From peter at peterswire.net Thu Jul 1 02:52:11 2004 From: peter at peterswire.net (Peter Swire) Date: July 1, 2004 2:52:11 PM EDT Subject: [IP] more on E-mail intercept ruling - good grief!! Message-ID: Dave: On VOIP interception, there is a statutory and a constitutional issue. The statutory issue is whether VOIP is a "wire" communication (like a phone call) or an "electronic" communication (like an e-mail or web communication). The Councilman court said that "wire" communications are considered "intercepted" even if they are in temporary storage. The key holding of the case was that "electronic" communications are not "intercepted" if the wiretap takes place while the communication is in temporary storage. "Wire communication" is defined as "any aural transfer made in whole or in part through the use of facilities for the transmission of communications by the aid of wire, cable or other like connection between the point of origin and the point of reception." I do not know whether a court has ruled on whether VOIP counts as a "wire communication." Quick research just now suggests we don't have a case on that yet. I can see arguments either way, based in part on whether a packet-switched communication counts as "aural." Under Councilman, if VOIP is an "electronic communication", then the provider therefore could intercept the VOIP calls for the provider's own use without it counting as an "interception." Providers already can intercept communications with user consent or to protect the system, but this would be blanket permission to intercept communications. The constitutional question is whether users have a "reasonable expectation of privacy" in VOIP phone calls. Since the 1960's, the Supreme Court has found a 4th Amendment protection for voice phone calls. Meanwhile, it has found no constitutional protection for stored records. In an article coming out shortly from the Michigan Law Review, I show why VOIP calls quite possibly will be found NOT to have constitutional protection under the 4th Amendment. It would then be up to Congress to fix this, or else have the Supreme Court change its doctrine to provide more protections against future wiretaps. Article at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=490623 . Peter Prof. Peter P. Swire Moritz College of Law, Ohio State University John Glenn Scholar in Public Policy Research (240) 994-4142, www.peterswire.net -----Original Message----- From: owner-ip at v2.listbox.com [mailto:owner-ip at v2.listbox.com] On Behalf Of David Farber Sent: Thursday, July 01, 2004 12:12 PM To: Ip Subject: [IP] more on E-mail intercept ruling - good grief!! Begin forwarded message: From eugen at leitl.org Thu Jul 1 02:45:54 2004 From: eugen at leitl.org (Eugen Leitl) Date: Thu, 1 Jul 2004 11:45:54 +0200 Subject: Appeals Circuit Ruling: ISPs Can Read E-Mail (fwd from brian-slashdotnews@hyperreal.org) Message-ID: <20040701094554.GH12847@leitl.org> ----- Forwarded message from brian-slashdotnews at hyperreal.org ----- From ed at belove.com Thu Jul 1 12:50:19 2004 From: ed at belove.com (Ed Belove) Date: July 1, 2004 12:50:19 PM EDT Subject: [IP] E-mail intercept ruling - good grief!! Message-ID: But Councilman argued that no violation of the Wiretap Act had occurred because the e-mails were copied while in "electronic storage" -- the messages were in the process of being routed through a network of servers to recipients. A scary thought: does this mean that VOIP packets can be copied from routers (by ISPs or anyone else) while they are "stored"? ------------------------------------- You are subscribed as peter at peterswire.net To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ------------------------------------- You are subscribed as eugen at leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From measl at mfn.org Thu Jul 1 19:58:06 2004 From: measl at mfn.org (J.A. Terranson) Date: Thu, 1 Jul 2004 21:58:06 -0500 (CDT) Subject: [Full-Disclosure] Presidential Candidates' Websites Vulnerable (fwd) Message-ID: <20040701215747.H159@ubzr.zsa.bet> Submitted for comment :-) -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden ---------- Forwarded message ---------- Date: Thu, 1 Jul 2004 18:47:55 -0700 From: Kurt Seifried To: Barry Fitzgerald , Frank Knobbe Cc: Jordan Klein , full-disclosure at lists.netsys.com Subject: Re: [Full-Disclosure] Presidential Candidates' Websites Vulnerable It is of interest to note we just had our federal election here in Canada a few days ago. I went to the polls, they checked my name, gave me a paper ballot, I took it to the booth, made my "X" (within the circle using the pencil provided), folded the ballot as indicated and handed it to them. They tore a small black strip off the ballot and put the ballot in the box. The collection of small black strips is used to ensure the ballots in the box have a second verification mechanism (i.e. if you remove or add ballot to a ballot box it would show up in the tally of ballots vs. ballot strips). The count was done relatively quickly and by midnight or so we knew who had won (polls closed at 8:30pm or so in most places). Personally I hope we NEVER use anything more sophisticated then this for federal elections in Canada. I simply don't see how an electronic system SIGNIFICANTLY improves on this time tested and simple method. Widespread fraud is quite difficult in our system, requiring coercion of numerous people, or of the people at the polling stations (and of course you'd have to deal with the scrutineers from opposing parties, perhaps with a sharp blow to the head). I have read some proposals for electronic systems, to make them truly anonymous, and verifiable, and tamper resistant you need an extremely complicated amount of math and crypto, as well as technological deployment. I just don't think it's ready yet, and I am not sure it will be for many years. Kurt Seifried, kurt at seifried.org A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html From brian-slashdotnews at hyperreal.org Fri Jul 2 00:26:02 2004 From: brian-slashdotnews at hyperreal.org (brian-slashdotnews at hyperreal.org) Date: 2 Jul 2004 07:26:02 -0000 Subject: Free Certificate Authority Unveiled by Aussies Message-ID: Link: http://slashdot.org/article.pl?sid=04/07/02/0116236 Posted by: CowboyNeal, on 2004-07-02 04:21:00 Topic: privacy, 124 comments from the good-things-from-down-under dept. [1]SonOfGates writes "Well, the Aussies have invaded Boston but at least they're not throwing tea into the harbor. AU-based nonprofit [2]CAcert Inc has spent the last few days at [3]USENIX '04 registering new users by the truckload. They bill themselves as a 'Community-Based CA.' Could this be the begining of a true 'open' certificate authority? See the [4]O'Reilly story and [5]press release." IFRAME: [6]pos6 References 1. http://www.cacert.org/ 2. http://www.cacert.org/ 3. http://www.usenix.org/ 4. http://www.onlamp.com/pub/wlg/5142 5. http://www.cacert.org/media/boston1.pdf 6. http://ads.osdn.com/?ad_id=2936&alloc_id=8587&site_id=1&request_id=2048979 ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From dave at farber.net Fri Jul 2 06:07:14 2004 From: dave at farber.net (David Farber) Date: Fri, 2 Jul 2004 09:07:14 -0400 Subject: [IP] more on more on E-mail intercept ruling - good grief!! Message-ID: Begin forwarded message: From eugen at leitl.org Fri Jul 2 02:51:23 2004 From: eugen at leitl.org (Eugen Leitl) Date: Fri, 2 Jul 2004 11:51:23 +0200 Subject: Free Certificate Authority Unveiled by Aussies (fwd from brian-slashdotnews@hyperreal.org) Message-ID: <20040702095123.GH12847@leitl.org> ----- Forwarded message from brian-slashdotnews at hyperreal.org ----- From roy at rant-central.com Fri Jul 2 10:50:33 2004 From: roy at rant-central.com (Roy M. Silvernail) Date: Fri, 02 Jul 2004 13:50:33 -0400 Subject: [IP] more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) In-Reply-To: <20040702155908.GX12847@leitl.org> References: <20040702155908.GX12847@leitl.org> Message-ID: <40E5A069.5040007@rant-central.com> Eugen Leitl forwarded: > The constitutional question is whether users have a "reasonable >expectation of privacy" in VOIP phone calls. Since the 1960's, the >Supreme Court has found a 4th Amendment protection for voice phone >calls. Meanwhile, it has found no constitutional protection for stored >records. In an article coming out shortly from the Michigan Law Review, >I show why VOIP calls quite possibly will be found NOT to have >constitutional protection under the 4th Amendment. It would then be up >to Congress to fix this, or else have the Supreme Court change its >doctrine to provide more protections against future wiretaps. Article >at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=490623 . > > Call me cynical (no... go ahead), but if VOIP is found to have no 4th Amendment protection, Congress would first have to agree that this *is* a problem before thay could "fix" it. Given the recent track record of legislators vs. privacy, I'm not at all confident Congress would recognize the flaw, much less legislate to extend 4th Amendment protection. After all, arent more and more POTS long-distance calls being routed over IP? The only difference, really, is the point at which audio is fed to the codec. If the codec is in the central office, it's a "voice" call. If it's in the handset or local computer, it's VOIP. I think we can count on the Ashcroftians to eventually notice this and pounce upon the opportunity. And as for the SCOTUS, all they have to do is sit back on a strict interpretation and such intercepts aren't "wiretaps" at all. -- Roy M. Silvernail is roy at rant-central.com, and you're not "It's just this little chromium switch, here." - TFS SpamAssassin->procmail->/dev/null->bliss http://www.rant-central.com From sunder at sunder.net Fri Jul 2 11:31:22 2004 From: sunder at sunder.net (Sunder) Date: Fri, 2 Jul 2004 14:31:22 -0400 (edt) Subject: [IP] more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) In-Reply-To: <40E5A069.5040007@rant-central.com> References: <20040702155908.GX12847@leitl.org> <40E5A069.5040007@rant-central.com> Message-ID: On Fri, 2 Jul 2004, Roy M. Silvernail wrote: > Call me cynical (no... go ahead), but if VOIP is found to have no 4th > Amendment protection, Congress would first have to agree that this *is* > a problem before thay could "fix" it. Given the recent track record of > legislators vs. privacy, I'm not at all confident Congress would > recognize the flaw, much less legislate to extend 4th Amendment > protection. After all, arent more and more POTS long-distance calls > being routed over IP? The only difference, really, is the point at > which audio is fed to the codec. If the codec is in the central office, > it's a "voice" call. If it's in the handset or local computer, it's > VOIP. I think we can count on the Ashcroftians to eventually notice > this and pounce upon the opportunity. And as for the SCOTUS, all they > have to do is sit back on a strict interpretation and such intercepts > aren't "wiretaps" at all. If VOIP gets no protection, then you'll see a lot of "digital" bugs in various spy shops again - and they'll all of a sudden be legal. I thought the Feds busted lots of people for selling bugging equipment, etc. because they're an invasion of privacy, etc. Ditto for devices that intercept digital cellular phone conversations, spyware software that turns on the microphone in your computer and sends the bits out over the internet, ditto for tempest'ing equipment ("But your honor, it's stored for 1/60th of a second in the phosphor! It's a storage medium!"), etc. Hey, they can't have their cake and eat it too. It's either protected or it isn't. From roy at rant-central.com Fri Jul 2 12:41:07 2004 From: roy at rant-central.com (Roy M. Silvernail) Date: Fri, 02 Jul 2004 15:41:07 -0400 Subject: [IP] more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) In-Reply-To: References: <20040702155908.GX12847@leitl.org> <40E5A069.5040007@rant-central.com> Message-ID: <40E5BA53.9070904@rant-central.com> Sunder wrote: >On Fri, 2 Jul 2004, Roy M. Silvernail wrote: > > > >>Call me cynical (no... go ahead), but if VOIP is found to have no 4th >>Amendment protection, Congress would first have to agree that this *is* >>a problem before thay could "fix" it. Given the recent track record of >>legislators vs. privacy, I'm not at all confident Congress would >>recognize the flaw, much less legislate to extend 4th Amendment >>protection. After all, arent more and more POTS long-distance calls >>being routed over IP? The only difference, really, is the point at >>which audio is fed to the codec. If the codec is in the central office, >>it's a "voice" call. If it's in the handset or local computer, it's >>VOIP. I think we can count on the Ashcroftians to eventually notice >>this and pounce upon the opportunity. And as for the SCOTUS, all they >>have to do is sit back on a strict interpretation and such intercepts >>aren't "wiretaps" at all. >> >> > >If VOIP gets no protection, then you'll see a lot of "digital" bugs in >various spy shops again - and they'll all of a sudden be legal. I thought >the Feds busted lots of people for selling bugging equipment, etc. because >they're an invasion of privacy, etc. > > Interesting counterpoint. Those busts were predicated on the violation of existing laws, where of course the feds get to break those laws with a good story and a judge's rubber sta.. er, I mean permission. So the question becomes "how does the fed keep their ability to intercept legally unprotected commo and at the same time, keep Joe Beets from doing the same thing". >Ditto for devices that intercept digital cellular phone conversations, >spyware software that turns on the microphone in your computer and sends >the bits out over the internet, ditto for tempest'ing equipment ("But >your honor, it's stored for 1/60th of a second in the phosphor! It's a >storage medium!"), etc. > > The Tempest argument is a stretch, only because you're not actually recovering the information from the phosphor itself. But the Pandora argument is well taken. >Hey, they can't have their cake and eat it too. It's either protected or >it isn't. > > Not that they won't try, though. Or that they wouldn't opt toward unprotecting everything if the opportunity presented itself. -- Roy M. Silvernail is roy at rant-central.com, and you're not "It's just this little chromium switch, here." - TFS SpamAssassin->procmail->/dev/null->bliss http://www.rant-central.com From sunder at sunder.net Fri Jul 2 13:15:59 2004 From: sunder at sunder.net (Sunder) Date: Fri, 2 Jul 2004 16:15:59 -0400 (edt) Subject: [IP] more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) In-Reply-To: <40E5BA53.9070904@rant-central.com> References: <20040702155908.GX12847@leitl.org> <40E5A069.5040007@rant-central.com> <40E5BA53.9070904@rant-central.com> Message-ID: > The Tempest argument is a stretch, only because you're not actually > recovering the information from the phosphor itself. But the Pandora > argument is well taken. Actually there is optical tempest now that works by watching the flicker of a CRT. Point is actually even more moot since most monitors are now LCD based, etc. so there's no raster line scanning the display, etc... From morlockelloi at yahoo.com Fri Jul 2 17:25:36 2004 From: morlockelloi at yahoo.com (Morlock Elloi) Date: Fri, 2 Jul 2004 17:25:36 -0700 (PDT) Subject: Nice pussy (was Re: [IP] more on more on E-mail intercept ruling - good grief!! ) In-Reply-To: Message-ID: <20040703002536.26736.qmail@web40610.mail.yahoo.com> > If VOIP gets no protection, then you'll see a lot of "digital" bugs in Protection of bits by legislation ??? Why is this a subject ? If you don't encrypt you will be listened to. Who the fuck cares if intercept is legal or not. That is irrelevant. It's like trying to obsolete summer clothing by making it illegal to watch pussies and dicks. And the discussion about it is similarly moronic. In olde times cypherpunks would applaud lack of legal bit protection as it stimulates sheeple to encrypt more. I mean wear panties. ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: __________________________________ Do you Yahoo!? Yahoo! Mail - 50x more storage than other providers! http://promotions.yahoo.com/new_mail From eugen at leitl.org Fri Jul 2 08:59:08 2004 From: eugen at leitl.org (Eugen Leitl) Date: Fri, 2 Jul 2004 17:59:08 +0200 Subject: [IP] more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) Message-ID: <20040702155908.GX12847@leitl.org> ----- Forwarded message from David Farber ----- From brian-slashdotnews at hyperreal.org Fri Jul 2 12:26:10 2004 From: brian-slashdotnews at hyperreal.org (brian-slashdotnews at hyperreal.org) Date: 2 Jul 2004 19:26:10 -0000 Subject: New Radar Sees Through Walls Message-ID: Link: http://slashdot.org/article.pl?sid=04/07/02/158257 Posted by: CowboyNeal, on 2004-07-02 16:46:00 Topic: privacy, 278 comments from the watching-me-watching-you dept. [1]artemis67 writes "A [2]small Israeli company has [3]developed a radar system that uses ultra-wideband technology to produce three-dimensional pictures of the space behind a wall from a distance of up to 20 meters. The pictures, which reportedly resemble those produced by ultrasound, are relatively high-resolution and are produced in real time. Wow, it sounds like the potential benefits of this device are huge, saving lives of soldiers, firemen, or police; the potential for privacy invasion, however, is similarly large." References 1. http://slashdot.org/~artemis67/journal/ 2. http://www.radarvision.com/ 3. http://www.worldnetdaily.com/news/article.asp?ARTICLE_ID=39246 ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From mv at cdc.gov Fri Jul 2 21:16:32 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 02 Jul 2004 21:16:32 -0700 Subject: UBL is George Washington Message-ID: <40E63320.111ED8CA@cdc.gov> At 09:58 PM 7/1/04 -0500, J.A. Terranson wrote: >Submitted for comment :-) > "...justice is a duty towards those whom you love and those whom you do > not. And people's rights will not be harmed if the opponent speaks out > about them." > > Osama Bin Laden UBL's morals, which he unfortunately gets from a book (being a smart guy, he could derive them himself like any half-cluefull atheist), are largely convergent with the pre-Judaic/Xian culture the Moslems forked a few hundred years ago. (And what, Haiwatha rooted the tree some time ago?) Ie, as the Gadsen flag says, "Don't tread on me". However, this is contrary to the methods of colonial agents, eg. Romans, Brits, and Yanks. Where yanks includes neocons. At this point I will quote the reluctant general, Trade with all, make treaties with none, and beware of foreign entanglements. -George Washington Where you can replace "all" with "oil" and "none" with Israel. Etc. Personally I think North America can be energy sufficient (nuke & coal sands) but this is an engineering/political issue. Morally I think our influence stops within 3 miles of our coasts, and as high as out ABMs can reach. From mv at cdc.gov Fri Jul 2 21:23:08 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 02 Jul 2004 21:23:08 -0700 Subject: more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) Message-ID: <40E634AC.673CB2AF@cdc.gov> >On Fri, 2 Jul 2004, Roy M. Silvernail wrote: ("But >your honor, it's stored for 1/60th of a second in the phosphor! It's a >storage medium!"), etc. Amongst the earliers RAMs were tubes of mercury with a pulse-generator at one end and a microphone at the other. The speed of sound provided the delay, the system required regeneration, like modern DRAMs. The fascists will define the language they desire, the technologists have to deal with reality. App level encryption with privately-exchanged PKs are the answer. Verification / reputation up to you. From die at dieconsulting.com Fri Jul 2 18:34:20 2004 From: die at dieconsulting.com (Dave Emery) Date: Fri, 2 Jul 2004 21:34:20 -0400 Subject: EZ Pass and the fast lane .... Message-ID: <20040703013420.GB8904@pig.dieconsulting.com> Having been inspired by some subversive comments on cypherpunks, I actually looked up the signaling format on the EZ-Pass toll transponders used throughout the Northeast. (On the Mass Pike, and most roads and bridges in NYC and a number of other places around here). They are the little square white plastic devices that one attaches to the center of one's windshield near the mirror and which exchange messages with an interrogator in the "FAST LANE" that debits the tolls from an account refreshed by a credit card (or other forms of payment). They allow one to sail through the toll booths at about 15-20 mph without stopping and avoid the horrible nuisance of digging out the right change while rolling along at 70 mph in heavy traffic. Turns out they use Manchester encoded on-off keying (EG old fashioned pulsed rf modulation) at 500 kilobits/second on a carrier frequency of 915 mhz at a power a little under 1 mw (0 dbm). The 915 mhz is time shared - the units are interrogated by being exposed to enough 915 mhz pulsed energy to activate a broadband video detector looking at energy after a 915 mhz SAW filter (presumably around -20 dbm or so). They are triggered to respond by a 20 us pulse and will chirp in response to between a 10 and 30 us pulse. Anything longer and shorter and they will not respond. The response comes about 100-150 us after the pulse and consists of a burst of 256 bits followed by a 16 bit CRC. No present idea what preamble or post amble is present, but I guess finding this out merely requires playing with a transponder and DSO/spectrum analyzer. Following the response but before the next interrogation the interrogator can optionally send a write burst which also presumably consists of 256 bits and CRC. Both the interrogators and transponders collect two valid (correct) CRC bursts on multiple interrogations and compare bit for bit before they decide they have seen a valid message. Apparently an EEPROM in the thing determines the partition between fixed bits set at the factory (eg the unit ESN) and bits that can get written into the unit by the interrogators. This is intended to allow interrogators at on ramps to write into the unit the ramp ID for units at off ramps to use to compute the toll... (possibilities for hacking here are obvious for the criminally inclined - one hopes the system designers were thoughtful and used some kind of keyed hash). No mention is made of encryption or challenge response authentication but I guess that may or may not be part of the design (one would think it had better be, as picking off the ESN should be duck soup with suitable gear if not encrypted). But what I have concluded is that it should be quite simple to detect a response from one's transponder and activate a LED or beeper, and hardly difficult to decode the traffic and display it if it isn't encrypted. A PIC and some simple rf hardware ought to do the trick, even one of those LED flashers that detect cellphone energy might prove to work. Perhaps someone more paranoid (or subversive) than I am will follow up and actually build such a monitor and report whether there are any interogations at OTHER than the expected places... -- Dave Emery N1PRE, die at dieconsulting.com DIE Consulting, Weston, Mass 02493 From non_secure at yahoo.com Fri Jul 2 23:34:35 2004 From: non_secure at yahoo.com (Joe Schmoe) Date: Fri, 2 Jul 2004 23:34:35 -0700 (PDT) Subject: other mailing list recommendations ? Message-ID: <20040703063435.86751.qmail@web53309.mail.yahoo.com> Can anyone recommend any other mailing lists besides cypherpunks to lurk on / read ? The aspects of cypherpunks that I value are the strong and opinionated stances on civil liberty issues, the pro gun and preparedness stances, and the general tech slant ... any suggestions ? __________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo From brian-slashdotnews at hyperreal.org Sat Jul 3 00:26:01 2004 From: brian-slashdotnews at hyperreal.org (brian-slashdotnews at hyperreal.org) Date: 3 Jul 2004 07:26:01 -0000 Subject: China Will Monitor, Censor SMS Messages Message-ID: Link: http://slashdot.org/article.pl?sid=04/07/03/0035224 Posted by: timothy, on 2004-07-03 06:44:00 Topic: censorship, 53 comments from the enlightenment-by-fiat dept. maggeth writes "Early reports on the AP (via Yahoo) indicate that [1]China will begin monitoring and censoring SMS communications in real time. China's 'great firewall' is infamous, but the move to censoring SMS has been slow due to technological roadblocks. Algorithms are used to identify key words and combinations of words that might be associated with 'political rumors and "reactionary remarks,"' and the system automatically notifies local police. Something to think about on your Fourth of July weekend!" Reader ackthpt adds links to [2]coverage at the BBC [3]and The Register, asking "What next, a massive government database system to track every message and contacts between people?" [4]Click Here References 1. http://news.yahoo.com/news?tmpl=story&cid=516&u=/ap/20040702/ap_on_re_as/chin a_mobile_phone_surveillance_3&printer=1 2. http://news.bbc.co.uk/1/hi/world/asia-pacific/3859403.stm 3. http://www.theregister.co.uk/2004/07/02/china_text_snoop/ 4. http://ads.osdn.com/?ad_id=4195&alloc_id=9769&site_id=1&request_id=5368172&op =click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From dave at farber.net Sat Jul 3 09:08:00 2004 From: dave at farber.net (dave at farber.net) Date: Sat, 03 Jul 2004 12:08 -0400 Subject: [IP] China filtering SMS messages Message-ID: ___ Dave Farber +1 412 726 9889 ...... Forwarded Message ....... From: "Alan A. Reiter" To: David Farber Date: Sat, 03 Jul 2004 10:33:10 -0400 Subj: China filtering SMS messages Hi Dave, When Howard Rheingold wrote "Smart Mobs," he discussed how wireless communications -- such as SMS -- can be a force for change. Apparently, the Chinese government wants to ensure SMS is not a force for changing the existing political system. The "New York Times" today published an article today that leads with, "China has begun filtering billions of telephone text messages to ensure that people do not use the popular communication tool to undermine one-party rule. "The campaign, announced on Friday by the official New China News Agency, comes after text messages sent between China's nearly 300 million mobile phone users helped to expose the national cover-up of the SARS epidemic last year. Text messages have also generated popular outrage about corruption and abuse cases that had received little attention in the state-controlled media.... "The dispatch said the purpose was to stop the spread of pornographic messages and false or deceptive advertising as well as to block illicit news and information. "All such companies are being required to install filtering equipment that can monitor and delete messages that contain key words, phrases or numbers that authorities consider suspicious before they reach customers. The companies must contact the relevant authorities, including the Communist Party's propaganda department, to make sure they stay in touch with the latest lists of banned topics, executives in the industry said." http://www.nytimes.com/2004/07/03/international/asia/03chin.html Alan ----------------------------------- Alan A. Reiter, president Wireless Internet & Mobile Computing E-Mail: reiter at wirelessinternet.com Phone: 1-301-951-0385 Weblog: http://www.CameraPhoneReport.com Weblog: http://reiter.weblogger.com Website: http://www.wirelessinternet.com ------------------------------------- You are subscribed as eugen at leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From shaddack at ns.arachne.cz Sat Jul 3 09:25:57 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sat, 3 Jul 2004 18:25:57 +0200 (CEST) Subject: China about to begin realtime censoring SMS messages Message-ID: <0407031818050.-1275484700@somehost.domainz.com> Mass-sending of SMS messages in China is a popular channel of spreading "alternative", government-unsanctioned news. Used eg. by the Falun Gong group, to spread the news about SARS, and probably in numerous other cases. Some phones are even directly equipped with the functions to automatically send SMS messages to a list of numbers. The government already keeps statistics on number of messages sent at time period from a single number, and alerts the officials when it's above the limit and then the content is checked manually. Mentioned Falun Gong news campaigns suffer from this. The new system, delayed by technological problems probably caused by the sheer volume of data, will scan the messages for keywords, keep logs of suspect ones, and automatically alert police. According to me, a partial solution of the problem could be deployment of encrypted messaging. The SMS standard, 160-character messages, doesn't offer enough space to fully use PKI (though we could sacrifice some message space - then we could afford 128 bits of key and 128 bits of HMAC, which is total of 32 characters, or maybe even use reduced HMAC of only half size as in this threat model we don't need the message integrity as much as denying the adversary access to the content, 64 bit hash could be enough). We can sacrifice also signing the message, or give the choice of signature vs additional content length (the signature is the message hash encrypted with the sender's private key, which is about another 128 bits; we could perhaps use only 64-bit of signature in this threat model). We can sacrifice the identification of sender/receiver keys (or more accurately, we can't even afford it in so short message space), but the GSM SMS standard has the sender phone number as part of the message, which can serve as identificator of the sender's key for eventual message signature check. Contemporary cellphones tend to have Java in them, and should have enough horsepower for 1024-bit RSA and 128-bit AES. However, according to my consultant, there is a problem with most of the cellphones; Java on them runs in sandbox, so they can only send the messages (and even that only when they have access to messaging API), and there is no access to message inbox. So you can merrily encrypt, but the receiver then won't decrypt it. There is a solution, though - use a phone with OpenAPI, eg. running Symbian, Linux, or (*shudder*) WinCE as its OS, but these are so far in the higher end of price spectrum. I hoped it will be possible to implement with already widely deployed cheap technology. :( Another hope lies in the advent of MMS, expensive now but bound to become a standard bulk commodity service tomorrow, which offer much bigger space (up to 64 or even 100 kbyte per message). Same problem as above applies. Then all the adversary can get is the pattern of traffic of the messages instead of their content. (And the message content too, but only when seizing the recipient's private key - I am not sure if we can avoid this in this scenario, without resorting to using one-time pads and using them correctly, or without using a direct handset-to-handeset connection, perhaps through a proxy, with a DH key exchange. The proxy could be very beneficial here, even for the traffic analysis purposes, if combined with onion routing.) ----------------- Yahoo News: http://news.yahoo.com/news?tmpl=story&cid=516&u=/ap/20040702/ap_on_re_as/china_mobile_phone_surveillance_3&printer=1 BBC News: http://news.bbc.co.uk/1/hi/world/asia-pacific/3859403.stm The Register: http://www.theregister.co.uk/2004/07/02/china_text_snoop/ Slashdot discussion: http://slashdot.org/article.pl?sid=04/07/03/0035224 From mv at cdc.gov Sat Jul 3 19:14:51 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 03 Jul 2004 19:14:51 -0700 Subject: EZ Pass and the fast lane .... Message-ID: <40E7681B.E561B234@cdc.gov> At 09:34 PM 7/2/04 -0400, Dave Emery wrote: >frequency of 915 mhz at a power a little under 1 mw (0 dbm). Meaning one can have a lot of fun while tossing one's change into the funnel as the privacy-whores cruise by... Diamond dust in the machine... From camera_lumina at hotmail.com Sat Jul 3 16:18:08 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Sat, 03 Jul 2004 19:18:08 -0400 Subject: [IP] more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) Message-ID: I dunno...as an ex-optical engineer/physicst, I'm sceptical about this whole scary "tempest" bullcrap. Even if it can be made to work fairly reliably, I suspect deploying it is extremely costly. In contrast, the main benefit of CALEA is that they can merely provision their copy of a circuit to go back to VA or wherever. They can be eavesdropping while surfin porn all without leaving their desk and cup of coffee. Hey--if they want me that bad these days, it would probably be cheaper just to send the van and beat whatever they need out of me. Actually, I suspect that Tempest is some kind of smokescreen..."Don't bother encrypting because we have this super-technology called tempest that can read your mind anyway." -TD >From: Sunder >To: "Roy M. Silvernail" >CC: cypherpunks at al-qaeda.net >Subject: Re: [IP] more on more on E-mail intercept ruling - good grief!! > (fwd from dave at farber.net) >Date: Fri, 2 Jul 2004 16:15:59 -0400 (edt) > > > > The Tempest argument is a stretch, only because you're not actually > > recovering the information from the phosphor itself. But the Pandora > > argument is well taken. > >Actually there is optical tempest now that works by watching the flicker >of a CRT. Point is actually even more moot since most monitors are now >LCD based, etc. so there's no raster