gets labelled as having to do with "Chaos Theory" and the research 
grants grow, even though it may not deal with those variables as a 
*dynamic system*. Substance though?

Not that studies in compelx systems are useless. By far the opposite.
(though the question of useful to *who* is important.  Using chaos 
theory to enhance methods of central control rather than allowing 
emergent behaviors is one downside of what some people are looking to 
the Santa Fe institute for.)

Other than noting crypto in the first paragraph and mentioning 
SmartCards, what does this have to do with crypto and socio- 
political implications of widespread use of crypto?

ObCrypto: similarities in literature on chaos theory and 
cryptanlysis.  I've seens refs to using various forms of chaotic 
equations or cellular automata for crypto, but most of the writers 
seem ignorant of any crypto-literature (never mentioning that 
Wolfram's PRNG is crackable, for instance). 

Backburner Idea: if all 1D CA's are equivalent to LFSRs, and if [need 
to find refs to this alleged proof] all 2+D CA's have an equivalent 
1D CA, then if a crypto algorithm can be duplicated as a CA...

Alas I ramble on about ideas which I am not an expert at...

Rob.


---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From stewarts at ix.netcom.com  Sat Jun 22 06:51:10 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 22 Jun 1996 21:51:10 +0800
Subject: FW: Bashing "Wired"
Message-ID: <199606220824.BAA26718@toad.com>


At 09:32 AM 6/21/96 -0700, you wrote:
>And notice that increasingly the "journalists" are the quoted thinkers and
>strategists in important areas? Someone majors in English, starts writing
>for "Netizen" or "HotWired," and the next thing you know they're debating
>crypto policy with Conrad Burns and Dorothy Denning. We're in an age where
>the medium truly is the message

You don't think the rest of the press is truly any better, do you?
At least on the net, you get to see the horse's mouth on a bad day,
and sometimes you can even meet the people and track down the rumors 
hat eventually become headlines, and pull the wool over your own eyes.

Dorothy Denning may know a lot of mathematics about cryptography, 
but that doesn't make her any more fit to decide what policies the 
government ought to enforce than I am.  She'll get the 
technical details correct far more often than Senator Burns,
as would most people here, but being a trained ethicist would perhaps
be more relevant than being a trained mathematician - it doesn't take
that much technical explanation to know that crypto lets you have
private conversations.


#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From jya at pipeline.com  Sat Jun 22 09:15:57 1996
From: jya at pipeline.com (John Young)
Date: Sun, 23 Jun 1996 00:15:57 +0800
Subject: Reno's Cyberspace Address
Message-ID: <199606221108.LAA09746@pipe1.t1.usa.pipeline.com>


   Thanks to LG: 
 
   "Law Enforcement in Cyberspace Address by the Honorable 
   Janet Reno, United States Attorney General." 
 
   Presented to the Commonwealth Club, June 14, 1996. 
 
 
   http://pwp.usa.pipeline.com/~jya/addres.txt  (25 kb) 
 
   ADD_res 
 





From declan+ at CMU.EDU  Sat Jun 22 11:57:15 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sun, 23 Jun 1996 02:57:15 +0800
Subject: FW: Bashing "Wired"
In-Reply-To: <199606220824.BAA26718@toad.com>
Message-ID: <sln00c200YUwI2kng6@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 22-Jun-96 Re: FW: Bashing "Wired" by
Bill Stewart at ix.netcom.c 
> At 09:32 AM 6/21/96 -0700, Tim May wrote:
> >And notice that increasingly the "journalists" are the quoted thinkers and
> >strategists in important areas? Someone majors in English, starts writing
> >for "Netizen" or "HotWired," and the next thing you know they're debating
> >crypto policy with Conrad Burns and Dorothy Denning. We're in an age where
> >the medium truly is the message
>  
> You don't think the rest of the press is truly any better, do you?
> At least on the net, you get to see the horse's mouth on a bad day,
> and sometimes you can even meet the people and track down the rumors 
> hat eventually become headlines, and pull the wool over your own eyes.

Bashing Wired is, in fact, a bit tired itself. I recommend checking out
<http://www.howtired.com/> for one treatment.

Now I'm no fan of Katz's front-pager -- I thought it maundered about and
was twice as long as it needed to be. But folks who write for Wired like
Jim Warren, Brock Meeks, and Mike Godwin (and Katz) do hang out online,
basically know what's going on, and are approachable.

Somehow, I suspect that cypherpunks aren't Wired's target audience...

-Declan






From geoff at commtouch.co.il  Sat Jun 22 13:20:46 1996
From: geoff at commtouch.co.il (geoff)
Date: Sun, 23 Jun 1996 04:20:46 +0800
Subject: Bad Signatures
Message-ID: <19960622151152974.AAB277@geoff>


-----BEGIN PGP SIGNED MESSAGE-----

To: cypherpunks at toad.com
Date: Sat Jun 22 18:22:50 1996

On Fri, 21 Jun 1996 10:15:13 "Travis J.I. Corcoran" wrote:

> I use a lisp package for emacs that I wrote to automatically verify
> signatures on incoming mail, so I already see the 10% of messages
> which are improperly signed displayed in a red "bad signature"
> font. Thus, I'd have no need of this service.
>
> Further, it makes philisophical/political sense to me to have
> verification distributed.  Every node should be doing it's own
> security.

I am not convinced. For a mailing list it makes sense for all members 
to be aware of message integrity problems. Not all cypherpunks have 
your lisp package or Pronto Secure which make signature verification of 
the 10-20 pgp signed messages per day on the list a non trivial task.

I also like the idea that cpunks provides as a byproduct a platform for 
developers to test and debug their security products. We really should 
be getting the bugs out of plain text signatures. You cannot expect Joe 
User to differentiate between an intruder and a gateway massaging the
message.

Geoff Klein
Pronto Secure Product Manager
 



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBMcwPzkLv5OMYFK1FAQH8tgP/Y/Qai5TQj45CGk7U9OdF5BrdycyQpKuE
UfAnlFut/LmgumyiM2wuy6+CPv8mPITAp375rNVx9UxvyRj8Gv8MFfEEuwVFZpNb
WbiWvl2yPBCV/ZBlEdmXJUPhfYto3FFjZX6AwKTMXgHd1j7uW3pBGSW24McEjM2I
aBQ1iDbLUY0=
=Igm9
-----END PGP SIGNATURE-----






From jimbell at pacifier.com  Sat Jun 22 15:14:21 1996
From: jimbell at pacifier.com (jim bell)
Date: Sun, 23 Jun 1996 06:14:21 +0800
Subject: Federal Key Registration Agency
Message-ID: <199606221648.JAA25376@mail.pacifier.com>


At 12:09 AM 6/22/96 -0700, Bill Stewart wrote:

>Actually, it may even be low - Cray-type supercomputers aren't particularly
>designed for the bit-twiddling you need to do DES well.  An application-
>specific cracking machine can do it several orders of magnitude faster
>for a smaller amount of money.  Wiener's design was two orders of magnitude
>more cost-effective than the two previous designs (Peter Wayner's content-
>addressible-memory design and somebody-from-DEC's GaAs chip design were
>both about $50M for a 1-day crack), and those were substantial breakthroughs
>when they came out.  

It would be foolish to use GaAs to build a DES-cracker.  If there's one 
thing we've learned from the fact that microcomputers have "won" against 
mainframes, and massively-parallel computers have "won" against super-speed 
scalars, it is that it is much, much cheaper to build 10 transistors of 
speed "1", than 1 transistor at speed "10."  Presumably, they can get the 
same amount of work done.

The main thing that kept vector (parallel) machines back in the 70's and 
80's was the problem of subdividing programming tasks into hundreds or 
thousands of such tasks, suitable for such a machine.  That "problem" is no 
problem at all for DES cracking, since trying large numbers of codes is 
inherently a decomposable problem.

It seems likely that the most economical solution would be to build the 
cracker on a not-quite state-of-the-art fab, say a 0.5 micron facility, 
purchased from some semiconductor company who has one too many old fabs.  
The costs of the hardware would be amortized already, and the product would 
be sufficiently fast to help minimize the parallelism required.

Jim Bell
jimbell at pacifier.com





From declan at eff.org  Sat Jun 22 15:36:02 1996
From: declan at eff.org (Declan McCullagh)
Date: Sun, 23 Jun 1996 06:36:02 +0800
Subject: IAG: "Non-violent demonstrations" planned after Net-attacks
Message-ID: <Pine.SUN.3.91.960622095337.25469C-100000@eff.org>


I subscribed to the IAG list and there's not much (or anything) happening
on it so far, but the idea has potential. Here's how to join if you're
interested. 

-Declan


// declan at eff.org // I do not represent the EFF // declan at well.com //


---------- Forwarded message ----------
Date: Fri, 21 Jun 1996 11:13:57 -0700 (PDT)
From: Marilyn Davis <madavis at deliberate.com>
To: iag at deliberate.com
Subject: For forwarding: IAG Invitation

  Alabama, Australia, Belgium, California, China, Connecticut, Florida,
  France, Georgia, Germany, Illinois, India, Indonesia, Italy, Jordan,
  Kansas, Malaysia, Maryland, Massachusetts, Montana, New Jersey, New
  York, Oklahoma, Oregon, Pennsylvania, Russia, Saudi Arabia, Singapore,
  South Korea, Sweden, Turkey, United Arab Emirates, U.S., Viet Nam,
  Virginia, and Washington.

 
 ** INTERNET UNDER ATTACK BY LOCAL AND NATIONAL GOVERNMENTS EVERYWHERE **
 
 
                           Fight Back!!
 
 
 Join the Internet Action Group gathering now on the email list:
 iag at deliberate.com.
 
 We will organize simultaneous local non-violent demonstrations at
 coordinated sites around the world in response to local and national
 attacks on the internet.
 
 Our list has new technology for polling ourselves so we can plan
 our actions democratically.
 
 To join the IAG, send a message to majordomo at deliberate.com.  Your
 message should say:
 
 subscribe iag
 
 This initialization of the IAG is the democratic decision of the
 cyber-rights list, cr at deliberate.com.  To join this group or to
 communicate with us, your message to majordomo at deliberate.com
 should say "subscribe cr".

                 <Please circulate widely.>











From tcmay at got.net  Sat Jun 22 15:53:52 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 23 Jun 1996 06:53:52 +0800
Subject: Bad Signatures
Message-ID: <adf17bba000210045c25@[205.199.118.202]>


At 3:12 PM 6/22/96, geoff wrote:

>I am not convinced. For a mailing list it makes sense for all members
>to be aware of message integrity problems. Not all cypherpunks have
>your lisp package or Pronto Secure which make signature verification of
>the 10-20 pgp signed messages per day on the list a non trivial task.
>
>I also like the idea that cpunks provides as a byproduct a platform for
>developers to test and debug their security products. We really should
>be getting the bugs out of plain text signatures. You cannot expect Joe
>User to differentiate between an intruder and a gateway massaging the
>message.
>
>Geoff Klein
>Pronto Secure Product Manager

Trusting others to perform cryptographic functions (encryption, decrytion,
signing, signature verification, etc.) is counter to the usual notions of
security.

Of course, people are free to ask others to do cryptographic functions for
them, to tell them which signatures are valid, and which are not. It's a
free society, after all.

However, I think there's already enough traffic on this list without having
"bounce" messages chastising folks for having signatures that for one
reason or another failed their tests. (Could be munging at _their_ end, for
example.)

Those who want to compile lists of "bad signatures," as determined by their
tests, could include a pointer to a URL at their site which says something
like "A list of suspected bad or improperly-formed signatures may be found
at hyyp://www.key-trust.org"

This heads off having a message with a bad sig generating N more messages
to the list announcing some conclusion or another about the sig. Not
something we need.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From shamrock at netcom.com  Sat Jun 22 16:01:10 1996
From: shamrock at netcom.com (Lucky Green)
Date: Sun, 23 Jun 1996 07:01:10 +0800
Subject: Bad Signatures
Message-ID: <v02120d8cadf1df6287ff@[192.0.2.1]>


At 18:12 6/22/96, geoff wrote:

>> Further, it makes philisophical/political sense to me to have
>> verification distributed.  Every node should be doing it's own
>> security.
>
>I am not convinced. For a mailing list it makes sense for all members
>to be aware of message integrity problems. Not all cypherpunks have
>your lisp package or Pronto Secure which make signature verification of
>the 10-20 pgp signed messages per day on the list a non trivial task.

If you think about the issue in more detail, you will realize that having a
third party do signature verification is no more useful than having a third
party do your encryption for you. In other words, not only is it not
useful, it is downright dangerous, since it provides you with a false sense
of security. If someone wishes to bounce messages that don't verify back to
the originator, great. But please do not further add to list traffic by
bouncing these messages to the list.

Thanks,


-- Lucky Green <mailto:shamrock at netcom.com>
   PGP encrypted mail preferred.
   Disclaimer: My opinions are my own.







From cynthia at usenix.ORG  Sat Jun 22 16:07:57 1996
From: cynthia at usenix.ORG (Cynthia Deno)
Date: Sun, 23 Jun 1996 07:07:57 +0800
Subject: Practical Solutions at USENIX SECURITY Symposium
Message-ID: <199606221754.KAA06702@usenix.ORG>



If you are responsible for your company's computer security,
you may want to attend the 6th USENIX Security Symposium - 
Focusing on Applications of Cryptography, in San Jose, CA,
July 22-25, 1996.

There will be refereed papers, invited talks, BoFs, and Vendor
Exhibits.  Tutorial speakers include Ed DeHard, CERT; Dan Geer,
Open Market; Jon Rochlis, BBN Planet; Marcus Ranum, V-One; 
Matt Bishop, UC Davis; and Bruce Schneier, Counterpane Systems.

For detailed information, please visit our Web site:
http://www.usenix.org, or send email to: conference at usenix.org.


/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-
| Cynthia Deno            |                           USENIX
|
| Tel: 408 335 9445    |  The UNIX and Advanced Computing Systems |
| Fax: 408 335 5327   |        Technical and Professional Association     |
| cynthia at USENIX.org |
|
| Check out USENIX on the Net..........http://www.USENIX.org                |
/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-/-






From attila at primenet.com  Sat Jun 22 16:19:44 1996
From: attila at primenet.com (attila)
Date: Sun, 23 Jun 1996 07:19:44 +0800
Subject: Programmers and Hackers v/v Patents, Intellectual Property, etc.
Message-ID: <199606221735.KAA00959@primenet.com>


Addressed to: Bill Stewart <stewarts at ix.netcom.com>
              Paul Penrod <furballs at netcom.com>
              Cypherpunks <cypherpunks at toad.com>

** Reply to note from Bill Stewart <stewarts at ix.netcom.com> 06/22/96 01:20am -0700

= At 02:57 PM 6/21/96 GMT, attila <attila at primenet.com> wrote:
= 
= >        personally, I think RSA has been most generous in their 
= >    licensing: a personal use license of the basic algorithm is free. 
= >    How do you suppose PGP really exists?  it's free!  RSA has done 
= >    more to advance cryptography with this policy than any other in many
= >    years.  the political and public relations benefits to our rights 
= >    to cryptography and the public relations bonanza for public 
= >    awareness is not even estimable, let alone measurable.  The Federal
= >    persecution of Phil Zimmerman was a PR bonanza and a rallying cry.
= 
= One of the main reasons that PKP let people use RSAREF free was that,
= mostly through PGP, people were already using it; this lets them both
= control the market to the extent that they can as well as letting
= free-software writers advance the state of the art and make commercial
= companies and their markets aware that RSA is the algorithm to use.
=
	absolutely.  if you are being "bootlegged" on a basic conceptual patent by a 
    class of users which are impossible to either regulate or litigate (individual 
    users), might as well maximize your advantage --in this case, the combination of 
    the privacy aware and the intense effort of the government to suppress 1,2,4, and 
    5 combined for a reward of public awareness which would be difficult to attain 
    any other way, particularly for free --I seriously doubt that even saturation 
    advertising time during superbowl would be effctive! (joe sixpack audience)!
 
= >        on the other hand, the Free Software group, despite the 
= >    tremendous value to those of us who develop, does nothing to
= >    protect our basic freedoms, and place the issue before the U.S. 
= >    (and world) forum.                                                   
= 
= The League For Programming Freedom, closely intertwined with FSF,
= has been lobbying against software patents for a long time.
= Maybe it's a losing battle, but they've been one of the prominent
= sets of good guys.  And then there are heavy-duty GNU supporters,
= like Cygnus Support (which makes its money developing and supporting
= free software), one of the co-founders of which was John Gilmore....
=
	free knowledge is a state of mind. free software takes away the "American" 
    work ethic incentive. when a nation state (or state or world, etc) decides to 
    appropriate the work of a class of entreprenuers (say software developers), there 
    will be no more creative productive results; few, if any, programmers will work 
    14-20 hours per day, 7 days a week for what could be several years unless they 
    are: 

	    a)  crazy (good possibility); 
	    b)  deranged (more than a few whom I know fit this class)
	    c)  obsessed (goes with the turf)
	    d)  hoping to swing on the brass ring (not the gold ring).

	I never met or hired a "real old-style hacker" programmer who did not fit 
    _ALL_ 4 of the above categories and was not obnoxious as well.  It is the same 
    difference which separates real hackers from programmers:

	    a)  what languages do hackers use?

		    any, except they do not waste time on x86 

	    b)  where do you find hackers?

		    in a (usually rented) place in the Valley (pick one) in a room 
		    littered with old newspapers and fast food bags, lit only by the 
		    glow of a CRT...

	    c)  what's the real difference between hackers and programmers?

		    programmers code; hackers tweak!
 
= But yes, software patents do mostly suck....
=
	that's the basic idea.  the only useful patents are like those owned by RSA 
    which protect a fundamental principal.  The rest of softwware success is 
    marketing and intimidating anyone who copies your basic ideas which are protected 
    by intellectual property rights --often more valuable than a patent.  

	The RSA saga was first published in Scientific America in Aug of 1977  --it's 
    been a long, and expensive, road which may yet pan out before the basic patent 
    expires in 2001 or so.

		attila



--
Fuck off, Uncle Sam. Cyberspace is where democracy lives!






From alano at teleport.com  Sat Jun 22 16:58:39 1996
From: alano at teleport.com (Alan Olsen)
Date: Sun, 23 Jun 1996 07:58:39 +0800
Subject: Cash Is Dying
Message-ID: <2.2.32.19960622194217.00a623f4@mail.teleport.com>


At 02:10 AM 6/22/96 -0500, snow wrote:
>On 21 Jun 1996 nelson at crynwr.com wrote:
>> Cash is anonymous.
>
>	And will remain as long as it still is. E-cash is a great idea,
>and I hope to see it _really_ working soon, but it will not be anonymous
>anytime in the forseable future.
>
>	Also, people won't trust it. Not the people that read this list, I
>trust some of the people here, and if they say it works, I trust that. Not
>just one, but _all_ of the group I trust. No, people like my parents and
>other relatives. People smart enough to read the papers, and smart enough
>not to trust everything the "experts" say. 

After hearing some of my friends and aquaintences rant about the little
metal strips in money and how it is a conspiracy to see how much cash you
have in your pockets from the orbital mind control satelites, I am just
waiting to see what they will say about e-cash.  Probibly something about
the hidden methods the government will force into the protocol to enable
them to track each and every transaction.  (Better not say that too loud
though, or they might get ideas...)

You will know that e-cash is here to stay when the conspiracy freaks latch
onto it as the next increment of the "Number of the Beast(tm)".

>	Cash is easy, cash is plentiful, you can hold cash in your hand
>and KNOW that you have it.

And you do not have to check in with the bank every time you spend it...

---
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.teleport.com/~alano/          | alano at teleport.com  |






From lzirko at c2.org  Sat Jun 22 17:15:09 1996
From: lzirko at c2.org (Lou Zirko)
Date: Sun, 23 Jun 1996 08:15:09 +0800
Subject: ISAKMP Security Architecture
Message-ID: <199606221921.MAA22323@infinity.c2.org>


-----BEGIN PGP SIGNED MESSAGE-----

To: cypherpunks at toad.com
Date: Sat Jun 22 14:20:39 1996
Some of the subscribers to this list might be interested in the following 
URL:

http://web.mit.edu/network/isakmp/ciscokmp.html

It is a link to Cisco Systems ISAKMP distribution.  Cylink and RSA have 
both announced support of the protocol.

Lou Z.

Lou Zirko                                (502)383-2175
Zystems                                  lzirko at c2.org
"We're all bozos on this bus" - Nick Danger, Third Eye

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1

iQEVAwUBMcxHqctPRTNbb5z9AQEGTAf9H+PXHJ1J1c4gfVCqRaRZhI0adRqJAiwk
b+B9f8OQMeXcgWiFHtpGtEm5roOQT2qujwjDXLGNKvWCtPbkJvmlbwLgwGkCtykx
Ndycy3fjz0oWimCpb+GI2MLPTgs4xMHmMck0TaeVDaxV9+G+GTekOD/jDgNptpxn
gmNJbw3Ww84XTUGswLofhBZTikjkhXLgFWv6lx408Yxp65b+XEEneGqGh/k7z9CW
BsXFu50y6JN5/aacztWg1krFHXVD8Msw3cqEMQ5YiiKF5lt0VILOxTOLxIURCkim
lpTZ9AqDE+2WwVWc3ltumb1kyRKbJQvgcS0i27OHMGlUv0GEk99Trg==
=700Q
-----END PGP SIGNATURE-----






From vznuri at netcom.com  Sat Jun 22 18:52:02 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Sun, 23 Jun 1996 09:52:02 +0800
Subject: info assembly line, "flits" (long)
Message-ID: <199606222047.NAA26324@netcom14.netcom.com>



these are a few ideas I've been working on intermittently for
some time on the possibility of an "information assembly line"
of the future.

Alvin Toffler was one of the first futurists to predict the
"third wave" or information economy. we are very steadily moving
our way into this new shift, with numerous signs attesting to
it, and reactionary forces ("Buchananism", see recent Wired)
arising as well.

however, we are only at the tip of the iceberg. even state-of-the-art
information economies like Silicon Valley I would not consider full
implementations of the idea. what would it really mean to have
an entire economy that is related to information? (caveat: I 
certainly am not saying that we will no longer have physical goods,
this is a misunderstanding of Toffler's thesis, and anyone who wants
more info on this point should consult his writing).

Moore's law comes to my mind, the trend that computer capability has
been doubling approximately every 18 months ever since chips were
first invented. what could this power have on a future information 
economy (henceforth abbreviated IE)? I tend to think that the future 
IE will make the current world wide web look like child's play, although it
will be built on top of it. we are far from implementing the full
capabilities of information technology in our economy.

==

first, I think the use of microcurrency is going to play a very
major role in the future IE. it will allow people to easily own
mini-businesses in much the same way the web has allowed everyone to
own printing presses. I've written elsewhere on cybercurrency, but
I also tend to think it will have the effect of creating new
monetary standards. whereas in our current economy, wealth is
typically tied to major world economies, particularly the US
through dollars, I've said how I think stocks will come to be
thought of as a kind of currency, and that any company that sells
stock is essentially circulating its own currency. I think the
short term effect of cybercurrency is going to be a grafting on
top of existing government cash schemes, but that much to their
chagrin they are going to eventually realize it tends to make
their own regulatory and supervisory role obsolete-- or at least
displace it.

==

now imagine taking the cybercurrency concept and applying it
to an information economy. what you will tend to see is that 
cash transfers will increasingly be automated. cash will be
like the blood flow of society. you will see companies automating
their payment processes so all the man-labor associated with
handling the paperwork will tend to evaporate. you will of
course still have verification systems that prevent payment
when payment is unjustified, but the massive frameworks and
bureacracies inside companies today that are used to deal with 
cash flows will tend to be automated and diminished in size.

==

the idea that strikes me most about an information economy
is that you're going to see systems that are similar to the
concept of the assembly line for the industrial economy. 
I believe we will literally see information assembly lines
in the future. what kind of form would they take?

we already have "information assembly lines" in companies today
but they are abstract concepts of flow of work that are
not fully automated. parts of the assembly line involve people
moving around documents, sending letters, having conversations,
etc.  I tend to think that much of this will be increasingly
encoded in cyberspace. a company will see its role as an
information processing component. 

let's say this sample company gets a work order. the primary 
means of transfer will be through cyberspace. today cyberspace
is seen as an adjunct to paperwork-- the paperwork is primary,
but you can put the paperwork in cyberspace file cabinets, 
send it via cyberspace, etc.  I believe this will exactly flip
in the future, so that the paperwork is seen as an adjunct to
cyberspace. the documents will be freely transportable in 
cyberspace, and one can always track their location, just like
one can always see where some object is on an assembly line.
the work order will be thought of as primarily a document 
existing in cyberspace, with it taking various forms in
different places on the assembly line based on actions of the
information workers, who process it and tie it with other
documents, etc.

==

what does today's cyberspace lack to pull off this vision? after
a bit of thought I think one word to describe it might be
"continuity" or "persistence". there are so many obstacles in cyberspace to
transporting documents. it requires too much manual effort
on the part of each person to translate documents into particular
formats, send them via email, etc.  what we need is the cyberspatial
equivalent of continuity: people anywhere can look at the same
object and see the same thing, and that thing can be moved around
in cyberspace without ever losing its identity.

the problem is that today the concept of a "document" in "cyberspace"
is merely a concept. I can't point to some "place" in cyberspace
when I want someone to grab a document from me. I can't say, "here
it is". I have to go through an artificial series of steps to
encode the document, such as emailing it, ftping it, 
uuencoding it, or whatever.

what I am getting at is that we need a kind of virtual reality to
pull off the information assembly line to its utmost potential. I
believe we literally need to create a visual metaphor for the 
information assembly line that transcends the concepts of email,
different computers, etc.  I should be able to "pick up" and "move"
a document in cyberspace as easily as I move a piece of paper in
the real world. the whole system of different servers, different
software packages, different protocols, all this should 
be *invisible*  to me in the same way it is invisible on the current
WWW.

imagine that one actually created a total virtual reality 
information assembly line. what kind of form would it take? you
would see different things that can be done to documents
as "tools" that can be applied to them. you would see their
locations as simple visual metaphors that ignore the concepts
that segregate information. for example, you might see a single
file cabinet that represents every record in an entire company,
regardless of its location anywhere in that company. tough to
pull off? of course, but this is what we are headed towards, in
my opinion.

===

I've written multiple times about Negroponte's ingenious concept
of "bits vs. atoms". in the above spirit, 
I think we need a slight additional paradigm
shift on the concept of bits, something I call a "flit". 

the concept of a bit is too abstract for me. for a virtual reality
and an assembly line, I would prefer to say that information has
two additional components other than a binary true/false value:
a *location*, and a *time* that it is at a location. in this way
information better matches our reality that we deal with every
day. I would say the "flit" concept is a pivotal missing link
in creating an information assembly line.

I would say that an information assembly line document is
actually composed of "flits" instead of bits. each "flit" can
have a different location at different times in cyberspace.
it is a sort of "fleeting bit", a bit that can move around to
different places.

this requires a somewhat radical shift in current technological
thinking. currently we see data as stationary stuff that sits
in some place, and people come along and run programs that
churn up the bits and spit out new bits. but the new bits are
not nicely tied to the old bits except through our own memories.

==

instead I would say that the key concept of information is to
say that it has a content and a state at some time. a document
composed of a bunch of "flits" can be broken up into its 
component "flits", and the "flits" can be sent in different
directions and recombined into different documents. but because
they are "flits", I can *trace* their destinations over time.

what does this mean? it is the concept of debugging applied to
information technology. imagine that I once had a document, and
I want to know what happened to it. because it is made of 
"flits", I could say, "where did the flits that comprise this
document go?" I would get an answer about their entire history--
what programs the moved through, how they were recombined, 
where they now reside. I could trace backwards too. "where did
this flit come from?" -- the system would trace the origination
of the flits.

what the flit concept does is introduce a *context* to a bit.
a bit has no "context".  where did a bit come from? the situation
with information is that it always has a *context* and is tied
with other information. (so in addition, I might like to suggest
that "flits" can be "tied together" with each other).

when today's software spits out some document, there is nothing
necessarily tying that document with the original input except
the memory of the humans. I would suggest that the information
assembly lines of the future will replace this concept. nothing
will be left to the imagination. things that are part of people's
memory today will be made explicit in the systems of tomorrow.
the abstract concepts we have of systems being "tied" together
will look very embryonic and impoverished compared to these
new techniques.

"flits" would have an identity irrespective of companies. one
could track them moving through different companies if necessary.
(the "flits" might therefore also have security aspects associated with
them.)  the point is that the data must not be disconnected, it
must be seen as continuous, and I think a flit-like concept is key
to accomplishing this.

==

notice today how much our systems diverge from the flit concept.
we are always losing bits, and not tying them together. whenever
a system goes down, all those bits evaporate. this would not
be acceptable in a flit universe-- it would be like an object
suddenly blinking out of existence. obviously we don't consider that
an acceptable behavior of objects in our current reality, why
should we allow it in cyberspace? cyberspace has a long ways to
go. today's cyberspace is barely sufficient for what is required.

in a flit universe, I would like to see flits "pile up" in a
queue when a machine breaks, like what happens in a real 
assembly line. the assembly line metaphor is really crucial
here. imagine that on some assembly line, all your objects
suddenly disappear when a machine anywhere on the assembly
line breaks. you have to then run other machines to "bring
back" the flits. a ridiculous concept. instead, I'd like to
see flits pile up when some machine goes down on the assembly
line. once you get the machine running, it automatically starts
back going through the flits.

a lot of this implies "transaction tracking" by conventional
standards. I would suggest that "transaction tracking" and
integrity assurance are only the barest rudiments of what is
required to pull off an information assembly line. the 
belief that these are now considered incredibly cutting-edge
and state-of-the-art technologies
is a good indication of how far we have to go.

==

I mentioned Moore's law above because I think it takes care of
all objections that "so and so that you are proposing would take
too much time". imagine that we have virtually unlimited 
computational capabilities-- what could we then do with this
kind of power? tracking "flits" would be an excellent use
for all this power, imho.

in future essays I may explore further the properties of flits
and give more examples.






From Omegaman at betty.bigeasy.com  Sat Jun 22 19:02:16 1996
From: Omegaman at betty.bigeasy.com (Omegaman)
Date: Sun, 23 Jun 1996 10:02:16 +0800
Subject: Bad Signatures
Message-ID: <199606222228.QAA00570@betty.bigeasy.com>


-----BEGIN PGP SIGNED MESSAGE-----

> From:          geoff at commtouch.co.il

> 
> IMHO Getting message authentication to work correctly should be a 
> cypherpunk objective.

how does posting notifications to the list satisfy that objective?
read on....

> Putting something like "Bad Signature Notification" in the subject will 
> make it quite easy for not-interested readers to killfile.

True.  But my opinion is that this list isn't the appropriate place 
for it.  Opinions were asked for, that is mine.  A separate list 
maybe...

> BTW this is the first time I have sighted the word "veracity" being 
> used in relation to signatures. Is the term used elsewhere? Could it be 
> used to separate the integrity property of a signature from its 
> authenticity property?

Oh lord. I don't want to get into semantic hair-splitting.  It's the 
word I chose at the time.  It may be the wrong one.  Don't read too 
much into it.


To put the issue simply.

Bob doesn't like Jane for whatever reason.  Jane signs all her 
messages with PGP.  Bob posts false" bad signature notifications" to 
the list to discredit Jane.  Am I to just read Bob's messages and 
believe the notifications he's posted.?  No.  I still have to examine 
Jane's messages myself for signature authenticity.

I understand that this is one person who wants to perform this 
service objectively.  But why should I trust his motivations?  I 
still have to do my own individual signature checking to be sure.

For this reason, I think the idea accomplishes little.   The 
intentions are good, but I don't see a major benefit.  Maybe someone 
else has another idea or angle....

me

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMcwm5ab3EfJTqNC9AQGl3gP9HD4mhPY6dg69ZaWTeUYEsm+45rDFkgWW
mNDbfeudTAgfl6Jdnm+xs0g+yfZcQQUe5g/qBpp0Nk0SRyzzL+mq+U+CJr9GA6Pr
Mm3a3JY65mwYqTis1dO4FzHDvmhlN5GaBlQT0HOGPywQZGkMf3IXCGZIDZG7z4lH
V6/4Y94A7ho=
=paU2
-----END PGP SIGNATURE-----
-----------------------------------------------------------------------------------------------
Omegaman <omega at bigeasy.com>
PGP Key fingerprint =  6D 31 C3 00 77 8C D1 C2  
                                  59 0A 01 E3 AF 81 94 63 
Send E-mail with the "get key" in the "Subject:" field
to get my public key
---------------------------------------------------------------------------------------------------------------------





From adam at homeport.org  Sat Jun 22 19:20:43 1996
From: adam at homeport.org (Adam Shostack)
Date: Sun, 23 Jun 1996 10:20:43 +0800
Subject: Bad Signatures
In-Reply-To: <19960622151152974.AAB277@geoff>
Message-ID: <199606222240.RAA07977@homeport.org>


geoff wrote:

| I am not convinced. For a mailing list it makes sense for all members
| to be aware of message integrity problems. Not all cypherpunks have

	Why?  I don't care that your message lacked a signature, I
neither know who you are, or have any history of interactions with
you.

| your lisp package or Pronto Secure which make signature verification of
| the 10-20 pgp signed messages per day on the list a non trivial task.

	I'll claim that anyone on the list who wants to check
signatures could do so, and that having a 'signature bot' which would
need to sign its opinions adds nothing to message security, except a
single point for comprimise.

| I also like the idea that cpunks provides as a byproduct a platform for
| developers to test and debug their security products. We really should

	I see; you're offering your web site for the complete
archives?

Adam
-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From szabo at netcom.com  Sat Jun 22 20:53:05 1996
From: szabo at netcom.com (Nick Szabo)
Date: Sun, 23 Jun 1996 11:53:05 +0800
Subject: Accounting costs: the need for better metaphors
Message-ID: <199606222317.QAA28081@netcom.netcom.com>



To assess the desirability of a transaction, and to avoid being mischarged,
the parties to a transaction have to count up, ie account for, the 
money paid for particular products and services --  whether making 
sure that cash payments ar made as promised (eg looking at the 
display as products are scanned at the store, or the receipt afterwards), 
or making sure the phone bill is proper.  Herein I use "accounting" in
this broad sense.

I may be paying in cash, but I'd still like to keep track of how 
and why my cash is going in and out, for many of the same reasons 
that accountants reconcile and analyze book entries.  Right now a 
transaction log (whether ecash(tm)'s or a credit card's) is the 
most useful way to do this.  There may be other metaphors 
more appropriate for some circumstances (eg, eg absolute level gauges, 
rate gauges with high and low water marks, etc.); this is a potentially 
fertile new field to explore.  There may be agents that can do some
of the accounting (eg comparing payments made to terms promised, 
payment limits, etc.), but for the vast majority of products and
services software cannot judge the quality or personal desire for 
the product or service, and thus the net desirability of the 
transaction.  The user must undertake this comparison with whatever 
information the computer can provide via the display.  The user 
interface and the cognition of the user thus remain the bottleneck 
to transaction granularity.

A big task is to use the power of GUI to come up with new metaphors to make 
this easier.  It is the intuitive yet accurate metaphor that will lower
accounting costs.  Cryptographic protocols potentially lower only 
security-related transaction costs such as forgery and extortion.
For the normal accounting transaction costs, which are currently 
too high for micropayments, we need better interactive visual
metaphors.

For transactions free of records, we need transactions
that can be fairly transacted once, immediately accounted for
by the parties via a nice visual metaphor, then forgotten.  The 
potential for unresolvable disputes in record-free systems is vast for 
transactions where this is not possible (probably most
of desired commerce: where quality of a product or service 
cannot be well determined until after the purchase 
transaction is complete, or where credit is involved).

Price is one kind of contractual term; we also need nice metaphors
to keep track of other kinds of contractual terms.  Lack of 
observability of the protocol on the part of the user leads to 
the ability of the counterparty to engage in hidden actions.  
See "http://www.best.com/~szabo/smart.contracts.2.html" 
for further discussion of this and other computerized contracting 
issues.

One of the barriers to creating good contracts is determining
what the parties want in the first place.   People tend to think
in terms of standard or stereotyped conditions: payment in dollars,
investing in stocks, etc. when there exist a far wider variety of
alternative contractual structures that, combined properly, could 
better meet the parties' needs.  I'd like to see tools which allow 
parties to explore their desires interactively with the computer.  In 
finance this might include interactive personal yield curves, determining 
the partial order of desires (as in decision theory) for particular 
alternate securities, derivatives, and synthetics; and so on.  Software 
would then analyze this input, make recommendations, and even undertake
automated contracting(*).  Metaphors should be developed so that make it 
easy for lay users to express such desires without extensive knowledge of 
finance or decision theory.  Such metaphors would provide a friendly
front end to automated exchanges, auctions, and other online 
contracting mechanisms.

Currently budget programs (like Quicken) provide some of the
metaphors, and financial analysis programs provide extensive
feedback on the cash flow properties of particular contracts,
but a potentially large untapped market lies between in a 
combination of these two technologies.

(*) contracting-like transactions done by automated agents raise
interesting questions about what constitutes a "meeting of the
minds".


Nick Szabo
szabo at netcom.com
http://www.best.com/~szabo/





From perry at piermont.com  Sat Jun 22 20:58:04 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 23 Jun 1996 11:58:04 +0800
Subject: Win95 Blowfish Implementation
In-Reply-To: <199606211918.PAA11089@darius.cris.com>
Message-ID: <199606222349.TAA05194@jekyll.piermont.com>



"David F. Ogren" writes:
> 3. MD5 can be used without royalty if the RSAREF library is used, 
> and if the proper credit is given to RSA.

Actually, MD5 has no restrictions on it at all. Its one thing RSA DSI
is nice about. Copies of the code are everywhere on the net, and are
totally unrestricted.

.pm





From anonymous-remailer at shell.portal.com  Sat Jun 22 21:18:28 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Sun, 23 Jun 1996 12:18:28 +0800
Subject: CDT Policy Post 2.25 - Senate Encrypti
Message-ID: <199606230004.RAA25208@jobe.shell.portal.com>


>In a historic first that demonstrates the increasing power of the Internet
>Community as a political force, HotWired, DIGEX, the Voters
>Telecommunications Watch, and the Center for Democracy and Technology have
>teamed up to provide a live, interactive "cybercast" of the Senate Commerce
>Subcommittee encryption hearing on Wednesday June 26.
>
>The "cybercast" will provide netizens concerned about privacy and security
>on the Internet the ability to participate in the hearing, ask questions of
>the witnesses, and submit comments for the record.  Details on how you can
>participate are printed below.
>
>This hearing is the second encryption hearing held before the Senate
>Subcommittee on Science, Space and Technology; the first hearing was held
>on June 12.  Subcommittee Chair Sen. Conrad Burns (R-MT) presided over both
>hearings.
>

Of course except for PRZ they didn't invite anyone who cares about privacy
(see later in this msg) What a fucking joke. Typical statist.

>TELL CONGRESS WHY ENCRYPTION IS IMPORTANT TO YOU - ADD YOUR VOICE TO THE
>CONGRESSIONAL RECORD
>
>Senator Burns, Senator Patrick Leahy (D-VT) and the other sponosors of the
>Pro-CODE bill want to hear from the Net.community about why encryption is
>important to privacy and security on the Internet.
>
>Please be sure to visit http://www.crypto.com/ and add your voice to the
>debate over encryption policy on Capitol Hill.  Responses will be tabulated
>and the results, along with selected statements, will be included in the
>Congressional Record by Senator Conrad Burns.  The restults will also be
>featured during the Security and Freedom through Encryption Forum (SAFE) on
>July 1 (details on that event are attached below).
>
>To add your voice to the crypto debate in Congress, visit:
>
>   http://www.crypto.com/submit/
>

Right. Sure. And then they have a record of all the ppl interested in
cryptoprivacy (keep reading)

>ATTEND THE SAFE FORUM - JULY 1, 1996 STANFORD CALIFORNIA
>
>On July 1, 1996, in the heart of California's Silicon Valley at Stanford
>University, members of Congress, prominent computer industry leaders and
>privacy advocates will meet to discuss the need to reform U.S. encryption
>policy.
>
>The event is FREE and open to the public, but space is limited and is going
>fast.  To find out more, and to reserve your free ticket, visit the SAFE
>Forum Web Page at:
>
>  http://www.crypto.com/safe/
>

And sign up for a free trip to the roundup of people who want privacy. Coming
soon to a police state near you. WHY THE FUCK DO THEY NEED TO KNOW YOUR
NAME FOR THIS SHIT??? WHY IS NO ONE ASKING THIS???

Look carefully at who's sponsoring this. Who are they, and where does
the money come from? Hint: three letters.

Notice how they don't use PGP to sign the msg? Wonder why?

[///// THIS LINE ADDED BY EZBBS-MAIL / DO NOT DELETE / MSGID-33f107 / END /////]






From szabo at netcom.com  Sat Jun 22 21:23:12 1996
From: szabo at netcom.com (Nick Szabo)
Date: Sun, 23 Jun 1996 12:23:12 +0800
Subject: Micropayments: myth?
In-Reply-To: <13618.835214087@odin.nma.com>
Message-ID: <199606230001.RAA09507@netcom.netcom.com>



A general limitation of level and rate gauges is that they apply
only to fungible commodities.  One gallon of gas is roughly as
good as any other, and one dollar is as good as any other(*),
so that the a gas pump gauge reflects the information important to the 
gas buyer.  Where variety in quality or features is important, or 
different products and services need to be purchased, the graphical
display of levels and rates does not reflect that information.

For this reason, most Internet commerce purchases are made by filling
out forms, the user selecting various features to be included in the
shipped product.  Such information cannot be reflected in a gauge,
and interaction by filling out forms is far too expensive for
micropayment transactions.  Incomparable transactions lumped
into a summary lose important information, while mathematically
comparable transactions so summarized do not (as long as the
summary display properly reflects the mathematical relationship).
Incomparable purchases must be looked at separately to
determine whether one was charged a fair rate, or whether the
transaction will be or was desirable.

There are some potentially fungible Internet commodities: bandwidth,
disk space, CPU time, memory, etc.  Such transactions can be summarized
losslessly, and comparability also facilitates agents automation,
so these areas provide a potential niche for micropayments.  However,
before such commodities can be traded they must be somehow be unbundled
from each other and related factors which may (availability, 
response time) or may not (human support) themselves be fungible.
Keeping track of a wide variety of unbundled services is itself
a big transaction cost.

Nick Szabo
szabo at netcom.com
http://www.best.com/~szabo/

(*) In general, currencies are linearly comparable via exchange
rates, so that currency exchange can be accurately summarized via 
gauges.  More sophisticated financial transactions require more
sophisticated interfaces.  Many of these relationships can 
in principal still be graphed continuously and even monotonically, 
but there are a wide variety of such relationships, so our work 
is cut out for us here.






From jya at pipeline.com  Sat Jun 22 21:46:30 1996
From: jya at pipeline.com (John Young)
Date: Sun, 23 Jun 1996 12:46:30 +0800
Subject: NS on TTPs
Message-ID: <199606230022.AAA00867@pipe3.t2.usa.pipeline.com>


   New Scientist, 22 July 1996, p. 10. 
 
 
   Crackdown on Net Crooks 'a charter for state snoopers' 
 
 
   Britain and France have become the first European nations 
   to take concerted action against swindlers and other 
   criminals operating on the Internet. The governments of 
   both countries last week announced plans to license Trusted 
   Third Parties (TTPs) to act as "honest brokers" for online 
   business transactions. But civil liberties campaigners fear 
   that the schemes may be snoopers' charters, giving police 
   forces and security agencies unprecedented opportunities to 
   spy on the world of business. 
 
   The idea is for TTPs to act as "introduction agencies" that 
   will reassure each party to a deal that the other has been 
   vetted and is reputable. TTPs will also hand out encryption 
   software that business partners will use to exchange 
   information in confidence. But in both countries, TTPs will 
   be required to release the keys to this encryption to the 
   police or the security services, on production of an 
   appropriate warrant. 
 
   Currently there are few safeguards to protect those 
   contemplating buying goods or services over the Internet 
   from fraudsters. "Cyberspace has become the new frontier 
   for scam artists," concluded a report released by the US 
   Federal Trade Commission last month. "The scams are not new 
   but the medium is." 
 
   John Moroney, a senior consultant at the computer 
   consultancy Ovum, believes TTPs are the best way to drive 
   forward the growth of business over the Internet. As online 
   transactions become commonplace, he argues, banks may be 
   especially keen to volunteer as TTPs, to protect their 
   dominance in the financial services market. "If home 
   shopping takes off they could be left exposed," says 
   Moroney. 
 
   But Simon Davies, director of the London-based civil 
   liberties watchdog, Privacy International calls the plan 
   "naive". He argues that businesses are perfectly capable of 
   setting up secure systems for electronic trade without 
   government involvement: "What is the government doing in 
   this field in the first place?" The British and French 
   proposals, Davies says, bear a strong resemblance to the 
   failed "Clipper chip" plan in the US. 
 
   The Clipper scheme involved building a scrambling chip into 
   all new telephones and computers. The keys to the scrambler 
   would have been in the hands of government-appointed 
   agencies. "With Clipper it quickly became clear the agenda 
   was broader than initially stated," says Davies, "and that 
   is exactly what will happen in Europe." He fears that if 
   the scheme takes off, companies not using TTP-approved 
   encryption software will instantly come under surveillance 
   by the police or security services. 
 
   The Department of Trade and Industry in Britain rejects 
   this claim. "The government licensing of TTPs is just a way 
   of enhancing consumer confidence," says a spokesman, who 
   adds that there are no plans to ban non-TTP software. 
   Banks, trade associations and telecommunications firms are 
   the most likely candidates for becoming TTPs, the DTI says. 
 
   -- Mark Ward 
 
   [End] 
 
 
 
 
 
 





From blancw at accessone.com  Sat Jun 22 22:35:47 1996
From: blancw at accessone.com (blanc)
Date: Sun, 23 Jun 1996 13:35:47 +0800
Subject: info assembly line, "flits" (long)
Message-ID: <01BB6068.3EA6BA80@blancw.accessone.com>


From: 	Vladimir Z. Nuri

"flits" would have an identity irrespective of companies. one
could track them moving through different companies if necessary.
(the "flits" might therefore also have security aspects associated with
them.)  the point is that the data must not be disconnected, it
must be seen as continuous, and I think a flit-like concept is key
to accomplishing this.
...................................................................


Wouldn't this accounting of "flits" require that each of them be assigned a tag?   

Since this would encompass all the "flits" in cyberspace irrespective of who/where used them, whose "flits" would be counted first, beginning where?   

And once one "flit" was attached to a document which was maintained as a permanent structure somewhere in someone's database, that means it could not be used anywhere else, and how would this work for copies made of that original document?  

Once a "flit" was used as a copy and then detached and re-associated with some other document several times, would each new copy carry a record of where it had been previously, so that half of the amount of space of a document would be comprised of the historical record of where that "flit" had been?

Sounds very costly.

     ..
Blanc





From jsled at skipjack.CS.Berkeley.EDU  Sun Jun 23 01:35:20 1996
From: jsled at skipjack.CS.Berkeley.EDU (Josh Sled)
Date: Sun, 23 Jun 1996 16:35:20 +0800
Subject: info assembly line, "flits" (long)
In-Reply-To: <199606222047.NAA26324@netcom14.netcom.com>
Message-ID: <Pine.HPP.3.91.960622202438.18527B-100000@skipjack.CS.Berkeley.EDU>


On Sat, 22 Jun 1996, Vladimir Z. Nuri wrote:

> what does today's cyberspace lack to pull off this vision? after
> a bit of thought I think one word to describe it might be
> "continuity" or "persistence". there are so many obstacles in cyberspace to
> transporting documents. it requires too much manual effort
> on the part of each person to translate documents into particular
> formats, send them via email, etc.  what we need is the cyberspatial
> equivalent of continuity: people anywhere can look at the same
> object and see the same thing, and that thing can be moved around
> in cyberspace without ever losing its identity.

The problem is that all that today is handled through the very complex 
laws of physics... think about the the number of atoms that are necessary 
to hold the information for a single page, let alone an entire book...  
in a virtual reality "cyberspace", this would be an insurmountable data 
storage... on the small-scale.

> the problem is that today the concept of a "document" in "cyberspace"
> is merely a concept. I can't point to some "place" in cyberspace
> when I want someone to grab a document from me. I can't say, "here
> it is". I have to go through an artificial series of steps to
> encode the document, such as emailing it, ftping it, 
> uuencoding it, or whatever.

Yes, but you have to go through the same steps in the real world... you 
just don't see it... it's all handled through physics and the properties 
of electron repulsion between an object and your fingers (holding 
something) and light coming from a light-emiting source, being 
absorbed (in part) by an object and reflected toward your eye, 
which interpretes it (seeing something).  These are enormously complex 
tasks, far more so than uuencoding and e-mailing... but we don't 
recognize it because it's handled for us automagically.

> what I am getting at is that we need a kind of virtual reality to
> pull off the information assembly line to its utmost potential. I
> believe we literally need to create a visual metaphor for the 
> information assembly line that transcends the concepts of email,
> different computers, etc.  I should be able to "pick up" and "move"
> a document in cyberspace as easily as I move a piece of paper in
> the real world. the whole system of different servers, different
> software packages, different protocols, all this should 
> be *invisible*  to me in the same way it is invisible on the current
> WWW.

I think the thing that's most important in this sentence is _"move"_ ... 
this is the main problem for computers... it's SO easy to DUPLICATE 
information... but near impossible to make sure that you've MOVED it... 
if it was easy or even possible to MOVE something on a computer, 
the whole double-spending ecash argument would be kaput, as would the 
"wiping" a file vs. deleting it... I think that's what you're getting at, 
rather than the visual metaphor... which could be EASILY created.

> imagine that one actually created a total virtual reality 
> information assembly line. what kind of form would it take? you
> would see different things that can be done to documents
> as "tools" that can be applied to them. you would see their
> locations as simple visual metaphors that ignore the concepts
> that segregate information. for example, you might see a single
> file cabinet that represents every record in an entire company,
> regardless of its location anywhere in that company. tough to
> pull off? of course, but this is what we are headed towards, in
> my opinion.

Who says that this doesn't exist today?  The file server which I'm on 
says that there's a file in my "home directory" on "this" machine 
(skipjack.cs.berkeley.edu) called index.html... and if I went to the 
computer next to me, it would say that there's a file on the machine 
hornet.cs.berkeley.edu of the same name... but in reality the file is 
somewhere within a block of me on the machine cory.eecs.berkeley.edu... 
it's the same thing, just with a nice visual metaphor slapped on front.

> the concept of a bit is too abstract for me. for a virtual reality
> and an assembly line, I would prefer to say that information has
> two additional components other than a binary true/false value:
> a *location*, and a *time* that it is at a location. in this way
> information better matches our reality that we deal with every
> day. I would say the "flit" concept is a pivotal missing link
> in creating an information assembly line.

And key to the flit concept is the moving concept that I alluded to 
earlier... these flits could only exist if A) you had trusted|responsible 
software that moved them or B) they could ONLY move... like an atom... 
you cannot copy and atom... and to pull off what you're talking about... 
you wouldn't be able to copy a flit.

> this requires a somewhat radical shift in current technological
> thinking. currently we see data as stationary stuff that sits
> in some place, and people come along and run programs that
> churn up the bits and spit out new bits. but the new bits are
> not nicely tied to the old bits except through our own memories.
[snip]
> instead I would say that the key concept of information is to
> say that it has a content and a state at some time. a document
> composed of a bunch of "flits" can be broken up into its 
> component "flits", and the "flits" can be sent in different
> directions and recombined into different documents. but because
> they are "flits", I can *trace* their destinations over time.
> 
> what does this mean? it is the concept of debugging applied to

It means that you'd have an INSANELY large ammount of storage for a 
single small document.

If each flit was, say, a single bit in the document... you'd have almost 
atomic-like storage for a file... each part of each character would have 
a revision/tracking history...

But, if you're thinking on the document level... all you'd really need is 
a good compound-document technology (similar to OpenDoc) with a great 
revision history (similar to OpenDoc) that not only tracked revisions 
done by humans... but also revisions and handling done by programs.

> information technology. imagine that I once had a document, and
> I want to know what happened to it. because it is made of 
> "flits", I could say, "where did the flits that comprise this
> document go?" I would get an answer about their entire history--
> what programs the moved through, how they were recombined, 
> where they now reside. I could trace backwards too. "where did
> this flit come from?" -- the system would trace the origination
> of the flits.

Where would all this imformation be stored?  It's far too much for any 
filesystem or computer or harddrive in existance...

> what the flit concept does is introduce a *context* to a bit.
> a bit has no "context".  where did a bit come from? the situation
> with information is that it always has a *context* and is tied
> with other information. (so in addition, I might like to suggest
> that "flits" can be "tied together" with each other).

But bits aren't supposed to have context... they're just a state of 
being... on or off...

> when today's software spits out some document, there is nothing
> necessarily tying that document with the original input except
> the memory of the humans. I would suggest that the information
> assembly lines of the future will replace this concept. nothing
> will be left to the imagination. things that are part of people's
> memory today will be made explicit in the systems of tomorrow.
> the abstract concepts we have of systems being "tied" together
> will look very embryonic and impoverished compared to these
> new techniques.

But how about another approach... instead of the software spitting out 
a document... it gives back a combination of a document and the spit-out 
document... listing what's changed: revision control.

> "flits" would have an identity irrespective of companies. one
> could track them moving through different companies if necessary.
> (the "flits" might therefore also have security aspects associated with
> them.)  the point is that the data must not be disconnected, it
> must be seen as continuous, and I think a flit-like concept is key
> to accomplishing this.

Unfortunately, data IS disconnected... the only thing that makes it 
connected is what we impose on it by saying that a file stops when the 
EOF is reached, and in a particular file format, this character means "foo" 
and that character means "bar", etc... this is what makes data continuous.

> notice today how much our systems diverge from the flit concept.
> we are always losing bits, and not tying them together. whenever
> a system goes down, all those bits evaporate. this would not
> be acceptable in a flit universe-- it would be like an object
> suddenly blinking out of existence. obviously we don't consider that
> an acceptable behavior of objects in our current reality, why
> should we allow it in cyberspace? cyberspace has a long ways to
> go. today's cyberspace is barely sufficient for what is required.

But cyberspace is NOT real space... if it was, we'd require computers the 
size of this planet to store and process eveything.  Cyberspace is a 
computer-generated space... and computers are far from powerful enough to 
keep up with what you propose... and I suspect that they will be for a 
LONG time to come.  I think a computer-generated approach is a lot better.

> in a flit universe, I would like to see flits "pile up" in a
> queue when a machine breaks, like what happens in a real 
> assembly line. the assembly line metaphor is really crucial
> here. imagine that on some assembly line, all your objects
> suddenly disappear when a machine anywhere on the assembly
> line breaks. you have to then run other machines to "bring
> back" the flits. a ridiculous concept. instead, I'd like to
> see flits pile up when some machine goes down on the assembly
> line. once you get the machine running, it automatically starts
> back going through the flits.

assembly-line = server program
assembly track = queue based in permenant storage (hard drive, static 
	ememory, etc)
machine breaks, assembly-line program dies... machine comes back up... 
assembly-line program starts... continues to process queue on permemant 
storage... difference?

> a lot of this implies "transaction tracking" by conventional
> standards. I would suggest that "transaction tracking" and
> integrity assurance are only the barest rudiments of what is
> required to pull off an information assembly line. the 
> belief that these are now considered incredibly cutting-edge
> and state-of-the-art technologies
> is a good indication of how far we have to go.

VERY VERY VERY far...

> I mentioned Moore's law above because I think it takes care of
> all objections that "so and so that you are proposing would take
> too much time". imagine that we have virtually unlimited 
> computational capabilities-- what could we then do with this
> kind of power? tracking "flits" would be an excellent use
> for all this power, imho.

Well.. that's what i'm saying : "It'll take too much time".  But, 
considering Moore's law... you may be right... in a universe with 
"virtually unlimited" computing power, this, and a lot more, would be 
possible...

Josh






From proff at suburbia.net  Sun Jun 23 01:49:49 1996
From: proff at suburbia.net (Julian Assange)
Date: Sun, 23 Jun 1996 16:49:49 +0800
Subject: Generation of private key from pass
In-Reply-To: <199606222214.PAA18284@jobe.shell.portal.com>
Message-ID: <199606230457.OAA29221@suburbia.net>


> Matt mentioned difficulty in finding a public domain dictionary that had
> parts of speech.  The reason I am posting is because a few weeks ago
> Grady Ward announced that he was making his "Moby Lexicon" available for
> free, and I seem to recall that this included part of speech information.
> If so, this could be an opportunity for someone else to explore this
> method.

Get the Oxford Learner's dictionary.





From skrenta at osmosys.incog.com  Sun Jun 23 01:50:19 1996
From: skrenta at osmosys.incog.com (Rich Skrenta)
Date: Sun, 23 Jun 1996 16:50:19 +0800
Subject: SKIP IP-layer encryption release Beta 2.3
Message-ID: <199606230444.VAA00630@miraj.incog.com>


We are pleased to announce the newest release of our domestic source
reference implementation into the public domain.

>From this public domain source release, you can build a fully functional
IP-layer encryption and authentication package with full key management.
Both FreeBSD 2.1.0 and SunOS 4.1.3 are supported in this release.
DES, triple-DES and SAFER are supported for encryption and keyed-MD5 is
supported for authentication.

This source produces a package which contains a loadable module which
works with existing TCP/IP stacks.  You do not need to replace (or even
recompile) your IP stack to use this package.

SKIP encrypts traffic at the IP packet layer.  Applications do not need
to be recompiled or modified to take advantage of encryption.

Source and pre-built binaries (for FreeBSD 2.1.0) may be obtained by US
and Canadian citizens from http://skip.incog.com/

    This software may be used without restriction, for commercial
    and/or non-commercial purposes.


Features of this release
------------------------

	o  Support for FreeBSD2.1.0 
	o  SKIP V2 compliant implementation using ESP and AH encapsulation.
	o  Support for Authentication using keyed-MD5.
	o  Support for DES, 3DES, and SAFER 128SK  for traffic and key 
	   encryption.
	o  Support for nomadic users
	o  Support for multiple local identities with different sets of
	   parameters.
	o  Support for multiple CA (Certificate Authority) certificates.
	o  Transport mode is supported.
	o  New Certificate Discovery protocol.
	o  Highly configurable key manager.
	o  Support for RAW AH and ESP protocols.
	o  Diffie-Hellman Public Key Agreement based system.
	o  Support for multiple NSIDs and multiple local certificates.
	o  GUI tool for user friendly manipulation of access control lists
	   and key statistics.
	o  Command line tools for manipulating access control lists, etc.
	o  Implementation of the Certificate Discovery protocol fully
	   integrated into SKIP.
	o  Implementation of X.509 public key certificates.
	o  Implementation of DSA signature algorithm for certificate
	   signatures.
	o  Implementation for MD2, MD5 and SHA message digest algorithms.
	o  Implementation of ASN.1 DER encoding/decoding.
	o  SunScreen(tm) SKIP compatibility mode.
	o  Implementation of hashed public keys as defined in the SKIP 
	   draft.  Implementation of programs to generate hashed public
	   keys,  to convert X.509 Certificates to hashed
	   keys and  print both X.509 and Hashed certificates.
	o  High performance Big Number library for Diffie-Hellman 
	   calculations.
	o  Implementation is effectively "public domain" and may be used both 
	   commercially and non-commercially.
	o  Patent Agreement with Cylink allows royalty-free use of the 
           Diffie-Hellman and other Stanford patents with this package for 
	   commercial and non-commercial use.  Read README.PATENT for 
	   some restrictions.
	o  Inclusion of prime generation program used to generate the 
	   primes in SKIP draft.






From ogren at cris.com  Sun Jun 23 02:19:55 1996
From: ogren at cris.com (David F. Ogren)
Date: Sun, 23 Jun 1996 17:19:55 +0800
Subject: Win95 Blowfish Implementation
Message-ID: <199606230521.BAA21859@darius.cris.com>


-----BEGIN PGP SIGNED MESSAGE-----

Thanks to everyone who replied to my original message.  I was 
confident I could use those algorithms (I wouldn't have spent 
months on the code otherwise) but I wanted to check one more time
before I publicly released software using them.

One question though.  The following text is quoted from Bill 
Stewart.

> >2. SHA can be used without royalty.
> Yup.  Use SHA-1 rather than the original SHA, though; the NSA
> "updated" it in ways that do appear to strengthen it.
> 

What exactly is the difference between SHA and SHA-1?  Is it the 
left circular shift when generating the W array?  I coded the SHA 
alogrithm according to _Applied Cryptography_ Second Edition.  Is 
that the updated version of SHA?

Many thanks.

David F. Ogren

P.S.
Here is the super short description of Hootie:

Hootie is a Windows 95 implementation of the Blowfish algorithm.  
It is a fully graphical interface which includes drag and drop 
support as well as Explorer launch.

It can support both CBC and ECB modes.  The passphrase can either 
be directly entered by the user or the passphrase can be SHA hashed 
before use.

Hootie can optionally add headers at the beginning of the file 
which automatically select the block encryption mode and confirm 
good passphrases, or (for people concerned about known-plaintext 
attacks) omit the headers.

Future features include: generation of keys via a TNG (which are 
then saved to file), using MD5 rather than SHA, and a primitive 
text editor which which can be encrypted/decrypted to/from.

I currently expect to release the alpha version in two to three 
weeks.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMczT+fBB6nnGJuMRAQGcXgP+LcOp17aHIpoyScq9O8MlK+HcNBUsbdxq
KoFEqeDJyyL9pOcn9IdMHvZXmzzdBpEdk2q7DrObhk9z8Dy3jqai4t222upJ2kmn
blXGW3zIRdyycGg0ij0GCZzUkD6cSLpe4k5/HdhWhcgyDFx6t95sJIQAm/YIoC1R
JTTc86tmjss=
=iXHL
-----END PGP SIGNATURE-----
--
David F. Ogren
ogren at concentric.net (alternate address: dfogren at msn.com)
PGP Key ID: 0xC626E311
PGP Key Fingerprint: 24 23 CD 15 BF 8D D1 DE  81 71 84 C8 2C E0 4B 01
(public key available via server or by sending a message to
ogren at concentric.net with a subject of GETPGPKEY)





From rochberg+ at cs.cmu.edu  Sun Jun 23 02:20:34 1996
From: rochberg+ at cs.cmu.edu (David Rochberg)
Date: Sun, 23 Jun 1996 17:20:34 +0800
Subject: CFS Questions (protocol? safer/idea linkings?)
In-Reply-To: <+cmu.andrew.internet.cypherpunks+8ln8pS:00UfAQ10BJU@andrew.cmu.edu>
Message-ID: <9606230530.AA33018@GS84.SP.CS.CMU.EDU>


ftp://research.att.com/dist/mab/cfs.ps is Blaze's CFS paper (which I
was silly not to read before my last post to cfs-users).  It should
answer many of your questions.

The answer to your "why so muany keys" question is that CFS uses two
keys per attachment (2 * 64 per hybrid-3DES instance * 2 instances =
256).  This is an attempt to foil structural analysis of the
files---under ECB mode alone, identical parts of the file will be
encrypted to identical ciphertext.

To encrypt data, CFS first XORs the data with a long (.5 Mbyte,
according to the paper) repeated psuedo-random mask.  The mask is
generated by running the cipher in OFB mode with one of the keys.

Then the result of the XOR is encrypted in ECB mode with the other
key.  (There's some other optional XORing that goes on as well---read
the paper).

The passphrase->key bit is based on SHS.  Take a look at new_pwcrunch
in getpass.c in your distribution.

					-david








From stewarts at ix.netcom.com  Sun Jun 23 03:54:57 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sun, 23 Jun 1996 18:54:57 +0800
Subject: Micropayments: myth?
Message-ID: <199606230719.AAA19709@toad.com>


>>don't people get this? with microcurrency, you don't say to a 
>>seller, "bill me for this item". it would rarely work like that at
>>all. instead, it is, "here is my money, please give me the item". 
>
>What is the authentication process for the "money" your are "giving" in this 
>scenario?

Varies with the micropayment system.  Some proposals are to use Digicash,
either online or offline.  Others are to use simpler systems, such as S/Key 
variants or piles of tokens - you'd use some heavyweight payment system like
a credit card / ATM / digicash to buy 100 or 1000 microtokens, which you'd
use for the actual payments, and which would require less computation to
authenticate.

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Dispel Authority!






From naim at micronet.fr  Sun Jun 23 05:55:32 1996
From: naim at micronet.fr (predator)
Date: Sun, 23 Jun 1996 20:55:32 +0800
Subject: unsuscribe
In-Reply-To: <Pine.A32.3.91.960621144854.52010A-100000@holly.ACNS.ColoState.EDU>
Message-ID: <31CD1106.13D0@micronet.fr>


unsuscribe





From WlkngOwl at unix.asb.com  Sun Jun 23 06:50:45 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sun, 23 Jun 1996 21:50:45 +0800
Subject: Win95 Blowfish Implementation
Message-ID: <199606231035.GAA22878@unix.asb.com>


On 22 Jun 96 at 19:49, Perry E. Metzger wrote:

> Actually, MD5 has no restrictions on it at all. Its one thing RSA DSI
> is nice about. Copies of the code are everywhere on the net, and are
> totally unrestricted.

I thought they asked for an acknowledgement in manuals or the 
programs usage or title message that it used RSA's MD5 
implementation, *if* you used their source code.

Rob.
 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From frissell at panix.com  Sun Jun 23 08:19:50 1996
From: frissell at panix.com (Duncan Frissell)
Date: Sun, 23 Jun 1996 23:19:50 +0800
Subject: Those Evil Republicans
Message-ID: <2.2.32.19960623115852.00b8c130@panix.com>


"They believe that the Government is the problem and that what everyone
needs is to be told, 'You're on your own; go out there into the tender
mercies of the global economy; have a great time in cyberspace, and we'll
get out of your way.'" -- William Jefferson Blythe Clinton in a speech to
the AFSCME in Chicago on Friday.

I guess he doesn't want us to have fun in cyberspace -- though he didn't say
so directly.

DCF

In the same speech in which he talked about people hunting ducks with rifles.






From jya at pipeline.com  Sun Jun 23 11:11:14 1996
From: jya at pipeline.com (John Young)
Date: Mon, 24 Jun 1996 02:11:14 +0800
Subject: FISA Mock
Message-ID: <199606231409.OAA02886@pipe6.t2.usa.pipeline.com>


   6-23-96. WaPo Mag cover story: 
 
   "Secret Intrusions" 
 
      Government surveillance, terrorism and the U.S. 
      Constitution: The story of a Washington Courtroom no 
      tourist can visit. 
 
      Last year, a secret court in the Justice Department 
      authorized a record 697 'national security' wiretaps on 
      American soil, outside normal constitutional procedures. 
      Is the world growing more dangerous -- or has Big 
      Brother found a way around the Foruth amendment. 
 
   A revealing report on burgeoning FISA wiretap intrusions, 
   featuring FBI, NSA, CIA, Freeh, Kallstrom, Gorelick and 
   little-known Mary Lawton who, before her death, guaranteed 
   the incorruptibility of FISA: "In the modern age of 
   intelligence gathering and federal law enforcement, no one 
   was more important to the management of the most critical 
   legal issues binding the two communities." And what has 
   happened without her "gold standard of legality in the 
   world of counterintelligence." 
 
   A wideawake eye-opener to General Reno's sweetsong lullaby  
   at the Commonwealth Club. 
 
   Taken from a book due out next month: "Main Justice," by 
   Jim McGee and Brian Duffy.  
 
   ----- 
 
   http://pwp.usa./pipeline.com/~jya/fismok.txt  (54 kb) 
 
   FIS_mok 
 
 
 
 
 
 
 





From jya at pipeline.com  Sun Jun 23 11:56:44 1996
From: jya at pipeline.com (John Young)
Date: Mon, 24 Jun 1996 02:56:44 +0800
Subject: Arsenal Ship Details
Message-ID: <199606231502.PAA05702@pipe6.t2.usa.pipeline.com>


A front-page detailed description of the Navy's latest work on the
remote-controlled Arsenal ship: 
 
 
http://www.washingtonpost.com/wp-srv/WPlate/1996-06/23/100L-062396-idx.html





From winn at Infowar.Com  Sun Jun 23 12:16:56 1996
From: winn at Infowar.Com (winn at Infowar.Com)
Date: Mon, 24 Jun 1996 03:16:56 +0800
Subject: Tales from the UK: Part III
Message-ID: <199606231513.LAA01959@mailhost.IntNet.net>


Attacks on the Financial Sector: Reprise

I've spent the last two weeks in Europe, five countries, an avarage of 2.6 
countries per day. Two kids and a wife along for a 'family vacation' which I 
have concluded is a modern day oxymoron. I'm thankfully back on the road to DC 
and Atlanta, sans kids, in a few days for a well earned rest.  :-) (Love you 
honey, really do, but I do need a break . . . .)

But what you care about is the attacks that the Sunday Times has been talking 
about for the last couple of weeks. I've received incredible volumes of email on 
this story asking for more details - mostly very supportive - so here goes

I met with the Times in London's Trocadero (while the kids played Virtual Games 
upstairs in an incredible arcade). I also spoke with them at length while at the 
top of Le Tour Eiffel, at Euro-Disney (Space Mountain violently pivots you end 
over end in complete darkness: a definite PG-13 ride), on the Chunnel Train and 
at Legoland. 

First, the errors in their reporting that annoy me:

	1. As a co-sponsor of InfoWarCon, I can assure you that the Brussels 
event had *nothing* to do with the alleged attacks as the June 2 article 
implies.

	2. There were absolutely *no* secret meetings at InfoWarCon about the 
alleged attacks,

	3. Laithe Gambit is not a secret study group about the distresses of the 
financial community. It is a NATO SHAPE security group and most of it is quite 
open.

Despite the protestations of the Net community, masses of media folks and my own 
criticisms of their writings, the Sunday Times is sticking by their stories with 
dedicated vehemence. In some ways they seem confused and chagrined that their 
reporting is suspect. They really do believe what they are saying. I argued that 
they gave no names of their sources and they responded that it wasn't  necessary 
since they used the word 'spokesman' in several places. We have to remain 
disagreed on that point. If it's a rumor, then say it's a rumor. If it's a well 
placed source who wants anonymity, say so. If it's a spokesman, name him in 
writing. 

As a result, the U.S. media has been calling Kroll Associates and the NSA and 
the British DTI and so on and getting rebuffed at every turn with firm denials 
of having ever had conversations of the nature claimed in the Times' articles. 
According to the media with whom I've spoken, this is a giant red flag. 
Curiously, though, according to the Times, when they call back the very sources 
used for the articles in the first place, they too are being met with cold 
shoulders and 180 degree attitude shifts. Curiouser and curiouser.

The Times swears by the validity of the story, and is putting on additional 
pressure to those people who they claim are in-the-know and will come out with 
the real details which could be further corroberated. I will be receiving, 
hopefully this weekend, (not here yet) an updated article that is being 
published in the UK on this story. From what I've heard about it so far, it will 
include some comments from Russian Admiral Pirumov (ret) and others on the 
record.

In the next couple days: Someone in Basel corroberates the tale.



Peace
Winn

		        Winn Schwartau - Interpact, Inc.
		        Information Warfare and InfoSec
		       V: 813.393.6600 / F: 813.393.6361
			    Winn at InfoWar.Com






From alewine at dcez.com  Sun Jun 23 15:37:36 1996
From: alewine at dcez.com (Alan Lewine)
Date: Mon, 24 Jun 1996 06:37:36 +0800
Subject: Oil Change software snoops through hard drive
In-Reply-To: <adf03dbc080210043817@[205.199.118.202]>
Message-ID: <31CDA9A3.1302@dcez.com>


<<I wrote:
>But this isn't MS's RegWiz. It's capabilities sound much greater, and
>it's not clear how to opt out, etc. >>Tim May replied:
<<Not buying it and not installing it would appear to be an easy way to 
"opt out.">>
Maybe i'm confused, but oil change sounds like a mole that can burrow 
unbidden into user's disks. I don't think user installation is required, 
or else it will auto install the user code on installation of whatever 
software has licensed it.
Alan L
http://www.dcez.com/~alewine





From 76711.2023 at compuserve.com  Sun Jun 23 15:49:44 1996
From: 76711.2023 at compuserve.com (Todd Murchison)
Date: Mon, 24 Jun 1996 06:49:44 +0800
Subject: Sign me up
Message-ID: <960623175822_76711.2023_FHD45-1@CompuServe.COM>


Please post me on the mailing lists.






From tcmay at got.net  Sun Jun 23 15:57:24 1996
From: tcmay at got.net (Timothy C. May)
Date: Mon, 24 Jun 1996 06:57:24 +0800
Subject: Oil Change software snoops through hard drive
Message-ID: <adf2d22c00021004b6d8@[205.199.118.202]>


At 8:31 PM 6/23/96, Alan Lewine wrote:
><<I wrote:
>>But this isn't MS's RegWiz. It's capabilities sound much greater, and
>>it's not clear how to opt out, etc. >>Tim May replied:
><<Not buying it and not installing it would appear to be an easy way to
>"opt out.">>
>Maybe i'm confused, but oil change sounds like a mole that can burrow
>unbidden into user's disks. I don't think user installation is required,
>or else it will auto install the user code on installation of whatever
>software has licensed it.

If I understand your comments (the strange wrapping doesn't make it easy),
you are confusing Oil Change with a virus or worm.

It's a commercial product, offering a (putative) service to those who buy
it. One "opts out" by not buying and installing it.

There may be privacy implications, but then there are privacy implications
in all sorts of other areas. Such as filling out a loan request, applying
for a credit card, visiting a doctor, etc. I'm of course not saying that
these privacy implications are not worth discussing, and do not vary from
example to example in seriousness, only that Oil Change hardly appears to
be a significant threat.

To repeat, no one is forced to buy and install Oil Change, and it certainly
doesn't copy itself onto the machines of unsuspecting users.


--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From jf_avon at citenet.net  Sun Jun 23 16:09:13 1996
From: jf_avon at citenet.net (Jean-Francois Avon)
Date: Mon, 24 Jun 1996 07:09:13 +0800
Subject: L&J: Libertarians
Message-ID: <9606231806.AA25084@cti02.citenet.net>


-----BEGIN PGP SIGNED MESSAGE-----

On 22 Jun 96 at 18:56, jim bell wrote:


> In practice, I think we'll discover we don't NEED politicians at
> all!  

I was having a discussion with a retired physics dept director the
other day.  He never heard of AP and we did not discuss it.  But we
discussed the Net a lot.  And he made a very fundamental remark.  He
said someting along thoses lines (not an exact quote but one that sums
it up in essence) :

"It is amazing how the Net is.  It is a total anarchy and yet, it
seems to work *perfectly* well without any central decision making
authority.  Actually, no central authority could ever make it happens
better than this actual anarchy led by self-interest on the part of
each individuals each owning a tiny piece of the network."

It make me think about how essential the govt is, and especially in
the field of economy...


> Sure, there are some people who scoff, 
> but I think they're just displaying sour grapes.  They're so used to
> the current system, they want to "fix" it with half-measures rather
> than really eliminating the problems.

Some peoples have a vested interest in maintaining the system as it
is.  For example, take here in Canada, progressive tax rates / a flat
income tax.  If a flat income tax rate would be put in place, just
think of how many chartered accountant would be jobless overnight...


> That's exactly the kind of discussion I want to have, on the 'net. 
> It turns

> out, however, that many if not most of the people who "get" this
> idea, are satisfied that it'll work, and don't seem to see the need
> for discussion of the details.