line scanning the display, etc... > > _________________________________________________________________ MSN 9 Dial-up Internet Access helps fight spam and pop-ups  now 2 months FREE! http://join.msn.click-url.com/go/onm00200361ave/direct/01/ From mv at cdc.gov Sat Jul 3 19:19:38 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 03 Jul 2004 19:19:38 -0700 Subject: China about to begin realtime censoring SMS messages Message-ID: <40E7693A.88191D45@cdc.gov> At 06:25 PM 7/3/04 +0200, Thomas Shaddack wrote: >automatically send SMS messages to a list of numbers. The government >already keeps statistics on number of messages sent at time period from a >single number, and alerts the officials when it's above the limit and then >the content is checked manually. What you need then is also a "telephone tree" to do mass distributions (randomly time-delayed) without having any one source go "over quota". Could be phone meshed or use computer SMS I/O. Wouldn't it be horrible if some otherwise benign, quiet worm infected computers to implement this? Zombies aren't just for porn & pills, they can help spread the newz. From bgt at chrootlabs.org Sat Jul 3 17:23:09 2004 From: bgt at chrootlabs.org (bgt) Date: Sat, 3 Jul 2004 19:23:09 -0500 Subject: For Liars and Loafers, Cellphones Offer an Alibi In-Reply-To: <20040626235359.R3017@ubzr.zsa.bet> References: <40DE4AD0.64E23DD0@cdc.gov> <20040626235359.R3017@ubzr.zsa.bet> Message-ID: <53ACA032-CD50-11D8-8969-000A95D02140@chrootlabs.org> On Jun 26, 2004, at 23:56, J.A. Terranson wrote: > > On Sat, 26 Jun 2004, Major Variola (ret) wrote: > >> Do any models let YOU decide to send your location to ANOTHER >> phone? > > Mine, an Samsung I330 PDA/Phone (actually a rebranded Handspring) > allows > you to selectively *disable* non-lea queries. Based upon this, I do > not > believe that the system is broadcast-based, but rather operates solely > upon a query-response model. > >> Do any models even let YOU know your OWN approx location >> (to within that 100m Fedfascist standard)? > > Mine does not, but I understand that there are models now coming into > the > market which do. I'm a little late to this thread, sorry... AT&T m-mode models have had this kind of functionality for quite awhile. http://www.mobileinfo.com/news_2002/Issue25/ATT_Finder.htm "With a few keystrokes on a wireless phone, a m-mode subscriber is given the approximate geographic location of his friend, such as a street intersection. The two friends can then exchange messages, call the other, or choose a place to meet from a directory of nearby restaurants, bars, coffee shops, and bookstores." I'm pretty sure they don't use GPS for this... I think they do some form of triangulation from the cell towers. --bgt From mv at cdc.gov Sat Jul 3 19:25:27 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 03 Jul 2004 19:25:27 -0700 Subject: Tyler's Education Message-ID: <40E76A97.D275BECF@cdc.gov> At 07:18 PM 7/3/04 -0400, Tyler Durden wrote: >I dunno...as an ex-optical engineer/physicst, I'm sceptical about this whole >scary "tempest" bullcrap. Even if it can be made to work fairly reliably, I >suspect deploying it is extremely costly. So? The State can print money... And people are cheap. And digital edges are sharp, in the Ghz even when the "clock" is in the Mhz. And boxes need ventilation slots. Any questions? Look at eg what NASA can do re: finding fireflies on the moon. Now drop one "A". Or replace ASA with RO. >Hey--if they want me that bad these >days, it would probably be cheaper just to send the van and beat whatever >they need out of me. That lets you know they're listening. Or they have to dispose of the body, which lets your colleages know they're onto y'all. You really need to get up to speed on your Tradecraft, friend. From mv at cdc.gov Sat Jul 3 19:28:15 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 03 Jul 2004 19:28:15 -0700 Subject: GPS, phones, toothing Message-ID: <40E76B3F.12D9C8BF@cdc.gov> At 07:23 PM 7/3/04 -0500, bgt wrote: > >"With a few keystrokes on a wireless phone, a m-mode subscriber is >given the approximate geographic location of his friend, such as a >street intersection. The two friends can then exchange messages, call >the other, or choose a place to meet from a directory of nearby >restaurants, bars, coffee shops, and bookstores." > >I'm pretty sure they don't use GPS for this... I think they do some >form of triangulation from the cell towers. The cool thing about 'toothing' is that the party you're arranging to mutually stimulate is within a finite physical range. An amusing unintended consequence. From mv at cdc.gov Sat Jul 3 21:25:16 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 03 Jul 2004 21:25:16 -0700 Subject: Tyler's Education Message-ID: <40E786AC.44AC60AF@cdc.gov> At 04:35 AM 7/4/04 +0200, Thomas Shaddack wrote: >On Sat, 3 Jul 2004, Major Variola (ret) wrote: > >> And digital edges are sharp, in the Ghz even when the "clock" is in the >> Mhz. > >How much do the "spread spectrum clock" feature on the modern motherboards >help here? They do complicate things. But I bet their spread-spectrum jitter is derived from a PRNG. All your PRNGs are belong to us. 'Specially because you can just buy them and either analyze their output, or strip the layers and get back to the Verilog. >> And boxes need ventilation slots. > >Not necessarily. Indeed Centaur/Via's x86 w/ crypto is advertized as "fanless" >There are other ways of heat transfer. A good way could >be water cooling for transport of the heat from the CPU and other parts to >a massive metal heatsink that's the part of the case, with an optional fan >on its outside. Voila, water cooling is not only for case mod freakz >anymore. Just put the ventilated box in a bigger box and use some steel wool in the ductwork to the outside... >> Any questions? > >I expect much bigger problem in the attached cables and connectors. How to >solve this? Shielding. Shielded room. Shielded building. Basic idea: electro-magnetic disturbances penetrate only a short distance into conductors. Folks who deal with low noise amplifiers deal with this all the time. Ground loops. Faraday cages. Low voltage differential signalling. Grounded thin metal layer over your LCD display. I once worked for a chipmaker and they had a metal room. Horrible ventilation. Copper gaskets on all the seams. You could probe a chip in there, with a microscope and micromanipulators. But they also had a PC which kinda nulled out the RFI issue. However that PC's output would not have escaped. The power cables from the outside to inside are an issue too. As Schneier says, pros go after people, not tech; which is not to say you can ignore RF tracking if you're a target. I don't think you can "fish" with van Ecyk (sp?) tech, although wardriving/flying sorta counts, except that those are intentional emitters. If I promise you a green card or citizenship, and give you a grand, will you install this gizmo between the keyboard and computer for me when you're cleaning the office? (Assuming you're an 'illegal' working for shit wages and the Suit has credentials, or cash, or both. Ask Nicky Scarfo about this..) Or plug a camoflaged 802.11blah AP into a RJ-45 and listen from the van... (Succeptible to sweeps, but how often are they done? And real pros use bursty bugs that aren't broadcasting all the time, eg in the woodwork of the State Dept.) From measl at mfn.org Sat Jul 3 19:41:44 2004 From: measl at mfn.org (J.A. Terranson) Date: Sat, 3 Jul 2004 21:41:44 -0500 (CDT) Subject: Tyler's Education In-Reply-To: <40E76A97.D275BECF@cdc.gov> References: <40E76A97.D275BECF@cdc.gov> Message-ID: <20040703213955.N159@ubzr.zsa.bet> On Sat, 3 Jul 2004, Major Variola (ret) wrote: > At 07:18 PM 7/3/04 -0400, Tyler Durden wrote: > >I dunno...as an ex-optical engineer/physicst, I'm sceptical about this > whole > >scary "tempest" bullcrap. Even if it can be made to work fairly > reliably, I > >suspect deploying it is extremely costly. Scary or not, I can attest from first hand personal knowledge that this type of monitoring is in active use by the US, and has been for over 4 years (although it's only been "mainstream" for ~2). -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From mv at cdc.gov Sat Jul 3 23:51:12 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 03 Jul 2004 23:51:12 -0700 Subject: 911 == Viagra for FBI? Message-ID: <40E7A8E0.7CBFCC7C@cdc.gov> At 11:57 PM 7/3/04 -0500, J.A. Terranson wrote: >requires blackbagging - something that was a lot more limited prior to >9/11). Was the FBI/SS (ie, US internal security service) so impotent after the McVeigh Oklahoma ANFO feedback that they couldn't pull off a black bag job on organized militias, militant racial or religious (eg antiabortion) groups, etc? Not that I expect an answer. Obviously 911 gave the State "freedom" to do as it pleases, Bill of Rights be damned, but one must wonder. From mv at cdc.gov Sat Jul 3 23:54:18 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 03 Jul 2004 23:54:18 -0700 Subject: Tyler's Education Message-ID: <40E7A99A.21CDD26D@cdc.gov> At 01:09 AM 7/4/04 -0400, Yeoh Yiu wrote: > >Optic fibre. > Enclosed in a pressurized conduit. Monitor the pressure. Harder to tap without being noticed. From measl at mfn.org Sat Jul 3 21:57:19 2004 From: measl at mfn.org (J.A. Terranson) Date: Sat, 3 Jul 2004 23:57:19 -0500 (CDT) Subject: Tyler's Education In-Reply-To: <20040704041703.GD13858@pig.dieconsulting.com> References: <40E76A97.D275BECF@cdc.gov> <20040703213955.N159@ubzr.zsa.bet> <20040704041703.GD13858@pig.dieconsulting.com> Message-ID: <20040703234859.G240@ubzr.zsa.bet> On Sun, 4 Jul 2004, Dave Emery wrote: > Would you care to comment on any technical or other details ? I do not have the detailed technical details I would have liked - I did ask some of these types of questions and received little more than careful "decline to answer"s. What I do know is that this type of monitoring is being done on a regular, although limited scale, in FISA proceedings. The targets are generally CRT emissions, and the distance between target and acquisition gear is under .5 miles - still a shocking range which I was totally unprepared for. I engaged one of the operators in a discussion about the tempest resistant typefaces, and he was unaware of them. Food for thought... Interestingly, I have had more than one report of aural acquistion of typists keystrokes being used to attempt to calculate the content of a short keysequence (I assume a password is what was meant by "short keysequence"). These reports indicated "poor, but occasionally lucky results". I have also been told that there is a broadcasting keyboard cable inline device which is in wide use (this is pretty easy to do, but requires blackbagging - something that was a lot more limited prior to 9/11). -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From howie.goodell at gmail.com Sat Jul 3 21:00:23 2004 From: howie.goodell at gmail.com (Howie Goodell) Date: Sun, 4 Jul 2004 00:00:23 -0400 Subject: UBL is George Washington In-Reply-To: <40E63320.111ED8CA@cdc.gov> References: <40E63320.111ED8CA@cdc.gov> Message-ID: <20bf32b704070321003588e234@mail.gmail.com> OK -- some comments. First, IMHO one confusing and perhaps confused post; I'm not sure I get the point. Second, to be specific, bin Laden isn't George Washington, but in at least one respect he is LIKE others who struggled to keep their countries from being dominated by foreigners. George Washington was one such leader. Vlad the Impaler was another (for the history-challenged, this original for the legendary Count Dracula temporarily saved Romania from being overrun by the Ottoman Turks, by massacring hundreds of thousands of them, mostly by impaling them on sharpened stakes.) Mahatma Gandhi was another. I think "Vlad the Impaler was Gandhi" or vice-versa is about as apt a comparison as Washington and bin Laden. For starters, I think the use of terrorism is a moral a distinction worth making. Murdering thousands of civilians is not the same thing as attacking enemy troops. (To be consistent, the plane that hit the Pentagon was not terrorism, but a military attack with civilian collateral damage.) Finally, while I (and John Kerry) agree that independence from Mideast oil is a wiser goal than our current slavish devotion to the Saudis, or military domination of the whole area, I think isolationism in the age of the Internet is absurd. The 3-mile limit was the range of cannonballs, and ABMs are about as useful against many threats we already face. Like it or not, we Americans are part of one planet, and we had better get better at it than we've been lately. Howie Goodell On Fri, 02 Jul 2004 21:16:32 -0700, Major Variola (ret) wrote: > > At 09:58 PM 7/1/04 -0500, J.A. Terranson wrote: > >Submitted for comment :-) > > > "...justice is a duty towards those whom you love and those whom you > do > > not. And people's rights will not be harmed if the opponent speaks > out > > about them." > > > > Osama Bin Laden > > UBL's morals, which he unfortunately gets from a book (being a smart > guy, he could derive them himself like any half-cluefull atheist), > are largely convergent with the pre-Judaic/Xian culture the Moslems > forked a few hundred years ago. (And what, Haiwatha rooted the > tree some time ago?) Ie, as the Gadsen flag says, "Don't tread > on me". However, this is contrary to the methods of colonial > agents, eg. Romans, Brits, and Yanks. Where yanks includes > neocons. > > At this point I will quote the reluctant general, > Trade with all, make treaties with none, and beware of foreign > entanglements. > -George Washington > Where you can replace "all" with "oil" and "none" with Israel. Etc. > > Personally I think North America can be energy sufficient (nuke & coal > sands) > but this is an engineering/political issue. Morally I think our > influence stops > within 3 miles of our coasts, and as high as out ABMs can reach. > > E3-I: This message has been scanned for viruses and dangerous content by UML's antivirus scanning services. > > -- Howie Goodell hgoodell at cs.uml.edu http://goodL.org Hardware control Info Visualization User interface UMass Lowell Computer Science Doctoral Candidate From die at dieconsulting.com Sat Jul 3 21:17:03 2004 From: die at dieconsulting.com (Dave Emery) Date: Sun, 4 Jul 2004 00:17:03 -0400 Subject: Tyler's Education In-Reply-To: <20040703213955.N159@ubzr.zsa.bet> References: <40E76A97.D275BECF@cdc.gov> <20040703213955.N159@ubzr.zsa.bet> Message-ID: <20040704041703.GD13858@pig.dieconsulting.com> On Sat, Jul 03, 2004 at 09:41:44PM -0500, J.A. Terranson wrote: > On Sat, 3 Jul 2004, Major Variola (ret) wrote: > > > At 07:18 PM 7/3/04 -0400, Tyler Durden wrote: > > >I dunno...as an ex-optical engineer/physicst, I'm sceptical about this > > whole > > >scary "tempest" bullcrap. Even if it can be made to work fairly > > reliably, I > > >suspect deploying it is extremely costly. > > Scary or not, I can attest from first hand personal knowledge that this > type of monitoring is in active use by the US, and has been for over 4 > years (although it's only been "mainstream" for ~2). Would you care to comment on any technical or other details ? Tempest monitoring of raster scan CRTs has been around for a long long time... but most current LCD displays are much less vulnerable as pixels are switched in parallel (and of course not painted at high speeds allowing optical monitoring). But many video cards generate the rasterized stuff anyway... and use that interface to talk to the LCD monitor. Tempest monitoring of energy on communications lines and power lines related to internal decrypted traffic has been around since before the Berlin tunnel... and used effectively. But the heyday of this was the mechanical crypto and mechanical Teletype era... where sparking contacts switched substantial inductive loads. Tempest monitoring of CPU and system behavior is a newer trick in most cases if it is effective at all in typical situations. Obviously Tempest monitoring of copper wire ethernet LAN traffic is possible. Wireless LANs, of course, aren't a Tempest issue. Perhaps some keyboards radiate detectable keystroke related energy... But given the current statist tendencies here and elsewhere, it would not surprise me at all to hear that any and all techniques for surveillance anyone has shown to be effective are likely in active use - there is money, interest, and a great lowering of inhibitions. And certainly there has been more than enough open discussion of Tempest type side channel attacks, unlikely the folks behind the curtain have just ignored all of it... On the other hand the cost, complexity and sophistication of the gear required to extract information at useful ranges is still daunting compared to other methods of obtaining the same information (such as black bag jobs with disk copiers and use of trojans to capture passphrases). -- Dave Emery N1PRE, die at dieconsulting.com DIE Consulting, Weston, Mass 02493 From squid at panix.com Sat Jul 3 22:09:05 2004 From: squid at panix.com (Yeoh Yiu) Date: 04 Jul 2004 01:09:05 -0400 Subject: Tyler's Education In-Reply-To: <0407040432110.9622@somehost.domainz.com> References: <40E76A97.D275BECF@cdc.gov> <0407040432110.9622@somehost.domainz.com> Message-ID: Thomas Shaddack writes: > > And boxes need ventilation slots. > > Not necessarily. There are other ways of heat transfer. A good way could > be water cooling for transport of the heat from the CPU and other parts to > a massive metal heatsink that's the part of the case, with an optional fan > on its outside. Voila, water cooling is not only for case mod freakz > anymore. > > > Any questions? > > I expect much bigger problem in the attached cables and connectors. How to > solve this? Optic fibre. From bill.stewart at pobox.com Sun Jul 4 01:35:06 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Sun, 04 Jul 2004 01:35:06 -0700 Subject: [IP] more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) In-Reply-To: <40E5A069.5040007@rant-central.com> References: <20040702155908.GX12847@leitl.org> <40E5A069.5040007@rant-central.com> Message-ID: <6.0.3.0.0.20040703152748.0443f008@pop.idiom.com> At 10:50 AM 7/2/2004, Roy M. Silvernail wrote: >Call me cynical (no... go ahead), but if VOIP is found to have no 4th >Amendment protection, Congress would first have to agree that this *is* a >problem before thay could "fix" it. While Peter Swire is a much better judge of court behavior than I am (:-) the key issue in the Councilman case is that the Wiretap Law differentiates between "aural" communications on wires and the broader category of "electronic communications", and "electronic communications" might only be protected on wires, and not just when it's in storage or in transit on a computer. (What about wireless transmission? Is that protected?) If courts don't think VOIP is "aural", they're way out of line. That should mean that if you wiretap VOIP calls, you'd better have a warrant. On a more negative hand, it sounds like the court thinks that wiretap rules only apply to stuff that's on wire - do packets that are inside a router get protected, while it's busy thinking about what wire to put it on next? Does it matter whether you're intercepting the whole message, or is the fact that the packet you're intercepting is inside a router good enough for the court, even though the other packets in the message might still be on the wires into or out of the router? >Given the recent track record of legislators vs. privacy, I'm not at all >confident Congress would recognize the flaw, much less legislate to extend >4th Amendment protection. The Ashcroftians have been able to con Congress into letting them have lots of other things they ask for in the name of "preventing technological change from taking away our current powers", and every edge case seems to be used as a loophole to grant them more power, not to restrict what they've got. It's possible that a Kerry Administration would be less aggressive about this than the Bush Administration, though it's unlikely that they'd actually be much better than the Clinton Administration, would were pretty evil back in their day. >After all, arent more and more POTS long-distance calls being routed over >IP? The only difference, really, is the point at which audio is fed to >the codec. If the codec is in the central office, it's a "voice" >call. If it's in the handset or local computer, it's VOIP. I think we >can count on the Ashcroftians to eventually notice this and pounce upon >the opportunity. Oh, they know, and they're in a mad scramble to make sure that they can tap data communications as well, and most VOIP doesn't have useful crypto protection. So far, it's easier to tap VOIP calls after they've been turned back into telco-flavored TDM, but that's partly because they've got tools and practice and established procedures for doing so. The big difference with VOIP is that it's normal to design relatively distributed VOIP systems that do most of the work peer-to-peer, and it's harder to get a hook into the endpoints without the endpoints being aware of them. Some VOIP systems can probably be convinced to make three-way calls without telling the user interface at the endpoints, so the logical way to do wiretapping is to get the gatekeepers to build calls that way. ---- Bill Stewart bill.stewart at pobox.com From roy at rant-central.com Sat Jul 3 22:47:53 2004 From: roy at rant-central.com (Roy M. Silvernail) Date: Sun, 04 Jul 2004 01:47:53 -0400 Subject: GPS, phones, toothing In-Reply-To: <40E76B3F.12D9C8BF@cdc.gov> References: <40E76B3F.12D9C8BF@cdc.gov> Message-ID: <1088920073.18615.5.camel@localhost> On Sat, 2004-07-03 at 22:28, Major Variola (ret) wrote: > The cool thing about 'toothing' is that the party you're arranging to > mutually stimulate is within a finite physical range. An amusing > unintended consequence. Not so unintended if you ask me. The chief drawback of semi-anon methods of negotiating assignations is the lack of geographical data. Certain "adult" telephone chat services suffer from aggregating widely strewn patrons. A patron in Cincinnati may discover suddenly that the object of his/her pursuit is actually in Nashville, hardly a quick drive. I think toothing has grown popular *because* of the proximity limitations. One has a reasonable assurance that the object of pursuit is close enough to "close escrow", as Lenny Nero would say. -- Roy M. Silvernail is roy at rant-central.com, and you're not "Progress, like reality, is not optional." - R. A. Hettinga SpamAssassin->procmail->/dev/null->bliss http://www.rant-central.com From measl at mfn.org Sun Jul 4 00:11:44 2004 From: measl at mfn.org (J.A. Terranson) Date: Sun, 4 Jul 2004 02:11:44 -0500 (CDT) Subject: 911 == Viagra for FBI? In-Reply-To: <40E7A8E0.7CBFCC7C@cdc.gov> References: <40E7A8E0.7CBFCC7C@cdc.gov> Message-ID: <20040704020745.W240@ubzr.zsa.bet> On Sat, 3 Jul 2004, Major Variola (ret) wrote: > At 11:57 PM 7/3/04 -0500, J.A. Terranson wrote: > >requires blackbagging - something that was a lot more limited prior to > >9/11). > > Was the FBI/SS (ie, US internal security service) so impotent after > the McVeigh Oklahoma ANFO feedback that they couldn't pull off a > black bag job on organized militias, militant racial or religious (eg > antiabortion) groups, etc? The feds that I know were uniformly terrified of any OOB activity prior to 9/11, in the absence of a secure authorizing paper trail (hard to get at that time). They are a lot more at ease nowadays :-/ > Not that I expect an answer. > > Obviously 911 gave the State "freedom" to do as it pleases, > Bill of Rights be damned, but one must wonder. What really interesting is that they don't see this. Honestly, they don't. I've had endless discussions with not just feds, but state and locals too - only one (and sometimes two) out of ~30 see that there is any incongruity between what is, and what was intended to be. Most of them honestly believe that they are "handcuffed" with "too much restrictive policy". Perception is everything... -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From shaddack at ns.arachne.cz Sat Jul 3 19:35:59 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sun, 4 Jul 2004 04:35:59 +0200 (CEST) Subject: Tyler's Education In-Reply-To: <40E76A97.D275BECF@cdc.gov> References: <40E76A97.D275BECF@cdc.gov> Message-ID: <0407040432110.9622@somehost.domainz.com> On Sat, 3 Jul 2004, Major Variola (ret) wrote: > And digital edges are sharp, in the Ghz even when the "clock" is in the > Mhz. How much do the "spread spectrum clock" feature on the modern motherboards help here? > And boxes need ventilation slots. Not necessarily. There are other ways of heat transfer. A good way could be water cooling for transport of the heat from the CPU and other parts to a massive metal heatsink that's the part of the case, with an optional fan on its outside. Voila, water cooling is not only for case mod freakz anymore. > Any questions? I expect much bigger problem in the attached cables and connectors. How to solve this? From shaddack at ns.arachne.cz Sat Jul 3 19:46:37 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sun, 4 Jul 2004 04:46:37 +0200 (CEST) Subject: China about to begin realtime censoring SMS messages In-Reply-To: <40E7693A.88191D45@cdc.gov> References: <40E7693A.88191D45@cdc.gov> Message-ID: <0407040437520.9632@somehost.domainz.com> On Sat, 3 Jul 2004, Major Variola (ret) wrote: > At 06:25 PM 7/3/04 +0200, Thomas Shaddack wrote: > >automatically send SMS messages to a list of numbers. The government > >already keeps statistics on number of messages sent at time period from > >a single number, and alerts the officials when it's above the limit and > >then the content is checked manually. > > What you need then is also a "telephone tree" to do mass distributions > (randomly time-delayed) without having any one source go "over quota". I suppose it's what Falun Gong started doing in reaction to the measure. > Could be phone meshed or use computer SMS I/O. If the gateways are present. > Wouldn't it be horrible if some otherwise benign, quiet worm infected > computers to implement this? Zombies aren't just for porn & pills, > they can help spread the newz. Or act as an onion-routing anonymizing network. It's a bit drastic way of enforcing privacy means, but it's always better to have a nuke up one's sleeve in case the stakes would get way too high. I expect it to happen in couple years. Most likely it will be born either in some overtly restrictive regime of Far or Middle East (including but not limited to China), or as a reaction to some drastic measure-to-happen in the Demagocratic West. From die at dieconsulting.com Sun Jul 4 13:28:39 2004 From: die at dieconsulting.com (Dave Emery) Date: Sun, 4 Jul 2004 16:28:39 -0400 Subject: more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) In-Reply-To: <20040704200600.GB12847@leitl.org> References: <40E634AC.673CB2AF@cdc.gov> <20040704200600.GB12847@leitl.org> Message-ID: <20040704202839.GA32743@pig.dieconsulting.com> On Sun, Jul 04, 2004 at 10:06:01PM +0200, Eugen Leitl wrote: > On Fri, Jul 02, 2004 at 09:23:08PM -0700, Major Variola (ret) wrote: > > > Amongst the earliers RAMs were tubes of mercury with a pulse-generator > > at one end and a microphone at the other. The speed of sound provided > > the delay, the system required regeneration, like modern DRAMs. > > At GBit WAN stores a whole packet in the fibre as optical delay line, with 10 > GBit > it's true even for a LAN (some 30 bits/m). > > That interpretation techically allows to wiretap anything. You guys miss the point... you don't have to deal with stretched examples of wires as storage devices ... I doubt there is a single router or switch which does not clock incoming packets into various intermediate storage registers, stuff them temporarily into RAM and/or FIFOs, and otherwise store traffic. Nobody builds flow through asynchronous systems of that complexity, if for no other reason than that outgoing traffic has to be queued for delivery. In fact virtually every networking technology and virtually every digital telephone technology stores the stream of samples, packets, vocoder frames and so forth internally for various lengths of time, often up to many seconds under the right circumstances. And essentially every design for a digital interface on the planet clocks bits one by one into holding flip flops, so viewed at the nanosecond clock tick by clock tick level the data is sitting there in storage even for devices that don't store whole packets, frames or messages. Shut off the clock and the data will sit there forever (plus or minus dynamic refresh issues). Thus unless the law changes, you are quite right - wiretapping virtually anything in digital format - at least by copying it from a storage device such as a latch inside the communications equipment that properly carries the traffic - is perfectly legal without exception under this absurd ruling. -- Dave Emery N1PRE, die at dieconsulting.com DIE Consulting, Weston, Mass 02493 From eugen at leitl.org Sun Jul 4 11:42:00 2004 From: eugen at leitl.org (Eugen Leitl) Date: Sun, 4 Jul 2004 20:42:00 +0200 Subject: New Radar Sees Through Walls (fwd from brian-slashdotnews@hyperreal.org) Message-ID: <20040704184159.GP12847@leitl.org> ----- Forwarded message from brian-slashdotnews at hyperreal.org ----- From eugen at leitl.org Sun Jul 4 13:06:01 2004 From: eugen at leitl.org (Eugen Leitl) Date: Sun, 4 Jul 2004 22:06:01 +0200 Subject: more on more on E-mail intercept ruling - good grief!! (fwd from dave@farber.net) In-Reply-To: <40E634AC.673CB2AF@cdc.gov> References: <40E634AC.673CB2AF@cdc.gov> Message-ID: <20040704200600.GB12847@leitl.org> On Fri, Jul 02, 2004 at 09:23:08PM -0700, Major Variola (ret) wrote: > Amongst the earliers RAMs were tubes of mercury with a pulse-generator > at one end and a microphone at the other. The speed of sound provided > the delay, the system required regeneration, like modern DRAMs. At GBit WAN stores a whole packet in the fibre as optical delay line, with 10 GBit it's true even for a LAN (some 30 bits/m). That interpretation techically allows to wiretap anything. Of course they're doing that anyway, regardless of what local laws says, so even not much twisting of words required. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From eugen at leitl.org Sun Jul 4 13:17:11 2004 From: eugen at leitl.org (Eugen Leitl) Date: Sun, 4 Jul 2004 22:17:11 +0200 Subject: China Will Monitor, Censor SMS Messages (fwd from brian-slashdotnews@hyperreal.org) Message-ID: <20040704201711.GC12847@leitl.org> ----- Forwarded message from brian-slashdotnews at hyperreal.org ----- From eugen at leitl.org Sun Jul 4 13:33:20 2004 From: eugen at leitl.org (Eugen Leitl) Date: Sun, 4 Jul 2004 22:33:20 +0200 Subject: [IP] China filtering SMS messages (fwd from dave@farber.net) Message-ID: <20040704203320.GH12847@leitl.org> ----- Forwarded message from dave at farber.net ----- From bill.stewart at pobox.com Sun Jul 4 23:26:29 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Sun, 04 Jul 2004 23:26:29 -0700 Subject: Tyler's Education In-Reply-To: <0407040432110.9622@somehost.domainz.com> References: <40E76A97.D275BECF@cdc.gov> <0407040432110.9622@somehost.domainz.com> Message-ID: <6.0.3.0.0.20040704225503.043e9b80@pop.idiom.com> As far as education goes, if you're constantly seeing black vans with big funky antennas on them parked in front of your house any time you're on the computer, you've really got far more serious worries than just a bit of TEMPEST. It's either time to line up your lawyers because of stuff you do know you've been doing, or else time to get your shrink to up your meds a bit. >On Sat, 3 Jul 2004, Major Variola (ret) wrote: > > And digital edges are sharp, in the Ghz even when the "clock" is in the > Mhz. > > And boxes need ventilation slots. >... water cooling .... >At 07:35 PM 7/3/2004, Thomas Shaddack wrote: >I expect much bigger problem in the attached cables and connectors. It's been 15-20 years since I worked on TEMPEST environments, so technology has overtaken most of what we were doing. We tested the TEMPEST room at 450 MHz, and needed something like 100-120 dB of shielding to be comfortable with it, and at those frequencies, you'd easily find leakage if the copper-wool packing in the joints wasn't tight. Our VAX ran at something like 10 MHz, and our Sparcstations might have been as fast as 40 MHz, but basically there wasn't a lot of high-frequency signal out there, even with harmonics. The standards for cable penetration were that a waveguide hole needed to be N wavelengths deep and no more than 1/x wide (I think it was something like half-wave wide), and most of ours were an inch or two deep with quarter-inch holes. That was convenient for running fiber through. If you stuck a paper-clip about halfway through, the RF meter would peg. These days, of course, most of the equipment's at much higher frequencies; I doubt the room would be meaningfully tight with 5GHz machines. Power connections were filtered, which was much more expensive, using boxes with big inductors in them. That part of the job would be much easier today - the VAX needed three-phase power, and the room drew lots of amps, as did the two one-ton water-cooled Liebert air conditioners. That AMD 64-bit CPU might look like a space-heater, but it really isn't that bad. And a laptop's a lot better. We occasionally used TEMPEST-shielded PCs. They weren't bad - they had solid metal boxes, and special shielded cables for the rather heavy keyboards, and the monitors were a bit bulky. The monitors were mostly CGA or mono text - maybe some EGA, but basically they were a lot lower end that you'd want today. Don't expect that laptops will keep you out of trouble - I once had a laptop projecting its image onto a TV I was near. The image was out of sync, with three partial images, and it was probably in the 640x480 days, maybe 800x600, ~1997, but I'd done nothing special and it was an average TV. Probably the signal was leaking out the VGA jack on the laptop. The easy part of TEMPEST monitoring is finding some signal. The hard part is sorting it out from the noise. If they're not nearby, they're unlikely to be using TEMPEST on you; they're much more likely to be tapping your ISP connections. ---- Bill Stewart bill.stewart at pobox.com From mv at cdc.gov Mon Jul 5 00:00:03 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Mon, 05 Jul 2004 00:00:03 -0700 Subject: GPS, phones, toothing Message-ID: <40E8FC72.2BDA997@cdc.gov> At 01:47 AM 7/4/04 -0400, Roy M. Silvernail wrote: >On Sat, 2004-07-03 at 22:28, Major Variola (ret) wrote: > >> The cool thing about 'toothing' is that the party you're arranging to >> mutually stimulate is within a finite physical range. An amusing >> unintended consequence. > >Not so unintended if you ask me. I'd love to have a transcript of the IEEE spec meeting where this potential feature was discussed. :-) From mv at cdc.gov Mon Jul 5 00:02:02 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Mon, 05 Jul 2004 00:02:02 -0700 Subject: UBL is George Washington Message-ID: <40E8FCEA.95B97E72@cdc.gov> At 12:00 AM 7/4/04 -0400, Howie Goodell wrote: > >For starters, I think the use of terrorism is a moral a distinction >worth making. Murdering thousands of civilians is not the same thing >as attacking enemy troops. (To be consistent, the plane that hit the >Pentagon was not terrorism, but a military attack with civilian >collateral damage.) The yanks did not wear regular uniforms and did not march in rows in open fields like Gentlemen. Asymmetric warfare means not playing by *their* rules. From jhall at SIMS.Berkeley.EDU Mon Jul 5 04:43:05 2004 From: jhall at SIMS.Berkeley.EDU (Joseph Lorenzo Hall) Date: July 5, 2004 4:43:05 PM EDT Subject: Syndicated Dave and Declan... RSS Message-ID: Hi Declan, Dave (for IP, if you wish), Being one of the many of your pesky readers that spends a good deal of time in a news aggregator and likes syndicated news (RSS, ATOM, etc.), I've bugged you both before about setting up something with RSS. (Declan finally caved and is using some sort of blog software with RSS and ATOM feeds: http://www.politechbot.com/ ) As for building a feed of Dave's IP list, I finally had to take matters into my own hands and hire a mercenary. I got Carlo Zottmann to build an RSS feed for Dave's Interesting People List... here's the RSS feed: http://bootleg-rss.g-blog.net/ d.interesting_people_org_archives_interesting-people.php A special feature that Carlo included was the ability to add '?date=YYYYMM' (ex: 200407) to the end of the script to access the archive for a previous month. When no date is given, the script defaults to the current month. Further, Carlo will scrape any site that you wished had syndication for $2 (If you like the IP syndication and would like to make a donation to Carlo's efforts, let me know): http://bootleg-rss.g-blog.net/journal/2004/07/announcement-accepting- feed-requests.html (via Boing Boing originally) I also asked him to syndicate the Drudge Report for fun (which appeared to be a major pain in the ass considering it seems to be hand-edited): http://bootleg-rss.g-blog.net/d.drudgereport_com.php Joe ------------------------------------------------------------------------ Joseph Lorenzo Hall, SIMS PhD Student; UC Berkeley. [web:, blog:] ------------------------------------- You are subscribed as eugen at leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From s.schear at comcast.net Mon Jul 5 11:02:14 2004 From: s.schear at comcast.net (Steve Schear) Date: Mon, 05 Jul 2004 11:02:14 -0700 Subject: New Radar Sees Through Walls (fwd from brian-slashdotnews@hyperreal.org) In-Reply-To: <20040704184159.GP12847@leitl.org> References: <20040704184159.GP12847@leitl.org> Message-ID: <6.0.1.1.0.20040705110041.054258e0@mail.comcast.net> At 11:42 AM 7/4/2004, Eugen Leitl wrote: >From: brian-slashdotnews at hyperreal.org >Date: 2 Jul 2004 19:26:10 -0000 >To: slashdotnews at hyperreal.org >Subject: New Radar Sees Through Walls >User-Agent: SlashdotNewsScooper/0.0.3 > >Link: http://slashdot.org/article.pl?sid=04/07/02/158257 >Posted by: CowboyNeal, on 2004-07-02 16:46:00 >Topic: privacy, 278 comments > > from the watching-me-watching-you dept. > [1]artemis67 writes "A [2]small Israeli company has [3]developed a > radar system that uses ultra-wideband technology to produce > three-dimensional pictures of the space behind a wall from a distance > of up to 20 meters. The pictures, which reportedly resemble those > produced by ultrasound, are relatively high-resolution and are > produced in real time. Wow, it sounds like the potential benefits of > this device are huge, saving lives of soldiers, firemen, or police; > the potential for privacy invasion, however, is similarly large." > >References > > 1. http://slashdot.org/~artemis67/journal/ > 2. http://www.radarvision.com/ > 3. http://www.worldnetdaily.com/news/article.asp?ARTICLE_ID=39246 Should be interesting to see what insulated walls which include aluminum foil, common in U.S., do to penetration. stvee From hseaver at cybershamanix.com Mon Jul 5 12:59:37 2004 From: hseaver at cybershamanix.com (Harmon Seaver) Date: Mon, 5 Jul 2004 14:59:37 -0500 Subject: UBL is George Washington In-Reply-To: References: <40E8FCEA.95B97E72@cdc.gov> Message-ID: <20040705195937.GA5460@cybershamanix.com> On Mon, Jul 05, 2004 at 09:32:16PM +0200, Anonymous wrote: > > Major Variola (ret) writes: > > > > The yanks did not wear regular uniforms and did not march in > > rows in open fields like Gentlemen. Asymmetric warfare means not > > playing by > > *their* rules. > > But asymm warfare has to accomplish its goal. It's not being very > successful. The only people who are siding with al-qaeda are those whose > brains are already mush -statist socialists, to be precise. If al qaeda Uh, the last I heard bin Ladin and the rest of al-queda hated socialists, which is why they didn't jive with Saddam. And, in fact, wasn't that exactly what the jihad in Afghanistan was all about -- killing commies? -- Harmon Seaver CyberShamanix http://www.cybershamanix.com Hoka hey! From dave at farber.net Mon Jul 5 14:28:27 2004 From: dave at farber.net (David Farber) Date: Mon, 5 Jul 2004 17:28:27 -0400 Subject: [IP] Syndicated Dave and Declan... RSS Message-ID: Begin forwarded message: From nobody at paranoici.org Mon Jul 5 12:32:16 2004 From: nobody at paranoici.org (Anonymous) Date: Mon, 5 Jul 2004 21:32:16 +0200 (CEST) Subject: UBL is George Washington In-Reply-To: <40E8FCEA.95B97E72@cdc.gov> Message-ID: Major Variola (ret) writes: > > The yanks did not wear regular uniforms and did not march in > rows in open fields like Gentlemen. Asymmetric warfare means not > playing by > *their* rules. But asymm warfare has to accomplish its goal. It's not being very successful. The only people who are siding with al-qaeda are those whose brains are already mush -statist socialists, to be precise. If al qaeda bombed government buildings or targetted the private residences or offices of government officials, they might get more sympathy, from me at least. Destroying an pair of buildings and killing thousands of citizens -most of whom couldn't give an accurate account of U.S. forces distribution in the MidEast- is not a step forward. From eugen at leitl.org Mon Jul 5 12:47:07 2004 From: eugen at leitl.org (Eugen Leitl) Date: Mon, 5 Jul 2004 21:47:07 +0200 Subject: UBL is George Washington In-Reply-To: References: <40E8FCEA.95B97E72@cdc.gov> Message-ID: <20040705194707.GJ12847@leitl.org> On Mon, Jul 05, 2004 at 09:32:16PM +0200, Anonymous wrote: > But asymm warfare has to accomplish its goal. It's not being very > successful. The only people who are siding with al-qaeda are those whose Au contraire. People in the US (stupid gits) are genuinely afraid. They're voting law and order types into office, with strongarm tendencies in foreign politics which is about the best recruitment program the mange-bearded turbaned fringe could ever come up with. They'd cream their pants with the thought of Shrubya being reelected. It's about the best thing that could happen to them. If they knew the right place and time to bomb the Xtian terrorists into office, they'd be on the plane already. > brains are already mush -statist socialists, to be precise. If al qaeda This is not an accurate view of what is happening in the EU. > bombed government buildings or targetted the private residences or offices > of government officials, they might get more sympathy, from me at least. > Destroying an pair of buildings and killing thousands of citizens -most of > whom couldn't give an accurate account of U.S. forces distribution in the > MidEast- is not a step forward. Yes, it is. You're just confused about what their goals are. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From eugen at leitl.org Mon Jul 5 14:40:25 2004 From: eugen at leitl.org (Eugen Leitl) Date: Mon, 5 Jul 2004 23:40:25 +0200 Subject: [IP] Syndicated Dave and Declan... RSS (fwd from dave@farber.net) Message-ID: <20040705214025.GM12847@leitl.org> ----- Forwarded message from David Farber ----- From kelsey.j at ix.netcom.com Tue Jul 6 06:32:19 2004 From: kelsey.j at ix.netcom.com (John Kelsey) Date: Tue, 6 Jul 2004 09:32:19 -0400 (GMT-04:00) Subject: Tyler's Education Message-ID: <12150291.1089120739376.JavaMail.root@huey.psp.pas.earthlink.net> From: "J.A. Terranson" Sent: Jul 4, 2004 12:57 AM To: "cypherpunks at al-qaeda.net" Subject: Re: Tyler's Education Interestingly, I have had more than one report of aural acquistion of typists keystrokes being used to attempt to calculate the content of a short keysequence (I assume a password is what was meant by "short keysequence"). These reports indicated "poor, but occasionally lucky results". I wonder if this follows the technique used by Song, Wagner, & Tian to attack SSH-encrypted passwords by watching keystroke timings. J.A. Terranson sysadmin at mfn.org --John Kelsey From camera_lumina at hotmail.com Tue Jul 6 07:23:08 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Tue, 06 Jul 2004 10:23:08 -0400 Subject: UBL is George Washington Message-ID: Traditionally speaking, Asymetric warfare has almost always been successful. The best example, of course, is the French exodus from Algeria. As for sympathisizing with OBL, I agree with you, but then again I've never been an asymmetric warrior myself. But it seems to me the bombing of that Indonesian discoteq wernt a long way towards getting the locals to view OBL as just another wannabe remote control dictator wanting to force-feed foregin culture into a complex, multicutlural area where those 'solutions' might be completely inappropriate. Meanwhile, however, anyone read that Vanity Fair article? The United States has almost single-handedly transformed OBL into an underdog and symbol of resistance. -TD >From: Anonymous >To: cypherpunks at al-qaeda.net >Subject: Re: UBL is George Washington >Date: Mon, 5 Jul 2004 21:32:16 +0200 (CEST) > >Major Variola (ret) writes: > > > > The yanks did not wear regular uniforms and did not march in > > rows in open fields like Gentlemen. Asymmetric warfare means not > > playing by > > *their* rules. > >But asymm warfare has to accomplish its goal. It's not being very >successful. The only people who are siding with al-qaeda are those whose >brains are already mush -statist socialists, to be precise. If al qaeda >bombed government buildings or targetted the private residences or offices >of government officials, they might get more sympathy, from me at least. >Destroying an pair of buildings and killing thousands of citizens -most of >whom couldn't give an accurate account of U.S. forces distribution in the >MidEast- is not a step forward. > > _________________________________________________________________ Get fast, reliable Internet access with MSN 9 Dial-up  now 2 months FREE! http://join.msn.click-url.com/go/onm00200361ave/direct/01/ From camera_lumina at hotmail.com Tue Jul 6 07:30:09 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Tue, 06 Jul 2004 10:30:09 -0400 Subject: Tyler's Education Message-ID: Now this might matter. If there's a phone line near the surveilled computer, then no blackbag op is necessary. Thus, "fishing" is much easier. If they've got to roll the trucks, then they'll probably need to have something fairly concrete to nail you with. -TD >From: John Kelsey >Reply-To: John Kelsey >To: "J.A. Terranson" , "cypherpunks at al-qaeda.net" > >Subject: Re: Tyler's Education >Date: Tue, 6 Jul 2004 09:32:19 -0400 (GMT-04:00) > > From: "J.A. Terranson" > Sent: Jul 4, 2004 12:57 AM > To: "cypherpunks at al-qaeda.net" > Subject: Re: Tyler's Education > > Interestingly, I have had more than one report of aural acquistion of > typists keystrokes being used to attempt to calculate the content of a > short keysequence (I assume a password is what was meant by "short > keysequence"). These reports indicated "poor, but occasionally lucky > results". > >I wonder if this follows the technique used by Song, Wagner, & Tian to >attack SSH-encrypted passwords by watching keystroke timings. > > J.A. Terranson > sysadmin at mfn.org > >--John Kelsey > _________________________________________________________________ MSN Life Events gives you the tips and tools to handle the turning points in your life. http://lifeevents.msn.com From emc at artifact.psychedelic.net Tue Jul 6 11:28:41 2004 From: emc at artifact.psychedelic.net (Eric Cordian) Date: Tue, 6 Jul 2004 11:28:41 -0700 (PDT) Subject: UBL is George Washington In-Reply-To: Message-ID: <200407061828.i66ISfgE026482@artifact.psychedelic.net> Sunder wrote: > Right, WTC as a target doesn't make any strategic sense. Doesn't hitting a world financial center impede the funding of imperialism? If you apply the same standards the US uses to classify dual use infrastructure, and organizations "linked to" the enemy, I think the WTC is pretty high on the target list. The US bombed water treatment plants, electrical facilities, and bridges in Iraq. Certainly not military targets either. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" From sunder at sunder.net Tue Jul 6 10:18:50 2004 From: sunder at sunder.net (Sunder) Date: Tue, 6 Jul 2004 13:18:50 -0400 (edt) Subject: UBL is George Washington In-Reply-To: References: Message-ID: On Mon, 5 Jul 2004, Anonymous wrote: > But asymm warfare has to accomplish its goal. It's not being very > successful. The only people who are siding with al-qaeda are those whose > brains are already mush -statist socialists, to be precise. If al qaeda > bombed government buildings or targetted the private residences or offices > of government officials, they might get more sympathy, from me at least. > Destroying an pair of buildings and killing thousands of citizens -most of > whom couldn't give an accurate account of U.S. forces distribution in the > MidEast- is not a step forward. Right, WTC as a target doesn't make any strategic sense. Either they were very stupid at picking their targets, or their goals are not quite so obvious - Unless the strategy was to short-sell the stock market the day before. Did the FTC/FBI/NSA/CIA/etc find anything along these lines (yet)? I've not been paying much attention to the news as of late. From pgut001 at cs.auckland.ac.nz Mon Jul 5 18:50:35 2004 From: pgut001 at cs.auckland.ac.nz (Peter Gutmann) Date: Tue, 06 Jul 2004 13:50:35 +1200 Subject: UBL is George Washington In-Reply-To: Message-ID: Anonymous writes: >But asymm warfare has to accomplish its goal. It's not being very >successful. It's been extraordinarily successful. The US is driving itself (and a lot of the rest of the world) nuts with terrorists-under-the-beds paranoia. I recently saw a replay of some speech that Bush made shortly after 9/11 where he said something about "the terrorists wanted to demoralise? frighten? us. This has failed", and my reaction was "Who are you kidding?". The terrorists have achieved their goals, and then some. The correct response would have been what the UK did in WWII, which was "business as usual" to let the opposition know that they couldn't be intimidated. In contrast, all Bush is doing is telling them which buttons to push. Peter. From hal at finney.org Tue Jul 6 14:47:43 2004 From: hal at finney.org (Hal Finney) Date: Tue, 6 Jul 2004 14:47:43 -0700 (PDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <20040706214743.5D26657E2A@finney.org> Thomas Shaddack writes: > Reading some news about the email wiretapping by ISPs, and getting an > idea. > > There are various email forwarding services, which are nothing more than a > SMTP server with pairs of recipient at forwarder.com -- > recipient at hiscurrentisp.com. Right, mostly for use as disposable email addresses. I've used spamgourmet to good effect, myself. > Messages in storage have much lower judicial protection than messages in > transit. (This does not have much technical merit, in the current > atmosphere of "damn the laws - there are terrorists around the corner", > but can be seen as a nice little potential benefit.) One thing I haven't understood in all the commentary is whether law enforcment still needs a warrant to access emails stored in this way. Apparently the ISP can read them without any notice or liability, but what about the police? Also, what if you run your own mail spool, so the email is never stored at the ISP, it just passes through the routers controlled by the ISP (just like it passed through a dozen other routers on the internet). Does this give the ISP (and all the other router owners) the right to read your email? I don't think so, it seems like that would definitely cross over the line from "mail in storage" to "mail in transit". > There can be an easy enhancement for such forwarder service; GnuPG proxy. > Every email that arrives to the forwarder address, before it is forwarded > to the real recipient, is piped through a GnuPG script; the recipient has > then to upload his public key during the registration of the target > address, otherwise the function is the same. That's a great idea. You'd want to be sure and encrypt the whole message including headers, and make the whole thing an encrypted attachment. Has the added side benefits of compressing the email, and you could even have the server do some spam filtering. > For added benefit, the > forwarder should support SMTP/TLS (STARTTLS) extension, so the connections > from security-minded owners of their own mailservers would be protected. STARTTLS support at the proxy should pretty much go without saying these days, so you might as well do it, but if you're already PGP encrypting then it's not adding that much security. Well, maybe it does, but you're talking about a different threat. For the problem that ISPs can read your email in storage, STARTLS doesn't help much because it will only protect the email until it gets to your local ISP, who will store your email for you and can read it then (which is where the PGP comes in). Where STARTTLS would help is with power users who run their own mail servers. But those people don't suffer from the problem we are talking about here, legal access to the email by the ISP (I think, see above). Nevertheless a mail-receiving proxy that uses STARTTLS connections to power users would be kind of cool because it would keep anyone local from knowing anything about the incoming mail. Hopefully, STARTTLS will eventually become so widespread that this functionality will be redundant, but we are not there yet. > The recipient himself then can either run his own mailserver and download > mails through fetchmail, or receive mails using SMTP/ETRN (both methods > allow automated decryption of such wrapped mail during its receiving), or > use a POP/IMAP decryption proxy, or have a plugin in mail client. > > (I know, auto-decryption is dangerous, but we now talk about the system > for one's grandma, transparent to use.) Absolutely, look at the threat model. You're not worried about someone breaking into your computer, you're worried about your ISP legally reading your email. To address this threat, auto-decryption is a perfect solution. Recently there was a proposal for a nym receiving service, http://www.freehaven.net/doc/pynchon-gate/, by Bran Cohen and Len Sassaman. They have a complicated protocol for downloading email anonymously. To hide the complexity, they propose to set up a POP compatible mail server agent on the user's computer running as a daemon process (Windows service). He would configure his mailer to connect to localhost:4949 or whatever, just like any other POP server. The service would periodically go out and poll for email using the fancy protocol, but then it would make it available to the local mail agent in perfectly vanilla form. The point is that this architecture hides the complexity and makes it transparent for end users to use arbitrarily complex crypto for mail receiving. Something similar would be perfect for your idea. > The only vulnerable parts of the mail route then will be the sender's > computer, the pathway between the sender and the forwarder server (if > SMTP/TLS is not used correctly or at all), the forwarder server (if > compromised), and the recipient's computer. The way between the forwarder > and the recipient's ISP, including the recipient's mailbox, is secured. > > What do you think about this scheme? I think it's a great idea. Of course as you say there is still the problem that the forwarding server could read your email, so you have only moved the threat from the ISP to another operator. The difference I suppose is that the forwarder would be selling privacy services, hence different ones would compete to get a good reputation. Any cheating might be detected by insider whistle blowers or perhaps some kind of audit. Hal Finney From camera_lumina at hotmail.com Tue Jul 6 12:32:35 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Tue, 06 Jul 2004 15:32:35 -0400 Subject: UBL is George Washington Message-ID: >Destroying an pair of buildings and killing thousands of citizens -most of >whom couldn't give an accurate account of U.S. forces distribution in the >MidEast- is not a step forward. Well, I think that was the point. At least, Al-Qaeda was saying (amongst other things) that the US public could no longer remain ignorant of US force activities. Or at least not without significant reprecussions. It's debateable wether they acheived this, however. The Spanish got the message, however. -TD >From: Justin >To: cypherpunks at al-qaeda.net >Subject: Re: UBL is George Washington >Date: Tue, 6 Jul 2004 16:31:16 +0000 > >On 2004-07-05T21:32:16+0200, Anonymous wrote: > > Major Variola (ret) writes: > > > The yanks did not wear regular uniforms and did not march in > > > rows in open fields like Gentlemen. Asymmetric warfare means not > > > playing by > > > *their* rules. > > > > But asymm warfare has to accomplish its goal. It's not being very > > successful. The only people who are siding with al-qaeda are those >whose > > brains are already mush -statist socialists, to be precise. If al qaeda > >Who cares who sides with Al Qaeda? They're not keeping track of their >sympathizers. It's foreign policy change, social change ("reform" >perhaps?), and volunteers for martyrdom they want, not rhetorical >support. > > > bombed government buildings or targetted the private residences or >offices > > of government officials, they might get more sympathy, from me at least. > >The WTC and the pentagon were specific, well-thought-out targets. The >plane that crashed in PA was headed to the Capitol. If you're so eager >to see Al Qaeda blow up better targets, why not suggest a few? > > > Destroying an pair of buildings and killing thousands of citizens -most >of > > whom couldn't give an accurate account of U.S. forces distribution in >the > > MidEast- is not a step forward. > >As everyone else pointed out, Even though the 9/11 attacks may not have >garnered your support, it accomplished other objectives. > _________________________________________________________________ Check out the latest news, polls and tools in the MSN 2004 Election Guide! http://special.msn.com/msn/election2004.armx From justin-cypherpunks at soze.net Tue Jul 6 09:31:16 2004 From: justin-cypherpunks at soze.net (Justin) Date: Tue, 6 Jul 2004 16:31:16 +0000 Subject: UBL is George Washington In-Reply-To: References: <40E8FCEA.95B97E72@cdc.gov> Message-ID: <20040706163116.GA20941@arion.soze.net> On 2004-07-05T21:32:16+0200, Anonymous wrote: > Major Variola (ret) writes: > > The yanks did not wear regular uniforms and did not march in > > rows in open fields like Gentlemen. Asymmetric warfare means not > > playing by > > *their* rules. > > But asymm warfare has to accomplish its goal. It's not being very > successful. The only people who are siding with al-qaeda are those whose > brains are already mush -statist socialists, to be precise. If al qaeda Who cares who sides with Al Qaeda? They're not keeping track of their sympathizers. It's foreign policy change, social change ("reform" perhaps?), and volunteers for martyrdom they want, not rhetorical support. > bombed government buildings or targetted the private residences or offices > of government officials, they might get more sympathy, from me at least. The WTC and the pentagon were specific, well-thought-out targets. The plane that crashed in PA was headed to the Capitol. If you're so eager to see Al Qaeda blow up better targets, why not suggest a few? > Destroying an pair of buildings and killing thousands of citizens -most of > whom couldn't give an accurate account of U.S. forces distribution in the > MidEast- is not a step forward. As everyone else pointed out, Even though the 9/11 attacks may not have garnered your support, it accomplished other objectives. From die at dieconsulting.com Tue Jul 6 14:12:24 2004 From: die at dieconsulting.com (Dave Emery) Date: Tue, 6 Jul 2004 17:12:24 -0400 Subject: Switzerland forcing registration of PrePay customers Message-ID: <20040706211224.GC11097@pig.dieconsulting.com> ----- Forwarded message from NEXTEL-1 ---- - ------------------------------ Switzerland forcing registration of PrePay customers The Swiss parliament decided last year to make registration mandatory for prepaid cards. By law, all mobile providers will have be able to provide information about customers buying their prepaid products for at least two years after the purchase. As of 1 July 2004, customers will have to register when buying a prepaid card from Swisscom Mobile (NATEL easy). Those who started using their NATEL easy cards on or after 1 November 2002 will have to register retrospectively. The authorities are aiming to limit the misuse of prepaid cards by these measures. Customers will be registered when they buy a NATEL easy SIM card. For verification, proof of identity will be required in the form of a valid passport, identity card or other travel document accepted for entry into Switzerland. In addition to the customer's personal details, Swisscom Mobile must also record the type of and number of the form of identification presented. The NATEL easy card will only be activated for use when all the necessary customer details have been recorded. Customers attempting to make calls with an unregistered prepaid card will hear a greeting prompting them to register their NATEL easy card. Retrospective registration until end of October 2004 On 23 June 2004, the Federal Council decided that prepaid customers who started using SIM cards on or after 1 November 2002 would have until 31 October 2004 to register. Swisscom Mobile will seek to ensure that the registration of these customers takes place in line with the statutory requirements and in as customer-friendly a manner as possible. The customers affected will be prompted via SMS to register their SIM cards. Registration can be made wherever Swisscom Mobile NATEL subscriptions can be purchased. In addition to the customers' personal details, Swisscom Mobile will also have to record their SIM card and mobile phone numbers. In accordance with the regulation, Swisscom Mobile will be obliged to block the access of customers who have not registered by 31 October 2004. Retrospective registration also applies to those prepaid customers who have already registered voluntarily with Swisscom Mobile in the past. The only exceptions are NATEL. easy customers who have registered formally (i.e. on presentation of a valid passport or identity card) in a Swisscom Shop since the middle of April 2004. On the basis of current information, Swisscom Mobile believes that several hundred thousand NATEL easy customers will have to register retrospectively. Posted to the site on 05-Jul-04 http://www.cellular-news.com/story/11407.shtml -- Dave Emery N1PRE, die at dieconsulting.com DIE Consulting, Weston, Mass 02493 From mv at cdc.gov Tue Jul 6 18:44:35 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 06 Jul 2004 18:44:35 -0700 Subject: UBL is George Washington Message-ID: <40EB5583.BBD1764A@cdc.gov> At 09:32 PM 7/5/04 +0200, Anonymous wrote: >Major Variola (ret) writes: >> >> The yanks did not wear regular uniforms and did not march in >> rows in open fields like Gentlemen. Asymmetric warfare means not >> playing by >> *their* rules. > >But asymm warfare has to accomplish its goal. It's not being very >successful. Worked for Gen W. The only people who are siding with al-qaeda are those whose >brains are already mush -statist socialists, to be precise. Of course their brains are mush, they are *religious*. Much like the xian loonies in DC "God, we pray that our actions here give some glory back to you. We live in grace even here, and we are not afraid of death. ... None of us wants to die here, but death is the blink of an eye, and you wake up in paradise." US Navy Chaplain Wayne Hall http://msnbc.msn.com/id/4717595/ But you get better post-mortem sex if you're Muslim. If al qaeda >bombed government buildings or targetted the private residences or offices >of government officials, they might get more sympathy, from me at least. >Destroying an pair of buildings and killing thousands of citizens -most of >whom couldn't give an accurate account of U.S. forces distribution in the >MidEast- is not a step forward. They are not after sympathy, they are after your attention. As in, "don't tread on me". As in, "get your filthy hands off my desert". As in, death to the Romans. The pentagon hit was apropos, but the pilot hit the wrong side. Still, nice taking it home like that. Not even UBL, who knows civil engineering, expected a pair of implosions. The pigs, fireman, civilians, etc were collateral damage --the point was the video. But architects have to show off, so down they went. Live and learn. But the replacement will be taller, a tower of Babel. More targets: soft targets with videocameras. Disneyland, Olympics, and of course kindergartens on days when parents would be there with cameras. Synchronized of course, so you have zero doubt who it was. Although they're religious, they know engineering and psyops as well as the xian loony hegemonists in DC. Basically its like this: even neighborhood bullies have to sleep. A wimp with a gallon of gasoline can make a point. David & Goliath, remember? All's fair in love and war, baby. From measl at mfn.org Tue Jul 6 16:59:22 2004 From: measl at mfn.org (J.A. Terranson) Date: Tue, 6 Jul 2004 18:59:22 -0500 (CDT) Subject: UBL is George Washington In-Reply-To: <20040706204453.GA22279@arion.soze.net> References: <200407061828.i66ISfgE026482@artifact.psychedelic.net> <20040706204453.GA22279@arion.soze.net> Message-ID: <20040706185535.U3309@ubzr.zsa.bet> On Tue, 6 Jul 2004, Justin wrote: > On 2004-07-06T11:28:41-0700, Eric Cordian wrote: > > Sunder wrote: > > > Right, WTC as a target doesn't make any strategic sense. > > > Doesn't hitting a world financial center impede the funding of imperialism? > > Empirically, I don't think so. Since September 11th, funding to the > military and security industries have increased substantially through > DHS and military contracts. It may be that the only way out is through, > and that the only way to be free from Western Imperialism is to cause it > to strangle itself. Precisely. They are doing to us what we did to the soviets: they making us spend ourselves right out of existence. > In the short term, however, terrorists have not > succeeded in getting our imperialist policies changed. > > 9/11 with Dubya at the helm can have only one result. Dubya at the helm can have only 1 result. 