Anybody who discuss it openly on the net and plan to implement it will
get killed by governments (pick your favorite one).  I find it very
unlikely that all e-mail on the topic is not monitored, just as
anything having my name, or Jim Bell's or anybody else that ever
discussed the topic.  Even peoples who apparently seemed to denigrate
AP, like Unicorn, will be suspected since they'll reason that he might
have a secret wish to implement it while opposing it publicly.  Just
like mole get to the highest rank in the organization they want to
undermine.  That is the *nature* of any security oriented
organization.  

And communicating with each other with PGP without remailers would
probably put us instantly on a hit list.  To quote a famous french
comic strip " when in doubt, it's better to hang..." .  The best
protection is either a long chain of remailer or to post *everything*
publicly on C'Punks *AND* several newsgroups at the same time.  Then,
again, they might make "examples", helped by a scare publicity
campaign by the mass medias.  

Wake up to it guys, if ever such a system gets implemented, it will be
a major war and govt will use every allies they might have (mainly,
the conventional mass-medias) to eradicate it.  The war will be fought
underground but it will be savage, as all wars are.

I don't think that you will ever succeed to "educate" a sufficient
part of the public to make things work as you figured.  The net
population represent a minuscule fraction of the population and most
net surfers don't even care.  C'Punks has a total cumulative
subscription of, say, 10000 (out of the blue number), which represent
(at 40E6 internet users) around 2.5 percent of 1 percent of all net
users.

Many individuals consider that it is better to get taxed to 50% and
keep 100% of their life...

JFA


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i
Comment: Verify/Decrypt with PGP v2.6 or later.

iQEVAgUBMc0L5ciycyXFit0NAQHFjggAiWQUV0YudQPHq1Q7Y8zkv64PicePiyoX
MEBOfseSx6SEiSoB0N/JY3FBZYOEa6QYfYiNr/FBSWjyPVEuxQcJc3SBQ354lFOQ
ZqiQnR6TrjzxZo0Z+NaVYI2Ys+G5ykOGW45NElF5TRyk0YjK1HI/dlS7UpD9Li1E
+xMtJo8x+/joWYEc45ABIHg0DUAJWe4MG7AEcmde4veOcyC/yMi1gy+2QLMARyZ/
VbTfhJ+V1D5zwBTNVQCtcIOJMeXmMDeBy6gkBRlaYP5r6az+uQa6AKfo78Y3f1eQ
P6XZWuGeWLPvdIeq+FTwWvULdfPkZ4xJtaCIJC03gOgBmXsuWNmy8Q==
=Yovo
-----END PGP SIGNATURE-----





From richieb at teleport.com  Sun Jun 23 17:09:35 1996
From: richieb at teleport.com (Rich Burroughs)
Date: Mon, 24 Jun 1996 08:09:35 +0800
Subject: Zimmerman/Viacrypt
Message-ID: <2.2.32.19960623191752.007219f0@mail.teleport.com>


At 01:25 AM 6/15/96 PDT, Edgar Swank <edgar at Garg.Campbell.CA.US> wrote:
[snip]
>Seems to me an employer has a perfect right to monitor his employee's
>work product, for which he's being paid a salary and using the
>employer's equipment (like business PGP).  If the employee doesn't
>like it, he's free to seek employment elsewhere (or start his own
>business).  Or he's free to encrypt all his personal Email at home
>with a personal copy of ViaCrypt or a copy of free PGP.

Sometimes these workplace privacy issues are really hard for me to come to a
clear decision on.

I don't know how many of you have been in a workplace where someone quit by
just walking out in the middle of the day, but I have.  Things would have
been really messy had the person left encrypted data lying around that the
company had no key for.  It probably wouldn't have been hard to get a judge
to make the employee give up the key (after getting the judge to understand
what the hell encryption is...), but the time lost might have had a real
impact on project deadlines.

I'm not sure what the answer is, but I have a feeling that as an employer I
probably wouldn't want to provide encryption that I had no key for.  What if
an employee died suddenly, and I needed access to their records/email?

Perhaps a somewhat enlightened employer could opt to split the escrowed key
up and pass it along to several people in the office, to help prevent
management from just spying on everyone.

Phil's feelings about PGP are a different matter, though.  If he feels it
shouldn't be used that way, and that Viacrypt has violated their agreement,
then he should pursue it, IMHO.  It doesn't necessarily follow that he's
just using it as an excuse to wrest the commercial version from them.  He
may feel they really have gone beyond what was agreed upon.  I suppose it
will be up to the courts to decide whether the escrow system is a "back
door" or not.


Rich

______________________________________________________________________
Rich Burroughs  richieb at teleport.com  http://www.teleport.com/~richieb
See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon
U.S. State Censorship Page at - http://www.teleport.com/~richieb/state
New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause






From cme at ACM.ORG  Sun Jun 23 17:34:38 1996
From: cme at ACM.ORG (Carl Ellison)
Date: Mon, 24 Jun 1996 08:34:38 +0800
Subject: Federal Key Registration Agency
In-Reply-To: <Pine.3.89.9606201224.B27834-0100000@tesla.cc.uottawa.ca>
Message-ID: <v03006f01adf34c411979@[168.143.8.144]>


At 21:20 -0400 6/20/96, Michael Froomkin wrote:
>[...] AG Reno's assertion
>that it would take the government a year to break one DES message with a
>"supercomputer".  She presumably believes this.  We know the number for
>known plaintext attacks, but assuming you don't have a known plaintext,
>what's a more reasonable assumption?

If the plaintext is ASCII text, the time is the same but the machine is a
little more expensive.  What you do is process 8 or more blocks of
ciphertext in parallel, matching the high order bit of each byte to 0.
With 8 blocks, you get 64 high order bits -- more than the number of key
bits -- so you're not likely to guess wrong.

If the signal is audio instead of text, I don't know what you look for.
That depends on the compression algorithm.

If the signal is compressed text, again I would need to see the comressor
output.

If all you have is one or two blocks of text (e.g., a bank transaction) you
decrypt and decide whether the result is just impossible.  If it's possible
(and there will be many) you send the trial key on to a second processor (a
more general one) to try that key on the whole message to decide if the
message is still possible.

If that processor likes a given key, you send the result to a human -- who
chooses among all the possibles.

In other words, this doesn't have to be one-step-to-success.  All you're
doing is pruning the keyspace to something more manageable.

 - Carl


+------------------------------------------------------------------------+
|Carl M. Ellison   cme at acm.org     http://www.clark.net/pub/cme          |
|PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2|
|  "Officer, officer, arrest that man!  He's whistling a dirty song."    |
+-------------------------------------------- Jean Ellison (aka Mother) -+







From WlkngOwl at unix.asb.com  Sun Jun 23 17:58:04 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Mon, 24 Jun 1996 08:58:04 +0800
Subject: Auto-mail filters and penet-remiler loophole?
Message-ID: <199606232055.QAA02670@unix.asb.com>


Hm.

Seems someone sent a message to my frienly-mailer filter using penet 
remailer.  So of course that person will get an anonymized reply, 
thus being able to know what my anon-id there is.

Fortunetly I don't use penet or rely on it for any form of security.

That's one situation where it would be nice to specify in a line 
somewhere *not* to anonymize mail sent through there (a command in 
header saying X-Do-Not-Anonymize maybe?)

Rob.





From bandrew at potlatch.esd112.wednet.edu  Sun Jun 23 18:14:31 1996
From: bandrew at potlatch.esd112.wednet.edu (Brian Andrew)
Date: Mon, 24 Jun 1996 09:14:31 +0800
Subject: unsuscribe
Message-ID: <31CDACD4.751@potlatch.esd112.wednet.edu>


unsuscribe





From markm at voicenet.com  Sun Jun 23 22:08:02 1996
From: markm at voicenet.com (Mark M.)
Date: Mon, 24 Jun 1996 13:08:02 +0800
Subject: Auto-mail filters and penet-remiler loophole?
In-Reply-To: <199606232055.QAA02670@unix.asb.com>
Message-ID: <Pine.LNX.3.94.960623203411.135A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Sun, 23 Jun 1996, Deranged Mutant wrote:

> Hm.
> 
> Seems someone sent a message to my frienly-mailer filter using penet 
> remailer.  So of course that person will get an anonymized reply, 
> thus being able to know what my anon-id there is.
> 
> Fortunetly I don't use penet or rely on it for any form of security.
> 
> That's one situation where it would be nice to specify in a line 
> somewhere *not* to anonymize mail sent through there (a command in 
> header saying X-Do-Not-Anonymize maybe?)

Non-anonymous mail can already be sent through penet by sending the message
to na[anon id] instead of an[anon id].  The problem you describe with your
mail filter also exists for mailing lists and other instances where a person
obliviously sends e-mail to an anonymous id.  Unfortunately, other
double-blind, pseudonymous remailers have the same problem.  The only way to
solve the problem is to not have remailers enable a double-blind by default
(or conversely, have all mail programs rearrange the address so the reply is
sent non-anonymously).

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"In Christianity neither morality nor religion come into contact with
reality at any point."
                -- Friedrich Nietzsche


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMc3kJ7Zc+sv5siulAQHm+QP/XhK9YdV2uSbady21ekMe4j//YzDDR32w
fvwwgZntjCQ7mP9thJzMxIziZ+RlA/DiXFf7A+eUieF+Tqbn4gyCh2/InQWrwssK
l7Qh5ZC9OuSCJZnbwlCi+G/XfLAO+OdskoiTkW3YYlz2YO5KRAKhCBJwzIDPiWNh
AIrN19vyI9k=
=gyEu
-----END PGP SIGNATURE-----





From vznuri at netcom.com  Sun Jun 23 22:18:46 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Mon, 24 Jun 1996 13:18:46 +0800
Subject: info assembly line, "flits" (long)
In-Reply-To: <01BB6068.3EA6BA80@blancw.accessone.com>
Message-ID: <199606240013.RAA25268@netcom10.netcom.com>


well, already I'm forced to elaborate on flits when I was
going to do that in another essay. oh well.

>
>
>Wouldn't this accounting of "flits" require that each of them be =
>assigned a tag?  =20

after more thought, I don't think a flit would only be 0 or 1. 
the flit would have different granularity based on what the system
can afford. we might start out by saying that every document
is one "flit", i.e. that is the basic unit. then when we get
a more powerful computer, the form is broken up into multiple
"flits". finally, when God finally designs the ultimate computer
<g>, we would then let every bit in the universe be considered
a flit that has a location in cyberspace at some time.

>Since this would encompass all the "flits" in cyberspace irrespective of =
>who/where used them, whose "flits" would be counted first, beginning =
>where?  =20

not sure about what you mean by "counting" flits.  the concept
of a flit would be very roughly analogous to something like
what email is today, except that the email would never be 
considered to have a permanent destination. every time you
move the flit, new header lines would be added to the 
history tracking of it. what is remarkable is that this 
paradigm gives you incredible tracking control over information
that is going to be necessary in the future, imho.

>And once one "flit" was attached to a document which was maintained as a =
>permanent structure somewhere in someone's database, that means it could =
>not be used anywhere else, and how would this work for copies made of =
>that original document? =20

the documents and flits are interchangeable. the document does not
have flits "attached", the document *is* a flit, or comprised of flits.

some of the properties of flits: they can be copied, but the 
child flits might "know" who their parents are, and can always
find their parent.  notice how radically different this is from
the modern view of information as lumps that sit in disconnected
piles. when I use a "cp" command, I do indeed get a copy, but I
have no idea about the origination of that copy. the flit concept
establishes *context* to information, and makes the context 
intrinsically part of the information. the information cannot
exist independent of context. today, our computers give us
contextless information, and all the structures we have built
are designed to attach context when it should be attached at
a much lower level, imho.

>Once a "flit" was used as a copy and then detached and re-associated =
>with some other document several times, would each new copy carry a =
>record of where it had been previously, so that half of the amount of =
>space of a document would be comprised of the historical record of where =
>that "flit" had been?

again, it can be implemented at different levels. many companies
already have "revision control systems" that are flit-like mechanisms
working at a document level.

>Sounds very costly.

ah yes. indeed. not saying it can be pulled off this moment.
two words: Moore's Law.





From vznuri at netcom.com  Sun Jun 23 22:21:47 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Mon, 24 Jun 1996 13:21:47 +0800
Subject: info assembly line, "flits" (long)
In-Reply-To: <Pine.HPP.3.91.960622202438.18527B-100000@skipjack.CS.Berkeley.EDU>
Message-ID: <199606240027.RAA26443@netcom10.netcom.com>




>think about the the number of atoms that are necessary 
>to hold the information for a single page, let alone an entire book...  

yep. not saying what I am talking about is feasible this moment.
"moore's law"

>in a virtual reality "cyberspace", this would be an insurmountable data 
>storage... on the small-scale.

not insurmountable. quite practical and sensible in say 10 years.

>These are enormously complex 
>tasks, far more so than uuencoding and e-mailing... but we don't 
>recognize it because it's handled for us automagically.

to move a pencil I only pick it up and set it down. to move a 
document through cyberspace, 
the process is infinitely more complex, requiring an
immensity of thoughts and coordinated actions. when we create
a system that matches the real-world difficulty, then we will
be approaching the limit. we are very, very far from that limit
even though we have climbed the ladder a long ways as you note.

>I think the thing that's most important in this sentence is _"move"_ ... 
>this is the main problem for computers... it's SO easy to DUPLICATE 
>information... but near impossible to make sure that you've MOVED it... 

as I was saying, information that is duplicated is contextless by
today's standards.

indeed, the concept of "moving" information implies TIME-- at one
time, it is at one place, at another time, it is in a new place.
but it is the SAME INFO. today, the disconnected idea of a "bit"
does not give you this *continuity*. I make a copy somewhere else
that is not tied to the original document.

>Who says that this doesn't exist today?  The file server which I'm on 
>says that there's a file in my "home directory" on "this" machine 
>(skipjack.cs.berkeley.edu) called index.html... and if I went to the 
>computer next to me, it would say that there's a file on the machine 
>hornet.cs.berkeley.edu of the same name... but in reality the file is 
>somewhere within a block of me on the machine cory.eecs.berkeley.edu... 
>it's the same thing, just with a nice visual metaphor slapped on front.

imagine the same thing on a totally universal cyberspatial level,
not merely within a single company or university. I agree, we have
rudiments of what I'm talking about in place. but my point is
mainly that they are rudiments compared to what is possible. the
web is a very good sample framework for the kind of seamlessness
I'm talking about. like I say, the future information assembly
line will be built on top of it. it has a long ways to go too.

>And key to the flit concept is the moving concept that I alluded to 
>earlier... these flits could only exist if A) you had trusted|responsible 
>software that moved them or B) they could ONLY move... like an atom... 
>you cannot copy and atom... and to pull off what you're talking about... 
>you wouldn't be able to copy a flit.

in a sense, I think the flit concept is a magic bridge between bits
and atoms. bits are too abstract. atoms are too real. flits are
a nice compromise. we have to get our bits to behave more like
atoms: persistence, etc.  there are a whole lot of very nice
"properties" of atoms that are staring us in the face that we
would benefit from immensely implementing in cyberspace.

>It means that you'd have an INSANELY large ammount of storage for a 
>single small document.

early stages would not be much different than RCS systems already in
use in companies.

>If each flit was, say, a single bit in the document... you'd have almost 
>atomic-like storage for a file... each part of each character would have 
>a revision/tracking history...

you could have mechanisms that don't keep the entire history of the
flit. I agree, a flit as a 0 or 1 is very unlikely in the near future.
but at a document level, i.e. a document as a flit, we already have
it in RCS systems that companies are struggling to implement well
as we speak.

>But bits aren't supposed to have context... they're just a state of 
>being... on or off...

I'm saying that in the information assembly line of the future,
they *must* have context. they must be tied together. you only
have disconnected chaos otherwise.

>But how about another approach... instead of the software spitting out 
>a document... it gives back a combination of a document and the spit-out 
>document... listing what's changed: revision control.

again, this requires the human to interpret the changes. what if
there was an actual "link" between the old and the new document
that is "stuck" to the new document? and furthermore, software
could traverse these links? that's more what I have in mind.

>Unfortunately, data IS disconnected... the only thing that makes it 
>connected is what we impose on it by saying that a file stops when the 
>EOF is reached, and in a particular file format, this character means "foo" 
>and that character means "bar", etc... this is what makes data continuous.

data doesn't have to be disconnected. I told you this was a radical
paradigm shift that I was proposing. you obviously have the previous
concepts down quite well. I'm not arguing that what you are saying
is the conventional system. I pointed out exactly that.

>But cyberspace is NOT real space...

it will evolve to become more and more like a real space, a point
of my essay.

>assembly-line = server program
>assembly track = queue based in permenant storage (hard drive, static 
>	ememory, etc)
>machine breaks, assembly-line program dies... machine comes back up... 
>assembly-line program starts... continues to process queue on permemant 
>storage... difference?

you have a rough analogy going. the point is that in a real cyberspace,
bits would never disappear like they do when computers go
down. we can create such a system.

>VERY VERY VERY far...

10 years or so, I would say, before people implement things that
sound like they came right out of what I was talking about.

>Well.. that's what i'm saying : "It'll take too much time".  But, 
>considering Moore's law... you may be right... in a universe with 
>"virtually unlimited" computing power, this, and a lot more, would be 
>possible...

right. I think it is much more realistic to speculate that we will
be virtually unlimited than limited, and to ask the question, 
what would we implement if we truly were unlimited? to build something
limited when you are unlimited shows an impoverished imagination.





From anonymous-remailer at shell.portal.com  Sun Jun 23 22:32:34 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Mon, 24 Jun 1996 13:32:34 +0800
Subject: CDT Policy Post 2.25 - Senate Encrypti
Message-ID: <199606240104.SAA29097@jobe.shell.portal.com>


WHY IS NO ONE TALKING ABOUT THIS VIOLATION OF OUR RIGHTS? EVER HERE THAT
IN THE US VOTES ARE supposed to be *****SECRET*****??? NO MORE!

Why does the vtw cdt etc want to hand over your name to the us gov? Notice
how there's two events one on the east cost and the other on the west coast.
Why is that? So they can get more names!

Read carefully:

>TELL CONGRESS WHY ENCRYPTION IS IMPORTANT TO YOU - ADD YOUR VOICE TO THE
>CONGRESSIONAL RECORD
>
>Senator Burns, Senator Patrick Leahy (D-VT) and the other sponosors of the
>Pro-CODE bill want to hear from the Net.community about why encryption is
>important to privacy and security on the Internet.
>
>Please be sure to visit http://www.crypto.com/ and add your voice to the
>debate over encryption policy on Capitol Hill.  Responses will be tabulated
>and the results, along with selected statements, will be included in the
>Congressional Record by Senator Conrad Burns.  The restults will also be
>featured during the Security and Freedom through Encryption Forum (SAFE) on
>July 1 (details on that event are attached below).
>
>To add your voice to the crypto debate in Congress, visit:
>
>   http://www.crypto.com/submit/
>

Right. Sure. And then they have a record of all the ppl interested in
cryptoprivacy (keep reading)

>ATTEND THE SAFE FORUM - JULY 1, 1996 STANFORD CALIFORNIA
>
>On July 1, 1996, in the heart of California's Silicon Valley at Stanford
>University, members of Congress, prominent computer industry leaders and
>privacy advocates will meet to discuss the need to reform U.S. encryption
>policy.
>
>The event is FREE and open to the public, but space is limited and is going
>fast.  To find out more, and to reserve your free ticket, visit the SAFE
>Forum Web Page at:
>
>  http://www.crypto.com/safe/
>

And sign up for a free trip to the roundup of people who want privacy. Coming
soon to a police state near you. WHY THE FUCK DO THEY NEED TO KNOW YOUR
NAME FOR THIS SHIT??? WHY IS NO ONE ASKING THIS???

Look carefully at who's sponsoring this. Who are they, and where does
the money come from? Hint: three letters.

Notice how they don't use PGP to sign the msg? Wonder why? What does PRZ
say about this?

Is there anyone we trust involved who can answer for this?

[///// THIS LINE ADDED BY EZBBS-MAIL / DO NOT DELETE / MSGID-33f1a9 / END /////]






From anonymous-remailer at shell.portal.com  Sun Jun 23 22:40:35 1996
From: anonymous-remailer at shell.portal.com (anonymous-remailer at shell.portal.com)
Date: Mon, 24 Jun 1996 13:40:35 +0800
Subject: unsuscribe
Message-ID: <199606240104.SAA29186@jobe.shell.portal.com>


naim at micronet.fr writes:
 > unsuscribe

     Hmm, the clueless list is no longer available at c2.  Pity.





From grafolog at netcom.com  Sun Jun 23 22:51:24 1996
From: grafolog at netcom.com (jonathon)
Date: Mon, 24 Jun 1996 13:51:24 +0800
Subject: Auto-mail filters and penet-remiler loophole?
In-Reply-To: <199606232055.QAA02670@unix.asb.com>
Message-ID: <Pine.SUN.3.94.960624012258.6339C-100000@netcom3>


On Sun, 23 Jun 1996, Deranged Mutant wrote:

> Date: Sun, 23 Jun 1996 16:49:07 +0000

> Seems someone sent a message to my frienly-mailer filter using penet 

	If you are using procmail, then what you want is a recipes
	at the begining like this:


	LOG=penet$NL
	:1hW:
 	^From.*.penet.fi
	.mailbox/penet

	Respond to the penet.fi messages as you wish.
	Alternatively, you can just send the message to /dev/null

	That recipe hasn't been tested, so it may need some tweeking
	on it.

        xan

        jonathon
        grafolog at netcom.com



	NETCOM --- when only the worst in internet service will suffice.







From jimbell at pacifier.com  Sun Jun 23 23:04:33 1996
From: jimbell at pacifier.com (jim bell)
Date: Mon, 24 Jun 1996 14:04:33 +0800
Subject: L&J: Libertarians
Message-ID: <199606240129.SAA04282@mail.pacifier.com>


At 05:35 PM 6/23/96 -0700, Franklin Wayne Poley wrote:
>On Sun, 23 Jun 1996, Jean-Francois Avon wrote:

>> On 22 Jun 96 at 18:56, jim bell wrote:
>> 
>> 
>> > In practice, I think we'll discover we don't NEED politicians at
>> > all!  
>> 
>> I was having a discussion with a retired physics dept director the
>> other day.  He never heard of AP and we did not discuss it.  But we
>> discussed the Net a lot.  And he made a very fundamental remark.  He
>> said someting along thoses lines (not an exact quote but one that sums
>> it up in essence) :
>> 
>> "It is amazing how the Net is.  It is a total anarchy and yet, it
>> seems to work *perfectly* well without any central decision making
>> authority.  Actually, no central authority could ever make it happens
>> better than this actual anarchy led by self-interest on the part of
>> each individuals each owning a tiny piece of the network."
>> 
>> It make me think about how essential the govt is, and especially in
>> the field of economy...
>> 
>I think we need public administrators (not politicians) who are hired by 
>the people for the people to do specific jobs, like looking after roads, 
>public buildings etc. and the public administrators who don't do their 
>jobs well are fired (not assassinated) like any other employee.... FWP.


Privatization will occur.  People will, indeed, be hired to do the tasks you describe.
Jim Bell
jimbell at pacifier.com





From perry at piermont.com  Sun Jun 23 23:13:11 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Mon, 24 Jun 1996 14:13:11 +0800
Subject: CDT Policy Post 2.25 - Senate Encrypti
In-Reply-To: <199606240104.SAA29097@jobe.shell.portal.com>
Message-ID: <199606240146.VAA08155@jekyll.piermont.com>



anonymous-remailer at shell.portal.com writes:
> WHY IS NO ONE TALKING ABOUT THIS VIOLATION OF OUR RIGHTS? EVER HERE THAT
> IN THE US VOTES ARE supposed to be *****SECRET*****??? NO MORE!
> 
> Why does the vtw cdt etc want to hand over your name to the us gov? Notice
> how there's two events one on the east cost and the other on the west coast.
> Why is that? So they can get more names!

Does your doctor know you've gone off your meds? Do that for long and
the guys in white coats will come for you again, you know.





From fwp at vcn.bc.ca  Sun Jun 23 23:58:31 1996
From: fwp at vcn.bc.ca (Franklin Wayne Poley)
Date: Mon, 24 Jun 1996 14:58:31 +0800
Subject: L&J: Libertarians
In-Reply-To: <9606231806.AA25084@cti02.citenet.net>
Message-ID: <Pine.3.89.9606231725.A9151-0100000@opus.vcn.bc.ca>


On Sun, 23 Jun 1996, Jean-Francois Avon wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On 22 Jun 96 at 18:56, jim bell wrote:
> 
> 
> > In practice, I think we'll discover we don't NEED politicians at
> > all!  
> 
> I was having a discussion with a retired physics dept director the
> other day.  He never heard of AP and we did not discuss it.  But we
> discussed the Net a lot.  And he made a very fundamental remark.  He
> said someting along thoses lines (not an exact quote but one that sums
> it up in essence) :
> 
> "It is amazing how the Net is.  It is a total anarchy and yet, it
> seems to work *perfectly* well without any central decision making
> authority.  Actually, no central authority could ever make it happens
> better than this actual anarchy led by self-interest on the part of
> each individuals each owning a tiny piece of the network."
> 
> It make me think about how essential the govt is, and especially in
> the field of economy...
> 
I think we need public administrators (not politicians) who are hired by 
the people for the people to do specific jobs, like looking after roads, 
public buildings etc. and the public administrators who don't do their 
jobs well are fired (not assassinated) like any other employee.... FWP.





From jimbell at pacifier.com  Mon Jun 24 02:00:42 1996
From: jimbell at pacifier.com (jim bell)
Date: Mon, 24 Jun 1996 17:00:42 +0800
Subject: One more reason to bash encrypt policy.
Message-ID: <199606240423.VAA13899@mail.pacifier.com>


Tonight, on the CBS show "60 minutes", we saw as the first portion the story 
of Carlos Salinas, the ex-president of Mexico, and his brother Raul, who 
managed to acquire $300 million despite the fact that his legitimate income 
never exceeded $190,000 in any year.  Well, Raul's in jail now, and his 
probably-crooked brother is in self-imposed exile (escape?) in Ireland.

Okay, you ask, is this relevant to Cypherpunks?  Sure!  The government's 
wanting to maintain an encryption policy to ensure that it is capable of 
reading encrypted traffic, right?  Well, the Bush and Clinton administration 
signed NAFTA with Mexico when it was run by a crook.  Where was the CIA?  
The NSA?  Raul's money went through Citibank.  Where's the FBI?  Isn't that 
one of the reasons we have such agencies?  Or is corruption among family 
members of the Presidend an old and established practice?  (Cattle futures?  
Sounds like a lotta bull to me!)
  
Why wasn't this stuff revealed by the US government?  Did it consider this 
corruption a failure?   Or a SUCCESS?  If we can't trust the US government 
to keep us from dealing with sleazy government's like Mexico, and exposing 
them, then why are we signing long-term trade agreements with them?  How 
much of Raul's money was due to NAFTA, for example?

Anyway, I think here's yet another reason to reject any kind of "National 
Crypto Policy" that's claimed to allow the government to snoop:  Clearly, 
they can't even be trusted to do the right thing with their information when 
they don't have to decrypt it.  I sure as hell am not going to expect 
them to do any better in the future.



Jim Bell
jimbell at pacifier.com





From carolann at censored.org  Mon Jun 24 17:20:38 1996
From: carolann at censored.org (Censored Girls Anonymous)
Date: Tue, 25 Jun 1996 08:20:38 +0800
Subject: The Reno Text.....
Message-ID: <2.2.16.19960624053327.12e75b32@primenet.com>


I read the Reno text from John Young's site.

Now not wanting to get into technical details,
It sure seemed kinda chilling to me.

The first "loaded word" she used was 'consensus'.
And from there on in, it was all downhill.

I would suggest that you read it.

Love Always

Carol Anne
Member Internet Society  - Certified BETSI Programmer  -  Webmistress
***********************************************************************
Carol Anne Braddock (cab8)  carolann at censored.org   206.42.112.96
My Homepage
The Cyberdoc
***********************************************************************
------------------ PGP.ZIP Part [017/713] -------------------
M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^
MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ`
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/






From shabbir at vtw.org  Mon Jun 24 17:37:48 1996
From: shabbir at vtw.org (Shabbir J. Safdar)
Date: Tue, 25 Jun 1996 08:37:48 +0800
Subject: CDT Policy Post 2.25 - Senate Encrypti
Message-ID: <199606240557.BAA27377@panix4.panix.com>


Damn, we've been found out.

I don't suppose anyone will notice the fact that although I've
helped with the preparation for the SAFE day, I won't actually be
attending the event.

Clearly, I don't want to get caught.

-Shabbir J. Safdar * Online Representative * Voters Telecomm. Watch (VTW)
 http://www.vtw.org/ * Defending Your Rights In Cyberspace

PS On a more serious note, I can't get testimony into the record for this
hearing if you don't send it to me.  Sooo...please either fill out the
form at http://www.crypto.com/submit/ or if you find that format too
constraining, just send it to me in email.  I'll see what I can do to
make sure PGP signatures are reproduced intact in the Congressional Record.

Most everyone I know cannot simply jaunt off to D.C. for a day.  Why not
at least make your voice heard?

anonymous-remailer at shell.portal.com writes:
>WHY IS NO ONE TALKING ABOUT THIS VIOLATION OF OUR RIGHTS? EVER HERE THAT
>IN THE US VOTES ARE supposed to be *****SECRET*****??? NO MORE!
>
>Why does the vtw cdt etc want to hand over your name to the us gov? Notice
>how there's two events one on the east cost and the other on the west coast.
>Why is that? So they can get more names!
>
>Read carefully:
>
>>TELL CONGRESS WHY ENCRYPTION IS IMPORTANT TO YOU - ADD YOUR VOICE TO THE
>>CONGRESSIONAL RECORD
>>
>>Senator Burns, Senator Patrick Leahy (D-VT) and the other sponosors of the
>>Pro-CODE bill want to hear from the Net.community about why encryption is
>>important to privacy and security on the Internet.
>>
>>Please be sure to visit http://www.crypto.com/ and add your voice to the
>>debate over encryption policy on Capitol Hill.  Responses will be tabulated
>>and the results, along with selected statements, will be included in the
>>Congressional Record by Senator Conrad Burns.  The restults will also be
>>featured during the Security and Freedom through Encryption Forum (SAFE) on
>>July 1 (details on that event are attached below).
>>
>>To add your voice to the crypto debate in Congress, visit:
>>
>>   http://www.crypto.com/submit/
>>
>
>Right. Sure. And then they have a record of all the ppl interested in
>cryptoprivacy (keep reading)
>
>>ATTEND THE SAFE FORUM - JULY 1, 1996 STANFORD CALIFORNIA
>>
>>On July 1, 1996, in the heart of California's Silicon Valley at Stanford
>>University, members of Congress, prominent computer industry leaders and
>>privacy advocates will meet to discuss the need to reform U.S. encryption
>>policy.
>>
>>The event is FREE and open to the public, but space is limited and is going
>>fast.  To find out more, and to reserve your free ticket, visit the SAFE
>>Forum Web Page at:
>>
>>  http://www.crypto.com/safe/
>>
>
>And sign up for a free trip to the roundup of people who want privacy. Coming
>soon to a police state near you. WHY THE FUCK DO THEY NEED TO KNOW YOUR
>NAME FOR THIS SHIT??? WHY IS NO ONE ASKING THIS???
>
>Look carefully at who's sponsoring this. Who are they, and where does
>the money come from? Hint: three letters.
>
>Notice how they don't use PGP to sign the msg? Wonder why? What does PRZ
>say about this?
>
>Is there anyone we trust involved who can answer for this?
>
>[///// THIS LINE ADDED BY EZBBS-MAIL / DO NOT DELETE / MSGID-33f1a9 / END ////
>/]
>





From stewarts at ix.netcom.com  Mon Jun 24 18:54:14 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Tue, 25 Jun 1996 09:54:14 +0800
Subject: Sen. Specter and Kerry move to delay crypto legislation
Message-ID: <199606240714.AAA13614@toad.com>


At 12:15 AM 6/22/96 -0700, someone anonymous wrote:

>Don't confuse Kerry and Kerrey.  This was not Kerry from
>Massachusetts.

Kerry from Mass seemed to have mixed feelings about it.
One one hand, he wants more business for his state, but on the
other, he's got a military background and is concerned about the
so-called legitimate needs of law enforcement.


#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Distract Authority!






From WlkngOwl at unix.asb.com  Mon Jun 24 18:57:59 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 25 Jun 1996 09:57:59 +0800
Subject: Zimmerman/Viacrypt
Message-ID: <199606240734.DAA02511@unix.asb.com>


Also note that "PGP" is Phil's trademark. If Viacrypt wants to market 
an 'escrowed' encryption utility that is compatabile with PGP, they 
can if they use their own code and if they don't use the trademark.

--Rob.

On 23 Jun 96 at 12:17, Rich Burroughs wrote:
[..]
> Phil's feelings about PGP are a different matter, though.  If he feels it
> shouldn't be used that way, and that Viacrypt has violated their agreement,
> then he should pursue it, IMHO.  It doesn't necessarily follow that he's
> just using it as an excuse to wrest the commercial version from them.  He
> may feel they really have gone beyond what was agreed upon.  I suppose it
> will be up to the courts to decide whether the escrow system is a "back
> door" or not.
 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From WlkngOwl at unix.asb.com  Mon Jun 24 18:58:57 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Tue, 25 Jun 1996 09:58:57 +0800
Subject: (Fwd) Re: MD5 collisions
Message-ID: <199606240728.DAA02464@unix.asb.com>


This was sent to me today.

Rob.

------- Forwarded Message Follows -------
Date:          Sun, 23 Jun 1996 20:03:16 -0400
From:          Zbigniew Fiedorowicz <fiedorow at math.ohio-state.edu>
Subject:       Re: MD5 collisions

It is very easy to add SHA1 hash capability to the existing PGP sources.
The patch is about 17K in size and there is an extra module which
actually implements SHA1. I've put this up on my web page:
 http://www.math.ohio-state.edu/~fiedorow/PGP

Zig Fiedorowicz








From don at wero.cs.byu.edu  Mon Jun 24 19:29:12 1996
From: don at wero.cs.byu.edu (Don)
Date: Tue, 25 Jun 1996 10:29:12 +0800
Subject: uh... HELLO?? Was Re: Auto-mail filters and penet-remiler loophole?
In-Reply-To: <Pine.LNX.3.94.960623203411.135A-100000@gak>
Message-ID: <m2n31t4p4v.fsf@wero.cs.byu.edu>


Hasn't anyone here heard of penet's password system? or does your autoresponder
automatically insert your penet password into all your autoresponses???

Even if you only got your penet account on accident, you could at least read
the documentation on it.

Don
-- 
<don at cs.byu.edu> http://students.cs.byu.edu/~don  PGP 0x994B8F39  fRee cRyPTo!
  Linux was made by foreign terrorists to take money from true US companies
  like Microsoft." -Some AOL'er. "To this end we dedicate ourselves..." -Don
** This user insured by the Smith, Wesson, & Zimmermann insurance company **





From jf_avon at citenet.net  Mon Jun 24 19:50:32 1996
From: jf_avon at citenet.net (Jean-Francois Avon)
Date: Tue, 25 Jun 1996 10:50:32 +0800
Subject: L&J: Libertarians
Message-ID: <9606240806.AA01235@cti02.citenet.net>


On 23 Jun 96 at 22:21, s1113645 at tesla.cc.uottawa.ca wrote:

> David Friedman (<http://www.best.com/~ddfr>

Thanks for the reference

> > Anybody who discuss it openly on the net and plan to implement it will
> > get killed by governments (pick your favorite one).  I find it very

> You don't see death
> squads going after old anti-government Milton Friedman, do you?

I guess I made myself misunderstood.  I meant to reply to Jim Bell 
mentionning that he would like to see some peoples interested in 
discussing the implementation of AP.  It is very different than just 
talking about (against) govt.

> No offense meant, but have a couple of Valiums, J-F. 

No. No offense meant, but you are wrong here. Did you read
Assasination Politics?  By the nature of it, govt employees will get
killed and *this* warrant trying to kill everybody they would
suspect of setting up an AP server.


> > And communicating with each other with PGP without remailers would
> > probably put us instantly on a hit list.  To quote a famous french

> Use a nym. I do.
No offense, but please, re-read the paragraph.  That is exactly what 
I meant...

 
> They already have such a thing. <snip> After all, Cypress Hill,
> Hyperreal.com, High Times and The Economist are still in business.

Did you read the AP essay?  I don't think so otherwise you wouldn't 
have commented in that sense.  What you say is true but IMO, AP is 
absolutely different from The Economist.  Remember, it entails 
asassination of govt employees...
 
> > C'Punks has a total cumulative
> > subscription of, say, 10000 (out of the blue number), which represent
> Closer to 1000. Send a "who cypherpunks" to majordomo at toad.com

I did not say "subscription", but "cumulative subscription".  I think 
that C'Punks is having around 1500 subscribers theses days.

> ;-) In the past little while 
<snip>

Interesting and good luck for the future!

> I really do think it's necessary for people to read a good book
<snip> 

wholehartedly agreed
 
> The subject of "anarchy vs. statism" doesn't really have much to do with
> politics, really. It's all economics.
<snip>

Somehow agreed.

Regards

JFA





From dlv at bwalk.dm.com  Mon Jun 24 21:54:08 1996
From: dlv at bwalk.dm.com (Dr.Dimitri Vulis KOTM)
Date: Tue, 25 Jun 1996 12:54:08 +0800
Subject: "Building the 21st Century Enterprise"
Message-ID: <eDs2PD207w165w@bwalk.dm.com>


I just got a piece of junk snail with these words on it. It's an ad for
"Financial Technology World Conference 1996". Highlight:

Luncheon Speaker, September 17, 12:30-1:30 pm
Dr. Nathaniel Borenstein
Chief Scientist
First Virtual Holdings, Inc
As Chief Scientist of First Vortual Holdings, Nathaniel Borenstein created
the first operational Internet payment system.

It includes his picture. What can I say... I wouldn't buy a falafel in the
street from this guy. :-)

The conference is run my Miller Freeman, (212) 615-2765.

I considered coming to heckle him, until I saw that this isn't even free:

CONFERENCE FEES
Fee is $795 per person...

I suppose the audience will be limited to the people willing to pay lots
of money to listen to Dr. Nathaniel.

Very amused,

---

Dr.Dimitri Vulis KOTM
Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps





From bryce at digicash.com  Mon Jun 24 22:09:20 1996
From: bryce at digicash.com (bryce at digicash.com)
Date: Tue, 25 Jun 1996 13:09:20 +0800
Subject: private message to anonymous recipient
In-Reply-To: <199606180226.VAA19583@alpha.jpunix.com>
Message-ID: <199606241102.NAA14046@digicash.com>



-----BEGIN PGP SIGNED MESSAGE-----

C'Punks, I sincerely apologize for this breach of netiquette,
but I can't figure out any other way to be sure of contacting my
interlocutors.  Please be patient with us, we'll have a better
anon channel soon.


Bryce


- -----BEGIN PGP MESSAGE-----
Version: 2.6.2i
Comment: Auto-encrypted under Unix with 'BAP' Easy-PGP v1.1b2

hIwDulymyOnirHUBBACLxoU/DOrHiwd/4eedAqcMpeVBHJskv4mcFnG97Nxll6OV
xRqNmVY7UT7HV6+8TgNsVPHtIz2gd76pT6gdscbZxFOnXNTOMR1c8kH/W0PZh8LY
kE0WxxWyqghnw4j98jMCs1al+aMSKE9CzGVPM5v3iZjTO6taOguvOFaBzDSvwYRs
A0jbHy8sKZitAQL+JDc20xS/fZPsIENngCyKcE7f8QsR85PhuQrBQeZuNsuOPU2v
5CbewkQR/+z3uzyJAfCcOUoXrPDecaMmyFYxrzjjYcjNhoxRDKEJa+X+SscvlcEp
T06KDNUZrrXDUUevhIwDkJRPiBSKEeUBBACfB3dE6Izxr3V6qfnxgE3P09Tb1hNI
30ZcahXWwWMPnkIPXOESyNbSYquV+2Inw0sSumCk7A+uwSDQEdv7T+7NxnBBO6Cx
EvUkOKIFa5ApyU38b/NjVeYK9XjOY5Zxz3smUwaRtCJwKSF/RfP/oRF465ZfiIaU
0bzo8Dx5o9H1bKYAAAHAl8upwh5wHWT+3xV89Vl0e+dsONfexbR28ON8o53gbLu1
UpgMhg3+ezSkPlaW5nXoDhME1Miwdi9/J9Rq3/CzF+jY4gus9pEobJ8MRZBLe2Lh
O1cBCDzyzSJcQdt1kbItfMfKkm2PMKHYt+SyzR1l9hHq42UBqw6qGfbj0SiQ8hWf
hwoAeL0xo2bfgwTYEX35QVc5FD5fEEAcsFOqgB/VzuxOfR9ydH1saOux8aXoF3N9
v/Y3pGMNxlAb+7NThv+Dt/GFK+3CnT9HbNE1h//SZL16THYByB1CzWqfUhrhW0XU
BfPHkReKTnei5Tc9Hblu0JrGOctIKIjZiyRIJAZzPg2zq/lVwOdB5glZRtJ0LAID
yvwODNXG71wLl2x8+jVFxCJTK5bAsQvluQXNwq8lPaDiJrBjsCWTYEbHXLnue4jO
xvQQf+yGDLISXB1yVKUf0peuYSn6pmFw5pcftXbSE5hb5W1bkh7bUZs0nDt2AELa
n/Ao8rnVWqiopUheIqIxEmxJZc4X99mTMQMUD4yr7ieR7+YtIkawOU4pGTyGZawM
3D5TFQdLphOUF512qGIxGbbg8NsZaPeIF133kHGOmw==
=nVvT
- -----END PGP MESSAGE-----



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i
Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.1b2

iQB1AwUBMc51q0jbHy8sKZitAQELJwMAubh35EvdnyJnRMb7aPS7SRiLuR5nZaFz
HNDM7YzwRJn+O9DFrrYiXSKGuGvQ4QPs3PRJ+UqbrbgNe6brXyMrMuHwRqELR+yI
uI4a2b4XBLGMVxutlznqYs221w7P3DSi
=/xkk
-----END PGP SIGNATURE-----





From wombat at mcfeely.bsfs.org  Mon Jun 24 22:09:45 1996
From: wombat at mcfeely.bsfs.org (Rabid Wombat)
Date: Tue, 25 Jun 1996 13:09:45 +0800
Subject: Anonymous stock trades.
In-Reply-To: <9606072345.AA04810@Etna.ai.mit.edu>
Message-ID: <Pine.BSF.3.91.960624220841.157A-100000@mcfeely.bsfs.org>



On Fri, 7 Jun 1996 hallam at Etna.ai.mit.edu wrote:

> I thought the list had probably got bored with this nonsense long
> ago.
>
 
Perhaps the first thing you've been right about in some time, *Dr.*.

- r.w.






From s1113645 at tesla.cc.uottawa.ca  Mon Jun 24 22:10:00 1996
From: s1113645 at tesla.cc.uottawa.ca (s1113645 at tesla.cc.uottawa.ca)
Date: Tue, 25 Jun 1996 13:10:00 +0800
Subject: L&J: Libertarians
In-Reply-To: <9606240806.AA01235@cti02.citenet.net>
Message-ID: <Pine.3.89.9606240829.A24595-0100000@tesla.cc.uottawa.ca>



May we take cypherpunks off the reply block for this thread? It's rather 
unrelated (though I have nothing against discussing the topic through 
e-mail).





From hallam at ai.mit.edu  Mon Jun 24 22:11:34 1996
From: hallam at ai.mit.edu (Hallam-Baker)
Date: Tue, 25 Jun 1996 13:11:34 +0800
Subject: Noise: Re: Those Evil Republicans
In-Reply-To: <4qjndd$fnl@life.ai.mit.edu>
Message-ID: <31CEE31E.794B@ai.mit.edu>


Duncan Frissell wrote:

> "They believe that the Government is the problem and that what everyone
> needs is to be told, 'You're on your own; go out there into the tender
> mercies of the global economy; have a great time in cyberspace, and we'll
> get out of your way.'" -- William Jefferson Blythe Clinton in a speech to
> the AFSCME in Chicago on Friday.

> I guess he doesn't want us to have fun in cyberspace -- though he didn't say
> so directly.

If you had heard the whole speech rather than only the portion reported on CNN
you would know that you have entirely distored the meaning. The point being
made was that cyberspace is being promoted as a panacea for all ills, many of
which it is creating rather than curing. Cyberspace is not a replacement for an
ecconomic policy, Newts idea of giving laptops to homeless people is not a
solution for poverty. Actually I think that this is quite obvious from the
quote you give.

Given the experience of derregulating Savings and Loans institutions I don't
think the country could survive another round of deregulation. As Reagan said
"Gentlemen we've hit the jackpot" - and of course they had, S&L was not a
fiasco for certain people, just for the poor taxpayers.


> In the same speech in which he talked about people hunting ducks with rifles.

Damned unsporting eh? Isn't the NRA weapon of choice a surface to air missile?


		Phill





From reagle at rpcp.mit.edu  Mon Jun 24 22:18:09 1996
From: reagle at rpcp.mit.edu (Joseph M. Reagle Jr.)
Date: Tue, 25 Jun 1996 13:18:09 +0800
Subject: http:--www.spyzone.com-
Message-ID: <9606242017.AA02091@rpcp.mit.edu>



   [IMAGE]
   
   THIS IS NOT A GAME.
   
    You are entering
   Communication Control System's
   
   
   Spy Zone.
   
   
     _________________________________________________________________
   
   This is the real world of spy versus spy, corporate espionage,
   counter intelligence, surveillance,
   and ultra-high tech detection systems.
   The products, services and information
   contained in this site are designed to protect you,
   your business and anything that you consider valuable.
   
     _________________________________________________________________
   
   THIS MONTH'S KEY FACT
   "72% of all businesses who experience a major loss of information
   systems/data and have not made preparations for that loss go out of
   business within 24 months...prepare for disasters..this is definitely
   the Decade of Disasters"
   
   ENTER SPYZONE
   TOOLS AND TECHNIQUES, OPPORTUNITIES, FACTS, ABOUT SPY ZONE
   
   Copyright CCS INTERNATIONAL, INC. 1995
   Web Site Design By John Copen
   
   .





From anonymous-user at worldnet.att.net  Mon Jun 24 22:19:26 1996
From: anonymous-user at worldnet.att.net (WorldNet User)
Date: Tue, 25 Jun 1996 13:19:26 +0800
Subject: AT&T bans anonymous messages
Message-ID: <31CEC5B3.7C19@worldnet.att.net>


AT&T WorldNet service has banned the sending of anonymous email or
posting anonymously.

>From the "AT&T WorldNet Service Operating Policies":

		(i) Members may not post or transmit any message
		anonymously or under a false name. Members may
		not permit any other person (other than an agent
		acting on Member's behalf and subject to Member's
		supervision) to access the Service Member's
		account for any purpose.

The no anon rule even beat the no indecency rule, which is second:

		(ii) Members may not post or transmit any message
                which is libelous, defamatory or which discloses
                private or personal matters concerning any person.
                Members may not post or transmit any message,
                data, image or program which is indecent, obscene
                or pornographic. 

http://www.worldnet.att.net/care/terms/#oppol





From HHendler at t-online.de  Mon Jun 24 22:25:26 1996
From: HHendler at t-online.de (Horst Hendler)
Date: Tue, 25 Jun 1996 13:25:26 +0800
Subject: (Kein 'Betreff')
Message-ID: <31CF2011.7377@t-online.de>


unsuscribe





From Paul.Rarey at Clorox.com  Mon Jun 24 22:25:43 1996
From: Paul.Rarey at Clorox.com (Paul Rarey)
Date: Tue, 25 Jun 1996 13:25:43 +0800
Subject: Micropayments: myth?
In-Reply-To: <1cceeb10@ix.netcom.com>
Message-ID: <960624042346.ZM14774@maverick.clorox.com>


On Jun 23,  0:16, Bill Stewart wrote:
> Subject: Re: Micropayments: myth?
>>>don't people get this? with microcurrency, you don't say to a 
>>>seller, "bill me for this item". it would rarely work like that at
>>>all. instead, it is, "here is my money, please give me the item". 
>>
>>What is the authentication process for the "money" your are "giving" in this 
>>scenario?
>
>Varies with the micropayment system.  Some proposals are to use Digicash,
>either online or offline.  Others are to use simpler systems, such as S/Key 
>variants or piles of tokens - you'd use some heavyweight payment system like
>a credit card / ATM / digicash to buy 100 or 1000 microtokens, which you'd
>use for the actual payments, and which would require less computation to
>authenticate.

These processes have a non-repudiation service?

Cheers!
[ psr ]






From geoff at commtouch.co.il  Mon Jun 24 22:30:57 1996
From: geoff at commtouch.co.il (geoff)
Date: Tue, 25 Jun 1996 13:30:57 +0800
Subject: Bad Signatures
Message-ID: <19960624094226014.AAA227@geoff.commtouch.co.il>


-----BEGIN PGP SIGNED MESSAGE-----

To: cypherpunks at toad.com
Date: Mon Jun 24 12:48:55 1996

Thanks to all list members who responded on this issue.

The consensus is that bouncing bad signatures to the list is not a 
good idea.

In the interest of reducing the number of bad signatures caused by 
munging which appear on the list, I will continue to bounce messages 
with bad signatures to the originator only.

Thanks,

Geoff Klein.






-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBMc5WeELv5OMYFK1FAQEiAAP/fr0+Z1dmGfuRgiGqir9396+DSJ+eBquS
0JM9FxtMvZwyCsafsJSwZSHBPWtLanaAzFMgO5SigWSki6hP3sP/ywrH0qni480U
7d0CG9gz2g2N6pYAjE8nhFT26NUVFBvm/csPod+3W71/vvg/KP3vRas2fWRqRzQY
wEV2g4aaTII=
=rh71
-----END PGP SIGNATURE-----






From snow at smoke.suba.com  Mon Jun 24 22:32:56 1996
From: snow at smoke.suba.com (snow)
Date: Tue, 25 Jun 1996 13:32:56 +0800
Subject: info assembly line, "flits" (long)
In-Reply-To: <199606240027.RAA26443@netcom10.netcom.com>
Message-ID: <Pine.LNX.3.93.960624034918.283A-100000@smoke.suba.com>


On Sun, 23 Jun 1996, Vladimir Z. Nuri wrote:

> to move a pencil I only pick it up and set it down. to move a 
> document through cyberspace, 
> the process is infinitely more complex, requiring an
> immensity of thoughts and coordinated actions. when we create
> a system that matches the real-world difficulty, then we will
> be approaching the limit. we are very, very far from that limit
> even though we have climbed the ladder a long ways as you note.

	Think about catching a ball. Think about writing a program
convince a piece of hardware to catch a ball. Which is _more complex_
neither. Which is harder? writing the program.  

	Back to your example: moving a pencil up and down is not nearly as
complex as "moving" a document through "cyberspace". Then again moving a
pencil up and down isn't nearly as comlex as moving a pencil from Finland
to Miami. 

	Thing is, in the physcial world there is much complexity to what
we accomplish, it is just that we have already learned that complexity. It
is often less of a pain for me to ftp a file from a site half way around
the world that to dig thru the piles of paper to find the print out. 

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From tcmay at got.net  Mon Jun 24 22:34:28 1996
From: tcmay at got.net (Timothy C. May)
Date: Tue, 25 Jun 1996 13:34:28 +0800
Subject: Paranoids Day Out
Message-ID: <adf41ef400021004dab4@[205.199.118.202]>


At 5:57 AM 6/24/96, Shabbir J. Safdar wrote:
>Damn, we've been found out.
>
>I don't suppose anyone will notice the fact that although I've
>helped with the preparation for the SAFE day, I won't actually be
>attending the event.
>
>Clearly, I don't want to get caught.


I also signed up for this "SAFE" event, using my True Name (tm, and TM). I
feel that I can do more good for the Cause by working from within the
Reeducation Camps than I can by wandering through the No Thought Zones.

But, then, They already had my name....


>anonymous-remailer at shell.portal.com writes:
>>WHY IS NO ONE TALKING ABOUT THIS VIOLATION OF OUR RIGHTS? EVER HERE THAT
>>IN THE US VOTES ARE supposed to be *****SECRET*****??? NO MORE!
>>
>>Why does the vtw cdt etc want to hand over your name to the us gov? Notice
>>how there's two events one on the east cost and the other on the west coast.
>>Why is that? So they can get more names!
...
>>Look carefully at who's sponsoring this. Who are they, and where does
>>the money come from? Hint: three letters.

Yes, the "NSA" is indeed the TLA operating VTW. This is well-known to all
true paranoids.

--Winston Smith







From jya at pipeline.com  Mon Jun 24 22:36:08 1996
From: jya at pipeline.com (John Young)
Date: Tue, 25 Jun 1996 13:36:08 +0800
Subject: Arms Export Report
Message-ID: <199606241754.RAA14356@pipe5.t1.usa.pipeline.com>


   The Wash Post today reports on a new study of U.S. arms 
   export policy, presented to the White House on Friday, and 
   to be formally released next week. It primarily addresses 
   killing-type arms and proposes greater U.S. restraint 
   of export of advanced armaments rather than promotion to 
   buttress the defense industry. 
 
   One of its recommendations is to form all regulations 
   governing arms exports and intelligence-gathering into 
   "single, coherent framework." 
 
   If anyone has seen this report, does it address crypto 
   export? 
 
   A copy by E-mail or fax (to 212-799-4003) would be 
   appreciated. 
 
---------- 
 
   The Wash Post has a free (for now) Web site at: 
 
        http://www.washingtonpost.com 
 
 
 





From hallam at Etna.ai.mit.edu  Mon Jun 24 22:42:27 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Tue, 25 Jun 1996 13:42:27 +0800
Subject: Noise: Re: Those Evil Republicans
In-Reply-To: <2.2.32.19960624201317.0092cd94@popserver.panix.com>
Message-ID: <9606242058.AA01765@Etna.ai.mit.edu>



>I read the reporting and excerpts in the Saturday Times.  

The Times is a Rupert Murdoch paper and so the views you find tend to be those 
of Rupert Murdoch - the man who gave Newt a $3million bribe (oops advance 
payment). 

>I wasn't aware of any ills being created by cyberspace.  For one thing, it
>hasn't been around (as a big thing) long enough. 

It probably dosen't affect you but there have been losers, mainly people loosing 
their jobs in the banking, insurance and other sectors where administrative 
staff are being replaced by computer. Now in the long run this is a good thing, 
but in the short run it is bad for the people concerned.

> The only impact it has had
>so far is to reduce TV watching and improve writing ability (from a very low
>base level) among its heavy users.  That's a good thing.  Any effects of
>disintermediation or shrinking of institutions (governments and
>corporations) as we discuss on this list haven't really happened yet.

Actually shrinking of government is happening but not because of the net. We are 
currently seeing the effect of the first wave of PC technology. The federal 
government has been drastically cut in size but mainly through outsourcing and 
contracting, not through reduction in functions performed. 

The main limitations are social, not technological. Like many large 
organisations the government has an ossified beauracracy. There is a very strong 
disincentive against making any changes. The reward for inovation is likely to 
be blame for whatever bad things happen without any credit for anything good 
that happens. Plus you could find yourself in front of a congressional kangeroo 
court being charged with some partisan charge or other.

Disintermediation is something that is happening, you could go to the Whitehouse 
site and obtain the "official" press release direct from the source.


>Yes the great inventor of deposit insurance FDR has a lot to answer for.
>But for his intervention, we taxpayers wouldn't have owed a dime for the S&L
>collapse.

Remember why FDR invented deposit insurance? The worst depression in modern 
history was caused by the lack of deposit insurance. You have the option of 
investing in a bank that is not insured, there were no problems with the 
insurance scheme so long as the insurers were allowed to regulate their risk 
just like any other insurer does. The problem came when Reagan and his crew "hit 
the jackpot".


>>Damned unsporting eh? Isn't the NRA weapon of choice a surface to air missile?
>
>The NRA suggests shotguns.  A rifle is much more sporting than a shotgun for
>assassinating quackers.  Hard to hit them with rifles (even harder with SAMs).

Well if you are a bad shot you probably need to use a shotgun. But think of the 
advantages of using a steel bullet - no lead poisoning problems!

	Phill












From williams at va.arca.com  Mon Jun 24 22:44:00 1996
From: williams at va.arca.com (Jeff Williams)
Date: Tue, 25 Jun 1996 13:44:00 +0800
Subject: info assembly line, "flits" (long)
Message-ID: <1093009406.50185835@va.arca.com>


Vladimir Z. Nuri,vznuri at netcom.com writes:

> what the flit concept does is introduce a *context* to a bit.
> a bit has no "context".  where did a bit come from? the situation
> with information is that it always has a *context* and is tied
> with other information. (so in addition, I might like to suggest
> that "flits" can be "tied together" with each other).

To me, bits don't need context any more than atoms do.  Their whole beauty
(like atoms) is their simplicity.  You can build incredibly complex
structures (like jaguars) from the simplest of particles (or bits).

Negroponte's analogy begs the question of the physics of cyberspace.  They
are clearly different from the physics of the real world.  Imagine if you
lived in a world where objects could be duplicated extremely quickly,
cheaply, and perfectly.  You could send things around at the speed of light.
Nothing ever happens except by the action of a program.  What would be
valuable to you in this world (crypto-relevance)?  Why would you care about
"where" anything is?  Why would you bother to "move" something?

Putting aside the implementation problems with "flits", I don't think there
is any need to make cyberspace behave like the real world.  The best things
about cyberspace are the differences with the real world.  I agree we need to
work on the interfaces between worlds, but that doesn't equate to making them
the same. 

A major problem with your note is that it confuses the bit-atom level view of
the world with the document-jaguar level.  People don't have to interact with
bits any more than they have to deal with atoms.  The properties you are
seeking are at a higher level than bits and are already in early development
(OpenDoc and others).   The "information assembly line" is at this higher
level and does not require "flits".

Thanks for a provocative note.

--Jeff






From vznuri at netcom.com  Mon Jun 24 22:47:47 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Tue, 25 Jun 1996 13:47:47 +0800
Subject: domain name zapping threat by Internic
Message-ID: <199606242105.OAA00824@netcom13.netcom.com>



surprising not to see any discussion on this here..

this is a very intersting development. all kinds of news reports
are talking about the internic zapping 25,000 DNS addresses.
I wonder how this will turn out.

I saw in an article a claim, I think, that the internic now charges
$100 "rent" per year for a domain. this is really amazing to me,
because this has totally changed from a one-time only fee, if correct.
is that correct?

I wonder if people are going to try to find a way to "route around"
this action by the internic... one wonders if this is just the first
in a series of actions by the new spook owners. (SAIC)  essentially,
if someone wanted to implement a tax or a way to control the internet,
the NIC would be an excellent place to start.

I wonder if the NIC has legal authority to yank DNS address like
they are doing. it seems one could take them to court and have
a pretty good argument that people who run DNS servers are free
to run them however they want, and that ultimately this is what
determines how routing on the internet is supported, not some
overseeing agency like the NIC.

it seems to me that now would be a brilliant time for someone
to introduce a "non NIC registration service" that sets up an
alternate DNS that guarantees that members will never be charged
money. of course that's what the DNS "sort of" started out as...

sigh.


Subject: Internic removing Domain names

The news media is anouncing that the Internic will delete 25,000 domain 
names that have not paid their registration fees Monday.  How will this 
work?  If someone is using one of these Domains and has DNS entries to 
find them what can the Internic do to disable the Domain? Won't the 
existing DNS services keep them working?

Glenn York






From raph at CS.Berkeley.EDU  Mon Jun 24 23:01:37 1996
From: raph at CS.Berkeley.EDU (Raph Levien)
Date: Tue, 25 Jun 1996 14:01:37 +0800
Subject: List of reliable remailers
Message-ID: <199606241350.GAA17535@kiwi.cs.berkeley.edu>


   I operate a remailer pinging service which collects detailed
information about remailer features and reliability.

   To use it, just finger remailer-list at kiwi.cs.berkeley.edu

   There is also a Web version of the same information, plus lots of
interesting links to remailer-related resources, at:
http://www.cs.berkeley.edu/~raph/remailer-list.html

   This information is used by premail, a remailer chaining and PGP
encrypting client for outgoing mail. For more information, see:
http://www.c2.org/~raph/premail.html

   For the PGP public keys of the remailers, finger
pgpkeys at kiwi.cs.berkeley.edu

This is the current info:

                                 REMAILER LIST

   This is an automatically generated listing of remailers. The first
   part of the listing shows the remailers along with configuration
   options and special features for each of the remailers. The second
   part shows the 12-day history, and average latency and uptime for each
   remailer. You can also get this list by fingering
   remailer-list at kiwi.cs.berkeley.edu.

$remailer{"extropia"} = "<remail at miron.vip.best.com> cpunk pgp special";
$remailer{"portal"} = "<hfinney at shell.portal.com> cpunk pgp hash";
$remailer{"alumni"} = "<hal at alumni.caltech.edu> cpunk pgp hash";
$remailer{"c2"} = "<remail at c2.org> eric pgp hash reord";
$remailer{"penet"} = "<anon at anon.penet.fi> penet post";
$remailer{"flame"} = "<remailer at flame.alias.net> cpunk mix pgp. hash latent cut post reord";
$remailer{"mix"} = "<mixmaster at remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?";
$remailer{"replay"} = "<remailer at replay.com> cpunk mix pgp hash latent cut post ek";
$remailer{"ecafe"} = "<cpunk at remail.ecafe.org> cpunk mix";
$remailer{"amnesia"} = "<amnesia at chardos.connix.com> cpunk mix pgp hash latent cut ksub";
$remailer{'alpha'} = '<alias at alpha.c2.org> alpha pgp';
$remailer{'nymrod'} = '<nymrod at nym.jpunix.com> alpha pgp';
$remailer{"lead"} = "<mix at zifi.genetics.utah.edu> cpunk pgp hash latent cut ek";
$remailer{"treehole"} = "<remailer at mockingbird.alias.net> cpunk pgp hash latent cut ek";
$remailer{"exon"} = "<remailer at remailer.nl.com> cpunk pgp hash latent cut ek";
$remailer{"vegas"} = "<remailer at vegas.gateway.com> cpunk pgp hash latent cut";
$remailer{"haystack"} = "<haystack at holy.cow.net> cpunk mix pgp hash latent cut ek";
$remailer{"ncognito"} = "<ncognito at rigel.cyberpass.net> mix cpunk pgp hash latent";
catalyst at netcom.com is _not_ a remailer.
lmccarth at ducie.cs.umass.edu is _not_ a remailer.
usura at replay.com is _not_ a remailer.

Groups of remailers sharing a machine or operator:
(c2 alpha)
(flame replay)
(alumni portal)

Use "premail -getkeys pgpkeys at kiwi.cs.berkeley.edu" to get PGP keys
for the remailers. Fingering this address works too.

Note: The remailer list now includes information for the alpha
nymserver.

Last update: Mon 24 Jun 96 6:48:39 PDT
remailer  email address                        history  latency  uptime
-----------------------------------------------------------------------
flame    remailer at flame.alias.net         ++++-+++++++    59:15 100.00%
replay   remailer at replay.com              ***+********     4:33  99.98%
alumni   hal at alumni.caltech.edu           **#+##*#####      :58  99.98%
ecafe    cpunk at remail.ecafe.org           --#+*#+####*    12:20  99.98%
vegas    remailer at vegas.gateway.com       *#*+#**#**-#    37:05  99.96%
c2       remail at c2.org                    +-+++-++++++    54:42  99.96%
portal   hfinney at shell.portal.com          ##+###+####      :58  99.86%
lead     mix at zifi.genetics.utah.edu       ++++++++++++    40:58  99.82%
exon     remailer at remailer.nl.com         ***+*+-++***     7:09  99.81%
haystack haystack at holy.cow.net            #*-*+-+*-+#+    21:26  99.80%
nymrod   nymrod at nym.jpunix.com            *+* ***** **     8:10  99.57%
penet    anon at anon.penet.fi               .___ ____    57:56:47  99.49%
mix      mixmaster at remail.obscura.com     ++-+_.-__.-  18:28:27  99.47%
amnesia  amnesia at chardos.connix.com        ----------   3:37:36  98.99%
treehole remailer at mockingbird.alias.net   +___-+.+++    7:26:03  97.84%
extropia remail at miron.vip.best.com        ----   --.-   7:35:07  95.20%
ncognito ncognito at rigel.cyberpass.net      ..._.--.    15:50:51  93.26%
alpha    alias at alpha.c2.org                    ++*****    35:02  87.27%

   History key
     * # response in less than 5 minutes.
     * * response in less than 1 hour.
     * + response in less than 4 hours.
     * - response in less than 24 hours.
     * . response in more than 1 day.
     * _ response came back too late (more than 2 days).

   cpunk
          A major class of remailers. Supports Request-Remailing-To:
          field.
          
   eric
          A variant of the cpunk style. Uses Anon-Send-To: instead.
          
   penet
          The third class of remailers (at least for right now). Uses
          X-Anon-To: in the header.
          
   pgp
          Remailer supports encryption with PGP. A period after the
          keyword means that the short name, rather than the full email
          address, should be used as the encryption key ID.
          
   hash
          Supports ## pasting, so anything can be put into the headers of
          outgoing messages.
          
   ksub
          Remailer always kills subject header, even in non-pgp mode.
          
   nsub
          Remailer always preserves subject header, even in pgp mode.
          
   latent
          Supports Matt Ghio's Latent-Time: option.
          
   cut
          Supports Matt Ghio's Cutmarks: option.
          
   post
          Post to Usenet using Post-To: or Anon-Post-To: header.
          
   ek
          Encrypt responses in reply blocks using Encrypt-Key: header.
          
   special
          Accepts only pgp encrypted messages.
          
   mix
          Can accept messages in Mixmaster format.
          
   reord
          Attempts to foil traffic analysis by reordering messages. Note:
          I'm relying on the word of the remailer operator here, and
          haven't verified the reord info myself.

   mon
          Remailer has been known to monitor contents of private email.
          
   filter
          Remailer has been known to filter messages based on content. If
          not listed in conjunction with mon, then only messages destined
          for public forums are subject to filtering.
          

Raph Levien





From jsled at cory.EECS.Berkeley.EDU  Mon Jun 24 23:15:44 1996
From: jsled at cory.EECS.Berkeley.EDU (Josh Sled)
Date: Tue, 25 Jun 1996 14:15:44 +0800
Subject: info assembly line, "flits" (long)
Message-ID: <199606241741.KAA10522@cory.EECS.Berkeley.EDU>


On Sun, 23 Jun 96 17:27:25 -0700, Vladimir Z. Nuri wrote:

>>think about the the number of atoms that are necessary 
>>to hold the information for a single page, let alone an entire book...  
>
>yep. not saying what I am talking about is feasible this moment.
>"moore's law"

But I don't think that it's feasible at ANY point in the near future...
in fact, I think a better question is WHY?  What would we use this
newfound ability for?  

>>in a virtual reality "cyberspace", this would be an insurmountable data 
>>storage... on the small-scale.
>
>not insurmountable. quite practical and sensible in say 10 years.

Ok... maybe practical to store the data... but I don't think sensible. 
Think: if we had this ability with atoms, what would we use it for? 
Maybe tracking crimes... or political prisoners (where have the atoms
in this anonymous leaflet spelling out steps for rebellion come from?)
or just curiousity... sure, there are justifable uses, but does the
"savings outweigh the cost", so to speak?

>to move a pencil I only pick it up and set it down. to move a 
>document through cyberspace, 
>the process is infinitely more complex, requiring an
>immensity of thoughts and coordinated actions. when we create
>a system that matches the real-world difficulty, then we will
>be approaching the limit. we are very, very far from that limit
>even though we have climbed the ladder a long ways as you note.

I think we're too far from the limit to even begin to guess about how
information would be stored in such a medium.    But that's just my
thought.  For the sake of argument: why would we want to have this
level of complexity in a simulated world.  There is so much that can be
assumed that is repetative and wasteful in the real world, why would we
want a computer-generated system that must keep track of all this
waste?

>>I think the thing that's most important in this sentence is _"move"_ ... 
>>this is the main problem for computers... it's SO easy to DUPLICATE 
>>information... but near impossible to make sure that you've MOVED it... 
>
>indeed, the concept of "moving" information implies TIME-- at one
>time, it is at one place, at another time, it is in a new place.
>but it is the SAME INFO. today, the disconnected idea of a "bit"
>does not give you this *continuity*. I make a copy somewhere else
>that is not tied to the original document.

That's why it's so easy to make a copy...  that's why we can have
backups and the cypherpunks list and almost everything on the Net.  If
we had to keep track of flits and update them constantly, things would
slow down a lot... but you're compensating for that by having
arbritarbily advanced computer technology.

>imagine the same thing on a totally universal cyberspatial level,
>not merely within a single company or university. I agree, we have
>rudiments of what I'm talking about in place. but my point is
>mainly that they are rudiments compared to what is possible. the
>web is a very good sample framework for the kind of seamlessness
>I'm talking about. like I say, the future information assembly
>line will be built on top of it. it has a long ways to go too.

Ok... in a far advanced level of technology, this and more would be
possible... but, the question is: do we need it?

>in a sense, I think the flit concept is a magic bridge between bits
>and atoms. bits are too abstract. atoms are too real. flits are
>a nice compromise. we have to get our bits to behave more like
>atoms: persistence, etc.  there are a whole lot of very nice
>"properties" of atoms that are staring us in the face that we
>would benefit from immensely implementing in cyberspace.

For some reason, distributed objects come to mind... though I'm not
knowledgeable enough on the subject to know why...

>>It means that you'd have an INSANELY large ammount of storage for a 
>>single small document.
>
>early stages would not be much different than RCS systems already in
>use in companies.

But I think that this is the best system available for today's or the
future's needs... if we extended this concept to document fragments
(ie, if you use a quote from a document, that section of your document
has the same revision history, changed as necessary), then we have a
system that could be in use for a long time.

>you could have mechanisms that don't keep the entire history of the
>flit. I agree, a flit as a 0 or 1 is very unlikely in the near future.
>but at a document level, i.e. a document as a flit, we already have
>it in RCS systems that companies are struggling to implement well
>as we speak.

Again, I think a document system is the best suited for information
storage... the flit concept seems to be a great overkill.

>I'm saying that in the information assembly line of the future,
>they *must* have context. they must be tied together. you only
>have disconnected chaos otherwise.

Hmm... the only problem is that the "context" would be completely
machine enforced... you can't actually MOVE or COPY the bits off a
computer onto another computer... each side just would have to
intrepret the bits as being moved or copied... and unless you propose
storing flits in something other than bits, the disconnected chaos you
refer to is nothing other than software understanding bit patterns...
same as ASCII or a word processor file or an OpenDoc document.

>again, this requires the human to interpret the changes. what if
>there was an actual "link" between the old and the new document
>that is "stuck" to the new document? and furthermore, software
>could traverse these links? that's more what I have in mind.

And if the old document moved?  How would the new document continue to
know where the old document is?

>data doesn't have to be disconnected. I told you this was a radical
>paradigm shift that I was proposing. you obviously have the previous
>concepts down quite well. I'm not arguing that what you are saying
>is the conventional system. I pointed out exactly that.

*nod*  You're right... I don't understand your shift in thinking... it
doesn't make sense to me.  I think that conventional systems are very
well suited to information creation, retrieval and transport, and that
virtual reality, though still in development, wouldn't benefit from the
flit concept.

>>But cyberspace is NOT real space...
>
>it will evolve to become more and more like a real space, a point
>of my essay.

I sure hope not... why do you think so many people escape to muds...
real space is bad... virtual space has the potential to become so much
more.

>>VERY VERY VERY far...
>
>10 years or so, I would say, before people implement things that
>sound like they came right out of what I was talking about.

Perhaps... I hope not, because I don't think that it's a reasonable
concept for working with data in an on-line or even mostly digital
environment, but perhaps...

>right. I think it is much more realistic to speculate that we will
>be virtually unlimited than limited, and to ask the question, 
>what would we implement if we truly were unlimited? to build something
>limited when you are unlimited shows an impoverished imagination.

well... I'll continue to think about the present, and you can continue
to dream about the future....

Take care,
Josh

PS I wonder: do you envision flits being able to be created out of thin
(virtual) air?







From frissell at panix.com  Mon Jun 24 23:17:17 1996
From: frissell at panix.com (Duncan Frissell)
Date: Tue, 25 Jun 1996 14:17:17 +0800
Subject: Noise: Re: Those Evil Republicans
Message-ID: <2.2.32.19960624201317.0092cd94@popserver.panix.com>


At 02:49 PM 6/24/96 -0400, Hallam-Baker wrote:

>If you had heard the whole speech rather than only the portion reported on CNN

I read the reporting and excerpts in the Saturday Times.  

>you would know that you have entirely distored the meaning. The point being
>made was that cyberspace is being promoted as a panacea for all ills, many of
>which it is creating rather than curing. 

I wasn't aware of any ills being created by cyberspace.  For one thing, it
hasn't been around (as a big thing) long enough.  The only impact it has had
so far is to reduce TV watching and improve writing ability (from a very low
base level) among its heavy users.  That's a good thing.  Any effects of
disintermediation or shrinking of institutions (governments and
corporations) as we discuss on this list haven't really happened yet.

>Cyberspace is not a replacement for an
>ecconomic policy, Newts idea of giving laptops to homeless people is not a
>solution for poverty. Actually I think that this is quite obvious from the
>quote you give.

I assume that Clinton's statement was aimed at the neo-Luddites in the
AFSCME.  There are probably quite a few.  Actually freedom of communications
or free exchange of bits (cyberspace) and by analogy the free exchange of
goods and services *are* an economic policy though of course a controversial
one.

>Given the experience of derregulating Savings and Loans institutions I don't
>think the country could survive another round of deregulation. As Reagan said
>"Gentlemen we've hit the jackpot" - and of course they had, S&L was not a
>fiasco for certain people, just for the poor taxpayers.

Yes the great inventor of deposit insurance FDR has a lot to answer for.
But for his intervention, we taxpayers wouldn't have owed a dime for the S&L
collapse.

I expect quite a bit more de facto dereg as people become harder to control.
A mere desire to regulate others unaccompanied by the ability to do so is so
much noise. 

>> In the same speech in which he talked about people hunting ducks with rifles.

>Damned unsporting eh? Isn't the NRA weapon of choice a surface to air missile?

The NRA suggests shotguns.  A rifle is much more sporting than a shotgun for
assassinating quackers.  Hard to hit them with rifles (even harder with SAMs).

DCF

"If the Internet is so easy to control, how come my sysop can't even control
his little piece of it?"






From nelson at crynwr.com  Tue Jun 25 01:00:39 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Tue, 25 Jun 1996 16:00:39 +0800
Subject: [Even More Noise]: Re: Those Evil Republicans
In-Reply-To: <4qjndd$fnl@life.ai.mit.edu>
Message-ID: <19960625022540.30059.qmail@ns.crynwr.com>


Hallam-Baker writes:

 > Given the experience of deregulating Savings and Loans institutions
 > I don't think the country could survive another round of
 > deregulation.

I get really tired of shallow critics of deregulation citing the S&L
problem.  The problem was partial deregulation -- the wolves were let
go: into the sheep's pen.  The S&L's were allowed to make risky
investments, but the American taxpayers still guaranteed their asses.

Phil, your reputation is sinking fast.  I suggest silence on your part.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade;
Potsdam, NY 13676       | +1 315 268 9201 FAX   | governments coerce.





From nobody at REPLAY.COM  Tue Jun 25 02:25:29 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Tue, 25 Jun 1996 17:25:29 +0800
Subject: No Subject
Message-ID: <199606250516.HAA04288@basement.replay.com>


How do I use the Encrypt-Key: header to include a reply block
in an anonymous posting? I've tried for a few days now, and
I can't seem to make it work.