9/11 was just his cover. > > If you apply the same standards the US uses to classify dual use > > infrastructure, and organizations "linked to" the enemy, I think the > > WTC is pretty high on the target list. > > Yep. Even ignoring specific entities that officed in the WTC, it was an > effective target. When a government is in debt 70%+ of the GDP (2002 - > $10.4T), there's little distinction between private financial targets > and government targets. And this was a prime target. Financial disruption from *just* the tower collapses was significant across the economy as a whole: lost records, insurance claims, lawsuits, etc., exacted a very substantial loss against their enemy. > > The US bombed water treatment plants, electrical facilities, and > > bridges in Iraq. Certainly not military targets either. > > Each democratic government likes to flood the logos with the notion that > it only attacks military targets; it convinces citizens that their > government is humane, and helps to pacify the non-interventionists. > > In practice, intelligence is never accurate. Hitting only military > targets, even if that were the goal which is clearly not the case -- is > not possible. Nonetheless, the military *does* consider places like WTC to be legitimate *military* targets. -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From justin-cypherpunks at soze.net Tue Jul 6 13:44:53 2004 From: justin-cypherpunks at soze.net (Justin) Date: Tue, 6 Jul 2004 20:44:53 +0000 Subject: UBL is George Washington In-Reply-To: <200407061828.i66ISfgE026482@artifact.psychedelic.net> References: <200407061828.i66ISfgE026482@artifact.psychedelic.net> Message-ID: <20040706204453.GA22279@arion.soze.net> On 2004-07-06T11:28:41-0700, Eric Cordian wrote: > Sunder wrote: > > Right, WTC as a target doesn't make any strategic sense. > Doesn't hitting a world financial center impede the funding of imperialism? Empirically, I don't think so. Since September 11th, funding to the military and security industries have increased substantially through DHS and military contracts. It may be that the only way out is through, and that the only way to be free from Western Imperialism is to cause it to strangle itself. In the short term, however, terrorists have not succeeded in getting our imperialist policies changed. 9/11 with Dubya at the helm can have only one result. > If you apply the same standards the US uses to classify dual use > infrastructure, and organizations "linked to" the enemy, I think the > WTC is pretty high on the target list. Yep. Even ignoring specific entities that officed in the WTC, it was an effective target. When a government is in debt 70%+ of the GDP (2002 - $10.4T), there's little distinction between private financial targets and government targets. > The US bombed water treatment plants, electrical facilities, and > bridges in Iraq. Certainly not military targets either. Each democratic government likes to flood the logos with the notion that it only attacks military targets; it convinces citizens that their government is humane, and helps to pacify the non-interventionists. In practice, intelligence is never accurate. Hitting only military targets, even if that were the goal which is clearly not the case -- is not possible. A stated policy of attacking only military targets encourages the use of human shields by the enemy, which in turn drives up the "civilian casualties" decried so strongly by the media. -- "Once you knew, you'd claim her, and I didn't want that." "Not your decision to make." "Yes, but it's the right decision, and I made it for my daughter. She deserved to be born with a clean slate." - Beatrix; Bill; Kill Bill V.2 From mv at cdc.gov Tue Jul 6 21:36:16 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 06 Jul 2004 21:36:16 -0700 Subject: UBL is George Washington Message-ID: <40EB7DC0.8631F772@cdc.gov> At 08:44 PM 7/6/04 +0000, Justin wrote: It may be that the only way out is through, >and that the only way to be free from Western Imperialism is to cause it >to strangle itself. You don't get it. The way to be free from Colonialists is to remind the folks *behind the Colonialism* that they are not immune just because they are bordered by oceans and 0wn3d northern and southern placid colonies. UBL understands democracy better than most. Strangling has nothing to do with it; Tim May used to encourage such self-suffication, but that's not the Jihad plan. The plan is to provide negative reinforcement. How do you say that in Spanish? From camera_lumina at hotmail.com Tue Jul 6 18:37:48 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Tue, 06 Jul 2004 21:37:48 -0400 Subject: UBL is George Washington Message-ID: "And this was a prime target. Financial disruption from *just* the tower collapses was significant across the economy as a whole: lost records, insurance claims, lawsuits, etc., exacted a very substantial loss against their enemy." That was nothing compared to the real damage, which I've heard few people point out. There was a telecom CO in (I think) #4 World Trade Center, and falling debris took the giant Verizon CO across the street on West Street offline for almost a week. The result was that Wall Street was basically cut off for several days...the effect of that dwarfs all the other stuff. (Although I wonder...Pipar Jaffrey was pretty much wiped out. Even if the records survived, they lost so much manpower that might have actually had a small but worldwide impact.) Of course, I truly doubt OBL & his posse realized this when they targeted the WTC (and the fact that they continue to pretty much ignore relatively ungarded COs shows they still don't realize this). If they took out a few key COs downtown one morning the effect on the economy would be significant. >From: "J.A. Terranson" >To: Justin >CC: cypherpunks at minder.net >Subject: Re: UBL is George Washington >Date: Tue, 6 Jul 2004 18:59:22 -0500 (CDT) > > >On Tue, 6 Jul 2004, Justin wrote: > > > On 2004-07-06T11:28:41-0700, Eric Cordian wrote: > > > Sunder wrote: > > > > Right, WTC as a target doesn't make any strategic sense. > > > > > Doesn't hitting a world financial center impede the funding of >imperialism? > > > > Empirically, I don't think so. Since September 11th, funding to the > > military and security industries have increased substantially through > > DHS and military contracts. It may be that the only way out is through, > > and that the only way to be free from Western Imperialism is to cause it > > to strangle itself. > >Precisely. They are doing to us what we did to the soviets: they making >us spend ourselves right out of existence. > > > In the short term, however, terrorists have not > > succeeded in getting our imperialist policies changed. > > > > 9/11 with Dubya at the helm can have only one result. > >Dubya at the helm can have only 1 result. 9/11 was just his cover. > > > > > If you apply the same standards the US uses to classify dual use > > > infrastructure, and organizations "linked to" the enemy, I think the > > > WTC is pretty high on the target list. > > > > Yep. Even ignoring specific entities that officed in the WTC, it was an > > effective target. When a government is in debt 70%+ of the GDP (2002 - > > $10.4T), there's little distinction between private financial targets > > and government targets. > >And this was a prime target. Financial disruption from *just* the tower >collapses was significant across the economy as a whole: lost records, >insurance claims, lawsuits, etc., exacted a very substantial loss against >their enemy. > > > > > The US bombed water treatment plants, electrical facilities, and > > > bridges in Iraq. Certainly not military targets either. > > > > Each democratic government likes to flood the logos with the notion that > > it only attacks military targets; it convinces citizens that their > > government is humane, and helps to pacify the non-interventionists. > > > > In practice, intelligence is never accurate. Hitting only military > > targets, even if that were the goal which is clearly not the case -- is > > not possible. > >Nonetheless, the military *does* consider places like WTC to be legitimate >*military* targets. > >-- >Yours, > >J.A. Terranson >sysadmin at mfn.org > > "...justice is a duty towards those whom you love and those whom you do > not. And people's rights will not be harmed if the opponent speaks out > about them." > > Osama Bin Laden > > > _________________________________________________________________ Is your PC infected? Get a FREE online computer virus scan from McAfee. Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 From mv at cdc.gov Tue Jul 6 21:40:29 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 06 Jul 2004 21:40:29 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40EB7EBC.C0EBF864@cdc.gov> At 02:47 PM 7/6/04 -0700, Hal Finney wrote: >> Messages in storage have much lower judicial protection than messages in >> transit. (This does not have much technical merit, in the current >> atmosphere of "damn the laws - there are terrorists around the corner", >> but can be seen as a nice little potential benefit.) Ie zero. >One thing I haven't understood in all the commentary is whether law >enforcment still needs a warrant to access emails stored in this way. >Apparently the ISP can read them without any notice or liability, but >what about the police? You are state meat, whether 5150'd or not. >Also, what if you run your own mail spool, so the email is never stored >at the ISP, it just passes through the routers controlled by the ISP >(just like it passed through a dozen other routers on the internet). >Does this give the ISP (and all the other router owners) the right to >read your email? I don't think so, it seems like that would definitely >cross over the line from "mail in storage" to "mail in transit". If you think the cable landings in Va/Md are coincidental, you are smoking something I've run out of. Its all recorded. I'm sure the archiving and database groups in Ft. Meade will get a chuckle out of your "the right to" idioms. From mv at cdc.gov Tue Jul 6 21:44:29 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 06 Jul 2004 21:44:29 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40EB7FAD.873694B6@cdc.gov> >> Absolutely, look at the threat model. You're not worried about someone >> breaking into your computer, you're worried about your ISP legally >> reading your email. Guaranteed, and encryption is bait. Use stego. >That's very true, however there can be operators you trust more than your >ISP, eg. a group of friends running such forwarder offshore. Until they're busted and open up... As Zappa sang, the hot iron sausage... and the sinister midget... From mv at cdc.gov Tue Jul 6 22:00:26 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 06 Jul 2004 22:00:26 -0700 Subject: Privacy laws and social engineering Message-ID: <40EB836A.576CFDC0@cdc.gov> A friend of mine botched a suicide attempt and in order to get any info I (we) pretended we were stepbrothers. It occurred to me a half hour later that we had the same first names. So it must have been confusing to our fictious stepmom :-) But if you play up a story about dysfunctional separated families, and adopting middle names as True Names, you can quickly get the questioner to feel uncomfortable enough to accept your ploy. Despite HIPAA. Welcome to the world of social engineering, Major. So, which is better, Schneier's books or Mitnick's? I suspect the former, but am curious what the community opinion is? Note that I am generally a guile-less person who does not weave arbitrarily complex webs of lies. In fact, brutally honest at times. But sometimes circumstances (like a brain damaged virtual brother) demand it. And I was bemused at my ability to maintain it. And multiple nurses/MDs to accept it. ------- While interviewing for a security job, I overheard the building-guards shout passwords for the building as I waited in the lobby. I thought it a test at first, but realized later it was reality, in all its glory. The passwords were regexps based on the company's name, of course. I mentioned this to my future quasiboss, who dug it. Which made me feel better about him. PS: Major kiratsu do not appreciate extreme programming (or keeping the building open past 8PM). Dinosaurs whose eggs were eaten by warm furry little mutants did not do so well. Though aligators eat a few kids a year in FLA, and an ostrich can kick your ass, I ask you: who rules, mammals or reptiles and birds? Still, its a job, and a job these days is a pearl, even if the tech is succeptible to reverse engineering, which you try to point out but are told its ok to be lame. Maybe they'll hire me after the contract and we can do some PK/cert work for real. Or maybe they'll move strong passphrases around with PGP email. One can hope, if only to keep one's upper lip stiff, one's faith in mankind nominally intact. Hard sometimes. PS: what is Michael Jackson's medical report worth in the free market? From bill.stewart at pobox.com Tue Jul 6 22:35:56 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Tue, 06 Jul 2004 22:35:56 -0700 Subject: UBL is George Washington In-Reply-To: References: Message-ID: <6.0.3.0.0.20040706220843.044a1bf8@pop.idiom.com> Somebody wrote > WTC doesn't make sense as a target Everybody I knew was _much_ more upset about the WTC than the Pentagon. As one friend put it "I don't care about the Pentagon." Now, partly that's because of the shock of the buildings collapsing, which seemed much more dramatic than the Pentagon getting an edge dented. And it's partly because 3000 people died, and 30,000 _could_ have died, but a lot of it's because attacking New York City is attacking American society, which was tremendously damaging to morale, while attacking the Pentagon is attacking the military, who spend their time attacking other people so all's fair. And the Feds planting anthrax in the Senate building and other places to keep us even more scared about terrorism so we'd be obedient really did make things worse. >"Tyler Durden" writes: > >If they took out a few key COs downtown one morning the effect on the > economy > >would be significant. The effects on American business were dramatic, but for the telecommunications industry the big problems weren't the COs, they were the year-long disappearance of the travel industry (which uses huge amounts of high-value call center calls) and the general decline in the economy, and trashing business in Wall Street, plus it was kicking us while were were down because the dot-com crash and the related crash in the telecom industry were already going on. The loss of the CO capacity was somewhat balanced by the fact that nobody was allowed anywhere near that area to work. The Verizon CO was much more of a problem than the AT&T one, partly because it had lots of access lines, while we mostly had a smaller number of larger trunks that are easier to reroute, plus fiber access rings which were mostly diverse, plus all the now-dead access lines from the Verizon POP. Industry did respond with a huge amount of diversification - taking out a CO today would cause much less damage, plus the huge increase in telecommuting means that offices are usually a less critical resource. At 07:42 PM 7/6/2004, Peter Gutmann wrote: >If OBL took out (say) that huge AT&T CO in the center of Manhattan >(the skyscraper that looks like something out of a SF film), Do you mean the building that looks like antique furniture? That's just office space, and I think we'd sold it by then. Or does one of the actual POPs have old microwave dishes on the roof? >every cellphone user in the country who's had any dealings with AT&T >would help him pack the explosives. Sigh. We've sold off AT&T Wireless as a business and still nobody realizes it... I think they were still relatively popular back then, though they had real problems around New York City keeping up with rapidly-growing demand. But yeah, the best thing about them these days is that Cingular's buying them, so my stock has zoomed up to almost half what I paid for it instead of 10-20%. ---- Bill Stewart bill.stewart at pobox.com From shaddack at ns.arachne.cz Tue Jul 6 14:15:06 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Tue, 6 Jul 2004 23:15:06 +0200 (CEST) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <0407062304530.-1275484700@somehost.domainz.com> Reading some news about the email wiretapping by ISPs, and getting an idea. There are various email forwarding services, which are nothing more than a SMTP server with pairs of recipient at forwarder.com -- recipient at hiscurrentisp.com. Messages in storage have much lower judicial protection than messages in transit. (This does not have much technical merit, in the current atmosphere of "damn the laws - there are terrorists around the corner", but can be seen as a nice little potential benefit.) There can be an easy enhancement for such forwarder service; GnuPG proxy. Every email that arrives to the forwarder address, before it is forwarded to the real recipient, is piped through a GnuPG script; the recipient has then to upload his public key during the registration of the target address, otherwise the function is the same. For added benefit, the forwarder should support SMTP/TLS (STARTTLS) extension, so the connections from security-minded owners of their own mailservers would be protected. The recipient himself then can either run his own mailserver and download mails through fetchmail, or receive mails using SMTP/ETRN (both methods allow automated decryption of such wrapped mail during its receiving), or use a POP/IMAP decryption proxy, or have a plugin in mail client. (I know, auto-decryption is dangerous, but we now talk about the system for one's grandma, transparent to use.) The only vulnerable parts of the mail route then will be the sender's computer, the pathway between the sender and the forwarder server (if SMTP/TLS is not used correctly or at all), the forwarder server (if compromised), and the recipient's computer. The way between the forwarder and the recipient's ISP, including the recipient's mailbox, is secured. What do you think about this scheme? From mv at cdc.gov Tue Jul 6 23:36:11 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 06 Jul 2004 23:36:11 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40EB99DB.5D771034@cdc.gov> At 06:58 AM 7/7/04 +0200, Eugen Leitl wrote: >I can't imagine any intelligence professional wasting her time reading >the crap at times coming over this list. Frankly sir, that's because you have no idea of their budget, or their fascistic urges. Its not paranoia to think you're tapped, its rationality. ------- "Stop shedding our blood to save your own and the solution to this simple but complex equation is in your hands. You know matters will escalate the more you delay and then do not blame us but blame yourselves. Rational people do not risk their security, money and sons to appease the White House liar." From mv at cdc.gov Tue Jul 6 23:43:27 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 06 Jul 2004 23:43:27 -0700 Subject: Privacy laws and social engineering Message-ID: <40EB9B8F.219883EE@cdc.gov> At 08:10 AM 7/7/04 +0200, Thomas Shaddack wrote: >On Tue, 6 Jul 2004, Major Variola (ret) wrote: > >> So, which is better, Schneier's books or Mitnick's? I suspect >> the former, but am curious what the community opinion is? > >You may like one side of the coin more than the other one, but they still >belong to the same flat, dirty, formerly shiny and now dull and mildly >corroded disc of an alloy of not so noble metals. .... >I feel zen today. You have no idea how Zen I have felt recently. No idea. As BS says, you go after people, not tech, these days. I was merely asking where I should spend my $, whether Mitnick was worth it, as Schneier by default is. Or what the hell, maybe my contract will become a job, and I'll buy 'em all. Meanwhile, watch your ass, the marketroids are full of detritus. And if you take cyanide salts, you dont' tell anyone about it. From bill.stewart at pobox.com Wed Jul 7 01:11:58 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Wed, 07 Jul 2004 01:11:58 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040706214743.5D26657E2A@finney.org> References: <20040706214743.5D26657E2A@finney.org> Message-ID: <6.0.3.0.0.20040706223732.044b3030@pop.idiom.com> At 02:47 PM 7/6/2004, Hal Finney wrote: >Thomas Shaddack writes: > > There are various email forwarding services, which are nothing more than a > > SMTP server with pairs of recipient at forwarder.com -- > > recipient at hiscurrentisp.com. > >Right, mostly for use as disposable email addresses. >I've used spamgourmet to good effect, myself. They're also marketed as permanent addresses you can keep when you change ISPs, for example pobox.com was one of the first ones. Unfortunately, as far as I know, none of the forwarders let you forward mail from recipient+tag at forwarder.com to recipient+tag at currentISP.com, which means that they don't support tag-based spam protection. When I want disposable addresses, I either use free providers, or I use tagged addresses at free / cheap providers like fastmail.fm. >One thing I haven't understood in all the commentary is whether law >enforcment still needs a warrant to access emails stored in this way. >Apparently the ISP can read them without any notice or liability, but >what about the police? Councilman currently only affects the First Circuit (the Northeast), and it was only the three-judge-panel version of the Appeals Court, so he could appeal it to the full court before going to the Supremes. My reading of the opinions is that the two majority judges totally failed to grasp the technology, while the dissenting judge got it, so even if the opinion stands, it's very narrow in scope - but it's a strong reminder that the current laws don't protect stored email very well, and that if judges aren't technical enough to understand it when it's laid out in front of their faces, they're certainly not going to be sufficiently uncooperative when police try to get warrants or subpoenas (or at least it probably won't be hard for police to find a cooperative judge.) Also, in the Steve Jackson Games case, the courts and Feds got away with declaring that the ECPA didn't apply to mail that had arrived in mailboxes, only to mail that was in transit. It's not clear that ISPs in general can read mail without any notice or liability - just that the obvious readings of the law that Councilman sued them under don't currently work in the 1st Circuit. He might have tried various business-related torts successfully, but the wiretapping laws looked like a slam-dunk. But that doesn't usually work against police, just businesses. Police reading mail like this really is a different case - they either need some kind of court papers to hand the ISP (though these days the Patriot Act seems to be used to justify almost anything and place a gag order on the activity, and a subpoena is easier to get than a warrant), or they need some bogus justification that the ISP has to obey "administrative requests" that aren't court-issued, or they need to wiretap the bits legally. >Also, what if you run your own mail spool, so the email is never stored >at the ISP, it just passes through the routers controlled by the ISP >(just like it passed through a dozen other routers on the internet). >Does this give the ISP (and all the other router owners) the right to >read your email? I don't think so, it seems like that would definitely >cross over the line from "mail in storage" to "mail in transit". One scary thing about Councilman was that it happened in a case where the government was vaguely neutral and responsible for protecting the citizen's privacy - when the prosecutors are _trying_ to get outrageously twisted anti-privacy rulings they're more likely to win. In particular, does a message count as "in transit" if you're only hauling IP packets around with parts of the message rather than the whole message, or does each part count as "in storage" when it's gotten to a router that has to queue it before forwarding it on to the next hop? Or if the whole message is queued in your ISP's sendmail queue because you've got an MX there? What about _outgoing_ mail queued at your ISP, who's being a good anti-spammer and forcing you to use their mail transfer agent instead of sending directly to the destination? > > There can be an easy enhancement for such forwarder service; GnuPG proxy. There are several different threat models to think about - - Greedy ISP reading your mail for their own purposes - ISP responding to court-ordered wiretapping - ISP collaborating enthusiastically with police - Police wiretapping without court orders - All of the above, but for stored mailboxes, not in-transit - All of the above, but for traffic analysis / headers, not content Mail-handling services don't prevent any of the in-transit threats, but they can eliminate most of the threats to stored mailboxes, and they do let you move your vulnerability to a different jurisdiction, which can potentially reduce the likelihood that they'll wiretap you there. For instance, if you're using your local cable modem company for mailbox services, and you annoy your local police, they may try to tap you, but police in Anguilla will probably only try to tap you if you've gotten the US Feds or MI5/MI6 annoyed. Police in Sealand might not respond to wiretaps at all, but any unencrypted mail going there would have been watched closely. Spooks in the UK proper might wiretap you as a favor to the US spooks, and data privacy laws might or might not apply if you're a non-subject. Google's Gmail is an interesting case. Unlike Councilman's ISP, who were sneaky greedy wiretapping bums, Google tells you that they'll grep your mail for advertising material, and tells you how much of that they'll leak to the advertisers and makes you some promises not to leak more. The data's just sitting there waiting for a subpoena, and there's not much point in having it all encrypted because the cool features of Gmail aren't much use on cyphertext. > > For added benefit, the > > forwarder should support SMTP/TLS (STARTTLS) extension, so the connections > > from security-minded owners of their own mailservers would be protected. > >STARTTLS support at the proxy should pretty much go without saying these >days, so you might as well do it, but if you're already PGP encrypting >then it's not adding that much security. Well, maybe it does, but you're >talking about a different threat. STARTTLS is helpful because it can protect mail from the sender's ISP. Almost by definition, that's unencrypted mail, because otherwise you wouldn't be so worried about it getting tapped. >I think it's a great idea. Of course as you say there is still the >problem that the forwarding server could read your email, so you have >only moved the threat from the ISP to another operator. The difference >I suppose is that the forwarder would be selling privacy services, hence >different ones would compete to get a good reputation. Any cheating might >be detected by insider whistle blowers or perhaps some kind of audit. It might. Unless of course the service is really run by narcs. ---- Bill Stewart bill.stewart at pobox.com From shaddack at ns.arachne.cz Tue Jul 6 17:01:17 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Wed, 7 Jul 2004 02:01:17 +0200 (CEST) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040706214743.5D26657E2A@finney.org> References: <20040706214743.5D26657E2A@finney.org> Message-ID: <0407070103310.9699@somehost.domainz.com> On Tue, 6 Jul 2004, Hal Finney wrote: > > There are various email forwarding services, which are nothing more than a > > SMTP server with pairs of recipient at forwarder.com -- > > recipient at hiscurrentisp.com. > > Right, mostly for use as disposable email addresses. I've used > spamgourmet to good effect, myself. I wrote the patch for qmail's fastforward for similar purposes. Everything in the name that is beyond the specified wildcard is ignored when resolving the mail alias (but stays there for procmail processing). As added benefit, the addresses that receive spam can be used for teaching bogofilter. > > Messages in storage have much lower judicial protection than messages in > > transit. (This does not have much technical merit, in the current > > atmosphere of "damn the laws - there are terrorists around the corner", > > but can be seen as a nice little potential benefit.) > > One thing I haven't understood in all the commentary is whether law > enforcment still needs a warrant to access emails stored in this way. > Apparently the ISP can read them without any notice or liability, but > what about the police? Let's expect them so as well. The ISP can hand them over to the police anyway, like a nosy neighbour fink finding your grass stash. > Also, what if you run your own mail spool, so the email is never stored > at the ISP, it just passes through the routers controlled by the ISP > (just like it passed through a dozen other routers on the internet). > Does this give the ISP (and all the other router owners) the right to > read your email? I don't think so, it seems like that would definitely > cross over the line from "mail in storage" to "mail in transit". If it passes through their SMTP servers, I am not sure. If it goes only through their routers, I'd think it's definitely in transit. > > There can be an easy enhancement for such forwarder service; GnuPG proxy. > > Every email that arrives to the forwarder address, before it is forwarded > > to the real recipient, is piped through a GnuPG script; the recipient has > > then to upload his public key during the registration of the target > > address, otherwise the function is the same. > > That's a great idea. You'd want to be sure and encrypt the whole message > including headers, and make the whole thing an encrypted attachment. > Has the added side benefits of compressing the email, and you could even > have the server do some spam filtering. The original idea I based it on was encrypting everything including the headers on the sender, then decrypting it on the receiver relay, and adding the data about the decryption of the message into the headers in some unspoofable way (eg. if the headers were there already when the message arrived to the decrypting script, prepend X- to them - not really bulletproof but rather decent). > > For added benefit, the forwarder should support SMTP/TLS (STARTTLS) > > extension, so the connections from security-minded owners of their own > > mailservers would be protected. > > STARTTLS support at the proxy should pretty much go without saying these > days, so you might as well do it, but if you're already PGP encrypting > then it's not adding that much security. Well, maybe it does, but you're > talking about a different threat. It hides the fact encrypted comm is in use. Which may be handy on its own. > For the problem that ISPs can read your email in storage, STARTLS > doesn't help much because it will only protect the email until it gets > to your local ISP, who will store your email for you and can read it > then (which is where the PGP comes in). That's true. But it protects the data in transit nearly for free. > Where STARTTLS would help is with power users who run their own mail > servers. But those people don't suffer from the problem we are talking > about here, legal access to the email by the ISP (I think, see above). > Nevertheless a mail-receiving proxy that uses STARTTLS connections to > power users would be kind of cool because it would keep anyone local > from knowing anything about the incoming mail. Hopefully, STARTTLS will > eventually become so widespread that this functionality will be redundant, > but we are not there yet. STARTTLS is by far not widespread. Few people use it, including the knowledgeable ones. :((( > > (I know, auto-decryption is dangerous, but we now talk about the system > > for one's grandma, transparent to use.) > > Absolutely, look at the threat model. You're not worried about someone > breaking into your computer, you're worried about your ISP legally > reading your email. To address this threat, auto-decryption is a > perfect solution. It's always better to select overly restrictive threat model and then loose it when necessary, than the other way. An omission then results in more work instead of a security hole. > He would configure his mailer to connect to localhost:4949 or whatever, > just like any other POP server. With a local SMTP server, you can run such service as a daemon (or from cron) with function similar to fetchmail. Whatever is downloaded is fed to local mail delivery. > The service would periodically go out and poll for email using the fancy > protocol, but then it would make it available to the local mail agent in > perfectly vanilla form. The point is that this architecture hides the > complexity and makes it transparent for end users to use arbitrarily > complex crypto for mail receiving. Something similar would be perfect > for your idea. Proxies rock :) I designed the idea with procmail and sendmail/qmail in mind. Didn't think much about Windows, as it's a pain to develop for them, but it shouldn't be too difficult to port it. > > What do you think about this scheme? > > I think it's a great idea. Of course as you say there is still the > problem that the forwarding server could read your email, so you have > only moved the threat from the ISP to another operator. That's very true, however there can be operators you trust more than your ISP, eg. a group of friends running such forwarder offshore. Especially if your ISP is untrustful or restrictive, eg. an university, a bigger corporation, or anything with a potential for nosing or censoring. > The difference I suppose is that the forwarder would be selling privacy > services, hence different ones would compete to get a good reputation. > Any cheating might be detected by insider whistle blowers or perhaps > some kind of audit. I didn't think about it as a sellable thing, though it's definitely possible. Instead of several paid services I thought more along the lines of thousands little servers for a handful of people each. But it's pretty likely to be marketable. The key here is low resource requirements and low cost of operation - which a combo of a small SMTP server and procmail could meet pretty well. From eugen at leitl.org Tue Jul 6 21:58:08 2004 From: eugen at leitl.org (Eugen Leitl) Date: Wed, 7 Jul 2004 06:58:08 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40EB7EBC.C0EBF864@cdc.gov> References: <40EB7EBC.C0EBF864@cdc.gov> Message-ID: <20040707045807.GS1141@leitl.org> On Tue, Jul 06, 2004 at 09:40:29PM -0700, Major Variola (ret) wrote: > smoking something I've run out of. Its all recorded. I'm sure the > archiving > and database groups in Ft. Meade will get a chuckle out of your > "the right to" idioms. All this stuff goes into some database slot. It will only get reviewed by a human analyst if the ranking function trips over threshold (or reviewed forensically after the fact). I can't imagine any intelligence professional wasting her time reading the crap at times coming over this list. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From shaddack at ns.arachne.cz Tue Jul 6 23:10:53 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Wed, 7 Jul 2004 08:10:53 +0200 (CEST) Subject: Privacy laws and social engineering In-Reply-To: <40EB836A.576CFDC0@cdc.gov> References: <40EB836A.576CFDC0@cdc.gov> Message-ID: <0407070800230.9709@somehost.domainz.com> On Tue, 6 Jul 2004, Major Variola (ret) wrote: > So, which is better, Schneier's books or Mitnick's? I suspect > the former, but am curious what the community opinion is? You may like one side of the coin more than the other one, but they still belong to the same flat, dirty, formerly shiny and now dull and mildly corroded disc of an alloy of not so noble metals. Sometimes you get access by telnet. Sometimes by a voice call. Hack the mainframe. Hack the secretary. What's better? (Okay, I agree, you can't sleep with the mainframe.) There are many ways to the hilltop. Some travelers argue what one is better. Others quarrel if the hilltop is more important than the pathway or the other way. Some don't care and march forward. I feel zen today. From eugen at leitl.org Wed Jul 7 00:03:36 2004 From: eugen at leitl.org (Eugen Leitl) Date: Wed, 7 Jul 2004 09:03:36 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40EB99DB.5D771034@cdc.gov> References: <40EB99DB.5D771034@cdc.gov> Message-ID: <20040707070336.GA1141@leitl.org> On Tue, Jul 06, 2004 at 11:36:11PM -0700, Major Variola (ret) wrote: > At 06:58 AM 7/7/04 +0200, Eugen Leitl wrote: > >I can't imagine any intelligence professional wasting her time reading > >the crap at times coming over this list. > > Frankly sir, that's because you have no idea of their budget, > or their fascistic urges. Its not paranoia to think you're tapped, > its rationality. Of course we're tapped, despite funky headers like Received: from positron.jfet.org (positron.jfet.org [66.136.223.122]) (using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits)) (Client CN "positron.mit.edu", Issuer "positron.mit.edu" (not verified)) by leitl.org (Postfix) with ESMTP id BDD9D3A8326 for ; Wed, 7 Jul 2004 08:39:41 +0200 (CEST) Received: from positron.jfet.org (localhost [127.0.0.1]) by positron.jfet.org (8.12.11/8.12.11/Debian-3) with ESMTP id i676giK6021720 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Wed, 7 Jul 2004 01:42:44 -0500 just don't fool yourself about all your fans at Mt. Spook central ejecting coffee through their nose at our jokes and witticisms. Databases, despite much improved, don't have a good sense of humor. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From camera_lumina at hotmail.com Wed Jul 7 07:28:01 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Wed, 07 Jul 2004 10:28:01 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: "If you think the cable landings in Va/Md are coincidental, you are smoking something I've run out of. Its all recorded. I'm sure the archiving and database groups in Ft. Meade will get a chuckle out of your "the right to" idioms." Well, I don't actually believe it's all recorded. As I've attempted to explain previously, "they" almost certainly have risk models in place. When several variables twinkle enough (eg, origination area, IP address, presence of crypto...) some rule fires and then diverts a copy into the WASP'S Nest. There's probably some kind of key word search that either diverts the copy into storage or into the short list for an analyst to peek it. -TD >From: "Major Variola (ret)" >To: "cypherpunks at al-qaeda.net" >Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto >proxies >Date: Tue, 06 Jul 2004 21:40:29 -0700 > >At 02:47 PM 7/6/04 -0700, Hal Finney wrote: > >> Messages in storage have much lower judicial protection than messages >in > >> transit. (This does not have much technical merit, in the current > >> atmosphere of "damn the laws - there are terrorists around the >corner", > >> but can be seen as a nice little potential benefit.) > >Ie zero. > > >One thing I haven't understood in all the commentary is whether law > >enforcment still needs a warrant to access emails stored in this way. > >Apparently the ISP can read them without any notice or liability, but > >what about the police? > >You are state meat, whether 5150'd or not. > > >Also, what if you run your own mail spool, so the email is never stored > > >at the ISP, it just passes through the routers controlled by the ISP > >(just like it passed through a dozen other routers on the internet). > >Does this give the ISP (and all the other router owners) the right to > >read your email? I don't think so, it seems like that would definitely > > >cross over the line from "mail in storage" to "mail in transit". > >If you think the cable landings in Va/Md are coincidental, you are >smoking something I've run out of. Its all recorded. I'm sure the >archiving >and database groups in Ft. Meade will get a chuckle out of your >"the right to" idioms. > > > > > > _________________________________________________________________ MSN 9 Dial-up Internet Access helps fight spam and pop-ups  now 2 months FREE! http://join.msn.click-url.com/go/onm00200361ave/direct/01/ From s.schear at comcast.net Wed Jul 7 12:11:41 2004 From: s.schear at comcast.net (Steve Schear) Date: Wed, 07 Jul 2004 12:11:41 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: References: Message-ID: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> At 07:28 AM 7/7/2004, Tyler Durden wrote: >"If you think the cable landings in Va/Md are coincidental, you are >smoking something I've run out of. Its all recorded. I'm sure the >archiving and database groups in Ft. Meade will get a chuckle out of your >"the right to" idioms." > >Well, I don't actually believe it's all recorded. As I've attempted to >explain previously, "they" almost certainly have risk models in place. >When several variables twinkle enough (eg, origination area, IP address, >presence of crypto...) some rule fires and then diverts a copy into the >WASP'S Nest. There's probably some kind of key word search that either >diverts the copy into storage or into the short list for an analyst to peek it. Perhaps, but at a Bay Area meeting a few years back held to discuss NSA/SIGINT, I think it was held on the Stanford campus, a developer disclosed that an American contractor manufacturer had won a contract to install 250,000 high-capacity disk drives at one of these agenicies. stveve From measl at mfn.org Wed Jul 7 12:02:43 2004 From: measl at mfn.org (J.A. Terranson) Date: Wed, 7 Jul 2004 14:02:43 -0500 (CDT) Subject: Final stage In-Reply-To: <20040707185234.25B5B11572@mail.cypherpunks.to> References: <20040707185234.25B5B11572@mail.cypherpunks.to> Message-ID: <20040707140219.B3309@ubzr.zsa.bet> On Wed, 7 Jul 2004, Anonymous via the Cypherpunks Tonga Remailer wrote: > Praise Allah! The spires of the West will soon come crashing down! > Our Brother wishes for us to meet at the previously discussed > southeastern roadhouse on August 1st, in preparation for the > operations scheduled for August 6th and 9th. > > Alternative targets have been chosen. Contact Jibril if you have not > heard of the changes since the last meeting. The infidels have machines > that detect the biologicals, so make sure the containers are sealed and > scrubbed as discussed. > > Leave excess semtex behind. The more we transport, the more likely the > infidels are to detect us. > > We have received more funding and supplies from our brothers in Saudi > Arabia and Syria. Be prepared for another operation before January. > > Praise Allah! May the blood of the infidels turn the oceans red! Laying it on just a little thick, no? -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From sunder at sunder.net Wed Jul 7 11:03:00 2004 From: sunder at sunder.net (Sunder) Date: Wed, 7 Jul 2004 14:03:00 -0400 (edt) Subject: Privacy laws and social engineering In-Reply-To: <0407070800230.9709@somehost.domainz.com> References: <40EB836A.576CFDC0@cdc.gov> <0407070800230.9709@somehost.domainz.com> Message-ID: On Wed, 7 Jul 2004, Thomas Shaddack wrote: > Sometimes you get access by telnet. Sometimes by a voice call. Hack the > mainframe. Hack the secretary. What's better? (Okay, I agree, you can't > sleep with the mainframe.) > I feel zen today. Me too: http://www.openbsd.org/lyrics.html#31 ftp://ftp.openbsd.org/pub/OpenBSD/songs/song31.ogg ftp://ftp.openbsd.org/pub/OpenBSD/songs/song31.mp3 BSD fight buffer reign Flowing blood in circuit vein Quagmire, Hellfire, RAMhead Count Puffy rip attacker out Crackin' ze bathroom, Crackin' ze vault Tale of the script, HEY! Secure by default Can't fight the Systemagic Uber tragic Can't fight the Systemagic Sexty second, black cat struck Breeding worm of crypto-suck Hot rod box unt hunting wake Vampire omellete, kitten cake Crackin' ze boardroom, Crackin' ze vault Rippin' ze bat, HEY! Secure by default Chorus Cybersluts vit undead guts Transyl-viral coffin muck Penguin lurking under bed Puffy hoompa on your head Crackin' ze bedroom, Crackin' ze vault Crackin' ze whip, HEY! Secure by default Crackin' ze bedroom, Crackin' ze vault Crackin' ze whip, HEY! Secure by default Chorus From rsw at jfet.org Wed Jul 7 12:13:46 2004 From: rsw at jfet.org (Riad S. Wahby) Date: Wed, 7 Jul 2004 14:13:46 -0500 Subject: Final stage In-Reply-To: <20040707140219.B3309@ubzr.zsa.bet> References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> Message-ID: <20040707191346.GA3089@jfet.org> "J.A. Terranson" wrote: > Laying it on just a little thick, no? Either it's a slow day in law enforcement or someone forgot to take their meds again. :-P -- Riad S. Wahby rsw at jfet.org From s.schear at comcast.net Wed Jul 7 14:34:04 2004 From: s.schear at comcast.net (Steve Schear) Date: Wed, 07 Jul 2004 14:34:04 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040707200931.GA8588@bitchcake.off.net> References: <20040706214743.5D26657E2A@finney.org> <20040707200931.GA8588@bitchcake.off.net> Message-ID: <6.0.1.1.0.20040707142810.060f2bb8@mail.comcast.net> At 01:09 PM 7/7/2004, Adam Back wrote: >Then we implemented a replacement version 2 mail system that I >designed. The design is much simpler. With freedom anonymous >networking you had anyway a anonymous interactive TCP feature. So we >just ran a standard pop box for your nym. Mail would be delivered to >it directly (no reply block) for internet senders. Freedom senders >would send via anonymous IP again to get sender anonymity. Used qmail >as the mail system. > >Unfortunately they closed down the freedom network pretty soon after >psuedonymous mail 2.0 [3] was implemented. I wonder if the mail 2.0 code could be publicly released so it could be used with the forthcoming i2p IP overlay http://www.i2p.net/ ? steve From pgut001 at cs.auckland.ac.nz Tue Jul 6 19:42:03 2004 From: pgut001 at cs.auckland.ac.nz (Peter Gutmann) Date: Wed, 07 Jul 2004 14:42:03 +1200 Subject: UBL is George Washington In-Reply-To: Message-ID: "Tyler Durden" writes: >If they took out a few key COs downtown one morning the effect on the economy >would be significant. It depends on what your goal is. As someone else on this list pointed out, terrorism is just another form of PR. If OBL took out (say) that huge AT&T CO in the center of Manhattan (the skyscraper that looks like something out of a SF film), every cellphone user in the country who's had any dealings with AT&T would help him pack the explosives. Sure, there'd be some economic damage, but Joe Sixpack would barely notice, and certainly wouldn't care. OTOH the WTC had enough significance and enough lives involved that everyone had to sit up and take notice. He knew exactly what target to hit to create the biggest mess (I offer the results in the last two years as proof). Peter. From measl at mfn.org Wed Jul 7 12:55:44 2004 From: measl at mfn.org (J.A. Terranson) Date: Wed, 7 Jul 2004 14:55:44 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> Message-ID: <20040707145032.R3309@ubzr.zsa.bet> On Wed, 7 Jul 2004, Steve Schear wrote: > Perhaps, but at a Bay Area meeting a few years back held to discuss > NSA/SIGINT, I think it was held on the Stanford campus, a developer > disclosed that an American contractor manufacturer had won a contract to > install 250,000 high-capacity disk drives at one of these agenicies. > > stveve Lets look at that for a second. "A few years ago". Lets call it two years ago. That would make the average hi-cap drive around 30gb. We'll have to assume they want these to be fault-tolerant and with host stanbys, since this *is* the standard implementation, so: 250,000 drives divie by 5 to get RAID groups = 50K groups of 90gb each, or ~4.6 petabytes for this one order. 4.6pb may be a lot, but it wouldn't hold much of the worlds traffic - there's a hell of a lot of filtering going on. -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From sunder at sunder.net Wed Jul 7 12:06:42 2004 From: sunder at sunder.net (Sunder) Date: Wed, 7 Jul 2004 15:06:42 -0400 (edt) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: References: Message-ID: On Wed, 7 Jul 2004, Tyler Durden wrote: > "If you think the cable landings in Va/Md are coincidental, you are > smoking something I've run out of. Its all recorded. I'm sure the > archiving and database groups in Ft. Meade will get a chuckle out of your > "the right to" idioms." > > Well, I don't actually believe it's all recorded. As I've attempted to > explain previously, "they" almost certainly have risk models in place. When > several variables twinkle enough (eg, origination area, IP address, presence > of crypto...) some rule fires and then diverts a copy into the WASP'S Nest. > There's probably some kind of key word search that either diverts the copy > into storage or into the short list for an analyst to peek it. To channel Mr. May: "All of this of course can be put to rest by reading some Bamford. (Body of Secrets, Puzzle Palace.)" From sunder at sunder.net Wed Jul 7 12:26:59 2004 From: sunder at sunder.net (Sunder) Date: Wed, 7 Jul 2004 15:26:59 -0400 (edt) Subject: Final stage In-Reply-To: <20040707140219.B3309@ubzr.zsa.bet> References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> Message-ID: On Wed, 7 Jul 2004, J.A. Terranson wrote: > On Wed, 7 Jul 2004, Anonymous via the Cypherpunks Tonga Remailer wrote: > > > Praise Allah! The spires of the West will soon come crashing down! > Laying it on just a little thick, no? Here we go again. Get ready for more FUD from the LEO's, I can see Fox news now. "Cypherpunks a hotbed of crypto-anarchist scum is now being used by Al Qaeda to setup new terrorist attacks..." Expect to see a sidebar about "rogue" or "evil" anonymous remailers and how they're un-patriotic, etc. Bah, some feeb had too one too many Crappachino's with lunch today and pulled a Cornholio.... :( A few years ago it was requests on how to make bombs, now it's this shit. From adam at cypherspace.org Wed Jul 7 13:09:31 2004 From: adam at cypherspace.org (Adam Back) Date: Wed, 7 Jul 2004 16:09:31 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040706214743.5D26657E2A@finney.org> References: <20040706214743.5D26657E2A@finney.org> Message-ID: <20040707200931.GA8588@bitchcake.off.net> This is somewhat related to what ZKS did in their version 1 [1,2] mail system. They made a transparent local pop proxy (transparent in that it happened at firewall level, did not have to change your mail client config). In this case they would talk to your real pop server, decrypt the parts (they were reply-block like onions), remove duplicates (as with mixmaster etc you can send duplicates via separate remailers to improve reliability). So the transparent proxy would leave alone your normal mail that you received in the pop box and remove duplicates only from the reply-block delivered pseudonymous mail. Actually they implemented the reply-block from scratch, it always seemed to me it would have been less development work to use mixmaster (it was implemented before I started). The ZKS reply block did not even use chunking (ala mixmaster) so traffic analysis would have been trivial as the message size would show through. At least that's what I recall, no chunking. However I am finding the security issues paper [1] says otherwise. The 1.0 architecture document [2] is ambiguous, there is no mention of chunking. (I've sent mail to one of the original developers to check I have it right). It was also unreliable because it did not use SMTP, it used its own transport AMTP and its own retry-semantics on nodes called MAIPs. (Mail AIPs, an AIP is an "Anonymous Internet Proxy"). Then we implemented a replacement version 2 mail system that I designed. The design is much simpler. With freedom anonymous networking you had anyway a anonymous interactive TCP feature. So we just ran a standard pop box for your nym. Mail would be delivered to it directly (no reply block) for internet senders. Freedom senders would send via anonymous IP again to get sender anonymity. Used qmail as the mail system. Unfortunately they closed down the freedom network pretty soon after psuedonymous mail 2.0 [3] was implemented. There is an interesting trade-off here. The interactive communications are perhaps more vulnerable to real-time powerful adversary traffic analysis than mixmaster style mixed chunked delivery. However they are less vunerable to subpoena because they are forward-secret on a relativey short time-frame. (1/2 hr if I recall; however more recent designs such as chainsaw internal prototype, and cebolla [4] by ex-ZKSer Zach Brown change keys down to second level by using a mix of backward-security based on symmetric key hashing (and deleting previous key) and forward security using DH.) It would be nice to get both types of anonymity, but I suspect for most typical users the discovery / subpeona route is the major danger, and if that is thwarted it is unlikely that their activities would warrant the effort of real time analysis. Well we have carnivore now, so they could potentially do real-time traffic analysis more routinely if they were to distribute enough collaborating analysis carnivore plugins. Adam [1] http://www.homeport.org/~adam/zeroknowledgewhitepapers/security-issues.pdf [2] http://www.homeport.org/~adam/zeroknowledgewhitepapers/arch-notech.pdf [3] http://www.cypherspace.org/adam/pubs/freedom2-mail.pdf [4] http://www.cypherspace.org/cebolla/ On Tue, Jul 06, 2004 at 02:47:43PM -0700, "Hal Finney" wrote: > Recently there was a proposal for a nym receiving service, > http://www.freehaven.net/doc/pynchon-gate/, by Bran Cohen and Len > Sassaman. They have a complicated protocol for downloading email > anonymously. To hide the complexity, they propose to set up a POP > compatible mail server agent on the user's computer running as a daemon > process (Windows service). He would configure his mailer to connect to > localhost:4949 or whatever, just like any other POP server. The service > would periodically go out and poll for email using the fancy protocol, > but then it would make it available to the local mail agent in perfectly > vanilla form. The point is that this architecture hides the complexity > and makes it transparent for end users to use arbitrarily complex crypto > for mail receiving. Something similar would be perfect for your idea. From eugen at leitl.org Wed Jul 7 08:17:48 2004 From: eugen at leitl.org (Eugen Leitl) Date: Wed, 7 Jul 2004 17:17:48 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: References: Message-ID: <20040707151747.GW1141@leitl.org> On Wed, Jul 07, 2004 at 10:28:01AM -0400, Tyler Durden wrote: > Well, I don't actually believe it's all recorded. As I've attempted to > explain previously, "they" almost certainly have risk models in place. When > several variables twinkle enough (eg, origination area, IP address, > presence of crypto...) some rule fires and then diverts a copy into the > WASP'S Nest. There's probably some kind of key word search that either > diverts the copy into storage or into the short list for an analyst to peek > it. How much plain text can ~10^9 online monkeys daily enter into their keyboard? A ~10^3 average ballpark gives you a TByte/day (minus the redundancy), which is currently a 1U worth of SATA RAID/day, or 3 years worth of world's entire traffic in a 10^3 node cluster, which is on the low side these days. Hard drive storage density goes up exponentially, and probably faster than people can go online (the old world has saturated) -- it isn't a problem, given that population increase doesn't occur at these growth rates. You don't have to delete anything, ever. Given what Google manages with some 10^4..10^5 nodes, this problem set looks puny in comparison. Keeping the data on a cluster gives you the local crunch to do some very nontrivial data mining, especially if you narrow the scope down sufficiently to be able to lock the data in memory and crunch it there. Fax OCR/telex is just as easy, speech recognition doable, given the budget. We don't know whether they are actually doing it (I *think* these people are too conservative to be doing clusters right now, so they're probably doing storage hierarchies with tape libraries -- but then they as well could be MIB types years ahead of the mainstream), the point it is that they could, given the documented amount of hired talent and official budget. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From justin-cypherpunks at soze.net Wed Jul 7 10:40:25 2004 From: justin-cypherpunks at soze.net (Justin) Date: Wed, 7 Jul 2004 17:40:25 +0000 Subject: U.S. forms mid-east terror group! Message-ID: <20040707174025.GA24548@arion.soze.net> http://www.cnn.com/2004/WORLD/meast/07/06/iraq.main/index.html BAGHDAD, Iraq (CNN) -- A previously unknown militant group in Iraq is threatening to kill the most-wanted terror suspect in that country: Abu Musab al-Zarqawi. The Arabic-language TV network Al-Arabiya said it received a taped statement from an organization that calls itself the Rescue Group warning al-Zarqawi and his followers to leave Iraq or face the consequences. One masked militant read a statement denouncing the actions by al-Zarqawi and his followers as hurtful to Iraq, particularly the kidnapping of foreigners. ... -- "Once you knew, you'd claim her, and I didn't want that." "Not your decision to make." "Yes, but it's the right decision, and I made it for my daughter. She deserved to be born with a clean slate." - Beatrix; Bill; Kill Bill V.2 From nobody at cypherpunks.to Wed Jul 7 11:52:34 2004 From: nobody at cypherpunks.to (Anonymous via the Cypherpunks Tonga Remailer) Date: Wed, 7 Jul 2004 20:52:34 +0200 (CEST) Subject: Final stage Message-ID: <20040707185234.25B5B11572@mail.cypherpunks.to> Praise Allah! The spires of the West will soon come crashing down! Our Brother wishes for us to meet at the previously discussed southeastern roadhouse on August 1st, in preparation for the operations scheduled for August 6th and 9th. Alternative targets have been chosen. Contact Jibril if you have not heard of the changes since the last meeting. The infidels have machines that detect the biologicals, so make sure the containers are sealed and scrubbed as discussed. Leave excess semtex behind. The more we transport, the more likely the infidels are to detect us. We have received more funding and supplies from our brothers in Saudi Arabia and Syria. Be prepared for another operation before January. Praise Allah! May the blood of the infidels turn the oceans red! From mv at cdc.gov Wed Jul 7 21:17:11 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Wed, 07 Jul 2004 21:17:11 -0700 Subject: All your data belongs to Redmond Message-ID: <40ECCAC7.675E0346@cdc.gov> I am currently working as a security consultant at a major kiretsu that makes printers/fax/copiers/scanners. Important eg in a hospital where HIPAA requires that info not be leaked. Eg the xerox-tech swaps a drive and gets to look at the data on it. Or your accountant is using a wireless laptop to print your bank numbers. A program I was working on crashed, and M$'s XP asked me if it could tell M$ about the "bug". I looked at the info the "anonymous" message would contain. It included the data I was testing with. Nice. I sent a note to my boss. Anyone know if this can be shut off? [Apologies if this is an old issue. As an aside, the 3Ghz work machine with half a Gig of RAM runs no faster than the 333 Mhz 128Meg Win95 PC this is composed on. When quantum computing chips come out, if they run M$ OS, they won't run any faster, but the "assistants" will be more annoying.] ------- "This is by-design behavior, not a security vulnerability. " -- Scott Culp, Microsoft Security Response Center, discussing the hole allowing ILOVEU to propogate, 5/5/00. From mv at cdc.gov Wed Jul 7 21:28:47 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Wed, 07 Jul 2004 21:28:47 -0700 Subject: Final stage Message-ID: <40ECCD7E.88BD4208@cdc.gov> At 03:26 PM 7/7/04 -0400, Sunder wrote: >Here we go again. Get ready for more FUD from the LEO's, I can see Fox >news now. Perhaps, but some will tune in and learn a thing or two. (Albeit we'll suffer the "September" effect...) .... This one is for Eunice Stone, who "turned in" 3 medical students last year for looking muslim: I suggest learning to graffiti arabic in public places. Perhaps one of those hotel bibles containing the lord's prayer in all the cool fonts will suffice. (I use the Job chapter for rolling cigs.). Or copy something from an arabic web site. Hell, even hebrew would work with most yokels piggies or paranoid citizen-slaves. Or use ammonium fluoride pens on glass for a frosty effect. >Bah, some feeb had too one too many Crappachino's with lunch today and >pulled a Cornholio.... :( LOL I need the Bill of Rights for Ashcrufts bunghole.. From mv at cdc.gov Wed Jul 7 21:31:45 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Wed, 07 Jul 2004 21:31:45 -0700 Subject: Faster than Moore's law Message-ID: <40ECCE31.B1C8BED2@cdc.gov> At 02:55 PM 7/7/04 -0500, J.A. Terranson wrote: >"A few years ago". Lets call it two years ago. That would make the >average hi-cap drive around 30gb. Just want to remind y'all that drive capacity has increased *faster* than semiconductor throughput, which has an 18 month doubling time. -------- "They keep talking about drafting a Constitution for Iraq. Why don't we just give them ours? It was written by a lot of really smart guys, it's worked for over 200 years, and Hell, we're not using it anymore." -Jay Leno From nobody at cypherpunks.to Wed Jul 7 14:58:20 2004 From: nobody at cypherpunks.to (Anonymous via the Cypherpunks Tonga Remailer) Date: Wed, 7 Jul 2004 23:58:20 +0200 (CEST) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <20040707215820.86845114A4@mail.cypherpunks.to> >I can't imagine any intelligence professional wasting her time reading >the crap at times coming over this list. As of mid 2000 most of traffic is recorded. By this time 'most' is very close to 'all'. But if you e-mail someone with account on the same local ISP, using dial-in at the recipient is also using dial-in, and ISP didn't farm-out dial-in access, then your message may not be backed up forever. From dewayne at warpspeed.com Thu Jul 8 04:53:34 2004 From: dewayne at warpspeed.com (Dewayne Hendricks) Date: July 8, 2004 4:53:34 AM EDT Subject: [Dewayne-Net] Hi-tech rays to aid terror fight Message-ID: Hi-tech rays to aid terror fight A new way of identifying metal and explosives could provide a valuable tool in the fight against terrorism. Airport security has become big business following the terrorist attacks in the US. A system that detects both metal and non-metallic weapons using terahertz light has been developed by technology firm TeraView. It could make passenger screening at airports more effective and quicker, say experts. Safe to humans Dr Ruth Woodward, an independent scientific adviser for terahertz consultancy firm HT Consultants, said the technology could provide one of the most innovative ways of dealing with security threats. "It presents a positive step forward, although the economic benefits are yet to be determined," she told BBC News Online. Terahertz light sits between microwave and infrared on the electro-magnetic spectrum. It has a number of properties that can be harnessed to screen passengers. Unlike X-ray, it is perfectly safe to use on people. It can pass through clothing, paper and plastics to detect metal, ceramic or plastic weapons. And it can identify explosives by reading their characteristic spectral 'fingerprints'. Magic wand TeraView is a firm looking at ways of exploiting terahertz light. It is developing a handheld security wand that could be used by airport security guards to pass over the body of passengers. It is expected that the product will be available for commercial use within two years, following a trial at an as yet unspecified airport. The firm is partnering with detection equipment firm Smiths Detection on the project. The terahertz 'wand' will be attached to a box which will bleep when suspicious objects are found. Eventually the firm also hopes to make a walk-through portal that uses the same techniques as the wand to scan passengers. "The big challenge for airports is to keep the passengers happy and provide a high level of security," said Dr Mike Kemp, the vice-president of TeraView. "What we are trying to do with terahertz light is create something that is more automatic and reduces the dependence on the sharp-eyed operator," he said. Turning to technology The technology is not likely to replace current methods of scanning, rather will sit alongside them, he explained. And there is no substitute for old-fashioned human alertness. "Any technology, whether it is new or old, is only there to complement commonsense," said Dr Woodward. Following the September 11 attacks, airport security has taken on a new-found urgency. "Many companies are looking at new technologies that can offer substantially increased security," said Chris Yates, aviation security editor at Jane's Transport. A system that blows air at passengers to detect explosives is under trial at Terminal One of Manchester airport. And several US airports are testing technology that can virtually undress passengers to detect any suspicious items. This has caused uproar from civil liberty organisations in the US and led to some modification to allow passengers a degree of modesty. "Basically the most sensitive areas of the body have been blocked out," said Mr Yates. Terahertz light is the last unexplored frontier of the radio wave and light spectrum. and can be also be utilised in a variety of ways such as medical imaging. Story from BBC NEWS: Published: 2004/07/08 08:05:37 GMT Archives at: Weblog at: ------------------------------------- You are subscribed as eugen at leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From measl at mfn.org Thu Jul 8 05:25:57 2004 From: measl at mfn.org (J.A. Terranson) Date: Thu, 8 Jul 2004 07:25:57 -0500 (CDT) Subject: Final stage In-Reply-To: <20bf32b7040708051742ce3b18@mail.gmail.com> References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> <20bf32b7040708051742ce3b18@mail.gmail.com> Message-ID: <20040708072448.M7047@ubzr.zsa.bet> On Thu, 8 Jul 2004, Howie Goodell wrote: > > A few years ago it was requests on how to make bombs, now it's this shit. > > The "UBL is GW" message sounded provocateurish, too. Yeah, I can see a humor impaired feeb going there. But you gotta admit, it was on-target! Whoever that one was, they were dead-on :-) > Howie Goodell -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From measl at mfn.org Thu Jul 8 05:27:17 2004 From: measl at mfn.org (J.A. Terranson) Date: Thu, 8 Jul 2004 07:27:17 -0500 (CDT) Subject: Final stage In-Reply-To: <20bf32b7040708051742ce3b18@mail.gmail.com> References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> <20bf32b7040708051742ce3b18@mail.gmail.com> Message-ID: <20040708072651.D7047@ubzr.zsa.bet> On Thu, 8 Jul 2004, Howie Goodell wrote: > Return-Path: > X-Original-To: measl at mfn.org > Delivered-To: measl at mfn.org > Received: from mproxy.gmail.com (rproxy.gmail.com [64.233.170.196]) > by mx1.mfn.org (Postfix) with SMTP id 5F0C154876 > for ; Thu, 8 Jul 2004 07:17:55 -0500 (CDT) > Received: by mproxy.gmail.com with SMTP id d19so134991rnf > for ; Thu, 08 Jul 2004 05:17:39 -0700 (PDT) > Received: by 10.38.71.16 with SMTP id t16mr209763rna; > Thu, 08 Jul 2004 05:17:39 -0700 (PDT) > Message-ID: <20bf32b7040708051742ce3b18 at mail.gmail.com> No tls for gmail? Booo!!! -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From howie.goodell at gmail.com Thu Jul 8 05:17:39 2004 From: howie.goodell at gmail.com (Howie Goodell) Date: Thu, 8 Jul 2004 08:17:39 -0400 Subject: Final stage In-Reply-To: References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> Message-ID: <20bf32b7040708051742ce3b18@mail.gmail.com> On Wed, 7 Jul 2004 15:26:59 -0400 (edt), Sunder wrote: > > On Wed, 7 Jul 2004, J.A. Terranson wrote: > > > On Wed, 7 Jul 2004, Anonymous via the Cypherpunks Tonga Remailer wrote: > > > > > Praise Allah! The spires of the West will soon come crashing down! > > > > > Laying it on just a little thick, no? > > Here we go again. Get ready for more FUD from the LEO's, I can see Fox > news now. "Cypherpunks a hotbed of crypto-anarchist scum is now being > used by Al Qaeda to setup new terrorist attacks..." Expect to see a > sidebar about "rogue" or "evil" anonymous remailers and how they're > un-patriotic, etc. > > Bah, some feeb had too one too many Crappachino's with lunch today and > pulled a Cornholio.... :( > > A few years ago it was requests on how to make bombs, now it's this shit. The "UBL is GW" message sounded provocateurish, too. Howie Goodell -- Howie Goodell hgoodell at cs.uml.edu http://goodL.org Hardware control Info Visualization User interface UMass Lowell Computer Science Doctoral Candidate From eugen at leitl.org Wed Jul 7 23:55:11 2004 From: eugen at leitl.org (Eugen Leitl) Date: Thu, 8 Jul 2004 08:55:11 +0200 Subject: Faster than Moore's law In-Reply-To: <40ECCE31.B1C8BED2@cdc.gov> References: <40ECCE31.B1C8BED2@cdc.gov> Message-ID: <20040708065511.GM1141@leitl.org> On Wed, Jul 07, 2004 at 09:31:45PM -0700, Major Variola (ret) wrote: > Just want to remind y'all that drive capacity has increased *faster* > than semiconductor throughput, which has an 18 month doubling time. Yes. Also, human-generated traffic (the relevant part: which email you write, which sites you browse) has an upper bound for each meat person. Even if one doesn't have access to your ISP's logs this should be enough to identify (not necessarily link to a specific fed-issued ID, though) almost every person within a session. I think it is safe to assume that every relevant traffic which is in clear is being recorded, some or all of it forever. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From howie.goodell at gmail.com Thu Jul 8 06:37:15 2004 From: howie.goodell at gmail.com (Howie Goodell) Date: Thu, 8 Jul 2004 09:37:15 -0400 Subject: Final stage In-Reply-To: <20040708072651.D7047@ubzr.zsa.bet> References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> <20bf32b7040708051742ce3b18@mail.gmail.com> <20040708072651.D7047@ubzr.zsa.bet> Message-ID: <20bf32b704070806377dc1f400@mail.gmail.com> On Thu, 8 Jul 2004 07:27:17 -0500 (CDT), J.A. Terranson wrote: > > On Thu, 8 Jul 2004, Howie Goodell wrote: > > > Return-Path: ... > > No tls for gmail? Booo!!! I asked a friend what he thought Google would market to someone with an Inbox crammed with cpunks messages. He suggested, "Legal services?" Howie Goodell -- Howie Goodell hgoodell at cs.uml.edu http://goodL.org Hardware control Info Visualization User interface UMass Lowell Computer Science Doctoral Candidate From dave at farber.net Thu Jul 8 07:09:31 2004 From: dave at farber.net (David Farber) Date: Thu, 8 Jul 2004 10:09:31 -0400 Subject: [IP] Hi-tech rays to aid terror fight Message-ID: Begin forwarded message: From sunder at sunder.net Thu Jul 8 08:39:34 2004 From: sunder at sunder.net (Sunder) Date: Thu, 8 Jul 2004 11:39:34 -0400 (edt) Subject: Final stage In-Reply-To: <20bf32b7040708051742ce3b18@mail.gmail.com> References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> <20bf32b7040708051742ce3b18@mail.gmail.com> Message-ID: On Thu, 8 Jul 2004, Howie Goodell wrote: > On Wed, 7 Jul 2004 15:26:59 -0400 (edt), Sunder wrote: > > > > On Wed, 7 Jul 2004, J.A. Terranson wrote: > > > > > On Wed, 7 Jul 2004, Anonymous via the Cypherpunks Tonga Remailer wrote: > > > > > > > Praise Allah! The spires of the West will soon come crashing down! > > > > > > > > > Laying it on just a little thick, no? > > > > Here we go again. Get ready for more FUD from the LEO's, I can see Fox > > news now. "Cypherpunks a hotbed of crypto-anarchist scum is now being > > used by Al Qaeda to setup new terrorist attacks..." Expect to see a > > sidebar about "rogue" or "evil" anonymous remailers and how they're > > un-patriotic, etc. > > > > Bah, some feeb had too one too many Crappachino's with lunch today and > > pulled a Cornholio.... :( > > > > A few years ago it was requests on how to make bombs, now it's this shit. > > The "UBL is GW" message sounded provocateurish, too. Yup... but that's kind of standard around here. Pull up a reasonable quote from some super hated person and make people think. Nothing new. I think there was something about gun control and making people safe attributed to Hitler, etc. a while back. But as I said, here we go: http://www.theinquirer.net/?article=17087 Right on que too, though it doesn't mention Cypherpunks... The Internet is the home of Terror Servers of Mass destruction By Nick Farrell: Thursday 08 July 2004, 07:50 THE INTERNET has become the place for terrorist training, recruitment, and fundraising, according to a leading Israeli academic. Speaking to the Medill News Service, Gabriel Weimann, chair of the University of Haifa communications department claims that Terrorist groups are exploiting the accessibility, vast audience, and anonymity of the Internet to raise money and recruit new members. From kenhirsch at myself.com Thu Jul 8 08:48:19 2004 From: kenhirsch at myself.com (Ken Hirsch) Date: Thu, 8 Jul 2004 11:48:19 -0400 Subject: All your data belongs to Redmond Message-ID: <037901c46503$a3189120$6aae86a2@pcx937> See http://www.windows-help.net/WindowsXP/tune-08.html and http://www.ciac.org/ciac/bulletins/m-005.shtml Major Variola wrote: >I am currently working as a security consultant at a major kiretsu >that makes printers/fax/copiers/scanners. Important eg in >a hospital where HIPAA requires that info not be leaked. >Eg the xerox-tech swaps a drive and gets to look >at the data on it. Or your accountant is using a wireless laptop >to print your bank numbers. > >A program I was working on crashed, and M$'s XP asked me if it >could tell M$ about the "bug". > >I looked at the info the "anonymous" message would contain. It >included the data I was testing with. > >Nice. > >I sent a note to my boss. > >Anyone know if this can be shut off? > >[Apologies if this is an old issue. As an aside, the 3Ghz work machine >with half a Gig of RAM runs no faster than the 333 Mhz 128Meg Win95 >PC this is composed on. When quantum computing chips come out, >if they run M$ OS, they won't run any faster, but the "assistants" will >be more annoying.] > >------- >"This is by-design behavior, not a security vulnerability. " >-- Scott Culp, Microsoft Security Response >Center, discussing the hole allowing ILOVEU to >propogate, 5/5/00. From camera_lumina at hotmail.com Thu Jul 8 08:58:19 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Thu, 08 Jul 2004 11:58:19 -0400 Subject: Final stage Message-ID: Hum. Does this mean Tim May has resuscribed? -TD >From: Anonymous via the Cypherpunks Tonga Remailer >To: "cypherpunks at al-qaeda.net" >Subject: Final stage >Date: Wed, 7 Jul 2004 20:52:34 +0200 (CEST) > >Praise Allah! The spires of the West will soon come crashing down! >Our Brother wishes for us to meet at the previously discussed >southeastern roadhouse on August 1st, in preparation for the >operations scheduled for August 6th and 9th. > >Alternative targets have been chosen. Contact Jibril if you have not >heard of the changes since the last meeting. The infidels have machines >that detect the biologicals, so make sure the containers are sealed and >scrubbed as discussed. > >Leave excess semtex behind. The more we transport, the more likely the >infidels are to detect us. > >We have received more funding and supplies from our brothers in Saudi >Arabia and Syria. Be prepared for another operation before January. > >Praise Allah! May the blood of the infidels turn the oceans red! > _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/ From sunder at sunder.net Thu Jul 8 10:08:52 2004 From: sunder at sunder.net (Sunder) Date: Thu, 8 Jul 2004 13:08:52 -0400 (edt) Subject: [IP] Hi-tech rays to aid terror fight (fwd from dave@farber.net) In-Reply-To: <20040708143039.GK1141@leitl.org> References: <20040708143039.GK1141@leitl.org> Message-ID: I recently visited the Canadian side of Niagra falls. On the return entry to the US customs, etc. meant driving through penns that look like toll booths. But I noticed little sensors in pairs and large square sensors as well. The entry gate was fairly large - I'd say about 2' deep by 2' wide by I'd guess 10/12' high. Black on the outside car facing side, white on the inner side. On the side there were pairs of large rectangular boxes at an angle pointing down toward the car. Deeper into the stall there were several pairs of sensors on vertical poles. The first pair on the left side - small rectangular ones which pointed at similar poles across the way. Something like this: | | | ]| mid - about 3-4' off the ground | | |[ | low about 1ft off the ground >From the top: Booth|---arm---| | | |[ | |[ | | ]| | ]| | | ### ### | | %%%%%%%%%%% %%%%%%%%%%% | | ^^^^^ direction of driving [ = small sensor ##= large sensor %%= entry gate 3'x3' thick And there were two sets of these as I drove through. Were these the (in)famous TZ sensors? There were two guys in the booth, one obviously examining in LCD monitor, the other guy going "papers please" and "state the nature of your visit" etc. He seemed only concerned with where we were born, lived, and whether we had purchased any alcohol or tabacco products in Canada. On Thu, 8 Jul 2004, Eugen Leitl wrote: > ----- Forwarded message from David Farber ----- > > From: David Farber > Date: Thu, 8 Jul 2004 10:09:31 -0400 > > Begin forwarded message: > > From: Dewayne Hendricks > Date: July 8, 2004 4:53:34 AM EDT > To: Dewayne-Net Technology List > Subject: [Dewayne-Net] Hi-tech rays to aid terror fight > > Hi-tech rays to aid terror fight > > A new way of identifying metal and explosives could provide a valuable > tool in the fight against terrorism. > Airport security has become big business following the terrorist > attacks in the US. > > A system that detects both metal and non-metallic weapons using > terahertz light has been developed by technology firm TeraView. From camera_lumina at hotmail.com Thu Jul 8 11:49:56 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Thu, 08 Jul 2004 14:49:56 -0400 Subject: BOUNTY BEAR is Faster than Moore's law Message-ID: Um. Interesting point. Come to think of it, it might actually make a lot more sense to be able to run those risk models offline. That way, you can always refine them later. Better safe than sorry. Given Variola's little factoid, even if they aren't grabbing everything now, they probably will soon. I'd also point out that imaging technology (eg, CCDs) are moving like a bat out of hell, though I'm not sure of the relevance vz Cypherpunks. Riffing a bit...with effectively inifinte storage capacity and high-density imaging arrays, it might be possible for a database search to include parameters such as "brown eyes"..."1mm zit pockmark on left cheek", and then a search is run on all Metrocard terminals through all city subway's security cameras in the world. Anyone see Wim Wender's "The End of the World"? BOUNTY BEAR! -TD >From: Eugen Leitl >To: cypherpunks at al-qaeda.net >Subject: Re: Faster than Moore's law >Date: Thu, 8 Jul 2004 08:55:11 +0200 > >On Wed, Jul 07, 2004 at 09:31:45PM -0700, Major Variola (ret) wrote: > > > Just want to remind y'all that drive capacity has increased *faster* > > than semiconductor throughput, which has an 18 month doubling time. > >Yes. Also, human-generated traffic (the relevant part: which email you >write, >which sites you browse) has an upper bound for each meat person. Even if >one >doesn't have access to your ISP's logs this should be enough to identify >(not >necessarily link to a specific fed-issued ID, though) almost >every person within a session. > >I think it is safe to assume that every relevant traffic which is in clear >is >being recorded, some or all of it forever. > >-- >Eugen* Leitl leitl >______________________________________________________________ >ICBM: 48.07078, 11.61144 http://www.leitl.org >8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE >http://moleculardevices.org http://nanomachines.net ><< attach3 >> _________________________________________________________________ Check out the latest news, polls and tools in the MSN 2004 Election Guide! http://special.msn.com/msn/election2004.armx From s.schear at comcast.net Thu Jul 8 15:05:20 2004 From: s.schear at comcast.net (Steve Schear) Date: Thu, 08 Jul 2004 15:05:20 -0700 Subject: Faster than Moore's law In-Reply-To: <40ECCE31.B1C8BED2@cdc.gov> References: <40ECCE31.B1C8BED2@cdc.gov> Message-ID: <6.0.1.1.0.20040708150322.0435cbc8@mail.comcast.net> At 09:31 PM 7/7/2004, Major Variola (ret) wrote: >At 02:55 PM 7/7/04 -0500, J.A. Terranson wrote: > >"A few years ago". Lets call it two years ago. That would make the > >average hi-cap drive around 30gb. > >Just want to remind y'all that drive capacity has increased *faster* >than semiconductor throughput, which has an 18 month doubling time. But access time has not nearly kept pace. Which is why all manner of database architectures have been created to make up for this shortcoming. steve From eugen at leitl.org Thu Jul 8 07:07:58 2004 From: eugen at leitl.org (Eugen Leitl) Date: Thu, 8 Jul 2004 16:07:58 +0200 Subject: petabyte on a budget Message-ID: <20040708140758.GH1141@leitl.org> Since we were talking about how much storage is available these days: http://www.archive.org/web/petabox.php For a backup just mirror to a number of similiar clusters offsite. Large Scale Data Repository: Petabox OVERVIEW The petabox by the Internet Archive is a machine designed to safely store and process one petabyte of information (a petabyte is a million gigabytes). The goals-- and current design points are: * Low power-- 6kWatts per rack, and 60kWatts for the whole system * High density-- 100 Terabytes per rack * Local computing to process the data-- 800 low-end PC's * Multi-OS possible, linux standard * Colocation friendly-- requires our own rack to get 100TB/rack, or 50TB in a * standard rack * Shipping container friendly-- Able to be run in a 20' by 8' by 8' shipping * container * Easy Maintenance-- one system administrator per petabyte * Software to automate mirroring with itself * Inexpensive design * Inexpensive storage PILOT STATUS 5/2004 * The first 100TB Rack is up and running! * The second 100TB Rack will be up by the end of May * Thermal Targets have been met * Systems Bootstrapped from USB Flash Device * Reiser FS running * PC-based Router running AVAILABILITY For more details, please contact: info at capricorn-tech.com -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From eugen at leitl.org Thu Jul 8 07:30:39 2004 From: eugen at leitl.org (Eugen Leitl) Date: Thu, 8 Jul 2004 16:30:39 +0200 Subject: [IP] Hi-tech rays to aid terror fight (fwd from dave@farber.net) Message-ID: <20040708143039.GK1141@leitl.org> ----- Forwarded message from David Farber ----- From camera_lumina at hotmail.com Thu Jul 8 14:01:45 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Thu, 08 Jul 2004 17:01:45 -0400 Subject: photodisc search (was Re: BOUNTY BEAR is Faster ...) Message-ID: Yeah, but this is a metadata search, correct? Seems to me Our Protectors(TM) are probably able to search a vast database of images themselves. In other words, go look for details they hadn't previously thought of as being important (and hence were not available in metadata). Given high-density CCDs and real cheap storage, these details may be very minute, or perhaps small+far away. -TD >From: Rediscover/db >To: Tyler Durden >CC: cypherpunks at al-qaeda.net >Subject: photodisc search (was Re: BOUNTY BEAR is Faster ...) >Date: Thu, 8 Jul 2004 13:26:41 -0700 > >Tyler Durden wrote: > > arrays, it might be possible for a database search to include parameters > > such as "brown eyes"..."1mm zit pockmark on left cheek", and then a >search > >You probably already know of this, but something like Photodisc? >Getty Images - stock photos and images: > >http://www.photodisc.com/ >http://www.fotosearch.com/photodisc/ > >Has a search feature, eg "content young woman sitting looking at camera" >(direct quote used to find the pic MicroSoft used for their >"switch" campaign). > _________________________________________________________________ MSN Life Events gives you the tips and tools to handle the turning points in your life. http://lifeevents.msn.com From shaddack at ns.arachne.cz Thu Jul 8 08:50:57 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Thu, 8 Jul 2004 17:50:57 +0200 (CEST) Subject: Querying SSL/TLS capabilities of SMTP servers Message-ID: <0407081735340.-1275484700@somehost.domainz.com> I cobbled up together a small bash shell script that does this. It lists the MX records for a domain, and then tries to connect to each of them, issue an EHLO command, disconnect, then list the output of the server, alerting if the server supports STARTTLS. It should be easy to further query the server for the certificate, using some external utility called from the script. It requires netcat and a pair of djbdns utilities. It's a bit crude, but could be helpful. Script follows: --------------------- cut here -------------------------------------- #!/bin/bash ## Query the capabilities of mailservers for a domain. ## ## Requirements: nc (netcat), dnsmx and dnsip (from djbdns package) TMP=`mktemp /tmp/queryehlo.XXXXXX` EHLOSTRING="capquery" TIMEOUT=15 function help() { cat << EOF queryehlo - query the capabilities of mailservers for a domain Usage: queryehlo EOF exit 0 } function checkresources() { ERR=""; if [ ! "`which nc 2>/dev/null`" ]; then echo "ERROR: nc (netcat) not available in \$PATH." echo "netcat should be part of standard distro, or can be acquired from eg." echo " http://www.atstake.com/research/tools/network_utilities/". echo ERR="1" fi if [ ! "`which dnsmx 2>/dev/null`" ]; then echo "ERROR: dnsmx (from djbdns) not available in \$PATH." echo "djbdns can be downloaded from eg. http://cr.yp.to/djbdns.html" echo ERR="1" fi if [ "$ERR" == "1" ]; then exit; fi } function queryrelay() { if [ ! "$x" ]; then return; fi echo "Querying mail relay $1, `dnsip $x`" cat << EOF | nc -w $TIMEOUT $1 25 > $TMP EHLO $EHLOSTRING QUIT EOF if [ "`cat $TMP|grep STARTTLS`" ]; then echo "*** RELAY ADVERTISES SMTP/TLS SUPPORT" # insert eventual further interrogations here fi echo cat $TMP echo echo rm $TMP } checkresources if [ "$1" == "" ]; then help; fi if [ "$1" == "-h" ]; then help; fi if [ "$1" == "--help" ]; then help; fi dnsmx $1 | sort -n | while true; do read x1 x; if [ "$?" == "1" ]; then break; fi queryrelay $x; done From mv at cdc.gov Thu Jul 8 18:52:22 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Thu, 08 Jul 2004 18:52:22 -0700 Subject: [IP] Hi-tech rays to aid terror fight Message-ID: <40EDFA56.99C18E5A@cdc.gov> At 01:08 PM 7/8/04 -0400, Sunder wrote: >I recently visited the Canadian side of Niagra falls. On the return entry >to the US customs, etc. meant driving through penns that look like toll >booths. But I noticed little sensors in pairs and large square sensors as >well. 1. I've seen adverts for linear sensors which image the bottoms of cars as they drive over. Sort of a scanner where the paper does the moving. Installed in the road. 2. There are companies developing sensors that bombard your car with neutrons (don't have to open the trunk), and detect the N from the temporary neutron-activated gamma emissions. 3. Obviously license plate OCR is trivial. 4. I've read papers on recognizing vehicles by their inductive signature as they drive over regular road sensors. This was to passively measure road speed for traffic control. The idea is that a VW Beetle has a different inductance vs. time than a Ford-250 or an 18 wheeler. You correlate between roadloops at known distances apart and infer road speed. 5. One could call terahertz "hard RF" in same way that hard x-rays bleed into soft gammas. But calling anything "hard" implies danger, and we mustn't scare the proles. Perhaps soft IR is better. Whatever, its still pornography if the resolution is high enough. From mv at cdc.gov Thu Jul 8 18:59:09 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Thu, 08 Jul 2004 18:59:09 -0700 Subject: Faster than Moore's law, Brinworld Message-ID: <40EDFBED.3EE2D5C8@cdc.gov> At 02:49 PM 7/8/04 -0400, Tyler Durden wrote: > >I'd also point out that imaging technology (eg, CCDs) are moving like a bat >out of hell, though I'm not sure of the relevance vz Cypherpunks. Although its kinda boring and dry, Brill's work on ubiquitous cameras is relevent to this list. In the EE trade mags I've seen 1. how to do strobe flashes efficiently with camera batteries 2. piezo and/or hydraulic autofocus mechanisms being developed. For cellcams. Stabilization will come too. And the CMOS boys are fighting to get their sensors as good as CCDs, though it really doesn't matter, the volume is so high, you can use funky fabs --just like primitive 6" wafer fabs being used for cellphone power amps. Heck, big fat 1 uM wires are better for analog. And you can still have your 0.1 uM CMOS logic do the compression to save bandwidth, which is the commodity being sold, the handset part of the contract. In the future only pros will own gizmos that only take pictures. Just like only surveyors and farmers would own a gizmo that only does GPS. From mv at cdc.gov Thu Jul 8 19:08:52 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Thu, 08 Jul 2004 19:08:52 -0700 Subject: Faster than Moore's law Message-ID: <40EDFE33.46AD2B0@cdc.gov> At 03:05 PM 7/8/04 -0700, Steve Schear wrote: >At 09:31 PM 7/7/2004, Major Variola (ret) wrote: > > >>At 02:55 PM 7/7/04 -0500, J.A. Terranson wrote: >> >"A few years ago". Lets call it two years ago. That would make the >> >average hi-cap drive around 30gb. >> >>Just want to remind y'all that drive capacity has increased *faster* >>than semiconductor throughput, which has an 18 month doubling time. > >But access time has not nearly kept pace. Which is why all manner of >database architectures have been created to make up for this shortcoming. True 'nuff. But DRAM is so cheap you put a few tens o' megs in the drive and cache the hell out of it. And the busses on the x86 have gotten much faster too. And the CPU itself is caching things up the kazoo. Remember the 640KB days? Its easier to add cache than to add a Montgomery unit, though instruction-sets are evolving towards symmetric crypto too. The FPGA players are noticing all this too. Get an Arm (tm) by default, or synthesize a soft CPU, and buy a third-party verified Montgomery unit. Maybe even get to add your own instructions to the basic CPU unit. And yeah, you keep enough pointers around, you can have some pretty fast DBs. Dereferencing spaghetti. Or dodder in the forest of trees. ------ PS: if the TSA goons detect a tumor with their highres Thz scanners, do they have to tell you? From mv at cdc.gov Thu Jul 8 19:55:43 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Thu, 08 Jul 2004 19:55:43 -0700 Subject: sweet noise Message-ID: <40EE092F.85CC8C1E@cdc.gov> If you've ever developed crypto hardware or software, you get to the point where you memorize the hex for a key & block, and when you see it computed correctly (even as you tweak the code or RTL) its a joy. One can also look at the entropic properties as you feed test vectors (eg 1,2,3,4...) into it (emulating a PRNG), and when you pass Marsaglia's Diehard or otherwise measure 1 bit/symbol, you know things are cool. See, you write test progs to encrypt, decrypt, and check that things D(E(x))=x; you also use published test vectors as "gold standards". But I've only got half the protocol coded, so I could only assure that highly redundant input gets turned into noise. Noise, sweet noise, even if its just eyeballing the hex. Of course, lots of error handling and input checking to assure that one has covered all the bases (and corner cases); but before that tedium there's the joy of making munitions by typing. Cypherpunks *do* write code. Or copy others', wrap it in a class, and put it together in useful ways. Under the cold, shaded eyes of a poster of lots of Agent Smiths. When I was unemployed for a year, which might recur in a month or so, I was worried about outsourcing, albeit as a lib that bothered me. Recently I realized that the kiretsu has outsourced software to the US, refilling my checking account, even better, saving my self-esteem. -------- Additional case studies are needed, however, to determine which traits of chemical and biological terrorists might help identify them because charisma, paranoia, and grandiosity are alo found to varying degreees among, for example, leaders of political parties, large corporations, and academic depts. --John T Finn, _Science_ v 289 1 sept 2000 From justin-cypherpunks at soze.net Thu Jul 8 14:50:44 2004 From: justin-cypherpunks at soze.net (Justin) Date: Thu, 8 Jul 2004 21:50:44 +0000 Subject: Querying SSL/TLS capabilities of SMTP servers In-Reply-To: <0407081735340.-1275484700@somehost.domainz.com> References: <0407081735340.-1275484700@somehost.domainz.com> Message-ID: <20040708215044.GA20069@arion.soze.net> On 2004-07-08T17:50:57+0200, Thomas Shaddack wrote: > I cobbled up together a small bash shell script that does this. It lists > the MX records for a domain, and then tries to connect to each of them, > issue an EHLO command, disconnect, then list the output of the server, ... Or, in perl... though I wonder if there's a way to get capabilities with Net::SMTP. Might make this cleaner. #!/usr/bin/perl use IO::Socket; use Net::DNS; for ($i = 0; $i <= $#ARGV; $i++) { my @mx = mx($ARGV[$i]); foreach $record (@mx) { my $hastls = 0; my $mhost = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $record->exchange, PeerPort => "25", Timeout => "10" ); print $mhost "EHLO I-love-my-country.whitehouse.gov\n"; print $mhost "QUIT\n"; while (<$mhost>) { if (/STARTTLS/) { $hastls = 1; last; } } print "$ARGV[$i] " . $record->preference . " " . $record->exchange; print $hastls ? " adv-tls\n" : " no-tls\n"; close $mhost; } } From shaddack at ns.arachne.cz Thu Jul 8 14:17:01 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Thu, 8 Jul 2004 23:17:01 +0200 (CEST) Subject: photodisc search (was Re: BOUNTY BEAR is Faster ...) In-Reply-To: References: Message-ID: <0407082313050.9796@somehost.domainz.com> A big database of images with metadata can be used to train a neural network (or other suitable AI approach) to recognize unknown images. On Thu, 8 Jul 2004, Tyler Durden wrote: > > Yeah, but this is a metadata search, correct? Seems to me Our Protectors(TM) > are probably able to search a vast database of images themselves. In other > words, go look for details they hadn't previously thought of as being > important (and hence were not available in metadata). Given high-density CCDs > and real cheap storage, these details may be very minute, or perhaps small+far > away. From bill.stewart at pobox.com Fri Jul 9 00:25:12 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Fri, 09 Jul 2004 00:25:12 -0700 Subject: Final stage In-Reply-To: <20040708072448.M7047@ubzr.zsa.bet> References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> <20bf32b7040708051742ce3b18@mail.gmail.com> <20040708072448.M7047@ubzr.zsa.bet> Message-ID: <6.0.3.0.0.20040709002352.03736910@pop.idiom.com> > > > A few years ago it was requests on how to make bombs, now it's this shit. > > > > The "UBL is GW" message sounded provocateurish, too. But Osama bin Laden and George Dubya _were_ good buddies, weren't they? From justin-cypherpunks at soze.net Thu Jul 8 18:03:34 2004 From: justin-cypherpunks at soze.net (Justin) Date: Fri, 9 Jul 2004 01:03:34 +0000 Subject: Querying SSL/TLS capabilities of SMTP servers In-Reply-To: <0407090137550.0@somehost.domainz.com> References: <0407081735340.-1275484700@somehost.domainz.com> <20040708215044.GA20069@arion.soze.net> <0407090137550.0@somehost.domainz.com> Message-ID: <20040709010334.GA20612@arion.soze.net> On 2004-07-09T01:46:26+0200, Thomas Shaddack wrote: > > It fails on hotmail.com; my script has problems there as well (and with > couple others, the cure seems to be adding delays between the lines sent > to the server; it makes the program slow, but more reliable). This should work much better, and has some additional keywords that help to figure out what's going on. This works on hotmail. I noticed one host was hanging until I started using \r\n. It might be worthwhile to ensure nagle is turned off between the EHLO and the QUIT. #!/usr/bin/perl use IO::Socket; use Net::DNS; $dlevel = 0; sub debug { ($str, $mlevel) = @_; if ($mlevel <= $dlevel) { print "DEBUG $str"; } } sub checkmailtls { my ($domain, $mpri, $mrelay) = @_; my $proto = ""; my $hastls = "no-tls"; my @special; my $mhost = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $mrelay, PeerPort => "25", Timeout => "5" ); if (! defined $mhost) { print "$domain $mpri $mrelay noconnect\n"; return; } debug("testing $mrelay $mpri\n", 1); $greeting = <$mhost>; if ($greeting =~ /\*\*\*\*\*\*\*\*/) { $proto = "smtp"; push (@special, "filtered"); } if ($greeting =~ /(esmtp|postfix|sendmail)/i) { $proto = "esmtp"; } elsif ($greeting =~ /[^eE][sS][mM][tT][pP]/) { $proto = "smtp"; } else { $proto = "smtp"; } print $mhost "EHLO I-love-my-country.whitehouse.gov\r\n"; print $mhost "QUIT\r\n"; while (<$mhost>) { if (/^5[0-9]{2}/) { if ($proto == "esmtp") { push(@special, "lies"); $proto = "smtp"; } $hastls = "no-tls"; last; } if (/STARTTLS/) { if ($proto == "smtp") { $proto = "esmtp"; push(@special, "stealth"); } $hastls = "adv-tls"; last; } } print "$domain $mpri $mrelay $proto $hastls @special\n"; close $mhost; } ### begin #### debug("argc: $#ARGV\n", 1); if ($#ARGV >= 0) { for ($i = 0; $i <= $#ARGV; $i++) { push (@ipstack, $ARGV[$i]); } } else { while (<>) { chomp; push (@ipstack, $_); } } while ($domain = shift(@ipstack)) { # $res = Net::DNS::Resolver->new(); # @mx = mx($res, $domain); my @mx = mx($domain); if ($#mx == -1) { print "no MX!\n"; } foreach $record (@mx) { my $mrelay = $record->exchange ; my $mpri = $record->preference ; checkmailtls($domain, $mpri, $mrelay); } } From shaddack at ns.arachne.cz Thu Jul 8 16:46:26 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Fri, 9 Jul 2004 01:46:26 +0200 (CEST) Subject: Querying SSL/TLS capabilities of SMTP servers In-Reply-To: <20040708215044.GA20069@arion.soze.net> References: <0407081735340.-1275484700@somehost.domainz.com> <20040708215044.GA20069@arion.soze.net> Message-ID: <0407090137550.0@somehost.domainz.com> It fails on hotmail.com; my script has problems there as well (and with couple others, the cure seems to be adding delays between the lines sent to the server; it makes the program slow, but more reliable). In my case I added "-i 3" to the netcat options. Isn't a panacea, but helped in most cases. In the rest, I have to resort to telnet. Thanks a lot. Seems I have to learn perl. Looks powerful. On Thu, 8 Jul 2004, Justin wrote: > On 2004-07-08T17:50:57+0200, Thomas Shaddack wrote: > > I cobbled up together a small bash shell script that does this. It lists > > the MX records for a domain, and then tries to connect to each of them, > > issue an EHLO command, disconnect, then list the output of the server, > .. > > Or, in perl... though I wonder if there's a way to get capabilities with > Net::SMTP. Might make this cleaner. > > > #!/usr/bin/perl > > use IO::Socket; > use Net::DNS; > > for ($i = 0; $i <= $#ARGV; $i++) { > my @mx = mx($ARGV[$i]); > foreach $record (@mx) { > my $hastls = 0; > my $mhost = IO::Socket::INET->new ( > Proto => "tcp", > PeerAddr => $record->exchange, > PeerPort => "25", > Timeout => "10" > ); > print $mhost "EHLO I-love-my-country.whitehouse.gov\n"; > print $mhost "QUIT\n"; > while (<$mhost>) { > if (/STARTTLS/) { > $hastls = 1; > last; > } > } > print "$ARGV[$i] " . $record->preference . " " . $record->exchange; > print $hastls ? " adv-tls\n" : " no-tls\n"; > close $mhost; > } > } From shaddack at ns.arachne.cz Thu Jul 8 19:05:13 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Fri, 9 Jul 2004 04:05:13 +0200 (CEST) Subject: [IP] Hi-tech rays to aid terror fight In-Reply-To: <40EDFA56.99C18E5A@cdc.gov> References: <40EDFA56.99C18E5A@cdc.gov> Message-ID: <0407090401220.9807@somehost.domainz.com> On Thu, 8 Jul 2004, Major Variola (ret) wrote: > 5. One could call terahertz "hard RF" in same way that hard x-rays > bleed into soft gammas. But calling anything "hard" implies danger, > and we mustn't scare the proles. Perhaps soft IR is better. Technically, it's closer to soft IR. If I remember correctly, terahertz detectors are closer to bolometers than to antennas. However, "hard microwaves" could be good (or bad, depending on your side of the chessboard) name for psyops purposes. From justin-cypherpunks at soze.net Thu Jul 8 23:52:50 2004 From: justin-cypherpunks at soze.net (Justin) Date: Fri, 9 Jul 2004 06:52:50 +0000 Subject: Querying SSL/TLS capabilities of SMTP servers In-Reply-To: <20040709010334.GA20612@arion.soze.net> References: <0407081735340.