From strix at rust.net  Tue Jun 25 04:39:00 1996
From: strix at rust.net (Jennifer Mansfield-Jones)
Date: Tue, 25 Jun 1996 19:39:00 +0800
Subject: Oil Change software snoops through hard drive
In-Reply-To: <adf2d22c00021004b6d8@[205.199.118.202]>
Message-ID: <Pine.LNX.3.91.960624063035.333A-100000@neophron.rust.net>


-----BEGIN PGP SIGNED MESSAGE-----

On Sun, 23 Jun 1996, Timothy C. May wrote:

> At 8:31 PM 6/23/96, Alan Lewine wrote:
> >Maybe i'm confused, but oil change sounds like a mole that can burrow
> >unbidden into user's disks. I don't think user installation is required,

> It's a commercial product, offering a (putative) service to those who buy
> it. One "opts out" by not buying and installing it.

I thought Alan was implying that Oil Change might be licensed by other
software vendors, and then supplied as a "service" without warnings.
For instance, one might purchase the NiftyKeen Win95 graphics editor, 
and find in a footnote on page 58 of the manual that the product will
automatically update itself unless the user explicitly refuses the 
Customer Convenience Package during installation.

In any case, I don't think it's a bad idea to point out the potential
problems -- some people just don't notice these things unless the
implications are spelled out in at least as much detail as the glowing
marketer fluff.

  regards,
`=-`=-`=-`=-                                          -='-='-='-='
 Jennifer Mansfield-Jones   http://www.rust.net/~strix/strix.html
 strix at rust.net                            PGP key ------^


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMc5xc0xVmNNM34OxAQH2DAQAxiAj+CR7okA5nLCI54GYoESNUKO1wX8D
geD2L4UHtidJQ1dbSJmhRAggMGnHVpOH3JuPTDzSV45m+O1o8GXIuUYqGMzmiFhZ
LrDiV7l/RTWxoFPVE8M3e6BiH6IMShe3ZHXPkP4q4w0RALJMSYK0YYq3EX3ji+1B
86tpWojLRzk=
=9rDr
-----END PGP SIGNATURE-----





From furballs at netcom.com  Tue Jun 25 04:40:57 1996
From: furballs at netcom.com (Paul S. Penrod)
Date: Tue, 25 Jun 1996 19:40:57 +0800
Subject: Noise: Re: Those Evil Republicans
In-Reply-To: <31CEE31E.794B@ai.mit.edu>
Message-ID: <Pine.3.89.9606250021.A7632-0100000@netcom>




On Mon, 24 Jun 1996, Hallam-Baker wrote:

> Duncan Frissell wrote:
> 
> > "They believe that the Government is the problem and that what everyone
> > needs is to be told, 'You're on your own; go out there into the tender
> > mercies of the global economy; have a great time in cyberspace, and we'll
> > get out of your way.'" -- William Jefferson Blythe Clinton in a speech to
> > the AFSCME in Chicago on Friday.
> 
> > I guess he doesn't want us to have fun in cyberspace -- though he didn't say
> > so directly.
> 
> If you had heard the whole speech rather than only the portion reported on CNN
> you would know that you have entirely distored the meaning. The point being
> made was that cyberspace is being promoted as a panacea for all ills, many of
> which it is creating rather than curing. Cyberspace is not a replacement for an
> ecconomic policy, Newts idea of giving laptops to homeless people is not a
> solution for poverty. Actually I think that this is quite obvious from the
> quote you give.

Right, and I bet Clinton really believes what someone wrote for him to 
wax political on. :->

If Clinton really thinks that Cyberspace is the Second Coming, then 
explain to me CLIPPER's 1,2 and 3, Janet Reno, Dorothy Denning, the CDA, 
etc.

Exercising dominion over this medium for the excuse of protecting us from 
the bad guys is yet another lame excuse for tossing out what little 
freedoms we have allowed to be legislated away. The mere fact, that 
cryptography is considered a hinderance to "protecting the citizenry" by 
this administration is tantamount to declaring war on personal privacy.

When his legislative efforts actually fall in line with believable 
rhetoric, then maybe I'll pay more attention. Up to date, he has 
demonstrated his true character, or lack thereof, between what he says 
and what he and his Clintonistas do.

> 
> Given the experience of derregulating Savings and Loans institutions I don't
> think the country could survive another round of deregulation. As Reagan said
> "Gentlemen we've hit the jackpot" - and of course they had, S&L was not a
> fiasco for certain people, just for the poor taxpayers.
> 
> 

This presumes that Cyberspace is regulated to begin with. I have yet to 
see anyone apply a litmus test that equally covers all jurisdictions and 
geopolitical climes. Last time I looked, Cyberspace was more "west of the 
Pecos" than any other communications medium that is generally available - 
which IMO is one of the last places that the first amendment actually 
still applies.

As for surviving deregulation, I would be more worried about the coming 
stock market crash and the devaluation of the worthless currency we carry 
in our pockets. Industry comes and goes with changes in technology, and 
the legal system continues on in the never ending effort to block 
progress and prop up self-serving ends.

10 years from now, many of the "regulated" industries we hold dear may 
not even exist in recognizable form.

> > In the same speech in which he talked about people hunting ducks with rifles.
> 
> Damned unsporting eh? Isn't the NRA weapon of choice a surface to air missile?
> 
> 
> 		Phill
> 

...Paul

"By the way, a new world record was set today in the 200 meter 
dash...Hillary heard a knock at the door and thought there was a
Subpoena waiting..." 

		Jay Leno, 6-24-96






From carolann at censored.org  Tue Jun 25 07:11:36 1996
From: carolann at censored.org (Censored Girls Anonymous)
Date: Tue, 25 Jun 1996 22:11:36 +0800
Subject: The Reno Text URL.....
Message-ID: <2.2.16.19960625103720.243fc176@primenet.com>


The URL for the Reno Address is:

http://pwp.usa.pipeline.com/~jwa/addres.txt

Thanks to John Young for the KEWL website.
Check out some of the other stuff in it too!

Love Always,

Carol Anne

At 04:21 AM 6/24/96 -0700, you wrote:

>I'd like to read it, but you didn't include the url, and the article
>you followed up seems to have expired out of my news spool.
>
>Mind telling me where the text is?
>
>-jcr
>
>
Member Internet Society  - Certified BETSI Programmer  -  Webmistress
***********************************************************************
Carol Anne Braddock (cab8)  carolann at censored.org   206.42.112.96
My Homepage
The Cyberdoc
***********************************************************************
------------------ PGP.ZIP Part [017/713] -------------------
M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M
MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^
MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ`
-------------------------------------------------------------
for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/






From nobody at vegas.gateway.com  Tue Jun 25 09:24:12 1996
From: nobody at vegas.gateway.com (Anonymous Remail Service)
Date: Wed, 26 Jun 1996 00:24:12 +0800
Subject: PhillNoise: Re: Those Evil Republicans
Message-ID: <199606251200.IAA27793@black-ice.gateway.com>


"Dr." Hallam-Baker <hallam at ai.mit.edu>
 ["but I don't think that I would ever let him cut on me." - sorry Jimmy]
opined:

.....

>Newts idea of giving laptops to homeless people is not a
>solution for poverty.

Agreed, any more than is Willie's subsidizing illegitimacy, despite his oft-
proven love for sex-without-responsibility.

>
>Given the experience of derregulating Savings and Loans institutions I don't
>think the country could survive another round of deregulation.

This is so moronic it could only come from Hallam. For you, "deregulation"
means doubling the government's liability, as happened when that space-
cadet (really!) Garn and that crook Fernand St. Germain raised the payout
from 50 to 100 thousand. Yeah, Phill, that really deregulated 'em...

>As Reagan said
>"Gentlemen we've hit the jackpot" - and of course they had, S&L was not a
>fiasco for certain people, just for the poor taxpayers.

Certainly not for that crook Cranston, either. There's a reason 4 of the
Keating 5 were Democrats, Phill. They were and are even more for sale than
the Republicans. Political history, even recent, isn't your strong suit,
and your pity for taxpayers is touching, if a bit recent.
anon.









From shifter at portal.stwing.upenn.edu  Tue Jun 25 12:21:43 1996
From: shifter at portal.stwing.upenn.edu (Shifter)
Date: Wed, 26 Jun 1996 03:21:43 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606242105.OAA00824@netcom13.netcom.com>
Message-ID: <199606251353.JAA07632@portal.stwing.upenn.edu>


> From cypherpunks-errors at toad.com  Mon Jun 24 22:57:09 1996
> Received: from toad.com (toad.com [140.174.2.1]) by portal.stwing.upenn.edu (8.7.4/8.7.3) with ESMTP id WAA03496 for <shifter at portal.stwing.upenn.edu>; Mon, 24 Jun 1996 22:57:07 -0400
> Received: (from majordom at localhost) by toad.com (8.7.5/8.7.3) id QAA00890 for cypherpunks-outgoing; Mon, 24 Jun 1996 16:29:06 -0700 (PDT)
> Received: from cygnus.com (cygnus.com [140.174.1.1]) by toad.com (8.7.5/8.7.3) with SMTP id QAA00878 for <cypherpunks at toad.com>; Mon, 24 Jun 1996 16:29:02 -0700 (PDT)
> Received: from netcom13.netcom.com (vznuri at netcom13.netcom.com [192.100.81.125]) by cygnus.com (8.6.12/8.6.9) with ESMTP id OAA21314 for <cypherpunks at toad.com>; Mon, 24 Jun 1996 14:07:22 -0700
> Received: from localhost (vznuri at localhost) by netcom13.netcom.com (8.6.13/Netcom)
> 	id OAA00824; Mon, 24 Jun 1996 14:05:58 -0700
> Message-Id: <199606242105.OAA00824 at netcom13.netcom.com>
> To: cypherpunks at toad.com
> cc: vznuri at netcom.com
> Subject: domain name zapping threat by Internic
> Date: Mon, 24 Jun 96 14:05:57 -0700
> From: "Vladimir Z. Nuri" <vznuri at netcom.com>
> Sender: owner-cypherpunks at toad.com
> Precedence: bulk
> 
> 
[intro deleted]
> 
> I saw in an article a claim, I think, that the internic now charges
> $100 "rent" per year for a domain. this is really amazing to me,
> because this has totally changed from a one-time only fee, if correct.
> is that correct?

There was never a "one-time" fee.  You could register as many domains as
you wanted whenever you wanted (as long as you weren't violating a 
trademark or something like that).  Usually people with domains would run 
into charges because they needed someone else (usually an ISP) to run
authoritative nameservers for their domain.

> 
> I wonder if people are going to try to find a way to "route around"
> this action by the internic... one wonders if this is just the first
> in a series of actions by the new spook owners. (SAIC)  essentially,
> if someone wanted to implement a tax or a way to control the internet,
> the NIC would be an excellent place to start.
> 
> I wonder if the NIC has legal authority to yank DNS address like
> they are doing. it seems one could take them to court and have
> a pretty good argument that people who run DNS servers are free
> to run them however they want, and that ultimately this is what
> determines how routing on the internet is supported, not some
> overseeing agency like the NIC.

Nothing stops anyone from running their own name server.  However, the root
servers are what 99% of the nameservers out there point at.  No one is going
to use dns.joe.schmoe.org as their primary nameserver.


> 
> it seems to me that now would be a brilliant time for someone
> to introduce a "non NIC registration service" that sets up an
> alternate DNS that guarantees that members will never be charged
> money. of course that's what the DNS "sort of" started out as...

And then there could be competition, which could potentially create some
bad scenarios.  What if one registration service refused to propagate their
domains to other registration services?

-- 

Shifter
shifter at portal.stwing.upenn.edu

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzF+qeMAAAEEALdaUpOTi8EtNjZMA9URTXGmQq1NPdyRSx2JXhQ7Q8Yz9qxU
q3tqRtlydRqp37VPmygibGB8eS7RptqolTlYvrVMHXSDcZjKpgpZA9d+3rCKUaLM
F9Hvltl2EafIEspVoNUYahpdXof4oMjs2sKGzJO8aDwyM34pRaicZR8SZJz9AAUR
tClTaGlmdGVyIDxzaGlmdGVyQHBvcnRhbC5zdHdpbmcudXBlbm4uZWR1Pg==
=Eucp
-----END PGP PUBLIC KEY BLOCK-----





From schneier at counterpane.com  Tue Jun 25 12:25:29 1996
From: schneier at counterpane.com (Bruce Schneier)
Date: Wed, 26 Jun 1996 03:25:29 +0800
Subject: I am looking to hire a crypto person....
Message-ID: <v03007401adf5a5188a3b@[204.246.66.57]>


I am looking to hire someone part-time (with potential to upgrade to
full-time) to work for Counterpane Systems, doing cryptography consulting
for a variety of clients.

The work is in analysis and design, mostly of cryptographic and security
systems.  Think of SSL, SPKI, PGP... that sort of thing.  There isn't a
whole lot of math, just critical thinking, complete analysis, and good
writing.

If anyone is interested, please send me mail.  (Depending on the number of
responses received, I may have some kind of application test.)

Bruce

************************************************************************
* Bruce Schneier            2,000,000,000,000,000,000,000,000,002,000,
* Counterpane Systems       000,000,000,000,000,000,002,000,000,002,293
* schneier at counterpane.com  The last prime number...alphabetically!
* (612) 823-1098            Two vigintillion, two undecillion, two
* 101 E Minnehaha Pkwy      trillion, two thousand, two hundred and
* Minneapolis, MN  55419    ninety three.
************************************************************************







From winn at Infowar.Com  Tue Jun 25 13:20:35 1996
From: winn at Infowar.Com (winn at Infowar.Com)
Date: Wed, 26 Jun 1996 04:20:35 +0800
Subject: Tales from the UK: Basel Part IV
Message-ID: <199606251406.KAA24757@mailhost.IntNet.net>


June, 1996: Basel, Switzerland
More on the London Attacks: Part IV

The International Banking Information Technology Forum seemed like an ideal 
location to get a reading on whether the Times' articles held any water or not. 
I sent the family to Germany for two days while I spoke and schmoozed and asked 
some of Europe's and America's top bankers about the articles. (See my last 
three reports [June 1 - 23, 1996] on the alleged attacks as reported in the 
(London) Sunday Times

I browsed and wove in and out of this esteemed financial community and asked 
anyone and everyone in the banking field: "Do you know anything?" "Is any of it 
true?" "Do you know any victims?" "Was your bank attacked?" "Please, tell me!"

Of course I didn't scream this out to all four hundred of the world's top 
bankers in the public forum of my keynote speech; rather I asked quietly and 
discreetly, hoping for a discreet and honest answer. I got lucky and received 
two.

Both people who did agree to speak about the events in question do *not* want to 
be identified. They are both in the very senior ranks of European banking and 
only asked that I do not divulge their companies, their positions, backgrounds 
or names. They both feel that the *real* story should get out - at least as much 
as they know - and that the leaks are inherently good for the banking industry. 
[They do not agree with security by obscurity.] Further, they both told me, at 
separate times during the two day conference, stories that were nigh on 
identical  (and I never told either one that I spoke to the other).

The bottom line is they both know about _four_ 'attacks' against financial 
institutions, although it was unclear as to whether they were all in the UK or 
not. I am left with the distinct impression at least three of them were. [Not 
the 40 or more that the Times suggested or that I have heard about since April 
of 1994.] However, unlike the Times article, there was no question as to the 
method of attack, and both sources were very clear in the use and the meaning of 
the word attack. Here is what they said as to how the technical extortion was 
accomplished. 

The perpetrator(s) would first place a call to the upper management of the 
intended victim announcing his/her intention. "We will take down your bank (or 
financial organization) unless you pay us a lot of money not to." 

The intended victims each sluffed off the threats. Shortly thereafter (within a 
day or two) their financial systems would seemingly collapse for no reason at 
the prescribed time and as promised by the caller. Banking services and/or 
trading would come to a halt, for about an hour or so, and then the affected 
systems would come back on line. Backups were ineffective; typical disaster 
recovery methods, I was told, just didn't work.

Thereafter, a second call would be made to senior executives of the victim 
firms, and the extortion demands for payment made again. In these cases, 
electronic payments to Switzerland were made, and the monies were then secreted 
from their temporary Swiss home within seconds - destined for places unknown or 
unannounced. No repeat attacks to paying institutions has occurred according to 
my sources.

I was told unequivocally that all of the four attacks used the same methodology: 
malicious software was somehow injected into the systems but neither was either 
forthcoming or knowledgeable about the specifics. They specifically denied that 
HERF techniques were used. But many questions remained, and I was unsuccessful 
at getting what I would call good answers to these and more queries:

	- Which systems were affected exactly?
	- How were the backup/redundancies disconnected?
	- Exactly what do you mean by remote control?
	- Did you ever find the offending software?
	- Was it an insider job?
	- Was it pure hacking?
	- Was is mission critical application software gone awry?
	- And so on . . . .

My questions flowed but both people either didn't know the answers or wouldn't 
talk. With both of them, there was a clear discomfort as I pushed and prodded 
for more details. Despite having so many questions still unanswered, I do feel 
fortunate to have found at least two people who were willing to support at least 
aspects of the Times' story.

One of the two banking people in Basel went even  further with detail. He/she 
says the actual dollar figure extorted in these four cases using the software 
techniques, was L63 Million (UK), which is just about US$100 Million. According 
to him/her, a lot of meetings have been taking place amongst the banks and 
financial institutions to deal with the situation but they have agreed and thus 
made a conscious effort to avoid government and law enforcement.

So, no, none of this fully supports the Times' story, but it does support 
aspects of it, and aspects of the rumors and stories I've been hearing since 
April of 1994. No HERF Guns, although another of my contacts who will not let me 
use much of his/her information yet, swears that the software attack stories are 
merely obfuscating the higher technology methods.

I certainly don't know all of the facts, but as more people come forward with 
bits and pieces we may be able to siphon through the maelstrom of noise and 
rumor and find out what's really been going on.

Back at you as soon as I have something more.
Winn


Peace
Winn

		        Winn Schwartau - Interpact, Inc.
		        Information Warfare and InfoSec
		       V: 813.393.6600 / F: 813.393.6361
			    Winn at InfoWar.Com






From hfinney at shell.portal.com  Tue Jun 25 14:40:28 1996
From: hfinney at shell.portal.com (Hal)
Date: Wed, 26 Jun 1996 05:40:28 +0800
Subject: AT&T bans anonymous messages
In-Reply-To: <31CEC5B3.7C19@worldnet.att.net>
Message-ID: <199606251435.HAA05846@jobe.shell.portal.com>


WorldNet User <anonymous-user at worldnet.att.net> writes:
>>From the "AT&T WorldNet Service Operating Policies":
>		(i) Members may not post or transmit any message
>		anonymously or under a false name. Members may
>		not permit any other person (other than an agent
>		acting on Member's behalf and subject to Member's
>		supervision) to access the Service Member's
>		account for any purpose.

(I can't get through to http://www.worldnet.att.net this morning.  Makes
me appreciate that dial tone I get every day.)

Is the WorldNet service an Internet access account, providing dial-in
SLIP or PPP access?  Or does it also provide user accounts like shell
accounts or like AOL?

The wording of this restriction is a bit ambiguous.  Technically if I
choose to resend someone else's mail I am not transmitting it anonymously
or under a false name, especially if I make clear what I have done.
He is anonymous, not I.

Rather, if I want to post a message anonymously I must access an
anonymous remailer to do so; if I want to post under a false name I must
hack my message headers or connect to someone else's news or mail server
and supply false data.

Doing the latter is something of a violation of the Internet rules, such
as they are, so I could see forbidding it, but forbidding use of an
anonymous remailer on someone else's system seems unreasonable.  AT&T
should not try to control what Internet services I access.

If I run an anonymous remailer on my home PC, connecting to WorldNet to
download the mail, decrypt it, scramble it, and re-send it under my name
but with a disclaimer attached telling what I have done, I have not
posted or transmitted anything anonymously or under a false name.  The
source of the material I choose to transmit, as long as it is legal, is
not something under AT&T's control.

Hal





From chris.liljenstolpe at SSDS.com  Tue Jun 25 15:02:37 1996
From: chris.liljenstolpe at SSDS.com (Christopher Liljenstolpe)
Date: Wed, 26 Jun 1996 06:02:37 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606242105.OAA00824@netcom13.netcom.com>
Message-ID: <31cffb3e.3418543@denver.ssds.com>


Greetings,

	Actually, it has been InterNIC policy (for better or worse) to
do this since they talked about charging.  The fee structure is:

1) New registrations cost $100 for two years
2) Renewals cost $50 for one year

Anyone could put in a record for a dead domain in their nameserver, if
they wanted to, the InterNIC can't tell you what you can and can't do
(nor will they), however:
1) It would only benefit you and the people who use your nameserver
for their resolver
2) If the InterNIC re-issued that name to another entity, you would
not be able to access that entity
3) You would be breaking the hierarchical nature of the DNS space

The InterNIC feeds all of the root name servers for the 5 common (US)
TLD's.

There has been a large amount of talk about alternative root name
spaces.

My guess is that you will never see a free one however, as equipment
has to be bought and maintained, staff hired (I don't want my root
name space managed by someone who is only available on weekends or
evenings - I don't know about anybody else), space provided, net links
funded, etc.  This is what the InterNIC is supposedly spending the
money on (as well as trying to limit the explosion of TLD registries).

	-=Chris

On Mon, 24 Jun 96 14:05:57 -0700, the sage "Vladimir Z. Nuri"
<vznuri at netcom.com> scribed:

>
>surprising not to see any discussion on this here..
>
>this is a very intersting development. all kinds of news reports
>are talking about the internic zapping 25,000 DNS addresses.
>I wonder how this will turn out.
>
>I saw in an article a claim, I think, that the internic now charges
>$100 "rent" per year for a domain. this is really amazing to me,
>because this has totally changed from a one-time only fee, if correct.
>is that correct?
>
>I wonder if people are going to try to find a way to "route around"
>this action by the internic... one wonders if this is just the first
>in a series of actions by the new spook owners. (SAIC)  essentially,
>if someone wanted to implement a tax or a way to control the internet,
>the NIC would be an excellent place to start.
>
>I wonder if the NIC has legal authority to yank DNS address like
>they are doing. it seems one could take them to court and have
>a pretty good argument that people who run DNS servers are free
>to run them however they want, and that ultimately this is what
>determines how routing on the internet is supported, not some
>overseeing agency like the NIC.
>
>it seems to me that now would be a brilliant time for someone
>to introduce a "non NIC registration service" that sets up an
>alternate DNS that guarantees that members will never be charged
>money. of course that's what the DNS "sort of" started out as...
>
>sigh.
>
>
>Subject: Internic removing Domain names
>
>The news media is anouncing that the Internic will delete 25,000 domain 
>names that have not paid their registration fees Monday.  How will this 
>work?  If someone is using one of these Domains and has DNS entries to 
>find them what can the Internic do to disable the Domain? Won't the 
>existing DNS services keep them working?
>
>Glenn York
>
>


--
   ( (   | (               Chris Liljenstolpe <Chris.Liljenstolpe at ssds.com>
    ) ) (|  ), inc.        SSDS, Inc; 8400 Normandale Lake Blvd.; Suite 993
   business driven         Bloomington, MN   55437; 
 technology solutions      TEL 612.921.2392  FAX 612.921.2395   Fram Fram Free!
 PGP Key 1024/E8546BD5     FE 43 BD A6 3C 13 6C DB  89 B3 E4 A1 BF 6D 2A A9





From geeman at best.com  Tue Jun 25 15:09:06 1996
From: geeman at best.com (geeman at best.com)
Date: Wed, 26 Jun 1996 06:09:06 +0800
Subject: AT&T bans anonymous messages
Message-ID: <01BB626F.7D26B040@geeman.vip.best.com>



fortunately there's still such a ting as freedom of choice: use another ISP.  There's no reason why ATT can't forbid anything they want on their service.

The problem is: what happens if there is no longer freedom of choice of ISP ... and: how is ATT going to KNOW WHO SENT WHAT anonymously ... aye, there's the insidious part of it ....
----------
From: 	WorldNet User[SMTP:anonymous-user at worldnet.att.net]
Sent: 	Monday, June 24, 1996 9:43 AM
To: 	cypherpunks at toad.com
Subject: 	AT&T bans anonymous messages

AT&T WorldNet service has banned the sending of anonymous email or
posting anonymously.

>From the "AT&T WorldNet Service Operating Policies":

		(i) Members may not post or transmit any message
		anonymously or under a false name. Members may
		not permit any other person (other than an agent
		acting on Member's behalf and subject to Member's
		supervision) to access the Service Member's
		account for any purpose.

The no anon rule even beat the no indecency rule, which is second:

		(ii) Members may not post or transmit any message
                which is libelous, defamatory or which discloses
                private or personal matters concerning any person.
                Members may not post or transmit any message,
                data, image or program which is indecent, obscene
                or pornographic. 

http://www.worldnet.att.net/care/terms/#oppol








From jamesd at echeque.com  Tue Jun 25 15:16:42 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Wed, 26 Jun 1996 06:16:42 +0800
Subject: Noise: Re: Those Evil Republicans
Message-ID: <199606251523.IAA04107@dns2.noc.best.net>


At 04:58 PM 6/24/96 -0400, hallam at Etna.ai.mit.edu wrote:
> Remember why FDR invented deposit insurance? The worst depression in modern 
> history was caused by the lack of deposit insurance. 

By an interesting coincidence the the worst depression in modern history
happened
shortly after governments around the world took control of currency issue, so
that banknotes became government notes.

Just as the worst famine in modern Russian history happened shortly after the
government collectivized the peasants.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From lzirko at c2.org  Tue Jun 25 15:51:09 1996
From: lzirko at c2.org (Lou Zirko)
Date: Wed, 26 Jun 1996 06:51:09 +0800
Subject: domain name zapping threat by Internic
Message-ID: <199606251505.IAA22490@infinity.c2.org>


-----BEGIN PGP SIGNED MESSAGE-----

To: shifter at portal.stwing.upenn.edu, vznuri at netcom.com,
 cypherpunks at toad.com
Date: Tue Jun 25 10:05:06 1996
The policy implemented about 10 months ago was for a $100 fee to register 
new domain names.  This was good for two years.  Current domain holders 
were to be billed $50 each year to maintain their domain names.  The 
billings for the current domain name holders are now just beginning to be 
sent.


> > I saw in an article a claim, I think, that the internic now charges
> > $100 "rent" per year for a domain. this is really amazing to me,
> > because this has totally changed from a one-time only fee, if
>  correct.
> > is that correct?
> 
> There was never a "one-time" fee.  You could register as many domains
>  as
> you wanted whenever you wanted (as long as you weren't violating a 
> trademark or something like that).  Usually people with domains would
>  run 
> into charges because they needed someone else (usually an ISP) to run
> authoritative nameservers for their domain.
> 
> > 
> > I wonder if people are going to try to find a way to "route around"
> > this action by the internic... one wonders if this is just the first
> > in a series of actions by the new spook owners. (SAIC)  essentially,
> > if someone wanted to implement a tax or a way to control the internet,
> > the NIC would be an excellent place to start.
> > 
> > I wonder if the NIC has legal authority to yank DNS address like
> > they are doing. it seems one could take them to court and have
> > a pretty good argument that people who run DNS servers are free
> > to run them however they want, and that ultimately this is what
> > determines how routing on the internet is supported, not some
> > overseeing agency like the NIC.
> 
> Nothing stops anyone from running their own name server.  However, the
>  root
> servers are what 99% of the nameservers out there point at.  No one is
>  going
> to use dns.joe.schmoe.org as their primary nameserver.
> 
> 
> > 
> > it seems to me that now would be a brilliant time for someone
> > to introduce a "non NIC registration service" that sets up an
> > alternate DNS that guarantees that members will never be charged
> > money. of course that's what the DNS "sort of" started out as...
> 
> And then there could be competition, which could potentially create
>  some
> bad scenarios.  What if one registration service refused to propagate
>  their
> domains to other registration services?
> 
> -- 
> 
> Shifter
> shifter at portal.stwing.upenn.edu
> 
> 

Lou Zirko                                (502)383-2175
Zystems                                  lzirko at c2.org
"We're all bozos on this bus" - Nick Danger, Third Eye

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: latin1

iQEVAwUBMdAATctPRTNbb5z9AQFEBwf/choEdkykN2+DGEBWGAUsD2uuk++cWqff
v2Kc9Kks7PmihspD7iq5X0l64a5ly2oYGk6aG/dKIr+rHnc+G3Nsd/LeczdTwfku
7iRLjWFNzq720m/XSkia4ho03+jFd090azKKqJb4w5sIu3n3xVSJRLczO8ofIsZg
gsk9QjcGfA2ZJlcIsgi4NMyaGSTtM7rdGfNafQ7CXFBfjlOlv+wfe/7Kpz/dLZZD
Ex7TS8Fgr2CA515F+6e3CkROKesn0EXLn087WTkwbNIWsreaJy4EPJxOXbz+KDN+
SuRfvKpQNSgHC0Q+m6JAuZnxLZcU1lZNSe7+DItAz7k0gwzgJVx80Q==
=W4NF
-----END PGP SIGNATURE-----






From chris.liljenstolpe at SSDS.com  Tue Jun 25 16:32:47 1996
From: chris.liljenstolpe at SSDS.com (Christopher Liljenstolpe)
Date: Wed, 26 Jun 1996 07:32:47 +0800
Subject: I am looking to hire a crypto person....
In-Reply-To: <v03007401adf5a5188a3b@[204.246.66.57]>
Message-ID: <31d01950.11117525@denver.ssds.com>


Greetings,

	I did not realize that you were in the Minneapolis Area.  I
am, technically, but am on the road about 98% of the time as the chief
security engineer for SSDS, a integration house.

	Your offer sounds somewhat interesting, especially since I
would not have to relocate.  In either case, are you aware of any
INFOSEC related groups that meet in the Minneapolis area?  If not, do
you think that there would be enough interest to support one?

	-=Chris

On Tue, 25 Jun 1996 09:17:43 -0500, the sage Bruce Schneier
<schneier at counterpane.com> scribed:

>I am looking to hire someone part-time (with potential to upgrade to
>full-time) to work for Counterpane Systems, doing cryptography consulting
>for a variety of clients.
>
>The work is in analysis and design, mostly of cryptographic and security
>systems.  Think of SSL, SPKI, PGP... that sort of thing.  There isn't a
>whole lot of math, just critical thinking, complete analysis, and good
>writing.
>
>If anyone is interested, please send me mail.  (Depending on the number of
>responses received, I may have some kind of application test.)
>
>Bruce
>
>************************************************************************
>* Bruce Schneier            2,000,000,000,000,000,000,000,000,002,000,
>* Counterpane Systems       000,000,000,000,000,000,002,000,000,002,293
>* schneier at counterpane.com  The last prime number...alphabetically!
>* (612) 823-1098            Two vigintillion, two undecillion, two
>* 101 E Minnehaha Pkwy      trillion, two thousand, two hundred and
>* Minneapolis, MN  55419    ninety three.
>************************************************************************
>
>
>


--
   ( (   | (               Chris Liljenstolpe <Chris.Liljenstolpe at ssds.com>
    ) ) (|  ), inc.        SSDS, Inc; 8400 Normandale Lake Blvd.; Suite 993
   business driven         Bloomington, MN   55437; 
 technology solutions      TEL 612.921.2392  FAX 612.921.2395   Fram Fram Free!
 PGP Key 1024/E8546BD5     FE 43 BD A6 3C 13 6C DB  89 B3 E4 A1 BF 6D 2A A9





From steve at miranova.com  Tue Jun 25 16:32:58 1996
From: steve at miranova.com (Steven L Baur)
Date: Wed, 26 Jun 1996 07:32:58 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606242105.OAA00824@netcom13.netcom.com>
Message-ID: <m2688fom8i.fsf@deanna.miranova.com>


>>>>> "Vladimir" == Vladimir Z Nuri <vznuri at netcom.com> writes:

Vladimir> surprising not to see any discussion on this here..

Vladimir> this is a very intersting development. all kinds of news reports
Vladimir> are talking about the internic zapping 25,000 DNS addresses.
Vladimir> I wonder how this will turn out.

Vladimir> I saw in an article a claim, I think, that the internic now
Vladimir> charges $100 "rent" per year for a domain. this is really
Vladimir> amazing to me, because this has totally changed from a
Vladimir> one-time only fee, if correct.  is that correct?

Not even close.


[ URL ftp://rs.internic.net/templates/domain-template.txt ]        [ 09/95 ]

******************* Please DO NOT REMOVE Version Number ********************

Domain Version Number: 2.0

**************** Please see attached detailed instructions *****************

******** Only for registrations under ROOT, COM, ORG, NET, EDU, GOV ********
 ...
A domain name registration fee of $100.00 US is applicable.  This charge
will cover the $50.00 maintenance fee for two (2) years.  After the two
year period, an invoice will be sent on an annual basis.


If that's not rent, what is?
-- 
steve at miranova.com baur
Unsolicited commercial e-mail will be proofread for $250/hour.
Andrea Seastrand: For your vote on the Telecom bill, I will vote for anyone
except you in November.





From tcmay at got.net  Tue Jun 25 16:37:32 1996
From: tcmay at got.net (Timothy C. May)
Date: Wed, 26 Jun 1996 07:37:32 +0800
Subject: Oil Change software snoops through hard drive
Message-ID: <adf5630101021004a745@[205.199.118.202]>


At 10:44 AM 6/24/96, Jennifer Mansfield-Jones wrote:

>I thought Alan was implying that Oil Change might be licensed by other
>software vendors, and then supplied as a "service" without warnings.
>For instance, one might purchase the NiftyKeen Win95 graphics editor,
>and find in a footnote on page 58 of the manual that the product will
>automatically update itself unless the user explicitly refuses the
>Customer Convenience Package during installation.
>
>In any case, I don't think it's a bad idea to point out the potential
>problems -- some people just don't notice these things unless the
>implications are spelled out in at least as much detail as the glowing
>marketer fluff.

I certainly agree that airing of issues is useful, and that of course there
is nothing wrong with such discussions.

There is a kind of tension on this list between two points of view, both
ostensibly "privacy-oriented":

1. There are potential privacy problems out there. We need laws to protect
people.

2. There are potential privacy problems out there. People need to protect
themselves.

This tension shows up in the debate about collection of public information
(dossiers), with folks in the #1 camp often arguing for laws restricting
the collection and dissemination of information. Folks in the #2 camp tend
to argue that public information is just that, and that information not
protected by contractual arrangements is, well, just not protected. That if
one doesn't want Fred the Retailer to know one bought a lawn chair, one
should take measures to hide this, that there should not be laws making it
illegal for Fred to make note of this purchase (as that opens all kinds of
cans of worms about inspection of records, etc.).

Anyway, I saw in Alan's remarks the beginnings of a #1 camp position, that
we may need legislation to protect consumers against the evils of Oil
Change. Maybe he did not mean this...he can clarify what he meant, of
course.

To me, Oil Change is a potentially useful service, with controllable
privacy implications. So long as it is voluntary, what's the problem?

I suppose I see many issues in the light of the dichotomy above, and I try
to speak up to make the #2 camp positions whenever I think appropriate.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From tcmay at got.net  Tue Jun 25 16:55:50 1996
From: tcmay at got.net (Timothy C. May)
Date: Wed, 26 Jun 1996 07:55:50 +0800
Subject: AT&T bans anonymous messages
Message-ID: <adf565df0202100453b8@[205.199.118.202]>


At 2:35 PM 6/25/96, Hal wrote:

>The wording of this restriction is a bit ambiguous.  Technically if I
>choose to resend someone else's mail I am not transmitting it anonymously
>or under a false name, especially if I make clear what I have done.
>He is anonymous, not I.
....
>If I run an anonymous remailer on my home PC, connecting to WorldNet to
>download the mail, decrypt it, scramble it, and re-send it under my name
>but with a disclaimer attached telling what I have done, I have not
>posted or transmitted anything anonymously or under a false name.  The
>source of the material I choose to transmit, as long as it is legal, is
>not something under AT&T's control.

I agree with Hal's points, but I suspect that these technicalities will be
ignored when the first _complaint_ reaches the DeathStar's administrators.

"Your account has been cancelled."

I suspect other major ISPs will adopt similar language, absent a vocal
lobbying group for anonymous messaging capabilities.

On the other hand, what happens to the AT&T customers who are using
anonymous message services for the "politically correct" uses? Namely, to
post messages to rape support groups, child-abuse groups (so-called
"survivors," in modern PC parlance), and homosexuality groups? Will AT&T
cancel their accounts for hiding under a veil of pseudoanonymity?

(Or just require that their identity be "escrowed"?)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From adam at homeport.org  Tue Jun 25 17:15:57 1996
From: adam at homeport.org (Adam Shostack)
Date: Wed, 26 Jun 1996 08:15:57 +0800
Subject: AT&T bans anonymous messages
In-Reply-To: <199606251435.HAA05846@jobe.shell.portal.com>
Message-ID: <199606251836.NAA14496@homeport.org>


Hal wrote:
| WorldNet User <anonymous-user at worldnet.att.net> writes:
| >>From the "AT&T WorldNet Service Operating Policies":

| (I can't get through to http://www.worldnet.att.net this morning.  Makes
| me appreciate that dial tone I get every day.)

Try http://www.att.com/worldnet/

| Is the WorldNet service an Internet access account, providing dial-in
| SLIP or PPP access?  Or does it also provide user accounts like shell
| accounts or like AOL?

	The AT&T service I'm familiar with (some contract work on the
back end) is what they call 'Internet Dial Tone,' which is to say, a
IP connection and nothing else.  Its a way to reach your home system,
or, if you can find a freindly DNS server, surf the web.  They talk
about adding other things later.

	The phrase Internet Dial tone appears on the att.com page.
How they intend to authenticate hundreds of thousands of dialup users
to prevent anonymity is beyond me.

	(Hals points on the ambiguity of the language are well taken.)

Adam



-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From wendigo at gti.net  Tue Jun 25 17:20:42 1996
From: wendigo at gti.net (Herr Wendigo)
Date: Wed, 26 Jun 1996 08:20:42 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606251353.JAA07632@portal.stwing.upenn.edu>
Message-ID: <199606251728.NAA14126@apollo.gti.net>


-----BEGIN PGP SIGNED MESSAGE-----

An entity claiming to be Shifter wrote:
: 
: Nothing stops anyone from running their own name server.  However, the root
: servers are what 99% of the nameservers out there point at.  No one is going
: to use dns.joe.schmoe.org as their primary nameserver.
: 

Except of course schmoe.org.  Primary name service is usually provided
by the organization's own nameserver.  The secondary name server should
(as per the rfc whose number I forget at the moment) be on a separate
network segment.  Anyone who lists a machine from root-servers.net as their
primary needs to learn a bit more about DNS.  Root servers exist to provide
an authoritative starting point for recursive lookups, they do not provide
name service for anything other than top level domains (com. edu. net. etc.).

The NIC has the power to remove domains based upon it's authority among 
the root servers.


- -- 
    Mark Rogaski   | Why read when you can just sit and |      Member
  GTI System Admin |         stare at things?           | Programmers Local
  wendigo at gti.net  | Any expressed opinions are my own  |     # 0xfffe
 wendigo at pobox.com | unless they can get me in trouble. |     APL-CPIO


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdAhfg0HmAyu61cJAQEWkQP7BFtGrStaG/ly+xl0T1u079tEM2loUGEk
MEDkFzOtHr9kTbab+fKrNwsG23M+PEpB6YIr3QUpfFgByf8jCthUJj7uqtZ952wz
iVnGMMgSE1xBMPKEAVqeJcpqzboHQP01URaPsHoya/ybLXtfQR0RUsydnMIOeEbc
c2f3LNaLzpM=
=oAeG
-----END PGP SIGNATURE-----






From wendigo at gti.net  Tue Jun 25 17:56:47 1996
From: wendigo at gti.net (Herr Wendigo)
Date: Wed, 26 Jun 1996 08:56:47 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606251353.JAA07632@portal.stwing.upenn.edu>
Message-ID: <199606251727.NAA14059@apollo.gti.net>


-----BEGIN PGP SIGNED MESSAGE-----

An entity claiming to be Shifter wrote:
: 
: Nothing stops anyone from running their own name server.  However, the root
: servers are what 99% of the nameservers out there point at.  No one is going
: to use dns.joe.schmoe.org as their primary nameserver.
: 

Except of course schmoe.org.  Primary name service is usually provided
by the organization's own nameserver.  The secondary name server should
(as per the rfc whose number I forget at the moment) be on a separate
network segment.  Anyone who lists a machine from root-servers.net as their
primary needs to learn a bit more about DNS.  Root servers exist to provide
an authoritative starting point for recursive lookups, they do not provide
name service for anything other than top level domains (com. edu. net. etc.).

The NIC has the power to remove domains based upon it's authority among 
the root servers.


- -- 
    Mark Rogaski   | Why read when you can just sit and |      Member
  GTI System Admin |         stare at things?           | Programmers Local
  wendigo at gti.net  | Any expressed opinions are my own  |     # 0xfffe
 wendigo at pobox.com | unless they can get me in trouble. |     APL-CPIO


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdAhfg0HmAyu61cJAQEWkQP7BFtGrStaG/ly+xl0T1u079tEM2loUGEk
MEDkFzOtHr9kTbab+fKrNwsG23M+PEpB6YIr3QUpfFgByf8jCthUJj7uqtZ952wz
iVnGMMgSE1xBMPKEAVqeJcpqzboHQP01URaPsHoya/ybLXtfQR0RUsydnMIOeEbc
c2f3LNaLzpM=
=oAeG
-----END PGP SIGNATURE-----





From mongol at netzone.com  Tue Jun 25 17:59:28 1996
From: mongol at netzone.com (mongol at netzone.com)
Date: Wed, 26 Jun 1996 08:59:28 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606242105.OAA00824@netcom13.netcom.com>
Message-ID: <31D02762.16A4@netzone.com>


Vladimir Z. Nuri wrote:
> 
> it seems to me that now would be a brilliant time for someone
> to introduce a "non NIC registration service" that sets up an
> alternate DNS that guarantees that members will never be charged
> money. of course that's what the DNS "sort of" started out as...
> 
> sigh.
> 

Hmm, correct me if I'm wrong, but isn't there already a method to bypass the NIC registration fee?  I thought 
one could use the international method for addressing.  You know, something like *.phx.az.us (for a site in 
Phoenix, Arizona, United States).  As far as I know, there isn't the fee that is charged for non location-based 
addressing.  (Although, I'd rather have a regular address)


Ben





From prz at ACM.ORG  Tue Jun 25 18:00:14 1996
From: prz at ACM.ORG (Philip Zimmermann)
Date: Wed, 26 Jun 1996 09:00:14 +0800
Subject: Zimmermann's Senate testimony
Message-ID: <199606251539.PAA01255@maalox>


Testimony of Philip R. Zimmermann to
the Subcommittee on Science, Technology, and Space
of the US Senate Committee on Commerce, Science, and 
Transportation
26 June 1996


Mr. Chairman and members of the committee, my name is Philip 
Zimmermann, and I'm Chairman and Chief Technology Officer for PGP 
Inc, a newly-formed company that provides cryptographic products.  
I'm here to talk to you today about S.1726 and the need to change 
US export control policy for cryptographic software.  I want to 
thank you for the opportunity to be here to speak in favor of this 
bill.

I'm the creator of PGP (Pretty Good Privacy), a public-key 
encryption software package for the protection of electronic mail.  
Since PGP was published domestically as freeware in June of 1991, 
it has spread organically all over the world, and has since become 
the de facto worldwide standard for encryption of E-mail, winning 
numerous industry awards along the way.  For three years I was the 
target of a criminal investigation by the US Customs Service, who 
assumed that laws were broken when PGP spread outside the US.  
That investigation was closed without indictment in January 1996.



Computers were developed in secret back in World War II mainly to 
break codes.  Ordinary people did not have access to computers, 
because they were few in number and too expensive.  Some people 
postulated that there would never be a need for more than half a 
dozen computers in the country, and assumed that ordinary people 
would never have a need for computers.  Some of the government's 
attitude toward cryptography today were formed in that period, and 
mirrors the old attitudes toward computers.  Why would ordinary 
people need to have access to good cryptography?

In addition to the limited availability of computers, another 
problem with cryptography in those days was that cryptographic 
keys had to be distributed over secure channels so that both 
parties could send encrypted traffic over insecure channels. 
Governments solved that problem by dispatching key couriers with 
satchels handcuffed to their wrists.  Governments could afford to 
send guys like these to their embassies overseas.  But the great 
masses of ordinary people would never have access to practical 
cryptography if keys had to be distributed this way.  No matter 
how cheap and powerful personal computers might someday become, 
you just can't send the keys electronically without the risk of 
interception. This widened the feasibility gap between government 
and personal access to cryptography.

Today, we live in a new world that has had two major breakthroughs 
that have an impact on this state of affairs.  The first is the 
coming of the personal computer and the information age.  The 
second breakthrough is public-key cryptography. 

With the first breakthrough comes cheap ubiquitous personal 
computers, modems, FAX machines, the Internet, E-mail, the World-
Wide Web, digital cellular phones, personal digital assistants 
(PDAs), wireless digital networks, ISDN, cable TV, and the data 
superhighway.  This information revolution is catalyzing the 
emergence of a global economy.

But this renaissance in electronic digital communication brings 
with it a disturbing erosion of our privacy.  In the past, if the 
government wanted to violate the privacy of ordinary citizens, it 
had to expend a certain amount of effort to intercept and steam 
open and read paper mail, and listen to and possibly transcribe 
spoken telephone conversation.  This is analogous to catching fish 
with a hook and a line, one fish at a time.  Fortunately for 
freedom and democracy, this kind of labor-intensive monitoring is 
not practical on a large scale.

Today, electronic mail is gradually replacing conventional paper 
mail, and is soon to be the norm for everyone, not the novelty it 
is today.  Unlike paper mail, E-mail messages are just too easy to 
intercept and scan for interesting keywords.  This can be done 
easily, routinely, automatically, and undetectably on a grand 
scale. This is analogous to driftnet fishing-- making a 
quantitative and qualitative Orwellian difference to the health of 
democracy.

The second breakthrough came in the late 1970s, with the 
mathematics of public key cryptography.  This allows people to 
communicate securely and conveniently with people they've never 
met, with no prior exchange of keys over secure channels.  No more 
special key couriers with black bags.  This, coupled with the 
trappings of the information age, means the great masses of people 
can at last use cryptography.  This new technology also provides 
digital signatures to authenticate transactions and messages, and 
allows for digital money, with all the implications that has for 
an electronic digital economy.  (See appendix)

This convergence of technology-- cheap ubiquitous PCs, modems, 
FAX, digital phones, information superhighways, et cetera-- is all 
part of the information revolution.  Encryption is just simple 
arithmetic to all this digital hardware.  All these devices will 
be using encryption.  The rest of the world uses it, and they 
laugh at the US because we are railing against nature, trying to 
stop it.  Trying to stop this is like trying to legislate the 
tides and the weather. It's like the buggy whip manufacturers 
trying to stop the cars-- even with the NSA and the FBI on their 
side, it's still impossible.  The information revolution is good 
for democracy-- good for a free market and trade. It contributed 
to the fall of the Soviet empire.  They couldn't stop it either.

Today, every off-the-shelf multimedia PC can become a secure voice 
telephone, through the use of freely available software such as 
PGPfone.  When you combine that with the strong political will 
that exists in the American people to have their privacy, it's 
going to require extreme measures to control this technology.  
What does this mean for the government's Clipper chip and key 
escrow systems?

Like every new technology, this comes at some cost.  Cars pollute 
the air and cause traffic jams.  Cryptography can help criminals 
hide their activities.  People in the law enforcement and 
intelligence communities are going to look at this only in their 
own terms.  But even with these costs, we still can't stop this 
from happening in a free market global economy.  Most people I 
talk to outside of government feel that the net result of 
providing privacy will be positive.

Law enforcement and intelligence interests in the government have 
attempted many times to suppress the availability of strong 
domestic encryption technology.  

In 1991, Senate Bill 266 included a non-binding resolution, which 
if it had become real law, would have forced manufacturers of 
secure communications equipment to insert special "trap doors" in 
their products, so that the government could read anyone's 
encrypted messages.  Before that measure was defeated, I wrote and 
released Pretty Good Privacy.  I did it because I wanted 
cryptography to be made available to the American public before it 
became illegal to use it.  I gave it away for free so that it 
would achieve wide dispersal, to inoculate the body politic.

The 1994 Digital Telephony bill mandated that phone companies 
install remote wiretapping ports into their central office digital 
switches, creating a new technology infrastructure for "point-and-
click" wiretapping, so that federal agents no longer have to go 
out and attach alligator clips to phone lines.  Now they'll be 
able to sit in their headquarters in Washington and listen in to 
your phone calls.  Of course, the law still requires a court order 
for a wiretap.  But while technology infrastructures tend to 
persist for generations, laws and policies can change overnight.  
Once a communications infrastructure optimized for surveillance 
becomes entrenched, a shift in political conditions may lead to 
abuse of this new-found power.  Political conditions may shift 
with the election of a new government, or perhaps more abruptly 
from the bombing of a Federal building.

A year after the 1994 Digital Telephony bill passed, the FBI 
disclosed plans to require the phone companies to build into their 
infrastructure the capacity to simultaneously wiretap one percent 
of all phone calls in all major US cities.  This would represent 
more than a thousandfold increase over previous levels in the 
number of phones that could be wiretapped.  In previous years, 
there were only about 1000 court-ordered wiretaps in the US per 
year, at the federal, state, and local levels combined.  It's hard 
to see how the government could even employ enough judges to sign 
enough wiretap orders to wiretap 1% of all our phone calls, much 
less hire enough federal agents to sit and listen to all that 
traffic in real time.  The only plausible way of processing that 
amount of traffic is a massive Orwellian application of automated 
voice recognition technology to sift through it all, searching for 
interesting keywords or searching for a particular speaker's 
voice.  If the government doesn't find the target in the first 1% 
sample, the wiretaps can be shifted over to a different 1% until 
the target is found, or until everyone's phone line has been 
checked for subversive traffic.  The FBI says they need this 
capacity to plan for the future.  This plan sparked such outrage 
that it was defeated in Congress, at least this time around, in 
1995.  But the mere fact that the FBI even asked for these broad 
powers is revealing of their agenda.  And the defeat of this plan 
isn't so reassuring when you consider that the 1994 Digital 
Telephony bill was also defeated the first time it was introduced, 
in 1993.  

Advances in technology will not permit the maintenance of the 
status quo, as far as privacy is concerned.  The status quo is 
unstable.  If we do nothing, new technologies will give the 
government new automatic surveillance capabilities that Stalin 
could never have dreamed of.  The only way to hold the line on 
privacy in the information age is strong cryptography.  
Cryptography strong enough to keep out major governments.

The government has a track record that does not inspire confidence 
that they will never abuse our civil liberties.  The FBI's 
COINTELPRO program targeted groups that opposed government 
policies.  They spied on the anti-war movement and the civil 
rights movement.  They wiretapped Martin Luther King's phone.  
Nixon had his enemies list.  And then there was the Watergate 
mess.  The War on Drugs has given America the world's largest per-
capita incarceration rate in the world, a distinction formerly 
held by South Africa, before we surpassed them during the eighties 
even when apartheid was in full swing.  Recently, we've seen the 
images and sounds of the Rodney King beatings, Detective Mark 
Fuhrman's tapes boasting of police abuses, and the disturbing 
events of the Ruby Ridge case.  And now Congress and the Clinton 
administration seem intent on passing laws curtailing our civil 
liberties on the Internet.  At no time in the past century has 
public distrust of the government been so broadly distributed 
across the political spectrum, as it is today.

The Clinton Administration seems to be attempting to deploy and 
entrench a communications infrastructure that would deny the 
citizenry the ability to protect its privacy.  This is unsettling 
because in a democracy, it is possible for bad people to 
occasionally get elected-- sometimes very bad people.  Normally, a 
well-functioning democracy has ways to remove these people from 
power.  But the wrong technology infrastructure could allow such a 
future government to watch every move anyone makes to oppose it.  
It could very well be the last government we ever elect.

When making public policy decisions about new technologies for the 
government, I think one should ask oneself which technologies 
would best strengthen the hand of a police state.  Then, do not 
allow the government to deploy those technologies.  This is simply 
a matter of good civic hygiene.



In addition to the human rights arguments, there are technological 
reasons why the current export control regime makes no sense 
anymore.

There has been considerable debate about allowing the export of 
implementations of the full 56-bit Data Encryption Standard (DES). 
At an academic cryptography conference in 1993, Michael Wiener of 
Northern Telecom in Ottawa presented a paper on how to crack the 
DES with a special machine.  He has fully designed and tested a 
chip that guesses DES keys at high speed until it finds the right 
one.  Although he has refrained from building the real chips so 
far, he can get these chips manufactured for $10.50 each, and can 
build 57000 of them into a special machine for $1 million that can 
try every DES key in 7 hours, averaging a solution in 3.5 hours.  
$1 million can be hidden in the budget of many companies.  For $10 
million, it takes 21 minutes to crack, and for $100 million, just 
two minutes.  That's full 56-bit DES, cracked in just two minutes.  
I'm sure the NSA can do it in seconds, with their budget.  This 
means that DES is now effectively dead for purposes of serious 
data security applications. If Congress acts now to enable the 
export of full DES products, it will be a day late and a dollar 
short.

Knowledge of cryptography is becoming so widespread, that export 
controls are no longer effective at controlling the spread of this 
technology.  People everywhere can and do write good cryptographic 
software, and we import it here but cannot export it, to the 
detriment of our indigenous software industry.

I wrote PGP from information in the open literature, putting it 
into a convenient package that everyone can use in a desktop or 
palmtop computer.  Then I gave it away for free, for the good of 
democracy.  This could have popped up anywhere, and spread.  Other 
people could have and would have done it.  And are doing it.  
Again and again.  All over the planet.  This technology belongs to 
everybody.


PGP has spread like a prairie fire, fanned by countless people who 
fervently want their privacy restored in the information age.

Today, human rights organizations are using PGP to protect their 
people overseas.  Amnesty International uses it.  The human rights 
group in the American Association for the Advancement of Science 
uses it.  It is used to protect witnesses who report human rights 
abuses in the Balkans, in Burma, in Guatemala, in Tibet.

Some Americans don't understand why I should be this concerned 
about the power of government.  But talking to people in Eastern 
Europe, you don't have to explain it to them.  They already get 
it-- and they don't understand why we don't.

I want to read you a quote from some E-mail I got in October 1993 
from someone in Latvia, on the day that Boris Yeltsin was shelling 
his Parliament building:  

"Phil I wish you to know: let it never be, but if 
dictatorship takes over Russia your PGP is widespread from Baltic 
to Far East now and will help democratic people if necessary.  
Thanks."



 Appendix -- How Public-Key Cryptography Works 

In conventional cryptosystems, such as the US Federal Data 
Encryption Standard (DES), a single key is used for both 
encryption and decryption.  This means that a key must be 
initially transmitted via secure channels so that both parties 
have it before encrypted messages can be sent over insecure 
channels.  This may be inconvenient.  If you have a secure channel 
for exchanging keys, then why do you need cryptography in the 
first place?

In public key cryptosystems, everyone has two related 
complementary keys, a publicly revealed key and a secret key.  
Each key unlocks the code that the other key makes.  Knowing the 
public key does not help you deduce the corresponding secret key.  
The public key can be published and widely disseminated across a 
communications network. This protocol provides privacy without the 
need for the same kind of secure channels that a conventional 
cryptosystem requires.

Anyone can use a recipient's public key to encrypt a message to 
that person, and that recipient uses her own corresponding secret 
key to decrypt that message.  No one but the recipient can decrypt 
it, because no one else has access to that secret key.  Not even 
the person who encrypted the message can decrypt it.  

Message authentication is also provided.  The sender's own secret 
key can be used to encrypt a message, thereby "signing" it.  This 
creates a digital signature of a message, which the recipient (or 
anyone else) can check by using the sender's public key to decrypt 
it.  This proves that the sender was the true originator of the 
message, and that the message has not been subsequently altered by 
anyone else, because the sender alone possesses the secret key 
that made that signature.  Forgery of a signed message is 
infeasible, and the sender cannot later disavow his signature. 

These two processes can be combined to provide both privacy and 
authentication by first signing a message with your own secret 
key, then encrypting the signed message with the recipient's 
public key. The recipient reverses these steps by first decrypting 
the message with her own secret key, then checking the enclosed 
signature with your public key.  These steps are done 
automatically by the recipient's software.



        Philip Zimmermann
        3021 11th Street
        Boulder, Colorado 80304
        303 541-0140
        E-mail:  prz at pgp.com







From jya at pipeline.com  Tue Jun 25 18:00:29 1996
From: jya at pipeline.com (John Young)
Date: Wed, 26 Jun 1996 09:00:29 +0800
Subject: Leahy vs. Landers
Message-ID: <199606251758.RAA09092@pipe1.t1.usa.pipeline.com>


   Thanks to MF: 
 
 
   The Washington Post, June 24, 1996. 
 
 
   Dear Ann Landers: 
 
   You have recently printed letters from people whose spouses 
   have left them for people they met on the Internet. 
 
   As a 55-year-old who has been happily married for 33 years, 
   I am living proof that the vast majority of us Internet 
   fans use our computers to browse newspapers, see the 
   treasures of the Sistine Chapel, check the weather in 
   Vermont or read the latest Batman comic. I think your 
   readers should be assured that almost all Americans on-line 
   have no intention of stealing someone else's spouse or 
   leaving their own. 
 
   Just as reckless and irresponsible drivers should not ruin 
   it for drivers who act responsibly, neither should a few 
   bored Web crawlers foul up the Internet for the rest of us. 
 
   -- Sen. Patrick Leahy (D Vt.) 
 
 
   Dear Pat: 
 
   You are a superb senator. Vermont is lucky to have you. As 
   an advice columnist, however, you aren't so hot. Granted, 
   most Web crawlers are fairly decent people, but many are 
   not interested in the Sistine Chapel or Batman. The 
   Internet is tailor-made for con men, the lonely and the 
   bored. The word from here is beware. More on this subject 
   tomorrow. 
 
   [Ann's two letters today exemplify the grief and joy of 
   betrayal and love on the Net.] 
 
   Questions may be sent to: Ann Landers, c/o Creators 
   Syndicate, 5777 W. Century Blvd., Suite 700, Los Angeles, 
   Calif. 90045. 
 
 
 
 
 
 





From llurch at networking.stanford.edu  Tue Jun 25 18:22:42 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Wed, 26 Jun 1996 09:22:42 +0800
Subject: AT&T bans anonymous messages
In-Reply-To: <31CEC5B3.7C19@worldnet.att.net>
Message-ID: <Pine.GUL.3.93.960625113555.328B-100000@Networking.Stanford.EDU>


On Mon, 24 Jun 1996, WorldNet User wrote:

> AT&T WorldNet service has banned the sending of anonymous email or
> posting anonymously.
> 
> >From the "AT&T WorldNet Service Operating Policies":
> 
> 		(i) Members may not post or transmit any message
> 		anonymously or under a false name. Members may
> 		not permit any other person (other than an agent
> 		acting on Member's behalf and subject to Member's
> 		supervision) to access the Service Member's
> 		account for any purpose.

I don't have a problem with this, actually, and a brief visit to
news.admin.net-abuse.misc would show why. AT&T is selling you access under a
given username. If you send a message traceable to AT&T, they are held
accountable. I think it's reasonable for them to demand that you make
messages traceable to yourself so that you are held accountable. 

If AT&T bans or monitors access to anonymous remailers, then that's a
different kettle of fish entirely, but they're not doing that. The policy
above allows you to send a message to an anonymous remailer under your own
name.

> The no anon rule even beat the no indecency rule, which is second:

I disagree. The below is outrageous.

> 		(ii) Members may not post or transmit any message
>                 which is libelous, defamatory or which discloses
>                 private or personal matters concerning any person.
>                 Members may not post or transmit any message,
>                 data, image or program which is indecent, obscene
>                 or pornographic. 
> 
> http://www.worldnet.att.net/care/terms/#oppol

"Discloses private or personal matters concerning any person"? I guess any
discussion of political figures is out.

-rich
 http://www.c2.org/~rich/






From jya at pipeline.com  Tue Jun 25 18:26:03 1996
From: jya at pipeline.com (John Young)
Date: Wed, 26 Jun 1996 09:26:03 +0800
Subject: domain name zapping threat by Internic
Message-ID: <199606251834.SAA11158@pipe5.t1.usa.pipeline.com>


   The Washington Post, June 25, 1996. 
 
 
   Domain Delinquents Get Day's Reprieve 
 
      Firm Delays Suspension of Internet Service to Process 
      Flood of Fees 
 
   By David S. Hilzenrath 
 
 
   The Herndon company that assigns the basic addresses on the 
   Internet said yesterday it would delay until this evening 
   a plan to cut off the service of address holders who 
   haven't paid the required fees. 
 
   Network Solutions Inc., which registers addresses under an 
   arrangement with the federal government, had planned to cut 
   off the delinquents yesterday, but postponed the action as 
   it processed a flood of last-minute payments. 
 
   The cutoffs involve about 10,000 of 400,000 "domain" names 
   -- the portion of the Internet address that follows the "@" 
   symbol -- whose holders have not paid Network Solutions a 
   $100 registration fee. 
 
   Network Solutions spokesman David Gravff said the company 
   would suspend service for those domain holders that had not 
   paid by 5 p.m. on Sunday. The service of those who pay 
   between that time and tonight will be suspended, but the 
   company will soon reinstate it. The cutoff involves domain 
   holders that registered their addresses between Sept. 14, 
   when Network Solutions began charging new users, and Feb. 
   28. 
 
   Domain names may be held by companies, universities, 
   individuals, government agencies or other organizations, 
   and a single domain name might be used by many people. 
   People using domain names that are suspended would not be 
   able to receive electronic mail. Similarly, people would 
   not be able to connect to World Wide Web sites using 
   suspended domains. 
 
   The company two weeks ago estimated that 25,000 domain 
   names would be suspended, but it reduced the total as 
   last-minute payments arrived. 
 
   The company will wait 60 days before reissuing the 
   suspended domain names to new users, giving delinquent 
   users another chance to pay and reclaim them, Graves said. 
 
   ----- 
 
   For More Information: Is your domain name available? Find 
   out by visiting The Post's site on the World Wide Web at: 
   http://www.washingtonpost.com 
 
   [End] 
 
 
 
 
 
 
 
 
 
 
 





From chris.liljenstolpe at SSDS.com  Tue Jun 25 19:48:24 1996
From: chris.liljenstolpe at SSDS.com (Christopher Liljenstolpe)
Date: Wed, 26 Jun 1996 10:48:24 +0800
Subject: Appology
Message-ID: <31d056c0.9637303@denver.ssds.com>


Greetings,

	I appologize for copying the whole list on my letter to Bruce.
I just changed mailers and the meaning of r and R have been reversed
:(

	-=Chris


--
   ( (   | (               Chris Liljenstolpe <Chris.Liljenstolpe at ssds.com>
    ) ) (|  ), inc.        SSDS, Inc; 8400 Normandale Lake Blvd.; Suite 993
   business driven         Bloomington, MN   55437; 
 technology solutions      TEL 612.921.2392  FAX 612.921.2395   Fram Fram Free!
 PGP Key 1024/E8546BD5     FE 43 BD A6 3C 13 6C DB  89 B3 E4 A1 BF 6D 2A A9





From trei at process.com  Tue Jun 25 19:48:56 1996
From: trei at process.com (Peter Trei)
Date: Wed, 26 Jun 1996 10:48:56 +0800
Subject: Tales from the UK: Basel Part IV
Message-ID: <199606251952.MAA13356@toad.com>


> Received: from toad.com [140.174.2.1] by alcor.process.com
>            with SMTP-OpenVMS via TCP/IP; Tue, 25 Jun 1996 11:11 -0400
> Received: (from majordom at localhost) by toad.com (8.7.5/8.7.3) id HAA10621 for cypherpunks-outgoing; Tue, 25 Jun 1996 07:04:53 -0700 (PDT)
> Received: from mailhost.IntNet.net (mercury.IntNet.net [198.252.32.180]) by toad.com (8.7.5/8.7.3) with SMTP id HAA10616 for <cypherpunks at toad.com>; Tue, 25 Jun 1996 07:04:46 -0700 (PDT)
> From: winn at Infowar.Com
> Received: from 198.252.40.157 by mailhost.IntNet.net (SMI-8.6/SMI-SVR4)
> 	id KAA24757; Tue, 25 Jun 1996 10:06:02 -0400
> Date: Tue, 25 Jun 1996 10:06:02 -0400
> Message-Id: <199606251406.KAA24757 at mailhost.IntNet.net>
> MIME-Version: 1.0
> Content-Type: text/plain
> Content-Transfer-Encoding: 7bit
> Subject: Tales from the UK: Basel Part IV
> To: Nmunro at access.digex.net
> X-Mailer: SPRY Mail Version: 04.00.06.17
> Sender: owner-cypherpunks at toad.com
> Precedence: bulk
> 
> June, 1996: Basel, Switzerland
> More on the London Attacks: Part IV

winn writes:

[...]
> The perpetrator(s) would first place a call to the upper management of the 
> intended victim announcing his/her intention. "We will take down your bank (or 
> financial organization) unless you pay us a lot of money not to." 
> 
> The intended victims each sluffed off the threats. Shortly thereafter (within a 
> day or two) their financial systems would seemingly collapse for no reason at 
> the prescribed time and as promised by the caller. Banking services and/or 
> trading would come to a halt, for about an hour or so, and then the affected 
> systems would come back on line. Backups were ineffective; typical disaster 
> recovery methods, I was told, just didn't work.
[...]
> I was told unequivocally that all of the four attacks used the same methodology: 
> malicious software was somehow injected into the systems but neither was either 
> forthcoming or knowledgeable about the specifics. They specifically denied that 
> HERF techniques were used. But many questions remained, and I was unsuccessful 
> at getting what I would call good answers to these and more queries:
> 
> 	- Which systems were affected exactly?
> 	- How were the backup/redundancies disconnected?
> 	- Exactly what do you mean by remote control?
> 	- Did you ever find the offending software?
> 	- Was it an insider job?
> 	- Was it pure hacking?
> 	- Was is mission critical application software gone awry?
> 	- And so on . . . .
[...] 
> 		        Winn Schwartau - Interpact, Inc.
> 		        Information Warfare and InfoSec
> 		       V: 813.393.6600 / F: 813.393.6361
> 			    Winn at InfoWar.Com

I used to work in a major money center bank (late, lamented Irving Trust). I find this
account highly improbable, considering the precautions I've seen used in these
situations.

The only possibility seems to be an inside job, inserting a logic bomb into some
crucial piece of software, and then setting it off either through an inside collaborator,
or by sending an appropriate message through the system from outside: "if you
see a transfer from acct 346769 to 56789 of $3,141,592.65, shut down for an
hour".

Inserting a bomb like this would have been extremely difficult, if not impossible, at IT.
Code modifications were always checked by more than one programmer, and an
extensive 'backout' mechanism existed which permitted us to go back to older versions
of the software in a matter of minutes.

Cracking the system from outside is also unlikely - the operational machines had
no internet connection, dial in, or connection to our development or administrative
lans, nor did they run any of the usual demons 
through which attacks are made. They were connected only to other parts of the
operational system. Even the developers did not have direct access to them - 
putting on new software involved writing it to a removable HD which was then 
physically transfered to the operational systems. Only the operators were permitted
to touch the consoles of the operational systems.

Finally, we maintained a 'hot site' duplicating most of our capability, at a location
about 100 miles away, in case of catastrophe. Switching to that would have taken
a few hours, but was certainly doable.

>Thereafter, a second call would be made to senior executives of the victim
>firms, and the extortion demands for payment made again. In these cases,
>electronic payments to Switzerland were made, and the monies were then
>secreted from their temporary Swiss home within seconds - destined for
>places unknown or unannounced.

I also find the claim improbable - the Swiss authorities are quite cooperative when
there is good reason to beleive a crime is being committed.

If it's an inside job, then it's not much of a threat, since each financial institution
would need to be penetrated separately. 

The only way in which this might NOT be an inside job would be if a logic bomb
was inserted into some piece of commercial software used by all of the targets,
such as a message database. If so, then there is no reason not to identify the
package.

Until names get named, I'm going to view this story with extreme skepticism.


Finally, people may wish to look at the source of the posting. Mr Schwartau
is a consultant who makes his living by advising institutions on how to protect
themselves against attacks of the type claimed in this story. 

Peter Trei
Senior Software Engineer
Purveyor Development Team                                
Process Software Corporation
http://www.process.com
trei at process.com





From frantz at netcom.com  Tue Jun 25 19:55:48 1996
From: frantz at netcom.com (Bill Frantz)
Date: Wed, 26 Jun 1996 10:55:48 +0800
Subject: AT&T bans anonymous messages
Message-ID: <199606252053.NAA11417@netcom7.netcom.com>


At 11:46 AM 6/25/96 -0700, Rich Graves wrote:
>On Mon, 24 Jun 1996, WorldNet User wrote:
>>               (ii) Members may not post or transmit any message
>>                 which is libelous, defamatory or which discloses
>>                 private or personal matters concerning any person.
>>                 Members may not post or transmit any message,
>>                 data, image or program which is indecent, obscene
>>                 or pornographic. 
>> 
>> http://www.worldnet.att.net/care/terms/#oppol
>
>"Discloses private or personal matters concerning any person"? I guess any
>discussion of political figures is out.

Hell!  My email to my family is also ruled out.


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From hallc at cs.colorado.edu  Tue Jun 25 19:56:16 1996
From: hallc at cs.colorado.edu (Chris Hall)
Date: Wed, 26 Jun 1996 10:56:16 +0800
Subject: crypto '96 roommate
Message-ID: <199606252051.OAA27564@nag.cs.colorado.edu>



Hello,

    I plan to attend this years crypto '96, but I don't have a roommate
for the dorms.  It is much cheaper if you have a roommate so I was
wondering if anyone needed a roommate who was going?

    Please respond to me directly as I don't subscribe to cypherpunks
and I don't see any point in cluttering the list with this thread.  BTW,
the deadline for normal registration is July 12 and it would be nice to
register asap.

							Thanks,
							Chris Hall





From gregmi at galileo.mis.net  Tue Jun 25 20:14:37 1996
From: gregmi at galileo.mis.net (Greg Miller)
Date: Wed, 26 Jun 1996 11:14:37 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606251353.JAA07632@portal.stwing.upenn.edu>
Message-ID: <31d064a7.751384@pop.mis.net>


On Tue, 25 Jun 1996 09:53:17 -0400 (EDT), you wrote:

>And then there could be competition, which could potentially create some
>bad scenarios.  What if one registration service refused to propagate their
>domains to other registration services?

	Then no one would use them for DNS service.  Back when the NIC first
started charging for services I remember seeing a message from someone who was
going to attempt to make another root name service, but I haven't heard much
about it since.
	Since the NIC charges $100 per registration, you can bet there will be
some legislation somewhere along the line.  They must be makeing 5000-10000%
profit.



Greg Miller: Programmer/Analyst
DOS -- A user friendly version of UNIX.
gregmi at mis.net
http://grendel.ius.indiana.edu/~gmiller/





From stewarts at ix.netcom.com  Tue Jun 25 20:15:05 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 26 Jun 1996 11:15:05 +0800
Subject: domain name zapping threat by Internic
Message-ID: <199606251954.MAA13366@toad.com>


At 02:05 PM 6/24/96 -0700, Vlad wrote:
>surprising not to see any discussion on this here..
It's not particularly relevant (:-), but SAIC's position
has been discussed here....

>this is a very intersting development. all kinds of news reports
>are talking about the internic zapping 25,000 DNS addresses.
>I wonder how this will turn out.
>I saw in an article a claim, I think, that the internic now charges
>$100 "rent" per year for a domain. this is really amazing to me,
>because this has totally changed from a one-time only fee, if correct.
>is that correct?

It's not correct.  They charge $50/year (the $100 setup fee for new 
domain names gets you the first two years.)  This gets you the use of the
name plus support from the root-level domain name servers; 
it's how they're trying to fund the NIC instead of getting tax subsidies.  
Before the rent policy started, domain names weren't charged for 
(there's no such thing as a free name server...)  They did a 90-day
grandfathering, but now they're trying to de-grandfather the older names,
and you can tell when you've got to pay from whois.

The legal issues are really unclear, especially since they don't run
all the US-based root name servers, but they'll probably get away with it.
It seems appropriate that organizations calling themselves COMmercial
should pay money for the privilege :-)  They also control the
.org and .net hierarchies.  If you don't like it, you can always
get a statist address in the .us domain or some other .xx government domain,
or find someone who's got a second-level domain that will register you
(e.g. someone may decide to rent out space in .a.com ... .z.com 
cheaper than NSI, or .hardware.com, .software.com, .services.com....)
The NSF is still subsidizing .edu and .gov, and .mil runs its own nameservers.
NSI's contract runs til 1998, which is about enough time to evaluate
alternatives.  .in-addr.arpa is also still "free".

>I wonder if people are going to try to find a way to "route around"
>this action by the internic... 

There are very interesting discussions of the issues in RFC1591 and 
RFC1480.  You _could_ hang off odd places in the .US domain, like
calling yourself a technical school, distributed nationwide institute,
or a generic .GEN.st.US which is used for things like domain name parks
or statewide garden clubs.  But use of top-level domain names and creation
of new ones isn't precluded; it might be interesting if someone wanted
to form a .ALT domain with some automated first-come-first-served registration.

Or you _could_ just live in .in-addr.arpa space if you wanted....

About N years ago, Peter Honeyman started the .fun domain; don't know
if he's still got a nameserver supporting it.

>one wonders if this is just the first in a series of actions by the 
>new spook owners. (SAIC)  essentially,
>if someone wanted to implement a tax or a way to control the internet,
>the NIC would be an excellent place to start.

They may have contracts with spooky people, but it doesn't really
give them a lot of control, especially since you can always get yourself
a domain name from some friendly country like Anguilla or Lichtenstein
(a high-tech equivalent of fancy postage stamps? :-)
It's more interesting to speculate on what they can do with .in-addr.arpa.

However, because the DNS root-level servers only hand out addresses,
rather than carrying your mail, it doesn't provide much opportunity
for wiretaps or other Un-American Activity.  They could do a bit of
traffic analysis (seeing which IP addresses request info for which
domain names), but it's really sparse traffic information - they're
mainly getting requests that have filtered through other nameservers
(especially if you point your systems at some caching nameserver like 
netcom's or aol's which tells them that one of 5 million users wanted
to know the address for .suspicious.com), and caching nameservers
mean that multiple requests for the same information generally won't
hit the root servers.  The take is further reduced if suspicious
machines are third-level addresses under either privacy-protecting
second-levels (suspicious.alias.net) or large ones (suspicious.big-isp.net)
which will get the queries instead of the root servers.





#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Distract Authority!






From frissell at panix.com  Tue Jun 25 20:22:00 1996
From: frissell at panix.com (Duncan Frissell)
Date: Wed, 26 Jun 1996 11:22:00 +0800
Subject: AT&T bans anonymous messages
Message-ID: <2.2.32.19960625211952.0097c780@popserver.panix.com>


At 09:48 AM 6/25/96 -0700, Timothy C. May wrote:

>I suspect other major ISPs will adopt similar language, absent a vocal
>lobbying group for anonymous messaging capabilities.

So all you have to do is copy the whole statement, delete the offending
passages, and mail it to your ISP as a counter offer to their proposed
contract.  You can explicitly disclaim the language you don't like.  This
sets up a long and interesting negotiation process during which you can try
to get them to define what they mean by the terms.  Since they haven't
defined any of this stuff (indecency?) it's all kind of meaningless.
Businesses usually won't cut you off over a mere refusal on your part to
accept a contract.  They wait for an overt act.

Might even work in the case of someone like me who pays AT&T $2K/month or more.

Then you can get a real ISP.

I have found that if you are well-behaved in a social sense, you can get
away with all sorts of controversial stuff.  I kept firearms in my college
dorm just because I argued my RA into ignoring same (he had bows and hunting
arrows).  He knew I wasn't a psycho.

I expect that AT&T will ignore what you do unless it kicks back to them so
use them for net access but don't use them for mail.  Run your own mail
server or keep a shell account somewhere else.

DCF







From sameer at c2.org  Tue Jun 25 20:37:13 1996
From: sameer at c2.org (sameer at c2.org)
Date: Wed, 26 Jun 1996 11:37:13 +0800
Subject: AT&T bans anonymous messages
In-Reply-To: <2.2.32.19960625211952.0097c780@popserver.panix.com>
Message-ID: <199606252145.OAA03814@clotho.c2.org>


> 
> So all you have to do is copy the whole statement, delete the offending
> passages, and mail it to your ISP as a counter offer to their proposed

	Or you just sign up with C2. Less stress, less hassle, less
headaches.


-- 
Sameer Parekh					Voice:   510-986-8770
Community ConneXion, Inc.			FAX:     510-986-8777
The Internet Privacy Provider
http://www.c2.net/				sameer at c2.net





From gary at systemics.com  Tue Jun 25 20:43:49 1996
From: gary at systemics.com (Gary Howland)
Date: Wed, 26 Jun 1996 11:43:49 +0800
Subject: [Announce] New version of Systemics crypto library for Perl
Message-ID: <199606252123.XAA27992@internal-mail.systemics.com>


The Systemics Cryptix crypto library for Perl is now available for
download at http://www.systemics.com/software/

Apart from much tidying up, there have been several signigicant additions
to the library, include a Blowfish implementation, RSA encryption
(including key generation routines), CFB and CBC block cipher mode modules,
and a cryptographically secure random stream generator.

This library is not currently on CPAN, since several modules are not
in a suitable state for CPAN distribution.  However, if anyone can
rectify this, then we are happy to place them on CPAN.

Enjoy!

P.S. - PGP library on it's way soon (hopefully this weekend!)



                        CRYPTIX LIBRARY FOR PERL (V1.1)
                                       
   
     _________________________________________________________________
   
Description

   This library contains a suite of cryptographic and mathematical
   modules for Perl. Many of the more CPU intensive algorithms have been
   implemented in C as Perl extensions.
   
Features

  Perl extensions
  
   All of the following have been implemented as Perl extensions in C:

     * Crypt::Blowfish module (Blowfish implementation by A.M. Kuchling).
     * Crypt::DES module (DES implementation by Eric Young).
     * Crypt::IDEA module.
     * Crypt::MD5 module (based on an implementation by Neil Winton and
       Data Security, Inc.)
     * Crypt::SHA module (based on an implementation by Uwe Hollerbach
       and based on code from NIST and Peter C. Gutmann)
     * Math::BigInteger module (based on code from Eric Young).
       This module implements arbitrary length integers and some
       associated mathematical functions.
     * Math::PRSG - Pseudo random sequence generator
       This module implements a 160 bit LFSR for use in generating pseudo
       random sequences.
     * Math::TrulyRandom module, based on code from Don Mitchell and Matt
       Blaze (AT&T).
       This module generates "truly random" numbers, based on interrupt
       timing discrepancies.
       
Perl modules

   All of the following have been implemented in Perl:

     * Crypt::CBC module
       This module implements CBC block cipher mode.
     * Crypt::CFB module
       This module implements CFB block cipher mode.
     * Crypt::CSRandomStream module
       This module implements a cryptographically secure random stream.
       It implements the Stream::DataInput interface.
     * Crypt::DES3EDE module
       This module implements triple DES (EDE mode).
     * Crypt::HashMD5
       This module implements an MD5 hash, which derives from
       Crypt::MessageDigest.
     * Crypt::HashSHA
       This module implements an SHA hash, which derives from
       Crypt::MessageDigest.
     * Crypt::MessageDigest
       This module implements the Crypt::MessageDigest base class.
     * Crypt::RSAKey
       This module implements the RSA key base class.
     * Crypt::RSAKeyGen
       This module is used for the generation of RSA key pairs.
     * Crypt::RSAPublicKey
       This module implements an RSA public key, which derives from
       Crypt::RSAKey.
     * Crypt::RSASecretKeyPair
       This module implements an RSA public/secret key pair, which
       derives from Crypt::RSAKey.
     * Math::MPI module
       This module implements the reading and writing of Philip
       Zimmermans MPI format large integers.
     * Math::PseudoRandomStream module
       This module implements a pseudo random data stream. It implements
       the Stream::DataInput interface.
     * Math::Random module
       This module contains a collection of various random number
       routines.
     * Math::TestPrime module
       This module is used to test the primality of an instance of
       Math::BigInteger.
     * Stream::DataEncoding
     * Stream::DataInput
     * Stream::DataOutput
     * Stream::FileInput
     * Stream::FileOutput
     * Stream::Streamable
     * Stream::StringInput
     * Stream::StringOutput
       
Copyright

   This library includes (or is derived from) software developed by (and
   owned by) the following:
     * Peter C. Gutmann
     * Uwe Hollerbach &ltuh at alumni.caltech.edu>
     * A.M. Kuchling
     * Don Mitchell and Matt Blaze (AT&T)
     * NIST
     * RSA Data Security, Inc.
     * Neil Winton &ltN.Winton at axion.bt.co.uk>
     * Eric Young &lteay at mincom.oz.au>
       
   
   Other parts of the library are covered by the following licence:
   
   Copyright (c) 1995, 1996 Systemics Ltd (http://www.systemics.com/) All
   rights reserved.
   
   This library and applications are FREE FOR COMMERCIAL AND
   NON-COMMERCIAL USE as long as the following conditions are adhered to.
   
   
   Copyright remains with Systemics Ltd, and as such any Copyright
   notices in the code are not to be removed. If this code is used in a
   product, Systemics should be given attribution as the author of the
   parts used. This can be in the form of a textual message at program
   startup or in documentation (online or textual) provided with the
   package.
   
   Redistribution and use in source and binary forms, with or without
   modification, are permitted provided that the following conditions are
   met:
    1. Redistributions of source code must retain the copyright notice,
       this list of conditions and the following disclaimer.
    2. Redistributions in binary form must reproduce the above copyright
       notice, this list of conditions and the following disclaimer in
       the documentation and/or other materials provided with the
       distribution.
    3. All advertising materials mentioning features or use of this
       software must display the following acknowledgement:
       
        This product includes software developed by Systemics Ltd
                (http://www.systemics.com/)
                
   
   THIS SOFTWARE IS PROVIDED BY SYSTEMICS LTD ``AS IS'' AND ANY EXPRESS
   OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
   WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
   DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
   ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
   GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
   INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
   IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
   OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
   ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   
   The licence and distribution terms for any publically available
   version or derivative of this code cannot be changed. i.e. this code
   cannot simply be copied and put under another distribution licence
   [including the GNU Public Licence.]
   
   
     _________________________________________________________________





From jya at pipeline.com  Tue Jun 25 20:45:14 1996
From: jya at pipeline.com (John Young)
Date: Wed, 26 Jun 1996 11:45:14 +0800
Subject: Appology
Message-ID: <199606252230.WAA28672@pipe5.t1.usa.pipeline.com>


On Jun 25, 1996 21:14:56, 'chris.liljenstolpe at SSDS.com (Christopher
Liljenstolpe)' wrote: 
 
>... the meaning of r and R have been reversed 
 
 
Way it is, Chris, 
 
 
The motherfucking Best and Brightest did that to us all time in Nam,
granting us a few days to stumble around fuck-you-GIs-it-ain't-our-war
Aussieland, with a few stolen hours layover, hungover puking up poison, in
Thailand, then back to eating their Ivy League shit sandwiches. 
 
 
There it is, live with it -- or frag their pasty asses back to the stoned
age. 
 
 





From jimbell at pacifier.com  Tue Jun 25 21:01:18 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 26 Jun 1996 12:01:18 +0800
Subject: Zimmermann's Senate testimony
Message-ID: <199606252212.PAA17199@mail.pacifier.com>


At 09:39 AM 6/25/96 -0700, Philip Zimmermann wrote:
>Testimony of Philip R. Zimmermann to
>the Subcommittee on Science, Technology, and Space
>of the US Senate Committee on Commerce, Science, and 
>Transportation  26 June 1996

>The government has a track record that does not inspire confidence 
>that they will never abuse our civil liberties.  The FBI's 
>COINTELPRO program targeted groups that opposed government 
>policies.  They spied on the anti-war movement and the civil 
>rights movement.  They wiretapped Martin Luther King's phone.  
>Nixon had his enemies list.  And then there was the Watergate 
>mess.  The War on Drugs has given America the world's largest per-
>capita incarceration rate in the world, a distinction formerly 
>held by South Africa, before we surpassed them during the eighties 
>even when apartheid was in full swing.  Recently, we've seen the 
>images and sounds of the Rodney King beatings, Detective Mark 
>Fuhrman's tapes boasting of police abuses, and the disturbing 
>events of the Ruby Ridge case.  And now Congress and the Clinton 
>administration seem intent on passing laws curtailing our civil 
>liberties on the Internet.  At no time in the past century has 
>public distrust of the government been so broadly distributed 
>across the political spectrum, as it is today.
>
>The Clinton Administration seems to be attempting to deploy and 
>entrench a communications infrastructure that would deny the 
>citizenry the ability to protect its privacy.  This is unsettling 
>because in a democracy, it is possible for bad people to 
>occasionally get elected-- sometimes very bad people.  Normally, a 
>well-functioning democracy has ways to remove these people from 
>power.  But the wrong technology infrastructure could allow such a 
>future government to watch every move anyone makes to oppose it.  
>It could very well be the last government we ever elect.

Yes, the situation is bad, very bad.  And yes, I agree that a political 
system has to have ways to remove bad people.  The odd thing is, some of the people 
who say that are the same ones who get squeamish when a solution is suggested.

<sigh>


Jim Bell
jimbell at pacifier.com





From jyacc!aspen!bdodds at uunet.uu.net  Tue Jun 25 21:25:09 1996
From: jyacc!aspen!bdodds at uunet.uu.net (brian dodds)
Date: Wed, 26 Jun 1996 12:25:09 +0800
Subject: domain names / f-secure..
In-Reply-To: <199606251353.JAA07632@portal.stwing.upenn.edu>
Message-ID: <Pine.SUN.3.91.960625163742.16177G-100000@aspen>


On Tue, 25 Jun 1996, Shifter wrote:

> There was never a "one-time" fee.  You could register as many domains as
> you wanted whenever you wanted (as long as you weren't violating a 
> trademark or something like that).  

even that was questionable, there were a rash of copyright infringements 
a couple of years ago.. the legal holders of the names that were taken 
had to go to great lengths to get the name, and sometimes could not.. i'm 
sure you've heard of the toys-r-us vs. roadkill-r-us domain dispute, and 
how microsoft.com finally `persuaded' micros0ft.com to give it up..

at any rate - has anyone tried out that new f-secure by the folks who 
brought us f-prot? "military strength internet encryption".. seems to be 
an encrypted telnet, but i can't replace our server to test it..

				bri..

--bdodds at jyacc.com
brian dodds, systems administration, jyacc, inc. wellesley, ma 
--617.431.7431x125
opinions expressed within are not necessarily my own or anyone elses..





From jimbell at pacifier.com  Tue Jun 25 21:31:09 1996
From: jimbell at pacifier.com (jim bell)
Date: Wed, 26 Jun 1996 12:31:09 +0800
Subject: AT&T bans anonymous messages
Message-ID: <199606252212.PAA17195@mail.pacifier.com>


At 11:46 AM 6/25/96 -0700, Rich Graves wrote:
>On Mon, 24 Jun 1996, WorldNet User wrote:
>
>> AT&T WorldNet service has banned the sending of anonymous email or
>> posting anonymously.
>> 
>> >From the "AT&T WorldNet Service Operating Policies":
>> 
>> 		(i) Members may not post or transmit any message
>> 		anonymously or under a false name. Members may
>> 		not permit any other person (other than an agent
>> 		acting on Member's behalf and subject to Member's
>> 		supervision) to access the Service Member's
>> 		account for any purpose.
>
>I don't have a problem with this, actually, and a brief visit to
>news.admin.net-abuse.misc would show why. AT&T is selling you access under a
>given username. If you send a message traceable to AT&T, they are held
>accountable. 

Why should this be true?  I can still walk to a pay telephone, put in a 
quarter, dial a random number and talk to somebody anonymously.  The various 
Baby Bell companies aren't "held accountable" if it's an obscene phone call.

I think that any attempt to hold the Internet to standards higher than 
existing services is a mistake.

>I think it's reasonable for them to demand that you make
>messages traceable to yourself so that you are held accountable. 

Isn't the whole purpose of anonymity (remailers and such) in order to ensure 
that the messages AREN'T traceable?!?


>If AT&T bans or monitors access to anonymous remailers, then that's a
>different kettle of fish entirely, but they're not doing that. 

Yet.


Jim Bell
jimbell at pacifier.com





From AwakenToMe at aol.com  Tue Jun 25 23:33:53 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Wed, 26 Jun 1996 14:33:53 +0800
Subject: AT&T bans anonymous messages
Message-ID: <960625203335_339565441@emout09.mail.aol.com>


How on earth can a service try to stop anonymous dealings. Well.. i can see
HOW... because they say their just going to do it. Now.. I know theres such
things as the internet task force....etc... Isnt there any groups out there
whose _SOLE_ purpose is trying to protect rights in the online community?






From AwakenToMe at aol.com  Wed Jun 26 00:08:28 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Wed, 26 Jun 1996 15:08:28 +0800
Subject: AT&T bans anonymous messages
Message-ID: <960625214547_339643612@emout17.mail.aol.com>



>	(ii) Members may not post or transmit any message
>>                 which is libelous, defamatory or which discloses
>>                 private or personal matters concerning any person.
>>                 Members may not post or transmit any message,
>>                 data, image or program which is indecent, obscene
>>                 or pornographic. 

political figures..yep....out.
the most recent Oj or whoever joke...out
ANY ethnic joke...out. IE yo mam's so black she went to nightschool and they
marked her absent..... OUT
This cr*p is so unlimited as to what rights of ours it overruns on.
Imagine this: a message posted appeals to 34,000 people that read it.
1 person is offended..complains..
Same thing happens again. The person's user access is cancelled.
BS? You decide. My opinion is evident =-}






From lharrison at mhv.net  Wed Jun 26 00:13:29 1996
From: lharrison at mhv.net (Lynne L. Harrison)
Date: Wed, 26 Jun 1996 15:13:29 +0800
Subject: domain name zapping threat by Internic
Message-ID: <9606260152.AA24057@mhv.net>


At 10:21 PM 6/25/96 GMT, Greg Miller wrote:
>
>	Since the NIC charges $100 per registration, you can bet there will be
>some legislation somewhere along the line.  They must be makeing 5000-10000%
>profit.

  Regarding NIC's policy concerning the taking away of domain names if X
states Y usurped his trademark, there are at least 4 suits pending wherein
the domain name owners/plaintiffs are challenging the alleged infringement,
namely:

First lawsuit - Roadrunner v. NSI
background at: http://www.patents.com/nsi.sht
complaint at: http://www.patents.com/nsicpt1.sht

Second lawsuit - DCI v. DCI and NSI
background at: http://www.patents.com/dci/dci.sht
complaint at: 
http://infolawalert.com/source/src061496_dc_complaint.html

Third lawsuit - Giacalone v. NSI et al.
complaint at: http://zeus.bna.com/e-law/cases/giac.html

Fourth lawsuit - Clue Computing v. NSI
background at:  http://www.clue.com/legal/index.html
complaint at:  http://www.clue.com/legal/complain.html

Fun and games....

Regards -
Lynne




*************************************************************
Lynne L. Harrison, Esq.      |     "The key to life:
Poughkeepsie, New York       |      - Get up;
lharrison at mhv.net            |      - Survive;
http://www.dueprocess.com    |      - Go to bed."
*************************************************************

DISCLAIMER:  I am not your attorney; you are not my client.
             Accordingly, the above is *NOT* legal advice.







From exalt at miworld.net  Wed Jun 26 00:58:39 1996
From: exalt at miworld.net (Intense)
Date: Wed, 26 Jun 1996 15:58:39 +0800
Subject: AT&T bans anonymous messages
In-Reply-To: <Pine.GUL.3.93.960625113555.328B-100000@Networking.Stanford.EDU>
Message-ID: <Pine.LNX.3.91.960625230149.659A-100000@invictor.miworld.net>


On Tue, 25 Jun 1996, Rich Graves wrote:

> given username. If you send a message traceable to AT&T, they are held
> accountable. I think it's reasonable for them to demand that you make
> messages traceable to yourself so that you are held accountable. 

Under the common carrier law, i do not think that would apply





From hallam at Etna.ai.mit.edu  Wed Jun 26 02:31:17 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Wed, 26 Jun 1996 17:31:17 +0800
Subject: Noise: Re: Those Evil Republicans
In-Reply-To: <199606251523.IAA04107@dns2.noc.best.net>
Message-ID: <9606260530.AA14412@Etna.ai.mit.edu>



I'm somewhat at a loss to understand your comment "worst famine in modern
Russian history", since modern Russian history could at the earliest be
said to start with the liberation of the serfs there is remarkably little
"modern Russian history" that was not under communist rule. Indeed it is 
difficult to imagine that any worse famine did occur at any time in Russias
history, unless you were to count some of the effects of world war 2. 

Since the appologists for Stalin outside Russia number in the low thousands
I'm at a loss to understand the relevance of your point. 

Similarly your point about government control of currency is somewhat puzzling. 
Are you arguing that we are less prosperous today than we were in the 1920's?
If so that would be a somewhat curious argument which you will no doubt 
share with us. The only modern country I know of which does not control its
currency is Lichenstein which uses the Swiss Franc, I'm not sure what lessons
can be learnt from a country whose chief ecconomic activities are gambling
and facilitating tax evasion however.

Now it may be that Bob Dole is secretly planning a radical change in the
ecconomic direction of the country but somehow I doubt that the position of 
chairman of the Federal Reserve is going to be going away soon. Indeed I
have not heard any Repulicans mioving towards yor policies which to me
sound more like those of William Jennings Bryant than Bob Dole. 

	Phill





From WlkngOwl at unix.asb.com  Wed Jun 26 02:34:53 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Wed, 26 Jun 1996 17:34:53 +0800
Subject: Leahy vs. Landers
Message-ID: <199606260600.CAA11201@unix.asb.com>


On 25 Jun 96 at 17:58, John Young quoted Ann Landers:
                                                                     
>                                                                   ... The 
>    Internet is tailor-made for con men, the lonely and the 
>    bored. The word from here is beware. More on this subject 
>    tomorrow. 

Gee? Is that why the DoD created ARPANet?  To help con men (well, 
there's the $200 hammers, er "multivariable handheld impact devices") 
and all of those lonely gronks based on ships and bases in B.F.E...

Seriously though...

 





From tcmay at got.net  Wed Jun 26 02:37:36 1996
From: tcmay at got.net (Timothy C. May)
Date: Wed, 26 Jun 1996 17:37:36 +0800
Subject: AT&T bans anonymous messages
Message-ID: <adf6129b05021004e930@[205.199.118.202]>


At 3:02 AM 6/26/96, Intense wrote:
>On Tue, 25 Jun 1996, Rich Graves wrote:
>
>> given username. If you send a message traceable to AT&T, they are held
>> accountable. I think it's reasonable for them to demand that you make
>> messages traceable to yourself so that you are held accountable.
>
>Under the common carrier law, i do not think that would apply


I agree that ISPs are unlikely to be held liable for messages passing
through their systems, but not because they have been determined to be
"common carriers." So far as I know, no ISP has been so classified.

(I'm not even sure what is involved in being classified as a common
carrier. Perhaps someone out there knows about these matters.)

However, it seems to me that the "Electronic Communications Privacy Act,"
the ECPA, gives an ISP a good defense. The ECPA forbids the interception of
electronic mail (usual caveats about special exceptions), and so an ISP
ostensibly is not supposed to be reading e-mail messages. Thus, an ISP
would seem to have a pretty good defense in court, claiming that the ECPA
explicitly precluded it from seeing what users were saying in e-mail.

(But I am not a lawyer, and it would not surprise me at all if an ISP is
someday held liable, despite the ECPA. "You can't read the mail, but you're
still responsible. You should have known. Or at least we can go after you
and shut you down.")

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From rharbeck at freenet.calgary.ab.ca  Wed Jun 26 02:40:29 1996
From: rharbeck at freenet.calgary.ab.ca (Reg Harbeck)
Date: Wed, 26 Jun 1996 17:40:29 +0800
Subject: LACC:       Re: Tales from the UK: Basel Part IV
In-Reply-To: <199606251952.MAA13356@toad.com>
Message-ID: <Pine.A32.3.92.960625225052.34342A-100000@srv1.freenet.calgary.ab.ca>


Time to insert a cautionary thought into this whole Info-war HERFsteria:

I'm just an EDP Security Specialist with 10 years experience in
Mainframe, PC and Network systems, and not some great expert with an
international reputation to protect, so take this for what it's worth.

However, I get the impression that there are some pretty smart people on
these lists.  You know, the kind of people who, when you say, "someone
just did the impossible," will figure out how they did it to solve the
mystery.  And there are also some people who like to look pretty smart by
going around and saying the kind of things that those pretty smart people
figured out, in order to enhance their reputation and keep their audiences
worried.  And there might even be people who'd be inclined to go out and
try those things that the pretty smart people figured out.

So, let's say that some public wanna-be-smart decides that they need to
scare people with stories of evil things that might be done, and so they
post a story of how they've already been claimed to be done, just to see
how the really-are-smart folks respond.  And then they go and take all
that free stuff and make a bundle off of it, and maybe hackers use it,
and, well, you get the idea.

Now, I'm not saying anyone on these lists does any of this stuff, 'cuz I
don't know.  But when it gets to speculation, well, maybe lets just say
the bogeyman did it, with help from his evil hacker friend Foobar.  It's a
lot safer, and maybe just as true.

-----
$0.02

- Reg Harbeck     (URL: http://www.freenet.calgary.ab.ca/~rharbeck)






From erehwon at c2.org  Wed Jun 26 02:44:51 1996
From: erehwon at c2.org (William Knowles)
Date: Wed, 26 Jun 1996 17:44:51 +0800
Subject: Alternic.net (was domain zapping)
Message-ID: <Pine.SUN.3.91.960625220103.16972A@infinity.c2.org>


With all the talk about InterNIC zapping domains, there should be
some talk about other registries, Alternic.net : http://www.alternic.net
is offering an alpha test for registering new TLD's and the prices
are considerably less expensive than the Internic.


William Knowles
erehwon at c2.org
finger for public key

--Fwd--

 A L T E R N I C . N I C

 Is proud to announce .NIC!
 
 The folks at alternic.nic (formerly alternic.net) are proud to
 announce alpha testing of the .NIC top level domain name served up by:
 
 MX.ALTERNIC.NIC at 204.94.42.1
 
 Other names are served by .NIC...
 ----------------------------------------------------------------------
 
    * ALTERNIC.NIC is being built to create a truly PUBLIC Network
      information center, for the benefit of all, on and off the net.
    * ALTERNIC.NIC is broadcast to disseminate information on Internet
      related issues, and to research new ideas on promoting the
      Internet.
    * ALTERNIC.NIC will promote the concept of Top Level Domainsi, and
      the de-centralization of name service. To this end, ALTERNIC.NIC
      will accept registrations for .NIC top level domains, as well as
      for administration of new top level domains. For now ALTERNIC.NIC
      will accept the existance of and promote a limitted number of top
      level domains. It should be recognized that at this point the
      concept of TLD diversification is EXPERIMENTAL.
    * ALTERNIC.NIC Will accept new TLDs or domain names which fit the
      following criteria:
         o The TLD or domain name must not already be registered.
         o DNS must be active for any TLD or domain names.
         o Payment of fees must be made to ALTERNIC.NET in advance.
         o Disputes between name holders may be handled several ways:
              + Release of domain name rights by existing name holder.
                If you want a name that's already registered, offer to
                buy the holder's rights.
              + ALTERNIC.NET will honour court orders from the
                jurisdiction which the domain name is currently
                registered in.
              + Sue ALTERNIC.NET. We're a privately held company, and
                do as we please. If you'd like to serve us with papers,
                it's dba A Towing Company, Inc., a Corporation
                registered with the Secretary of State of Washington
                State, USA. Of course, we'll have our corporate
                attorney counter-sue, and you can do it on our turf, OK


--End Fwd--






From stewarts at ix.netcom.com  Wed Jun 26 03:00:58 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Wed, 26 Jun 1996 18:00:58 +0800
Subject: AT&T bans anonymous messages
Message-ID: <199606260559.WAA27746@toad.com>


My AT&T Worldnet material finally came, and I was similarly anti-impressed
with the policies against anonymity, indecency, and other things that
their lawyers probably told them would cause them less hassle to ban
outright than to not mention until they get complaints later (sigh...)
(To give them a small bit of slack, the service did come out just about
when the CDA got signed, so it's no surprise they'd cover their <noun deleted>.)
I know some Worldnet folks, and I'll try to work my way up the food chain
to see if I can find who did it, and how flexible they are.
There are also some worldnet.* newsgroups where this can be discussed;
that'd be a good place for issues like alt.sexual-abuse.recovery and
other politically correct reasons for anonymity.

Adam Shostack asked what services it provides - the 5-hour-free/$20-unlimited
service gets you PPP, a POP3 mailbox, and servers for DNS, NNTP, SMTP,
and technical support.  There are also business services that get you 
anything from raw SLIP to frame relay to with us installing and managing 
routers on your premises and doing primary DNS service.  

Tim wrote:
>I agree with Hal's points, but I suspect that these technicalities will be
>ignored when the first _complaint_ reaches the DeathStar's administrators.
>"Your account has been cancelled."

I'd guess that the first complaint will either be ignored (because they're
busy trying to get the service on line and scaled up to 500,000 people)
or else get the account squashed without a second thought (because they're
busy trying to get the service on line and scaled up to 500,000 people),
but the first few spams that cause mass quantities of complaints will start
to get people thinking.  

>I suspect other major ISPs will adopt similar language, absent a vocal
>lobbying group for anonymous messaging capabilities.

If I remember right, Netcom doesn't permit remailers (or at least discouraged
one or two of them), but they'd rather not know about content, don't
censor users, and do censor spammers.

Disclaimer: This posting is official policy for any shares of AT&T stock
that I own, which will be listened to the next time the issue appears
on shareholders' ballot question....



#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Distract Authority!






From WlkngOwl at unix.asb.com  Wed Jun 26 03:30:46 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Wed, 26 Jun 1996 18:30:46 +0800
Subject: f-secure..
Message-ID: <199606260638.CAA00732@unix.asb.com>


On 25 Jun 96 at 17:45, brian dodds wrote:
[..]
> at any rate - has anyone tried out that new f-secure by the folks who 
> brought us f-prot? "military strength internet encryption".. seems to be 
> an encrypted telnet, but i can't replace our server to test it..

No. I'll have to look for it.

In the F-Prot does they explicitly endorse using PGP (esp. for 
sending infected files to them for analysis, as well as for checking 
signatures of binaries in the F-Prot package).

They also do the same academic hedging about effectiveness of their 
anti-virus package that a good crypto package would use, so I suspect 
they're likely to produce a good crypto package.

BTW, they're located in Iceland, at the complex.is domain.  AFAIK, no 
export restrictions there.

Rob.



 
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From roy at sendai.scytale.com  Wed Jun 26 03:38:23 1996
From: roy at sendai.scytale.com (Roy M. Silvernail)
Date: Wed, 26 Jun 1996 18:38:23 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606251954.MAA13366@toad.com>
Message-ID: <960626.010919.5c5.rnr.w165w@sendai.scytale.com>


-----BEGIN PGP SIGNED MESSAGE-----

In list.cypherpunks, stewarts at ix.netcom.com writes:

> At 02:05 PM 6/24/96 -0700, Vlad wrote:

> They also control the
> .org and .net hierarchies.  If you don't like it, you can always
> get a statist address in the .us domain or some other .xx government domain,
> or find someone who's got a second-level domain that will register you

Actually,  I just went through this.  I wanted scytale.net, but my ISP
rep was very upfront about my chances.  The .net is now reserved by
InterNIC for ISP's.  The .org domain is held for provable nonprofit
corps.  The .us domain was a possibility, but pragmatically impossible
due to the >4 month update latency in Minnesota.  Literally, the only
choice I had for a domain name was in the .com area.  It somewhat pissed
me off, since I really did not want my net.presence to look commercial.  
- -- 
           Roy M. Silvernail     [ ]      roy at scytale.com
PGP Public Key fingerprint =  31 86 EC B9 DB 76 A7 54  13 0B 6A 6B CC 09 18 B6
                Key available from pubkey at scytale.com

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdDVShvikii9febJAQGqhQP9GfDPsXUVnNGJG3yft5OR/LF8cvHiSFN5
pwmhZr6TyfQTKCO9tB1JoHI4+ibIIuSaepoW3J5PU/ltlhaivc7UBYm6g2nin0ep
g59e5M8mQsFvoKvvRxFcgtfya22WXqkCkMTyR+fVwEzc503RkvDq9Yr0Kx7SaInK
k2rqiYXYs5s=
=HRqc
-----END PGP SIGNATURE-----






From WlkngOwl at unix.asb.com  Wed Jun 26 04:38:16 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Wed, 26 Jun 1996 19:38:16 +0800
Subject: RFD: Developing Nations and crypto (based on excertp from Edupag
Message-ID: <199606260805.EAA01587@unix.asb.com>


An interesting possibility: information tech expands and 'centers' in 
third-world/developing countries, since (1) they need to skip 
industrial techs to catch up to N.America, Europe, etc. (2) they 
aren't bogged down in older ways of doing business, communicating, 
etc. (3) 'emerging democracies' might embrace crypto tech as a 
safeguard against Orwellian practices, to use digital authentication 
to protect from fraud, etc. (4) cheaper costs for rent, wages, etc. 
[though in many cases exploitavily cheap] may outweigh building an 
infrastructure from scratch, (5) building an infrastructure from 
scratch has advantages of building in flexibility towards uses that 
were not built into older structures in N.Am, Eur., etc. (6) desire 
for investment (7) desire for skills or tech to drive education etc. 
in region



------- Forwarded Message Follows -------
From:          Edupage Editors <educom at elanor.oit.unc.edu>
[..]
DEVELOPING NATIONS SEE BRIGHT FUTURE IN SMART CARDS
When it comes to full-scale trials of smart card technology, developing
countries such as Zambia and Thailand are way ahead of the U.S.  The new
payment systems are finding greater acceptance in countries where
traditional banking practices are not so firmly entrenched.  "No one's in a
hurry for a new payment system here because our system already works," says
a U.S. programmer who designed Zambia's smart card system.  "Our country is
expanding, and we don't have enough banks and no automated teller
machines...  The lines are very long,"  says a spokesman for the Zambian
embassy in Washington.  And smart cards provide valuable access to other
technological advances:  "Developing nations are using smart cards to
leapfrog the need to build telecommunications infrastructures," says a Visa
VP.  (Investor's Business Daily 25 Jun 96 A8)
[..]
Educom Update ...  is our twice-a-month electronic summary of
organizational news and events. To subscribe, send mail to:
listproc at educom.unc.edu with the message:  subscribe update Charles Revson
(if your name is Charles Revson;  otherwise, substitute your own name).
[..]
---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From jk at stallion.ee  Wed Jun 26 04:40:37 1996
From: jk at stallion.ee (=?ISO-8859-1?Q?J=FCri_Kaljundi?=)
Date: Wed, 26 Jun 1996 19:40:37 +0800
Subject: f-secure..
In-Reply-To: <199606260638.CAA00732@unix.asb.com>
Message-ID: <Pine.GSO.3.93.960626112325.29256A-100000@nebula.online.ee>


 Wed, 26 Jun 1996, Deranged Mutant wrote:

> On 25 Jun 96 at 17:45, brian dodds wrote:
> [..]
> > at any rate - has anyone tried out that new f-secure by the folks who 
> > brought us f-prot? "military strength internet encryption".. seems to be 
> > an encrypted telnet, but i can't replace our server to test it..
> 
> BTW, they're located in Iceland, at the complex.is domain.  AFAIK, no 
> export restrictions there.

F-secure is a new commercial version of the SSH package, written by Tatu
Ylonen from Finland. It uses the SSH protocol v2.0 and it is developed and
sold by Data Fellows from Finland, http://www.datafellows.com/
Cryptographic algorithms are RSA, IDEA and 3-key 3DES. It can be sold both
inside and outside the US. I would say the SSH package is very secure and
very well designed.

J�ri Kaljundi
AS Stallion
jk at stallion.ee






From perry at piermont.com  Wed Jun 26 06:30:46 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Wed, 26 Jun 1996 21:30:46 +0800
Subject: Alternic.net (was domain zapping)
In-Reply-To: <Pine.SUN.3.91.960625220103.16972A@infinity.c2.org>
Message-ID: <199606260954.FAA02843@jekyll.piermont.com>



William Knowles writes:
> With all the talk about InterNIC zapping domains, there should be
> some talk about other registries, Alternic.net : http://www.alternic.net
> is offering an alpha test for registering new TLD's and the prices
> are considerably less expensive than the Internic.

The AlterNIC is a figment of its creators imagination. It has about
the same credibility level as the claim of the Freemen that they
aren't subject to U.S. law.

They can offer to sell you anything they like, of course, and you can
pay them, but you don't get anything at all for the money. Domains
registered with them don't appear in the real DNS.

.pm





From gary at systemics.com  Wed Jun 26 06:33:22 1996
From: gary at systemics.com (Gary Howland)
Date: Wed, 26 Jun 1996 21:33:22 +0800
Subject: Noise: Re: Those Evil Republicans
In-Reply-To: <9606260530.AA14412@Etna.ai.mit.edu>
Message-ID: <31D104C6.62319AC4@systemics.com>


hallam at Etna.ai.mit.edu wrote:
> 
> Similarly your point about government control of currency is somewhat puzzling.
> Are you arguing that we are less prosperous today than we were in the 1920's?
> If so that would be a somewhat curious argument which you will no doubt
> share with us. The only modern country I know of which does not control its
> currency is Lichenstein which uses the Swiss Franc,

There are dozens - Jersey, Isle of Man, Andorra, ...

> I'm not sure what lessons
> can be learnt from a country whose chief ecconomic activities are gambling
> and facilitating tax evasion however.

Ever heard of Goodhearts law?  (something along the lines of
"efforts to regulate something will result in it moving somewhere
unregulated").

Gary
--
pub  1024/C001D00D 1996/01/22  Gary Howland <gary at systemics.com>
Key fingerprint =  0C FB 60 61 4D 3B 24 7D  1C 89 1D BE 1F EE 09 06





From jya at pipeline.com  Wed Jun 26 08:30:43 1996
From: jya at pipeline.com (John Young)
Date: Wed, 26 Jun 1996 23:30:43 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <199606261126.LAA02542@pipe2.t2.usa.pipeline.com>


   The New York Times, June 26, 1996, p. B7. 
 
 
   Head of C.I.A. Plans Center To Protect Federal Computers 
 
   By Tim Weiner 
 
 
   Washington, June 25 -- Alarmed at the growing threat that 
   computer hackers pose to national security, the Director of 
   Central Intelligence today announced plans to create a 
   "cyberwar" center to protect the bits and bytes that weave 
   the nation together. 
 
   The United States cannot be brought to its knees by a 
   madman with a modem. But the Director, John M. Deutch, said 
   the nation's intelligence agencies were alert to the threat 
   of "very, very large" attacks on the computers that run 
   Defense Department war rooms, power plants, telephone 
   systems, air traffic control centers and international 
   financial transfers. 
 
   "The electron," Mr. Deutch warned, "is the ultimate 
   precision-guided weapon." 
 
   Mr. Deutch said he was seeking to create a cyberwar center 
   at the National Security Agency, the giant electronic 
   eavesdropping branch of American intelligence. He said the 
   center could focus the Government's previously scattershot 
   efforts to understand and combat the threats posed by 
   governments, terrorist groups and mischievous teen-agers. 
 
   Mr. Deutch's first public statement about information 
   warfare came in testimony before Senator Sam Nunn, the 
   Georgia Democrat who called a hearing of a Senate 
   Governmental Affairs subcommittee to discuss the 
   little-understood, highly classified problem. 
 
   "There are some who believe we are going to have to have an 
   electronic Pearl Harbor, so to speak, before we really make 
   this the kind of priority that many of us believe it 
   deserves to be made," Mr. Nunn said. "Do you think we're 
   going to need that kind of real awakening, or are we fully 
   alerted to this danger now?" 
 
   Mr. Deutch replied: "I think that we are fully alerted to 
   it now. I don't know whether we will face an electronic 
   Pearl Harbor, but we will have, I'm sure, some very 
   unpleasant circumstances." 
 
   He added, "I'm certainly prepared to predict some very, 
   very large and uncomfortable incidents." 
 
   Mr. Deutch said cyberwar could become a 21st-century 
   national security threat second only to nuclear, biological 
   and chemical weapons. 
 
   Potential attackers may already possess the sophisticated 
   techniques they would need to bring off a cataclysmic 
   crash, many experts believe, but they still lack the deep 
   knowledge of their targets and direct access to the 
   computer systems they would seek to disable. 
 
   Military and civilian organizations are increasingly 
   dependent on evermore complicated and interlinked systems. 
   They run the risk of understanding the threat less and less 
   as it becomes more and more complex Mr. Nunn and Mr. Deutch 
   suggested. 
 
   Senator Nunn also said intelligence agencies have 
   communications problems with banks, telecommunications 
   companies and other business ventures vulnerable to cyber 
   attacks. 
 
   "There's a great reluctance by the private sector to 
   discuss the threat that they've faced or even the attacks 
   that have already occurred," he said, "because they fear 
   that the word would go out they're vulnerable, and 
   therefore could destroy or damage consumer confidence and 
   thereby cost them business." 
 
   "At some point," the Senator added, "there's got to be 
   communication here." 
 
   [End] 
 
 
 
 
 
 
 





From nelson at crynwr.com  Wed Jun 26 10:08:56 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Thu, 27 Jun 1996 01:08:56 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606251954.MAA13366@toad.com>
Message-ID: <19960626111642.6239.qmail@ns.crynwr.com>


-----BEGIN PGP SIGNED MESSAGE-----

Roy M. Silvernail writes:

 > Actually,  I just went through this.  I wanted scytale.net, but my ISP
 > rep was very upfront about my chances.  The .net is now reserved by
 > InterNIC for ISP's.  The .org domain is held for provable nonprofit
 > corps.  The .us domain was a possibility, but pragmatically impossible
 > due to the >4 month update latency in Minnesota.  Literally, the only
 > choice I had for a domain name was in the .com area.

In my experience, this is 100% bullshit.


-----BEGIN PGP SIGNATURE-----
Version: 2.7
Comment: Processed by Mailcrypt 3.2, an Emacs/PGP interface

iQCVAwUBMdEcAabBSWSDlCdBAQFnlwQAis6ktpRIJWktljS3QZlsP3pojr6yHNCg
muwJWMczj0IR7qA97DPO6dqoO302rVJCKg6D+4yXU6rkUi3YIKYLVK/evGO4d+YH
HJd6UclikrExAIKns37xqtJhyMcMFhbOhWwsdRm1lH9iujXElWCYANXgGZiKM27S
oKU0tseg4VI=
=D6qk
-----END PGP SIGNATURE-----





From m5 at vail.tivoli.com  Wed Jun 26 11:09:16 1996
From: m5 at vail.tivoli.com (Mike McNally)
Date: Thu, 27 Jun 1996 02:09:16 +0800
Subject: CIA Fears UmpTeen InfoNukes
In-Reply-To: <199606261126.LAA02542@pipe2.t2.usa.pipeline.com>
Message-ID: <31D13BF9.467A@vail.tivoli.com>


John Young wrote:

>    "The electron," Mr. Deutch warned, "is the ultimate
>    precision-guided weapon."

I'd like to claim this for potential use in a .signature, if nobody
else has thusly used it already.


By the way, there was a thing in the Yahoo/Reuters feed about "attacks"
on DoD computers; apparently British police arrested a "hacker" the
other day.  Anyway, the article included a claim that there have been
250,000 attempted break-ins on DoD computers over the past year.

Does anybody know how they count that?

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
       m5 at tivoli.com * m101 at io.com          *
      <URL:http://www.io.com/~m101>         * suffering is optional





From bobpal at cdt.org  Wed Jun 26 13:34:09 1996
From: bobpal at cdt.org (Bob Palacios)
Date: Thu, 27 Jun 1996 04:34:09 +0800
Subject: Senate Crypto Hearing being "Cybercast" now!
Message-ID: <v02140b03adf6f9221008@[204.157.127.16]>


SENATE ENCRYPTION HEARING BEING "CYBERCAST" LIVE ON THE NET NOW!
Wednesday June 26, 10:30am EDT | 7:30am PDT | 14:30 GMT
HotWired WiredSide Chat
http://www.hotwired.com/wiredside/

Senator Conrad Burns (R-MT) is chairing a hearing regarding cryptography policy
before the Senate Subcommittee on Science, Space and Technology.  The hearing
is being "cybercast" now on HotWired's WiredSide Chat.

Netizens concerned about privacy and security on the Internet are participating
in the hearing; they are submitting comments and questions, and discussing the
hearing with others online.

Witnesses that are testifying now include:

* Phil Zimmermann, Inventor of PGP
* Whit Diffie, Father of Public-Key Cryptography
* Jerry Berman, Executive Director, Center for Democracy and Technology
* Matt Blaze, Cryptographer
* Phil Karn, Cryptographer
* Barbara Simons, Chair of US Public Policy Committee, ACM
* Marc Rotenberg, Director, Electronic Privacy Information Center

HOW TO JOIN THE HEARING LIVE ONLINE

Point your web browser at:

     http://www.hotwired.com/wiredside/

To listen to the hearing, you will need to have RealAudio properly installed on
your computer in order to participate in this event. (You can download RealAudio
software *FREE* by visiting [http://www.realaudio.com/].)

In order to participate in the accompaning chat session (and to ask questions of
the witnesses) you will need to be a member of HotWired.  Membership is *FREE*!
Visit http://www.hotwired.com/ for details.

If you do not have RealAudio capability, you can still participate in the online
discussion.  Telnet to talk.com and log in with your HotWired member name and
password.

The hearing is being brought to you by HotWired, DIGEX, the Voters
Telecommunications Watch, and the Center for Democracy and Technology.



-----
Bob Palacios, Online Organizer/Sysop     Center for Democracy and Technology
<bobpal at cdt.org>                             1634 Eye Street, NW  Suite 1100
                                                        Washington, DC 20006
http://www.cdt.org/                                      (v) +1 202 637 9800
http://www.cdt.org/homes/bobpal/                         (f) +1 202 637 0968

           The CDA fight continues! Visit http://www.cdt.org/ciec/







From jya at pipeline.com  Wed Jun 26 14:08:01 1996
From: jya at pipeline.com (John Young)
Date: Thu, 27 Jun 1996 05:08:01 +0800
Subject: TWP on CIA Info Gears
Message-ID: <199606261456.OAA29250@pipe2.t1.usa.pipeline.com>


   The latter part of this article elaborates the NYT report 
   today. 
 
 
   The Washington Post, June 26, 1996, p. A19. 
 
 
   CIA Gears Up to Thwart 'Information Attacks' 
 
      Deutch Lists Computer Break-Ins, Terrorism as 
      High-Priority Potential Threats to National Security 
 
   By R. Jeffrey Smith 
 
 
   CIA director John M. Deutch warned yesterday that the 
   country is likely to experience some a very large and 
   uncomfortable" disruptions of vital computer systems at the 
   hands of foreign terrorists or hostile nations in coming 
   years, but pledged a major new U.S. effort to detect and 
   combat the threat of computer break-ins. 
 
   "We have evidence that a number of countries around the 
   world are developing the doctrine, strategies, and tools to 
   conduct information attacks" on military-related computers, 
   Deutch told a hearing of the Senate Permanent Subcommittee 
   on Investigations, while declining to name these nations. 
 
   Deutch added that he is convinced that foreigners are 
   becoming increasingly aware "that advanced societies, 
   especially the United States, are increasingly dependent on 
   open and potentially vulnerable" computers to control 
   electric power, airplane traffic, telecommunications and 
   financial operations -- posing an attractive target for 
   virtually "any nation or foreign terrorist organization." 
   Emphasizing that the Clinton administration has just begun 
   to grasp the dangers involved and begin working on the 
   problem, Deutch said "we are not well-organized as a 
   government to address these issues" and cautioned that 
   making vital computers much less vulnerable to attack may 
   take decades. 
 
   "The electron is the ultimate precision-guided weapon," 
   Deutch said, but "it is not [a problem about] which it's 
   absolutely apparent ... the best way to proceed." 
 
   Deutch said he nonetheless had already drawn up plans to 
   create an office at the National Security Agency to be 
   called the Information Warfare Technology Center, which 
   will focus on analyzing the risks that foreign hackers pose 
   to U.S. computers and help create new methods of 
   investigating and defending the U.S. against electronic 
   break-ins. 
 
   Deutch also said that he supports creating a "real-time 
   response center" for any major domestic or foreign attacks 
   against civilian computers under the supervision of the 
   Justice Department, as well as a separate, Defense 
   Department center for responding to attacks on 
   military-related computers. 
 
   Deutch disclosed that the intelligence community conducted 
   an extensive survey last year of the risks of an attack on 
   computers controlling U.S. telephones, the electric power 
   grid, oil refineries and other utilities. He said the 
   results are classified, but added that a new, broader 
   estimate of the threat is to be completed by December. 
 
   He also said the intelligence community has begun to hunt 
   more diligently for evidence of any foreign intent to 
   attack U.S. computers, any sign of foreign sponsorship for 
   U.S.-based computer hacking activities, and for any 
   indication that foreign organized crime figures are 
   becoming involved in attacks on computers at U.S. financial 
   institutions. 
 
   The Defense Intelligence Agency, moreover, is trying to 
   develop a way to predict a major "information warfare 
   attack" against the United States, Deutch said. 
 
   One obstacle is that banks and other private institutions 
   have been reluctant to divulge any evidence of computer 
   intrusions for fear that it will leak and erode the 
   confidence of their customers. Deutch said "the situation 
   is improving" but that more cooperation was needed from 
   major corporations, and said the CIA remains willing to 
   share information with such firms about the risks they 
   might face. 
 
   Although he declined to cite any specific examples of 
   computer warfare, Deutch said he would list it as the 
   second most worrisome threat to U.S. national security -- 
   just below the threat posed by foreign chemical, nuclear, 
   and biological arms. 
 
   In answer to a question from Senator Sam Nunn (D Ga.) about 
   whether the government was aware of the danger, Deutch 
   said, "I don't know whether we will face an electronic 
   Pearl Harbor, but we will have, I'm sure, some very 
   unpleasant circumstances in this area or our allies 
   will.... I'm certainly prepared to predict some very, very 
   large and uncomfortable incidents in this area." 
 
   [End]  
 
 
   Final notice:  Wash Post on the Web at: 
 
        http://www.washingtonpost.com 
 
 
 





From usura at replay.com  Wed Jun 26 14:32:10 1996
From: usura at replay.com (Alex de Joode)
Date: Thu, 27 Jun 1996 05:32:10 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <199606261549.RAA06484@basement.replay.com>


Mike  sez:
[..]
: By the way, there was a thing in the Yahoo/Reuters feed about "attacks"
: on DoD computers; apparently British police arrested a "hacker" the
: other day.  Anyway, the article included a claim that there have been
: 250,000 attempted break-ins on DoD computers over the past year.

: Does anybody know how they count that?

'telnet nsa.gov 25' and you will be added to the count .... 
--

	-AJ-





From lucifer at dhp.com  Wed Jun 26 15:20:38 1996
From: lucifer at dhp.com (lucifer)
Date: Thu, 27 Jun 1996 06:20:38 +0800
Subject: Lucifer remailer
Message-ID: <Pine.LNX.3.91.960626120657.32722A-100000@dhp.com>


-----BEGIN PGP SIGNED MESSAGE-----

I have just finished setting up a Mixmaster and cpunk remailer at
lucifer at dhp.com.  The PGP key and Mixmaster key are below.

lucifer lucifer at dhp.com 6e57353149a1175f11aba72cedee02fd 2.0.3

- -----Begin Mix Key-----
6e57353149a1175f11aba72cedee02fd
258
AATvJVbP8R9tUF6R9zjSbRdDaz2j1INJvkVI6L6I
5F65Q7lRCoOl8+TCi+HgUo1AErYsLPpHpI1l4F9I
RUqvH/fvR7GuqgIJc+RsGyQPPG0dpL5lHt2ppdmW
wcTX85ZKRK242SW1hTih43IaCmXr+i1zX6+QZsr1
MtAqwDlyDgoU0QAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAQAB
- -----End Mix Key-----


- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzHPdZkAAAEEAK3rI5oq3dwDV5inleitjy03JvhBD/GtbRRDO1noLUnRf4FV
CmCfGJrqitHtIBqhA+hIRBcNRo7J48Yiu6ctda29xe/rEy3QdSKHpZhstsV+hzw3
42Lhogm1cW2QPrvjJQUgU5mpKR9qKn7KQLBcVz/Mx1EvX4aMGJ2oJ1gRbIg5AAUR
tCRBbm9ueW1vdXMgcmVtYWlsZXIgPGx1Y2lmZXJAZGhwLmNvbT6JAJUDBRAxz3vx
nagnWBFsiDkBAfUAA/9ufh0GPUo6uR4/5/tbbFKyQs8fW0NmDkrU+xni7QNmKKUj
qC7lJ/MHPxRGzuXaYE+k9I8NmI1DxyzdWlRX/X6uwcwYPOxa/+CI9HUAkcB/Q/N8
GZJckumcU7hlMim08lFJQjsEWxNyqKefAeOAKQ5v5xt3rmpPDmHrXbOuJ104Ng==
=dFZY
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdFhcZ2oJ1gRbIg5AQGqSwP9HzVjkvkN4oBIHh5AzvsKZoZG+zMvId7Z
+LlvpSOSyXm+Vaxga28jBL03JIN8j6+yJtZy1h07VlYYwnhhBrhnIufeq+mO+ea6
k/ymFcUFsfM4jnf5jvaHKJTMULnmL3wspWzBKl3CRkQ2e238ozx8IWdhTxxdD9vj
aO3vQZHHFTI=
=/ICd
-----END PGP SIGNATURE-----





From wendigo at gti.net  Wed Jun 26 15:44:12 1996
From: wendigo at gti.net (Herr Wendigo)
Date: Thu, 27 Jun 1996 06:44:12 +0800
Subject: domain name zapping threat by Internic
In-Reply-To: <199606260644.CAA00869@apollo.gti.net>
Message-ID: <199606261646.MAA25289@apollo.gti.net>


-----BEGIN PGP SIGNED MESSAGE-----

An entity claiming to be Bill Stewart wrote:
: 
: Perhaps I'm misunderstanding your point.  Because the root nameservers
: provide name service for the top level domains, if you want to find 
: schmoe.org, you need to ask a nameserver for .org where it is, and to find
: www.schmoe.org, you need to ask a nameserver for .org where to find a 
: primary or secondary nameserver for schmoe.org - so if the .org folks
: decide to drop you, you become hard to reach, even if you've got
: the primary and secondary name servers working just fine.

The org. folks ARE the InterNIC.  The machines on ROOT-SERVERS.NET are all
fed by the NIC.  My problem with the original statement was the implication
that using your own nameserver as having zone authority was a bad idea.
Not only is it a good idea, it is standard operating procedure.  You're 
absolutely right about being "hard to reach" (a bit understated) if the
NIC drops your record.  Any recursive lookups will fail.


: Now, you can improve your odds a bit by getting popular systems, such as
: aol.com and compuserve.com to act as secondary nameservers for you -
: you may lose connectivity to Europe, but you're in the cache for half
: the Net that way...

Well, if you decide to use AOL as your secondary, you will only be accessible
(by name) outside of aol.com for about 48 hours after the NIC drops your 
records.  After that, only users who use one of aol.com's name servers
will be able to access your domain.  Then, when someone else registers your
domain, AOL will probably drop you like a bad habit (if they don't when the NIC
drops you).  I'm sure that AOL (or Compuserve, etc.) are not too keen on being
the odd man out when the NIC and the rest of the world say XYZ.COM is owned
by your competitor and AOL says it is owned by you.

mark

- -- 
    Mark Rogaski   | Why read when you can just sit and |      Member
  GTI System Admin |         stare at things?           | Programmers Local
  wendigo at gti.net  | Any expressed opinions are my own  |     # 0xfffe
 wendigo at pobox.com | unless they can get me in trouble. |     APL-CPIO


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdFpaQ0HmAyu61cJAQEn+AP/Ttiw04EyeEQ4/6K19ZqXAbOui+zZ+fmu
t/RJJGL834E/8yWB3xmbAmltDR+/V5T679iBUtw8Q+0CQEZOWwXeguRriILyabMn
XRFdCP8+Cw5zvrz12BtIKYHCm4o9MG7or3BBbP3iHSF1ia6n2eMPwjRiaKrlqBYm
Gqv9lThaoqU=
=LD//
-----END PGP SIGNATURE-----





From tcmay at got.net  Wed Jun 26 15:54:01 1996
From: tcmay at got.net (Timothy C. May)
Date: Thu, 27 Jun 1996 06:54:01 +0800
Subject: RFD: Developing Nations and crypto (based on excertp from Edupag
Message-ID: <adf6b50a0602100412c8@[205.199.118.202]>


At 3:57 AM 6/26/96, Deranged Mutant wrote:
>An interesting possibility: information tech expands and 'centers' in
>third-world/developing countries, since (1) they need to skip
>industrial techs to catch up to N.America, Europe, etc. (2) they
>aren't bogged down in older ways of doing business, communicating,
>etc. (3) 'emerging democracies' might embrace crypto tech as a
>safeguard against Orwellian practices, to use digital authentication
>to protect from fraud, etc. (4) cheaper costs for rent, wages, etc.
>[though in many cases exploitavily cheap] may outweigh building an
>infrastructure from scratch, (5) building an infrastructure from
>scratch has advantages of building in flexibility towards uses that
>were not built into older structures in N.Am, Eur., etc. (6) desire
>for investment (7) desire for skills or tech to drive education etc.
>in region

Sadly, most developing countries (Third World, LDCs, whatever) have
repressive governments of various stripes...few are libertarian. Several
have embraced computer technology, but primarily as an instrument of social
control.

Singapore is an example of a country that jumped from former colonial
status, surrounded by relatively poor (GNP) countries, to the "Information
Age." And what is the result? What our own Sandy Sandfort dubbed
"Disneyland with a Death Penalty." No spitting, no cursing, no long hair,
no "Wall Street Journal," no pornography, no Internet free access, no
dissension. And smartcards track the movements of all Citizen-Units. Not an
encouraging example.

As for the comment that "they aren't bogged down in older ways of doing
business, communicating, etc." Well, some of these "older ways" include:

- concepts about the ownership of property and transfers of title

- contracts, and the ability to make and enforce them

- understanding of the Uniform Commercial Code (the descendent of the "Law
Merchant" which Western societies have embraced for centuries)

- a stable middle class, solid educational facilities, and a tradition of
business and technical achievement

(These are all things which are missing in many Third World countries, for
whatever reasons. Even in many Second World countries, such as the former
U.S.S.R., and these lacks are making the development of modern economic
systems problematic.)

Certainly some small nations--perhaps island nations--can essentially jump
directly to an "information based economy." The Cayman Islands and several
other examples come to mind.

I find it harder to believe that a _large_ nation is likely to make such a
transition.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From trei at zipnet.net  Wed Jun 26 16:03:59 1996
From: trei at zipnet.net (Peter Trei)
Date: Thu, 27 Jun 1996 07:03:59 +0800
Subject: Life imitates art (InfoWar, Sunday Times article)
Message-ID: <199606261626.MAA19023@zip0.zipnet.net>




Winn Schwartau is much too modest.

Following up on the alleged info-ransom attacks on European financial
institutions, I've tracked down his entertaining fascinating resume
at:

http://www.homecom.com/people/schwartau-frame.html

This led me to the most amazing discovery: Winn predicted the
technologies used in the alleged attacks at least three years ago, in
the self-published science fiction novel "Terminal Compromise." The text
of this prescient work can be found on the web at:

http://www.inform.umd.edu:8080/Educational_Resources/ReadingRoom/Fiction/TerminalCompromise

I won't quote from it (there are dire warnings against doing so in the
intro), but here are some of the elements in which alleged real life is
so closely imitating Winn's art:

EMP bomb attacks against financial institutions	chapter 11     
"HERF" guns (described but un-named)		chapter 16
info-ransom demands against large corporations	chapter 17
... and many others.

If I had predicted the future so well and so far ahead, I'd be shouting
it from the rooftops, and use the strength of the reputation I'd
instantly establish to set up shop as a professional prognosticator (for
fat fees).

I wonder why Winn hasn't bothered to bring this to our attention - and
I hope that Peter Warren and the editors of the London Sunday Times
have heard about his astounding foresight.

Winn, my hat's off to you, and my $7 "shareware fee" will be in mail
as soon as I finish the book!

Peter Trei
ptrei at acm.org





From rmtodd at servalan.servalan.com  Wed Jun 26 16:17:57 1996
From: rmtodd at servalan.servalan.com (Richard Todd)
Date: Thu, 27 Jun 1996 07:17:57 +0800
Subject: AT&T bans anonymous messages
In-Reply-To: <199606260559.WAA27746@toad.com>
Message-ID: <m0uYy5s-000f6YC@servalan.servalan.com>


In mailinglist.cypherpunks Bill Stewart writes:
>I'd guess that the first complaint will either be ignored (because they're
>busy trying to get the service on line and scaled up to 500,000 people)
>or else get the account squashed without a second thought (because they're
>busy trying to get the service on line and scaled up to 500,000 people),
>but the first few spams that cause mass quantities of complaints will start
>to get people thinking.  

Um, you don't read news.admin.net-abuse.misc, do you?  The first few spams
from worldnet have already happened, and from the reports I've seen on there,
the response from worldnet's posthamster has been pretty much nonexistent.
It apparently doesn't help that the 'postmaster' mailbox has a quota just
like the other mailboxen on the system, so every time someone does spam
from worldnet, half the complaint mail to postmaster bounces.  






From brucem at wichita.fn.net  Wed Jun 26 16:45:17 1996
From: brucem at wichita.fn.net (Bruce M.)
Date: Thu, 27 Jun 1996 07:45:17 +0800
Subject: CIA Fears UmpTeen InfoNukes
In-Reply-To: <31D13BF9.467A@vail.tivoli.com>
Message-ID: <Pine.BSI.3.91.960626121433.4983A-100000@wichita.fn.net>


On Wed, 26 Jun 1996, Mike McNally wrote:

> By the way, there was a thing in the Yahoo/Reuters feed about "attacks"
> on DoD computers; apparently British police arrested a "hacker" the
> other day.  Anyway, the article included a claim that there have been
> 250,000 attempted break-ins on DoD computers over the past year.
> 
> Does anybody know how they count that?

    Any time that someone doesn't successfully log into their computer, 
pings their site, fingers their site, does a nslookup on their site or 
anything else that constitutes an "attack."

                    Bruce M. * brucem at feist.com
        ~---------------------------------------------------~
        "Knowledge enormous makes a god of me." -- John Keats






From nelson at crynwr.com  Wed Jun 26 16:48:28 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Thu, 27 Jun 1996 07:48:28 +0800
Subject: Alternic.net (was domain zapping)
In-Reply-To: <2.2.32.19960626174302.0099dcf8@vertexgroup.com>
Message-ID: <19960626180225.9280.qmail@ns.crynwr.com>


John F. Fricker writes:

 > DNS server administrators need only add one line to their named.boot file to
 > resolve .nic hosts.
 > 
 > secondary       nic     204.94.42.1             db.nic

Question to ponder: Why don't people encrypt mail sent to cypherpunks?

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade;
Potsdam, NY 13676       | +1 315 268 9201 FAX   | governments coerce.





From wendigo at gti.net  Wed Jun 26 17:21:24 1996
From: wendigo at gti.net (Herr Wendigo)
Date: Thu, 27 Jun 1996 08:21:24 +0800
Subject: Alternic.net (was domain zapping)
In-Reply-To: <Pine.SUN.3.91.960625220103.16972A@infinity.c2.org>
Message-ID: <199606261739.NAA28980@apollo.gti.net>


-----BEGIN PGP SIGNED MESSAGE-----

An entity claiming to be William Knowles wrote:
: 
: With all the talk about InterNIC zapping domains, there should be
: some talk about other registries, Alternic.net : http://www.alternic.net
: is offering an alpha test for registering new TLD's and the prices
: are considerably less expensive than the Internic.
: 

ALTERNIC.NIC is a couple of kids with a few Linux boxes.  It's rather amusing,
but they did go through a lot of trouble to make it look good.  Sure,
the new TLD's work if you use their name server.

I thought about actually registering NSA.TEL and MCI.ATT with them for
shits and giggles.  I love the TLD's they have ... BSA, XXX, CAT, DOG ...
it was a good laugh, but it's way past April 1st.

- -- 
    Mark Rogaski   | Why read when you can just sit and |      Member
  GTI System Admin |         stare at things?           | Programmers Local
  wendigo at gti.net  | Any expressed opinions are my own  |     # 0xfffe
 wendigo at pobox.com | unless they can get me in trouble. |     APL-CPIO


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdF1zA0HmAyu61cJAQGUGwP+KXJnvznmCPqWRdVHdpthvkNNqcVsBM+D
vajJQc6RLmhEbKsBrTlcNfF4zN5bREGCRP4NAxp7pbw4ewlcfEQo5A2a2CsllmbJ
xD3RgK/EY03nErT0fsLuKVU9dcAhUJILj2KWadMkL9vzAg05Me/7YaGqXSkKHJIM
1JEKS1xFoto=
=yAkh
-----END PGP SIGNATURE-----





From llurch at networking.stanford.edu  Wed Jun 26 17:22:57 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Thu, 27 Jun 1996 08:22:57 +0800
Subject: AT&T bans anonymous messages
In-Reply-To: <Pine.LNX.3.91.960625230149.659A-100000@invictor.miworld.net>
Message-ID: <Pine.GUL.3.93.960626105454.14494A-100000@Networking.Stanford.EDU>


On Tue, 25 Jun 1996, Intense wrote:

> On Tue, 25 Jun 1996, Rich Graves wrote:
> 
> > given username. If you send a message traceable to AT&T, they are held
> > accountable. I think it's reasonable for them to demand that you make
> > messages traceable to yourself so that you are held accountable. 
> 
> Under the common carrier law, i do not think that would apply

This is true, but I wrote "accountable" rather than "liable" on purpose. 
Sites known as spam havens are regularly mailbombed, killfiled, aliased out,
and so on. With the possble exception of mailbombing, all of these means of
holding ISPs accountable for their users' abuse of network are completely
legal and require no legal action on the part of the responding site.

I see no excuse for the craven "indecency" and "personal information" bits
of the AUP, but my reading of the "anonymity" bits is simply that if you
configure Netscape "wrong" and send a spam or a harassing note, you'll get
kicked off. You can still use encryption, and you can still send messages to
anonymous remailers.

Actually, you'd be a fool to rely on AT&T for your privacy services, since
they can determine your identity based on Message-ID. Even Sameer will track
you down and kick you off if you spam from c2. The difference is that Sameer
encourages you to use his services responsibly in ways that ensure that even
he doesn't know who you are. 

Of course AT&T's language SUCKS. I'd like to see an explicit recognition of
the right to anonymity, when done PROPERLY, i.e., with anonymous remailers
or more freedom-loving ISPs intended for that purpose. An opportunity?
Probably not, but it's something for stockholders to consider. 

Skim news.admin.net-abuse.misc for messages from the respected spam-stompers
who are extremely sensitive to free speech issues -- Tim Skirvin, Seth
Breidbart, Chris Lewis, Russ Allbery, JEM. 

-rich






From perry at piermont.com  Wed Jun 26 18:08:15 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Thu, 27 Jun 1996 09:08:15 +0800
Subject: Alternic.net (was domain zapping)
In-Reply-To: <2.2.32.19960626174302.0099dcf8@vertexgroup.com>
Message-ID: <199606261910.PAA03334@jekyll.piermont.com>



John F. Fricker writes:
> What constitutes "real DNS"?

The DNS that everyone on earth but the few hundred loonies use.

The fact that if you put a URL on the side of a bus using one of
"alternic"'s alleged domain names in it, no one on earth will be able
to read the page. I think that more or less says everything.

> It's that easy! The concept of centralized name resolutions is flawed and
> only exists out of habit. 

Yes, lets have chaos so no one can send anyone else mail because no
two machines share the same idea of the global namespace. It will
reduce the number of messages like yours I have to read.

Perry





From jfricker at vertexgroup.com  Wed Jun 26 18:42:12 1996
From: jfricker at vertexgroup.com (John F. Fricker)
Date: Thu, 27 Jun 1996 09:42:12 +0800
Subject: Alternic.net (was domain zapping)
Message-ID: <2.2.32.19960626174302.0099dcf8@vertexgroup.com>


At 05:54 AM 6/26/96 -0400, you wrote:
>
>William Knowles writes:
>> With all the talk about InterNIC zapping domains, there should be
>> some talk about other registries, Alternic.net : http://www.alternic.net
>> is offering an alpha test for registering new TLD's and the prices
>> are considerably less expensive than the Internic.
>
<snip crap>
>
>They can offer to sell you anything they like, of course, and you can
>pay them, but you don't get anything at all for the money. Domains
>registered with them don't appear in the real DNS.
>
>.pm

Perry,

What constitutes "real DNS"?

DNS server administrators need only add one line to their named.boot file to
resolve .nic hosts.

secondary       nic     204.94.42.1             db.nic


It's that easy! The concept of centralized name resolutions is flawed and
only exists out of habit. 

J.






From sandfort at crl.com  Wed Jun 26 18:46:18 1996
From: sandfort at crl.com (Sandy Sandfort)
Date: Thu, 27 Jun 1996 09:46:18 +0800
Subject: AT&T bans anonymous messages
Message-ID: <2.2.32.19960626194119.007538f8@popmail.crl.com>


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                       SANDY SANDFORT
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

C'punks,

At 11:16 AM 6/26/96 -0700, Rich Graves wrote:

>I see no excuse for the craven "indecency" and "personal 
>information" bits of the AUP, but...

Plausible deniability.  Currently, the majors don't want to
be publicly associated with "naughty" uses of their networks.
The do, however, want the lucrative fees generated by them.
As a result, an enormous market niche has come open for
"resellers" of 900/976 services.  The majors can say, "We
don't offer our services to THOSE types of services, but we
are powerless to stop our resellers from doing that sort of
business."  The same rational applies to the Internet.


 S a n d y

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From mccoy at communities.com  Wed Jun 26 18:54:11 1996
From: mccoy at communities.com (Jim McCoy)
Date: Thu, 27 Jun 1996 09:54:11 +0800
Subject: Alternic.net (was domain zapping)
Message-ID: <v02140b02adf75a42eda3@[205.162.51.35]>


John Fricker writes:
> At 05:54 AM 6/26/96 -0400, Perry wrote:
[...regarding alternte registries...]
> >
> >They can offer to sell you anything they like, of course, and you can
> >pay them, but you don't get anything at all for the money. Domains
> >registered with them don't appear in the real DNS.
>
> What constitutes "real DNS"?

For 99.99999% of the Internet "real DNS" is defined by the root server list
distributed with the most recent version of BIND.

> DNS server administrators need only add one line to their named.boot file to
> resolve .nic hosts.
>
> secondary       nic     204.94.42.1             db.nic
>
> It's that easy!

Sorry, but this only gives you domain name resolution for the .nic TLD, not
the other new top-level domains they want to create or any domains that
alternic is proposing to provide service for.  To do that one needs to add an
appropriate line into the root.cache file (or whatever the root server list
is in your name server setup), at which point you are also trusting alternic
with pointing you properly to any domain they get queried on.

> The concept of centralized name resolutions is flawed and
> only exists out of habit.

It is not just about habit, it is also about trust.  There are alternatives,
but they need to be thought-out much more than this alternic stuff...

jim








From ac at hawk.twinds.com  Wed Jun 26 19:08:11 1996
From: ac at hawk.twinds.com (Arley Carter)
Date: Thu, 27 Jun 1996 10:08:11 +0800
Subject: CIA Fears UmpTeen InfoNukes
In-Reply-To: <199606261549.RAA06484@basement.replay.com>
Message-ID: <Pine.HPP.3.91.960626162546.3893B-100000@hawk.twinds.com>


Do that 100 times and become the top story on Dan Blather News.
"Today the FBI arrested Alex de Joode for trying to break into........" 
Billybob and Algore may even point you out as an example of "the criminal 
element that is running rampant on the Internet that we alone in 
Washington can protect America from."

How's *that* for 15 minutes of fame?  :-)

Cheers:
-arc

Arley Carter
Tradewinds Technologies, Inc.
email: ac at hawk.twinds.com
www: http://www.twinds.com

"Trust me. This is a secure product. I'm from <insert your favorite 
corporation or government agency>."

On Wed, 26 Jun 1996, Alex de Joode 
wrote:

> Mike  sez:
> [..]
> : By the way, there was a thing in the Yahoo/Reuters feed about "attacks"
> : on DoD computers; apparently British police arrested a "hacker" the
> : other day.  Anyway, the article included a claim that there have been
> : 250,000 attempted break-ins on DoD computers over the past year.
> 
> : Does anybody know how they count that?
> 
> 'telnet nsa.gov 25' and you will be added to the count .... 
> --
> 
> 	-AJ-
> 





From jya at pipeline.com  Wed Jun 26 19:34:58 1996
From: jya at pipeline.com (John Young by way of Censored Girls Anonymous <carolann@censored.org>)
Date: Thu, 27 Jun 1996 10:34:58 +0800
Subject: The Reno Text URL.....
Message-ID: <2.2.16.19960626212539.3e8f0c18@primenet.com>


Why, thank you very much for the kewl compliment. 
 
 
May I correct your correction of the URL for addres.txt: it should be "jya"
not "jwa," to read: 
 
 
    http://pwp.usa.pipeline.com/~jya/addres.txt 
 
 
Several c'punks have kindly noted my clumsy typing thumbs by breaking them.

 
 
Regards, 
 
 
Kohn







From tcmay at got.net  Wed Jun 26 19:38:32 1996
From: tcmay at got.net (Timothy C. May)
Date: Thu, 27 Jun 1996 10:38:32 +0800
Subject: Life imitates art (InfoWar, Sunday Times article)
Message-ID: <adf6f94c010210046b30@[205.199.118.202]>


At 4:26 PM 6/26/96, Peter Trei wrote:
>Winn Schwartau is much too modest.

I don't think so. Read on.


>This led me to the most amazing discovery: Winn predicted the
>technologies used in the alleged attacks at least three years ago, in
>the self-published science fiction novel "Terminal Compromise." The text
>of this prescient work can be found on the web at:
...
>If I had predicted the future so well and so far ahead, I'd be shouting
>it from the rooftops, and use the strength of the reputation I'd
>instantly establish to set up shop as a professional prognosticator (for
>fat fees).
>
>I wonder why Winn hasn't bothered to bring this to our attention - and
>I hope that Peter Warren and the editors of the London Sunday Times
>have heard about his astounding foresight.

He _has_ been bringing it to our attention! In fact, he has been shouting
it from the rooftops. He has sponsored at least two "InfoWar" and/or
"InfoWarCon" conferences, including one in Europe and one in the D.C. area.
Robert Steele was a co-sponsor. (There have been many announcements here
and elsewhere on the Net about these conferences; I recall at least one
subscriber of our list went to one of them.)

He also wrote another book, "Information Warfare," and was essentially one
of the main folks interviewed in a BBC special called "The I-Bomb"
(Information Bomb), shown recently on A&E in the U.S. (I had about a minute
or so on this show, much to my regret.)

I have my doubts about "HERF" attacks being current realities, for various
reasons (some of which I wrote about in a recent post here), and I have a
few other doubts, but I certainly don't think Schwartau is being coy about
his involvement in this whole thing.

Whether it is hype to sell conference attendance seats, or to sell
consulting work, or is real, or is partly real, or is imagined....well, I
don't know.

I suspect the recent riding of this bandwagon by Deutch and Perry is easily
understandable: anything that triggers fear and uncertainty is good for
those seeking more control of cyberspace.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From Clay.Olbon at dynetics.com  Wed Jun 26 19:42:06 1996
From: Clay.Olbon at dynetics.com (Clay Olbon II)
Date: Thu, 27 Jun 1996 10:42:06 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <ADF71F69-19B1582@193.239.225.200>


Mike M Nally wrote:

>By the way, there was a thing in the Yahoo/Reuters feed about "attacks"
>on DoD computers; apparently British police arrested a "hacker" the
>other day.  Anyway, the article included a claim that there have been
>250,000 attempted break-ins on DoD computers over the past year.
>
>Does anybody know how they count
that?
>
>______c____________________________________________________________________
_
>Mike M Nally * Tiv^H^H^H IBM * Austin TX    * pain is inevitable  
>       m5 at tivoli.com * m101 at io.com          *
>      <URL:http://www.io.com/~m101>         * suffering is optional
>

Probably the same way other things are counted when used to make a
political point (# of homeless people, # of date rape victims, etc.).  Make
a wild-ass guess based on a very small sample, then multiply by a factor of
10 or 100.  I think lying with statistics has become a national pastime
recently.  I tend to not trust numbers issued by folks who stand to gain
from the use of the numbers.

	Clay

***************************************************************************
Clay Olbon II       *      Clay.Olbon at dynetics.com
Systems Engineer    *    PGP262 public key on web page
Dynetics, Inc.      * http://www.msen.com/~olbon/olbon.html
***************************************************************** TANSTAAFL






From ceridwyn at wolfenet.com  Wed Jun 26 19:47:16 1996
From: ceridwyn at wolfenet.com (Cerridwyn Llewyellyn)
Date: Thu, 27 Jun 1996 10:47:16 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <2.2.32.19960626213301.006951b4@gonzo.wolfenet.com>


At 08:32 AM 6/26/96 Mike McNally wrote:

>By the way, there was a thing in the Yahoo/Reuters feed about "attacks"
>on DoD computers; apparently British police arrested a "hacker" the
>other day.  Anyway, the article included a claim that there have been
>250,000 attempted break-ins on DoD computers over the past year.
>Does anybody know how they count that?

Nope, especially since they claimed a large percentage of those attacks
went "unnoticed".  I fail to see how they can know they happened if they
went unnoticed.  They also neglected to mention exactly what consitutes 
an "attack" or breakin attempt.  Some people far more cynical than the
average sheep would claim that report was used as a tool to justify new
massive expenditures to congress and the public.  //cerridwyn//






From jfricker at vertexgroup.com  Wed Jun 26 19:47:39 1996
From: jfricker at vertexgroup.com (John F. Fricker)
Date: Thu, 27 Jun 1996 10:47:39 +0800
Subject: Alternic.net (was domain zapping)
Message-ID: <2.2.32.19960626214217.00674520@vertexgroup.com>


At 01:39 PM 6/26/96 -0400, you wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>An entity claiming to be William Knowles wrote:
>: 
>: With all the talk about InterNIC zapping domains, there should be
>: some talk about other registries, Alternic.net : http://www.alternic.net
>: is offering an alpha test for registering new TLD's and the prices
>: are considerably less expensive than the Internic.
>: 
>
>ALTERNIC.NIC is a couple of kids with a few Linux boxes.  It's rather amusing,
>but they did go through a lot of trouble to make it look good.  Sure,
>the new TLD's work if you use their name server.
>
>I thought about actually registering NSA.TEL and MCI.ATT with them for
>shits and giggles.  I love the TLD's they have ... BSA, XXX, CAT, DOG ...
>it was a good laugh, but it's way past April 1st.
>

Well, Karl's IETF draft is certainly serious. A Karl is a bit more than a
kid with a linux box having started one of the largest ISPs in Chicago and
being a component in the anti CIX fiasco.