-1275484700@somehost.domainz.com> <20040708215044.GA20069@arion.soze.net> <0407090137550.0@somehost.domainz.com> <20040709010334.GA20612@arion.soze.net> Message-ID: <20040709065250.GA21105@arion.soze.net> This one should work better. The last one had string comparison problems. #!/usr/bin/perl use IO::Select; use IO::Socket; use Net::DNS; $ehloname = "mail.senate.gov"; $timeout = 15; $dlevel = 0; sub debug { (my $str, my $mlevel) = @_; if ($mlevel <= $dlevel) { print "DEBUG $str"; } } sub checkmailtls { my ($domain, $mpri, $mrelay) = @_; my $proto = "smtp"; my $hastls = "no-tls"; my @flags; my $mhost = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $mrelay, PeerPort => "25", Timeout => "10" ); if (! defined $mhost) { print "$domain $mpri $mrelay noconnect\n"; return; } debug("opened connection to $mrelay\n", 1); $sel = IO::Select->new($mhost); @readable = $sel->can_read($timeout); # magic number if ($#readable == -1) { print "$domain $mpri $mrelay timeout-a\n"; goto OUT; } $greeting .= <$mhost>; # there's only one handle; we know which it is. debug("greeting: $greeting", 2); if ($greeting =~ /[\\*]{8}/) { $proto = "smtp"; push (@flags, "filtered"); } if ($greeting =~ /\b(esmtp|postfix|exim|sendmail)\b/i) { debug("setting esmtp (greet)!\n", 1); $proto = "esmtp"; debug("found esmtp-indicator in greeting\n", 1); } print $mhost "EHLO $ehloname\r\n"; print $mhost "QUIT\r\n"; if (! (@readable = $sel->can_read($timeout))) { print "$domain $mpri $mrelay timeout-b\n"; goto OUT; } while (<$mhost>) { #$sel->can_read(0)) { chomp; debug("loop-recv: $_\n", 2); if (/^5[0-9]{2}/) { if ($proto =~ /^esmtp/) { push(@flags, "lies"); $proto = "smtp"; } $hastls = "no-tls"; last; } if (/STARTTLS/) { if ($proto =~ /^smtp/) { debug("setting esmtp (stls)!\n", 1); $proto = "esmtp"; push(@flags, "nobproto"); } $hastls = "adv-tls"; last; } } print "$domain $mpri $mrelay $proto $hastls @flags\n"; # try again just in case the remote host didn't notice the first one print $mhost "QUIT\r\n"; OUT: close $mhost; debug("closed connection to $mrelay\n", 1); } ### begin #### if ($#ARGV >= 0) { for ($i = 0; $i <= $#ARGV; $i++) { push (@hostfifo, $ARGV[$i]); } } else { while (<>) { chomp; push (@hostfifo, $_); } } while ($domain = shift(@hostfifo)) { my @mx = mx($domain); if ($#mx == -1) { checkmailtls($domain, "A", $domain); } else { foreach $record (@mx) { my $mrelay = $record->exchange; my $mpri = $record->preference; checkmailtls($domain, $mpri, $mrelay); } } } From eugen at leitl.org Fri Jul 9 00:03:48 2004 From: eugen at leitl.org (Eugen Leitl) Date: Fri, 9 Jul 2004 09:03:48 +0200 Subject: [IP] Hi-tech rays to aid terror fight In-Reply-To: <40EDFA56.99C18E5A@cdc.gov> References: <40EDFA56.99C18E5A@cdc.gov> Message-ID: <20040709070348.GE1141@leitl.org> On Thu, Jul 08, 2004 at 06:52:22PM -0700, Major Variola (ret) wrote: > Whatever, its still pornography if the resolution is high enough. THz EM radiation only has a (relatively shallow) penetration depth for clothes, plastic, wood, sand and soil. It might do to detect a ceramics knife on a person through clothes, or for (say, skin cancer) diagnostics, but it will only pick up an explosive spectrum if it's wrapped in paper/cardboard/plastic foil, or not wrapped at all. Looking for nitrogen doesn't cover all explosives, but most of them. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From sunder at sunder.net Fri Jul 9 06:47:12 2004 From: sunder at sunder.net (Sunder) Date: Fri, 9 Jul 2004 09:47:12 -0400 (edt) Subject: Faster than Moore's law In-Reply-To: <6.0.1.1.0.20040708150322.0435cbc8@mail.comcast.net> References: <40ECCE31.B1C8BED2@cdc.gov> <6.0.1.1.0.20040708150322.0435cbc8@mail.comcast.net> Message-ID: On Thu, 8 Jul 2004, Steve Schear wrote: > >Just want to remind y'all that drive capacity has increased *faster* > >than semiconductor throughput, which has an 18 month doubling time. > > But access time has not nearly kept pace. Which is why all manner of > database architectures have been created to make up for this shortcoming. Which is still perfectly fine for data that you collect but search/access very rarely which I'd guess is the type of data we're talking about here. You collect the data, index it (or extract metadata from it in other ways) and you _almost_ never access it again. From sunder at sunder.net Fri Jul 9 07:05:47 2004 From: sunder at sunder.net (Sunder) Date: Fri, 9 Jul 2004 10:05:47 -0400 (edt) Subject: [IP] Hi-tech rays to aid terror fight In-Reply-To: <40EDFA56.99C18E5A@cdc.gov> References: <40EDFA56.99C18E5A@cdc.gov> Message-ID: On Thu, 8 Jul 2004, Major Variola (ret) wrote: > 1. I've seen adverts for linear sensors which image the bottoms > of cars as they drive over. Sort of a scanner where the paper > does the moving. Installed in the road. Come to think of it, yes, the "road" within the tollbooth gate was a bit raised, so there could well have been sensors underneath it. Might as well add all the sensors you can afford, after all any cars going through the gate are a captive audience. > 2. There are companies developing sensors that bombard > your car with neutrons (don't have to open the trunk), > and detect the N from the temporary neutron-activated gamma emissions. > > 3. Obviously license plate OCR is trivial. Natch. I also did see the big red IR lamps behind, but that's old school in almost any toll booth. > 4. I've read papers on recognizing vehicles by their inductive > signature as they drive over regular road sensors. This was > to passively measure road speed for traffic control. The idea > is that a VW Beetle has a different inductance vs. time than > a Ford-250 or an 18 wheeler. You correlate between > roadloops at known distances apart and infer road speed. Or you OCR license plates which is mostly trivial these days, or a combination of both. Then again, for upstate NY, you actually get a card for NYS Throughway and pay when you exit at another tollbooth. Card has a magnetic stripe, and shows the entry point on the throughway. So there are obviously other less expensive ways to do just that. Add cameras with timestamps at each tollboth and a way to keep track of which card was where and you've got a verifiable robust tracking system. > 5. One could call terahertz "hard RF" in same way that hard x-rays > bleed into soft gammas. But calling anything "hard" implies danger, > and we mustn't scare the proles. Perhaps soft IR is better. :) Sort of like spammers calling their trade "targetted mails" or "opt-in" Heh, would be funny if the 4am NINJA SWAT raid teams painted happy faces on their helmets and say "Have a nice day" as they shoot. > Whatever, its still pornography if the resolution is high enough. What was that quote?... "tits or nukes, it's all just bits on the wire" I also recall reading recently about those colored plastic/glass embedded in the road bumps that reflect light (so you can see your lane better?) are being retrofitted with cameras in them and set at an angle to read the license plate and measure speed as you drive over them by some company. Bah, wetware memory sucks. :( From s.schear at comcast.net Fri Jul 9 11:30:52 2004 From: s.schear at comcast.net (Steve Schear) Date: Fri, 09 Jul 2004 11:30:52 -0700 Subject: USA PATRIOT Act Survives Amendment Attempt (fwd from brian-slashdotnews@hyperreal.org) In-Reply-To: <20040709132750.GQ1141@leitl.org> References: <20040709132750.GQ1141@leitl.org> Message-ID: <6.0.1.1.0.20040709112750.04e12940@mail.comcast.net> At 06:27 AM 7/9/2004, Eugen Leitl wrote: >*** PGP Signature Status: good >*** Signer: Eugen Leitl (makes other keys obsolete) >(Invalid) >*** Signed: 7/9/2004 6:27:50 AM >*** Verified: 7/9/2004 11:27:24 AM >*** BEGIN PGP VERIFIED MESSAGE *** > >----- Forwarded message from brian-slashdotnews at hyperreal.org ----- > >From: brian-slashdotnews at hyperreal.org >Date: 9 Jul 2004 13:26:01 -0000 >To: slashdotnews at hyperreal.org >Subject: USA PATRIOT Act Survives Amendment Attempt >User-Agent: SlashdotNewsScooper/0.0.3 > >Link: http://slashdot.org/article.pl?sid=04/07/09/1145225 >Posted by: michael, on 2004-07-09 12:49:00 >Topic: us, 90 comments > > from the i-feel-safer-already dept. > crem_d_genes writes "A bill to modify the USA PATRIOT Act that would > have blocked part of the legislation's provisions that allow for the > investigation of people's reading habits [1]was defeated by a 210-210 > vote in the U.S House of Representives. The House leaders kept the > roll call open for 23 minutes past the 15 minute deadline to persuade > 10 Representatives to change votes. According to the article 'Rep. > Zach Wamp, R-Tenn., said he switched his initial "yes" vote to "no" > after being shown Justice Department documents asserting that > terrorists have communicated over the Internet via public library > computers.' On the other hand, 'Critics of the Patriot Act argued that > even without it, investigators can get book store and other records > simply by obtaining subpoenas or search warrants.'" Quite a few book stores (including the local Half-Priced Books) now keep no records not required and some do not even automate and encourage their patron to pay cash. In California book sellers to such used/remaindered stores must identify themselves for tax purposes. steve From brian-slashdotnews at hyperreal.org Fri Jul 9 06:26:01 2004 From: brian-slashdotnews at hyperreal.org (brian-slashdotnews at hyperreal.org) Date: 9 Jul 2004 13:26:01 -0000 Subject: USA PATRIOT Act Survives Amendment Attempt Message-ID: Link: http://slashdot.org/article.pl?sid=04/07/09/1145225 Posted by: michael, on 2004-07-09 12:49:00 Topic: us, 90 comments from the i-feel-safer-already dept. crem_d_genes writes "A bill to modify the USA PATRIOT Act that would have blocked part of the legislation's provisions that allow for the investigation of people's reading habits [1]was defeated by a 210-210 vote in the U.S House of Representives. The House leaders kept the roll call open for 23 minutes past the 15 minute deadline to persuade 10 Representatives to change votes. According to the article 'Rep. Zach Wamp, R-Tenn., said he switched his initial "yes" vote to "no" after being shown Justice Department documents asserting that terrorists have communicated over the Internet via public library computers.' On the other hand, 'Critics of the Patriot Act argued that even without it, investigators can get book store and other records simply by obtaining subpoenas or search warrants.'" References 1. http://story.news.yahoo.com/news?tmpl=story&u=/ap/20040708/ap_on_go_co/congre ss_patriot_act ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From alan at clueserver.org Fri Jul 9 14:13:49 2004 From: alan at clueserver.org (alan) Date: Fri, 9 Jul 2004 14:13:49 -0700 (PDT) Subject: USA PATRIOT Act Survives Amendment Attempt (fwd from brian-slashdotnews@hyperreal.org) In-Reply-To: <0407092227560.0@somehost.domainz.com> Message-ID: On Fri, 9 Jul 2004, Thomas Shaddack wrote: > > On Fri, 9 Jul 2004, Steve Schear wrote: > > > Quite a few book stores (including the local Half-Priced Books) now keep no > > records not required and some do not even automate and encourage their patron > > to pay cash. In California book sellers to such used/remaindered stores must > > identify themselves for tax purposes. > > The Patriot gag orders lead me to a thought. > > Is it possible to write a database access protocol, that would in some > mathematically bulletproof way ensure that the fact a database record is > accessed is made known to at least n people? A way that would ensure that > either nobody can see the data, or at least n people reliably know the > record was accessed and by whom? > > When somebody comes with a paper and asks for the data, the one currently > in charge of the database has to give them out, and may be gag-ordered. > However, when way too many people know about a secret, which the protocol > should ensure, it's better chance it leaks out, and less likely to > identify the one person responsible for the leak, who could be jailed > then. Especially when at least one of n is outside of the reach of the > paws of the given jurisdiction. > > The question is this: How to allow access to a specific file/db record in > a way that it can't be achieved without a specified list of parties (or, > for added system reliability, at least m of n parties) reliably knowing > about who and when accessed what record? With any attempt to prevent the > parties from knowing about the access leading to access failure? > > Note a peculiarity here; we don't ask for consent of the parties (that > would be a different threat-response model), we only make sure they know > about it. (We can deny the access, when at least (n-m)+1 parties refuse to > participate, though.) That would crash the system. From eugen at leitl.org Fri Jul 9 06:27:50 2004 From: eugen at leitl.org (Eugen Leitl) Date: Fri, 9 Jul 2004 15:27:50 +0200 Subject: USA PATRIOT Act Survives Amendment Attempt (fwd from brian-slashdotnews@hyperreal.org) Message-ID: <20040709132750.GQ1141@leitl.org> ----- Forwarded message from brian-slashdotnews at hyperreal.org ----- From s.schear at comcast.net Fri Jul 9 16:40:51 2004 From: s.schear at comcast.net (Steve Schear) Date: Fri, 09 Jul 2004 16:40:51 -0700 Subject: USA PATRIOT Act Survives Amendment Attempt In-Reply-To: <0407092227560.0@somehost.domainz.com> References: <20040709132750.GQ1141@leitl.org> <6.0.1.1.0.20040709112750.04e12940@mail.comcast.net> <0407092227560.0@somehost.domainz.com> Message-ID: <6.0.1.1.0.20040709163235.05117800@mail.comcast.net> At 01:44 PM 7/9/2004, you wrote: >On Fri, 9 Jul 2004, Steve Schear wrote: > > > Quite a few book stores (including the local Half-Priced Books) now keep no > > records not required and some do not even automate and encourage their > patron > > to pay cash. In California book sellers to such used/remaindered > stores must > > identify themselves for tax purposes. > >The Patriot gag orders lead me to a thought. > >Is it possible to write a database access protocol, that would in some >mathematically bulletproof way ensure that the fact a database record is >accessed is made known to at least n people? A way that would ensure that >either nobody can see the data, or at least n people reliably know the >record was accessed and by whom? This may best be accomplished by placing the data offshore and empowering the db operators with some non-repudiatable right of disclosure (especially under duress of a warrant). Some months back I discussed a procedural methodology where patrons could find out if their records hand been accessed in a way that circumvented court orders. I was told that it might work but that frustrated prosecutors might press charges of conspiracy before the fact to evade lawful orders that 'might' be issued, even if the defendant had no reasonable expectation that this might occur. steve "The law is an ass." -- Charles Dickens From bill.stewart at pobox.com Fri Jul 9 21:50:02 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Fri, 09 Jul 2004 21:50:02 -0700 Subject: USA PATRIOT Act Survives Amendment Attempt (fwd from brian-slashdotnews@hyperreal.org) In-Reply-To: <0407092227560.0@somehost.domainz.com> References: <20040709132750.GQ1141@leitl.org> <6.0.1.1.0.20040709112750.04e12940@mail.comcast.net> <0407092227560.0@somehost.domainz.com> Message-ID: <6.0.3.0.0.20040709213451.043f20b8@pop.idiom.com> At 01:44 PM 7/9/2004, Thomas Shaddack wrote: >Is it possible to write a database access protocol, that would in some >mathematically bulletproof way ensure that the fact a database record is >accessed is made known to at least n people? A way that would ensure that >either nobody can see the data, or at least n people reliably know the >record was accessed and by whom? >.... >Note a peculiarity here; we don't ask for consent of the parties (that >would be a different threat-response model), we only make sure they know >about it. The obvious method for the first half of your problem is Shamir secret-sharing - n out of m people need to provide their information in order to access the data item (or its key.) That isn't necessarily an _efficient_ protocol for databases, of course, but where you have something where it works, it works. And obviously you'd want some jurisdictional arbitrage. I'm not convinced that the second half of your problem makes sense. The only ways to make sure that somebody knows something are either to tell them or else to get them to tell you some piece of information you need. Since it's the secret police that would be running the algorithm, they're not going to be polite about telling them if they don't need to, so you're dependent on some algorithm that requires their assistance, which is in some sense consent. I suppose you could differentiate assistance and consent contractually, by telling them it's ok to release the data when given papers from some appropriate court, and you could probably even require them to notify you, e.g. by having them charge a per-event fee for their service, and maybe that'll hold up in jurisdictions where their secret police don't cooperate well with your secret police. Of course, even to use this requires that the application be designed in some manner where there's some kind of key that's needed to access the data, such as a mailbox that encrypts incoming mail with your public key. That doesn't prevent the secret police from forcing your mailbox company to reveal the information before encrypting it to you, but it does at least protect _old_ mail, unless n out of the m key escrow agents all cooperate. I don't know why you'd design a system like this when you could do it without the key escrow feature - am I missing something? Bill Stewart bill.stewart at pobox.com From shaddack at ns.arachne.cz Fri Jul 9 13:44:39 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Fri, 9 Jul 2004 22:44:39 +0200 (CEST) Subject: USA PATRIOT Act Survives Amendment Attempt (fwd from brian-slashdotnews@hyperreal.org) In-Reply-To: <6.0.1.1.0.20040709112750.04e12940@mail.comcast.net> References: <20040709132750.GQ1141@leitl.org> <6.0.1.1.0.20040709112750.04e12940@mail.comcast.net> Message-ID: <0407092227560.0@somehost.domainz.com> On Fri, 9 Jul 2004, Steve Schear wrote: > Quite a few book stores (including the local Half-Priced Books) now keep no > records not required and some do not even automate and encourage their patron > to pay cash. In California book sellers to such used/remaindered stores must > identify themselves for tax purposes. The Patriot gag orders lead me to a thought. Is it possible to write a database access protocol, that would in some mathematically bulletproof way ensure that the fact a database record is accessed is made known to at least n people? A way that would ensure that either nobody can see the data, or at least n people reliably know the record was accessed and by whom? When somebody comes with a paper and asks for the data, the one currently in charge of the database has to give them out, and may be gag-ordered. However, when way too many people know about a secret, which the protocol should ensure, it's better chance it leaks out, and less likely to identify the one person responsible for the leak, who could be jailed then. Especially when at least one of n is outside of the reach of the paws of the given jurisdiction. The question is this: How to allow access to a specific file/db record in a way that it can't be achieved without a specified list of parties (or, for added system reliability, at least m of n parties) reliably knowing about who and when accessed what record? With any attempt to prevent the parties from knowing about the access leading to access failure? Note a peculiarity here; we don't ask for consent of the parties (that would be a different threat-response model), we only make sure they know about it. (We can deny the access, when at least (n-m)+1 parties refuse to participate, though.) From Nostra2004 at SAFe-mail.net Fri Jul 9 23:04:43 2004 From: Nostra2004 at SAFe-mail.net (Nostra2004 at SAFe-mail.net) Date: Sat, 10 Jul 2004 02:04:43 -0400 Subject: USA PATRIOT Act Survives Amendment Attempt Message-ID: >At 05:22 PM 7/9/2004, Thomas Shaddack wrote: >>On Fri, 9 Jul 2004, Steve Schear wrote: >> Some months back I discussed a procedural methodology where patrons could find >> out if their records hand been accessed in a way that circumvented court >> orders. I was told that it might work but that frustrated prosecutors might >> press charges of conspiracy before the fact to evade lawful orders that >> 'might' be issued, even if the defendant had no reasonable expectation that >> this might occur. >But we have a psychological mechanism here; many people tend to be "tough" when not under direct threat. Then they implement the mechanism. Then years flow by. Then the prosecutors come. But by then it is too late to cooperate. They are doomed (though that depends largely on the available lawyers), but it can save the ones they were protecting. The mechanism Steve suggested probably needs to be applied before you ever see a court order. >It seems that, by the prosecutor logic, just about any comsec improvement you implemented may be viewed as a conspiracy, including but not limited to secure email. >I am not happy to say this, but can we ever hope for designing any kind of secure infrastructure without some nodes having to win the martyr lottery? Actually, frequent prosecutions could work to the advantage of a select few who choose to become martyrs. Since it would make it much more likely supplicants would be called upon. >....speaking about martyrs... I am just watching a TV document about cults. Maybe we could piggyback on religion and use some kinks within Christian doctrine, selected for having wide user base within Western civilization? Eg, finding a believable and theologically coherent explanation how operating a Darknet node helps undermining the reign of Satan (a voice suggests me that the Book of Prophecies, or how that horsemen thing is called, could contain enough of material to build on)? That could provide a decent amount of node ops using existing infrastructure of likely-minded religious organizations. Faith is a big motivation for undertaking risk, and while Westerners currently tend to be less radical than Middle-Easterners, this kind of mission is far from suicidal. I posted a few months back offering an alternative to religion in recruitment: the terminally ill. Nostra From shaddack at ns.arachne.cz Fri Jul 9 17:22:26 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sat, 10 Jul 2004 02:22:26 +0200 (CEST) Subject: USA PATRIOT Act Survives Amendment Attempt In-Reply-To: <6.0.1.1.0.20040709163235.05117800@mail.comcast.net> References: <20040709132750.GQ1141@leitl.org> <6.0.1.1.0.20040709112750.04e12940@mail.comcast.net> <0407092227560.0@somehost.domainz.com> <6.0.1.1.0.20040709163235.05117800@mail.comcast.net> Message-ID: <0407100144080.0@somehost.domainz.com> On Fri, 9 Jul 2004, Steve Schear wrote: > This may best be accomplished by placing the data offshore and empowering the > db operators with some non-repudiatable right of disclosure (especially under > duress of a warrant). This may be impractical in some cases. > Some months back I discussed a procedural methodology where patrons could find > out if their records hand been accessed in a way that circumvented court > orders. I was told that it might work but that frustrated prosecutors might > press charges of conspiracy before the fact to evade lawful orders that > 'might' be issued, even if the defendant had no reasonable expectation that > this might occur. But we have a psychological mechanism here; many people tend to be "tough" when not under direct threat. Then they implement the mechanism. Then years flow by. Then the prosecutors come. But by then it is too late to cooperate. They are doomed (though that depends largely on the available lawyers), but it can save the ones they were protecting. It seems that, by the prosecutor logic, just about any comsec improvement you implemented may be viewed as a conspiracy, including but not limited to secure email. I am not happy to say this, but can we ever hope for designing any kind of secure infrastructure without some nodes having to win the martyr lottery? ....speaking about martyrs... I am just watching a TV document about cults. Maybe we could piggyback on religion and use some kinks within Christian doctrine, selected for having wide user base within Western civilization? Eg, finding a believable and theologically coherent explanation how operating a Darknet node helps undermining the reign of Satan (a voice suggests me that the Book of Prophecies, or how that horsemen thing is called, could contain enough of material to build on)? That could provide a decent amount of node ops using existing infrastructure of likely-minded religious organizations. Faith is a big motivation for undertaking risk, and while Westerners currently tend to be less radical than Middle-Easterners, this kind of mission is far from suicidal. But one of the voices in my head just told me that shared MP3s would bring in more people with less effort... > "The law is an ass." > -- Charles Dickens Maybe because most of it comes out of ass-holes? From sunder at sunder.net Sat Jul 10 09:39:27 2004 From: sunder at sunder.net (Sunder) Date: Sat, 10 Jul 2004 12:39:27 -0400 (edt) Subject: USA PATRIOT Act Survives Amendment Attempt (fwd from brian-slashdotnews@hyperreal.org) In-Reply-To: <6.0.3.0.0.20040709213451.043f20b8@pop.idiom.com> References: <20040709132750.GQ1141@leitl.org> <6.0.1.1.0.20040709112750.04e12940@mail.comcast.net> <0407092227560.0@somehost.domainz.com> <6.0.3.0.0.20040709213451.043f20b8@pop.idiom.com> Message-ID: On Fri, 9 Jul 2004, Bill Stewart wrote: > At 01:44 PM 7/9/2004, Thomas Shaddack wrote: > >Is it possible to write a database access protocol, that would in some > >mathematically bulletproof way ensure that the fact a database record is > >accessed is made known to at least n people? A way that would ensure that > >either nobody can see the data, or at least n people reliably know the > >record was accessed and by whom? .. > The obvious method for the first half of your problem is > Shamir secret-sharing - n out of m people need to provide > their information in order to access the data item (or its key.) > That isn't necessarily an _efficient_ protocol for databases, Better yet, you have the n sources provide pieces of a key which auto-expires after X days, that key is used to access the database rather than getting the data from n sources. Authenticating at random with n sources, each with a different key is also required. Store the data on some persistent, distributed stores... Bit Torrent comes to mind here. > I'm not convinced that the second half of your problem makes sense. See above method and add some sort of log to it that automatically and anonymously publishes logs of access to it. So long as n>m/2 and at least n people are trustworthy it should work, right? Then, you also need a watcher app to reveal that access occured. This app downloads the logs of the hashes you're interested in, plus other random ones to prevent logging from revealing who is interested in what. Would also be nice if the hash for the data you're trying to watch/access changes with the date. That way if one user of the system is compromised, the compromisers can't figure out who the other parties accessing the same data are. But I'm not sure how you'd make it happen without tweaking the Bit Torrent client a lot, or writing a new one from scratch (invoking Not-Invented Here Syndrome). > Of course, even to use this requires that the application be designed > in some manner where there's some kind of key that's needed > to access the data, such as a mailbox that encrypts incoming mail > with your public key. That doesn't prevent the secret police from > forcing your mailbox company to reveal the information before > encrypting it to you, but it does at least protect _old_ mail, > unless n out of the m key escrow agents all cooperate. A-Yup. > I don't know why you'd design a system like this when you could > do it without the key escrow feature - am I missing something? How else would you do it and still be able to know when something was read? ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"I find it ironic that, on an amendment designed to protect /|\ \|/ :American democracy and our constitutional rights, the /\|/\ <--*-->:Republican leadership in the House had to rig the vote and \/|\/ /|\ :subvert the democratic process in order to prevail" \|/ + v + : -- Rep. Sanders re vote to ammend the US PATRIOT ACT. -------------------------------------- http://www.sunder.net ------------ From mv at cdc.gov Sat Jul 10 21:36:23 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 10 Jul 2004 21:36:23 -0700 Subject: [IP] Hi-tech rays to aid terror fight Message-ID: <40F0C3C6.29A05428@cdc.gov> At 09:03 AM 7/9/04 +0200, Eugen Leitl wrote: >Looking for nitrogen doesn't cover all explosives, but most of them. Yes. That Jamaican dude had TATP, triacetyl tri peroxide if IIRC, in his shoe. But the dingbat tried to light a shoelace on a non-smoking flight. Peroxides need contain zero nitrogen. That's the thing ---you can use all the advanced nukechem you want, as col as it is, you can't distinguish what you need to. Fuck the TSA. Avoid Athens, baby. From mv at cdc.gov Sat Jul 10 21:38:15 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 10 Jul 2004 21:38:15 -0700 Subject: Final stage Message-ID: <40F0C437.16E4383C@cdc.gov> At 12:25 AM 7/9/04 -0700, Bill Stewart wrote: >> > > A few years ago it was requests on how to make bombs, now it's this shit. >> > >> > The "UBL is GW" message sounded provocateurish, too. > >But Osama bin Laden and George Dubya _were_ good buddies, weren't they? Sure, along with that Nicaraguan dude. The tradecraft term is "blowback", to the rest of us, "feedback". Have a nice day, MV (ret) From mv at cdc.gov Sat Jul 10 21:48:19 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 10 Jul 2004 21:48:19 -0700 Subject: zombie patriots Message-ID: <40F0C693.D09F9C18@cdc.gov> At 02:04 AM 7/10/04 -0400, Nostra2004 at SAFe-mail.net wrote: > >I posted a few months back offering an alternative to religion in recruitment: the terminally ill. Yes, that remains valid. As does anonymous broadcasting, eg usenet stego. The essential problem for us sleeper cells is to be able to access the alt.port DB without 1. this being anomolous 2. the posted files being detectable. There's a nordic fellow, Nichols something or other, who has looked for stego'd files in high-bandwidth places. He has not found a babypicture hidden in a diagram of the 1945 plane-into-skyscraper picture I have posted at an alt port with even the tool & passhprase issued. Just FYI. I haven't tried posting a double-message to eBay yet, not really having anyone to communicate with, but it would be trivial. Data -> compress -> encrypt -> encode All your faxes are belong to us. "I read your email" is not just a bumper sticker in Maryland. From mv at cdc.gov Sat Jul 10 21:50:47 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 10 Jul 2004 21:50:47 -0700 Subject: Orwell as optimist Message-ID: <40F0C727.47CB32F1@cdc.gov> At 10:24 PM 7/10/04 -0500, J.A. Terranson wrote: >On Fri, 9 Jul 2004, Bill Stewart wrote: > >> But Osama bin Laden and George Dubya _were_ good buddies, weren't they? > >*Were*??? Don't you mean *are*? Hell, it's Osama that keeps the Angry >Midget in power... Hey, no offense to short people. Just *mental* midgets. We have always been at war with Oceania bin Laden... You're either with us, or against us. Vote Kerry, as the antiBush, no matter how sleazy you feel in the AM. From measl at mfn.org Sat Jul 10 20:24:05 2004 From: measl at mfn.org (J.A. Terranson) Date: Sat, 10 Jul 2004 22:24:05 -0500 (CDT) Subject: Final stage In-Reply-To: <6.0.3.0.0.20040709002352.03736910@pop.idiom.com> References: <20040707185234.25B5B11572@mail.cypherpunks.to> <20040707140219.B3309@ubzr.zsa.bet> <20bf32b7040708051742ce3b18@mail.gmail.com> <20040708072448.M7047@ubzr.zsa.bet> <6.0.3.0.0.20040709002352.03736910@pop.idiom.com> Message-ID: <20040710222314.W10724@ubzr.zsa.bet> On Fri, 9 Jul 2004, Bill Stewart wrote: > But Osama bin Laden and George Dubya _were_ good buddies, weren't they? *Were*??? Don't you mean *are*? Hell, it's Osama that keeps the Angry Midget in power... -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden From shaddack at ns.arachne.cz Sun Jul 11 10:03:14 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sun, 11 Jul 2004 19:03:14 +0200 (CEST) Subject: USA PATRIOT Act Survives Amendment Attempt In-Reply-To: References: Message-ID: <0407111747330.9849@somehost.domainz.com> On Sat, 10 Jul 2004 Nostra2004 at SAFe-mail.net wrote: > >But we have a psychological mechanism here; many people tend to be > >"tough" when not under direct threat. Then they implement the > >mechanism. Then years flow by. Then the prosecutors come. But by then > >it is too late to cooperate. They are doomed (though that depends > >largely on the available lawyers), but it can save the ones they were > >protecting. > > The mechanism Steve suggested probably needs to be applied before you ever see a court order. That's a matter of course. At the moment the Men with Bumazhkas come, it's too late to act. When the short circuit happens, it's too late to install the breakers. > Actually, frequent prosecutions could work to the advantage of a select > few who choose to become