I still fail to see why decentralizing control of namespace is a bad idea.







From wb8foz at nrk.com  Wed Jun 26 19:55:29 1996
From: wb8foz at nrk.com (David Lesher)
Date: Thu, 27 Jun 1996 10:55:29 +0800
Subject: CIA Fears UmpTeen InfoNukes
In-Reply-To: <31D13BF9.467A@vail.tivoli.com>
Message-ID: <199606262141.RAA03491@nrk.com>


> By the way, there was a thing in the Yahoo/Reuters feed about "attacks"
> on DoD computers; apparently British police arrested a "hacker" the
> other day.  Anyway, the article included a claim that there have been
> 250,000 attempted break-ins on DoD computers over the past year.
> 
> Does anybody know how they count that?

Pings & smtp verifies seem to be included in their counting.....


-- 
A host is a host from coast to coast.................wb8foz at nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433





From furballs at netcom.com  Wed Jun 26 21:18:43 1996
From: furballs at netcom.com (Paul S. Penrod)
Date: Thu, 27 Jun 1996 12:18:43 +0800
Subject: CIA Fears UmpTeen InfoNukes
In-Reply-To: <ADF71F69-19B1582@193.239.225.200>
Message-ID: <Pine.3.89.9606261638.A9173-0100000@netcom>




On 26 Jun 1996, Clay Olbon II wrote:

> 
> Probably the same way other things are counted when used to make a
> political point (# of homeless people, # of date rape victims, etc.).  Make
> a wild-ass guess based on a very small sample, then multiply by a factor of
> 10 or 100.  I think lying with statistics has become a national pastime
> recently.  I tend to not trust numbers issued by folks who stand to gain
> from the use of the numbers.
> 
> 	Clay
> 

Lying with statistics probably started with the invention of the same. 
Mark Twain put it best:

"There are lies, damn lies, and statistics"

:-)

...Paul






From hallam at Etna.ai.mit.edu  Wed Jun 26 21:50:43 1996
From: hallam at Etna.ai.mit.edu (hallam at Etna.ai.mit.edu)
Date: Thu, 27 Jun 1996 12:50:43 +0800
Subject: Noise: Re: Those Evil Republicans
In-Reply-To: <31D104C6.62319AC4@systemics.com>
Message-ID: <9606262325.AA25647@Etna.ai.mit.edu>



Jersey and the Isle of Man are not independent soverign nations. The
Manx parliament is subordinate to the English Privy Council and Jersey
is similarly an anachronism. Andora is ruled jointly by the French President
and a Spanish Bishop (or is it the other way round?).

Fogive my skepticism but I don't think that any ecconomist would seriously
suggest these as usefull models for modern industrial societies. The chief
industries being parasitic on those of larger nations.

There are political solutions to the problem of regulation being factored 
down to the lowest common denominator. That is the purpose of the Social
Chapter (nee charter) of the EU Maastricht agreement. The next round of
GATT is likely to contain similar requirements.

		Phill





From markm at voicenet.com  Thu Jun 27 00:02:53 1996
From: markm at voicenet.com (Mark M.)
Date: Thu, 27 Jun 1996 15:02:53 +0800
Subject: Alternic.net (was domain zapping)
In-Reply-To: <v02140b02adf75a42eda3@[205.162.51.35]>
Message-ID: <Pine.LNX.3.94.960626220042.157A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 26 Jun 1996, Jim McCoy wrote:

> John Fricker writes:
> 
> > DNS server administrators need only add one line to their named.boot file to
> > resolve .nic hosts.
> >
> > secondary       nic     204.94.42.1             db.nic
> >
> > It's that easy!
> 
> Sorry, but this only gives you domain name resolution for the .nic TLD, not
> the other new top-level domains they want to create or any domains that
> alternic is proposing to provide service for.  To do that one needs to add an
> appropriate line into the root.cache file (or whatever the root server list
> is in your name server setup), at which point you are also trusting alternic
> with pointing you properly to any domain they get queried on.

A better way is to add the nameserver data file distributed by alternic and
adding it to primary nameserver data.  The file that the alternic distributes
does not have any root level servers defined (except the ones distributed by
the Internic) so there isn't much trust involved.

> 
> > The concept of centralized name resolutions is flawed and
> > only exists out of habit.
> 
> It is not just about habit, it is also about trust.  There are alternatives,
> but they need to be thought-out much more than this alternic stuff...

I don't see trust as being much of a factor on the user-end.  The only people
that really need to trust alternic are the people who have domain names
registered with them.  If the alternic starts screwing with its nameserver
data, this will just cause them a severe loss of reputation without any gain.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"Freedom is the freedom to say that two plus two make four.  If that
is granted, all else follows."  --George Orwell, _1984_


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMdHtXrZc+sv5siulAQE+vwP9GXJFC5YOpSgLCYW2hLklljC6IYJfyYSP
QZDBoDdPgWjVzgCIx8v2XEyTxd7GSoGZHVk8eYy8lqsKRGBVaXoAJhSGHu2RQnGv
5DW6kFE0/CcsDhYbgcqzoHSdNb67elT8Nei/bUanSXRIkBgXA2bC0VEF0/pGeGtW
Xd0zrZLtPnY=
=Xids
-----END PGP SIGNATURE-----





From declan at well.com  Thu Jun 27 00:06:17 1996
From: declan at well.com (Declan McCullagh)
Date: Thu, 27 Jun 1996 15:06:17 +0800
Subject: Bruce Taylor at HotWired
Message-ID: <v01510104adf7b1cd7bca@[204.62.128.229]>


This is going to be an interesting chat. It will be the first time in my
recollection that a supporter of the CDA has ventured onto the Net to
defend it.

Taylor, of course, is the principal author of the CDA as the president of
the National Law Center for Children and Families. A former Justice
Department porn-prosecutor with a record number of convictions ("Comstock
was an amateur"), he'll be talking about what the DoJ is thinking and what
their plans are. (He's argued obscenity cases before the Supreme Court.)

But for such a net-basher, he's pretty cyberclueless. Since Taylor doesn't
even have email, let alone a live net-connection, he's coming over to my
office tomorrow evening and we'll connect to HotWired from my Macintosh.

"Hide your porn," he reminded me.

I plan to.

-Declan



Info on Taylor's CDA amicus brief supporting the Justice Department:
  http://fight-censorship.dementia.org/dl?num=2388

The text of Taylor's amicus brief:
 http://fight-censorship.dementia.org/dl?num=2736




>Attorney Lance Rose, originally scheduled for the HotWired Electronic
>Frontiers Forum this Thursday night, June 27 (probably TODAY as you read
>this...), could not make it, however in his place we've extended an
>11th-hour invitation to Bruce Taylor of the National Law Center for Children
>and Families, and he's accepted.  Please join us!
>
>(Requires that you join HotWired)
>
>javachat at http://talk.wired.com
>or
>telnet to talk.wired.com
>
>
>--
>Jon Lebkowsky <jonl at hotwired.com>                 http://www.well.com/~jonl
>Electronic Frontiers Forum, 6PM PDT Thursdays  <http://www.hotwired.com/eff>







From jonl at well.com  Thu Jun 27 00:06:23 1996
From: jonl at well.com (Jon Lebkowsky)
Date: Thu, 27 Jun 1996 15:06:23 +0800
Subject: Bruce Taylor at HotWired
Message-ID: <199606270208.TAA29471@mh1.well.com>


Attorney Lance Rose, originally scheduled for the HotWired Electronic
Frontiers Forum this Thursday night, June 27 (probably TODAY as you read
this...), could not make it, however in his place we've extended an
11th-hour invitation to Bruce Taylor of the National Law Center for Children
and Families, and he's accepted.  Please join us!

(Requires that you join HotWired)

javachat at http://talk.wired.com
or
telnet to talk.wired.com


--
Jon Lebkowsky <jonl at hotwired.com>                 http://www.well.com/~jonl
Electronic Frontiers Forum, 6PM PDT Thursdays  <http://www.hotwired.com/eff>  






From elam at art.net  Thu Jun 27 00:36:07 1996
From: elam at art.net (Lile Elam)
Date: Thu, 27 Jun 1996 15:36:07 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <199606270238.TAA25847@art.net>


When I saw this article in the paper early this morning (like 1am)
on nando.net, I just couldn't beleave it....

When did hackers become a threat? I thought that hackers were a 
national resource! 

It sounds like these gov folks are concerned about how much
hackers know how things work... which is probably more than
they do. Didn't hackers build the Internet? :)

I just blew the article off as noise. I just can't waist 
energy on such rubbish.

-lile





From stend at grendel.austin.texas.net  Thu Jun 27 00:36:19 1996
From: stend at grendel.austin.texas.net (Firebeard)
Date: Thu, 27 Jun 1996 15:36:19 +0800
Subject: Zimmermann's Senate testimony
In-Reply-To: <199606251539.PAA01255@maalox>
Message-ID: <199606270324.WAA04246@grendel.austin.texas.net>


-----BEGIN PGP SIGNED MESSAGE-----


	Um, color me paranoid, but...  Has this been independently
verified that this _is_ Mr Zimmermann's testimony?  If there is
anyone's messages that I'm suspicious of if they are un-PGP-signed,
it's Mr Zimmermann's.

- -- 
#include <disclaimer.h>                               /* Sten Drescher */
ObCDABait:      For she doted upon their paramours, whose flesh is as the
flesh of asses, and whose issue is like the issue of horses.  [Eze 23:20]
Unsolicited solicitations will be proofread for a US$100/page fee.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQEVAwUBMdH+1S+2V9GxYWz1AQE7Cwf+MMLkXYqNiw94ywf3p7kHLQOOzmowKLSG
QntDXI7AL8go4jE9y6wHKMAwZSEb5BAMaJaHX1M2MRKpkfO0eIII5vfJ7bJmPwEx
/bAL9JVV6vxRRB/7yyN2tIR4Ot3Saurb6AJ2eCudz2k6zaGosEsgVxTUnWxx/6Ou
SCxhtCpNXwNJc6nHGgsOOR6wEV+hm/hzOn1h100VLXm7Rs/cBC15f9XPOYw06A6N
vmymtu26MLY0dPo7nU+s2JJK1WqdmKRyjPjL/3tF1tTCrk8ifE7Ov6G/z5Yhxb4X
E0SuBLU/vRVUYoTbgTiiB12vpWr3SVp+79eX+dtRE/HQOzfwxpoemA==
=ajuN
-----END PGP SIGNATURE-----





From froomkin at law.miami.edu  Thu Jun 27 00:50:57 1996
From: froomkin at law.miami.edu (Michael Froomkin)
Date: Thu, 27 Jun 1996 15:50:57 +0800
Subject: Fortezza now comes on an ISA card
Message-ID: <Pine.SUN.3.94.960626232821.25871B-100000@viper.law.miami.edu>


http://www.rnbo.com/PROD/FORTEZZA_ISA.HTM

This may be old news, but it was new to me.

Note the "extra" features, including a new approach to "secure 
timestamping".

A. Michael Froomkin        | +1 (305) 284-4285; +1 (305) 284-6506 (fax)
Associate Professor of Law | 
U. Miami School of Law     | froomkin at law.miami.edu
P.O. Box 248087            | http://www.law.miami.edu/~froomkin
Coral Gables, FL 33124 USA | It's hot here.  And humid.






From declan at hotwired.com  Thu Jun 27 01:07:17 1996
From: declan at hotwired.com (Declan McCullagh)
Date: Thu, 27 Jun 1996 16:07:17 +0800
Subject: HotWired: Crypto Switch in DC
Message-ID: <v0151010aadf7bb1cab7b@[204.62.128.229]>


http://www.hotwired.com/netizen/

Crypto Switch?

By Brock N. Meeks
Washington, DC, 26 June 1996

   Advocates for the use of encryption free of government mandates
   packed a Senate hearing room to overflowing today in support of a
   pro-encryption bill. But as no detractors were asked to testify at the
   hearing, this was all preaching to the crypto choir.

   What even the preachers and choir are unaware of, however, is that a
   senior White House official is quietly trying to turn the
   administration away from its lock-step allegiance to the FBI and
   National Security Agency rhetoric of "strong crypto bad; key escrow
   good."

   This official told Dispatch: "I'm hoping to develop a [consensus
   movement] inside the administration that will stand up to some of the
   [law enforcement and intelligence agency] interests" on encryption.
   "We haven't found the right encryption policy yet," the official
   noted.

   Here, for the first time, there's real hope that the administration
   can be swayed from its wholesale support for the key-escrow encryption
   scheme. "The government moves on its own," the White House source
   said. There are "shifting sands on things ... policies change," and
   there's the "potential that the administration's position will change
   over time."

   So what we have, of course, is the classic Washington public-private
   squeeze play: Push an issue in public, and push even harder in
   private.

   Today, the Senate's newest wired member and the chairman of the Senate
   Science Subcommittee hearing, Conrad Burns (R-Montana), welcomed
   testimony from crypto experts in support of his previously introduced
   pro-encryption bill, the Commerce Online in the Digital Era Act of
   1996, dubbed "Pro-CODE." Burns called the hearing a historic event in
   that it was the first time a Senate hearing had been wired to the Net.

   Several senators knocked the White House for supporting encryption
   policies that essentially hogtie US businesses, locking them out of a
   lucrative international market. Others made reference to potential
   dangers of empowering government agencies, such as the FBI, with the
   ready ability to snoop on the private speech of citizens.

   Senator John Ashcroft (R-Missouri) noted how the "events of the this
   last week or two" - namely, the political flap resulting from the
   White House inspection of FBI background files - "brings into sharp
   focus" the need to assure Americans that their private speech won't be
   compromised. "I want to be sure we don't forfeit what it means to be
   an American citizen," Ashcroft said.

   Jerry Berman, executive director of the Center for Democracy and
   Technology, put a finer point on the issue: "We don't want the
   Internet to become the ultimate FBI background file on everyone."

   Although the panelists admitted that law enforcement has a legitimate
   concern about criminals being able to use encryption techniques to
   subvert investigations, they also noted that such concerns had to be
   balanced with constitutional rights.

   Marc Rotenberg, executive director for the Electronic Privacy
   Information Center, responding to a question about whether "secret
   speech" should be given the same protection as public speech, said
   that there's no doubt that encrypted speech should be awarded the same
   protection as public speech. However, Rotenburg cautioned, "the courts
   have to be educated first," as they were during the recent case in
   which the Communications Decency Act was deemed unconstitutional.

   And so went the show. No fireworks; then again, none were expected.

   And while the hearing finally allowed the pro-crypto camp a chance to
   spout off to Congress, it was really only a steppingstone to future
   efforts. The reason? Even the hard-core crypto advocates privately
   admit that this legislation doesn't have a prayer of passing, given a
   cramped legislative calendar and election-year rhetoric.

###







From nobody at REPLAY.COM  Thu Jun 27 01:10:10 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Thu, 27 Jun 1996 16:10:10 +0800
Subject: Grubor remailer? (Was Re: Lucifer remailer)
Message-ID: <199606270317.FAA27361@basement.replay.com>


Hm, is that Dr. John Grubor's domain (aga at dhp.com)?

That will make a nice anonymous remailer... NOT! Thank you.

By the way: is there a way in premail to disable a certain remailer
altogether so that it will never be used in chains? There is one
candidate now... <chuckle>


lucifer wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> I have just finished setting up a Mixmaster and cpunk remailer at
> lucifer at dhp.com.  The PGP key and Mixmaster key are below.
> 
> lucifer lucifer at dhp.com 6e57353149a1175f11aba72cedee02fd 2.0.3
> 
> - -----Begin Mix Key-----
> 6e57353149a1175f11aba72cedee02fd
> 258
> AATvJVbP8R9tUF6R9zjSbRdDaz2j1INJvkVI6L6I
> 5F65Q7lRCoOl8+TCi+HgUo1AErYsLPpHpI1l4F9I
> RUqvH/fvR7GuqgIJc+RsGyQPPG0dpL5lHt2ppdmW
> wcTX85ZKRK242SW1hTih43IaCmXr+i1zX6+QZsr1
> MtAqwDlyDgoU0QAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> AAAAAAAAAAAAAAAAAAAAAQAB
> - -----End Mix Key-----
> 
> 
> - -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: 2.6.2
> 
> mQCNAzHPdZkAAAEEAK3rI5oq3dwDV5inleitjy03JvhBD/GtbRRDO1noLUnRf4FV
> CmCfGJrqitHtIBqhA+hIRBcNRo7J48Yiu6ctda29xe/rEy3QdSKHpZhstsV+hzw3
> 42Lhogm1cW2QPrvjJQUgU5mpKR9qKn7KQLBcVz/Mx1EvX4aMGJ2oJ1gRbIg5AAUR
> tCRBbm9ueW1vdXMgcmVtYWlsZXIgPGx1Y2lmZXJAZGhwLmNvbT6JAJUDBRAxz3vx
> nagnWBFsiDkBAfUAA/9ufh0GPUo6uR4/5/tbbFKyQs8fW0NmDkrU+xni7QNmKKUj
> qC7lJ/MHPxRGzuXaYE+k9I8NmI1DxyzdWlRX/X6uwcwYPOxa/+CI9HUAkcB/Q/N8
> GZJckumcU7hlMim08lFJQjsEWxNyqKefAeOAKQ5v5xt3rmpPDmHrXbOuJ104Ng==
> =dFZY
> - -----END PGP PUBLIC KEY BLOCK-----
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
> 
> iQCVAwUBMdFhcZ2oJ1gRbIg5AQGqSwP9HzVjkvkN4oBIHh5AzvsKZoZG+zMvId7Z
> +LlvpSOSyXm+Vaxga28jBL03JIN8j6+yJtZy1h07VlYYwnhhBrhnIufeq+mO+ea6
> k/ymFcUFsfM4jnf5jvaHKJTMULnmL3wspWzBKl3CRkQ2e238ozx8IWdhTxxdD9vj
> aO3vQZHHFTI=
> =/ICd
> -----END PGP SIGNATURE-----
> 






From declan at well.com  Thu Jun 27 01:16:52 1996
From: declan at well.com (Declan McCullagh)
Date: Thu, 27 Jun 1996 16:16:52 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <v01510108adf7b97d4a23@[204.62.128.229]>


You should believe it. Take it seriously. Your elected Congressperns do.

In a nice twist, the threat of darkside hackers has emerged as one of the
best arguments for Sen. Burns' Pro-CODE legislation.

At today's hearing, it was clear that we needed the legislation to encrypt
the net-infrastructure and prevent it from being ripped apart by
terrorists. Security through strong crypto, I say, and paint Janet Reno as
a friend of and apologist for those evil hackers.

-Declan




>When I saw this article in the paper early this morning (like 1am)
>on nando.net, I just couldn't beleave it....
>
>When did hackers become a threat? I thought that hackers were a
>national resource!
>
>It sounds like these gov folks are concerned about how much
>hackers know how things work... which is probably more than
>they do. Didn't hackers build the Internet? :)
>
>I just blew the article off as noise. I just can't waist
>energy on such rubbish.
>
>-lile







From molecul1 at molecule1.com  Thu Jun 27 02:12:49 1996
From: molecul1 at molecule1.com (Molecule One Scientific Research Institute)
Date: Thu, 27 Jun 1996 17:12:49 +0800
Subject: this 1 seeking koool..................
Message-ID: <m0uZ9sh-0009WnC@powergrid.electriciti.com>


Peace & tranquil wishes y'all,

   This 1 seeking koool, artistic, creative, farout webdesign person
in S.D. area. Creative 1's can e.................. 2 above email address.
Serious, creative, farout, artistic types only please. Gender no prob.
   Peace & super koool wishes.
                                                                            
               Keep koool,
                                                                            
                             M1.






From mab at crypto.com  Thu Jun 27 04:02:21 1996
From: mab at crypto.com (Matt Blaze)
Date: Thu, 27 Jun 1996 19:02:21 +0800
Subject: My testimony at Wednesday's Senate hearing on encryption policy
Message-ID: <199606270502.BAA19188@crypto.com>


WRITTEN TESTIMONY OF DR. MATTHEW BLAZE

BEFORE THE SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION,
SUBCOMMITTEE ON SCIENCE, TECHNOLOGY, AND SPACE

JUNE 26, 1996


Thank you for the opportunity to speak with you about the technical
impact of encryption policy.  It is a privilege to be here, and I
hope my perspective will be useful to you.

Let me begin by describing my own background and biases.  I am a
Principal Research Scientist in the area of computer security and
cryptology at AT&T Research in Murray Hill, New Jersey.  I also
hold a number of ancillary appointments related to computer security;
among others, I teach an occasional graduate course in the subject
at Columbia University, and I serve as co-chair of the Federal
Networking Council Advisory Committee subcommittee on security and
privacy (which advises Federal agencies on computer networking
issues).  However, the views I am presenting here today are my own,
and should not be taken to represent those of any organization with
which I happen to be affiliated.

I am a computer scientist by training; my Ph.D. is from the Princeton
University Computer Science department, and my primary research
areas are cryptology, computer security, and large-scale distributed
systems.  Much of my research focuses on the management of encryption
keys in networked computing systems and understanding the risks of
using cryptographic techniques to accomplish security objectives.
Recent government initiatives in encryption, such as the "Clipper
Chip," have naturally been of great interest to me, in no small
part because of the policy impact they have on the field in which
I work, but also because they present a number of very interesting
technical and scientific challenges in their own right.

My testimony today focuses on three areas.  First, I will discuss
the role and risks of cryptographic techniques for securing the
current and future electronic world.  Next, I will examine in more
detail the security implications of the limitations imposed on
US-based cryptographic systems through the government's export
policies.  Finally, I will discuss the technical aspects of the
Administration's current approach to cryptography policy, which
promotes "key escrow" systems.


I  THE INCREASING IMPORTANCE OF ENCRYPTION

The importance of cryptographic techniques for securing modern
computer and communications systems is widely recognized today.
Evidence of the scope of  this recognition can be found in the
increasing number of hardware, software, and system vendors that
offer encryption in their products, the increasing demand for
high-quality encryption by users in a widening array of applications,
and the growing, thriving community of cryptologic researchers of
which I am a part.  It is vital that those who formulate our nation's
policies and official attitude toward encryption understand the
nature of the underlying technology and the reasons for its growing
importance to our society.

The basic function of cryptography is to separate the security of
a message's content from the security of the medium over which it
is carried.  For example, we might encrypt a cellular telephone
conversation to guard against eavesdroppers (allowing the call to
be transmitted safely over easily-intercepted radio frequencies),
or we might use encryption to verify that documents, such as
contracts, have not been tampered with (removing the need to
safeguard a copy of the original).  The idea that this might be
possible is not a new one; history suggests that the desire to
protect information is almost as old as the written word itself.
Perhaps as a consequence of the invention of the digital computer,
our understanding of the theory and practice of cryptography has
accelerated in recent years, with a number of new techniques
developed and many new applications emerging.  Among the most
important of the recent techniques is "public key cryptography."
It allows secure messages to be exchanged without the need

Modern cryptographic techniques are based on the application of
simple, if repetitive,  mathematical functions, and as such lend
themselves nicely to implementation by computer programs.  Any
information that can be represented digitally can be protected by
encryption, including computer files, electronic mail messages,
and even audio and video signals such as telephone calls, radio,
and television.  Encryption can be performed by means of software
on general-purpose computers, through special-purpose hardware, or
by special programming of microprocessor-based electronic products
such as the next generation of cellular telephones.  The basic cost
of encryption in terms of computational power required is quite
low, and the marginal cost of including encryption in a software-based
computer program or a programmable electronic product is essentially
zero.

Why, then, has encryption recently enjoyed so much attention?  The
reasons can be found from two perspectives: the technology of modern
communication systems, and the new purposes for which we are relying
on digital information.

First, the technology and economics of modern communications and
computing systems strongly favors media that have little inherent
security.  For example, wireless telephones have great advantages
in convenience and functionality compared with their familiar wired
counterparts and are comprising an increasing proportion of the
telephone network.  This also makes eavesdropping much easier for
curious neighbors, burglars identifying potential targets, and
industrial spies seeking to misappropriate trade secrets.  Similarly,
decentralized computer networks such as the Internet have lower
barriers to entry, are much less expensive, are more robust and
can be used to accomplish a far greater variety of tasks than the
proprietary networks of the past, but, again, at the expense of
intrinsic security.  The Internet makes it virtually impossible to
restrict, or even predict, the path that a particular message will
traverse, and there is no way to be certain where a message really
originated or whether its content ha

Second, electronic communication is becoming increasingly critical
to the smooth functioning of our society and our economy and even
to protect the safety of human life.  Communication networks and
computer media are rapidly replacing less efficient, traditional
modes of interaction whose security properties are far better
understood.  As teleconferencing replaces face-to-face meetings,
electronic mail replaces letters, electronic payment systems replace
cash transactions, and on-line information services replace written
reference materials, we gain a great deal in efficiency, but our
assumptions about the reliability of very ordinary transactions
are often dangerously out-of-date.

Put another way, the trend in communication and computing networks
has been away from closed systems in favor of more open ones and
the trend in our society is to rely on these new systems for
increasingly serious purposes.  There is every reason to believe
that these trends will continue, and even accelerate, for the
foreseeable future.  Cryptography plays an important and clear role
in helping to provide security assurances that at least mirror what
we have come to expect from the older, more familiar communications
methods of the not-so-distant past.


II  KEY LENGTH AND SECURITY

The "strength" of an encryption system depends on a number of
variables, including the mathematical properties of the underlying
encryption function, the quality of the implementation, and the
number of different "keys" from which the user is able to choose.
It is very important that a cryptosystem and its implementation be
of high quality, since an error or bug in either can expose the
data it protects to unexpected vulnerabilities.  Although the
mathematics of cryptography is not completely understood and cipher
design is an exceptionally difficult discipline (there is as yet
no general "theory" for designing cipher functions), there are a
number of common cipher systems that have been extensively studied
and that are widely trusted as building blocks for secure systems.
The implementation of practical systems out of these building
blocks, too, is a subtle and difficult art, but commercial experience
in this area is beginning to lead to good practices for adding
high-quality encryption systems to software

The most easily quantified variable that contributes to the strength
of an encryption system is the size of the pool of potential values
from which the cryptographic keys are chosen.  Modern ciphers depend
on the secrecy of the users' keys, and a system is considered
well-designed only if the easiest "attack" involves trying every
possible key, one after the other, until the correct one is found.
The system is secure only if the number of keys is large enough to
make such an attack infeasible.  Keys are usually specified as a
string of "bits," and adding one bit to the key length doubles the
number of possible keys.  An important question, then, is the
minimum key length sufficient to resist a key search attack in
practice.

Last November, I participated in a study, organized by the Business
Software Alliance, aimed at examining the computer technology that
might be used by an "attacker" in order to determine the minimum
length keys that should be used in commercial applications.  We
followed an unusually conservative methodology in that we assumed
that the attacker would have only available standard "off-the-shelf"
technology and is constrained to purchase in single-unit quantities
with no economies of scale.  That is, our methodology would tend
to produce a recommendation for shorter keys than would an analysis
using the more conventional approach of giving the potential attacker
every benefit of the doubt in terms of technological advantages he
might enjoy.  Nonetheless, we concluded that the key lengths
recommended in existing U.S. government standards (e.g., the Data
Encryption Standard, with a 56-bit key) for domestic use are far
too short and will soon render data protected under them vulnerable
to attack with only modest

Attempting to design systems "at the margins" by using the minimum
key length needed is a dubious enterprise at best.  Because even
a slight miscalculation as to the technology and resources available
to the potential attacker can make the difference between a secure
system and an insecure one, prudent designers specify keys that
are longer than the minimum they estimate is needed to resist
attack, to provide a margin for error.

Current U.S. policy encourages the designers of encryption systems
to take exactly the opposite approach.  Encryption systems designed
for export from the United States at present generally must use
keys no more than 40 bits long.  Such systems provide essentially
no cryptographic security, except against the most casual "hacker."
Examples of 40 bit systems being "broken" through the use of spare
computer time on university computer networks are commonplace.
Unfortunately, it is not only users outside the U.S. who must make
do with the inferior security provided by such short keys.  Because
of the difficulty of maintaining  multiple versions of software,
one for domestic sale and one for export, and the need for common
interoperability standards, many US-based products are available
only with export-length keys.

There is no technical, performance, or economic benefit to employing
keys shorter than needed.  Unlike, for example, the locks used to
protect our homes, very secure cryptographic systems with long keys
are no more expensive to produce or any harder to design or use
than weaker systems with shorter keys.  The only reason vendors
design systems with short keys is to comply with export requirements.

The key length figures and analysis in this section are based on
so-called "secret key" cryptosystems.  For technical reasons,
current public key cryptosystems employ much longer keys than secret
key systems to achieve equivalent security (public keys are measured
in hundreds or thousands of bits).  However, virtually all systems
that use public key cryptography also rely on secret key cryptography,
and so the overall strength of any system is limited by the weakest
encryption function and key length in it.


III  THE RISKS OF KEY ESCROW

A number of recent Administration initiatives have proposed that
future cryptosystems include special "key escrow" provisions to
facilitate access to encrypted data by law enforcement and intelligence
agencies.  In a such systems, copies of keys are automatically
deposited, in advance, with third parties who can use them to
arrange for law enforcement access if required in the future.
Several key escrow systems have been proposed by the Administration,
differing in the details of how keys are escrowed, and who the
third party key holders are.  In the first proposal, called the
"Clipper chip," the system is embedded in a special tamper-resistant
hardware-based cryptosystem and copies of keys are held by federal
agencies.  In the more recent "public key infrastructure" proposal,
keys are escrowed at the time a new public key is generated and
are held by the organization (public or private) responsible for
certification of the public key.

Although the various key escrow proposals differ in the details of
how they accomplish their objective, there are a number of very
serious fundamental problems and risks associated with all of them.

There are some appropriate commercial applications of key escrow
techniques.  A properly designed cryptosystem makes it essentially
impossible to recover encrypted data without the correct key.  This
can be a double-edge sword; the cost of keeping unauthorized parties
out is that if keys are lost or unavailable at the time they are
needed, the owner of encrypted data will be unable to make use of
his own information.  This problem, of balancing  secrecy with
assurances of continued availability, remains an area of active
research, and commercial solutions are starting to emerge.  The
Administration's initiatives do not address this problem especially
well, however.

The first problem with key escrow is the great increase in engineering
complexity that such systems entail.  The design and implementation
of even the simplest encryption systems is an extraordinarily
difficult and delicate process.  Very small changes can introduce
fatal security flaws that often can be exploited by an attacker.
Ordinary (non-escrowed) encryption systems have conceptually rather
simple requirements (for example, the secure transmission of data
between two parties) and yet, because there is no general theory
for designing them, we still often discover exploitable flaws in
fielded systems.  Key escrow renders even the specification of the
problem itself far more complex, making it virtually impossible to
assure that such systems work as they are intended to.  It is
possible, even likely, that lurking in any key escrow system are
one or more design weaknesses that allow recovery of data by
unauthorized parties. The commercial and academic world simply does
not have the tools to analyze or des

Key escrow is so difficult that even systems designed by the
classified world can have subtle problems that are only discovered
later.  In 1994 I discovered a new type of "protocol failure" in
the Escrowed Encryption Standard, the system on which the Clipper
chip is based.  The failure allows, contrary to the design objectives
of the system, a rogue user to circumvent the escrow system in a
way that makes the data unrecoverable by the government.  Others
weaknesses have been discovered since then that make it possible,
for example, to create incriminating messages that appear to have
originated from a particular user.

It should be noted that these weaknesses have been discovered in
spite of the fact that most of the details of the standard are
classified and were not included in the analysis that led to the
discovery of the flaws.  But these problems did not come about
because of incompetence on the part of the system's designers.
Indeed, the U.S. National Security Agency is likely the most advanced
cryptographic enterprise in the world, and is justifiably entrusted
with developing the cryptographic systems that safeguard the
government's most important military and state secrets.  The reason
the Escrowed Encryption Standard has flaws that are still being
discovered is that key escrow is an extremely difficult technical
problem, with requirements unlike anything previously encountered.

A second problem with key escrow arises from the difficulty of
operating a key escrow center in a secure manner.   According to
the Administration (for example, see the May 20, 1996 White House
draft report "Enabling Privacy, Commerce, Security and Public Safety
in the Global Information Infrastructure"), key escrow centers must
be prepared to respond to law enforcement requests for escrowed
data 24 hours a day, completing transactions within two hours of
receiving each request.  There are thousands of law enforcement
agencies in the United States authorized to perform electronic
surveillance, and the escrow center must be prepared to identify
and respond to any of them within this time frame.  If the escrow
center is also a commercial operation providing data recovery
services, it may also have tens of thousands of additional private
sector customers that it must be prepared to serve and respond to.
There are few, if any, secure systems that operate effectively on
such a scale and under such tightly-constr

A third problem with the Administration's key escrow proposals is
that they fail to distinguish between cryptographic keys for which
recovery might be required and those for which recoverability is
never needed.  There are many different kinds of encryption keys,
but for the purposes of discussing key escrow it is sufficient to
divide keys into three categories.  The first includes keys used
to encrypt stored information, which must be available throughout
the lifetime of the data.  The owner of the data has an obvious
interest in ensuring the continued availability of such keys, and
might choose to rely on a commercial service to store "backup"
copies of such keys.  A second category of key includes those used
to encrypt real-time communications such as telephone calls.  Here,
the key has no value to its owner once the transaction for which
it was used has completed.  If a key is lost or destroyed in the
middle of a conversation, a new one can be established in its place
without permanent loss of informatio

Unfortunately, however, the current Administration proposal exposes
all three types of keys equally to the risks introduced by the
escrow system, even though recoverability is not required for all
of them.  Partly this is because there is no intrinsic difference
in the structure of the different types of keys; they are usually
indistinguishable from one another outside of the application in
which they are used.

Finally, there is the problem that criminals can circumvent almost
any escrow system to avoid exposure to law enforcement monitoring.
All key escrow systems are vulnerable to so-called "superencryption,"
in which a user first encrypts data with an unescrowed key prior
to processing it with the escrowed system.  Most escrow systems
are also vulnerable to still other techniques that make it especially
easy to render escrowed keys useless to law enforcement.  The ease
of avoiding law enforcement when convenient raises an obvious
question as to whether the reduced security and high cost of setting
up an escrow system will yield any appreciable public safety benefit
in practice.


IV  CONCLUSIONS AND RECOMMENDATIONS

The wide availability of encryption is vitally important to the
future growth of our global information infrastructure.  In many
cases, encryption offers the only viable option for securing the
rapidly increasing range of human, economic and social activities
taking place over emerging communication networks.  It is no
exaggeration to say that the availability of encryption in the
commercial marketplace is and will continue to be necessary to
protect national security.  Unfortunately, current policy, through
export controls and ambiguous standards, discourages, rather than
promotes, the use of encryption.

Current encryption policy is enormously frustrating to almost
everyone working in the field.  Export controls make it difficult
to deploy effective cryptography even domestically, and we can do
little more than watch as our foreign colleagues and competitors,
not constrained by these rules, are matching our expertise and
obtaining an ever-increasing share of the market.  A large part of
the problem is that the current regulations were written as if to
cover hardware but are applied to software, including software in
the public domain or aimed at the mass market.  The PRO-CODE bill
goes a long way toward moving the regulations in line with the
realities of the technology.





From nobody at c2.org  Thu Jun 27 04:08:24 1996
From: nobody at c2.org (Anonymous User)
Date: Thu, 27 Jun 1996 19:08:24 +0800
Subject: Grubor remailer? (Was Re: Lucifer remailer)
Message-ID: <199606270705.AAA23255@infinity.c2.org>


>Hm, is that Dr. John Grubor's domain (aga at dhp.com)?
>
>That will make a nice anonymous remailer... NOT! Thank you.

dhp is not "Grubor's domain," it's just a Pittsburgh ISP
with liberal terms of service (which is why it can run
remailers).    Perhaps you're thinking of "manus.org"?

check out http://www.dhp.com/amusement.html for some 
background on dhp's attitude

		-not a DHP user or sysadmin








From eagle at armory.com  Thu Jun 27 04:33:40 1996
From: eagle at armory.com (Jeff Davis)
Date: Thu, 27 Jun 1996 19:33:40 +0800
Subject: AT&T bans anonymous messages
Message-ID: <9606270123.aa12416@deepthought.armory.com>


Richard Todd said:
> Um, you don't read news.admin.net-abuse.misc, do you?  The first few spams
> from worldnet have already happened, and from the reports I've seen on there,
> the response from worldnet's posthamster has been pretty much nonexistent.
> It apparently doesn't help that the 'postmaster' mailbox has a quota just
> like the other mailboxen on the system, so every time someone does spam
> from worldnet, half the complaint mail to postmaster bounces.  
>
You guys wouldn't believe what a mogolian clusterfuck Worldnet is.  When is
the physical C'punks meeting at SGI?  I'll be in the bay in a few hours and
around the EFF office and the SAFE conference at Stanford Monday.  Worldnet
software is invasive as hell.  Installations on boxes running Win95 with a 
PCI bus, plug and play BIOS and the I/O on the motherboard have IRQ's and
interupts overwritten to the point the box locks and won't even boot anymore.
Speaking of SGI, TCI, (John Malone), just bought $25,000,000.00 worth of
their boxes...  
-- 
According to John Perry Barlow:                       *What is EFF?* 
"Jeff Davis is a truly gifted trouble-maker." *email <info at eff.org>*
*** O U T L A W S  On The  E L E C T R O N I C  F R O N T I E R ****
US Out Of Cyberspace!!! Join EFF Today! *email <membership at eff.org>*   





From mab at crypto.com  Thu Jun 27 05:14:07 1996
From: mab at crypto.com (Matt Blaze)
Date: Thu, 27 Jun 1996 20:14:07 +0800
Subject: My testimony at Wednesday's Senate hearing on encryption policy
Message-ID: <199606270511.BAA19272@crypto.com>


[Previous message was garbled with several lines truncated; here's
the real one.  Sorry.  -matt]

[This file is (will soon be) at ftp://research.att.com/dist/mab/testimony.txt]


WRITTEN TESTIMONY OF DR. MATTHEW BLAZE

BEFORE THE SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION,
SUBCOMMITTEE ON SCIENCE, TECHNOLOGY, AND SPACE

JUNE 26, 1996

Thank you for the opportunity to speak with you about the technical
impact of encryption policy.  It is a privilege to be here, and I hope
my perspective will be useful to you.

Let me begin by describing my own background and biases.  I am a
Principal Research Scientist in the area of computer security and
cryptology at AT&T Research in Murray Hill, New Jersey.  I also hold a
number of ancillary appointments related to computer security; among
others, I teach an occasional graduate course in the subject at
Columbia University, and I serve as co-chair of the Federal Networking
Council Advisory Committee subcommittee on security and privacy (which
advises Federal agencies on computer networking issues).  However, the
views I am presenting here today are my own, and should not be taken
to represent those of any organization with which I happen to be
affiliated.

I am a computer scientist by training; my Ph.D. is from the Princeton
University Computer Science department, and my primary research areas
are cryptology, computer security, and large-scale distributed
systems.  Much of my research focuses on the management of encryption
keys in networked computing systems and understanding the risks of
using cryptographic techniques to accomplish security objectives.
Recent government initiatives in encryption, such as the "Clipper
Chip," have naturally been of great interest to me, in no small part
because of the policy impact they have on the field in which I work,
but also because they present a number of very interesting technical
and scientific challenges in their own right.

My testimony today focuses on three areas.  First, I will discuss the
role and risks of cryptographic techniques for securing the current
and future electronic world.  Next, I will examine in more detail the
security implications of the limitations imposed on US-based
cryptographic systems through the government's export policies.
Finally, I will discuss the technical aspects of the Administration's
current approach to cryptography policy, which promotes "key escrow"
systems.


I THE INCREASING IMPORTANCE OF ENCRYPTION

The importance of cryptographic techniques for securing modern
computer and communications systems is widely recognized today.
Evidence of the scope of this recognition can be found in the
increasing number of hardware, software, and system vendors that offer
encryption in their products, the increasing demand for high-quality
encryption by users in a widening array of applications, and the
growing, thriving community of cryptologic researchers of which I am a
part.  It is vital that those who formulate our nation's policies and
official attitude toward encryption understand the nature of the
underlying technology and the reasons for its growing importance to
our society.

The basic function of cryptography is to separate the security of a
message's content from the security of the medium over which it is
carried.  For example, we might encrypt a cellular telephone
conversation to guard against eavesdroppers (allowing the call to be
transmitted safely over easily-intercepted radio frequencies), or we
might use encryption to verify that documents, such as contracts, have
not been tampered with (removing the need to safeguard a copy of the
original).  The idea that this might be possible is not a new one;
history suggests that the desire to protect information is almost as
old as the written word itself.  Perhaps as a consequence of the
invention of the digital computer, our understanding of the theory and
practice of cryptography has accelerated in recent years, with a
number of new techniques developed and many new applications emerging.
Among the most important of the recent techniques is "public key
cryptography."  It allows secure messages to be exchanged without the
need for specific advance arrangements between parties.  A related
notion is the "digital signature," which allows messages to be
"signed" in a way that verifiably associates the signer of a message
with its content.

Modern cryptographic techniques are based on the application of
simple, if repetitive, mathematical functions, and as such lend
themselves nicely to implementation by computer programs.  Any
information that can be represented digitally can be protected by
encryption, including computer files, electronic mail messages, and
even audio and video signals such as telephone calls, radio, and
television.  Encryption can be performed by means of software on
general-purpose computers, through special-purpose hardware, or by
special programming of microprocessor-based electronic products such
as the next generation of cellular telephones.  The basic cost of
encryption in terms of computational power required is quite low, and
the marginal cost of including encryption in a software-based computer
program or a programmable electronic product is essentially zero.

Why, then, has encryption recently enjoyed so much attention?  The
reasons can be found from two perspectives: the technology of modern
communication systems, and the new purposes for which we are relying
on digital information.

First, the technology and economics of modern communications and
computing systems strongly favors media that have little inherent
security.  For example, wireless telephones have great advantages in
convenience and functionality compared with their familiar wired
counterparts and are comprising an increasing proportion of the
telephone network.  This also makes eavesdropping much easier for
curious neighbors, burglars identifying potential targets, and
industrial spies seeking to misappropriate trade secrets.  Similarly,
decentralized computer networks such as the Internet have lower
barriers to entry, are much less expensive, are more robust and can be
used to accomplish a far greater variety of tasks than the proprietary
networks of the past, but, again, at the expense of intrinsic
security.  The Internet makes it virtually impossible to restrict, or
even predict, the path that a particular message will traverse, and
there is no way to be certain where a message really originated or
whether its content has been altered along the way.  It is possible,
even common, for electronic mail messages to route through the
computers of competitors.  This is not a result of sloppy design or
poor planning on the part of the Internet's architects; on the
contrary, these properties are a direct consequence of the
technological advances that make the Internet efficient and useful in
the first place.

Second, electronic communication is becoming increasingly critical to
the smooth functioning of our society and our economy and even to
protect the safety of human life.  Communication networks and computer
media are rapidly replacing less efficient, traditional modes of
interaction whose security properties are far better understood.  As
teleconferencing replaces face-to-face meetings, electronic mail
replaces letters, electronic payment systems replace cash
transactions, and on-line information services replace written
reference materials, we gain a great deal in efficiency, but our
assumptions about the reliability of very ordinary transactions are
often dangerously out-of-date.

Put another way, the trend in communication and computing networks has
been away from closed systems in favor of more open ones and the trend
in our society is to rely on these new systems for increasingly
serious purposes.  There is every reason to believe that these trends
will continue, and even accelerate, for the foreseeable future.
Cryptography plays an important and clear role in helping to provide
security assurances that at least mirror what we have come to expect
from the older, more familiar communications methods of the
not-so-distant past.


II KEY LENGTH AND SECURITY

The "strength" of an encryption system depends on a number of
variables, including the mathematical properties of the underlying
encryption function, the quality of the implementation, and the number
of different "keys" from which the user is able to choose. It is very
important that a cryptosystem and its implementation be of high
quality, since an error or bug in either can expose the data it
protects to unexpected vulnerabilities.  Although the mathematics of
cryptography is not completely understood and cipher design is an
exceptionally difficult discipline (there is as yet no general
"theory" for designing cipher functions), there are a number of common
cipher systems that have been extensively studied and that are widely
trusted as building blocks for secure systems.  The implementation of
practical systems out of these building blocks, too, is a subtle and
difficult art, but commercial experience in this area is beginning to
lead to good practices for adding high-quality encryption systems to
software and hardware.  Users and developers of secure systems can
protect against weaknesses in these areas by choosing only cipher
functions that have been carefully studied and by ensuring that their
implementation follows good engineering practices.

The most easily quantified variable that contributes to the strength
of an encryption system is the size of the pool of potential values
from which the cryptographic keys are chosen.  Modern ciphers depend
on the secrecy of the users' keys, and a system is considered
well-designed only if the easiest "attack" involves trying every
possible key, one after the other, until the correct one is found.
The system is secure only if the number of keys is large enough to
make such an attack infeasible.  Keys are usually specified as a
string of "bits," and adding one bit to the key length doubles the
number of possible keys.  An important question, then, is the minimum
key length sufficient to resist a key search attack in practice.

Last November, I participated in a study, organized by the Business
Software Alliance, aimed at examining the computer technology that
might be used by an "attacker" in order to determine the minimum
length keys that should be used in commercial applications.  We
followed an unusually conservative methodology in that we assumed that
the attacker would have only available standard "off-the-shelf"
technology and is constrained to purchase in single-unit quantities
with no economies of scale.  That is, our methodology would tend to
produce a recommendation for shorter keys than would an analysis using
the more conventional approach of giving the potential attacker every
benefit of the doubt in terms of technological advantages he might
enjoy.  Nonetheless, we concluded that the key lengths recommended in
existing U.S. government standards (e.g., the Data Encryption
Standard, with a 56-bit key) for domestic use are far too short and
will soon render data protected under them vulnerable to attack with
only modest resources.  We concluded that keys today should be a bare
minimum of 75 bits long, and that systems being fielded today to
secure data over the next twenty years must employ keys of at least 90
bits. I have included a copy of our report as an appendix to my
testimony.

Attempting to design systems "at the margins" by using the minimum key
length needed is a dubious enterprise at best.  Because even a slight
miscalculation as to the technology and resources available to the
potential attacker can make the difference between a secure system and
an insecure one, prudent designers specify keys that are longer than
the minimum they estimate is needed to resist attack, to provide a
margin for error.

Current U.S. policy encourages the designers of encryption systems to
take exactly the opposite approach.  Encryption systems designed for
export from the United States at present generally must use keys no
more than 40 bits long.  Such systems provide essentially no
cryptographic security, except against the most casual "hacker."
Examples of 40 bit systems being "broken" through the use of spare
computer time on university computer networks are
commonplace. Unfortunately, it is not only users outside the U.S. who
must make do with the inferior security provided by such short keys.
Because of the difficulty of maintaining multiple versions of
software, one for domestic sale and one for export, and the need for
common interoperability standards, many US-based products are
available only with export-length keys.

There is no technical, performance, or economic benefit to employing
keys shorter than needed.  Unlike, for example, the locks used to
protect our homes, very secure cryptographic systems with long keys
are no more expensive to produce or any harder to design or use than
weaker systems with shorter keys.  The only reason vendors design
systems with short keys is to comply with export requirements.

The key length figures and analysis in this section are based on
so-called "secret key" cryptosystems.  For technical reasons, current
public key cryptosystems employ much longer keys than secret key
systems to achieve equivalent security (public keys are measured in
hundreds or thousands of bits).  However, virtually all systems that
use public key cryptography also rely on secret key cryptography, and
so the overall strength of any system is limited by the weakest
encryption function and key length in it.

III THE RISKS OF KEY ESCROW

A number of recent Administration initiatives have proposed that
future cryptosystems include special "key escrow" provisions to
facilitate access to encrypted data by law enforcement and
intelligence agencies.  In a such systems, copies of keys are
automatically deposited, in advance, with third parties who can use
them to arrange for law enforcement access if required in the future.
Several key escrow systems have been proposed by the Administration,
differing in the details of how keys are escrowed, and who the third
party key holders are.  In the first proposal, called the "Clipper
chip," the system is embedded in a special tamper-resistant
hardware-based cryptosystem and copies of keys are held by federal
agencies.  In the more recent "public key infrastructure" proposal,
keys are escrowed at the time a new public key is generated and are
held by the organization (public or private) responsible for
certification of the public key.

Although the various key escrow proposals differ in the details of how
they accomplish their objective, there are a number of very serious
fundamental problems and risks associated with all of them.

There are some appropriate commercial applications of key escrow
techniques.  A properly designed cryptosystem makes it essentially
impossible to recover encrypted data without the correct key.  This
can be a double-edge sword; the cost of keeping unauthorized parties
out is that if keys are lost or unavailable at the time they are
needed, the owner of encrypted data will be unable to make use of his
own information.  This problem, of balancing secrecy with assurances
of continued availability, remains an area of active research, and
commercial solutions are starting to emerge.  The Administration's
initiatives do not address this problem especially well, however.

The first problem with key escrow is the great increase in engineering
complexity that such systems entail.  The design and implementation of
even the simplest encryption systems is an extraordinarily difficult
and delicate process.  Very small changes can introduce fatal security
flaws that often can be exploited by an attacker.  Ordinary
(non-escrowed) encryption systems have conceptually rather simple
requirements (for example, the secure transmission of data between two
parties) and yet, because there is no general theory for designing
them, we still often discover exploitable flaws in fielded systems.
Key escrow renders even the specification of the problem itself far
more complex, making it virtually impossible to assure that such
systems work as they are intended to.  It is possible, even likely,
that lurking in any key escrow system are one or more design
weaknesses that allow recovery of data by unauthorized parties. The
commercial and academic world simply does not have the tools to
analyze or design the complex systems that arise from escrow.

Key escrow is so difficult that even systems designed by the
classified world can have subtle problems that are only discovered
later.  In 1994 I discovered a new type of "protocol failure" in the
Escrowed Encryption Standard, the system on which the Clipper chip is
based.  The failure allows, contrary to the design objectives of the
system, a rogue user to circumvent the escrow system in a way that
makes the data unrecoverable by the government.  Others weaknesses
have been discovered since then that make it possible, for example, to
create incriminating messages that appear to have originated from a
particular user.

It should be noted that these weaknesses have been discovered in spite
of the fact that most of the details of the standard are classified
and were not included in the analysis that led to the discovery of the
flaws.  But these problems did not come about because of incompetence
on the part of the system's designers.  Indeed, the U.S. National
Security Agency is likely the most advanced cryptographic enterprise
in the world, and is justifiably entrusted with developing the
cryptographic systems that safeguard the government's most important
military and state secrets.  The reason the Escrowed Encryption
Standard has flaws that are still being discovered is that key escrow
is an extremely difficult technical problem, with requirements unlike
anything previously encountered.

A second problem with key escrow arises from the difficulty of
operating a key escrow center in a secure manner.  According to the
Administration (for example, see the May 20, 1996 White House draft
report "Enabling Privacy, Commerce, Security and Public Safety in the
Global Information Infrastructure"), key escrow centers must be
prepared to respond to law enforcement requests for escrowed data 24
hours a day, completing transactions within two hours of receiving
each request.  There are thousands of law enforcement agencies in the
United States authorized to perform electronic surveillance, and the
escrow center must be prepared to identify and respond to any of them
within this time frame.  If the escrow center is also a commercial
operation providing data recovery services, it may also have tens of
thousands of additional private sector customers that it must be
prepared to serve and respond to.  There are few, if any, secure
systems that operate effectively on such a scale and under such
tightly-constrained response time.  The argument, advanced by the
Administration, that escrow centers can use the same procedures that
protect classified data is a curious one, since classified information
is by its nature available to a far smaller and more
carefully-controlled potential audience than are escrowed keys.  It is
simply inevitable that escrow centers that meet the government's
requirements will make mistakes in giving out the wrong keys from time
to time or will be vulnerable to fraudulent key requests.  Key escrow,
by its nature, makes encrypted data less secure because the escrow
center introduces a new target for attack.

A third problem with the Administration's key escrow proposals is that
they fail to distinguish between cryptographic keys for which recovery
might be required and those for which recoverability is never needed.
There are many different kinds of encryption keys, but for the
purposes of discussing key escrow it is sufficient to divide keys into
three categories.  The first includes keys used to encrypt stored
information, which must be available throughout the lifetime of the
data.  The owner of the data has an obvious interest in ensuring the
continued availability of such keys, and might choose to rely on a
commercial service to store "backup" copies of such keys.  A second
category of key includes those used to encrypt real-time
communications such as telephone calls.  Here, the key has no value to
its owner once the transaction for which it was used has completed.
If a key is lost or destroyed in the middle of a conversation, a new
one can be established in its place without permanent loss of
information.  For these keys, the owner has no use for recoverability;
it is of value only to law enforcement and others who wish to obtain
access to a conversation without the knowledge or cooperation of the
parties.  Finally, there are the keys used not for secrecy but for
signature and authentication, to insure that messages indeed
originated from a particular party.  There is never a need for anyone,
law enforcement or the key owner, to recover such keys, since their
purpose is not to obscure content but rather to establish authorship.
If the owner looses a signature key, a new one can be generated easily
at any time.

Unfortunately, however, the current Administration proposal exposes
all three types of keys equally to the risks introduced by the escrow
system, even though recoverability is not required for all of them.
Partly this is because there is no intrinsic difference in the
structure of the different types of keys; they are usually
indistinguishable from one another outside of the application in which
they are used.

Finally, there is the problem that criminals can circumvent almost any
escrow system to avoid exposure to law enforcement monitoring.  All
key escrow systems are vulnerable to so-called "superencryption," in
which a user first encrypts data with an unescrowed key prior to
processing it with the escrowed system.  Most escrow systems are also
vulnerable to still other techniques that make it especially easy to
render escrowed keys useless to law enforcement.  The ease of avoiding
law enforcement when convenient raises an obvious question as to
whether the reduced security and high cost of setting up an escrow
system will yield any appreciable public safety benefit in practice.


IV CONCLUSIONS AND RECOMMENDATIONS

The wide availability of encryption is vitally important to the future
growth of our global information infrastructure.  In many cases,
encryption offers the only viable option for securing the rapidly
increasing range of human, economic and social activities taking place
over emerging communication networks.  It is no exaggeration to say
that the availability of encryption in the commercial marketplace is
and will continue to be necessary to protect national security.
Unfortunately, current policy, through export controls and ambiguous
standards, discourages, rather than promotes, the use of encryption.

Current encryption policy is enormously frustrating to almost everyone
working in the field.  Export controls make it difficult to deploy
effective cryptography even domestically, and we can do little more
than watch as our foreign colleagues and competitors, not constrained
by these rules, are matching our expertise and obtaining an
ever-increasing share of the market.  A large part of the problem is
that the current regulations were written as if to cover hardware but
are applied to software, including software in the public domain or
aimed at the mass market.  The PRO-CODE bill goes a long way toward
moving the regulations in line with the realities of the technology.






From vin at shore.net  Thu Jun 27 05:55:50 1996
From: vin at shore.net (Vin McLellan)
Date: Thu, 27 Jun 1996 20:55:50 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <v02140b00adf7ea1940e7@[206.243.160.225]>


        Mike McNally <m5 at vail.tivoli.com> queried the List:

>By the way, there was a thing in the Yahoo/Reuters feed about "attacks"
>on DoD computers; apparently British police arrested a "hacker" the
>other day.  Anyway, the article included a claim that there have been
>250,000 attempted break-ins on DoD computers over the past year.
>
>Does anybody know how they count that?

        I don't know if they go so far as to count pings, but it seems they
do try to count ISS/Satan/Pingware scans -- and then they project off what
numbers they have to come up with the estimates.  But no one is
particularly careful about these numbers... certainly not the politicians
nor the press.

        The estimates come from the Defense Information Systems Agency
(DISA) and refer to "attacks" on the 2.1 million computers, 10,000 LANs,
and 100 long-distance networks.  (It is unclear whether DISA also includes
the defense contractors' machine and networks -- another 2 million, as I
recall -- but, by US law, those are also considered Defense systems.)

        According the May 22 GAO report: "DISA  estimates indicate that
Defense may have been attacked as many as 250,000 times last year.
However, the exact number is not known because, according to DISA, only
about 1 in 150 attacks is actually detected and reported.  In addition, in
testing its systems, DISA attacks and successfully penetrates Defense
systems 65 percent of the time."

        (It is unclear whether this estimate process is circular, with DISA
-- all and all, a generally capable crew, which normally doesn't bother
with this sound-bite silliness -- "projecting" the total number of attacks
by taking the number of reported attacks  and then enhancing that number by
multiplying it by the percentage of their own attacks on DoD systems which
go unremarked.)

         Jack Brooks, the director of the GAO's Defense Information and
Financial Management Systems, who presented the GAO's formal report
("Computer Attacks at Department of Defense Pose Increasing Risks") gave
some further explication:  "Not all hacker attacks result in actual
intrusions into computer systems; some are attempts to obtain information
on systems in preparation for future attacks, while others are made by the
curious or those who wish to challenge the Department's computer defenses."

     Some numbers seems slightly less puffy: officials at Wright-Patterson
Air Force Base reported that, on average, they receive 3,000 to 4,000
"attempts to access information each month from counties all around the
world."

        There are real problems effectively securing DoD's unclassified
computers -- both the military's own systems and the defense contractors --
but its sad how completely the real problems are being overlooked (or, at
least, overshadowed) but the obsession with the InfoWar threat and teen
cyberdemons being manipulation by Iraqi secret agents.

        Historically and at this moment, the vulnerability of the DoD
computers -- as illustrated by hacker attacks and (almost certainly) by
DISA itself -- lies in untrained and poorly managed system administrators
who simply do not bother to apply even the CERT-labelled patches to their
systems.  There are brilliant hackers about (some in DISA; maybe even a few
on this list) but they would but rarely need that brilliance to penetrate
the typical DoD system.

        I'd bet cold cash that DISA's own tiger-team attacks on DoD systems
are almost always successful with nothing more innovative than an ISS or
SATAN scans and/or a list of CERT-announced security problems from the
previous six months.  The real threat is incompetent, poor-trained DoD
system administrators -- and a class of computer-illiterate senior managers
who define "system security" and routine administration as a marginal
expenses and scorn readily available options like one-time passwords as too
complex for the military mind.

        Much, much, easier to rail at the terrorist threat exemplified by
the 16 year-old Brit who called himself "Datastream Cowboy" and to hint
darkly that his unidentified cohort "Kuji" may have been a Russian or an
Iraqi.  The hell with security, let's wiretap the phones of all 16
year-olds!

        Cliff Stoll and Peter Neuman of SRI are supposed to testify, and
they might bring some common sense to bear -- but I for one desperately
wish to hear the like of acid-tongued Bob Courtney, IBM's former director
of Info Security, chew this fluff up.

        The Datastream attack, btw, didn't occur "the other day," as Mike
McNally suggested -- this whole media flurry is built around a retelling of
Datastream's 1994 attack and arrest.  It's just that the Air Force CERT did
a nice job of documenting the good guys' effort to identify and track him
down -- although Lord! the kid was dumb, no Morris Jr. there! -- and
writing up a report.

        Makes you realize how desperate some folks are for cyberterror
stories, doesn't it?  Wonder why?????

        Suerte,
                        _Vin

         Vin McLellan +The Privacy Guild+ <vin at shore.net>
      53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548
                         <*><*><*><*><*><*><*><*><*>







From rah at shipwright.com  Thu Jun 27 06:50:02 1996
From: rah at shipwright.com (Robert Hettinga)
Date: Thu, 27 Jun 1996 21:50:02 +0800
Subject: Bruce Taylor at HotWired
In-Reply-To: <199606270208.TAA29471@mh1.well.com>
Message-ID: <v03007600adf80d494b7d@[199.0.65.105]>


At 10:08 PM -0400 6/26/96, Jon Lebkowsky wrote:
> however in his place we've extended an
> 11th-hour invitation to Bruce Taylor of the National Law Center for Children
> and Families, and he's accepted.  Please join us!
> 
> (Requires that you join HotWired)

Ooooooo, I'm *excited*!

My very own chance to meet Bruce Taylor, AKA "Penis with a Blister", AKA "PWAB",  AKA "The Toolman", AKA "The Labia Nailer".

I soooo excited, I just want to reach down right now and fondle my inner child. 

Maybe not. After all that fondling, I'd probably be to TiReD...

Feh.

Cheers,
Bob Hettinga

-----------------
Robert Hettinga (rah at shipwright.com)
e$, 44 Farquhar Street, Boston, MA 02131 USA
"If they could 'just pass a few more laws', 
  we would all be criminals."    --Vinnie Moscaritolo
The e$ Home Page: http://www.vmeng.com/rah/







From perry at alpha.jpunix.com  Thu Jun 27 07:45:31 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Thu, 27 Jun 1996 22:45:31 +0800
Subject: New type2.list/pubring.mix combination
Message-ID: <Pine.NEB.3.93.960627053747.19370B-100000@alpha.jpunix.com>


-----BEGIN PGP SIGNED MESSAGE-----

Hello Everyone,

	I have just updated the type2.list/pubring.mix combination on
jpunix.com. Of note, I have dropped ecafe-mix as it has not responded in a
LONG time and it doesn't look like it's going to get fixed any time soon.

	There are two new type II remailers on the list, Ad and lucifer.
Welcome aboard!

	The lists are available by WWW from www.jpunix.com and by
anonymous FTP fro ftp.jpunix.com.

	If you have any questions about the lists, please send email to
perry at alpha.jpunix.com. 

 John Perry - perry at alpha.jpunix.com -  PGP-encrypted e-mail welcome!
 WWW - http://www.jpunix.com
 PGP 2.62 key for perry at jpunix.com is on the keyservers.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdJl3VOTpEThrthvAQGjEgP+N+DqShSfaWdqdxzlp9wCI+m1H3RXxKaz
JPr2WLKXjmYImH72X3CvNuEQY19fV1N/n0iVoKFY0xwz814dMf6MMM4Wt5D1gxfk
HjYvMFWuRVFMR5cN3DJIN/lAIV7zY4Pga77gVu3eo0Q3hN8SCP2ZIiMAStkA+6e/
v6FXGIeijUo=
=AbdV
-----END PGP SIGNATURE-----





From wywong2 at cs.cuhk.hk  Thu Jun 27 13:43:17 1996
From: wywong2 at cs.cuhk.hk (Leo WONG Wing-yan)
Date: Fri, 28 Jun 1996 04:43:17 +0800
Subject: MS-Mail Security
Message-ID: <Pine.SOL.3.91.960627231233.11957A-100000@sol25.cs.cuhk.hk>


Hi all,


    I would like to gather informations of whether the MS-Mail server is 
secure or not, is anyone heard of somebody, say, disguise as other user 
or read other user e-mail?


    Thanks a lot

Best regards
Leo Wong










From nowhere at alpha.c2.org  Thu Jun 27 14:42:18 1996
From: nowhere at alpha.c2.org (nowhere at alpha.c2.org)
Date: Fri, 28 Jun 1996 05:42:18 +0800
Subject: Ga Law/No False Identity
Message-ID: <199606271536.IAA07581@infinity.c2.org>


Mailing from Electronic Frontiers Georgia 6/27/96:
----------snip----------
:Subject: [EFG] GA law criminalizing Spam cancels??
----------snip----------
:Electronic Frontiers Georgia has engaged the law firm of Bondurant, Mixson, 
:& Elmore (specifically Scott McClain) to look into a court challenge of 
:HB1630 "The Internet Police Law" which goes into effect on July 1st.  We see 
:this as an unecessary and badly framed law.
:
:This law would appear to make it a Georgia criminal act to remove spam & 
:spews from newsgroups.  This is law OCGA 16-9-93.1
:
:Some information can be found at
:
:    http://ninja.techwood.org/~efg/
:
:under the "Day the sites went out in Georgia" section.
:
:My understanding, and the perception of spammers seems to be that in order 
:to cancel a message, you must forge headers to become that person, thereby 
:falsely identifying yourself.  This seems to be in direct violation of the law
:
:  It shall be unlawful for any person, ... to transmit any data 
:  through a computer network ... if such data uses any individual 
:  name, ... to falsely identify the person, ... 
:
----------snip----------
:  -- Robert Costner
:     Electronic Frontiers Georgia
:     rcostner at intergate.net

Spamming aside, this strikes at my privacy and choice of anonymity. 





From rpowell at algorithmics.com  Thu Jun 27 16:16:37 1996
From: rpowell at algorithmics.com (Robin Powell)
Date: Fri, 28 Jun 1996 07:16:37 +0800
Subject: info assembly line, "flits" (long)
In-Reply-To: <199606241741.KAA10522@cory.EECS.Berkeley.EDU>
Message-ID: <96Jun27.131433edt.20485@janus.algorithmics.com>


>>>>> In article <199606241741.KAA10522 at cory.EECS.Berkeley.EDU>, "Josh Sled" <jsled at cory.EECS.Berkeley.EDU> writes:

    >> flit. I agree, a flit as a 0 or 1 is very unlikely in the near future.
    >> but at a document level, i.e. a document as a flit, we already have
    >> it in RCS systems that companies are struggling to implement well
    >> as we speak.

    > Again, I think a document system is the best suited for information
    > storage... the flit concept seems to be a great overkill.

Another basic problem that I'm surprised hasn't come up yet:

If I have a 1-bit flit with full revision history, don't I have to
have revision history on each of the bits of the revision history of
the original flit?  We're talking an infinite amount of storage space
here, for one flit that has been moved once!  Also, revisions for the
individual bits in program, including the programs to keep track of
flits, including revision history of programs in main memory, from
what it sounds like.

We will never have this much storage space.  An infinite amount is
required.  What would be the point anyways?  Makes a lot more sense on
a per-file basis.

-Robin





From nelson at crynwr.com  Thu Jun 27 17:15:15 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Fri, 28 Jun 1996 08:15:15 +0800
Subject: CIA Fears UmpTeen InfoNukes
In-Reply-To: <199606271845.LAA13527@netcom7.netcom.com>
Message-ID: <19960627192347.16856.qmail@ns.crynwr.com>


Bill Frantz writes:
 > At  4:57 AM 6/27/96 -0400, Vin McLellan wrote:
 > >...  The real threat is incompetent, poor-trained DoD
 > >system administrators -- and a class of computer-illiterate senior managers
 > >who define "system security" and routine administration as a marginal
 > >expenses and scorn readily available options like one-time passwords as too
 > >complex for the military mind.
 > 
 > Public key authentication could go a long way toward solving the military
 > and contractor's security problems.  However, they won't use public key
 > authentication for unclassified systems until it is available in "COTS"
 > (Commercial, Off The Shelf) software.  And it won't be available there
 > until it can be exported as well as sold domestically.  Catch-22

So a Pentagon Computer Security Analyst might reasonably make the case
that the ban on exportable crypto is hurting National Security just as
much as, or more than, it helps.

Why hasn't someone made that case?  If they have, why hasn't it
succeeded?

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade;
Potsdam, NY 13676       | +1 315 268 9201 FAX   | governments coerce.





From frantz at netcom.com  Thu Jun 27 17:38:46 1996
From: frantz at netcom.com (Bill Frantz)
Date: Fri, 28 Jun 1996 08:38:46 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <199606271845.LAA13527@netcom7.netcom.com>


At  4:57 AM 6/27/96 -0400, Vin McLellan wrote:
>...  The real threat is incompetent, poor-trained DoD
>system administrators -- and a class of computer-illiterate senior managers
>who define "system security" and routine administration as a marginal
>expenses and scorn readily available options like one-time passwords as too
>complex for the military mind.

Public key authentication could go a long way toward solving the military
and contractor's security problems.  However, they won't use public key
authentication for unclassified systems until it is available in "COTS"
(Commercial, Off The Shelf) software.  And it won't be available there
until it can be exported as well as sold domestically.  Catch-22


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From mab at research.att.com  Thu Jun 27 17:48:32 1996
From: mab at research.att.com (Matt Blaze)
Date: Fri, 28 Jun 1996 08:48:32 +0800
Subject: my senate testimony
Message-ID: <199606271917.PAA00317@nsa.research.att.com>


I sent a copy of my senate testimony here last night, discovered
that a bunch of lines were truncated, and (I thought) immedately sent out
a revised, corrected version.  The garbled version got forwarded to
a bunch of mailing lists, however, and now I'm getting dozens of
messages from people telling me about the truncated lines.

The corrected version can be found at
	ftp://research.att.com/dist/mab/testimony.txt
Please forward this version (or the URL) to anyone to whom you forwarded
the the garbled version.  Thanks.

-matt






From harka at nycmetro.com  Thu Jun 27 18:50:10 1996
From: harka at nycmetro.com (harka at nycmetro.com)
Date: Fri, 28 Jun 1996 09:50:10 +0800
Subject: MS-Mail Security
Message-ID: <TCPSMTP.16.6.27.-15.0.46.2780269260.1184837@nycmetro.com>


 -=> Quoting In:wywong2 at cs.cuhk.hk to Harka <=-
 
 In> I would like to gather informations of whether the MS-Mail server
 In> is  secure or not, is anyone heard of somebody, say, disguise as other
 In> user  or read other user e-mail?


I'd also like to know how secure the MS-Mail files are (*.mmf). They are password protected and should be encrypted but does anybody know how secure?

Harka
___ Blue Wave/386 v2.30 [NR]







From eli+ at gs160.sp.cs.cmu.edu  Thu Jun 27 18:54:04 1996
From: eli+ at gs160.sp.cs.cmu.edu (eli+ at gs160.sp.cs.cmu.edu)
Date: Fri, 28 Jun 1996 09:54:04 +0800
Subject: Grubor remailer? (Was Re: Lucifer remailer)
In-Reply-To: <+cmu.andrew.internet.cypherpunks+QloTyoO00UfAE10B1B@andrew.cmu.edu>
Message-ID: <199606272033.NAA17591@toad.com>


>Hm, is that Dr. John Grubor's domain (aga at dhp.com)?

DHP is "The DataHaven Project", a local (Pittsburgh) ISP "dedicated to
providing anonymous and/or private accounts for users."  The egregious
Law Doctor *could* be running the remailer, but there's no particular
reason to think so.

>That will make a nice anonymous remailer... NOT! Thank you.

It might make a nice test case for the Pennsylvania anti-remailer law.

--
   Eli Brandt
   eli+ at cs.cmu.edu





From alexf at iss.net  Thu Jun 27 19:08:44 1996
From: alexf at iss.net (Alex F)
Date: Fri, 28 Jun 1996 10:08:44 +0800
Subject: Grubor remailer? (Was Re: Lucifer remailer)
Message-ID: <199606272114.RAA04139@phoenix.iss.net>



> dhp is not "Grubor's domain," it's just a Pittsburgh ISP
> with liberal terms of service (which is why it can run
> remailers).    Perhaps you're thinking of "manus.org"?
> 

I thought that DHP is mostly Canadian.  I know that Panzer deals w/ 
them & he is running from Pitt. but I think that the others are 
mostly from Canada.  I work w/ a few of them, but they are not here 
to ask about this (at the moment.  They just went out for dinner).  I 
don't think that DHP (Data Haven Project) is really an ISP per se...
=-=-=-=-=-=-=-=-=-=-=-=-=-
Alex F    alexf at iss.net
Marketing Specialist
Internet Security Systems
=-=-=-=-=-=-=-=-=-=-=-=-=-





From AwakenToMe at aol.com  Thu Jun 27 19:20:32 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Fri, 28 Jun 1996 10:20:32 +0800
Subject: Ga Law/No False Identity
Message-ID: <960627174301_565508240@emout12.mail.aol.com>


In a message dated 96-06-27 17:15:15 EDT, nowhere at alpha.c2.org writes:

>:  It shall be unlawful for any person, ... to transmit any data 
>:  through a computer network ... if such data uses any individual 
>:  name, ... to falsely identify the person, ... 
>:
>----------snip----------
>:  -- Robert Costner
>:     Electronic Frontiers Georgia
>:     rcostner at intergate.net
>
>Spamming aside, this strikes at my privacy and choice of anonymity. 
>
>
falsely id a person?? Well it seems to me ya just wanna get the messages
OUTTA there and arent trying to 'act' as that person in the sense that you
are posing to NO person that you really are that person.






From smith at sctc.com  Thu Jun 27 19:22:36 1996
From: smith at sctc.com (Rick Smith)
Date: Fri, 28 Jun 1996 10:22:36 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <199606271857.NAA10915@shade.sctc.com>


m5 at vail.tivoli.com (Mike McNally) asks:

> ...  the article included a claim that there have been
>250,000 attempted break-ins on DoD computers over the past year.

>Does anybody know how they count that?

The number comes from the recent GAO report, which provides it as an
estimated upper bound of the number of attacks. Notice how rapidly the
press loses the distinction between an estimated upper bound and a
hard number. The GAO report claims that 559 attacks were reported on
DOD machines last year, and that "only 1 in about 150 incidents" are
reported. That comes out to less than 84,000, and I'm not sure where
the extra factor of 3 comes from. The GAO report is vage about the
distinction between "reported" and "successful" attacks in statistics
from different sources, and this may account for some of it.

The GAO report also gives statistics from recent penetration work
done by DISA. What they did was mount a bunch of attacks on DOD
systems and see what happened. They claimed a 65% success rate.  Only
4% of the successful attacks were detected, and only 27% of those
detected were reported back up the line to the Pentagon.

It's an interesting report. It's gao/aimd-96-84, and you can get it
via their website at (no kidding) http://www.gao.gov

Rick.
smith at sctc.com        secure computing corporation





From eric at clever.net  Thu Jun 27 20:06:37 1996
From: eric at clever.net (eric traudt)
Date: Fri, 28 Jun 1996 11:06:37 +0800
Subject: A favor
Message-ID: <v02140b00adf8bc10f17b@[204.249.244.13]>


To: Barry J. Toiv, High Exalted  Muckety Muck White Castle Press and
Database Spokesman

Dear Sir,

I  am researching the topic of rent seeking in government and could make
good use of your "Big Brother" database. From press reports I've heard it
contains payment records and invoiced items for political transactions.
This should enable me to calculate  prices and inflation rates for
ambassadorships etc.

If it's not too much trouble could you email me a copy of the 20,000 name
database before my thesis is due?

P.S. Please give me the "FBI clean" version, I don't need the really
dangerous bits.








From vin at shore.net  Fri Jun 28 16:31:09 1996
From: vin at shore.net (Vin McLellan)
Date: Sat, 29 Jun 1996 07:31:09 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <v02140b00adf8924b5fe4@[198.115.179.228]>


        On Cypherpunks-L, Vin McLellan wrote:

>>...  The real threat is incompetent, poor-trained DoD
>>system administrators -- and a class of computer-illiterate senior managers
>>who define "system security" and routine administration as a marginal
>>expenses and scorn readily available options like one-time passwords as too
>>complex for the military mind.

        Bill Frantz <frantz at netcom.com> responded:

>Public key authentication could go a long way toward solving the military
>and contractor's security problems.  However, they won't use public key
>authentication for unclassified systems until it is available in "COTS"
>(Commercial, Off The Shelf) software.  And it won't be available there
>until it can be exported as well as sold domestically.  Catch-22

        I love PKC with all its promise, but you overstate (and IMHO,
attribute inappropriately) the barriers that slow the adoption of one-time
password authentication in the military... and many other more highly
regarded IS environments.

        Security Dynamics (a client of mine) has sold a million SecurID
two-factor OTP tokens internationally -- and its ACE/Server installations
are freely exported to 20-odd nations, even with its embedded DES code.
There is no barrier against exporting OTP authentication systems, either
two-factor tokens or software!  Bellcore's s/key is available world-wide in
both the popular freeware versions and Bellcore's commercial client/server
version -- and the US Navy  developed and circulates widely its own
freeware rewrite of the s/key OTP code: OPIE.

        Free and commercial OTP code has been effectively COTS for years!
I would be greatly surprised if there has been a published report on the
state of security in the US computer or communications infrastructure
anytime in the past five years which has not highlighted the promise of
OTPs to plug the single most eggregious systemic vulnerability in the
installed base of networked computer systems: static, unchanging, user
passwords vulnerable to anyone with a wayward sniffer utility or (to
collect them by the bushel) able to logon to a target site with one of
those stolen passwords to drop a trojan.

        Without trustworthy user authentication there is no meaningful
computer security, period!  Sen. Sam Nunn, who is now chairing the
Congressional hearings on Security in Cyberspace, is a bright guy --
although he is reputed to be utterly innocent of basic computer skills.
Yet Sam Nunn could have pulled off the total penetration of the 30 USAF
computer systems at Rome Labs -- the tale of incompetence witnesses
described so luridly at his recent hearings -- with a couple of hours of
simple tutorials from anyone on this List.

        The British 16 year-old who did it just religiously collected
passwords -- working the Net from his 25 MHz 486 SX pc with a 170 Megabyte
hard drive.   The "Datastream Cowboy" liked to hack .MIL systems because --
as he was quoted explaning, in an analysis by the Nunn's subcommittee staff
-- they are "so insecure."

        CERT, DISA, NIST, OTA, GAO, even NSA -- they've all issued stacks
of reports with the same redundant recommendations.  Even CERT, fer cripes
sake!  Reusable passwords are the hole in the dyke!  It's a mantra among
the security pros; has been for years: "Shift to OTPs for meaningful
security in networked systems."

        Yes, there are still threats to the communication links without
network encryption -- but with OTPs, even those vulnerabilities become
vastly more managable.  With universal adoption of OTPs for multi-user
systems, 80 percent (??) of the problem would disappear and we could worry
(as we must) about bad code in Sendmail and other widely-used apps and
system products. Then, we could blame our sense of vulnerability on the
self-interested spooks and the short-sighted politicians who deny us and
our culture the personal security of widespread quality encryption.

        But it's not that simple.  Access to encryption is one issue;
separate and distinct from the issue of the adoption of one-time password
technologies.  OTP user authentication -- and the vast increase in the
security and integrity of our computers and networks it could bring to our
government and private sector information systems -- is _Not_ dependent
upon the government releasing encryption (PKC or other) from its spooky
bondage.

        You don't need PKC for quality authentication.  They are
complementary technologies (thus, the proposed merger of Security Dynamics
and RSA) but they are not the same.  They are not even necessarily
interdependent.  You can have weak authentication with utterly secure
network encryption.

        No, in this case, the blame is spread far more widely.  Yes, DoD
and other meta-institutions have been slow to acknowledge and act upon the
obvious solution to their biggest and most obvious vulnerability.  Security
is still seen as a marginal item in the budget -- not something that must
be designed into both the technology or implicit in its responsible
management.

        But they've been able to get away with it because the hardware
vendors and big software companies -- the very firms which now harp on ITAR
denying them the international market -- have been so hesitant to risk
their margins by designing security into their number crunchers.  And
they've been able to get away with that because the whimpy class of
professionals who design, impliment, and manage the computer installations
upon which our nation (many nations!) and our industrial culture depend has
been unable to get it together to define or condemn irresponsible,
unprofessional stewardship of these assets.

        People carp about soul-less lawyers.  Money-grubbing MDs.  Sell-out
CPAs.  But has there ever been a class of technical professionals so adept
at denying all responsibility for the proper and responsible management of
the power and assets they control as we professional technocrats of the
computer culture?  By contrast, lawyers, MDs, etc., are bastions of probity
and social and professional responsibility!

        How low do you have to sink to find some unacceptable level -- some
level of incompetent system administration that carries the burden of
liability? A standard beneath which a professional's peers would judge him
or her reckless and irresponsible, lacking due care, unprofessional?
Frankly, I've never been able to find out.  (And, to judge by the lack of
judicial condemnation of corporate and public managers for mismanagement of
other people's electronic assets, neither have the Courts.)

        Think of it: our culture could be about to be irretrievably
transformed by a series of laws drafted by the American subculture of spys
(both the police and the real spooks) and passed by legislators stampeded
into reckless action by a heartfelt but hysterical sense that our
computer-based national infrastructure is vulnerable to bored teanagers
just  bright enough to scoop up the static passwords that circulate
unprotected on our networks; to run CRACK against readily-available
"secured" password files full of what everybody knows are guessable
passwords; or to slip through system backdoors announced world-wide by CERT
and FIRST alerts... but never patched, closed, or fixed.

        Sad.  No -- it's absurdly tragic!  Nunn's subcommittee will leap
from considering poor Datastream's vaunted outlaw prowess to offer, in the
weeks to come, yet another proposal for guaranteed government access to
private sector crypto keys.  (And this one might fly with the Nation -- all
those Nations -- At Risk.)

        Somehow, firing, fining, demoting, or making liable for damages,
any designated system administrator who can't find the time (within, say, a
week) to apply vendor-circulated patches for vulnerabilities announced by
CERT is too extreme a proposal.  OTPs are too simple a solution. Better to
toy with the potential for repression than risk the revolutionary idea of
personal and professional responsibility.

        They say People ultimately get what they deserve.  Computer
professionals better pray that this is not the case.


                        _Vin

        (Zounds!  This was to be merely my two cents, but then the wind
caught my sails. Apologies for the overheated bandwidth.)


         Vin McLellan +The Privacy Guild+ <vin at shore.net>
      53 Nichols St., Chelsea, Ma. 02150 USA Tel: (617) 884-5548
                         <*><*><*><*><*><*><*><*><*>







From frantz at netcom.com  Fri Jun 28 17:20:06 1996
From: frantz at netcom.com (Bill Frantz)
Date: Sat, 29 Jun 1996 08:20:06 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <199606272352.QAA10348@netcom7.netcom.com>


At  6:38 PM 6/27/96 -0400, Vin McLellan wrote:
>        On Cypherpunks-L, Vin McLellan wrote:
>
>>>...  The real threat is incompetent, poor-trained DoD
>>>system administrators -- and a class of computer-illiterate senior managers
>>>who define "system security" and routine administration as a marginal
>>>expenses and scorn readily available options like one-time passwords as too
>>>complex for the military mind.
>
>        Bill Frantz <frantz at netcom.com> responded:
>
>>Public key authentication could go a long way toward solving the military
>>and contractor's security problems.  However, they won't use public key
>>authentication for unclassified systems until it is available in "COTS"
>>(Commercial, Off The Shelf) software.  And it won't be available there
>>until it can be exported as well as sold domestically.  Catch-22
>
>        I love PKC with all its promise, but you overstate (and IMHO,
>attribute inappropriately) the barriers that slow the adoption of one-time
>password authentication in the military... and many other more highly
>regarded IS environments.

On thinking about your rant, I think you have a valid point.  What our
venture capitalists said to us was, "There is no market for security."  Now
perhaps the ITAR helps suppress that market on the basis of, "If I'm going
to have to wander the information superhighway naked, why should I shut the
blinds on my house."  Given no market, and the requirement to support
everything you ever supported, it is hard to justify building in security
features.


>        No, in this case, the blame is spread far more widely.  Yes, DoD
>and other meta-institutions have been slow to acknowledge and act upon the
>obvious solution to their biggest and most obvious vulnerability.  [One 
>Time Passwords - WSF]  Security
>is still seen as a marginal item in the budget -- not something that must
>be designed into both the technology or implicit in its responsible
>management.

I have a client who provides services to part of the DOD.  (My contract
prevents me from being more specific.)  Their only saving grace is they
don't use the Internet or Unix.  (Making them vulnerable to a much smaller
group of hackers.)

The ideal situation for them would be to use public key authentication
because it would be entirely user-transparent.  Doing OTP's the way Apple
does them (see below) would also work well.  However, to implement one of
these systems requires modifying a bunch of terminal emulator programs from
different vendors (some of whom are no longer in business).  Without widely
adopted standards for OTP logon, these modifications are not likely to
happen.


>        But they've been able to get away with it because the hardware
>vendors and big software companies -- the very firms which now harp on ITAR
>denying them the international market -- have been so hesitant to risk
>their margins by designing security into their number crunchers...

I think that backward compatibility requirements are a significant part of
the reason we see this problem.  The other part is, of course, that there
is no market for security.

Apple has a form of one time passwords in their file sharing system.  When
you enter your password, it is used as a key to encrypt a challenge sent by
the file server (Using a symmetric cypher).  The result is returned,
decrypted and compared with the original challenge.  But this system didn't
have to be compatible with a hardware VT100 or TTY-33.


>        Somehow, firing, fining, demoting, or making liable for damages,
>any designated system administrator who can't find the time (within, say, a
>week) to apply vendor-circulated patches for vulnerabilities announced by
>CERT is too extreme a proposal...

The problem, in general, isn't the system administrators.  If management
gave the same priority to security that it does to joining new users or
installing new hardware, sysadmins would have the time to install the
patches.  Most sysadmins are up to their asses in alligators.  Security is
something to put off.  If the managers were judged on the security of their
systems (perhaps via independent audit), then they might give the problem
some priority.


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From iang at cs.berkeley.edu  Fri Jun 28 17:20:08 1996
From: iang at cs.berkeley.edu (Ian Goldberg)
Date: Sat, 29 Jun 1996 08:20:08 +0800
Subject: New mixmaster up: jammix
Message-ID: <4qvaui$plc@abraham.cs.berkeley.edu>


-----BEGIN PGP SIGNED MESSAGE-----

I've finally gotten around to installing mixmaster.  I'll install a Type 1
tomorrow or next week.  Any suggestions on which (I hope this isn't a
religious war...)?

jammix mix at cypherpunks.ca c2178bf3018c062a8d0fabd066e50ed9 2.0.3

- -----Begin Mix Key-----
c2178bf3018c062a8d0fabd066e50ed9
258
AATgExB26IdURw+itvFEQsWjv/mQFgg3Tu2avLU2
fdW55aqKqKDeiIWf8nY24HG+i08s65cp8zCm2w7E
ZvzgcBxLQu91Sg1UbQlkYMYqx8NpeKjxnkU+5KqC
mswqrAbOn0qqcmNz7/3TsGS0p22+Dsw9rLjwDk4o
udzR2maCUTuDvwAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAQAB
- -----End Mix Key-----

   - Ian

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdMvBUZRiTErSPb1AQEOFwQAlseh5bV8OaBgH/eIqNbxm7whFoOfjdDN
2AjcX17G1VsX/T/qMVXLle0KJ7Ac+e4f5RMcU5iAjEueU06jor4xEJOqDDQsIn2w
56niRMFICStAm2babEu1RSbgwLIZ35lA0l3ybO/g9AijDTFD9PD+lIyKX+vH7fXB
ey4TQOAC1XM=
=ZdGA
-----END PGP SIGNATURE-----





From vinnie at webstuff.apple.com  Fri Jun 28 17:46:34 1996
From: vinnie at webstuff.apple.com (vinnie moscaritolo)
Date: Sat, 29 Jun 1996 08:46:34 +0800
Subject: crypto and bagpipes [NOISE]
Message-ID: <v0300740dadf8d550a116@[17.203.21.75]>


>>>A Missive From: David Kovar (kovar at nda.com)
>>>
>>>What is the connection between crypto and bagpipes? Well
>>>crypto is regarded as an armament by the US ITAR regulations.
>>>Later this month a British court is to rule as to whether
>>>bagpipes are still classified as "instruments of war"!
>>>The story is in today's Times newspaper (The British one)
>>>It seems that a piper is being taken to court for practising
>>>on Hampstead Heath, which has a bye-law forbidding music.
>>>Mr Brooks, the piper, has denied the charge, citing a case in 1746,
>>>where bagpipes were declared to be instruments of war, not musical
>>>instruments, and a subsequent Act of Parliament which specifically
>>>stated that they were weapons. He claims he wasn't playing a musical
>>>instrument, but practising with a weapon!
>>>
>>>The imagination boggles if his claim is successful! Will it
>>>be possible to sue pipers for assault with a deadly weapon?
>>>Will airports be equipped with bagpipe detectors?
>>>
>>>David Wadsworth                |  Wohin der Weg? Kein Weg!
>>>dwadsw at etna.demon.co.uk        |  Ins Unbetretene. (Faust)



Vinnie Moscaritolo
------------------
"friends come and friends go..but enemies accumulate."
http://www.vmeng.com/vinnie/
Fingerprint: 4FA3298150E404F2782501876EA2146A







From privsoft at ix.netcom.com  Fri Jun 28 18:02:40 1996
From: privsoft at ix.netcom.com (Steve O)
Date: Sat, 29 Jun 1996 09:02:40 +0800
Subject: Crack for DOS
Message-ID: <1.5.4.16.19960627202318.3cf78a08@popd.ix.netcom.com>


Guys,

1. A colleague of mine was interseted in in demonstrating the unix password
cracking program Crack on a windoze system. Where can one be found if one
exists?

2. If you were looking to compare single key block ciphers like Blowfish,
DES, 3xDES etc. Which one would be considered the best for implementation in
a software security package, assuming maximal key lengths irreverant of the
governmental restrictions.

3. Does anyone have info re: S/MIME implementation time table into the
Netscape browser?

Thanks
SO
 Steve O.

"True Utopia can only be reached by an uncensored and secure Internet,
	True Chaos can only be reached by the government,
		True love can only be reached in the movies."
S.O.

"Bang your head, Metal Health will drive you mad!"
Quiet Riot

"Welcome my friend, Welcome to The Machine"
Pink Floyd

"Lonelyness and Emptiness;
 Love and Fulfillment;
 Are all but flashes 
 in the eye of the storm
 of our tormented soul."
S.O.






From declan at well.com  Fri Jun 28 18:04:39 1996
From: declan at well.com (Declan McCullagh)
Date: Sat, 29 Jun 1996 09:04:39 +0800
Subject: Fight-Censorship Dispatch #15: Government Appeals CDA!
Message-ID: <v01510103adf8ed692839@[204.62.128.229]>




-----------------------------------------------------------------------------
                    Fight-Censorship Dispatch #15
-----------------------------------------------------------------------------
                     Justice Department Appeals!
-----------------------------------------------------------------------------
         By Declan McCullagh / declan at well.com / Redistribute freely
-----------------------------------------------------------------------------


June 27, 1996

WASHINGTON, DC -- With no fanfare and no hype, the Justice Department
yesterday faxed a 39-word statement to Senator Exon saying they will
appeal their loss in the Philadelphia case.

The consolidated lawsuits of ACLU v. Reno and ALA v. DoJ resulted in a
victory for the plaintiffs earlier this month after a three-judge panel
granted a preliminary injunction preventing the DoJ from enforcing the
Communications Decency Act.

I didn't know about this letter until about 15 minutes ago, when Bruce "I
wrote the CDA" Taylor showed up outside my office for a HotWired Club
Wired chat at 9 pm this evening.

Taylor was grinning. "I got a scoop for you guys. You owe me. Nobody but
Senator Exon would have gotten this letter out of the department."

For a while, netizens were worrying that the DoJ might appeal the New
York American Reporter v. Reno case, a narrower and weaker appeal that
only challenged part of the CDA.

This letter means that the ACLU/ALA case is definitely going to the
Supremes, which will likely result in a decision a year from now.

Stay tuned for more reports, and check in at Club Wired for the Taylor
transcript. He says it'll be a "roast." We'll see...

-----------------------------------------------------------------------------


Office of the Deputy Attorney General
Washington, DC 20530

June 26, 1996

The Honorable J. James Exon
United States Senate
Washington, DC 20510

Dear Senator Exon:

With regard to your request as to the status of the appeal on ACLU v.
Reno, this letter is to inform you that the Department of Justice will
file a Notice of Appeal on or before the July 2 deadline.

Sincerely

[signed]

Jamie S. Gorelick
Deputy Attorney General

-----------------------------------------------------------------------------

Mentioned in this CDA update:

  HotWired Club Wired:
    http://www.hotwired.com/eff/
  Deputy Atty Gen Jamie Gorelick's speech slamming Net, calling for controls:
    http://fight-censorship.dementia.org/dl?num=2733
  Bruce Taylor's amicus "finger" brief in NYC CDA lawsuit:
    http://fight-censorship.dementia.org/dl?num=2736

  Fight-Censorship list   <http://fight-censorship.dementia.org/top/>
  Rimm ethics critique    <http://www.cs.cmu.edu/~declan/rimm/>
  Int'l Net-Censorship    <http://www.cs.cmu.edu/~declan/international/>
  Justice on Campus       <http://joc.mit.edu/>

This document and previous Fight-Censorship Dispatches are archived at:
  <http://fight-censorship.dementia.org/top/>

To subscribe to future Fight-Censorship Dispatches and related
announcements, send "subscribe fight-censorship-announce" in the body
of a message addressed to:
  majordomo at vorlon.mit.edu

Other relevant web sites:
  <http://www.vtw.org/>
  <http://www.cpsr.org/>
  <http://www.epic.org/>
  <http://www.aclu.org/>
  <http://www.cdt.org/>
  <http://www.ala.org/>
  <http://www.eff.org/>

-----------------------------------------------------------------------------








From lucifer at dhp.com  Fri Jun 28 18:25:06 1996
From: lucifer at dhp.com (Lucifer Remailer Operator)
Date: Sat, 29 Jun 1996 09:25:06 +0800
Subject: John Grubor and me
Message-ID: <Pine.LNX.3.91.960627221432.29950A-100000@dhp.com>


Just for the record, I am not John Grubor and had never even heard of him
before I did an Altavista search on his name earlier today.  The concept that
some net.loon like Grubor would get another account with DHP to run an
anonymous remailer for whatever reason is laughable.  From what I have read,
Grubor spams newsgroups quite often, something I have not done nor plan on
doing.  I was expecting people to be posting paranoid rantings about how I
am obviously a spook...





From rodger at interramp.com  Fri Jun 28 18:41:16 1996
From: rodger at interramp.com (Will Rodger)
Date: Sat, 29 Jun 1996 09:41:16 +0800
Subject: ALERT - DOJ TO APPEAL CDA says Interactive Week
Message-ID: <v01510100adf8a9427970@[38.11.99.32]>


 From a draft to be posted shortly at http://www.zdnet.com/intweek


By Will Rodger
Wahington Bureau Chief
Inte at active Week

The Department of Justice will appeal to the Supreme Court a federal court
decision that stayed enforcement of a controversial Internet indecency law,
sources close to the court challenge told Inter at ctive Week Thursday.
Department of Justice lawyers gave Sen. J. James Exon, D-Nebr. news of the
appeal in a three-line letter delivered to the law's chief sponsor
Wednesday. A copy of the letter was obtained by Inter at ctive Week.
Exon welcomed the news. "We needed the Justice Department to make a final
decision on the appeal, which I am pleased that they have done with the
full support of the White House," Exon said. "This will now go to the
Supreme court and I believe we will get a more thoughtful decision out of
the top court than what the court in Philadelphia ruled."
Attorneys on the other side seemed equally pleased.
"This is wonderful news because it means the Supreme Court will have a
chance to speak on these issues," said Mike Godwin, staff counsel of the
Electronic Frontier Foundation. "We feel certain the Supreme Court will
uphold the lower court's finding that the statute is unconstitutional."
The Communications Decency Act, passed as part of telecommunications reform
legislation last February, would have banned indecent images and speech
from any areas open to minors on the Internet. Under the law, operators of
Internet sites would have been required to segregate indecent content into
adults-only areas that required a credit card or other form of positive
identification for access.
Drafters based their restrictions in large part on regulations governing
broadcast media which still prohibit indecency over the airwaves, as well
as some local ordinances which require segregation of indecent materials
from others.
But a coalition of civil liberties groups, for-profit and non-profit
organizations challenged the Act in a consolidated suit before a federal
court in Philadelphia. The law, plaintiffs claimed, was unconstitutional
since it set up restrictions on indecent but constitutionally protected
speech.
The CDA, moreover, would place a "chilling effect" on free speech as
Internet users unnecessarily limited their speech in order to comply with
an impermissibly vague law, plaintiffs claimed. In place of the CDA,
plaintiffs suggested evolving technologies in the hands of responsible
parents would better protect children while preserving adults' First
Amendment rights.
The Philadelphia Court agreed with the plaintiffs on all counts, striking
down the law June 12. In a unanimous decision, a three-judge panel found
that the democratic nature of  the Internet entitled it to at least as much
protection as print, traditionally the least regulated of all media. The
court also found that the statue was impermissibly vague and would thus
unnecessarily restrict speech. The court also ruled the government had
failed to show the law was enforceable with current technology.

Cheers.

Will







From nson at kpmg.com  Fri Jun 28 18:46:32 1996
From: nson at kpmg.com (nson at kpmg.com)
Date: Sat, 29 Jun 1996 09:46:32 +0800
Subject: FTS2000 and Encryption?
Message-ID: <9605288360.AA836007879@mailgate5.kpmg.com>


I trying to find out if there are any talks, decisions or even standards being 
discussed for encryption and FTS2000?

Anything will be helpful.






From iang at cs.berkeley.edu  Fri Jun 28 18:52:09 1996
From: iang at cs.berkeley.edu (Ian Goldberg)
Date: Sat, 29 Jun 1996 09:52:09 +0800
Subject: New mix/ghio.remailer.2 remailer up: jam
Message-ID: <199606281906.MAA29266@abraham.cs.berkeley.edu>


-----BEGIN PGP SIGNED MESSAGE-----

As anticipated, I've put up a ghio.remailer.2.  The email address is
<remailer at cypherpunks.ca>.

Here's the public key:

Type bits/keyID    Date       User ID
pub  1024/734C3A3D 1996/06/28 John Anonymous MacDonald Remailer <remailer at cypherpunks.ca>
sig       734C3A3D             John Anonymous MacDonald Remailer <remailer at cypherpunks.ca>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzHUH7sAAAEEAKi9dAsHtUYzWu8u/0O3HKfWMYYfuwlo9y5W1x+lvNdZ9RL0
T1znvGaaoGmVF76qzl3aAabuoiKTdeGyUtZ5kZ/Ka+DpMaRQUaTY7i4wf3vD8u1I
y2mTGYv945BwBdhcpDeTVCK81J6krnY1iAi6o8GqtATQHeJskDz5wkNzTDo9AAUR
tDtKb2huIEFub255bW91cyBNYWNEb25hbGQgUmVtYWlsZXIgPHJlbWFpbGVyQGN5
cGhlcnB1bmtzLmNhPokAlQMFEDHUH+c8+cJDc0w6PQEBIC0D/jMBXNlMBSokNveZ
7LvWpWKfOlHwNSNGT3p403o21bIG9txsPk9e/wDurG310hJglKBuovoenqwClxy/
m6lldAe+11VMpLimzUCE0W4LeJxW84N+Jg/SGmP7YF1N0OmAc0snfvJhhgI0kWHl
DMu+pWAc6UXLEPln0wtb936TFxbA
=WL1j
- -----END PGP PUBLIC KEY BLOCK-----

It also accepts Mixmaster messages:

jam remailer at cypherpunks.ca c2178bf3018c062a8d0fabd066e50ed9 2.0.3

- -----Begin Mix Key-----
c2178bf3018c062a8d0fabd066e50ed9
258
AATgExB26IdURw+itvFEQsWjv/mQFgg3Tu2avLU2
fdW55aqKqKDeiIWf8nY24HG+i08s65cp8zCm2w7E
ZvzgcBxLQu91Sg1UbQlkYMYqx8NpeKjxnkU+5KqC
mswqrAbOn0qqcmNz7/3TsGS0p22+Dsw9rLjwDk4o
udzR2maCUTuDvwAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAQAB
- -----End Mix Key-----

Note that the above mix line should be used instead of the one
(called "jammix") I posted yesterday.

For Raph's remailers file:

$remailer{"jam"} = "<remailer at cypherpunks.ca> cpunk mix pgp hash latent cut ek";

   - Ian

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdQs3UZRiTErSPb1AQHC9gP+KT5KfwsHdK6S7Urg2iVxbLAqci5+gZhi
E6UKqsolDv8BMCr5nJuMClEHfdJBGrGeyrazgcxESmOzAoj/TfHbIU6seg46/q9c
pSpASazX39YE8Os5hMomgcEfFBVFE8+m9XUWGNnpCvyO8ZtlfVyQS+vG0aS2o0hE
/59pTd0iTAM=
=J5Hd
-----END PGP SIGNATURE-----





From smith at sctc.com  Fri Jun 28 18:56:56 1996
From: smith at sctc.com (Rick Smith)
Date: Sat, 29 Jun 1996 09:56:56 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <199606281551.KAA00586@shade.sctc.com>


frantz at netcom.com (Bill Frantz) writes about the miserable state of
computer security, and I'll comment on some statements, hopefully
taken not too far out of order and context:

>I think that backward compatibility requirements are a significant part of
>the reason we see this problem.  The other part is, of course, that there
>is no market for security.

The phrase "backward compatibility" is, in my experience, a code
phrase for peoples' annoying habit of wanting to stay with things
they've finally made useful as opposed to having them replaced by
something "better" that is more expensive, less convenient, and in
general less familiar. The components of the latest release of MS
Office come to mind as a good example, and they didn't even include
public key crypto to atone for it.

I agree that it's seductive for us security weenies to think the tail
wags the dog, but let's remember what's really supposed to be happening.

The requirement isn't "backwards compatibility," the requirement is
that people get their work done. If the security threat keeps them
from getting their work done, then backwards compatibility is no
longer a major requirement.

>The problem, in general, isn't the system administrators.  If management
>gave the same priority to security that it does to joining new users or
>installing new hardware, sysadmins would have the time to install the
>patches.  Most sysadmins are up to their asses in alligators.  Security is
>something to put off.  If the managers were judged on the security of their
>systems (perhaps via independent audit), then they might give the problem
>some priority.

The problem (or at least the difference) is in the priorities
established by an organization's culture. Some would rather take the
risks and do things in a fairly open, if unpredictable, environment.
Some prefer and even thrive on predictability. Either approach can and
does produce valuable results. However, few people want to use a bank
that takes the "open, if unpredicable" approach. Banks have auditors.

>The ideal situation for them would be to use public key authentication
>because it would be entirely user-transparent. ...

Nonsense. The mere fact that it's not currently deployed guarantees
that it won't be user transparent. Vendors will include it on some
rewrite of whatever software it's embedded in. Memory requirements go
up and delays are introduced when the crypto computations are
performed. Security will be added only if it gives customers more
things they can do, so there'll be other functional changes as well.

In any case, working crypto *can't* be entirely user transparent.
People need to handle keys, choose the one to use, and update them
occasionally. There is a lot of training and cultural awareness
involved here that just doesn't exist yet.

And there will be *billions* in fraud before people finally learn,
then maybe it'll attenuate to mere millions (and I'm probably still
optimistic by orders of magnitude).  Look at credit and ATM cards. A
dozen years ago a bank issued us some ATM cards, and the clerk
insisted on writing the PIN code ON the cards. Very few banks do that
any more.

Rick.
smith at sctc.com            secure computing corporation





From alano at teleport.com  Fri Jun 28 18:57:54 1996
From: alano at teleport.com (Alan Olsen)
Date: Sat, 29 Jun 1996 09:57:54 +0800
Subject: [NOISE] Ga Law/No False Identity
Message-ID: <2.2.32.19960628182607.00ad9fc8@mail.teleport.com>


At 05:43 PM 6/27/96 -0400, AwakenToMe at aol.com wrote:

>falsely id a person?? Well it seems to me ya just wanna get the messages
>OUTTA there and arent trying to 'act' as that person in the sense that you
>are posing to NO person that you really are that person.

I just wonder how the law is going to effect all those web servers posing as
nobody (uid #-1).

"When SUID is outlawed, only outlaws will become sysadmins."
---
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.teleport.com/~alano/          | alano at teleport.com  |






From jya at pipeline.com  Fri Jun 28 18:59:16 1996
From: jya at pipeline.com (John Young)
Date: Sat, 29 Jun 1996 09:59:16 +0800
Subject: DUO_pol
Message-ID: <199606282215.WAA21486@pipe6.t2.usa.pipeline.com>


   We offer cypherpunk Jim Ray's column in The Miami Herald of 
   June 24 on suppression of political freedom in Florida by 
   the Democrat-Republican duopoly. 
 
 
   http://pwp.usa.pipeline.com/~jya/duopol.txt  (5 kb) 
 
   DUO_pol 
 





From droelke at rdxsunhost.aud.alcatel.com  Fri Jun 28 19:00:11 1996
From: droelke at rdxsunhost.aud.alcatel.com (Daniel R. Oelke)
Date: Sat, 29 Jun 1996 10:00:11 +0800
Subject: Yet another mailing list
Message-ID: <9606282223.AA29739@spirit.aud.alcatel.com>



For those of you who are privacy-cypherpunks - there is
another list (run by big-brother) out there on the issue.

>From the list-of-lists:

PRIVACY
  Subscription Address: PRIVACY-REQUEST at FTC.GOV
  Owner: John Audette <ja at mmgco.com>
  Last Update: 12/28/95
  Description:
   A mailing list created bt the US Federal Trade Commission to allow
   interested parties to discuss the issues surrounding the privacy
   interests of consumers visiting web sites.  It is part of the FTC's
   "Privacy Initiative" to investigate whether the information
   collected at websites (either that affirmatively submitted by a
   visitor via a form or information collected based upon a visitor's
   selection of pages at a site to reflect personal interests) should
   be the subject of regulation by the FTC.


------------------------------------------------------------------
Dan Oelke                                  Alcatel Network Systems
droelke at aud.alcatel.com                             Richardson, TX






From maldrich at grci.com  Fri Jun 28 19:03:29 1996
From: maldrich at grci.com (Mark O. Aldrich)
Date: Sat, 29 Jun 1996 10:03:29 +0800
Subject: MS-Mail Security
In-Reply-To: <TCPSMTP.16.6.27.-15.0.46.2780269260.1184837@nycmetro.com>
Message-ID: <Pine.SCO.3.93.960628171056.19646C-100000@grctechs.va.grci.com>


On Thu, 27 Jun 1996 harka at nycmetro.com wrote:

>  In> I would like to gather informations of whether the MS-Mail server
>  In> is  secure or not, is anyone heard of somebody, say, disguise as other
>  In> user  or read other user e-mail?
> 
> I'd also like to know how secure the MS-Mail files are (*.mmf). They are
> password protected and should be encrypted but does anybody know how
> secure? 

We have worked extensively with MS Mail and providing integrated crypto
features for the product.  The native security on the files is provided in
two ways:  1)  The usually poor MS "scrambling" (it's not really crypto),
and 2) The discretionary access controls (DAC) of the OS.  Since only NT
has decent DAC (which only works at a C2 level of trust when it's not on a
network), my opinion of the risk level would be "VERY HIGH" against
threats of repudiation, loss of confidentiality, loss of availability, and
loss of integrity. 

Further, the I&A mechanisms in everything other than a stand-alone NT
environment are inadequate for any real proof of identity.  They most
certainly can't offer anything close to a real non-repudiation solution.
Forging a "from" header into the database is, I would contend, fairly
simple.  Reading someone else's mail is a bit harder, but not incredibly
difficult.  If traditional hacking doesn't work, building a hacking tool
using MAPI (widely available API to the mail subsystem) would be fairly
straight-forward (Hmmmmm - Summer vacation programming project???). 

------------------------------------------------------------------------- 
|Just as the strength of the Internet is  |Mark Aldrich                 |
|chaos, so the strength of our liberty    |GRCI INFOSEC Engineering     |
|depends upon the chaos and cacophony of  |maldrich at grci.com            |
|the unfettered speech the First Amendment|MAldrich at dockmaster.ncsc.mil |
|Protects  - Federal Judges on the CDA    |                             |
|_______________________________________________________________________|
|The author is PGP Empowered.  Public key at:  finger maldrich at grci.com |
|    The opinions expressed herein are strictly those of the author     |
|         and my employer gets no credit for them whatsoever.           |
-------------------------------------------------------------------------






From frantz at netcom.com  Fri Jun 28 19:06:05 1996
From: frantz at netcom.com (Bill Frantz)
Date: Sat, 29 Jun 1996 10:06:05 +0800
Subject: CIA Fears UmpTeen InfoNukes
Message-ID: <199606281920.MAA12136@netcom7.netcom.com>


At 10:51 AM 6/28/96 -0500, Rick Smith wrote:
>frantz at netcom.com (Bill Frantz) writes:
>>I think that backward compatibility requirements are a significant part of
>>the reason we see this problem.  The other part is, of course, that there
>>is no market for security.
>
>...
>
>The requirement isn't "backwards compatibility," the requirement is
>that people get their work done. If the security threat keeps them
>from getting their work done, then backwards compatibility is no
>longer a major requirement.

Absolutely.  However, from a vendor's point of view, customers have a wide
range of security problems.  Some run in an open environment and have no
use for security.  They may still be using those VT100s.  These are the
customers the vendor considers when thinking of backwards compatibility.


>>The ideal situation for them would be to use public key authentication
>>because it would be entirely user-transparent. ...
>
>Nonsense. The mere fact that it's not currently deployed guarantees
>that it won't be user transparent. Vendors will include it on some
>rewrite of whatever software it's embedded in. Memory requirements go
>up and delays are introduced when the crypto computations are
>performed. Security will be added only if it gives customers more
>things they can do, so there'll be other functional changes as well.

There are several "users" at issue.  I fully agree that those
administrators responsible for upgrading the software and hardware for the
change will notice.  The people who have to pay for it all should also
notice.  But the actual end user may find the logon simplified.  If is
sufficent to mearly identify the machine and not the person, then the new
software can eliminate end user involvement in the logon.  The
administrator is responsible for installing the private key in the machine
and the end user never sees it.

On the other hand, if users still must be identified, it is possible to
give them a logon interface which is unchanged from the old,
non-one-time-password, interface, while still giving them the benefits.


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From perry at piermont.com  Fri Jun 28 19:06:18 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sat, 29 Jun 1996 10:06:18 +0800
Subject: crypto and bagpipes [NOISE]
In-Reply-To: <v0300740dadf8d550a116@[17.203.21.75]>
Message-ID: <199606280352.XAA06868@jekyll.piermont.com>



vinnie moscaritolo writes:
> >>>A Missive From: David Kovar (kovar at nda.com)
[...]
> >>>Mr Brooks, the piper, has denied the charge, citing a case in 1746,
> >>>where bagpipes were declared to be instruments of war, not musical
> >>>instruments, and a subsequent Act of Parliament which specifically
> >>>stated that they were weapons. He claims he wasn't playing a musical
> >>>instrument, but practising with a weapon!
> >>>
> >>>The imagination boggles if his claim is successful!

No one who has heard sustained bagpipe playing can deny the fact that
bagpipes are indeed an instrument of war, with no legitimate place in
peaceful everyday society.

Perry





From stewarts at ix.netcom.com  Fri Jun 28 19:07:55 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 29 Jun 1996 10:07:55 +0800
Subject: Alternic.net (was domain zapping)
Message-ID: <199606281605.JAA22735@cygnus.com>


At 02:42 PM 6/26/96 -0700, jfricker at vertexgroup.com (John F. Fricker) wrote:
>Well, Karl's IETF draft is certainly serious. A Karl is a bit more than a
>kid with a linux box having started one of the largest ISPs in Chicago and
>being a component in the anti CIX fiasco.
>
>I still fail to see why decentralizing control of namespace is a bad idea.

Decentralizing control is a good thing; after all, that's what the 
domain name hierarchy is _for_.  One cost of decentralized control
is the need for coordination between different parts of the namespace.
Another cost is the need to move between namespaces if the
namespace owners either fail or implement policies you dislike.
Having one namespace owner per country plus a couple extra for
non-nationalist namespaces is a convenient approach for accomplishing it,
and worked well when the number of users was small enough that
managing namespaces was a low-volume non-political effort.
That's no longer true.  And as long as the namespace management
is coupled with nameserver administration, which it probably needs to be,
the number of toplevel domains will need to remain small,
and the namespace managers will be motivated to charge money
for names as a way to pay for the nameservers and administration.

Opening up the top-level namespace lets you out of NSI's control, 
if you can coordinate with them and the country-based namespace owners,
but doesn't solve the basic problem.  If you don't do it carefully,
you'll end up needing a bunch of Above-Top-Level nameservers that
serve the names of the tens of thousands of top-level domains.
Karl's draft is an interesting approach; don't know if it'll work.


#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Distract Authority!






From gregmi at galileo.mis.net  Fri Jun 28 19:08:23 1996
From: gregmi at galileo.mis.net (Greg Miller)
Date: Sat, 29 Jun 1996 10:08:23 +0800
Subject: MS-Mail Security
In-Reply-To: <Pine.SOL.3.91.960627231233.11957A-100000@sol25.cs.cuhk.hk>
Message-ID: <31d46260.87906896@pop.mis.net>


On Thu, 27 Jun 1996 23:13:23 +0800 (HKT), you wrote:

>    I would like to gather informations of whether the MS-Mail server is 
>secure or not, is anyone heard of somebody, say, disguise as other user 
>or read other user e-mail?

	I haven't looked into it a great deal, but I have forgotten my password
and was able to retreive my mail by deleting the password file and making a new
one.


begin 644 tagline.txt
enum MicrosoftBoolean {TRUE, FALSE, MAYBE};
Greg Miller: Programmer/Analyst (gregmi at mis.net)
http://grendel.ius.indiana.edu/~gmiller/
end.





From hlin at nas.edu  Fri Jun 28 19:08:46 1996
From: hlin at nas.edu (Herb Lin)
Date: Sat, 29 Jun 1996 10:08:46 +0800
Subject: The National Research Council Study of National...
Message-ID: <9605288359.AA835967230@nas.edu>


Subject:
The National Research Council Study of National Cryptography Policy

  The NRC report entitled

  Cryptography's Role in Securing
  the Information Society
  
  was released on May 30, 1996.
  
  A public briefing on the report will be held in New York City:
  Wednesday, July 10, 1996, 10:00 am to noon.
  
  It will be presented at the Association of the Bar of the City of New York
  (ABCNY) under the aegis of its Committee on Science and Law.
  Mr. Kenneth Dam, study chair and Max Pam Professor of American and Foreign Law
   at the University
  of Chicago, Mr. Colin Crook, committee member and senior technology officer at
   Citicorp, and Dr.
  Herbert Lin, study director and senior staff officer of CSTB, will be present.

  The briefing will take place in the Stimson Room, 42 W. 44th Street, New York,
   New York, from 10:00
  a.m. to Noon.  Committee members will respond to questions from attendees, and
   a limited number of
  pre-publication copies of the report will be available at that time.  For
  further information, please
  contact Michael Schiffres of the ABCNY Committee on Science and Law at (718)
  248-5708 for further
  information.  The event is open to the press and the public.

     If you have suggestions about other places that the committee should
     offer a public briefing, please send e-mail to crypto at nas.edu.






From stewarts at ix.netcom.com  Fri Jun 28 19:09:18 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 29 Jun 1996 10:09:18 +0800
Subject: Ga Law/No False Identity
Message-ID: <199606280630.XAA16312@cygnus.com>


>>:  It shall be unlawful for any person, ... to transmit any data 
>>:  through a computer network ... if such data uses any individual 
>>:  name, ... to falsely identify the person, ... 

You don't have to falsely identify yourself to do spam canceling -
in addition to the header saying
        From: Spammer <president at whitehouse.gov>
you can put in a header with your real name
        Really-From: Mario Greymist <mario at luigi.com>
or put your real name in the body, or a nym you use (e.g. Cancelpoodle)
with an explanation that you're cancelling the spam posted by the
spammer.

>>Spamming aside, this strikes at my privacy and choice of anonymity. 
Well, of course - it's an offensively bogus law for a variety of reasons :-)

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Distract Authority!






From hua at XENON.chromatic.com  Fri Jun 28 19:10:20 1996
From: hua at XENON.chromatic.com (Ernest Hua)
Date: Sat, 29 Jun 1996 10:10:20 +0800
Subject: News: NEC has encrypted networks ...
Message-ID: <199606281930.MAA00143@ohio.chromatic.com>


Japanese companies catching up and passing American companies
should scare those Congressional critters into action:

Ern

--------

06/27/96 VIRTUAL PRIVATE NETWORKING ADVANCES

PAGE: 1C 

NEC Technologies' Internet Business Unit has successfully demonstrated
country-to-country virtual private networking during several tests
performed in early June between the San Jose unit and its counterpart
in Tokyo. Virtual private networking promises a secure and
cost-effective alternative to privately leased lines. Most connections
across the Internet are not encrypted and information exchanged is
vulnerable to snoopers. In a virtual private network, encryption is
used to scramble the data.

(From SJ Mercury NewsLibrary)





From shabbir at vtw.org  Fri Jun 28 19:11:54 1996
From: shabbir at vtw.org (Voters Telecommunications Watch)
Date: Sat, 29 Jun 1996 10:11:54 +0800
Subject: INFO: Photos, testimony, and audio transcripts of 6/26 crypto hearing, get it now!
Message-ID: <199606280419.AAA08511@panix3.panix.com>


=============================================================================
          ____                  _              _   _
         / ___|_ __ _   _ _ __ | |_ ___       | \ | | _____      _____
        | |   | '__| | | | '_ \| __/ _ \ _____|  \| |/ _ \ \ /\ / / __|
        | |___| |  | |_| | |_) | || (_) |_____| |\  |  __/\ V  V /\__ \
         \____|_|   \__, | .__/ \__\___/      |_| \_|\___| \_/\_/ |___/
                    |___/|_|

         MISSED THE CRYPTO HEARINGS?  HEAR THE TRANSCRIPT WITH REALAUDIO,
            READ THE TESTIMONY WITH ANY BROWSER, VIEW THE FUZZY PHOTOS

                              Date: June 28, 1996

         URL:http://www.crypto.com/            crypto-news at panix.com
           If you redistribute this, please do so in its entirety,
                         with the banner intact.
-----------------------------------------------------------------------------
Table of Contents
        News
        Security And Freedom through Encryption forum: July 1, 1996
        (that's MONDAY!)
        How to receive crypto-news
        Press contacts

-----------------------------------------------------------------------------
NEWS

The second hearing on the Burns/Leahy Pro-CODE bill (S.1726) brought down
the house in the Senate this past Wednesday.  With a number of firsts
(first cyber-simulcast of a Senate hearing, first time testimony was submitted
purely through a WWW page) this is a monumental event.

But wait!  If you missed this standing room only event, you can still attend
virtually by visiting the hearing wrapup page at http://www.crypto.com/
There you will find the two hour RealAudio transcripts of the audio portion
of the day, links to online copies of many witnesses written testimony, and
some photos taken at the hearing.

-----------------------------------------------------------------------------
ATTEND THE SAFE FORUM - JULY 1, 1996 STANFORD CALIFORNIA

On July 1, 1996, in the heart of California's Silicon Valley at Stanford
University, members of Congress, prominent computer industry leaders and
privacy advocates will meet to discuss the need to reform U.S. encryption
policy.

The event is FREE and open to the public, but space is limited and is going
fast.  To find out more, and to reserve your free ticket, visit the SAFE
Forum Web Page at:

  http://www.crypto.com/safe

CONFIRMED SPEAKERS INCLUDE:

Among other prominent industry leaders, cryptographers, privacy advocates
and members of Congress, confirmed speakers include"

Industry Leaders and Cryptographers        Members of Congress

* Marc Andreeson, Netscape                 * Rep. Anna Eshoo (D-CA)
* Jim Bidzos, RSA                          * Rep. Tom Campbell (R-CA)
* Eric Schmidt, Sun Microsystems           * Rep. Zoe Lofgren (D-CA)
* Brad Silverberg, Microsoft               * Sen. Conrad Burns (R-MT)
* Phil Zimmermann, PGP Inc                   * Sen. Patrick Leahy (D-VT)
* Matt Blaze, AT&T                         * Sen. Larry Pressler (R-SD)
* Bruce Schneier, Counterpane Systems

Privacy Advocates and Legal Experts:

* Michael Froomkin, U. of Miami Law School
* Jerry Berman, Center for Democracy and Technology
* Grover Norquist, Americans for Tax Reform (invited)
* Ken Dam, U. of Chicago Law School (invited)

This event will be "cybercast", with full audio and still video clips,
live online with the help of MediaCast.  Details on the cybercast are
available at http://www.crypto.com/safe/

SAFE FORUM SPONSORS

This important discussion on the need for an alterative policy to protect
privacy and security and promote commerce on the Global Information
Infrastructure is being made possible by the generous support of the
following companies and public interest organizations:

America Online
Americans for Tax Reform
AT&T
Business Software Alliance
Center for Democracy and Technology
Center for National Security Studies
Commercial Internet eXchange
CompuServe Incorporated
Computer Professionals for Social Responsibility
Cylink Corporation
EDS
Electronic Frontier Foundation
Electronic Messaging Association
Electronic Privacy Information Center
Information Technology Association of America
IEEE - USA
MediaCast
Media Institute
Microsoft Corporation
Netcom Online Communication Services
Netscape Communications Corporation
Novell, Inc.
Oracle Corporation
Pacific Telesis
PGP Inc.
Prodigy, Inc.
Progress and Freedom Foundation
Securities Industry Association
Software Publishers Association
Sybase, Inc.
Voters Telecommunications Watch
Wired Magazine

Please visit the SAFE Forum Home Page for more information
(http://www.crypto.com/safe/)

-----------------------------------------------------------------------------
HOW TO RECEIVE CRYPTO-NEWS

To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com)
or send mail to majordomo at panix.com with "subscribe crypto-news" in the body
of the message.  To unsubscribe, send a letter to majordomo at panix.com with
"unsubscribe crypto-news" in the body.
-----------------------------------------------------------------------------
PRESS CONTACT INFORMATION

Press inquiries on Crypto-News should be directed to
	Shabbir J. Safdar (VTW) at +1.718.596.2851 or shabbir at vtw.org
	Jonah Seiger (CDT) at +1.202.637.9800 or jseiger at cdt.org

-----------------------------------------------------------------------------
End crypto-news
=============================================================================







From nobody at flame.alias.net  Fri Jun 28 19:12:13 1996
From: nobody at flame.alias.net (Anonymous)
Date: Sat, 29 Jun 1996 10:12:13 +0800
Subject: No Subject
Message-ID: <199606281309.PAA13151@basement.replay.com>


I would appreciate any information members may have regarding the security/safety of the new nym server nym.alias.net (in "alpha" state) who posted here about 3 weeks ago. Nym.alias.net reportedly is the same machine as anon.lcs.mit.edu.

Specifically, is the individual running the nym _known_ to cypherpunks, or is this an unknown about whom I should have serious doubts. The admin states that nym.alias.net is the same machine as anon.lcs.mit.edu. 

Any information or insight regarding the wisdom of using ths nym would be welcome.

Information concerning the nym I obtained by sending a message to help at nym.alias.net; the administrator can be reached at admin at nym.alias.net. 

 






From jya at pipeline.com  Fri Jun 28 19:12:41 1996
From: jya at pipeline.com (John Young)
Date: Sat, 29 Jun 1996 10:12:41 +0800
Subject: CIA Fears Hackers, Anonymity
Message-ID: <199606281016.KAA03774@pipe3.t2.usa.pipeline.com>


CIA Director Deutch's comments in the Defense Daily 
article below about hacker surveillance and the national 
security threat of anonymity: 
 
   "Tools are readily available on the Internet, and 
   hackers [computer experts] are a source for any 
   foreign nation or terrorist organization," he said. 
 
   The personal anonymity provided by cyberspace also 
   aids foreign agents, Deutch said, adding that 
   "hackers, with or without their full knowledge, may be 
   supplying advice and expertise to rogue states such as 
   Iran and Libya." 
 
   The CIA and other agencies are working to collect 
   information about hackers and their activities from 
   both informants and from other advanced means, 
   including signals intelligence, Deutch said. The CIA 
   is working closely with the Federal Bureau of 
   Investigations (FBI) and the Department of Justice to 
   collect and analyze information about hackers and 
   their relationships with organized crime and foreign 
   agents, he said. 
 
------ 
 
Defense Daily, 26 June 1996 
 
Deutch Orders Information Warfare Estimate 
 
The nation's top intelligence official said Tuesday that 
he has ordered a major review of foreign threats to the 
U.S. information, banking, and telecommunications 
networks.  
 
"The treat of information warfare and the damage it could 
cause to the U.S. is so significant that it warrants an 
National Intelligence Estimate (NIE)," John Deutch, 
Director of the Central Intelligence Agency (CIA), told 
the Senate Government Affairs committee yesterday. He 
added that disruption of the information infrastructure 
could give terrorists or foreign governments the ability 
to weaken U.S. national security. 
 
"Information attacks could not only disrupt our daily 
lives, but also seriously jeopardize our national or 
economic security," he added. 
 
Deutch said he ordered the NIE to focus attention on how 
vulnerable the nation's computer-based telecommunications 
and information networks are to foreign governments and 
terrorist groups, which are both, despite their relative 
differences in personnel and funding, potential threats 
to U.S. information networks. 
Information warfare is neither manpower intensive nor an 
expensive form of terrorism, Deutch said, adding that 
even the smallest radical group can exploit the 
unregulated and undefended expanse of cyberspace. 
 
For example, the Islamic militant group Hezboullah has 
been using the Internet and other modern means of 
communications for their daily operations, Deutch said. 
Such technology could also be used to launch a terrorist 
act on the U.S., he added. 
  
This NIE will determine the damage terrorists or foreign 
governments could inflict were they to combine 
information warfare techniques with conventional military 
tactics to attack the U.S. 
 
An NIE, which details potential security threats to the 
U.S., is usually crafted by the National Intelligence 
Council (NIC), a senior panel of career intelligence 
officers and academics. This NIE, however, will also 
include comments from the U.S. law enforcement community, 
the Defense Information Security Agency, the armed 
services, and representatives from the major 
telecommunications providers, Deutch said. 
 
The threat estimate is expected to be complete by 
December 1, 1996, he added. 
 
Preliminary evaluations conducted by the U.S. 
intelligence community suggest that such a coordinated 
information attack could seriously disrupt electric power 
grids, air traffic control centers, banks and the stock 
market, or even the operational effectiveness of deployed 
U.S. military forces. Deutch is concerned about the ease 
with which enemy agents can obtain the hardware and 
software required to attack the information 
infrastructure. 
 
"Tools are readily available on the Internet, and hackers 
[computer experts] are a source for any foreign nation or 
terrorist organization," he said. 
 
The personal anonymity provided by cyberspace also aids 
foreign agents, Deutch said, adding that "hackers, with 
or without their full knowledge, may be supplying advice 
and expertise to rogue states such as Iran and Libya." 
 
In addition to the high technology, computer-based threat 
to the U.S. information infrastructure, foreign agents 
could use conventional explosives to destroy key 
information facilities and data processing centers. 
 
Previous studies conducted by the U.S. intelligence 
community suggests that numerous foreign nations are 
creating "cyber-warfare" techniques for application on 
the modern battlefield, Deutch said. Those programs are 
geared towards crippling an enemy's command and control 
centers or disabling air defense networks, he added. 
 
Based upon the progress made by these military programs, 
disrupting U.S. civilian and commercial information 
networks would be easy, Deutch said. 
 
The U.S. intelligence community has begun several 
activities in response to the emerging cyber-threat, he 
said. 
 
The CIA and other agencies are working to collect 
information about hackers and their activities from both 
informants and from other advanced means, including 
signals intelligence, Deutch said. The CIA is working 
closely with the Federal Bureau of Investigations (FBI) 
and the Department of Justice to collect and analyze 
information about hackers and their relationships with 
organized crime and foreign agents, he said. 
 
Both the intelligence and law enforcement communities are 
trying to work with private industry and academia in this 
cyber-warfare campaign, he said. 
 
The Pentagon and the CIA may reorganize existing 
personnel and efforts to create a new information warfare 
center at the National Security Agency, he added. 
 
----- 
 
 
 
 
 
 





From ses at tipper.oit.unc.edu  Fri Jun 28 19:14:11 1996
From: ses at tipper.oit.unc.edu (Simon Spero)
Date: Sat, 29 Jun 1996 10:14:11 +0800
Subject: UK Crypto regs?
Message-ID: <Pine.SUN.3.91.960628170810.25672C-100000@tipper.oit.unc.edu>


Anybody got a trip report for the IEE meeting yesterday? I phoned the 
IEE press office, but no-one there seemed to have any briefings, and 
there didn't seem to be any coverage

Simon

---
Cause maybe  (maybe)		      | In my mind I'm going to Carolina
you're gonna be the one that saves me | - back in Chapel Hill May 16th.
And after all			      | Email address remains unchanged
You're my firewall -    	      | ........First in Usenet.........





From stewarts at ix.netcom.com  Fri Jun 28 19:18:25 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 29 Jun 1996 10:18:25 +0800
Subject: Crack for DOS
Message-ID: <199606280620.XAA24528@cygnus.com>


At 06:17 PM 6/27/96 -0700, you wrote:
>2. If you were looking to compare single key block ciphers like Blowfish,
>DES, 3xDES etc. Which one would be considered the best for implementation in
>a software security package, assuming maximal key lengths irreverant of the
>governmental restrictions.

"Best" really depends on your criteria for goodness....

DES has been thoroughly explored, and people have a good idea of how
strong it is and how easy it is to implement well in software.
It's not strong enough (you can do a bit better than 2**55 brute force tries,
and 2**55 isn't enough given modern computers), but you can take care 
of that by using Triple DES, preferably the 3-key form, which
is strong enough for the forseeable future.  It's also annoyingly
slow in software form, having been designed for bit-twiddling hardware,
but there are well-optimized versions on the usual archive servers.

Blowfish is new, so perhaps there are flaws that 10-20 years of analysis
will find.  But it's pretty good - it's small, fast in software,
and has an annoyingly slow key-schedule which makes it difficult to
use brute-force crackers on.  It's got variable key lengths.

RC4 and RC5 are also new, fast, have variable key lengths, and appear to
be quite strong if used with adequate choices of parameters.
RC5 is patented; RC4 was a trade secret, since leaked, and you may
get flak for using the _name_ RC4 in a commercial product.
40-bit keys make it exportable but easily brute-forced;
128-bit keys are quite strong.

#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Distract Authority!






From stewarts at ix.netcom.com  Fri Jun 28 19:22:29 1996
From: stewarts at ix.netcom.com (Bill Stewart)
Date: Sat, 29 Jun 1996 10:22:29 +0800
Subject: MS-Mail Security
Message-ID: <199606280631.XAA19392@cygnus.com>


Leo WONG Wing-yan <wywong2 at cs.cuhk.hk>
> In> I would like to gather informations of whether the MS-Mail server
> In> is  secure or not, is anyone heard of somebody, say, disguise 
> In> as other user or read other user e-mail?

You have to look at the whole environment.  MSMail typically runs
on MS-DOS / Windows PCs, on a network using Microsoft file server
protocols over TCP/IP, so it has all the vulnerabilities of that
environment.  (It can run over Novell Netware instead, which has
a somewhat more secure file server, but the system is still vulnerable.)
The easy attack is to use a sniffer or other ethernet eavesdropping
software to listen for MSMail messages on the LAN - they're not
sent encrypted.  It also runs over dialup, and the dialup and
LAN versions rely on a user-typed login name and password for security,
but don't require that the password meet any minimum standards
for length (empty passwords work just fine.)

MSMail is typically used for two different kinds of business applications -
a purely internal mail system that doesn't connect to the outside world,
or gatewayed to SMTP or UUCP to connect to other locations.
I don't know how secure the gateways are, but the places I've seen them
used they certainly haven't been reliable, and generally have been heavily
hacked on by the users to make them do what the users want, which probably
doesn't add to either the reliability or the security.  The mail client
has its own set of problems, such as choking on messages with more than
30KB of message body.  My purely personal non-official opinion is that 
it's the third worst mail system I've ever used.  (IBM PROFS is the worst,
and I watched someone use the original Prodigy 1200-baud 24x40 lines with
advertising on every page nonsense as well.)

harka at nycmetro.com
>I'd also like to know how secure the MS-Mail files are (*.mmf). 
>They are password protected and should be encrypted but 
>does anybody know how secure?

For those of you who aren't familiar with MSMail, the .mmf file
is the big hulking file that MSMail keeps all your mail in,
including new mail and mail filed in folders (you _can_ split it
so your Inbox resides in one .mmf on a mail server and all
your other mail folders are in one file on your PC.)  
The main effects are 
- if the file gets corrupted (perhaps by a bad disk block, or 
because the "operating system" crashed while you were using MSMail), 
you can't read the undamaged pieces,
- if you received a message that the MSMail client can't handle,
like a large text message, you can't read it directly from the mail file
using a text editor like Emacs.

I haven't tried to crack it, but the experience of people who've
cracked other Microsoft Office encryption (e.g. Word, Excel)
has been that it's been pretty wimpy.  It does prevent casual
users of your PC or server from reading your email by looking
at the file with an editor or by using the MSMail client without
the password, but I'd be very surprised if it kept out a professional
who wanted to take the time to attack it carefully.




#				Thanks;  Bill
# Bill Stewart +1-415-442-2215 stewarts at ix.netcom.com
# http://www.idiom.com/~wcs
#				Distract Authority!






From WlkngOwl at unix.asb.com  Fri Jun 28 19:27:05 1996
From: WlkngOwl at unix.asb.com (Deranged Mutant)
Date: Sat, 29 Jun 1996 10:27:05 +0800
Subject: GA law, spam, su etc.
Message-ID: <199606280949.FAA28164@unix.asb.com>


So wait... if I'm on a Unix box in Georgia and I use the 'su' 
command, am I breaking the law?

It would seem a 'better' law would outlaw the use of false identitity 
when comitting a crime, as is (supposeldy) the case in certain 
discrete carribbean islands...  which begs the question, since a 
crime is a crime, and using a false id to commit a crime is just 
icing on the cake (and doesn't need to be outlawed anyway).

Rob.


---
No-frills sig.
Befriend my mail filter by sending a message with the subject "send help"
Key-ID: 5D3F2E99 1996/04/22 wlkngowl at unix.asb.com (root at magneto)
        AB1F4831 1993/05/10 Deranged Mutant <wlkngowl at unix.asb.com>
Send a message with the subject "send pgp-key" for a copy of my key.





From cyber02 at sprynet.com  Fri Jun 28 19:36:03 1996
From: cyber02 at sprynet.com (`` Cyber - Times ``)
Date: Sat, 29 Jun 1996 10:36:03 +0800
Subject: `` Cyber - Times ``
Message-ID: <199606272057.NAA27234@dfw-ix11.ix.netcom.com>


========> Maximize your window for best viewing <==============

======> WELCOME TO CYBER - TIMES WEEKLY E-ZINE <=========

=============> The BEST web site  of the week! <================
===============> CNN on the WWW! <======================

=========> Check Out Our Complete Marketing Package! <=========

* Please do not be offended by this E-ZINE if you choose not to be informed of
valuable information, simply reply and put UNSUBSCRIBE in the SUBJECT and you
will receive no further issues. We are the PREMIERE Mailing Service on the
Internet today, and we currently have a subscription list of over 2,000,000
people now! Remember, we're a FREE E-ZINE, so enjoy your issue. And if you wish
to stay SUBSCRIBED to CYBER-TIMES E-ZINE simply do nothing and your FREE WEEKLY
issue will keep coming! If you have any friends that would enjoy receiving a
copy feel free to have them send a message to: subscribe at cyber-times.com  then
they will be added on our list.

----- Thanks you for your support ---- 
       --- CYBER - TIMES ---

* To place your ad in the Internet's Best E-Zine, go to the end of this 
 E-ZINE. We are having a TREMENDOUS Weekly SPECIAL!!

=====> GRAND OPENING: CYBER-TIMES MALL ON JUNE 28th <======

* To REPLY to an ad simply E-mail the address listed in the ad or visit
there Web Site.

///////////////////////////////////////////////////////////////////////////

************** Government: Home-Business ************************

============== NO MLM or SELLING =====================

Earn $500 to $1,000 weekly. This is a GUARANTEED Home-Business 
that was setup and created by the U.S. Government. We will even give 
you the phone number to call and verify the program. For FREE complete 
information visit us on the WWW at:     
                   http://members.gnn.com/HUDTRACER/fha.htm
or E-Mail our auto-responder at:====>   hud at cyber-times.com    
and you'll get complete information in 20 seconds!!

////////////////////////////////////////////////////////////////////////////

Hiring Now! This truly is THE PERFECT JOB - working on your home PC.
You can now telecommute from home with our International Software 
Company Co. We are seeking full-time & part-time personnel. We offer
flexible hours. Must have a computer to process customers orders. Earn 
$25+ per hour. Must be a PRO and have a clear phone voice. E-mail 
experience helpful.  If you are enthusiastic and have a positive 
personality call Mrs. Roberts at InterNetWorks at: (619) 781-4104. 
Call NOW  ...24 hours a day! Working at home is the "Wave of the Future". 
Come Surf the Net with us and earn your financial reward.
or e-mail my autoresponder at: internetworks at cyber-times.com

//////////////////////////////////////////////////////////////////////////

Save 50% ON YOUR PHONE BILL with rates as low as 9.9 cents per minute 
flat rate day or night from Sprint, MCI, and WilTel.  Home or business, billed
in 6 increments. Not MLM.  No fees, minimums, or commitments for most plans. 
Also available: 800/888#'s, calling cards, International callback, T-1's, and
more.  For complete rates, visit our web site at:
http://www.catalog.com/impulse/tel.htm or Email:  ad18 at cyber-times.com

////////////////////////////////////////////////////////////////////////////

HEALTHRIDER  Blowout Sale- $399.99! For a limited time, the premier total body
fitness machine that gently stretches and tones every major-muscle group in your
body at the same time is offering a "blowout special" on all remaining
demo-models for just $399.99.  That's a $100.00 savings off the original price,
so don't delay.  This rare HealthRider opportunity is for a limited time and is
good only while supplies last. Call us toll-free at (800) 529-2919 to get all
the details! Now's your chance to start looking and feeling your very best!  The
number to call is (800) 529-2919. (Restrictions may apply)

///////////////////////////////////////////////////////////////////////////

The Youngest MLM Co. ever Featured on the Cover of Success Mag.
Awarded 1995 Best Company in MLM, by MLM Insider Magazine
*Rated #1 by Market Wave/Profit Now, Jan. 1996
*World's most popular nutritionist, Dr. Earl Mindell
*World's most technologically advanced products
*PROVEN DOWLINE & SUPPORT SYSTEMS
Voice box 800-566-5319/800-663-0631 ref. #32025-9

///////////////////////////////////////////////////////////////////////////

MONEY MAKING OPPORTUNITIES FOR WOMEN Want extra money?
Want to be your own boss? Over **200** EXCITING and ENJOYABLE
ways to make fast and easy money.  Most require no training or 
investment.  Work Full Time! Work Part Time! All Legitimate.  Check out
my 20 Page BOOKLET for ONLY $5.00.  Send cash, check or money order
to A. Tucker   Box 371264    El Paso, Texas  79937.

//////////////////////////////////////////////////////////////////////////

WORK FROM HOME! NO INVESTMENT REQUIRED.  Experienced self-
motivated telemarketers wanted! Excellent income possibilities selling our
12.9 c/min. FLAT RATE long distance service & 17.9c/min travel card (NO 
SURCHARGES), with 6 second billing.  In test runs, telemarketers easily
signed 10 new customers a day.  One working full timer got 120 in 5 days.
Pay STARTS at $5/customer.  Earned raises and long-term residual income
in compensation plan.  208-263-5681 9am-8pm PDT.

///////////////////////////////////////////////////////////////////////////

                  SPORTS/ENTERTAINMENT
Sports News, Point Spreads and MUCH MUCH MORE!!
*ALSO Soap Opera Updates CALL NOW !!!
1-900-476-6368 EXT. 6761
$2.99 per minute
Must be 18 years to Call
Serv-U (619) 645-8434

///////////////////////////////////////////////////////////////////////////

THE PERFECT JOB FOR YOU!

Are you looking for legitimate work to do at home and make above average
income? WebWorks is seeking 100 agents to answer phones, return e-mail,
process orders and offer technical support for our Online Service.
For information email at: ad19 at cyber-times.com or call Ms. Doughery
for an interview at (409) 756-5669 9-6 p.m. Central Time.

///////////////////////////////////////////////////////////////////////////

Do YOU need a BIG, permanent monthly income?? (up to $65,000/month?) Would
YOU like to be able to help more people- family, charities?  Have you been
disappointed in networking/mlm programs?  16,000+ joined in OUR downline in
April!! Some are already making $65,000/mo! Contact me BEFORE you join for
benefits available only to our downline.  Call NOW:  512-505-6838 (3-minute
recorded message) Get fax on demand:  703-736-1600, doc 839 (call from
fax-phone) E-mail: ad5 at cyber-times.com      Fax: 360-423-2238         Do it Now!

////////////////////////////////////////////////////////////////////////////

INCREASE YOUR INCOME!
Get that promotion you deserve or find that dream job you've been looking
for. Learn the secrets of creating the ultimate  resume that hiring managers
choose most often.  These techniques have been tested and perfected over the
last 10 years.  For complete, easy, do-it-yourslef guide, including the "How to
Write the Perfect Bullet" section, send $14.95 to: M. Rogers, P.O. Box 583,
Hayward CA  94543-0583

////////////////////////////////////////////////////////////////////////////

                           THE PERFECT JOB FOR YOU !
The perfect job for those who wish to work at home on their own computers!!  S.
S. Publishing is seeking Customer Service Representatives to answer E-MAIL and
process INBOUND PHONE CALLS on your own telephone and computer.  Must be
positive, professional and have a pleasant phone voice and be familiar with
e-mail.  Experience preferred, but will train motivated, enthusiastic
individuals.  Full-time or Part-time positions available, you set the times that
work best for you.  Above average earnings!!  For more information call S.S.
publishing at 307-856-7090 or E-mail your daytime phone number to: 
ad20 at cyber-times.com 

///////////////////////////////////////////////////////////////////////////

Love Making 2000 (M/F) A guide on creating intense emotions for increased and
intense sexual pleasure.  Discover feelings in your body that you never knew
existed before.  Highs you never thought were possible.  Send $14.95 to Simmons
Enterprises 1186-1124 Londsdale Ave. North Vancouver, B.C.  V7M 2H1. Canada *As
a BONUS a chapter called Designing the Lovers Playroom. *Receive $150.00 for
your fantasy details in the book.

//////////////////////////////////////////////////////////////////////////

"FAX MACHINES WORK!!!  Use your Fax machine responsibly.  Use it to make
money (even while you are sleeping).  I'll show you how.  I'll give you living
proof. Call me TOLL FREE with your name, FAX, and phone numbers at:
1-800-995-0796 ext. 2583

//////////////////////////////////////////////////////////////////////////

============ THE PERFECT BUSINESS!!! ==========
NO Sales! NO Monthly Purchases! NO Inventory! NO Recruiting! NO Phone 
Calls! NO Meetings! NO Overhead! One-time $120 to $750 outgo generates 
$HUNDREDS to $THOUSANDS per month income!
===========NOTHING ELSE REQUIRED!!==========
We will build YOUR business. You get paid for OUR work!! The best 
investment you will ever make is owning your own business. For More Info 
( 800 ) 955-3974 or e-mail:  ad10 at cyber-times.com

//////////////////////////////////////////////////////////////////////////

WARNING!!! WHAT NO LONG DISTANCE CARRIER WANTS YOU TO KNOW!!!
LONG DISTANCE SERVICE FOR AS LITTLE AS 9.9 OR 10.9 CENTS PER MIN.
9.9 or 10.9 cents interstate ANYTIME, ANYWHERE in the continental USA.
13.9 800#'s 17.9 cpm calling card, 16.9 rechargeable Debit Cards, No sign on
fee, No monthly minimums, No volume requirements. One of the BIG THREE IS
UNDERLYING CARRIER. Cut your cost to minimum or participate in referral
commissions. Lifetime residual, churches, charities, non profit groups,
businesses or individuals. Don't pass this up--it costs nothing to check us out.
E-mail for details and more information:  ad13 at cyber-times.com

///////////////////////////////////////////////////////////////////////////

Why Wait for ROMANCE...ADVENTURE?
Let our #1 Singles Dateline find Attractive, 
Available singles in your area for you.
Post/Listen to 100's of Personals.  Call now and Connect!
1-900-369-0419
ONLY $1.99/min  18+  Futurefone

////////////////////////////////////////////////////////////////////////////

                               PET PEOPLE
Do you own an exotic bird or know someone who does? (GREAT GIFT)
Lake Tahoes 1995 Entertainer of the year, Max Clever offers you this 
Tolly award winning Video. "Max Clevers" "BIRD TRAINING SECRETS"
In the 90 minutes you will learn everything you need to know about training your
bird I include TRICK TRAINING, potty training, taming, nutrition etc.. It's only
$34.95 + $4.95 S+H to: Bird Traing Secrets 230 Bridge St. Collegeville, PA 
19426 or 1-800-689-8707 all cards. Visit Website at:
http://www.acy.digex.net/~questflm/

//////////////////////////////////////////////////////////////////////////////

MINIATURE BASEBALL
*Sweeping the Country*
*Finally a Realistic 4 Player Per Team Baseball Game* 
*Complete Rules*
*Featuring the Auto-Ump, Utility Infielder, and Knockdown Rule*
*Complete Blueprints and Stadium Designs*
*Add on Products Available*
1-800-240-1263

//////////////////////////////////////////////////////////////////////////////

TRACE YOUR ROOTS
Some of the history goes back to the 1400's in Ireland.  Some of the USA 
discs cover as far back as 1725.  Coming soon, the history of 
African-American's in the USA.  Prices vary.  Available is the search of a
single family history for $39.95.  **Not every single person that was born or
died in an area is on the discs. **   E-mail:  ad21 at cyber-times.com Leave postal
address for a complete list.

//////////////////////////////////////////////////////////////////////////////

You've seen the rest, now try the best? Sounds familiar? I've been there too,
and this is the company I joined! Believe me, if I can do it, so can you.  I'll
show you and lead every step of the way to a healthier, wealthier lifestyle
that's also a lot of fun! Now opening in Europe.  For free info without
obligation, Simply E-mail:  ad22 at cyber-times.com 

//////////////////////////////////////////////////////////////////////////////

New Industry is Born! MARKET NETWORKING!
Become a Leader in the Industry 
Build a solid Business via- Sharing - Helping- Teaching
Simply, We have the System that Works!
Income Potential is very Lucrative
All we Need is "U" to spell SUCCESS
Please call: Louie at 503-644-7714 or Fax to 503-671-9964
Norma Jean at 503-644-3634

//////////////////////////////////////////////////////////////////////////////

Large Corporation hiring Customer Service Reps to work from home taking 
orders for memberships to on-line service.  All calls inbound.  No selling. 
Earn $25+ per hour.  Must have professional phone voice, and home computer for
order entry.  Email experience helpful.  Only persons with those qualifications
should CALL Mr. Bellet 1-804-643-3229 24 hours a day or EMAIL
gatesnet at cyber-times.com

//////////////////////////////////////////////////////////////////////////////

STAR LINK- GREAT SOFTWARE PRICES for PC's & MACS.  We carry 1000's 
of software titles at low, low prices. Special discounts available for Students,
Faculties, and Schools.  PO's are welcome from Government Agencies, Educational
Institutions, & Corporate 1000.  Phone, Fax or Email for current prices, or to
request a price list.   Ph: (215) 953-8239     Fax: (215)953-8249    Email:
ad23 at cyber-times.com 

//////////////////////////////////////////////////////////////////////////////


==========>    TOP WEB SITE OF THE WEEK    <================

=========>  This is a MUST visit Web Site:  <===================
===============>  http://www.cnn.com  <=====================

CNN Online is the best place to get up to the minute information around
the clock. Business, Sports, Technology Reports, Health etc.


======================================================

          Here's The Unbelievable Prices To Advertise Here.

1) 7 line classified ad to 500,000 people==> $49 =>Extra Lines => $2.00 
2) 7 line classified ad to 1,000,000 people=>$99 =>Extra Lines => $4.00 
3) 7 line classified ad to 1,500,000 people=>$149=>Extra Lines => $6.00 
4) 7 line classified ad to 2,000,000 people=>$185 =>Extra Lines  => $8.00 


**** PLACE YOUR ORDER TODAY! THESE PRICES WON'T LAST LONG ****


****For anyone who advertises with CYBER-TIMES will receive 900 Places
to Advertise for FREE on the World Wide Web and a FREE AD in 
CYBER-TIMES Electronic Mall for 1 year! We are here to see you achieve.

****Also, as you noticed in the ads above your mail is forwarded to you 
through our server!! So your E-mail address is not given out.

===========================================================

                   ********** Complete Marketing Package **********

 We have put together the most complete marketing package and are glad to
make it available to you. Here's what we put together:

=====> 2 Million E-mail Addresses
=====>FREE copy of Pegasus Mail
=====>900 Places to advertise FREE
=====>Complete Internet Business Guide
=====>FREE Auto-Responer for 1 FULL YEAR.=====>FREE 1 YEAR ad in our New Cyber
Mall

*If this is any interest to you please send a E-mail message to our
Auto-Responder at:  marketing at cyber-times.com   And you will receive FREE
complete information.

============================================================

** We also build TARGETED E-MAIL LISTS for your special needs call 
   216-226-8799 For our SPECIAL PRICES!! So if you're selling something 
   SPECIAL and you need a BRAND NEW FRESH TARGETED LIST, 
   you're at the right place. And we'll even do the mailing of the list 
   FOR YOU!!

============================================================

Here's a few of many testimonials we like to share with you.
--------------------------------------------------------------------
" Your company is doing a terrific job for me! Thank you, Thank you! 
I am very impressed with your computer and marketing expertise. I will 
continue to send business your way. You deserve to get wealthy from 
this because you're doing a good job for people. You really give them 
their money's worth and do not cheat them like so many of these other 
e-mailing companies do. I have run ads with 3 others companies and 
NEVER got orders, like I do with you". 

Thanks.      - Becky -     ( California )


"I have placed ads with various companies such as "Cyber-Promotions",
"South West" and  "Pin-Point" you guys are by far the BEST. I have never
gotten a better response and made more sales. I look forward to placing my
ad again and again... 

Thank you.  -Dennis-     ( Illinois )

=========================================================

============  " FLOODGATE " The Bulk E-Mail Loader.  ===========

If you ever heard of it now is your chance to get it. Learn step by step on how
to extract E-mail addresses and send your sales letter out to over 500,000
people per day! You may have heard of similar programs like FREEDOM or HARVEST
but don't be fooled by them this is the REAL THING! For FREE complete
information simply send an E-mail message to our Auto-Responder at: 
flood at cyber-times.com Also, 2 MILLION E-mail addresses are included with your
copy.

=========================================================

-----------------------------ORDER-FORM----------------------------------

 Yes, I want to place an advertisement in your Electronic-Magazine to 
the following amount of people.  Check one Below:

$39 - 500,000:_____  $59 - 1,000,000:_____ 

$79 - 1,500,000:____ $99 - 2,000,000:____      

These prices above are 50% off the regular costs. This special won't 
last to long, get your spot now!! Ads are placed in order as they're
received. 

There are never more than 26 advertisements in each E-ZINE!

All advertisements can only be 70 characters per line and font size of 12.
When sending payment include a copy of your ad, EXACTLY how you want
it sent, and it will be sent that way.

Including Extra Lines Total:_________________

-------------------------------------------------------------------------------

First & Last Name:__________________________________

Mailing Address:____________________________________

City:_____________________________

State:____________________________

Zipcode:_________________

E-Mail Address:____________________________________

Phone Number:_____________________________________

Make check or money order payable to: Creative Financial Alternatives

Send Payment to: 

Creative Financial Alternatives
CYBER-TIMES
14837 Detroit Ave. 
Suite 135
Lakewood, OH 44107

* If you have any questions or want to place an ad call: 216-226-8799
   Thank you.

* We also accept checks by Phone or Fax. You can place you order by 
  phone, or tape your check to a piece of paper with all your ordering 
  information and a copy of the ad exactly as you would like to place it
  and fax it to 216-226-3225. 

Phone: 216-226-8799

Fax: 216-226-3225

<< Copyright 1996 - All Rights Reserved >>

 Cyber-Times, or any subsidiary thereof, accept no responsibility
 whatsoever for the content or legality of any advertisement that appears in any
 mailing.  It is the advertisers responsibility to check with Local, State, and
 Federal laws pertaining to the product or service they advertise. 
                                Cyber-Times
                       14837 Detroit Ave. Suite 135
  `\|||/                    Lakewood, Ohio 44107
   (o o)       Phone: 216-226-8799     Fax: 216-226-3225
ooO_(_)_Ooo________________________________________________
_____|_____|_____|_____|_____|_____|_____|_____|_____|_____|
_____|__ __|_____|_____|_____|_____|_____|_____|_____|_____|
_____|_____|_____|_____|_____|_____|_____|_____|_____|_____|





From editor at cdt.org  Fri Jun 28 19:43:26 1996
From: editor at cdt.org (Bob Palacios)
Date: Sat, 29 Jun 1996 10:43:26 +0800
Subject: Policy Post 2.26 - Sen. Crypto Hearing; SAFE Forum Cybercast; CDT on C-SPAN; more
Message-ID: <v02140b0badfa1607e035@[204.157.127.16]>


-----------------------------------------------------------------------------
    _____ _____ _______
   / ____|  __ \__   __|   ____        ___               ____             __
  | |    | |  | | | |     / __ \____  / (_)______  __   / __ \____  _____/ /_
  | |    | |  | | | |    / /_/ / __ \/ / / ___/ / / /  / /_/ / __ \/ ___/ __/
  | |____| |__| | | |   / ____/ /_/ / / / /__/ /_/ /  / ____/ /_/ (__  ) /_
   \_____|_____/  |_|  /_/    \____/_/_/\___/\__, /  /_/    \____/____/\__/
   The Center for Democracy and Technology  /____/     Volume 2, Number 26
----------------------------------------------------------------------------
      A briefing on public policy issues affecting civil liberties online
----------------------------------------------------------------------------
 CDT POLICY POST Volume 2, Number 26                        June 28, 1996

 CONTENTS: (1) Senate Encryption Hearing - Sea Change in Policy Debate
           (2) First Ever "Cybercast" of Congressional Hearing
           (3) SAFE Forum Live Online -- Join Us July 1st!
           (4) CDT Deputy Director Janlori Goldman on C-SPAN - 7/1/96
           (5) How to Subscribe/Unsubscribe
           (6) About CDT, contacting us

  ** This document may be redistributed freely with this banner intact **
        Excerpts may be re-posted with permission of <editor at cdt.org>
         ** This document looks best when viewed in COURIER font **
-----------------------------------------------------------------------------

(1) SENATE ENCRYPTION HEARING ILLUSTRATES SEA CHANGE IN POLICY DEBATE

On Wednesday June 26, 1996 the Senate Commerce Subcommittee on Science,
Space, and Technology held a hearing to consider legislation designed to
encourage the widespread availability of strong, easy-to-use, privacy and
security technologies for the Internet.  Wednesday's hearing illustrated
that a sea change has occurred in Congressional attitude towards the
encryption policy debate.

While members of the Subcommittee noted the complex law enforcement issues
raised by the encryption policy debate, the Senators also recognized that
because of the global nature of the Internet, top down regulations such as
export controls and centralized government mandates like the Clipper
schemes will not address the needs of individuals, business, and even law
enforcement in the Information Age.

In addition, several Senators noted that future of electronic commerce,
privacy, and the competitiveness of the US computer industry should not be
held hostage to law enforcement considerations.

This change in Congressional attitude towards encryption policy is
significant and extremely encouraging.

Wednesday's hearing was also significant because it was the first ever
Congressional hearing cybercast live on the Internet. Details on the
Cybercast are attached below.

The hearing, chaired by Senator Conrad Burns (R-MT), was called to consider
the Promotion Of Commerce Online in the Digital Era (Pro-CODE) legislation,
which would relax current regulations restricting the export of strong
encryption.

Witnesses testifying before the panel included:

* Phil Zimmermann, Inventor of PGP
* Whit Diffie, Sun Microsystems, Father of Public-Key Cryptography
* Phil Karn, Qualcomm Inc, Cryptographer
* Marc Rotenberg, Director, Electronic Privacy Information Center
* Jerry Berman, Executive Director, Center for Democracy and Technology
* Matt Blaze, Lucent Technologies Cryptographer,
* Barbara Simons, Chair of US Public Policy Committee, ACM
* And 135 Netizens (http://www.crypto.com)

CDT Executive Director Jerry Berman also testified before the Subcommittee.
Noting that the current US encryption policy has left individual Internet
users without adequate privacy and businesses without necessary security,
Berman urged Congress to instead move forward to reform US policy based on
the following principals:

* THE INTERNET IS NOT LIKE A TELEPHONE SYSTEM: The traditional approach
  to wiretapping cannot simply be extended to the Internet. This new
  medium encompasses a range of social functions far beyond simple two-
  way voice communication.  These broad activities demand a heightened
  capacity for uses to protect their security and privacy online.

* THE INTERNET IS A GLOBAL, DECENTRALIZED MEDIUM: Efforts to impose
  unilateral national policies -- such as export controls or key escrow
  proposals -- are unlikely to be accepted widely.  Decentralized user
  choice solutions to privacy problems are preferable to and more
  effective than centralized, governmental mandates (such as the
  Clipper proposals).

* ON THE INTERNET, THE BILL OF RIGHTS IS A LOCAL ORDINANCE:
  Constitutional guarantees of privacy and free expression to U.S.
  Citizens whose communications regularly cross national borders.
  Policies should be designed to protect Americans outside the shelter
  of U.S. law.

Berman expressed CDT's strong support for Congressional efforts to reform
US Encryption policy, and urged Congress to act quickly to liberalize
export controls and provide American Internet users with the strong
security and privacy they so badly need.

Audio transcripts of the Hearing, copies of the prepared statements of the
witnesses, and other background information is available at CDT's
encryption policy web page: http://www.cdt.org/crypto/

HEARING SHOWS NEW SENSE OF URGENCY AND FOCUS IN CONGRESS

The clearest example of the emerging frustration in Congress with the
current export restrictions came in an exchange between Senator John
Aschroft (R-MO) and Phil Karn, a cryptographer with Qualcomm and a
plaintiff in a case challenging the export restrictions:

Sen. Aschroft: So for all other countries, the world is the market, but
               for American companies, America is the only market and
               the rest of the world is off limits?

Karn:          You've got it.

Sen. Aschroft: Mr. Chairman, I think that's one of the reasons we need
               to look very carefully at the bill (Pro-CODE) we are
               looking at here today...

Sen. Aschroft: In all our discussions about whether it (cryptography) is
               good or bad, we ignore the fact that it's THERE, and it
               can be available to Americans by American companies, it
               cannot be available to anyone else by American companies,
               but it can be available around the world by a company in
               any other country.

This exchange, as well as strong statements in support of the Burns
Pro-CODE bill from Senators Patrick Leahy (D-VT), Ron Wyden (D-OR), and
Representative Bob Goodlatte (R-VA), who made the unusual move of coming to
a Senate hearing, show that Congress is finally giving the need to reform
US encryption policy serious support.

A hearing of the full Senate Commerce Committee, chaired by Senator Larry
Pressler (R-SD) is expected in mid July.  Representatives from the
Administration and Law Enforcement agencies are expected to testify.  CDT
is working with Senator Burns' and Senator Pressler to bring that hearing
live online.  Check CDT's "Congress and the Net" Web Page at
http://www.cdt.org/net_congress/

-----------------------------------------------------------------------

(2) FIRST EVER CYBERCAST OF CONGRESSIONAL HEARING SHOWS CONGRESS'
    GROWING DESIRE TO REACH OUT TO THE INTERNET COMMUNITY

Wednesday's hearing was the first Congressional hearing to be cybercast
live on the Internet.  The cybercast, coordinated at the request of Senator
Burns by the Center for Democracy and Technology, HotWired, DIGEX, and the
Voters Telecommunications Watch, provided Netizens around the world with
the opportunity to be a part of the Congressional debate on an important
Internet policy issue.

By reaching out to the net.community and providing netizens with an
opportunity to participate in the hearing (Senator Burns asked several
questions posed by the online audience), the cybercast marked an historic
moment in the evolution of the net.community as a political force.

In addition to a live audio feed from the hearing, approximately 40
netizens participated in a simultaneous discussion of the hearing in a chat
area on HotWired.  A member of Senator Burns' staff also joined the
discussion from inside the hearing room, providing insights into the
proceedings, answering questions from the audience, and delivering audience
questions to Senator Burns.

The goal of the hearing cybercast, as well as other recent CDT sponsored
online discussions with members of Congress, is to bring the net.community
and Congress together on critical Internet policy issues in order to
encourage a constructive dialogue and mutual understanding.
CDT is pleased to have been a part of this historic event, and looks
forward to bringing the next Senate Encryption hearing tentatively set for
mid-July online.

Audio transcripts from the hearing are available at:

     http://www.cdt.org/net_congress/

----------------------------------------------------------------------

(3) SECURITY AND FREEDOM THROUGH ENCRYPTION FORM -- JULY 1, STANFORD CA

The Security and Freedom through Encryption (SAFE) is set for July 1 in
Stanford, California.

The event will bring together members of Congress, privacy advocates,
cryptographers, and industry leaders for a discussion on the need to reform
US encryption policy.  A complete list of speakers and the program schedule
is available at the URL below.

HOW TO PARTICIPATE IN THE SAFE FORUM

* The Forum is free and open to the public. You can reserve your free
  ticket by visiting

    http://www.crypto.com/safe

  SPACE IS LIMITED AND YOU MUST REGISTER BY 12:00 MIDNIGHT EDT/9:00 pm
  PDT SUNDAY June 30.

* The SAFE Forum will also be CYBERCAST LIVE ON THE NET! For information
  on how you can join, visit:

    http://www.crypto.com/safe/cybercast.html

-----------------------------------------------------------------------

(4) CDT DEPUTY DIRECTOR TO APPEAR ON C-SPAN'S WASHINGTON JOURNAL
    MONDAY JULY 1
    7:45am EDT / 4:45am PDT

CDT Deputy Director Janlori Goldman will appear on C-SPAN's interview
program "Washington Journal" on Monday July 1 at 7:45am EDT / 4:45am PDT.
She will be discussing privacy issues on the Internet.  The program will
also highlight CDT's Privacy Demonstration and Online Privacy
Clearinghouse.

CDT's Privacy Demonstration and Privacy Issues Page can be accessed at:

     http://www.cdt.org/privacy/

------------------------------------------------------------------------

(5) SUBSCRIPTION INFORMATION

Be sure you are up to date on the latest public policy issues affecting
civil liberties online and how they will affect you! Subscribe to the CDT
Policy Post news distribution list.  CDT Policy Posts, the regular news
publication of the Center For Democracy and Technology, are received by
nearly 10,000 Internet users, industry leaders, policy makers and
activists, and have become the leading source for information about
critical free speech and privacy issues affecting the Internet and other
interactive communications media.

To subscribe to CDT's Policy Post list, send mail to

     policy-posts-request at cdt.org

with a subject:

     subscribe policy-posts

If you ever wish to remove yourself from the list, send mail to the
above address with a subject of:

     unsubscribe policy-posts

-----------------------------------------------------------------------

(6) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US

The Center for Democracy and Technology is a non-profit public interest
organization based in Washington, DC. The Center's mission is to develop
and advocate public policies that advance democratic values and
constitutional civil liberties in new computer and communications
technologies.

Contacting us:

General information:  info at cdt.org
World Wide Web:       URL:http://www.cdt.org/
FTP                   URL:ftp://ftp.cdt.org/pub/cdt/

Snail Mail:  The Center for Democracy and Technology
             1634 Eye Street NW * Suite 1100 * Washington, DC 20006
             (v) +1.202.637.9800 * (f) +1.202.637.0968

-----------------------------------------------------------------------
End Policy Post 2.26                                            6/28/96
-----------------------------------------------------------------------







From caal at hopf.dnai.com  Fri Jun 28 19:43:28 1996
From: caal at hopf.dnai.com (caal at hopf.dnai.com)
Date: Sat, 29 Jun 1996 10:43:28 +0800
Subject: BW: E-commerce
Message-ID: <199606281521.IAA27764@hopf.dnai.com>



>        (KPMG-PEAT-MARWICK-STUDY) American companies forecast huge growth in
>        electronic commerce, but study uncovers concern about the impact of
>        ambiguous state tax laws 
>        
>           Business Editors
>        
>        NOTE:  The following news release replaces 
>               BW1109, which was upheld by KPMG Peat Marwick.    
>               This revised version is for immediate release.
>        
>            NEW YORK--(BUSINESS WIRE)--June 27, 1996--An overwhelming nine
>        out of ten financial executives at American companies currently
>        engaged in buying and selling goods or services over the Internet
>        caution that government must clarify the associated state and local
>        tax implications if this new method of doing business is to reach
>        its full potential, according to a study conducted on behalf of KPMG
>        Peat Marwick LLP.  
>        
>            "This study shows that electronic commerce is taking off,"  said
>        Kent Johnson, National Partner-in-Charge of KPMG's Sales and
>        Transactions Tax practice.  "But it also reveals the frustrations of
>        corporate America as it tries to cope with the murky environment
>        created by applying old tax laws to new ways of doing business."  
>        
>            Johnson continues: "Taxation of electronic commerce varies from
>        state to state so determining what's taxable and who is responsible
>        for paying those taxes becomes very complex."  
>        
>            Survey respondents appear to agree.  Almost seven out of ten
>        respondents (67%) say that state and local tax laws governing
>        electronic commerce are ambiguous, while more than half of those
>        polled (51%) say that this ambiguity is already inhibiting their
>        involvement in electronic commerce.  Furthermore, 50% say they are
>        "not very"  or "not at all"  familiar with the sales and transaction
>        tax implications -- twice as many as those who say that they are
>        "very"  or "extremely"  familiar with the tax issues.  In fact, 20%
>        of the financial executives surveyed do not know if their companies
>        are even subject to sales and transactions taxes for the sale of
>        products and services over the Internet.  
>        
>            Johnson says that these statistics are particularly distressing
>        because several states and municipalities have already begun taxing
>        certain Internet services.  
>        
>            "The huge growth potential of the Internet has undoubtedly
>        caught the attention of state tax administrators who are eagerly
>        looking for ways to apply existing tax laws and capture some of the
>        revenue this business generates,"  said Michael H.  Lippman,
>        National Partner-in-Charge of KPMG's State and Local Tax Technical
>        Services.  "On the other hand, companies are saying that tax law, in
>        its present form, cannot be applied to the new world of electronic
>        commerce.  They are calling for, at the least, a rewrite of the
>        statutes and many contend that the states should give electronic
>        commerce time to develop before imposing taxes."  
>        
>            Companies' concerns about taxes, however, go beyond those
>        related to the bottom line.  More than half of those surveyed (53 %)
>        think taxing electronic commerce has the potential to become a
>        significant threat to privacy.  Other specific areas of concern
>        include: "the crafting of equitable laws from state to state and
>        across industries" and "fear that state taxing authorities will take
>        a very aggressive approach in determining whether a company is
>        taxable in its state."  
>        
>            Said Johnson of KPMG's Sales and Transaction Tax Practice: "Even
>        though companies are saying they're concerned about the impact of
>        state and local taxes on electronic commerce, very few have been
>        proactive in working with taxing authorities to help ensure
>        equitable rules."  Nearly seven out of 10 companies (68%) say that
>        they are "not very"  or "not at all"  involved with efforts to
>        affect state and local tax policy, compared to only one in 10
>        companies that are "very"  or "extremely involved."  However,
>        exactly half of respondents (50%) claim they do intend to become
>        involved in industry group discussions and debates in the future.  
>        
>            Looking at taxation of electronic commerce from an international
>        perspective, Jeff Stein, National Partner-in-Charge of KPMG's
>        International Services, notes that the impact of ambiguous tax laws
>        on electronic commerce is even more heightened as companies expand
>        their sales and operations overseas.  
>        
>            "Electronic commerce has the potential to fuel the engine for
>        future growth of U.S.  exports,"  notes Stein.  "In fact, 83 percent
>        of study participants believe that electronic commerce will be a
>        major vehicle for U.S.  exports."  
>        
>            About one-third of companies believe that state and local taxes
>        imposed on electronic commerce diminish their international
>        competitiveness.  Indeed, some companies even said that that they
>        would consider moving their Internet activities offshore to escape
>        state and local taxes in the future.  But, KPMG cautions, such a
>        move might not provide the anticipated tax haven because
>        jurisdictions around the world are revenue-starved and will be just
>        as aggressive as individual states in imposing taxes on companies
>        engaged in electronic commerce.  
>        
>            "There are a great deal of unknowns when it comes to electronic
>        versus traditional commerce.  We've been advising our clients to
>        develop a multi-level, flexible approach that positions them for
>        sudden changes in policies.  At the same time we'll continue to work
>        with regulators to help clarify how current tax laws can be fairly
>        applied to business in the 21st century,"  said Lippman.  
>        
>        Editor's note: The KPMG Study was executed by Clark, Martire &
>        Bartolomeo, Inc.  during June 1996.  Results of the study will be
>        available through KPMG's State and Local Tax Practice World Wide Web
>        Site at HTTP:\WWW.US.KPMG.COM\SALT\ or by calling Patricia Neil,
>        KPMG's director of State and Local Tax Marketing & Communications at
>        212/872-6570.  
>        
>        For the purpose of this survey, electronic commerce is defined as
>        buying or selling products or services over the Internet.  The
>        survey was conducted among 291 companies with gross revenues in
>        excess of $50 million.  They span four industry groups: publishing;
>        software/business services/ advertising; communications; and
>        manufacturing/distributing/retail.  
>        
>        KPMG Peat Marwick LLP is the U.S. member firm of KPMG, The Global
>        Leader among professional services firms.  Worldwide, KPMG has more
>        than 6,000 partners as well as 76,000 professionals servicing
>        clients throughout 1,100 offices in 837 cities in 134 countries.  In
>        the U.S., KPMG partners and professionals deliver a wide range of
>        value-added consulting, assurance and tax services in five markets:
>        financial services; manufacturing, retailing and distribution;
>        health care and life sciences; information, communications and
>        entertainment; and public services.  
>        
>        --30--bk/ny*
>        
>        CONTACT:  Pat Neil  
>                  KPMG Peat Marwick LLP         
>                  212/872-5506             
>                  E-mail: pneil at kpmg.com
>                         or
>                  Jackie Kaldon/Constantine Theodoropulos
>                  Shandwick USA
>                  212-420-8100, ext. 213, 217
>                  800-223-2121
>                  E-mail: jkaldon at shandwick.com
>        
>        KEYWORD:  NEW YORK
>        INDUSTRY KEYWORD:  TELECOMMUNICATIONS GOVERNMENT COMED
>        
>         REPEATS: New York 212-752-9600 or 800-221-2462; Boston 617-236-4266
>        or 800-225-2030; SF 415-986-4422 or 800-227-0845; LA 310-820-9473 BW
>        URL: http://www.businesswire.com
>        
>         
>        
>        Copyright 1996 BusinessWire. All rights reserved.






From AwakenToMe at aol.com  Fri Jun 28 19:44:44 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Sat, 29 Jun 1996 10:44:44 +0800
Subject: MS-Mail Security
Message-ID: <960627232515_144630593@emout09.mail.aol.com>


In a message dated 96-06-27 21:39:21 EDT, harka at nycmetro.com writes:

>I'd also like to know how secure the MS-Mail files are (*.mmf). They are
>password protected and should be encrypted but does anybody know how secure?
>
>Harka
>___ Blue Wave/386 v2.30 [NR]
>
>

as far as I know.. the encryption used on them is weak. I think ive seen a
generic cracker for these on the internet. I dont think MS is going to put
the time into a good VERY secure encryption for this.. because then
aftermarket things wouldnt be bought!!! hehe





From nobody at c2.org  Fri Jun 28 20:14:14 1996
From: nobody at c2.org (Anonymous User)
Date: Sat, 29 Jun 1996 11:14:14 +0800
Subject: Another free speech victory
Message-ID: <199606281805.LAA22574@infinity.c2.org>


Just read that the Supreme Court "struck down provisions of the 1992
Cable Act that require local cable companies to either ban indecent
shows from appearing on leased or access channels or place all
programs deemed indecent on a single channel and block it. Those
provisions violate free-speech rights, the court said. But the court
said Congress lawfully can permit cable operators to choose not to
broadcast such programs on leased access channels." [NYT]

Looks like the gov't will lose if it decides to appeal the CDA
decision.

Medea








From kqb at c2.org  Fri Jun 28 20:30:43 1996
From: kqb at c2.org (Kevin Q. Brown)
Date: Sat, 29 Jun 1996 11:30:43 +0800
Subject: secure WWW on UNsecure servers
Message-ID: <199606280438.VAA05479@infinity.c2.org>


I know several people who want to share private information on
some web pages but do not trust any publicly-accessible web server
not to leak the information on those pages.   The normal IP
address or password-based web page protection mechanisms thus
are not sufficient since they assume that the server is secure
from non-web-based mechanisms for retrieving the pages.  Also,
encryption schemes such as SSL will not solve the problem because
they protect only against interception between the server and
the client, not at the server itself.  Instead, it looks like
the web pages must reside on the server in encrypted form.

How might one arrange for these encrypted web pages residing on an
(unsecure) server to get decrypted only at the client's machine?
This should work as transparently as possible for the user;
except possibly for a userid/password query it should look like a
normal web browsing session.  For now, we can assume that the
decrypted web pages contain only HTML and images in .gif format.

Might this best be done with some combination of special MIME
types and helper applications or plug-ins?  Has someone already
done it?  Thanks.

    Kevin Q. Brown
    kqb at c2.org





From jimbell at pacifier.com  Fri Jun 28 21:00:59 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 29 Jun 1996 12:00:59 +0800
Subject: Another free speech victory
Message-ID: <199606290107.SAA03962@mail.pacifier.com>


At 11:05 AM 6/28/96 -0700, Anonymous User wrote:
>Just read that the Supreme Court "struck down provisions of the 1992
>Cable Act that require local cable companies to either ban indecent
>shows from appearing on leased or access channels or place all
>programs deemed indecent on a single channel and block it. Those
>provisions violate free-speech rights, the court said. But the court
>said Congress lawfully can permit cable operators to choose not to
>broadcast such programs on leased access channels." [NYT]
>
>Looks like the gov't will lose if it decides to appeal the CDA
>decision.
>Medea

However, it's worrisome that the decisions were only 6-3 and 5-4.

Jim Bell
jimbell at pacifier.com





From JMKELSEY at delphi.com  Fri Jun 28 21:09:15 1996
From: JMKELSEY at delphi.com (JMKELSEY at delphi.com)
Date: Sat, 29 Jun 1996 12:09:15 +0800
Subject: anonymous mailing lists
Message-ID: <01I6GF62YWG291VYF3@delphi.com>


-----BEGIN PGP SIGNED MESSAGE-----

[ To: Cypherpunks ## 06/28/96 04:34 pm ##
  Subject: anonymous mailing lists ]

>Date: Fri, 14 Jun 1996 02:15:03 +0000 (GMT)
>From: Ecafe Mixmaster Remailer <mixmaster at remail.ecafe.org>
>Subject: Hackerpunks and C2

>The proposal for a Hackerpunks nym based mailing list is
>interesting, however, there are some concerns regarding the
>susceptibility of the list to traffic analysis.

I was thinking about attacks that can be carried out on remailers in
general, and came up with something that is potentially pretty
nasty, especially for anonymous mailing lists and people who post a
lot of stuff anonymously using ``nyms.''

Let's imagine an anonymous remailer network as a ``black box'' which
functions perfectly.  Messages (broken into equal-sized packets and
strongly encrypted) are sent into the network by the sender, and at
some later time, they come out at the receiver.  Let's assume there
is no possible way for an attacker to trace a message through this
network.  Now, we still have to deal with two more issues--mail goes
into the network, and comes out of the network.  At those two
points, there is trafic analysis available.  Specifically, we can
see how much data goes over the line.  (Naturally, if it's
encrypted, we can't tell how much of it is real data and how much is
padding.)

Generally, when we're attacking this system, we're trying to figure
out either the sender or the receiver of a message (or a sequence of
messages), based on what we can observe coming into and going out of
the network of remailers.  There are basically five scenarios:

1.   The sender wants to know who the receiver of his message is.
2.   The receiver wants to know who the sender of his message is.
3.   An outsider wants to identify the sender of a message.
4.   An outsider wants to identify the receiver of a message.
5.   One receiver of a message wants to know who the other receivers
     of the message are.  (This is the case for anonymous lists.)

Now, there are a couple of different ways these attacks can be
carried out.  Usually, I've seen people talk about ``tracing''
attacks, in which a message is traced from one side of the network
to another, without any clear idea of who might be on the other
side.  However, I think a more realistic situation is to imagine the
attacker trying to test the hypothesis that some person is on the
other end of the anonymous transmission.  If relatively few people
regularly send or receiver anonymous e-mail, then this is practical
for many kinds of test.  It's even more practical when we're dealing
with relatively small populations of interested people in some
technical subject.  (This is conceptually similar to the
``dictionary attack'' on passphrases.)  Basically, what we're
looking at, in that case, is some test which (with some reasonably
high probability) determines whether some person is the sender or
receiver of a given message or stream of messages.

This leads to some interesting insights.

1.   In reasonably large text messages, it's probably easy to test
hypotheses about senders.  There are metrics that can more-or-less
identify the writer of a piece of prose.  While it's no doubt
possible to defeat this kind of analysis for some things (i.e.,
blackmail notes or rigidly-defined messages in a cryptographic
protocol), I suspect that this is very hard to defeat for a mailing
list where the objective is to discuss serious technical issues.
(This kind of analysis also causes headaches for people trying to do
strong steganography in text.)

2.   If an attacker (i.e., the NSA) logs the total volume of all
traffic in and out of the remailer network, and to whom each message
came from or went to, then that attacker can probably mount some
very powerful hypothesis-testing attacks.

It's these attacks I want to discuss.

If Alice sends a message to Bob through the remailer network, two
things must happen to prevent it from being trivially traceable.

1.   The message has to change size.  If the message is already
encrypted, then compression isn't much of an option--so what's left
is padding it out by a random amount.  The amount of padding per
message is probably a uniformly distributed random variable.

2.   The message has to be delayed somewhat.  The delay is probably
also a uniformly distributed random variable, or possibly the result
of adding N such variables, where N is the number of chained
remailers.

For a single mailing, this is probably not much of a threat. There
will be enough ``noise'' in the delay and padding that most
transmissions will be masked.  However, consider the situation of a
mailing-list.  Alice and Bob are both recipients of the list. Alice
wants to decide whether Bob is receiving the list.  Let D be a delay
such that, if Alice received her copy at time T, 90% of the other
list members received their copy between T-D and T+D.  Now, Alice
looks at Bob's anonymous e-mail volume during that time span vs. at
all other times.  If he's receiving the same stuff she is, then
there should be an increase within that span of time, on average.

The random distribution of the arrival time will mask individual
transmissions, but with many messages, it probably will not.  (This
is conceptually similar to the situation in Paul Kocher's timing
attacks--adding some random pauses doesn't hurt the attack as much
as most people expect it to, because those random pauses, summed up
over many messages, become a normally distributed random variable.)

The average amount of anonymous e-mail Bob gets per day doesn't have
much effect, nor do occasional worst-cases. The only ways I can see
to prevent this attack are either to ensure that Bob gets a constant
rate of information from the anonymous remailer network, or to make
the arrival time span so large that other randomness in the sample
makes the change in volume undetectable.  In general, I don't think
this second one will work without accepting incredible delays on
messages.

This can also be adapted to tracing back anonymous posters to
newsgroups and mailing lists, when they use a consistent nym.
(They could also be traced by textual analysis.)  In this case, the
attacker starts by posting some anonymous messages (not using a
nym--he doesn't need one), to get some statistics on what the
average delay is, and also what the average amount of padding is. He
may do this for several different ways of putting things
together--he's got almost unlimited time to gather acceptable data.

At this point, he observes in/out traffic logs for each hypothesized
sender during a wide timespan before the arrival of the post at its
destination.  He compares activity inside that span with activity
outside, over a large number of posts.  If there is a correlation,
then he's got the e-mail address of the nym.

There are ways to get around this second attack, at least to some
extent.  However, I don't think it's wise to count on even very good
remailer networks (i.e., the Mixmaster stuff) to protect your
anonymity in this situation.  (However, note that I'm thinking in
terms of a very well funded, determined adversary.  It's probably
not too bad to count on it to protect your anonymity from
technically unsophisticated attackers--but I wouldn't recommend
using it for things that (say) the FBI or NSA might get very
interested in.)

I think the best defense against this will be something like this:
Each user sets a quota of how much trafic he will take in and send
out per day.  Once per day, he goes through an interaction in which
he downloads and uploads that much stuff, whether there's any of it
for him or not.  (Naturally, this won't be detectable from looking
at the transmission, timing the interaction, etc.)  This makes any
volume variations per day disappear.  Unfortunately, it also limits
the user's total inflow and outflow, which means he'll have to set
it to something larger than the maximum he ever expects to get.  (It
would be possible to have occasional overflow onto the next day's
downloads, but not too often, or the user would fall further behind,
on average, each day.)  The size of these quotas will still leak
some information, though not enough for the kinds of attacks I
discussed above.

Note:  Please respond via e-mail as well as or instead of posting,
as I get CP-LITE instead of the whole list.

   --John Kelsey, jmkelsey at delphi.com / kelsey at counterpane.com
 PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdRWR0Hx57Ag8goBAQHCowQA71WBKkx1yonS0dEpy3pe7lgvSJPkpLUk
zLjm0KeFoP+HGQBep48iILRYBlbGy5czcxNCU4zhE6+c4PWwvD+BpaGGccWWkyRi
0l/rdo5L5/1KgnpCAQJ/HNyRH0fO2NNOHvGB3m7I0H3lfmfOlNed8oIIjPFDVB23
60wpMZ9S93w=
=HC1g
-----END PGP SIGNATURE-----





From jimbell at pacifier.com  Sat Jun 29 12:56:06 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 29 Jun 1996 12:56:06 -0700 (PDT)
Subject: rsync and md4
Message-ID: <199606291955.MAA11090@mail.pacifier.com>


At 01:19 PM 6/29/96 -0400, Mark M. wrote:

>> A first guess might be 2^-128 but I know that this sort of thing is
>> rarely that simple. Is md4 that good?
>
>2^-64.
>> 
>> Note that I am not interested in "attacks" on md4 as such as the
>> source of the random data is just another file provided by the same
>> user, so it won't have been specially designed to defeat md4. 
>> 
>> If the probability is within a few orders of magnitude of 2^-128 then
>> can I also be sure that if I only use the first b bits of a md4
>> checksum it will be within a few orders of magnitude of 2^-b ? There
>> is an option in rsync to use a shorter checksum by truncating
>> md4. This saves some bytes on the link at the risk of lowering the
>> confidence. 
>
>The probability of failure is 2^-(b/2).

I don't think that's correct.  That would be the correct formula if I were 
looking for two strings that happened to have the same hash value, but 
that's not what he's asking for.

Jim Bell
jimbell at pacifier.com





From joseph at genome.wi.mit.edu  Fri Jun 28 22:03:50 1996
From: joseph at genome.wi.mit.edu (Joseph Sokol-Margolis)
Date: Sat, 29 Jun 1996 13:03:50 +0800
Subject: secure WWW on UNsecure servers
In-Reply-To: <199606280438.VAA05479@infinity.c2.org>
Message-ID: <v03007405adfa3dc7588f@[18.157.1.107]>


> How might one arrange for these encrypted web pages residing on an
> (unsecure) server to get decrypted only at the client's machine?
> This should work as transparently as possible for the user;
> except possibly for a userid/password query it should look like a
> normal web browsing session.  For now, we can assume that the
> decrypted web pages contain only HTML and images in .gif format.

It seems like it could be done by writing a plug-in that passed the
encrypted page to pgp (or had it internally) and used that to decrypt it.
The plug-in could store  the pass-phrase locally and clear when the user
disconnected.

It *might* also be possible to do this with java. I don't know enough java
to say for sure, but couldn't you build an interface that took the
encrypted data passed it though whatever and then displayed it on the local
screen. The applet could produce a viewer with a 'sigoff' button telling
the applet to forget the pass-phrase. Comments?


Joseph Sokol-Margolis
joseph at genome.wi.mit.edu
Systems Administrator







From llurch at networking.stanford.edu  Fri Jun 28 22:40:44 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sat, 29 Jun 1996 13:40:44 +0800
Subject: Abridged spam sucker list (was Re: `` Cyber - Times ``)
In-Reply-To: <199606272057.NAA27234@dfw-ix11.ix.netcom.com>
Message-ID: <Pine.GUL.3.94.960628195321.24211B-100000@Networking.Stanford.EDU>


On Thu, 27 Jun 1996, `` Cyber - Times `` wrote:

>                    http://members.gnn.com/HUDTRACER/fha.htm
> or E-Mail our auto-responder at:====>   hud at cyber-times.com    
> personality call Mrs. Roberts at InterNetWorks at: (619) 781-4104. 
> Call NOW  ...24 hours a day! Working at home is the "Wave of the Future". 
> or e-mail my autoresponder at: internetworks at cyber-times.com
> http://www.catalog.com/impulse/tel.htm or Email:  ad18 at cyber-times.com
> good only while supplies last. Call us toll-free at (800) 529-2919 to get all
> Voice box 800-566-5319/800-663-0631 ref. #32025-9
> to A. Tucker   Box 371264    El Paso, Texas  79937.
> in compensation plan.  208-263-5681 9am-8pm PDT.
> 1-900-476-6368 EXT. 6761
> $2.99 per minute
> Must be 18 years to Call
> Serv-U (619) 645-8434
> For information email at: ad19 at cyber-times.com or call Ms. Doughery
> for an interview at (409) 756-5669 9-6 p.m. Central Time.
> benefits available only to our downline.  Call NOW:  512-505-6838 (3-minute
> recorded message) Get fax on demand:  703-736-1600, doc 839 (call from
> fax-phone) E-mail: ad5 at cyber-times.com      Fax: 360-423-2238         Do it Now!
> Write the Perfect Bullet" section, send $14.95 to: M. Rogers, P.O. Box 583,
> Hayward CA  94543-0583
> publishing at 307-856-7090 or E-mail your daytime phone number to: 
> ad20 at cyber-times.com 
> 1-800-995-0796 ext. 2583
> ( 800 ) 955-3974 or e-mail:  ad10 at cyber-times.com
> E-mail for details and more information:  ad13 at cyber-times.com
> 1-900-369-0419
> ONLY $1.99/min  18+  Futurefone
> 19426 or 1-800-689-8707 all cards. Visit Website at:
> http://www.acy.digex.net/~questflm/
> 1-800-240-1263
> died in an area is on the discs. **   E-mail:  ad21 at cyber-times.com Leave postal
> obligation, Simply E-mail:  ad22 at cyber-times.com 
> Please call: Louie at 503-644-7714 or Fax to 503-671-9964
> Norma Jean at 503-644-3634
> should CALL Mr. Bellet 1-804-643-3229 24 hours a day or EMAIL
> gatesnet at cyber-times.com
> request a price list.   Ph: (215) 953-8239     Fax: (215)953-8249    Email:
> ad23 at cyber-times.com 
> ** We also build TARGETED E-MAIL LISTS for your special needs call 
>    216-226-8799 For our SPECIAL PRICES!! So if you're selling something 
> flood at cyber-times.com Also, 2 MILLION E-mail addresses are included with your
> Creative Financial Alternatives
> CYBER-TIMES
> 14837 Detroit Ave. 
> Suite 135
> Lakewood, OH 44107
> * If you have any questions or want to place an ad call: 216-226-8799
>   and fax it to 216-226-3225. 
> Phone: 216-226-8799
> Fax: 216-226-3225






From declan+ at CMU.EDU  Fri Jun 28 22:44:16 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sat, 29 Jun 1996 13:44:16 +0800
Subject: crypto and bagpipes [NOISE]
In-Reply-To: <199606280352.XAA06868@jekyll.piermont.com>
Message-ID: <Alp9gs600YUyRVfsNl@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 27-Jun-96 Re: crypto and bagpipes
[NO.. by "Perry E. Metzger"@pierm 
> No one who has heard sustained bagpipe playing can deny the fact that
> bagpipes are indeed an instrument of war, with no legitimate place in
> peaceful everyday society.

Hmm... Carnegie Mellon University is the only school in the country with
a bagpipe major, you know. You haven't lived until you've heard a
screeching 'pipe at 3 am in front of Hunt Library.

-Declan






From nobody at REPLAY.COM  Fri Jun 28 22:47:44 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Sat, 29 Jun 1996 13:47:44 +0800
Subject: John Grubor and you
Message-ID: <199606290307.FAA23142@basement.replay.com>


Lucifer Remailer Operator wrote:

>Just for the record, I am NOT John Grubor and had never even heard of him
>before I did an Altavista search on his name earlier today.  The concept that
>some net.loon like Grubor would get another account with DHP to run an
>anonymous remailer for whatever reason is LAUGHABLE.  From what I have read,
>Grubor spams newsgroups quite often, something I have not done nor plan on
>doing.  I was expecting people to be posting paranoid rantings about how I
>am obviously a SPOOK...

Why you were expecting people to be posting paranoid rantings if you did
not even know who Dr. John Grubor, undercover police agent, was?





From nobody at REPLAY.COM  Fri Jun 28 22:55:31 1996
From: nobody at REPLAY.COM (Anonymous)
Date: Sat, 29 Jun 1996 13:55:31 +0800
Subject: No Subject
Message-ID: <199606290306.FAA23041@basement.replay.com>


declan at well.com (Declan McCullagh) spake thus and so:

>WASHINGTON, DC -- With no fanfare and no hype, the Justice Department
>yesterday faxed a 39-word statement to Senator Exon saying they will
>appeal their loss in the Philadelphia case.
>
>The consolidated lawsuits of ACLU v. Reno and ALA v. DoJ resulted in a
>victory for the plaintiffs earlier this month after a three-judge panel
>granted a preliminary injunction preventing the DoJ from enforcing the
>Communications Decency Act.

Sounds like a case of "political testicles in a vise." This smells like
an election-year maneuver so the Clinton administration can maintain its
fa�ade. (After all, who wants to be called "soft on the protection of
children"?) By the time it's finally settled, the Congresscritters will
have been re-elected and can go merrily back to perverting the
Constitution.

So how'd we wind up having to choose between *these* two yahoos for 
President? :-)







From rich at netbox.com  Fri Jun 28 22:56:11 1996
From: rich at netbox.com (Rich)
Date: Sat, 29 Jun 1996 13:56:11 +0800
Subject: PC-ness of nym.alias.net
Message-ID: <199606290304.DAA15488@netbox.com>


-----BEGIN PGP SIGNED MESSAGE-----

On Fri, 28 Jun 1996, Anonymous wrote:

> I would appreciate any information members may have regarding the
> security/safety of the new nym server nym.alias.net (in "alpha" state) who
> posted here about 3 weeks ago. Nym.alias.net reportedly is the same
> machine as anon.lcs.mit.edu. 
> 
> Specifically, is the individual running the nym _known_ to cypherpunks, or
> is this an unknown about whom I should have serious doubts.

I could tell you who it is, but then I'd have to kill you. So let's just
stick to publicly available information. 

According to the root DNS servers, which as we know are controlled by a ZOG
defense contractor, alias.net is an alias for alpha.jpunix.com, and
anon.lcs.mit.edu is indeed the same as nym.alias.net. alias2-dom is said to
get name service from Sameer and company, but that could be a trap. 

Obviously, they've infiltrated pretty deep, but thanks to you, we know to
be careful.

Then again, this could just be FUD from another Fucking Statist. Who
knows? 

Somewhat more seriously, wouldn't it be nice if the various remailers signed
each other's keys?

- -rich

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQBVAwUBMdScnJNcNyVVy0jxAQEwFQH/ZXv+9Nj5ZDjk5FpA33T+kw68H39p/SuW
Ab/hRfGGkZX97PIa50C7UVu4YROYE9RYcn7kalsZgFKOsJKAq3JKIw==
=1CQg
-----END PGP SIGNATURE-----






From declan+ at CMU.EDU  Fri Jun 28 22:57:52 1996
From: declan+ at CMU.EDU (Declan B. McCullagh)
Date: Sat, 29 Jun 1996 13:57:52 +0800
Subject: News: NEC has encrypted networks ...
In-Reply-To: <199606281930.MAA00143@ohio.chromatic.com>
Message-ID: <Elp9dtW00YUyFVfplB@andrew.cmu.edu>


Excerpts from internet.cypherpunks: 28-Jun-96 News: NEC has encrypted
net.. by Ernest Hua at XENON.chromat 
> Japanese companies catching up and passing American companies
> should scare those Congressional critters into action:

Realistically, there's not a chance in hell Pro-CODE will pass this
session. (Research question for cypherpunks: how many days left are
there in the legislative calendar?)

-Declan






From tridge at arvidsjaur.anu.edu.au  Fri Jun 28 23:45:31 1996
From: tridge at arvidsjaur.anu.edu.au (Andrew Tridgell)
Date: Sat, 29 Jun 1996 14:45:31 +0800
Subject: rsync and md4
Message-ID: <96Jun29.135037+1000est.65075-20848+164@arvidsjaur.anu.edu.au>


I've recently released a package called rsync that uses a checksum
search to provide very efficient file update over a slow link.  (see
ftp://samba.anu.edu.au/pub/rsync if you are interested)

Now I'd like to calculate some probabilities of failure of the
algorithm. The fundamental thing I need to know to do the calculation
is the probability of a random piece of data of length n having the
same md4 checksum as another given piece of data of the same length.

A first guess might be 2^-128 but I know that this sort of thing is
rarely that simple. Is md4 that good?

Note that I am not interested in "attacks" on md4 as such as the
source of the random data is just another file provided by the same
user, so it won't have been specially designed to defeat md4. 

If the probability is within a few orders of magnitude of 2^-128 then
can I also be sure that if I only use the first b bits of a md4
checksum it will be within a few orders of magnitude of 2^-b ? There
is an option in rsync to use a shorter checksum by truncating
md4. This saves some bytes on the link at the risk of lowering the
confidence. 

Why md4? I chose md4 because it seemed to be the fastest of the
reputedly strong, publicly available checksum algorithms. Suggestions
for alternative algorithms are welcome.

Cheers, Andrew





From ichudov at algebra.com  Sat Jun 29 00:02:07 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Sat, 29 Jun 1996 15:02:07 +0800
Subject: anonymous mailing lists
In-Reply-To: <01I6GF62YWG291VYF3@delphi.com>
Message-ID: <199606290404.XAA32220@manifold.algebra.com>


How about this attack: suppose I want to find out who hides behind
an alias MightyPig at alpha.c2.org and I have the ability to monitor
all internet traffic. Then I simply start mailbombing that address
and see whose account gets unusually high traffic volume.

A nice, albeit quite expensive, way of pretection from traffic analysis
is to create a mailing list (or a newsgroup) and forward all messages to
all users of that mailing list or newsgroup. Of course, since messages
are encrypted, only the recipients will be able to decrypt them.

This way the list of suspects is all subscribers of that list or
newsgroup and there is no way to discriminate them.

Instead of having messages to be sent to all recipients all the time,
alpha.c2.org may be programmed so that it sends out every message not to
only one recipient X, but to X and 20 other randomly selected people.

It apparently makes traffic analysis much harder.

Then users of alpha.c2.org will have to install mail filters that
automatically delete all incoming mail not intended to be read by them
(they can't read such messages anyway).

	- Igor.





From jimbell at pacifier.com  Sat Jun 29 01:04:16 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 29 Jun 1996 16:04:16 +0800
Subject: News: NEC has encrypted networks ...
Message-ID: <199606290531.WAA15509@mail.pacifier.com>


At 10:52 PM 6/28/96 -0400, Declan B. McCullagh wrote:
>Excerpts from internet.cypherpunks: 28-Jun-96 News: NEC has encrypted
>net.. by Ernest Hua at XENON.chromat 
>> Japanese companies catching up and passing American companies
>> should scare those Congressional critters into action:
>
>Realistically, there's not a chance in hell Pro-CODE will pass this
>session.
>-Declan

Which reminds me...

About that NTT chip:  While I haven't been looking particularly carefully 
for it, I haven't noticed an announcement in any of the electronics 
magazines I normally read.  Has anyone seen a reference to it?

I think we ought to learn more about it:  Does it implement an open 
standard, so that other manufacturers can build compatible phones?


Jim Bell
jimbell at pacifier.com





From AwakenToMe at aol.com  Sat Jun 29 01:05:55 1996
From: AwakenToMe at aol.com (AwakenToMe at aol.com)
Date: Sat, 29 Jun 1996 16:05:55 +0800
Subject: www hacking?
Message-ID: <960629011631_145401493@emout08.mail.aol.com>


I havent seen much in lines of this being a problem yet..although I was
reading through practical unix security (newest edition) and it made mention
of the danger of hacking WWW. Forgive my ignorance on this.. but what dangers
are there? I could see someone attacking the main server and do damage in
that sense..but Im a little outdated in this as far as what is attacked. The
only thing Ive ever had to worry about was unix, now theres oh-so much more.
If someone could tell me the dangers of someone attacking someones
site..etc..on the WWW, I would much appreciate it!
Thanks 
Adam





From ryans at worldchat.com  Sat Jun 29 01:20:20 1996
From: ryans at worldchat.com (ryans at worldchat.com)
Date: Sat, 29 Jun 1996 16:20:20 +0800
Subject: unsuscribe
Message-ID: <31D4C3DD.29A6@worldchat.com>


unsuscribe





From nelson at crynwr.com  Sat Jun 29 01:38:08 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 29 Jun 1996 16:38:08 +0800
Subject: mocking paranoia
Message-ID: <19960629055807.31357.qmail@ns.crynwr.com>


Earlier, someone mocked someone else for being paranoid.  Sorry, but
this is a mistake.  By definition, you have a non-empty threat model
when you set out to encrypt; therefore you must be paranoid to use
encryption.  Or else they really *could* be out to get you, but
sometimes it's not possible to tell, and you have to assume that they
are.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade;
Potsdam, NY 13676       | +1 315 268 9201 FAX   | governments coerce.





From nelson at crynwr.com  Sat Jun 29 01:41:52 1996
From: nelson at crynwr.com (nelson at crynwr.com)
Date: Sat, 29 Jun 1996 16:41:52 +0800
Subject: Open letter to the NSA
Message-ID: <19960629061130.31403.qmail@ns.crynwr.com>


You screwed up, guys.  If, instead of restricting the export of strong
crypto systems, you had instead encouraged it, you would have
prevented the development of foreign crypto expertise.  Look at South
Africa: we banned them armaments, so they created their own arms
industry.  Now they're a serious arms exporter.  You won in the
short-term and lost in the long-term.

Where is the wisdom needed to admit your mistake?  Missing, I'd say.

-russ <nelson at crynwr.com>    http://www.crynwr.com/~nelson
Crynwr Software sells packet driver support     | PGP ok
521 Pleasant Valley Rd. | +1 315 268 1925 voice | Corporations persuade;
Potsdam, NY 13676       | +1 315 268 9201 FAX   | governments coerce.





From llurch at networking.stanford.edu  Sat Jun 29 01:43:07 1996
From: llurch at networking.stanford.edu (Rich Graves)
Date: Sat, 29 Jun 1996 16:43:07 +0800
Subject: John Grubor and you
In-Reply-To: <199606290307.FAA23142@basement.replay.com>
Message-ID: <Pine.GUL.3.94.960628230701.24211G-100000@Networking.Stanford.EDU>


On Sat, 29 Jun 1996, Anonymous wrote:

> Lucifer Remailer Operator wrote:
> 
> >Just for the record, I am NOT John Grubor and had never even heard of him
> >before I did an Altavista search on his name earlier today.  The concept that
> >some net.loon like Grubor would get another account with DHP to run an
> >anonymous remailer for whatever reason is LAUGHABLE.  From what I have read,
> >Grubor spams newsgroups quite often, something I have not done nor plan on
> >doing.  I was expecting people to be posting paranoid rantings about how I
> >am obviously a SPOOK...
> 
> Why you were expecting people to be posting paranoid rantings if you did
> not even know who Dr. John Grubor, undercover police agent, was?

Gee, given the anonymous paranoid rants that greeted nym.alias.net and the 
SAFE conference, I can't imagine...

-rich






From jimbell at pacifier.com  Sat Jun 29 02:42:19 1996
From: jimbell at pacifier.com (jim bell)
Date: Sat, 29 Jun 1996 17:42:19 +0800
Subject: rsync and md4
Message-ID: <199606290549.WAA16170@mail.pacifier.com>


At 01:50 PM 6/29/96 +1000, Andrew Tridgell wrote:
>Why md4? I chose md4 because it seemed to be the fastest of the
>reputedly strong, publicly available checksum algorithms.

Whatever you do, PLEASE stop using the term "checksum" when what you really 
mean is CRC, hash or something else.  A "checksum" is a bad error checker, 
only somewhat better than none at all.  If you use the term "checksum" some 
neophyte might actually misinterpret what you're doing and implement a real, 
honest-to-goodness checksum in his next program.


Jim Bell
jimbell at pacifier.com





From snow at smoke.suba.com  Sat Jun 29 03:06:32 1996
From: snow at smoke.suba.com (snow)
Date: Sat, 29 Jun 1996 18:06:32 +0800
Subject: crypto and bagpipes [NOISE]
In-Reply-To: <Alp9gs600YUyRVfsNl@andrew.cmu.edu>
Message-ID: <Pine.LNX.3.93.960629013851.429A-100000@smoke.suba.com>


On Fri, 28 Jun 1996, Declan B. McCullagh wrote:

> Excerpts from internet.cypherpunks: 27-Jun-96 Re: crypto and bagpipes
> [NO.. by "Perry E. Metzger"@pierm 
> > No one who has heard sustained bagpipe playing can deny the fact that
> > bagpipes are indeed an instrument of war, with no legitimate place in
> > peaceful everyday society.
> 
> Hmm... Carnegie Mellon University is the only school in the country with
> a bagpipe major, you know. You haven't lived until you've heard a
> screeching 'pipe at 3 am in front of Hunt Library.

	And after, you _aren't_ alive.

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From janimmo at ionet.net  Sat Jun 29 04:25:30 1996
From: janimmo at ionet.net (Jeffrey A Nimmo)
Date: Sat, 29 Jun 1996 19:25:30 +0800
Subject: unsuscribe
In-Reply-To: <31D4C3DD.29A6@worldchat.com>
Message-ID: <Pine.SOL.3.91.960629041429.12090B-100000@ion1.ionet.net>




On Sat, 29 Jun 1996 ryans at worldchat.com wrote:

> unsuscribe
> 

Apparently noone in this country knows how to: 

1. Read the help file sent out automatically upon
   subscription.

2. Spell "unsubscribe."





From jamesd at echeque.com  Sat Jun 29 04:30:29 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Sat, 29 Jun 1996 19:30:29 +0800
Subject: RFD: Developing Nations and crypto (based on excertp from Edupag
Message-ID: <199606290859.BAA25535@dns1.noc.best.net>


At 09:48 AM 6/26/96 -0700, Timothy C. May wrote:
> Sadly, most developing countries (Third World, LDCs, whatever) have
> repressive governments of various stripes...few are libertarian. Several
> have embraced computer technology, but primarily as an instrument of social
> control.

This is true, but basically back to front.  Certain common forms of repressive
economic policy cause poverty.  From time to time political convulsions change
this policy for a long period.  If the period is several decades, development
follows.

In the past, popular support for these repressive policies was vast and 
overwhelming, and once in place they could only be changed by fairly 
murderous dictatorships, for example South Korea and Chile.

Popular support for these policies is still substantial, but has steadily 
diminished.

In my opinion this diminishing support is largely the result of 
improved international communications.  When people in poor countries 
discover that their social order is radically different from that in 
similar rich countries, they are apt to vote for institutions similar 
to those in the rich country -- the JR Ewing affect.

In short, the third world it has become considerably easier to create
liberty without the need to massacre real, suspected, and imaginary
communists.



>Singapore is an example of a country that jumped from former colonial
>status, surrounded by relatively poor (GNP) countries, to the "Information
>Age." And what is the result? What our own Sandy Sandfort dubbed
>"Disneyland with a Death Penalty." No spitting, no cursing, no long hair,
>no "Wall Street Journal," no pornography, no Internet free access, no
>dissension. And smartcards track the movements of all Citizen-Units. Not an
>encouraging example.
>
>As for the comment that "they aren't bogged down in older ways of doing
>business, communicating, etc." Well, some of these "older ways" include:
>
>- concepts about the ownership of property and transfers of title
>
>- contracts, and the ability to make and enforce them
>
>- understanding of the Uniform Commercial Code (the descendent of the "Law
>Merchant" which Western societies have embraced for centuries)
>
>- a stable middle class, solid educational facilities, and a tradition of
>business and technical achievement
>
>(These are all things which are missing in many Third World countries, for
>whatever reasons. Even in many Second World countries, such as the former
>U.S.S.R., and these lacks are making the development of modern economic
>systems problematic.)
>
>Certainly some small nations--perhaps island nations--can essentially jump
>directly to an "information based economy." The Cayman Islands and several
>other examples come to mind.
>
>I find it harder to believe that a _large_ nation is likely to make such a
>transition.
>
>--Tim May
>
>Boycott "Big Brother Inside" software!
>We got computers, we're tapping phone lines, we know that that ain't allowed.
>---------:---------:---------:---------:---------:---------:---------:----
>Timothy C. May              | Crypto Anarchy: encryption, digital money,
>tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
>W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
>Licensed Ontologist         | black markets, collapse of governments.
>"National borders aren't even speed bumps on the information superhighway."
>
>
>
>
>
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From janimmo at ionet.net  Sat Jun 29 04:41:48 1996
From: janimmo at ionet.net (Jeffrey A Nimmo)
Date: Sat, 29 Jun 1996 19:41:48 +0800
Subject: anonymous mailing lists
In-Reply-To: <199606290404.XAA32220@manifold.algebra.com>
Message-ID: <Pine.SOL.3.91.960629040641.12090A-100000@ion1.ionet.net>




On Fri, 28 Jun 1996 ichudov at algebra.com wrote:

> Then users of alpha.c2.org will have to install mail filters that
> automatically delete all incoming mail not intended to be read by them
> (they can't read such messages anyway).

How exactly would this be done? Since messages from alpha.c2.org
are conventionally encrypted, they don't contain key id's. 

Wouldn't that require every recipient to store his/her passphrase
and call pgp for every message to see if it could be decrypted? This in
and of itself would be a more serious security breach, not to mention an 
_enormous_ drain on site resources. 






From perry at alpha.jpunix.com  Sat Jun 29 06:10:09 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Sat, 29 Jun 1996 21:10:09 +0800
Subject: PC-ness of nym.alias.net
In-Reply-To: <199606290304.DAA15488@netbox.com>
Message-ID: <Pine.NEB.3.93.960629053420.7046A-100000@alpha.jpunix.com>


-----BEGIN PGP SIGNED MESSAGE-----

On Fri, 28 Jun 1996, Rich wrote:

> According to the root DNS servers, which as we know are controlled by a ZOG
> defense contractor, alias.net is an alias for alpha.jpunix.com, and
> anon.lcs.mit.edu is indeed the same as nym.alias.net. alias2-dom is said to
> get name service from Sameer and company, but that could be a trap. 

	Not totally correct. I used to run the alias.net domain but I
handed it over to Sameer at one time because I was unable to administer it
due to some things going on at work. So the correct answer is that Sameer
now owns and operates alias.net. 

 John Perry - perry at alpha.jpunix.com -  PGP-encrypted e-mail welcome!
 WWW - http://www.jpunix.com
 PGP 2.62 key for perry at jpunix.com is on the keyservers.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdUHQ1OTpEThrthvAQFtKAP9Hehb3i1RaVOs12nwSFAor3YM+GiYYIad
wpCvgwKWv+VPgMrC+ogga2apkNngd6ztC7J7Zk99tDq0v78yJrq1N7x0O/xXREcA
FPxCqdOjPxolIEIG7Xb6Oqvfby/cDwP2hzX9tgWz01s51xToLyGG/j7PSwbEgMRA
oe5t0wvgOqE=
=3/Ys
-----END PGP SIGNATURE-----





From asgaard at sos.sll.se  Sat Jun 29 06:54:01 1996
From: asgaard at sos.sll.se (Asgaard)
Date: Sat, 29 Jun 1996 21:54:01 +0800
Subject: www hacking?
In-Reply-To: <960629011631_145401493@emout08.mail.aol.com>
Message-ID: <Pine.HPP.3.91.960629125936.8634A-100000@cor.sos.sll.se>


On Sat, 29 Jun 1996 AwakenToMe at aol.com wrote:

> If someone could tell me the dangers of someone attacking someones
> site..etc..on the WWW, I would much appreciate it!

Editing the contents of a .htm(l) without permission of the owner
(alledged publisher) can do any sort of harm. Imagine the reaction
if the Vatican Home Page suddenly contained a statement like 'Woytola
just spoke to God. The Allmighty has changed her mind: Contraception
and Divorce are hereby sanctioned by the Divine Catholic Throne'.

Even changing a single ascii character can raise HELL. The biggest
telco in Sweden, TELIA (formerly the State Monopoly and still
a subject for 2600-type teenager scorn) recently involuntarily
had their main home-page logo changed to FELIA - which in Swedish
is an allegory of 'wrong', as if PACIFIC BELL would have become
PACIFIC HELL. This was major news for all media including prime
time TV and very bad publicity for the telco, securitywize.


Asgaard







From ceridwyn at wolfenet.com  Sat Jun 29 07:26:53 1996
From: ceridwyn at wolfenet.com (Cerridwyn Llewyellyn)
Date: Sat, 29 Jun 1996 22:26:53 +0800
Subject: mocking paranoia
Message-ID: <2.2.32.19960629122315.0068dd0c@gonzo.wolfenet.com>


At 05:58 AM 6/29/96 nelson at crynwr.com wrote:
>Earlier, someone mocked someone else for being paranoid.  Sorry, but
>this is a mistake.  By definition, you have a non-empty threat model
>when you set out to encrypt; therefore you must be paranoid to use
>encryption.  Or else they really *could* be out to get you, but
>sometimes it's not possible to tell, and you have to assume that they
>are.

heh... "just because you're paranoid doesn't mean they're not after you."






From jya at pipeline.com  Sat Jun 29 07:57:54 1996
From: jya at pipeline.com (John Young)
Date: Sat, 29 Jun 1996 22:57:54 +0800
Subject: The End of Science
Message-ID: <199606291214.MAA23695@pipe6.t2.usa.pipeline.com>


   Natalie Angier, the sharp-witted science reporter for The 
   New York Times, reviews "The End of Science," by John 
   Horgan, a senior writer at Scientific American, in the June 
   30 NYT Book Review. She writes: 
 
      In this intellectually bracing, sweepingly reported, 
      often brilliant and sometimes bullying book, John Horgan 
      makes the powerful case that the best and most exciting 
      scientific discoveries are behind us. He argues that 
      many scientists today, particularly those he interviewed 
      for this book, are "gripped by a profound unease." Part 
      of that malaise results from all the sociopolitical 
      irritants we've heard about: the dwindling financial 
      resources, the vicious competition, the strident 
      antipathy of animal rights activists, religious 
      fundamentalists, technophobes and the like. 
 
      But a far more important source of despair, Mr. Horgan 
      insists, is that scientists are beginning to sense that 
      "the great era of scientific discovery is over." The big 
      truths, the primordial truths, the pure truths about 
      "the universe and our place in it" have already been 
      mapped out. Science has been so spectacularly successful 
      at describing the principal features of the universe, on 
      a scale from quarks to the superstructure of galaxies, 
      that the entire enterprise may well end up the 
      paradoxical victim of its own prosperity. "Further 
      research may yield no more great revelations or 
      revolutions," he writes, "but only incremental, 
      diminishing returns." 
 
   While Angier does not agree with his thesis that the major 
   problems of science have been solved, she commends his 
   incisive critique of scientists who cannot give up the 
   dream of omniscience, many of whom he has interviewed for 
   the book -- Stephen Jay Gould, Roger Penrose, Steven 
   Weinberg, Daniel Dennett, Stuart Kauffman, Marvin Minsky, 
   John Wheeler, Frank Tipler and others. 
 
   She summarizes Horgan's view of detumescent science: 
 
      Where does that leave contemporary scientists? They can 
      either pursue small, manageable and vaguely boring 
      science (sequencing the complete complement of human DNA 
      may fall into this category), or they can turn to what 
      Mr. Horgan calls "ironic science." Such science is 
      "speculative, postempirical," resembling literary 
      criticism "in that it offers points of view, opinions, 
      which are, at best, interesting." Ironic science is 
      provocative, he says, but it fails to converge on the 
      truth. " It cannot achieve empirically verifiable 
      surprises that force scientists to make substantial 
      revisions in their basic description of reality," he 
      writes. 
 
   ---------- 
 
   For those without access to NYT, the full review is 
   available at: 
 
      http://pwp.usa.pipeline.com/~jya/theend.txt   (11 kb) 
 
   Or, we will E-mail a copy. Send a blank message to 
   <jya at pipeline.com> with the subject THE_end 
 
 
 
 





From kdf at gigo.com  Sat Jun 29 10:53:20 1996
From: kdf at gigo.com (John Erland)
Date: Sun, 30 Jun 1996 01:53:20 +0800
Subject: Open Gates?
Message-ID: <102_9606290819@gigo.com>



[Please respond via netmail, as I have only limited access to the list.]

Does anyone have a _current_ list of open mail-to-news gates?

As far as I can tell, the only one is:

        group.name at pubnews.demon.co.uk

Thanks for any help.
--
: Fidonet:  John Erland 1:203/8055.12  .. speaking for only myself.
: Internet: kdf at gigo.com





From iang at cs.berkeley.edu  Sat Jun 29 11:56:47 1996
From: iang at cs.berkeley.edu (Ian Goldberg)
Date: Sun, 30 Jun 1996 02:56:47 +0800
Subject: anonymous mailing lists
In-Reply-To: <01I6GF62YWG291VYF3@delphi.com>
Message-ID: <4r3k8g$8h@abraham.cs.berkeley.edu>


-----BEGIN PGP SIGNED MESSAGE-----

In article <199606290404.XAA32220 at manifold.algebra.com>,
Igor Chudov @ home <ichudov at algebra.com> wrote:
>How about this attack: suppose I want to find out who hides behind
>an alias MightyPig at alpha.c2.org and I have the ability to monitor
>all internet traffic. Then I simply start mailbombing that address
>and see whose account gets unusually high traffic volume.
>
>A nice, albeit quite expensive, way of pretection from traffic analysis
>is to create a mailing list (or a newsgroup) and forward all messages to
>all users of that mailing list or newsgroup. Of course, since messages
>are encrypted, only the recipients will be able to decrypt them.
>
>This way the list of suspects is all subscribers of that list or
>newsgroup and there is no way to discriminate them.
>
>Instead of having messages to be sent to all recipients all the time,
>alpha.c2.org may be programmed so that it sends out every message not to
>only one recipient X, but to X and 20 other randomly selected people.
>
>It apparently makes traffic analysis much harder.
>
>Then users of alpha.c2.org will have to install mail filters that
>automatically delete all incoming mail not intended to be read by them
>(they can't read such messages anyway).
>
>        - Igor.

[I'm copying this to remailer-operators.]

Yesterday, Dave and I discussed at length a design for a new remailer network.
It was motivated by the fact that, when I installed mixmaster, it mentioned
Diffie-Helman and direct socket connections as a "future expansion"
thing.  Well, IMHO, that time has come.  I wanted to hack mixmaster to
accept ecash postage for the last hop, anyway, so I may as well put in
the direct connection bits as well.

I'll post more about this when we've discussed it more (and with Lance),
and when I'm on a faster link to the net.  Basically, the idea is that every
remailer gets a copy of every encrypted message, using a randomized fill
algorithm, and D-H encrypted links.  If you're a remailer in this network,
and you get a message:

If you've seen this message before, drop it (this step needs more thought).
If you can decrypt the message, do so, and handle the decrypted copy (but
continue with the following steps with the original message anyway).
If you have a message waiting to be inserted into the remailer network,
drop the incoming message and take that message instead.
Take whatever message you have now, and queue it to be sent to 5 random
remailers.  Every so often, fill your queue to a constant size with dummy
messages, and send some (possibly smaller, randomly chosen) constant
number of them on their way.
All messages should, of course, be packetized to the same size, a la mixmaster.

The result of this is that, if you are a part of this network, it should
be impossible for anyone to tell when you receive a message, as opposed
to anyone else in the network (think alt.anonymous.messages, but where
the links are D-H encrypted, and you have a news feed to your own
machine, and the message sizes are all the same, and so on...).  This is
perfect for making nyms.

Sender anonymity is achieved by chaining.  If you are part of the network,
you can always claim that a message you sent was just one you received from
somewhere else (you used D-H to get the messages, so you can't identify
from where, though).

So if you're part of the network, it would seem you are indistinguishable
from anyone else on the network.  Here is where the tradeoff occurs.
How big should the network be?  If it's too small, the above anonymity
doesn't gain you much.  If it's too big, you may not be able to handle
all of the remailer traffic.

Also, what are the issues for people who aren't on the network?  It will
be very hard to prevent people from noticing that they're sending a
message to the network, or receiving one from it, so it seems the best we can
do is to avoid letting someone be able to link incoming messages to outgoing
ones.  A way to help this is to have a (smaller) number of nodes be the
only ones which send mail _out_ of the network.  One idea which I'd like to
try is having that last remailer charge postage in order to send mail out.
After all, he is the one who will take the "heat" for the anon message,
probably.  By concentrating the outgoing messages, it should be easier
to do the latency and reordering tricks.

   - Ian

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdVUL0ZRiTErSPb1AQH3mAQAhf0Lgh2cpahbF8JrB+hhD8ZP3oV3v9bA
UsfRFEV+vcQtCopvwEsXGz6FvuyrxvYzxWE+74iPBlY204eeiTFZ0n1zq8qGRIuw
kUgdM0jgNX5v5nmv+EaUeeCkuRQ5JEqIevlaD9iaK3iYO2mAVg8HFxzdmV0kLPq1
hLehErR+GX4=
=7JBM
-----END PGP SIGNATURE-----





From adam at homeport.org  Sat Jun 29 12:02:54 1996
From: adam at homeport.org (Adam Shostack)
Date: Sun, 30 Jun 1996 03:02:54 +0800
Subject: MS-Mail Security
In-Reply-To: <Pine.SOL.3.91.960627231233.11957A-100000@sol25.cs.cuhk.hk>
Message-ID: <199606291744.MAA24676@homeport.org>


Leo WONG Wing-yan wrote:

|     I would like to gather informations of whether the MS-Mail server is 
| secure or not, is anyone heard of somebody, say, disguise as other user 
| or read other user e-mail?

	Its good idea to think of mail security as an end to end
thing; you encrypt the mail for your recipient(s).  They decrypt it.
There are (decent) proposals afoot to encrypt mail server to server,
which is fine, it doesn't sacrifice security, and makes accidental
mail reading less likely.

	However, I know of two mail servers that I might trust, and
both of them (qmail and smap) come as source code.  I wouldn't trust
any MS product with security functions; what happens when it breaks?
SMB was broken for 3 months before it was fixed.

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From hfinney at shell.portal.com  Sat Jun 29 12:06:32 1996
From: hfinney at shell.portal.com (Hal)
Date: Sun, 30 Jun 1996 03:06:32 +0800
Subject: anonymous mailing lists
Message-ID: <199606291634.JAA28291@jobe.shell.portal.com>


From: Jeffrey A Nimmo <janimmo at ionet.net>
> On Fri, 28 Jun 1996 ichudov at algebra.com wrote:
> > Then users of alpha.c2.org will have to install mail filters that
> > automatically delete all incoming mail not intended to be read by them
> > (they can't read such messages anyway).
> 
> How exactly would this be done? Since messages from alpha.c2.org
> are conventionally encrypted, they don't contain key id's. 
> 
> Wouldn't that require every recipient to store his/her passphrase
> and call pgp for every message to see if it could be decrypted? This in
> and of itself would be a more serious security breach, not to mention an 
> _enormous_ drain on site resources. 

Since the PGP is run on private computers, and only at mail-reading time,
there should be no problem entering the conventional encryption
passphrase and checking to see whether the messages decrypt.  Actually
PGP puts a pattern at the beginning of the encrypted portion, so
successful decryption can be checked very quickly, without much of a
computational load.

Hal





From adam at homeport.org  Sat Jun 29 12:06:38 1996
From: adam at homeport.org (Adam Shostack)
Date: Sun, 30 Jun 1996 03:06:38 +0800
Subject: crypto and bagpipes [NOISE]
In-Reply-To: <199606280352.XAA06868@jekyll.piermont.com>
Message-ID: <199606291737.MAA24643@homeport.org>


Damnit, Perry, the fact that you don't like them doesn't mean we
should outlaw them!  :)

Adam

Perry E. Metzger wrote:
| vinnie moscaritolo writes:
| > >>>A Missive From: David Kovar (kovar at nda.com)
| [...]
| > >>>Mr Brooks, the piper, has denied the charge, citing a case in 1746,
| > >>>where bagpipes were declared to be instruments of war, not musical
| > >>>instruments, and a subsequent Act of Parliament which specifically
| > >>>stated that they were weapons. He claims he wasn't playing a musical
| > >>>instrument, but practising with a weapon!
| > >>>
| > >>>The imagination boggles if his claim is successful!
| 
| No one who has heard sustained bagpipe playing can deny the fact that
| bagpipes are indeed an instrument of war, with no legitimate place in
| peaceful everyday society.
| 
| Perry
| 


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume






From markm at voicenet.com  Sat Jun 29 12:37:29 1996
From: markm at voicenet.com (Mark M.)
Date: Sun, 30 Jun 1996 03:37:29 +0800
Subject: rsync and md4
In-Reply-To: <96Jun29.135037+1000est.65075-20848+164@arvidsjaur.anu.edu.au>
Message-ID: <Pine.LNX.3.94.960629131422.197A-100000@gak>


-----BEGIN PGP SIGNED MESSAGE-----

On Sat, 29 Jun 1996, Andrew Tridgell wrote:

> I've recently released a package called rsync that uses a checksum
> search to provide very efficient file update over a slow link.  (see
> ftp://samba.anu.edu.au/pub/rsync if you are interested)
> 
> Now I'd like to calculate some probabilities of failure of the
> algorithm. The fundamental thing I need to know to do the calculation
> is the probability of a random piece of data of length n having the
> same md4 checksum as another given piece of data of the same length.

MD4 is a hashing algorithm, but it can be used for checksuming.

> 
> A first guess might be 2^-128 but I know that this sort of thing is
> rarely that simple. Is md4 that good?

2^-64.
> 
> Note that I am not interested in "attacks" on md4 as such as the
> source of the random data is just another file provided by the same
> user, so it won't have been specially designed to defeat md4. 
> 
> If the probability is within a few orders of magnitude of 2^-128 then
> can I also be sure that if I only use the first b bits of a md4
> checksum it will be within a few orders of magnitude of 2^-b ? There
> is an option in rsync to use a shorter checksum by truncating
> md4. This saves some bytes on the link at the risk of lowering the
> confidence. 

The probability of failure is 2^-(b/2).

> 
> Why md4? I chose md4 because it seemed to be the fastest of the
> reputedly strong, publicly available checksum algorithms. Suggestions
> for alternative algorithms are welcome.

So far, MD4 is the fastest hashing algorithm.

- -- Mark

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
markm at voicenet.com              | finger -l for PGP key 0xe3bf2169
http://www.voicenet.com/~markm/ | d61734f2800486ae6f79bfeb70f95348
"Freedom is the freedom to say that two plus two make four.  If that
is granted, all else follows."  --George Orwell, _1984_


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQCVAwUBMdVlv7Zc+sv5siulAQG0SAP9HyybTTn/ffPLhPgtooxP/abIQYZ2r6sI
PW90ilTucWMNjFQ87Xl+MUUysklG4G1zx+i3ZnIP5ud3D69kh+E6s2MbvUKcOFUi
TKAmB5rVSGHOvDROnY5cBGU7iSCxgiM5auq5rSu6/MvwtvSf99VtKh9UdcFp2SuH
u4ukZmAE1x0=
=otP1
-----END PGP SIGNATURE-----





From hfinney at shell.portal.com  Sat Jun 29 13:13:04 1996
From: hfinney at shell.portal.com (Hal)
Date: Sun, 30 Jun 1996 04:13:04 +0800
Subject: anonymous mailing lists
Message-ID: <199606291637.JAA28348@jobe.shell.portal.com>


From: ichudov at algebra.com (Igor Chudov @ home)
> A nice, albeit quite expensive, way of pretection from traffic analysis
> is to create a mailing list (or a newsgroup) and forward all messages to
> all users of that mailing list or newsgroup. Of course, since messages
> are encrypted, only the recipients will be able to decrypt them.

This was discussed here several years ago, under the name "anonymous
message pools".  Myron Cuperman, the operator of the extropia remailer
implemented one, although I don't know if it is still running (I
haven't gotten any mail from it for years).  It was basically just a
mailing list specifically for this purpose, that you would use as your
anonymous return address.  Of course a problem is that there may not be
enough people signed up to provide much privacy protection.

Hal





From jamesd at echeque.com  Sat Jun 29 13:20:15 1996
From: jamesd at echeque.com (jamesd at echeque.com)
Date: Sun, 30 Jun 1996 04:20:15 +0800
Subject: Alternic.net (was domain zapping)
Message-ID: <199606291758.KAA19598@dns2.noc.best.net>


At 09:03 AM 6/28/96 -0700, Bill Stewart wrote:
> If you don't do it carefully,
> you'll end up needing a bunch of Above-Top-Level nameservers that
> serve the names of the tens of thousands of top-level domains.

Five thousand top level domain names is quite manageable, no big problem 
provided that their servers are reasonably stable -- and if the unstable 
ones do not work well, big deal.

A hundred thousand would be a problem.

Assume a top level domain typically lasts forever, and a top level server 
typically lasts ten years.  Assume two new top level domain names appear 
each day, and that it typically takes a several of months of reliable service
to be added to the most generally accepted lists.  This does not seem to
constitute an intolerable burden to most domain name server administrators.
 ---------------------------------------------------------------------
              				|  
We have the right to defend ourselves	|   http://www.jim.com/jamesd/
and our property, because of the kind	|  
of animals that we are. True law	|   James A. Donald
derives from this right, not from the	|  
arbitrary power of the state.		|   jamesd at echeque.com






From tcmay at got.net  Sat Jun 29 13:20:38 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 30 Jun 1996 04:20:38 +0800
Subject: Message pools _are_ in use today!
Message-ID: <adfab86806021004c248@[205.199.118.202]>


At 4:37 PM 6/29/96, Hal wrote:
>From: ichudov at algebra.com (Igor Chudov @ home)
>> A nice, albeit quite expensive, way of pretection from traffic analysis
>> is to create a mailing list (or a newsgroup) and forward all messages to
>> all users of that mailing list or newsgroup. Of course, since messages
>> are encrypted, only the recipients will be able to decrypt them.
>
>This was discussed here several years ago, under the name "anonymous
>message pools".  Myron Cuperman, the operator of the extropia remailer
>implemented one, although I don't know if it is still running (I
>haven't gotten any mail from it for years).  It was basically just a
>mailing list specifically for this purpose, that you would use as your
>anonymous return address.  Of course a problem is that there may not be
>enough people signed up to provide much privacy protection.

The newsgroup "alt.anonymous.messages" has existed for a year or two, and
serves to be working reasonably well as a message pool. Check it out.

One will find numerous messages of the sort copied below. Having browsed
some of the less common newsgroups (and trolled, in my my earlier days), I
surmise that messages to nyms like "TheBear" are related to "support and
recovery" sorts of topics. (I mention this because this is a compelling
example of where anonymity is often sought; that people are using remailers
and message pools to communicate is interesting. When Louis Freeh claims
that remailers are only being used by hackers and Russian mafia arms
exporters, this is a counterexample.)

Here's just one such message, of several I saw this morning in
"alt.anonymous.messages". (Note that anonymous message pool sorts of
messages also appear directly from time to time in groups like
"alt.abuse.recovery" and that ilk.)

--begin copied message--

From: nobody at REPLAY.COM (Anonymous)
Newsgroups: alt.anonymous.messages
Subject: TheBear
Date: 15 Jun 1996 14:26:12 +0200
Organization: Replay and Company UnLimited
Lines: 14
Sender: replay at basement.replay.com
Message-ID: <4pua54$gt6 at basement.replay.com>
NNTP-Posting-Host: basement.replay.com
X-XS4ALL-Date: Sat, 15 Jun 1996 14:26:17 MET DST
XComm: Replay may or may not approve of the content of this posting
XComm: Report misuse of this automated service to <abuse at REPLAY.COM>


-----BEGIN PGP MESSAGE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

hIwDrINEDTBBpVEBA/4sKOcgI33fdk6Pz5V27OIX0KiVfb4YDwgNLDpf6Wy0uvix
4oQ9p+vmtsZ32dPBoG4aF7bvh5ejqwZSpvuKOpgt1M8SKbA+Nma+EclMzQ3us3Ey
OX5aFKo3TwB1Ck8tZPhpF8b/fI8gqz5v2FJhnon6NdktjFBVo3SBXya8AdlgUaYA
AABsOTd6WOMH8PWnKHuP7PMCflH2p+halmCDsn9ytmoG6uzrINHH/B8c7aW6c7xw
9nXbB+99xLldhAqyg1M/oKi4pjfJ8cuSonDxMPTP8rr49XTCFaiOuQ7JUe3MEaop
NIppnoBMrBvGRkKOgrYy
=lYbJ
-----END PGP MESSAGE-----

--end copied message--

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From hfinney at shell.portal.com  Sat Jun 29 14:03:31 1996
From: hfinney at shell.portal.com (Hal)
Date: Sun, 30 Jun 1996 05:03:31 +0800
Subject: anonymous mailing lists
Message-ID: <199606291640.JAA28469@jobe.shell.portal.com>


Wei Dai did some nice statistical analysis of this type of attack
sometime a year or two ago.  Even with countermeasures such as you
suggest, if they are not perfect, so some information leaks correlating
incoming and outgoing messages, Wei showed that it was possible to
deduce the owners of the nyms surprisingly quickly.

The countermeasures do work - if you get and send exactly 50 pieces of
4K byte email every day, no matter what, then correlations don't exist
- but they are expensive to do perfectly.  For now we have much worse
weaknesses; none of the current return-address systems are really safe,
other than posting encrypted mail to newsgroups (and even that may be a
problem if they suspect who you are and are monitoring your computer
link to see if you download certain messages).

Hal





From alano at teleport.com  Sat Jun 29 15:13:50 1996
From: alano at teleport.com (Alan Olsen)
Date: Sun, 30 Jun 1996 06:13:50 +0800
Subject: crypto and bagpipes [NOISE]
Message-ID: <2.2.32.19960629184928.00ad4d90@mail.teleport.com>


At 10:55 PM 6/28/96 -0400, Declan B. McCullagh wrote:
>Excerpts from internet.cypherpunks: 27-Jun-96 Re: crypto and bagpipes
>[NO.. by "Perry E. Metzger"@pierm 
>> No one who has heard sustained bagpipe playing can deny the fact that
>> bagpipes are indeed an instrument of war, with no legitimate place in
>> peaceful everyday society.
>
>Hmm... Carnegie Mellon University is the only school in the country with
>a bagpipe major, you know. You haven't lived until you've heard a
>screeching 'pipe at 3 am in front of Hunt Library.

I guess this explains the pro-censorship outlook of the students and staff
there.  Maybe someone should be investigating the evil effects of bagpipes
on the mind.  (The Freudian implications of bagpipe playing alone should get
someone there to do something about it...)


---
|"The moral PGP Diffie taught Zimmermann unites all| Disclaimer:         |
| mankind free in one-key-steganography-privacy!"  | Ignore the man      |
|`finger -l alano at teleport.com` for PGP 2.6.2 key  | behind the keyboard.|
|         http://www.teleport.com/~alano/          | alano at teleport.com  |






From ichudov at algebra.com  Sat Jun 29 16:03:00 1996
From: ichudov at algebra.com (Igor Chudov @ home)
Date: Sun, 30 Jun 1996 07:03:00 +0800
Subject: anonymous mailing lists
In-Reply-To: <4r3k8g$8h@abraham.cs.berkeley.edu>
Message-ID: <199606291921.OAA12444@manifold.algebra.com>


Ian Goldberg wrote:
> 
> Also, what are the issues for people who aren't on the network?  It will
> be very hard to prevent people from noticing that they're sending a
> message to the network, or receiving one from it, so it seems the best we can
> do is to avoid letting someone be able to link incoming messages to outgoing
> ones.  A way to help this is to have a (smaller) number of nodes be the
> only ones which send mail _out_ of the network.  One idea which I'd like to
> try is having that last remailer charge postage in order to send mail out.
> After all, he is the one who will take the "heat" for the anon message,
> probably.  By concentrating the outgoing messages, it should be easier
> to do the latency and reordering tricks.
> 

Hm, I wonder what would it take to incorporate encryption straight 
into sendmail (I am talking about actually encrypting not only message
bodies, but also MAIL FROM: and RCPT TO: data). The protocol extension
would for SMTP be something like this:

A server in the welcome message may say "PGP Enhanced". If the client sees 
this substring, client (after HELO) may send command

SENDKEY

If the server answers "503 Command unrecognized", the exchange goes in the
normal way. If instead a text with 214 preceding each line gets sent 
followed by a final ".", this text is considered a PGP key for exchange.

Then usual MAIL FROM: and RCPT TO: follow, following by DATA command.
The data sent by client will be PGP encrypted. Moreover, the data may
have MAIL FROM: and RCPT TO: fields preceding any header information 
and message body. These RCPT TO: and MAIL FROM: override anything that
was supplied in clear text prior to the DATA command.

This change in protocol is relatively simple to implement and does not
require the actual sendmail to have any cryptographic subroutines.
Instead, sendmail simply calls public-key encryption programs with right
command line parameters when an encrypted message is received.

It is also possible to incorporate Latent-Time: into such messages.

What it gives to us is that a great number of systems can participate
in the more secure mail exchange. It gives clear advantages to each
site running it because now they may be exchanging may securely for 
all users.

Users of remailer network may use such PGP enhanced hosts to conceal
their usage of remailer network. It is rather obvious that when the 
number of PGP-enhanced mailers becomes large, it will be hard to tell
who is and who is not using the remailer network.

	- Igor.





From vznuri at netcom.com  Sat Jun 29 16:14:52 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Sun, 30 Jun 1996 07:14:52 +0800
Subject: fbi botches intel "ecspionage" case
Message-ID: <199606291925.MAA12512@netcom3.netcom.com>



"economic espionage" (ecspionage?) is in full swing as being 
promoted as the new bogeyman to justify spending billions of
dollars to our intelligence agencies, both military and
the FBI.

we already have a very good example where this has
backfired. I was watching Nightline on Tues night or
so in which there was info about how the FBI helped
get an informant into Intel in a *very* sensitive
position, where he was able to film the pentium chip
plans. he said he sold them, as I recall,
to iraq, syria, china, etc.

at the end of the show, the reporter stated that
the FBI was seeking stronger laws against theft
of "intellectual property" in congress that might
solve the problem. there was much lamentation over the
fact the criminal in question only got about 33 months
of prison time or something.

the FBI emerged with great egg on their face. I would
say if anyone wants to ridicule them for getting into
covering "ecspionage" cases, this is a prime candidate
case. is this what they are aiming for? heh, heh.

==

somehow we have missed a good public debate about 
ecspionage in the country. there were a few NYT 
editorials, but it is clearly being used as a very
major aspect of promoting the new post-cold-war spy
and intelligence strategy without almost any notice
by major analyists.

I was thinking about all the objections I had to the
FBI ecspionage treatment that were never raised on the
program:


1. there was an implicit assumption that merely having
the plans to the chip would allow other countries to somehow
slaughter us in economic competition. but INTEL has spent
billions of dollars on physical infrastructure without which
the plans are virtually useless. it would take other countries
years to get the kind of equipment necessary to produce the
pentium, by which it might actually be yesterday's technology
that no one cares about any more.

2. we have a tradition of separation of church and state in
this country, and also separation of the public government
and private industry. suddenly we have the FBI saying they
want to infiltrate companies to deal with economic espionage.
well, these companies have their own policy, and what do
they gain by having a government agency working inside them?
in the above case I note, it led to exactly the *opposite*
of what was intended: the theft of *highly*sensitive* plans
by an FBI mole.

3. hence, one wonders if the FBI could do a better job of
combating ecspionage than companies are already doing, or
if they are just going to botch it as has already been 
spectacularly proven in this case.

4. we could have companies that are run like the NSA to prevent
"theft of information" (in quotes because I wonder if this will
be considered a crime in future decades, just as heresy and
blasphemy were once considered crimes a long time ago but no
longer are today).  however, we have the old "openess vs.
security" catch-22. we can't have technological development
without some degree of openess.

5. what is "intellectual property"? I think a very good case
can be made that there isn't really any such thing, that
the term itself may be thought in the future as something
like an oxymoron. there is a big red flag going up here:
why do we need all kinds of laws to combat this? is it
really a problem? can anyone actually point to a very sinister
situation in which massive amounts of cash were lost by a 
company due to ecspionage? as the steve jackson games 
incident proved, companies are liable to vastly exaggerate
their losses to the point of fantasy. they have a tendency
to think that "their information" is worth hundreds of thousands
of dollars when it may actually be freely legally obtainable.

if someone else can give more info on this case (apparently
a book is coming out about it or something) including the
guy's name, I'd appreciate it, I didn't take any notes so
this is a bit fuzzy.





From blackavr at aa.net  Sat Jun 29 16:18:03 1996
From: blackavr at aa.net (Michael Myers)
Date: Sun, 30 Jun 1996 07:18:03 +0800
Subject: crypto and bagpipes [NOISE]
Message-ID: <2.2.32.19960629200120.006b2158@aa.net>


At 12:37 PM 6/29/96 -0500, Adam Shostack wrote:
>Damnit, Perry, the fact that you don't like them doesn't mean we
>should outlaw them!  :)
>
>Adam
>
>Perry E. Metzger wrote:
>| vinnie moscaritolo writes:
>| > >>>Mr Brooks, the piper, 
             (...)
>| > >>>claims he wasn't playing a musical
>| > >>>instrument, but practising with a weapon!
>| > >>>
>| > >>>The imagination boggles if his claim is successful!
>| 
>| No one who has heard sustained bagpipe playing can deny the fact that
>| bagpipes are indeed an instrument of war, with no legitimate place in
>| peaceful everyday society.
>| 
>| Perry

Of course...when bagpipes are outlawed...
--

Michael Myers                   Vote Libertarian....you'll sleep better!
Don't like abortion? Don't have one.     Don't like guns? Don't buy one.
|                 Don't like bagpipes? Don't play one!                 |
blackavr at aa.net                          E-mail for PGPv2.6.2 public key
\____________ http://www.aa.net/~blackavr/homepage.htm ________________/







From nCognito at rigel.cyberpass.net  Sat Jun 29 16:30:13 1996
From: nCognito at rigel.cyberpass.net (Anonymous)
Date: Sun, 30 Jun 1996 07:30:13 +0800
Subject: nym.alias.net
In-Reply-To: <199606281309.PAA13151@basement.replay.com>
Message-ID: <199606292026.NAA08528@rigel.infonex.com>


On Fri, 28 Jun 1996, Anonymous wrote:

> I would appreciate any information members may have regarding the 
> security/safety of the new nym server nym.alias.net (in "alpha" state) 
> who posted here about 3 weeks ago. Nym.alias.net reportedly is the same 
> machine as anon.lcs.mit.edu.
> 
> Specifically, is the individual running the nym _known_ to cypherpunks, 
> or is this an unknown about whom I should have serious doubts. The admin 
> states that nym.alias.net is the same machine as anon.lcs.mit.edu. 
> 
> Any information or insight regarding the wisdom of using ths nym would 
> be welcome.
> 
> Information concerning the nym I obtained by sending a message to 
> help at nym.alias.net; the administrator can be reached at 
> admin at nym.alias.net. 

Yes, nym.alias.net is anon.lcs.mit.edu.  As for whether the operator is 
trust-worthy, this is really a pointless question. With a properly 
implemented nym, the NSA themselves could be the host of your nym, and 
they still couldn't connect your nym to your true email address.

All that is required is that at least ONE of the remailers in your reply 
chain be trustworthy. 

The nym server stores only a list of nym's and the associated 
reply-blocks. Your reply block should have an absolute minimum of 2 hops, 
and each hop should be seperately encrypted with the key of the 
particular remailer. In this manner, even a corrupt nymserver would only 
be able to discern that a particular nym was using remailer X as its 
first hop. The eventual destination would be encrypted with the other 
remailer's key.  In order to compromise your nym, an attacker would need 
to compromise not only the nym server, but also all of the other 
remailers in your chain.

Persons sending mail to your nym should also use a chain of remailer's, 
if you are concerned that the nym server is interested in who is sending 
mail to which nym.

It may be helpful to have a seperate public/private PGP keypair for your 
nym, which is available for those wishing to send mail to your nym. 
Encrypting all trafic across the nymserver would protect the contents 
from eavesdropping, even if the nymserver has been compromised.




Ciao..






From tcmay at got.net  Sat Jun 29 16:40:43 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 30 Jun 1996 07:40:43 +0800
Subject: fbi botches intel "ecspionage" case
Message-ID: <adfae81f08021004f81e@[205.199.118.202]>


At 7:25 PM 6/29/96, Larry Detweiler wrote:

>we already have a very good example where this has
>backfired. I was watching Nightline on Tues night or
>so in which there was info about how the FBI helped
>get an informant into Intel in a *very* sensitive
>position, where he was able to film the pentium chip
>plans. he said he sold them, as I recall,
>to iraq, syria, china, etc.

I didn't see this particular "Nightline," so I can't be certain this is the
same case I have been casually following for a couple of years. However, it
sounds like the case of the guy who spent a year at Intel, stole some
design tapes, went to work for AMD, offered them to AMD, had AMD refuse him
and report his offer to Intel (the chip companies are very cooperative in
these matters), and then proceeded on a bizarre course of offering the
tapes to various foreign nations.

A comedy of sorts, and his "damage" was essentially meaningless.

I don't recall _anything_ about him being planted by the FBI within Intel,
nor can I imagine any circumstances in which the FBI would try this. So
maybe I'm thinking of a different story.

>solve the problem. there was much lamentation over the
>fact the criminal in question only got about 33 months
>of prison time or something.
>
>the FBI emerged with great egg on their face. I would
>say if anyone wants to ridicule them for getting into
>covering "ecspionage" cases, this is a prime candidate
>case. is this what they are aiming for? heh, heh.

Well, the "33 months" sounds like the story I remember. Bear in mind that
the tapes he took were essentially useless. A comedy, as I said.

(He was down in Brazil, living with his parents, sending out press releases
on how he had sold the tapes to Cuba and other such countries. He
voluntarily returned to the U.S. to face charges, so it sure looks like he
wanted to get caught....a psychological case more than a national security
case.)

>somehow we have missed a good public debate about
>ecspionage in the country. there were a few NYT
>editorials, but it is clearly being used as a very
>major aspect of promoting the new post-cold-war spy
>and intelligence strategy without almost any notice
>by major analyists.

Larry, you must not have been subscribed during the months when we debated
this issue many times. There have also been numerous mentions of this since
at least 1990, when I recall discussions of a change in mission for the
NSA.


>2. we have a tradition of separation of church and state in
>this country, and also separation of the public government
>and private industry. suddenly we have the FBI saying they
>want to infiltrate companies to deal with economic espionage.
>well, these companies have their own policy, and what do
>they gain by having a government agency working inside them?
>in the above case I note, it led to exactly the *opposite*
>of what was intended: the theft of *highly*sensitive* plans
>by an FBI mole.

In the case I described, involving Intel and Pentium plans and a recent
prison sentence, this was not the case. The FBI did not plant the thief.


>if someone else can give more info on this case (apparently
>a book is coming out about it or something) including the
>guy's name, I'd appreciate it, I didn't take any notes so
>this is a bit fuzzy.

I'm sure an Alta Vista search would turn up this story. I don't plan to do
it, though. I'm relatively certain the "Nightline" piece you cite is
related to the case I've described. Whether "Nightline" got its wires
crossed, or Larry did, is unknown to me.

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From tcmay at got.net  Sat Jun 29 16:42:13 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 30 Jun 1996 07:42:13 +0800
Subject: The Net and Terrorism
Message-ID: <adfaddeb070210049285@[205.199.118.202]>



There have been many recent reports linking the Net and anonymous
remailers, pseudonyms, and (of course) strong crypto to various possible
and actual terrorist events, with an emphasis on the "possible." (If the
Net is linked to _actual_ terrorist incidents, little is being disclosed
publically as of yet.)

Recent comments by John Deutch, William Perry, and Louis Freeh make
reference to the growing danger of the Net. And the "Russian mafia" is
playing a major role in this debate; I won't recap the various articles in
major magazines about arms sales from the former Soviet Army, the reports
that an entire paramilitary unit of the KGB is now working for the Russian
mafia, and the obvious corruption of the entire former Soviet system (I'm
not saying it wasn't corrupt before, just that now the paymasters have
changed).

Can anything be done? To stop the likely effects of lots more
surface-to-air missiles, lots more nerve gas available on the black market,
and so on?

In a word, "no."

I've been thinking about this a lot, reading the various articles, and
pondering the implications. The plain fact is that the modern world is one
of great "liquidity," and the vast amount of arms built up by the U.S.S.R.
(thanks in large part to responding to a similar build-up in the U.S.,
without taking any sides...) are now "leaking out" in increasing numbers.

(The leakage is quite similar to that seen in the 1975-79 period, when
thousands of tons of armaments abandoned by the U.S. in Viet Nam were sold
around the world. Except, of course, that the the Soviet weapons include
some interesting new things.)

Not even a police state can stop armaments from being diverted in
situations such as faced in the former U.S.S.R. (For those not familiar
with the conditions, read up on it. The combination of former command
economy, secret police, selling off of industry to highest bidders, lack of
a conventional industrial base...all of this makes it nearly unavoidable
that much of the former state industry is now controlled by black
marketeers and former Party apparatchniks....after all, who else would have
the money to buy these former State industries?)

In fact, a former police state does not change its stripes. The names and
paymasters change a bit, but the organism lives on. (One need only look at
the police states of Central and South America and their platitudes about
the "Drug War" to understand the realities of such markets.)

Unbreakable crypto will of course be used. This is unsurprising.

A few airliners will shot down by Soviet surface-to-air missiles. This is
unsurprising.

I expect a city or two to get nuked in the next decade or so. (Haifa or Tel
Aviv would be my leading candidates.) To me, this is unsurprising.

My personal solution dovetails with other perceived threat responses: avoid
living in or near major cities and take reasonable measures to cope with
moderate economic or physical crises. (No, I am not a "survivalist," just
mentally and physically prepared to deal with a major earthquake, economic
dislocation, or terrorist incident in San Jose, which is 30 miles north of
me.)

FBI Director Louis Freeh and the TLA spooks are already sounding the alarm
about the "Four Horsemen." Sen. Sam Nunn is calling for measures to ensure
that cyberspace is "secured" and that the Net is not used to further
chemical and biological terrorism.

The point is that even a police state cannot stop the consequences of the
increased "degrees of freedom" the modern world (and the Net) provides. In
fact, police states tend to make the scale of the corruption even greater,
as the Soviet and Latin American examples show. (I could of course get into
the examples of arms dealings in Iran-Contra, the CIA's role in covert arms
supply, etc., but this should be self-evident to all.)

An Australian radio journalist asked me if the Net could make possible new
types of terrorism, and could allow terrorists to plot crimes in new ways.
He seemed surprised when I said "Of course" and then proceeded to give some
examples of how the Net can be used to undermine governments (what those
governments of course refer to as "terrorism," even when it is mostly not).

I'm not advocating such "terrorism," by the way, merely telling it like it is.

Arguing that the Net cannot and will not be used in such ways is naive and
ultimately counterproductive. It is more accurate and useful to point out
that the increased role of terrorism is due to many factors, including
prominently the vast amount of armaments in the world, the role of police
states which have benefitted from these build-ups in the
military-industrial complex, the expansion of "virtual communities" around
the world, and, crucially, the expanded number of degrees of freedom in
transportation, communication, banking, and other such Information Age
channels.

Keep your head down, avoid crowded downtown areas, prepare for moderate
disruptions, and reject arguments that an American Police State will do
anything to stop terrorism.

(Remember, terrorism is just warfare carried on by other means, with
apolgies to Von Clausewitz.)

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From wsj-announce at interactive.wsj.com  Sat Jun 29 17:09:15 1996
From: wsj-announce at interactive.wsj.com (The Wall Street Journal Interactive Edition)
Date: Sun, 30 Jun 1996 08:09:15 +0800
Subject: Important News from The Wall Street Journal Interactive Edition
Message-ID: <v02130503adfa48d0a6e4@[143.131.186.21]>


Dear Wall Street Journal reader:

If you haven't visited the Money & Investing Update in a while, we wanted to
let you know we've made some dramatic changes.  On April 29, we became The
Wall Street Journal Interactive Edition (http://wsj.com).

That means we've expanded, to bring you the entire spectrum of business
coverage provided by The Wall Street Journal. You'll see not only our
pioneering, continually updated coverage of the markets, but all the most
important stories in technology, marketing, the law--even sports and weather.

We've also added new features we hope make the Interactive Edition even more
useful, such as Personal Journal, which enables you to create your own
personalized view of today's news, and the ability to build and monitor your
own personal stock portfolio.

As a trial subscriber to Money & Investing Update, we are eager to have you
try the Interactive Edition.  So, your User Name and Password for the Update
are valid for the Interactive Edition as well.  Plus, as a special thank you
for your early support, your access to the Interactive Edition WILL CONTINUE
TO BE FREE THROUGH AUGUST 31, 1996, after which time a very modest
subscription fee will be required to continue.

But remember, NO CREDIT CARD OR OTHER PAYMENT INFORMATION is required until
after August 31, and ONLY THEN if you decide you want to join us as a paid
subscriber.  Until then, read the Interactive Edition as often as you like
at no charge.

To see the Interactive Edition, you can jump directly to the front page at
http://wsj.com/edition/current/summaries/front.htm, or take a brief tour of
the most interesting new features at http://wsj.com/tour.htm.

We look forward to hearing your reactions to our interactive efforts, since
the comments of readers like you have already played a powerful role in
shaping our future.  Please write us at the address below with any questions
or comments.

Neil Budde
Editor
The Wall Street Journal Interactive Edition
info at interactive.wsj.com

P.S.  If you experienced difficulty accessing the Interactive Edition during
our first few weeks, we apologize.  Reader interest completely exceeded our
expectations.  However, we've made a number of major system improvements
since then and we encourage you to come back and try again.

--------------------------------------------

If you don't want to receive future mail from the WSJ-ANNOUNCE list, simply
reply to this message with UNSUBSCRIBE WSJ-ANNOUNCE3 in the message body.





From jimbell at pacifier.com  Sat Jun 29 18:23:50 1996
From: jimbell at pacifier.com (jim bell)
Date: Sun, 30 Jun 1996 09:23:50 +0800
Subject: crypto and bagpipes [NOISE]
Message-ID: <199606292214.PAA15653@mail.pacifier.com>


At 01:01 PM 6/29/96 -0700, Michael Myers wrote:
>>Perry E. Metzger wrote:
>>| vinnie moscaritolo writes:
>>| > >>>Mr Brooks, the piper, 
>             (...)
>>| > >>>claims he wasn't playing a musical
>>| > >>>instrument, but practising with a weapon!
>>| > >>>
>>| > >>>The imagination boggles if his claim is successful!
>>| 
>>| No one who has heard sustained bagpipe playing can deny the fact that
>>| bagpipes are indeed an instrument of war, with no legitimate place in
>>| peaceful everyday society.
>>| 
>>| Perry
>
>Of course...when bagpipes are outlawed...

Do you mean the FULL-AUTO "Assault Bagpipes," the ones that produce more 
than one "toot" per blow?  Or the more "responsible" (but still dangerous!) 
semi-auto bagpipes, where you have to blow each time you want a toot.
Jim Bell
jimbell at pacifier.com





From janimmo at ionet.net  Sat Jun 29 18:49:13 1996
From: janimmo at ionet.net (Jeffrey A Nimmo)
Date: Sun, 30 Jun 1996 09:49:13 +0800
Subject: anonymous mailing lists
In-Reply-To: <199606291634.JAA28291@jobe.shell.portal.com>
Message-ID: <Pine.SOL.3.91.960629165335.10952B-100000@ion1.ionet.net>




On Sat, 29 Jun 1996, Hal wrote:

> Since the PGP is run on private computers, and only at mail-reading time,
> there should be no problem entering the conventional encryption
> passphrase and checking to see whether the messages decrypt.  Actually
> PGP puts a pattern at the beginning of the encrypted portion, so
> successful decryption can be checked very quickly, without much of a
> computational load.

OK, so now I'm downloading twenty times as much anonymous mail (the original
scenario called for a 20:1 increase). Suppose for a minute that I'm doing
something really silly, like subscribing to cypherpunks through a nym (as 
some do). Now, instead of an average of sixty messages a day, I'm getting 
twelve hundred. I think my ISP might have something to say about that.

Also, who on earth would be willing to even double the load on his server 
in order to enact this? I doubt that Mr. Parekh or anyone else would do it.

Can anyone do the math as to what the quotient would have to be in order to
defy traffic analysis? It seems to me that even twenty to one would fool 
a determined attacker only for a while. After all, we're not talking 
about a very large pool. Presumably only those individuals who had a nym
on a particular server would be chosen for this mail blind.






From jimbell at pacifier.com  Sat Jun 29 19:31:55 1996
From: jimbell at pacifier.com (jim bell)
Date: Sun, 30 Jun 1996 10:31:55 +0800
Subject: fbi botches intel "ecspionage" case
Message-ID: <199606292217.PAA15773@mail.pacifier.com>


At 12:25 PM 6/29/96 -0700, Vladimir Z. Nuri wrote:
>
>"economic espionage" (ecspionage?) is in full swing as being 
>promoted as the new bogeyman to justify spending billions of
>dollars to our intelligence agencies, both military and
>the FBI.
>we already have a very good example where this has
>backfired. I was watching Nightline on Tues night or
>so in which there was info about how the FBI helped
>get an informant into Intel in a *very* sensitive
>position, where he was able to film the pentium chip
>plans. he said he sold them, as I recall,
>to iraq, syria, china, etc.
[snip]
>I was thinking about all the objections I had to the
>FBI ecspionage treatment that were never raised on the
>program:

>1. there was an implicit assumption that merely having
>the plans to the chip would allow other countries to somehow
>slaughter us in economic competition. but INTEL has spent
>billions of dollars on physical infrastructure without which
>the plans are virtually useless. it would take other countries
>years to get the kind of equipment necessary to produce the
>pentium, by which it might actually be yesterday's technology
>that no one cares about any more.

It's worse than this.  I can recall talk of a big problem WITHIN INTEL 
trying to tranfer the process to produce a part between (as I recall) two 
Intel semiconductor fabs,  Fab IV and Fab V, which are buildings only a 
couple hundred feet apart!  And obviously, this was done with the full 
cooperation of everyone within Intel, and did not require the interfacing 
with any other company.  The idea that you can just steal the "plans" for a 
chip and build it yourself is crazy.

>2. we have a tradition of separation of church and state in
>this country, and also separation of the public government
>and private industry. suddenly we have the FBI saying they
>want to infiltrate companies to deal with economic espionage.
>well, these companies have their own policy, and what do
>they gain by having a government agency working inside them?
>in the above case I note, it led to exactly the *opposite*
>of what was intended: the theft of *highly*sensitive* plans
>by an FBI mole.

I was even more disgusted with the FBI:  I kept hearing them claim, "We did 
not authorize him to break the law."   Huh?!?  Maybe they didn't, this time, 
but does this mean, implicitly, that this country has sunk so low that the 
FBI thinks it has the legal authority to "authorize" somebody to break the 
law?????


Jim Bell
jimbell at pacifier.com





From vznuri at netcom.com  Sat Jun 29 20:23:32 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Sun, 30 Jun 1996 11:23:32 +0800
Subject: fbi botches intel "ecspionage" case
In-Reply-To: <199606292217.PAA15773@mail.pacifier.com>
Message-ID: <199606292231.PAA24242@netcom9.netcom.com>



> I can recall talk of a big problem WITHIN INTEL 
>trying to tranfer the process to produce a part between (as I recall) two 
>Intel semiconductor fabs,  Fab IV and Fab V, which are buildings only a 
>couple hundred feet apart!  And obviously, this was done with the full 
>cooperation of everyone within Intel, and did not require the interfacing 
>with any other company.  The idea that you can just steal the "plans" for a 
>chip and build it yourself is crazy.

I don't quite understand your point. are you saying that a chip is
far more than merely plans? that I totally agree with.  a chip is
built by a massive army of highly intelligent people and highly
specialized equipment. I would wager that a very large part of
pentium technology is in their fabrication equipment. it would take
truckloads of files to describe all the equipment, and even
then you wouldn't necesarily be able to build it: you need the
geniuses who wrote the papers  in the first place to pull it off.

hence, one of my big criticisms of the concept of "intellectual
property": does it really exist?!?! is it in fact an oxymoron?
(don't tell the fbi!!! they'll get that weepy look that little kids
get when you tell them santa claus doesn't exist, hehehehe)

>I was even more disgusted with the FBI:  I kept hearing them claim, "We did 
>not authorize him to break the law."   Huh?!?  Maybe they didn't, this time, 
>but does this mean, implicitly, that this country has sunk so low that the 
>FBI thinks it has the legal authority to "authorize" somebody to break the 
>law?????

actually I smell something really bad here. the reporter for nightline
seemed kind of stupid to me. he kept talking about how Intel had
not gotten any warning that the employee had a criminal record and
had been involved in espionage in the past.

that was LUDICROUS. didn't he understand what was going on here? the
FBI was using this person as an INFORMANT and SPY and therefore probably did
the exact OPPOSITE: tried to use whatever leverage they could to get
him into a sensitive position where he would be USEFUL. and they
succeeded!! I find this a highly plausible scenario that they are probably
still trying to suppress.  I doubt the full truth on the matter is out
yet and a lot of people are doing the CYA thing in both Intel and
the FBI over this thing.

hence, I suspect the FBI was directly responsible for getting him
into a sensitive position where he could do damage. at least, that's
exactly what they'd be encouraging him to do. however he didn't seem
to present any evidence of that. there was some kind of finagling that
the fbi did to get him his job.

what is possible is that the FBI has *other* informants and spies working
in Intel that helped get the guy his job, and they would be "rooted out" 
if the whole story came to light. the FBI cooks up some story that makes
him look like a lone madman that went loose on his own.









From vznuri at netcom.com  Sat Jun 29 20:56:03 1996
From: vznuri at netcom.com (Vladimir Z. Nuri)
Date: Sun, 30 Jun 1996 11:56:03 +0800
Subject: fbi botches intel "ecspionage" case
In-Reply-To: <adfae81f08021004f81e@[205.199.118.202]>
Message-ID: <199606292247.PAA25329@netcom9.netcom.com>



TCM
>I didn't see this particular "Nightline," so I can't be certain this is the
>same case I have been casually following for a couple of years. However, it
>sounds like the case of the guy who spent a year at Intel, stole some
>design tapes, went to work for AMD, offered them to AMD, had AMD refuse him
>and report his offer to Intel (the chip companies are very cooperative in
>these matters), and then proceeded on a bizarre course of offering the
>tapes to various foreign nations.

that's the guy.

>A comedy of sorts, and his "damage" was essentially meaningless.

the nightline segment certainly failed to convey that concept, but it
was what I raised in my post. in fact
it was all virtually touted as a great reason for new stringent intellectual
property laws by the reporter. "the fbi's hands are tied" he might have
even said.

>I don't recall _anything_ about him being planted by the FBI within Intel,
>nor can I imagine any circumstances in which the FBI would try this. So
>maybe I'm thinking of a different story.

probably the same one based on new elements that have just been discovered.
I missed the first half of the show but I think it was based on a new
book.

>Larry, you must not have been subscribed during the months when we debated
>this issue many times. There have also been numerous mentions of this since
>at least 1990, when I recall discussions of a change in mission for the
>NSA.

Klaus, I have seen many debates on this list and weren't what I was
talking about. this list has very little influence on public policy
as you might imagine <g>  ok, I will get flamed for that, but frankly
the public perception of cypherpunks is as a bunch of anarchists.

I mean public opinion pieces in newspapers, policy
journals, the washington talking-heads circuit like "meet the press",
etc-- but we will probably be getting that soon. except the topic
will be "what do we do about evil infoterrorists", instead of
"are evil infoterrorists a real problem". "does intellectual
property really exist, and if so what is it"  "do we actually need
new laws to create a new class of infocriminals"

>In the case I described, involving Intel and Pentium plans and a recent
>prison sentence, this was not the case. The FBI did not plant the thief.

sure sounds similar though. the guy on nightline went to brazil. maybe
that's all some juicy new info that you haven't gotten yet through 
any of your "blacknet" sources. heh heh. not too often I scoop the
ILF. <g>

>I'm sure an Alta Vista search would turn up this story. I don't plan to do
>it, though. I'm relatively certain the "Nightline" piece you cite is
>related to the case I've described. Whether "Nightline" got its wires
>crossed, or Larry did, is unknown to me.

yeah, I don't know what I'm talking about, Klaus (speaking of crossing
wires, my name is Vladimir, Vlad for short). don't understand your
fetish of calling people different names, does that have something
to do with that crypty-anarchy stuff or something? just curious.








From snow at smoke.suba.com  Sat Jun 29 21:58:05 1996
From: snow at smoke.suba.com (snow)
Date: Sun, 30 Jun 1996 12:58:05 +0800
Subject: fbi botches intel "ecspionage" case
In-Reply-To: <199606291925.MAA12512@netcom3.netcom.com>
Message-ID: <Pine.LNX.3.93.960629170534.299B-100000@smoke.suba.com>


On Sat, 29 Jun 1996, Vladimir Z. Nuri wrote:

> 2. we have a tradition of separation of church and state in
> this country, and also separation of the public government
> and private industry. suddenly we have the FBI saying they

	Since when? We should, but we don't. The bigger the business, the
more likely it is to be in bed with the government.

> want to infiltrate companies to deal with economic espionage.
> well, these companies have their own policy, and what do
> they gain by having a government agency working inside them?

	It doesn't cost them anything. They are absolved from legal
problems etc.

> 3. hence, one wonders if the FBI could do a better job of
> combating ecspionage than companies are already doing, or
> if they are just going to botch it as has already been 
> spectacularly proven in this case.

	Maybe the real point isn't to combat espionage, maybe the point is
to transfer technology from those that aren't sucking up to the government
to those that are. Just a thought from the paranoid front.
 

Petro, Christopher C.
petro at suba.com <prefered for any non-list stuff>
snow at crash.suba.com






From perry at piermont.com  Sat Jun 29 22:12:30 1996
From: perry at piermont.com (Perry E. Metzger)
Date: Sun, 30 Jun 1996 13:12:30 +0800
Subject: secure WWW on UNsecure servers
In-Reply-To: <v03007405adfa3dc7588f@[18.157.1.107]>
Message-ID: <199606292310.TAA12274@jekyll.piermont.com>



Joseph Sokol-Margolis writes:
> > How might one arrange for these encrypted web pages residing on an
> > (unsecure) server to get decrypted only at the client's machine?
> > This should work as transparently as possible for the user;
> > except possibly for a userid/password query it should look like a
> > normal web browsing session.  For now, we can assume that the
> > decrypted web pages contain only HTML and images in .gif format.
> 
> It seems like it could be done by writing a plug-in that passed the
> encrypted page to pgp (or had it internally) and used that to decrypt it.
> The plug-in could store  the pass-phrase locally and clear when the user
> disconnected.

The "Right Way" to do what was asked is to use S/HTTP. However,
Netscape, in their wisdom, has not implemented it.

Perry





From vanished at alpha.c2.org  Sat Jun 29 22:41:40 1996
From: vanished at alpha.c2.org (vanished at alpha.c2.org)
Date: Sun, 30 Jun 1996 13:41:40 +0800
Subject: Cookies anyone?
Message-ID: <199606292334.QAA20775@infinity.c2.org>


While rummaging around in my cookie jar, I found this message--along with some cookies.

:Netscape HTTP Cookie File
:# http://www.netscape.com/newsref/std/cookie_spec.html
:# This is a generated file!  Do not edit.

Rather than bring down my system by experimenting, I thought I'd ask the list, "What happens if I delete this file?" and "What happens if I delete (edit) the cookies?"

This may have been discussed before, but until now I never checked for cookies.

Thanks for your consideration of this matter.

Vanished  





From thecrow at iconn.net  Sat Jun 29 23:40:40 1996
From: thecrow at iconn.net (Jack Mott)
Date: Sun, 30 Jun 1996 14:40:40 +0800
Subject: Hardware RNG
Message-ID: <31D5D7CC.7E5C@iconn.net>


I just recently built a hardware RNG, I just wanted to see what you guys 
think of it, here is how it works:

	Got a geiger counter plugged into the game port
	Weak radioactive source next to it (dont worry wont fry you)
	Use a PRNG string to do create an RC4 S-box
	Cycle through the S-box in a tight loop, each time checking to 
see if the geiger counter got a hit, if it did, record that number in 
the S-box as our first byte, do this 100 times, and we have 100 random 
numbers.

	With my radioactive source and geiger settings, you can grab 100 
random numbers in about 8 seconds, and the S-box will make a complete 
cycle between 1000 and 350,000 times between geiger hits, depending on 
how long between hits.

any thoughts? It seems to work well, no basic stat analysis reveals any 
pattern, and physicists have backed me up on radioactive decay being 
'the great randomizer'.

seeya
-- 
thecrow at iconn.net
"It can't rain all the time"

RSA ENCRYPTION IN 3 LINES OF PERL
---------------------------------------------------------
#!/bin/perl -sp0777i<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<j]dsj
$/=unpack('H*',$_);$_=`echo 16dio\U$k"SK$/SM$n\EsN0p[lN*1
lK[d2%Sa2/d0$^Ixp"|dc`;s/\W//g;$_=pack('H*',/((..)*)$/)





From mpd at netcom.com  Sat Jun 29 23:51:33 1996
From: mpd at netcom.com (Mike Duvos)
Date: Sun, 30 Jun 1996 14:51:33 +0800
Subject: Cookies anyone?
In-Reply-To: <199606292334.QAA20775@infinity.c2.org>
Message-ID: <199606300159.SAA08486@netcom3.netcom.com>


A Nym Writes:

> While rummaging around in my cookie jar, I found this message--
> along with some cookies.
> 
> :Netscape HTTP Cookie File
> :# http://www.netscape.com/newsref/std/cookie_spec.html
> :# This is a generated file!  Do not edit.
> 
> Rather than bring down my system by experimenting, I thought I'd ask the list, "What happens if I delete this file?" and "What happens if I 
> delete (edit) the cookies?"
> 
> This may have been discussed before, but until now I never checked for 
> cookies.
> 
> Thanks for your consideration of this matter.

HTTP servers are permitted to store up to 4k bytes of information of their
choice on your machine, which is returned to them upon request the next
time you access their system.

This allows the servers to maintain a client state which persists 
across separate accesses.  

Nothing will happen if you delete the file, other than that servers
will not remember information they stored on the client side during
your previous visits.  If you edit the file, which is binary, you may
possibly mess it up and choke the software that uses it. 

There are some minor privacy implications for "Cookies", but they 
have been discussed on the list before.  

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     mpd at netcom.com     $    via Finger.                      $






From frantz at netcom.com  Sat Jun 29 23:56:26 1996
From: frantz at netcom.com (Bill Frantz)
Date: Sun, 30 Jun 1996 14:56:26 +0800
Subject: Crack for DOS
Message-ID: <199606300111.SAA23763@netcom7.netcom.com>


Bill Stewart wrote:
> Blowfish is new, so perhaps there are flaws that 10-20 years of analysis
> will find.  But it's pretty good - it's small, fast in software,
> and has an annoyingly slow key-schedule which makes it difficult to
> use brute-force crackers on.  It's got variable key lengths.

This comment about "annoyingly slow" key setup made me think of pipeline
hardware to set up the keys.  Now with blowfish, key setup requires running
the Blowfish algorithm 521 times in setting up the key, so the pipeline
will require 521 stages if you want a new key for every "real" decryption. 
Ignoring chip size restrictions, this pipeline will increase the chip real
estate by 521 which will have approximately the same economic effect on the
cost of cracks as extending the key by 9 bits.

For CBC cypher systems, brute force attacks will require at least two
decryptions (one for the initialization vector, and one for the first block
of the message).  however, these decryptions can take place in parallel
(for the first block of the message) so they do not change the above
argument.  However if the design calls for more than the first block, then
the pipeline can run slower and becomes a smaller portion of the cost of
the system.

Of course if you are using Blowfish with anywhere near its full 448 bit
key, brute force attacks are simply not practical.


-------------------------------------------------------------------------
Bill Frantz       | The Internet may fairly be | Periwinkle -- Consulting
(408)356-8506     | regarded as a never-ending | 16345 Englewood Ave.
frantz at netcom.com | worldwide conversation.    | Los Gatos, CA 95032, USA







From middleman at nym.jpunix.com  Sat Jun 29 23:56:41 1996
From: middleman at nym.jpunix.com (MiddleMan Remailer)
Date: Sun, 30 Jun 1996 14:56:41 +0800
Subject: New&Improved MiddleMan
Message-ID: <199606300240.VAA18027@alpha.jpunix.com>


Hello Everyone,

	Due to several requests, I have been working on an improved
middleman remailer. Actually it's quite simple. I was able to improve the
reliability and robustness of the remailer dramatically by changing
$config{"numshuf"} = 3; to $config{"numshuf"} = 2; in the .premailrc file
for the middleman remailer. Exhaustive testing demonstrated that no code
changes to middleman itself were required. The only variable that
demonstrated the most profound performance difference is shown above. I
invite others to test the remailer for reliability and report back to me.
If it works, I'll go public with it once again. Here is the public key for
middleman. Please note the slight name change from middle-man to
middleman. One less keystroke if you know what I mean. I invite your
comments.

middleman middleman at nym.jpunix.com d020c2e68f1861098812ffaadd6e8a7d 2.0.3

-----Begin Mix Key-----
d020c2e68f1861098812ffaadd6e8a7d
258
AAS/9+NieAH945N1PYtLzSxnhUxVrfPR/OIAcQDM
61v5WGfpgXAltjMRQ0PHaBibeuER2/JhF5uDh4tu
nypppGDshlrajeX/RuXMN38UPRMZPDKwNzP2oddB
l/nTy6rxcdRUclBfzzoERUUay9RSiScbpnfvcm3g
R2Qgv3taGiAf+wAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAQAB
-----End Mix Key-----

				middleman-admin at nym.jpunix.com






From usura at replay.com  Sat Jun 29 23:58:26 1996
From: usura at replay.com (Alex de Joode)
Date: Sun, 30 Jun 1996 14:58:26 +0800
Subject: anonymous mailing lists
Message-ID: <199606300249.EAA26246@basement.replay.com>


Hal sez:
: Wei Dai did some nice statistical analysis of this type of attack
: sometime a year or two ago.  Even with countermeasures such as you
: suggest, if they are not perfect, so some information leaks correlating
: incoming and outgoing messages, Wei showed that it was possible to
: deduce the owners of the nyms surprisingly quickly.

: The countermeasures do work - if you get and send exactly 50 pieces of
: 4K byte email every day, no matter what, then correlations don't exist
: - but they are expensive to do perfectly.  For now we have much worse
: weaknesses; none of the current return-address systems are really safe,
: other than posting encrypted mail to newsgroups (and even that may be a
: problem if they suspect who you are and are monitoring your computer
: link to see if you download certain messages).

Use ssh or any other link encryptor, or fetch the whole newsgroup using
uucp.

--

	-AJ-





From jya at pipeline.com  Sat Jun 29 23:59:22 1996
From: jya at pipeline.com (John Young)
Date: Sun, 30 Jun 1996 14:59:22 +0800
Subject: In From the Cold
Message-ID: <199606300203.CAA08970@pipe2.ny2.usa.pipeline.com>


   June 28 the NYT and Wash Post reported on a new report on 
   intelligence: 
 
      In From the Cold: The Report of the Twentieth Century 
      Fund Task Force on the Future of U.S. Intelligence. 
 
   This report supplements and differs somewhat from the three 
   released earlier this year by the Brown Commission, 
   Representative Combest's Committee and the Council on 
   Foreign Relations. It recommends greater emphasis on 
   economic intelligence and less on military support as well 
   as reduction of covert operations. Here's an excerpt from 
   the Foreword: 
 
      The Task Force discerned basic problems that merit far 
      greater attention. Foremost among them is the 
      intelligence community's increasing preoccupation with 
      military priorities since the Soviet Union's collapse, 
      which has coincided with a decline in the usefulness of 
      intelligence to civilian policymakers. To help strike a 
      more equitable balance between the military and civilian 
      needs of the government, the Task Force proposes 
      specific recommendations for strengthening what it 
      perceives to be four pervasive shortcomings: 1) the 
      atrophying analytic capabilities of the intelligence 
      community and U.S. foreign policy agencies; 2) the lack 
      of productive and effective interactions between the 
      intelligence community and civilian officials who make 
      foreign policy decisions; 3) a clandestine service whose 
      costs have too often exceeded its benefits; and 4) 
      poorly organized, unfocused, and often mediocre economic 
      intelligence efforts. 
 
   The full volume is 275 pages, composed of introductions,  
   the main 21-page report and three extensive and detailed 
   background papers of 248 pages. 
 
   The introductions and main report are at: 
 
      http://pwp.usa.pipeline.com/~jya/infrom.txt  (60 kb) 
 
   INF_rom 
 
   ---------- 
 
      In From The Cold: The Report of the Twentieth Century 
      Fund Task Force on the Future of U.S. Intelligence. 
 
      With Background papers by Allan E. Goodman, Gregory F. 
      Treverton and Philip Zelikow 
 
      The Twentieth Century Fund Press, New York, 1996. $5.95 
      ISBN 0-87078-392-0 
 
      To order by telephone: 1-800-552-5450 
 
 
 
 
 
 





From tridge at arvidsjaur.anu.edu.au  Sun Jun 30 00:01:44 1996
From: tridge at arvidsjaur.anu.edu.au (Andrew Tridgell)
Date: Sun, 30 Jun 1996 15:01:44 +0800
Subject: rsync and md4
In-Reply-To: <199606300025.UAA04020@darius.cris.com>
Message-ID: <96Jun30.110048+1000est.65037-6357+787@arvidsjaur.anu.edu.au>


> MD4 is the fastest hash I am aware of.  However, there has been some 
> successful attacks against two rounds of MD4.  Although this is not to 
> suggest that MD4 is insecure, MD5 almost as fast (~1.3 times slower) and 
> more secure.

I thought md5 was slower than that, but I'm only going by my
(addmitedly poor) memory of some comments in the tripwire docs. I'll
give it a go sometime.

One annoying think about the md4 implementation that I have is that on
little endian machines it byte reverses the words in the buffer its
hashing so I need to make a copy of the buffer each time. Is there a
version of md4 that doesn't do this?

Cheers, Andrew





From root at edmweb.com  Sun Jun 30 00:08:49 1996
From: root at edmweb.com (Steve Reid)
Date: Sun, 30 Jun 1996 15:08:49 +0800
Subject: rsync and md4
In-Reply-To: <96Jun30.105019+1000est.65036-6357+785@arvidsjaur.anu.edu.au>
Message-ID: <Pine.BSF.3.91.960629200514.626A-100000@bitbucket.edmweb.com>


> > MD4 is not strong- people can deliberately produce files with the same
> > hash in a matter of minutes. MD5 is secure for now, but it seems to be
> > gradually falling to cryptanalysis, and should be phased out of use before
> > it breaks. IMO the best hash algorithm is SHA1 (which is an updated
> > version of the original SHA). Do a web search for "FIPS PUB 180-1" for the
> > specs. 
> 
> Do you have references to the md4 collision stuff? The situation I
> have is a bit unusual so its just possible some of the results may
> apply. 

Sorry, I was actually thinking of two-pass Snerfu that can be collided in
a matter of minutes... I'm fairly certain that MD4 is collidable, but I
don't remember where I read that, and I'm not sure how much time it would
take.

I'm quite certain that MD4 will not collide by accident, so it would 
probably be okay for you.


=====================================================================
| Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/)    |
| Email: steve at edmweb.com   Home Page: http://www.edmweb.com/steve/ |
| PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 |
|          -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. --          |
===================================================================:)






From tridge at arvidsjaur.anu.edu.au  Sun Jun 30 00:10:34 1996
From: tridge at arvidsjaur.anu.edu.au (Andrew Tridgell)
Date: Sun, 30 Jun 1996 15:10:34 +0800
Subject: rsync and md4
In-Reply-To: <Pine.BSF.3.91.960629145318.187A-100000@bitbucket.edmweb.com>
Message-ID: <96Jun30.105019+1000est.65036-6357+785@arvidsjaur.anu.edu.au>


> The odds of a certain file having a certain hash are one in 2^128. But,
> the odds of any two files having the same hash (the "Birthday Attack") is
> just one in 2^64. 

The birthday paradox doesn't apply in my case I believe. Its not an
all-to-all comparison. One file is "given" by the user. I'm definately
not a crypto-expert, however, so I could be wrong.

> That's good, because MD4 collisions can be produced in a matter of
> minutes. But if you're not concerned about attacks, then MD4 is probably
> more than you need. 

I'd like to know more about this. 

> You could, but why bother? If you've got a 14.4 or faster modem, you can
> send a lot of hashes in a short time. The real load won't come until you
> try to download an altered file. 

You'd have to read the tech report on rsync. It does not download the
whole file when a checksum mismatch is found, that would be next to
useless. 

It effectively creates binary diffs of the two files, without direct
(local) access to both files. As far as I know this is a new type of
algorithm.

In practice the hashes and checksums dominate the data that is sent
over the link. They total about 1/30 of the total file size for the
default settings.

> MD4 is not strong- people can deliberately produce files with the same
> hash in a matter of minutes. MD5 is secure for now, but it seems to be
> gradually falling to cryptanalysis, and should be phased out of use before
> it breaks. IMO the best hash algorithm is SHA1 (which is an updated
> version of the original SHA). Do a web search for "FIPS PUB 180-1" for the
> specs. 

Do you have references to the md4 collision stuff? The situation I
have is a bit unusual so its just possible some of the results may
apply. 

> For what you're doing it sounds like you don't need a cryptographically
> secure hash function. If you're not concerned about people deliberately
> trying to defeat the system, then just use a 32-bit CRC.

It already uses a 16 bit hash as a first level filter and a 32 bit
"rolling checksum" as the 2nd level. The 2nd level fails about 25
times on a 25MB test file I've been using. The failure rate goes as
the square of the file length. When the 2nd level fails it is detected
by the md4 hash which has to be much stronger.

Cheers, Andrew





From prahe at ix.netcom.com  Sun Jun 30 00:30:23 1996
From: prahe at ix.netcom.com (Paul Rahe)
Date: Sun, 30 Jun 1996 15:30:23 +0800
Subject: (no subject)
Message-ID: <31D59C58.621A@ix.netcom.com>







From root at edmweb.com  Sun Jun 30 00:32:48 1996
From: root at edmweb.com (Steve Reid)
Date: Sun, 30 Jun 1996 15:32:48 +0800
Subject: arcfour
Message-ID: <Pine.BSF.3.91.960629210817.626B-100000@bitbucket.edmweb.com>


A few questions about RC4...

I understand that RC4 is like a one-time-pad, in that a key can not be
used more than once. What about adding a different salt to the key for
each encryption? Would that be sufficent, even if the salt (but not the
rest of the key) were known to an attacker? 

Is there any way to identify and weed out weak keys?

Does anyone have any sample data I can use to test an RC4 implementation?
A key and the first few bytes of the stream should be sufficent. 

Thanks...


=====================================================================
| Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/)    |
| Email: steve at edmweb.com   Home Page: http://www.edmweb.com/steve/ |
| PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 |
|          -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. --          |
===================================================================:)





From tcmay at got.net  Sun Jun 30 01:22:02 1996
From: tcmay at got.net (Timothy C. May)
Date: Sun, 30 Jun 1996 16:22:02 +0800
Subject: Hardware RNG
Message-ID: <adfb5d610a0210048597@[205.199.118.202]>


At 1:26 AM 6/30/96, Jack Mott wrote:
>I just recently built a hardware RNG, I just wanted to see what you guys
>think of it, here is how it works:
>
>        Got a geiger counter plugged into the game port

>any thoughts? It seems to work well, no basic stat analysis reveals any
>pattern, and physicists have backed me up on radioactive decay being
>'the great randomizer'.

First, have fun playing with it. Second, watch out for subtle statistical
biases.

While radioactive decay is unpredictable (so are a lot of things, by the
way), there are all kinds of biases that reduce the apparent entropy.
Detector "dead time" is a classic one (basically, the detector can't detect
counts during a post-pulse recovery time...probably not a problem at low
count rates, but an example of how subtle things can sneak in).

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay at got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Licensed Ontologist         | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."









From ericm at lne.com  Sun Jun 30 01:23:07 1996
From: ericm at lne.com (Eric Murray)
Date: Sun, 30 Jun 1996 16:23:07 +0800
Subject: [Fwd: Doubleclick]
Message-ID: <199606300526.WAA23105@slack.lne.com>




[Multiple forwards deleted]

[short-attention-span summary:  someone's using Netscape
cookies as a way to target-market browser users.  Since I
hate being targeted, I came up with a hack "fix" to prevent
it, see below]


> >Date:    Wed, 26 Jun 1996 19:42:00 -0700
> >From:    Scott Wyant <scott_wyant at loop.com>
> >Subject: COMMENT: Cookie dough
> >
> >(I originally posted this to a library science listserve, and was asked to
> >post it here.  I hope it is of some interest to ADV-HTML readers)
> >
> >This list has seen discussion about the little "cookie" that a Netscape
> >server hands to your browser.  Have you wondered how someone might use it to
> >make some money?
> >
> >Here's how.
> >(This will take a while, but I think it's worth it.)
> >
> >Using Find File, look for a file called cookie.txt (or MagicCookie if you
> >have a Mac machine).  Using a text editor, open the file and take a look.
> > If you've been doing any browsing, the odds are about 80/20 that you'll find
> >a cookie in there from someone called "doubleclick.net."
> >
> >If you're like me, you never went to a site called "doubleclick."  So how did
> >they give you a cookie?  After all, the idea of the cookie, according to the
> >specs published by Netscape, is to make a more efficient connection between
> >the server the delivers the cookie and the client machine which receives it.
> >But we have never connected to "doubleclick."
> >
> >Close MagicCookie, connect to the Internet, and jump to <www.doubleclick.net>
> > Read all about how they are going to make money giving us cookies we don't
> >know about, collecting data on all World Wide Web users, and delivering
> >targeted REAL TIME marketing based on our cookies and our profiles.
> >
> >Pay special attention to the information at:
> ><www.doubleclick.net/advertising/howads.htm>
> >
> >You'll see that the folks at "doubleclick" make the point that this entire
> >transaction (between their server and your machine) is "transparent to the
> >user."  In plain English, that means you'll never know what hit you.
> >
> >So what's happening is, subscribers to the doubleclick service put a "cookie
> >request" on their home page FOR THE DOUBLECLICK COOKIE.  When you hit such a
> >site, it requests the cookie and take a look to see who you are, and any
> >other information in your cookie file.  It then sends a request to
> >"doubleclick" with your ID, requesting all available marketing information
> >about you.  (They're very coy about where this information comes from, but it
> >seems clear that at least some of it comes from your record of hitting
> >"doubleclick" enabled sites.)  You then receive specially targetted marketing
> >banners from the site.  In other words, if Helmut Newton and I log on to
> >the same site at the exact same time, I'll see ads for wetsuits and
> >basketballs, and Helmut will see ads for cameras.
> >
> >If you log in to a "doubleclick" enabled site, and it sends a request for
> >your "doubleclick" cookie, and you don't have one, why each and every one of
> >those sites will hand you a "doubleclick" cookie.
> >
> >Neat, huh?  And you can bet they're going to be rolling in the cookie dough.
> >Me, I edit my cookie file each and every time I go to a new site.  (Despite
> >the dire warning at the top of the file, you can edit it with no adverse
> >consequences.)
> >
> >Oh, and one other thing.  If you edit your cookie file BEFORE you connect to
> >"doubleclick," and then jump around at the site, you'll notice that they
> >DON'T hand you a cookie.  I probed the site pretty carefully, checking the
> >MagiCookie file, and nothing happened.
> >
> >Until I closed Netscape.  The LAST thing the 'doubleclick" site did was....
> >You guesed it.  They handed me a cookie.  So much for making the
> >client-server negotiation more efficient.  (In fairness, that cookie may
> >have been in memory until I closed Netscape -- I can't tell for sure.)
> >Scott Wyant
> >Spinoza Ltd.
> >


My own experiments shows that simply removing the cookie file
(~/.netscape/cookies) works to "fix" this, as long as you don't
have old netscape config files lying about (then it pops a dialog
asking if you want to nuke the old config, and uses the old
cookies file).  Netscape (version 3.0b for Linux) doesn't
recreate the cookies file.  Of course this "fix" means
that I'm not able to take advantage of whatever cookies might
offer me, but since I can't control them and never see them
there's probably not a lot that they do that I'll miss.


I think that Netscape should add a configuration to the browser
so that paranoid privacy fanatics like me can disable cookies
or better yet control which ones that we'll accept.



-- 
Eric Murray  ericm at lne.com  ericm at motorcycle.com  http://www.lne.com/ericm
PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03  92 E8 AC E6 7E 27 29 AF





From jon at aggroup.com  Sun Jun 30 01:23:24 1996
From: jon at aggroup.com (Yanni)
Date: Sun, 30 Jun 1996 16:23:24 +0800
Subject: Cookies anyone?
Message-ID: <9606292209.AA49109@jon.clearink.com>


> Rather than bring down my system by experimenting, I thought I'd ask
> the list, "What happens if I delete this file?"

you loose any cool stuff that cool sites give you. we are using them
(along with searchArgs) for a client to allow a "buddie" to follow
you around the site....when you come back, the buddy tells you how long
you have been gone, etc...a really cool fun harmless application of
cookies that makes the user experience much more fun and personal...

> and "What happens if
> I delete (edit) the cookies?"

if you don't keep the format, navigator will probably remove that line
when it starts up.

if you keep the format, and have edited the cookie, the site on the
other end might not know what to do with the cookie when it gets it
again...(depends on how good the error checking, etc is...)

> This may have been discussed before, but until now I never checked
> for cookies.

either way, contrary to popular belief, cookies really aren't a
security risk because they don't contain any information that you
don't already know. if a site gives you a cookie with your password in
it ( especially in clear text ), then they (the cgi programmers) are
idiots and should be shot on the spot.

regards,

-jon

Jon (no h) S. Stevens        yanni at clearink.com
ClearInk WebMagus      http://www.clearink.com/
finger pgp at sparc.clearink.com for pgp pub key
We are hiring! Check out...
http://www.clearink.com/clearink/home/job.html





From jfricker at vertexgroup.com  Sun Jun 30 01:47:36 1996
From: jfricker at vertexgroup.com (John F. Fricker)
Date: Sun, 30 Jun 1996 16:47:36 +0800
Subject: Cookies anyone?
Message-ID: <2.2.32.19960630055331.00741f70@vertexgroup.com>


At 04:34 PM 6/29/96 -0700, vanished at alpha.c2.org wrote:
>While rummaging around in my cookie jar, I found this message--along with
some cookies.
>
>:Netscape HTTP Cookie File
>:# http://www.netscape.com/newsref/std/cookie_spec.html
>:# This is a generated file!  Do not edit.
>
>Rather than bring down my system by experimenting, I thought I'd ask the
list, "What happens if I delete this file?" and "What happens if I delete
(edit) the cookies?"
>
>This may have been discussed before, but until now I never checked for cookies.
>
>Thanks for your consideration of this matter.
>
>Vanished  
>


Delete it at will.

Cookies are small tidbits of information that server side CGI progs (and
client side JavaScript progs) have saved. Cookies are generally used to
identify web users when they return to a site. I've seen cookies named
"lastvisit", "userid", and so on. If pathfinder.com creates a cookie, it is
only visible to pathfinder.com (that's the theory anyway). 

Deleting the cookie.txt file will have no ill effects unless you are using
one of those "build yer own Start Pages" at MSN or wherever. Altering
cookies would send garbage down when the cookie is requested.

If you would rather that cookies (and crumb trails) not be allowed simply
delete any cookies present and make the nominal file read only.

John.






From jeremey at forequest.com  Sun Jun 30 02:43:10 1996
From: jeremey at forequest.com (Jeremey Barrett)
Date: Sun, 30 Jun 1996 17:43:10 +0800
Subject: Cookies anyone?
In-Reply-To: <199606292334.QAA20775@infinity.c2.org>
Message-ID: <Pine.BSI.3.93.960629232908.23436B-100000@descartes.forequest.com>


On Sat, 29 Jun 1996 vanished at alpha.c2.org wrote:

> While rummaging around in my cookie jar, I found this message--along with 
> some cookies.
> 
> :Netscape HTTP Cookie File
> :# http://www.netscape.com/newsref/std/cookie_spec.html
> :# This is a generated file!  Do not edit.
> 
> "What happens if I delete this file?" 

Nothing (other than the file getting deleted).

> "What happens if I delete (edit) the cookies?"

They get deleted/edited.

When I was testing some cookie stuff, I regularly deleted several cookies
manually while Netscape was running, with no ugliness resulting. Since
there is no way to delete them from Netscape itself, vi is about the
best option.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Jeremey Barrett
Senior Software Engineer			jeremey at forequest.com 
The ForeQuest Company       			http://www.forequest.com/

   "less is more."
		-- Mies van de Rohe.

   Ken Thompson has an automobile which he helped design.  Unlike most
   automobiles, it has neither speedometer, nor gas gage, nor any of the
   numerous idiot lights which plague the modern driver.  Rather, if the
   driver makes any mistake, a giant "?" lights up in the center of the
   dashboard.  "The experienced driver", he says, "will usually know
   what's wrong."

		-- 'fortune` output






From aba at dcs.ex.ac.uk  Sun Jun 30 04:45:46 1996
From: aba at dcs.ex.ac.uk (Adam Back)
Date: Sun, 30 Jun 1996 19:45:46 +0800
Subject: UK Crypto regs?
In-Reply-To: <Pine.SUN.3.91.960628170810.25672C-100000@tipper.oit.unc.edu>
Message-ID: <199606300840.JAA00124@server.test.net>



> Anybody got a trip report for the IEE meeting yesterday? I phoned the 
> IEE press office, but no-one there seemed to have any briefings, and 
> there didn't seem to be any coverage

Ross Anderson posted this report on sci.crypt:

Adam

======================================================================
From: rja14 at cl.cam.ac.uk (Ross Anderson)
Newsgroups: sci.crypt,alt.security,uk.telecom,alt.security.pgp
Subject: HMS Clipper - GCHQ bungling!
Date: 28 Jun 1996 12:20:19 GMT

I went to the meeting organised at the IEE yesterday on the UK
`Trusted Third Party' proposals. One of the speakers, Nigel Hickson of
the DTI, confirmed that escrowing of confidentiality keys would be
mandatory. He also claimed that an OECD expert group was working on
`global crypto guidelines', and made clear that the controls would
focus on small-to medium enterprises and individuals rather than on
large companies.

It was a most extraordinary meeting, and showed up GCHQ in a rather
poor light. The introductory talk was given by Andrew Saunders,
advertised as head of CESG (GCHQ's protection arm) since 1991 and a
GCHQ board member. He remarked that the debate on encryption had been
acrimonious, especially in the USA, but that now technology made
possible a compromise in the form of `Trusted Third Parties' which
would supply a key delivery service and a key recovery service for
both users and law enforcement authorities.

I asked him whether his department had advised ministers that it was
all right to release the April report on encryption in the NHS network
(which floated the TTP idea), or had at least had sight of it before
its release. He claimed to have no knowledge of whether his agency had 
seen it.

After a talk on the common criteria by Murray Donaldson of the
Ministry of Defence, Saunders left, and we were addressed by a man
introduced as Paul Fleury, head of the information systems security
group at the security service. He was claimed to have been with MI5
for 18 years, and in his current post for 5; and to head a team of 9
people responsible for the overall UK threat assessment (with
technical input from GCHQ), as well as for managing CRAMM and running
UNIRAS (the UK government equivalent of CERT).

Strangely enough for such a senior and responsible person, his name did
not appear on the programme, and in the list of participants he appears
only as `UNIRAS SPEAKER, Security Service, PO Box 5656, London EC1A 1AH'
(so now you know - but why did he turn up with slides that had his name
on them and yet not write his name in the attendance register?)

His talk contained little to surprise, with statistics on viruses, 
equipment thefts and hacking. He did mention that 98% of the 873 hacking 
incidents in 1994/5 were abuse of access by insiders rather than 
external attack.

The third talk was by Elizabeth France, the Data Protection Registrar,
who expressed amusement at my having ironically referred to her (along
with the other speakers) as `one of the forces of darkness' when I
relayed notice of the meeting to the net. She proceeded to blaze with
light; she argued that the national security exemptions to data
protection law should be curtailed, and could see no reason why the
security service should not have to register along with everybody
else. She also pleaded for the wider use of privacy enhancing
technologies, such as the use of pseudonyms in medical databases.

Next was John Austen of the Yard, who pointed out that company
directors can get ten years' jail if one of their employees has
kiddieporn on a company server, since under the Children and Young
Persons Act simple possession is an offence. Then Bob Hill of the MoD
talked about the SOS-TDP project to provide security interfaces in
Microsoft, Novell and DEC products, linked with Northern Telecom's
`Enterprise Security Toolkit'; David Ferbrache of DRA talked about
security threats from the Internet; John Hughes of TIS about
firewalls; and Alex McIntosh of PCSL about how his company built a
crypto infrastructure for Shell and got government approval for it.

The threat model depicted in these talks was remote from reality. For
example, it was categorically stated that most thefts of PCs are for
the information in them, rather than the resale value of the machine
or its components. False - over 11% of UK general practitioners have
experienced theft of a practice PC, yet there is only one case known
to the BMA in which the information was abused.  Another example was
the numbers put on various threats: satellite TV hacking was said to
cost 300,000 pounds a year (according to News Datacom at Cardis 94,
that should be 200,000,000) while other risks were wildly inflated.

Bob Morris, the former NSA chief scientist, is fond of asking security
researchers, `Do you consider yourself to be more dishonest, or more
incompetent?' Well, does GCHQ know that the threat model presented at
their meeting is wrong, or don't they?

Anyway, Alex McIntosh's talk brought matters back to crypto policy
when he explained that following UK and US government approval of a 
corporate security architecture designed for Shell, Fortune 500 
companies would be trusted to manage their own keys. The explanation is
that they have so much to lose that they will be responsive to warrants 
and subpoenas. (The doctrine of equality of persons before the law was 
not, of course, mentioned.)

The final speaker was Nigel Hickson from the DTI. The excuse given for
his late arrival ws that he had been in France with the OECD and had
been discussing crypto policy for three days. He looked somewhat junior
but was said to co-chair the ITSEC scheme with CESG and to be one of a
group of five people in DTI responsible for information security policy.

In the introduction to his talk, he picked up on Alex's remarks about
Shell and stated that the motivation for the DTI's involvement was
that while `large firms will crack security', it would be an
inhibiting factor for small-to-medium firms and individuals, and would
prevent them participating in commerce on the Internet (this seemed to
clash with the policy announcement that corporate encryption would be
regulated but private would not be).

He then quite blatantly waffled until his time was almost up before
getting to the reason most people had come to the meeting, namely the
DTI announcement of its intent to regulate `Trusted Third Parties'. My
notes on his words are as follows:

 Why the UK announcement? Many reasons, some of which are highlighted in
 the public statement. The primary reason is that to secure electronic
 commerce people will need access to strong crypto, and if this is serious 
 then government will have to look at what systems are `appropriate'. The 
 UK government has spent a lot of time discussing the essential balance.
 Continued law enforcement access is required along the lines of the
 Interception of Communications Act. The government has `obviously' looked
 at TTPs and at `elements of key escrow'. There was no mention of national
 intelligence requirements.

 Policy framework for the provision of encryption services:

 1	No new controls on the use of encryption, such as types of
	algorithm. The introduction of trusted third parties will be
	on a voluntary basis;

 2	Licensing of TTPs will be on (a) competence (b) ability to
	provide a service (c) cooperation with government under 
	conditions of warranted interception;

 3	International working will be the essential vehicle to drive it
	- first in Europe and then in a wider field.

 Legislation later this year is possible. The EU is working on a `second
 infosec decision' to promote TTPs in Europe. The OECD expert group is
 working on global crypto guidelines.

By the time he had finished this short exposition, he had run over the 
advertised time of 4.15, eating well into the fifteen minutes that the 
programme had allocated for discussion. There were only a few questions:
Paul Leyland managed to ask whether it would be mandatory for 
confidentiality keys to be escrowed, and Hickson said yes.

Just as the questions were starting to flow, the chairman - advertised
as Mr DJ Robertson, Ministry of Defence - declared the meeting closed. I 
objected; I pointed out that there were plenty of people with questions, 
and that the government's attempts to sell their proposal would not be 
aided by such blatant news management, which would surely be reported. He 
said that we absolutely had to be out of the room by half past four - the 
time then - and overruled me, remarking that the Universities of Oxford 
and Cambridge had asked quite enough questions.

Then a large gentleman came up to me and said that he hoped my remark
about publicising their news management had been made in jest. I told him 
that it was not, and he became menacing. He said that the meeting was 
held under IEE rules and seemed taken aback when I stood my ground and 
told him I was a member. He then said that he was also a graduate of 
Cambridge and that he would write to very senior people in the University 
about me. Good luck to him. Although he wouldn't give me his name, his 
lapel badge said `B Buxton' and the attendance register lists a Bill 
Buxton, Parity Solutions Ltd., Wimbledon Bridge House, 1 Hartford Road, 
Wimbledon SW19 3RU.

After the meeting, we milled around, to the evident discomfiture of the 
man advertised as Robertson. Finally, at almost five o'clock, an IEE 
lady turned up while there were still a few of us in the corridor. He 
asked her to see us off the premises, at which she smiled and asked
whether we knew our way out. When I said yes, she said 'that's all right 
then' and went off. The man advertised as Robertson scuttled away without
meeting my eye.

As Bob would ask, incompetence or dishonesty? Well, I didn't get the 
impression that our spooks are even competent at being dishonest.

Ross Anderson





From jya at pipeline.com  Sun Jun 30 06:29:59 1996
From: jya at pipeline.com (John Young)
Date: Sun, 30 Jun 1996 21:29:59 +0800
Subject: UK Crypto regs?
Message-ID: <199606301058.KAA02005@pipe3.t2.usa.pipeline.com>


Adam, 
 
 
Thanks for forwarding that delightful report from Ross Anderson on the IEE
TTP romp. 
 
 
His grimly comical description of the hauty evasiveness of governmental
infosec turkeys fits the U.S. sessions on GAK. These power-drunk birds just
aren't used to answering to an aroused, sober, informed public on the
cluckers' no longer secretly enjoyed private stocks of
if-you-gnu-what-we-brew inebriants. 
 
 
Pray British rabble-rousers continue to grieve the red-nosed authorities as
have the colonials theirs. 
 
 
Is there more info on when the OECD report is due? 
 
 





From wb8foz at nrk.com  Sun Jun 30 08:13:02 1996
From: wb8foz at nrk.com (David Lesher)
Date: Sun, 30 Jun 1996 23:13:02 +0800
Subject: RNG
Message-ID: <199606301251.IAA00411@nrk.com>



> 
> I just recently built a hardware RNG, I just wanted to see what you guys 
> think of it, here is how it works:
> 
> 	Got a geiger counter plugged into the game port
> 	Weak radioactive source next to it (dont worry wont fry you)
> 	Use a PRNG string to do create an RC4 S-box
> 	Cycle through the S-box in a tight loop, each time checking to 
> see if the geiger counter got a hit, if it did, record that number in 
> the S-box as our first byte, do this 100 times, and we have 100 random 
> numbers.
> 


Tony Patti just gave the DC 'Punks a great talk on this topic.
He built a faster RNG he called RANGER -- it connects to the parallel
port. Plans for it are available in Cryptosystems Journal....


-- 
A host is a host from coast to coast.................wb8foz at nrk.com
& no one will talk to a host that's close........[v].(301) 56-LINUX
Unless the host (that isn't close).........................pob 1433
is busy, hung or dead....................................20915-1433





From perry at alpha.jpunix.com  Sun Jun 30 10:14:16 1996
From: perry at alpha.jpunix.com (John A. Perry)
Date: Mon, 1 Jul 1996 01:14:16 +0800
Subject: Updated type2.list/pubring.mix
Message-ID: <Pine.NEB.3.93.960630092316.238B-100000@alpha.jpunix.com>


-----BEGIN PGP SIGNED MESSAGE-----

	There is an updated type2.list/pubring.mix available on
jpunix.com. Of note is the new jam remailer and the return of middleman.
Welcome aboard! BTW you may have noticed that I've started sorting the
type2.list file. I think it looks nicer that way. The files are available
by WWW from www.jpunix.com as well as anonymous FTP from ftp.jpunix.com.
Please direct questions or suggestions to perry at alpha.jpunix.com.

 John Perry - perry at alpha.jpunix.com -  PGP-encrypted e-mail welcome!
 WWW - http://www.jpunix.com
 PGP 2.62 key for perry at jpunix.com is on the keyservers.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMdaO8lOTpEThrthvAQH4JQP9HYP+TbIZ8VO1v5lvRUfJfM0GDlakuCaN
WK1CWQyCY79QLUs9GAAIksim+VyvfS9g1pg7zrsmy5S4MgZRMAX5NkWTg/+BNqKk
M8LnDBAU2hSPNzjmNUiO9KhAgoein7z3Dy91ZOuaPGRNf6GhE0i8QjPTKKL81lzz
75+oY9rObEQ=
=oR/A
-----END PGP SIGNATURE-----