martyrs. Since it would make it much more > likely supplicants would be called upon. Please explain this thought? > I posted a few months back offering an alternative to religion in > recruitment: the terminally ill. That's not good for this purpose; their lifetime is too short. From hseaver at cybershamanix.com Tue Jul 13 06:28:54 2004 From: hseaver at cybershamanix.com (Harmon Seaver) Date: Tue, 13 Jul 2004 08:28:54 -0500 Subject: USA PATRIOT Act Survives Amendment Attempt In-Reply-To: <0407111747330.9849@somehost.domainz.com> References: <0407111747330.9849@somehost.domainz.com> Message-ID: <20040713132854.GA27574@cybershamanix.com> On Sun, Jul 11, 2004 at 07:03:14PM +0200, Thomas Shaddack wrote: > > That's a matter of course. At the moment the Men with Bumazhkas come, it's > too late to act. > Bumazhkas? I thought I was pretty familiar with most weapons of the world, but not Bumazhkas. What calibre are they? I've always liked those CZ Model 52 pistols and Model 32 subguns in .30Mauser. Loaded hot with a teflon coated bullet they should punch thru armor well. -- Harmon Seaver CyberShamanix http://www.cybershamanix.com Hoka hey! From hseaver at cybershamanix.com Tue Jul 13 06:40:12 2004 From: hseaver at cybershamanix.com (Harmon Seaver) Date: Tue, 13 Jul 2004 08:40:12 -0500 Subject: Bumazhkas In-Reply-To: <20040713132854.GA27574@cybershamanix.com> References: <0407111747330.9849@somehost.domainz.com> <20040713132854.GA27574@cybershamanix.com> Message-ID: <20040713134012.GA27601@cybershamanix.com> On Tue, Jul 13, 2004 at 08:28:54AM -0500, Harmon Seaver wrote: > > On Sun, Jul 11, 2004 at 07:03:14PM +0200, Thomas Shaddack wrote: > > > > > That's a matter of course. At the moment the Men with Bumazhkas come, it's > > too late to act. > > > Bumazhkas? I thought I was pretty familiar with most weapons of the world, > but not Bumazhkas. What calibre are they? I've always liked those CZ Model 52 > pistols and Model 32 subguns in .30Mauser. Loaded hot with a teflon coated > bullet they should punch thru armor well. > Whoops, that should be "Model 23", not model 32. The 23 - 26 series from whence the Uzi got it's basic design, IIRC. -- Harmon Seaver CyberShamanix http://www.cybershamanix.com Hoka hey! From measl at mfn.org Tue Jul 13 13:35:16 2004 From: measl at mfn.org (J.A. Terranson) Date: Tue, 13 Jul 2004 15:35:16 -0500 (CDT) Subject: Shrub flips the bird at kid Message-ID: <20040713153416.E15599@ubzr.zsa.bet> http://www.livejournal.com/users/jiveturky/185733.html After waiting around for about 45 minutes, the motorcade passed by us again. A few police cars, followed by a van or two, drove by. Then, a Bush/Cheney bus passed, followed by a second one going slower. At the front of this second bus was The W himself, waving cheerily at his supporters on the other side of the highway. Adam, Brendan, and I rose our banner (the More Trees, Less Bush one) and he turned to wave to our side of the road. His smile faded, and he raised his left arm in our direction. And then, George W. Bush, the 43rd president of the United States of America, extended his middle finger. Read that last sentence again. I got flipped off by George W. Bush. A ponytailed man standing next to us confirmed the event, saying, "I do believe the President of the U.S. just gave you boys the finger." We laughed probably for the next half hour, and promptly told everyone we knew. Brendan actually snapped a picture of Bushy in action, but the glare and the tint of the bus windows make it difficult to see him at all. Nonetheless, it was the best possible reaction. We pissed George W. Bush off. We are true patriots. From adam at cypherspace.org Tue Jul 13 14:32:18 2004 From: adam at cypherspace.org (Adam Back) Date: Tue, 13 Jul 2004 17:32:18 -0400 Subject: zks source (Re: Email tapping by ISPs, forwarder addresses, and crypto proxies) In-Reply-To: <6.0.1.1.0.20040707142810.060f2bb8@mail.comcast.net> References: <20040706214743.5D26657E2A@finney.org> <20040707200931.GA8588@bitchcake.off.net> <6.0.1.1.0.20040707142810.060f2bb8@mail.comcast.net> Message-ID: <20040713213218.GB26303@bitchcake.off.net> You could try sending an email to Austin Hill to see if he could organize releasing source for remaining freedom related source that they are not currently using. Adam On Wed, Jul 07, 2004 at 02:34:04PM -0700, Steve Schear wrote: > I wonder if the mail 2.0 code could be publicly released so it could be > used with the forthcoming i2p IP overlay http://www.i2p.net/ ? > > steve > > At 01:09 PM 7/7/2004, Adam Back wrote: > > >Then we implemented a replacement version 2 mail system that I > >designed. The design is much simpler. With freedom anonymous > >networking you had anyway a anonymous interactive TCP feature. So we > >just ran a standard pop box for your nym. Mail would be delivered to > >it directly (no reply block) for internet senders. Freedom senders > >would send via anonymous IP again to get sender anonymity. Used qmail > >as the mail system. > > > >Unfortunately they closed down the freedom network pretty soon after > >psuedonymous mail 2.0 [3] was implemented. From shaddack at ns.arachne.cz Tue Jul 13 10:15:44 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Tue, 13 Jul 2004 19:15:44 +0200 (CEST) Subject: Bumazhkas In-Reply-To: <20040713134012.GA27601@cybershamanix.com> References: <0407111747330.9849@somehost.domainz.com> <20040713132854.GA27574@cybershamanix.com> <20040713134012.GA27601@cybershamanix.com> Message-ID: <0407131910500.0@somehost.domainz.com> On Tue, 13 Jul 2004, Harmon Seaver wrote: > > Bumazhkas? I thought I was pretty familiar with most weapons of the world, > > but not Bumazhkas. What calibre are they? I've always liked those CZ Model 52 > > pistols and Model 32 subguns in .30Mauser. Loaded hot with a teflon coated > > bullet they should punch thru armor well. > > > Whoops, that should be "Model 23", not model 32. The 23 - 26 series from > whence the Uzi got it's basic design, IIRC. Bumashkas belong between the highest-caliber weapons of the bureaucracy-centered governments. You don't want to meet the adversary armed with them. They are deadly and should be banned. ("Bumazhka" is a Russian word for "form" or "paper". The way I use it should invoke the associations to Soviet-style bureaucracy, requiring a stamped permission for just about everything.) From measl at mfn.org Tue Jul 13 17:47:27 2004 From: measl at mfn.org (J.A. Terranson) Date: Tue, 13 Jul 2004 19:47:27 -0500 (CDT) Subject: Mexico Atty. General gets microchipped (fwd) Message-ID: <20040713194619.F15599@ubzr.zsa.bet> Forwarded for amusement -- Yours, J.A. Terranson sysadmin at mfn.org "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? ---------------------------------------------------------------------- http://www.cnn.com/2004/WORLD/americas/07/13/mexico.chip.reut/index.html Mexico attorney general gets microchip implant Tuesday, July 13, 2004 Posted: 5:34 PM EDT (2134 GMT) MEXICO CITY, Mexico (Reuters) -- Mexico's attorney general said on Monday he had had a microchip inserted under the skin of one of his arms to give him access to a new crime database and also enable him to be traced if he is ever abducted. Attorney General Rafael Macedo said a number of his staff had also been fitted with chips which will give them exclusive and secure access to a national, computerized database for crime investigators that went live on Monday. "It's an area of high security, it's necessary that we have access to this, through a chip, which what's more is unremovable," Macedo told reporters. "The system is here and I already have it. It's solely for access, for safety and so that I can be located at any moment wherever I am," he said, admitting the chip hurt "a little." The chips would enable the wearer to be found anywhere inside Mexico, in the event of an assault or kidnapping, said Macedo. And kidnapping is a huge problem here. From 1992 to 2002, Mexico saw some 15,000 kidnappings, second only to war-torn Colombia, according to the Inter-American Development Bank. Crime-fighting is a dangerous business in Mexico, where police are notoriously corrupt and where political figures and investigative journalists sometimes risk assassination. Mexico has seen a surge in violent crime recently, with an onslaught of headlines about murders and kidnappings prompting Fox to pledge in a national broadcast to crack down on crime. In June a quarter of a million people protested the government's failure to combat crime. From mv at cdc.gov Tue Jul 13 22:14:20 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 13 Jul 2004 22:14:20 -0700 Subject: USA PATRIOT Act Survives Amendment Attempt Message-ID: <40F4C12C.B7F61731@cdc.gov> At 08:28 AM 7/13/04 -0500, Harmon Seaver wrote: > Bumazhkas? I thought I was pretty familiar with most weapons of the world, >but not Bumazhkas. What calibre are they? I've always liked those CZ Model 52 >pistols and Model 32 subguns in .30Mauser. Loaded hot with a teflon coated >bullet they should punch thru armor well. I have a doubt about polytetrafluoroethylene, but I have no experience. I do know that tungsten is sold on eBay, any diamond bit should lathe it, and its nearly equal to DU (modulo how DU is free to DoD), should you be into reloading. From mv at cdc.gov Tue Jul 13 22:17:37 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 13 Jul 2004 22:17:37 -0700 Subject: Trimming the bush Message-ID: <40F4C1F1.5F09A303@cdc.gov> At 03:35 PM 7/13/04 -0500, J.A. Terranson wrote: >http://www.livejournal.com/users/jiveturky/185733.html > > After waiting around for about 45 minutes, the motorcade passed by us >again. A few police cars, followed by a van or two, drove by. Then, a >Bush/Cheney bus passed, followed by a second one going slower. At the A recent History channel show indicated that the nuclear football was in a car a few cars behind the C student. Glad you weren't swarmed. Maybe the 1st hasn't been as raped as the rest of the BoR. Maybe GWB stole a little of his nieces valium to chill. From mv at cdc.gov Tue Jul 13 22:20:44 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 13 Jul 2004 22:20:44 -0700 Subject: Mexico Atty. General gets microchipped (fwd) Message-ID: <40F4C2AC.827EEB2D@cdc.gov> At 07:47 PM 7/13/04 -0500, J.A. Terranson wrote: > "...justice is a duty towards those whom you love and those whom you do > not. And people's rights will not be harmed if the opponent speaks out > about them." > > Osama Bin Laden > > "There aught to be limits to freedom!" > George Bush > >Which one scares you more? "The government of the United States is not, in any sense, founded on the Christian religion." -George Washington, November 4, 1796 "No, I don't know that Atheists should be considered as citizens, nor should they be considered patriots. This is one nation under God." -GW Bush From mv at cdc.gov Tue Jul 13 22:22:42 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 13 Jul 2004 22:22:42 -0700 Subject: Mexico Atty. General gets microchipped (fwd) Message-ID: <40F4C322.51615CB9@cdc.gov> At 06:30 AM 7/14/04 +0200, Thomas Shaddack wrote: >Politicians getting RFIDs. > >Will it spur a new generation of smart roadside bombs, landmines, and >perhaps homing missiles? Do you think UBL tossed his $10K satphone for yucks? It tended to attract cruise missiles launched by distant cowards. You think the DARPA micro-UAV program is for fun? Don't let Mossad repair your cell phone, baby. From shaddack at ns.arachne.cz Tue Jul 13 21:30:46 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Wed, 14 Jul 2004 06:30:46 +0200 (CEST) Subject: Mexico Atty. General gets microchipped (fwd) In-Reply-To: <20040713194619.F15599@ubzr.zsa.bet> References: <20040713194619.F15599@ubzr.zsa.bet> Message-ID: <0407140619080.9868@somehost.domainz.com> On Tue, 13 Jul 2004, J.A. Terranson wrote: > Forwarded for amusement > http://www.cnn.com/2004/WORLD/americas/07/13/mexico.chip.reut/index.html > Mexico attorney general gets microchip implant Politicians getting RFIDs. Will it spur a new generation of smart roadside bombs, landmines, and perhaps homing missiles? 1. Get the politico's ID. 2. Release a tiny unmanned drone with a small shaped charge. 3. Let it fly over the city or a highway, patroling patiently, drinking the nectar of the sunshine with the panels of its wings, occassionally pinging the ground below. 4. Wait until it hears the target response, then aims to the target using the RFID's response signal the way tracking radars do, falling down for a suicide kill, not dissimilar to a beast of prey. ....then a counter-technology appears and the cycle will repeat again. From sunder at sunder.net Wed Jul 14 07:01:07 2004 From: sunder at sunder.net (Sunder) Date: Wed, 14 Jul 2004 10:01:07 -0400 (edt) Subject: Mexico Atty. General gets microchipped (fwd) In-Reply-To: <20040713194619.F15599@ubzr.zsa.bet> References: <20040713194619.F15599@ubzr.zsa.bet> Message-ID: On Tue, 13 Jul 2004, J.A. Terranson wrote: > Forwarded for amusement > "...justice is a duty towards those whom you love and those whom you do > not. And people's rights will not be harmed if the opponent speaks out > about them." > > Osama Bin Laden > > - - - > > "There aught to be limits to freedom!" > > George Bush > > > - - - > > Which one scares you more? The about sounds like a great .signature file. :) > > ---------------------------------------------------------------------- > http://www.cnn.com/2004/WORLD/americas/07/13/mexico.chip.reut/index.html > > Mexico attorney general gets microchip implant > "It's an area of high security, it's necessary that we have access to > this, through a chip, which what's more is unremovable," Macedo told > reporters. Huh? any implantable is removeable... What, kidnappers, in Mexico don't have access to alumium foil, faraday cages, frequency counters and {hatchets,knives,scalpels,chain saws}, etc? > The chips would enable the wearer to be found anywhere inside Mexico, in > the event of an assault or kidnapping, said Macedo. Which means it's transmitting, and to do so, it's not an RFID, it's a bug with a battery. If if it doesn't transmit at all times, there's a scar somewhere which points where it is. This ploy would have only worked if the kidnappers didn't know about it in advance. Now they do. It will stop the lame ones. The hardass criminals know how to deal with it. IMHO, this is a publicity op - not much else, designed to discourage potential kidnappers, and enourage the public to get chipped. "What's the frequency Kenneth?" comes to mind. ROTFL! From sunder at sunder.net Thu Jul 15 09:20:33 2004 From: sunder at sunder.net (Sunder) Date: Thu, 15 Jul 2004 12:20:33 -0400 (edt) Subject: New trend: dropping trou at the TSA Message-ID: BoingBoing calls this "The Freedom Flash" http://www.boingboing.net/2004/07/14/man_flashes_authorit.html ---- http://news.yahoo.com/news?tmpl=story&u=/ap/20040714/ap_on_fe_st/airport_flasher_1 Man Exposes Self During Airport Screening Wed Jul 14, 9:07 AM ET Add Strange News - AP to My Yahoo! By The Associated Press MINNEAPOLIS - Daryl Miller didn't make it through airport security because he couldn't keep his pants on. Airport police said a security screener was waving a metal-detecting wand over Miller's pants area on Friday when Miller pulled his shorts down to his ankles. He wasn't wearing any underwear. Miller then said, "There, how do you like your job," thus ending the screening, according to the police report. He was charged with indecent exposure and released on $300 bail. ... "This person exposed themself in a public area, a clear violation of the law, and we needed to take some action on that, otherwise everybody would be dropping their pants," Christenson said. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"I find it ironic that, on an amendment designed to protect /|\ \|/ :American democracy and our constitutional rights, the /\|/\ <--*-->:Republican leadership in the House had to rig the vote and \/|\/ /|\ :subvert the democratic process in order to prevail" \|/ + v + : -- Rep. Sanders re vote to ammend the US PATRIOT ACT. -------------------------------------- http://www.sunder.net ------------ From anmetet at freedom.gmsociety.org Fri Jul 16 03:35:02 2004 From: anmetet at freedom.gmsociety.org (An Metet) Date: Fri, 16 Jul 2004 06:35:02 -0400 Subject: vacuum-safe laptops ? Message-ID: <46bd8b6c2c2de0d4da3507c7eb505bf8@anonymous> Does anyone *know* (first or second hand, I can speculate myself) which laptops, if any, can safely go to zero air pressure (dropping from 1 atm to 0 in, say, 1 minute.) From dave at farber.net Fri Jul 16 06:07:22 2004 From: dave at farber.net (David Farber) Date: Fri, 16 Jul 2004 09:07:22 -0400 Subject: [IP] Government Is 'Reshaping' Airport Screening System Message-ID: Government Is 'Reshaping' Airport Screening System By MATTHEW L. WALD Published: July 16, 2004 ASHINGTON, July 15 - The government is backing away from a plan to use commercial databases in its computerized system for determining which airline passengers might pose a security risk. But it is pressing ahead with a new computer system that will rely on government databases. The goal is a better screening tool that will select about 4 percent of all passengers for more intense scrutiny, compared with the 14 percent identified by the current system. Some travelers are now chosen for more intensive "secondary screenings" at random, and others are chosen for reasons that are supposed to be secret but are thought to include booking at the last minute, buying one-way tickets and paying with cash. The acting administrator of the Transportation Security Administration, David M. Stone, told the Senate Governmental Affairs Committee on Tuesday that his agency was "reshaping and repackaging" the screening system, which was originally supposed to use commercial databases that sweep in data on credit, home ownership, telephone records and car registration as a way to evaluate whether the name given by a passenger was real. That plan, called Capps 2, for Computer Assisted Passenger Pre-Screening, had been criticized as an invasion of passengers' privacy. On Wednesday the secretary of homeland security, Tom Ridge, was quoted in USA Today as saying that Capps 2 was dead. But a spokesman for his agency, Brian Roehrkasse, said Thursday that "the administration continues to move forward on an automated aviation passenger prescreening system to replace the existing antiquated airline system, to better manage risk and be more efficient." Mr. Roehrkasse said he did not know when the new system would be put into place. Much of it is still under development, he said. The law that established the Transportation Security Administration, passed by Congress in November 2001, two months after the terrorist attacks, included a variety of requirements for the new agency. One was to screen all baggage. That destroyed the rationale of the original Capps system, which was established in 1998 in response to the possibility of a bomb in a checked suitcase like the one that destroyed Pan Am Flight 103 over Lockerbie, Scotland. Another requirement was to develop a better screening tool to pick which passengers, with their carry-on luggage, should be scrutinized. The new system is supposed to rely on government databases. The government already has a so-called no-fly list, which is actually a list of people whom the airlines are not supposed to carry, and a larger list of people who are supposed to be put through secondary screening if they seek to fly. According to an administration official who asked not to be identified, those two lists have fewer than 10,000 names but the new computer system would integrate a list of names that is "dramatically larger." The official would not be more specific about either number. In addition, various government agencies maintain lists of names now, including the State Department, the Immigration and Naturalization Service, the F.B.I. and the C.I.A. A federal agency established last December within the Department of Homeland Security, the Terrorist Screening Center, is supposed to integrate these lists. The agencies use a variety of bases for identifying individuals as suspect. The Capps 2 system was supposed to be based on passengers' names, addresses and phone numbers; the original proposal for the system would have required passengers to submit their dates of birth as well. The new system might still do that, according to the official. Laura W. Murphy, the director of the Washington office of the American Civil Liberties Union, one of the organizations that had been critical of Capps 2, said a system that relied solely on government databases could still be unfair, because the databases themselves would have errors. But she said she was glad that the government was no longer proposing to run every name through commercial databases. "We don't want to turn into a society where everybody is treated like a suspect and everybody is investigated," Ms. Murphy said. The recently released Senate Intelligence Committee report and the hearings held by the Sept. 11 commission have demonstrated shortcomings in intelligence, Ms. Murphy said, and no-fly lists based on flawed intelligence would mean a security system "built on what right now appears to be a house of cards." The government should improve aviation security by concentrating on simpler challenges, like access control at airports, she said. ------------------------------------- You are subscribed as eugen at leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From emc at artifact.psychedelic.net Fri Jul 16 10:30:20 2004 From: emc at artifact.psychedelic.net (Eric Cordian) Date: Fri, 16 Jul 2004 10:30:20 -0700 (PDT) Subject: US Seeks Bobby Fischer Extradition Message-ID: <200407161730.i6GHULj1029800@artifact.psychedelic.net> Now that AmeriKKKa has successfully invaded the sovereign nation of Iraq in violation of international law, tortured with impunity, and mocked the rest of the world with its arrogance, what will it do for an encore? Settle old political scores, of course. So it comes as no surprise that the US has had former world chess champion Bobby FIscher arrested in Japan, and is seeking his extradition to the United States. Seems in 1992, Mr. Fischer played in the world chess championship in Yugoslavia which was under UN sanctions prohibiting people from engaging in a "business enterprise" there. The US, which has a long history of creatively interpreting UN resolutions to suit its own ends, decided unilaterally that this prohibition applied to sporting events, a view held by no other nation in the world. After Fischer won the match, a federal grand jury indicted him, and he was magically transformed from world chess champion into a fugutive facing 10 years in prison and a $250,000 fine. Unable to protect his business and personal interests in the United States as a fugitive, his belongings in the US were stolen, and his chess books were freely reproduced in violation of his copyright, depriving him of the rightful income from his intellectual property. Another reason Mr. Fischer's life was magically transformed to shit. He's openly critical, as any sane person would be, of Israel and the Jews. And as we know, you can't do that and be a public figure in AmeriKKKa without being attacked, although to even suggest that this is the case instantly gets one accused of "hate speech." So it should be interesting to see how this case unfolds, in a country where Martha Stewart can go to prison for lying, but Colin Powell can't. -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law" From ptrei at rsasecurity.com Fri Jul 16 08:01:03 2004 From: ptrei at rsasecurity.com (Trei, Peter) Date: Fri, 16 Jul 2004 11:01:03 -0400 Subject: vacuum-safe laptops ? Message-ID: <017630AA6DF2DF4EBC1DD4454F8EE297161695@rsana-ex-hq1.NA.RSA.NET> > -----Original Message----- > From: owner-cypherpunks at minder.net > [mailto:owner-cypherpunks at minder.net]On Behalf Of An Metet > Sent: Friday, July 16, 2004 6:35 AM > To: cypherpunks at minder.net > Subject: vacuum-safe laptops ? > > > > Does anyone *know* (first or second hand, I can speculate > myself) which laptops, if any, can safely go to zero air > pressure (dropping from 1 atm to 0 in, say, 1 minute.) What's your application, exactly? A rocket? I don't know about rapid decompression, but one problem is with the disk drives - the heads rely on entrained air to maintain separation from the disk surface. Most drives are not hermetically sealed, and have a (filtered) port to the outside to equalize air pressure. Some drives *are* sealed, and will operate at low pressure. I've seen this issue disscussed in the context of computers and laptops at high-altitude astronomical observatories: most machines will suffer head crashes if you try to use them at > 10,000 feet (jets maintain an internal pressure altitude of about 5,000 feet). Some applications use solid state drives to get around this: http://www.globalspec.com/featuredproducts/detail?exhibitId=10540&fromSpotlight=1&fromSupplier=0 Some displays may also be a problem. This is more an issue for big plasma displays. Sony makes a special plasma TV for high altitude use: http://www.superwarehouse.com/Sony_PlasmaPro_PFM-42V1A_S_Silver_42_Plasma_Display/PFM-42V1A_S/pf/330392 A useful article is at http://www.iht.com/IHT/SUP/031999/digi-08.html You might want to look at the Itronix GoBook Max. http://www.gobookmax.com/ This device supposedly meets MILSPEC: http://www.dtc.army.mil/pdf/810.pdf which is a USG survivability spec. It includes an explosive decompression test, but not to high vacuum. ...and of course, all this gets pricy. Peter Trei From eugen at leitl.org Fri Jul 16 03:58:30 2004 From: eugen at leitl.org (Eugen Leitl) Date: Fri, 16 Jul 2004 12:58:30 +0200 Subject: vacuum-safe laptops ? In-Reply-To: <6ad7d343ee36c3e7c11fde7f8393c65b@freedom.gmsociety.org> References: <6ad7d343ee36c3e7c11fde7f8393c65b@freedom.gmsociety.org> Message-ID: <20040716105830.GO1141@leitl.org> Hard drives won't be able to, you'd need solid state flash disks. Sustainable operation will dry out lubricant in bearings, so any fans won't last very long. Any cooling requiring convection won't work, radiative cooling only. I suppose backlighting should be able to do, don't see how LCDs will get damaged. If high voltage is sufficiently good insulated, otherwise it will arc. It all depends on how hard your vacuum is, of course. And how long you want to operate the device. You'd need an old laptop, passively cooled (if it won't foul up your vacuum, immerse it in silicon oil), outfitted with flash sticks or flash drives. All of this is an educated guess, of course. On Fri, Jul 16, 2004 at 06:35:02AM -0400, An Metet wrote: > Does anyone *know* (first or second hand, I can speculate myself) which laptops, if any, can safely go to zero air pressure (dropping from 1 atm to 0 in, say, 1 minute.) -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From rsw at jfet.org Fri Jul 16 12:19:24 2004 From: rsw at jfet.org (Riad S. Wahby) Date: Fri, 16 Jul 2004 14:19:24 -0500 Subject: "Terror in the Skies, Again?" Message-ID: <20040716191924.GA32005@jfet.org> I don't quite know what to make of this. Is it just paranoid rambling? http://www.womenswallstreet.com/WWS/article_landing.aspx?titleid=1&articleid=711 "Terror in the Skies, Again?" By Annie Jacobsen Note from the E-ditors: You are about to read an account of what happened during a domestic flight that one of our writers, Annie Jacobsen, took from Detroit to Los Angeles. The WWS Editorial Team debated long and hard about how to handle this information and ultimately we decided it was something that should be shared. What does it have to do with finances? Nothing, and everything. Here is Annie's story. On June 29, 2004, at 12:28 p.m., I flew on Northwest Airlines flight #327 from Detroit to Los Angeles with my husband and our young son. Also on our flight were 14 Middle Eastern men between the ages of approximately 20 and 50 years old. What I experienced during that flight has caused me to question whether the United States of America can realistically uphold the civil liberties of every individual, even non-citizens, and protect its citizens from terrorist threats. ... -- Riad S. Wahby rsw at jfet.org From eugen at leitl.org Fri Jul 16 06:32:45 2004 From: eugen at leitl.org (Eugen Leitl) Date: Fri, 16 Jul 2004 15:32:45 +0200 Subject: [IP] Government Is 'Reshaping' Airport Screening System (fwd from dave@farber.net) Message-ID: <20040716133244.GW1141@leitl.org> ----- Forwarded message from David Farber ----- From Nostra2004 at SAFe-mail.net Fri Jul 16 12:34:59 2004 From: Nostra2004 at SAFe-mail.net (Nostra2004 at SAFe-mail.net) Date: Fri, 16 Jul 2004 15:34:59 -0400 Subject: USA PATRIOT Act Survives Amendment Attempt Message-ID: > > Actually, frequent prosecutions could work to the advantage of a select > > few who choose to become martyrs. Since it would make it much more > > likely supplicants would be called upon. > > Please explain this thought? If people are intentionally trying to set up the jackbooted thugs to break down your door then the more often the thugs take the bait the more likely the baitors will get to spring their traps. > > > I posted a few months back offering an alternative to religion in > > recruitment: the terminally ill. > > That's not good for this purpose; their lifetime is too short. Do you have evidence to support this (e.g., average survivial times of the TI from their first learning about their condition)? From Nostra2004 at SAFe-mail.net Fri Jul 16 12:36:32 2004 From: Nostra2004 at SAFe-mail.net (Nostra2004 at SAFe-mail.net) Date: Fri, 16 Jul 2004 15:36:32 -0400 Subject: We werent doing anything wrong Message-ID: http://www.wvgazettemail.com/static/stories/2004071346.html Couple in anti-Bush T-shirts were arrested at presidents speech By Tara Tuckwiller tara at wvgazette.com A husband and wife who wore anti-Bush T-shirts to the presidents Fourth of July appearance arent going down without a fight: They will be represented by lawyers from the American Civil Liberties Union as they contest the trespassing charges against them Thursday morning in Charleston Municipal Court. Police took Nicole and Jeff Rank away in handcuffs from the event, which was billed as a presidential appearance, not a campaign rally. They were wearing T-shirts that read, Love America, Hate Bush. Spectators who wore pro-Bush T-shirts and Bush-Cheney campaign buttons were allowed to stay. We werent doing anything wrong, said Jeff Rank. The couple, who said they had tickets just like everybody else, said they simply stood around the Capitol steps with the rest of the spectators. We sang the national anthem, Rank said. The Ranks hardly fit the image of rabble-rousers. Jeff Rank, 29, has a masters degree in oceanography. Nicole Rank, 30, has degrees in biological science and marine biology. They have been married for seven years. Nicole Rank arrived in Charleston soon after the Memorial Day floods. She was working as deputy environmental liaison officer for the Federal Emergency Management Agency, making sure cities and counties obeyed federal environmental laws as they repaired roads and bridges. After police arrested the Ranks, fingerprinted them and took their mug shots, FEMA told Nicole Rank she was no longer needed in West Virginia. I have not been fired per se, she said. But I was released from this job. And when they release you from a job, you no longer get paid. The Ranks started to go home to Corpus Christi, Texas, but they only got as far as Roanoke, Va., when it occurred to them that they might not be able to contest their arrest if they werent in Charleston on their court date. A phone call confirmed their suspicions. So they turned around. Weve been living in motels ever since, said Jeff Rank, who spent Tuesday evening in his motel room with his wife, their cocker spaniel Feinman, and their marmalade cat Rowr. Its extremely difficult [financially]. We can only afford to do this for so long. But they had to stay and fight the charges, he said, because we didnt think we were guilty. Since Bush took office in early 2001, people have been banned from displaying anti-Bush messages at dozens of Bush appearances across the country. In September, the ACLU filed a federal lawsuit against the Secret Service, seeking an injunction against the Bush administration for segregating protesters at his public appearances. The Secret Service agreed that such censorship was wrong, said Witold Walczak, one of the lawyers that filed the lawsuit. They had an internal memo dated September 2002, saying they couldnt treat protesters differently or worse than anyone else at a presidential appearance, Walczak said. The judge said any agent responsible for doing so could be held liable for damages. The Secret Service had been telling local police to sequester anyone displaying an anti-administration message, usually in areas completely out of sight and earshot of Bush. Because the Secret Service agreed with the ACLU that it shouldnt be doing that, the judge dismissed the case. Prior to filing our suit in September, wed get a couple of confirmed protest zone complaints every month, Walczak said. After we filed, there were practically none. We had two documented incidents between September and March: one in Little Rock, Ark., and one in Knoxville, Tenn. But now, lawyers like Walczak are carefully monitoring cases like the Ranks  and two similar incidents recently in Pennsylvania. Were trying to assess what is going on at these appearances ... whether these protest zones are resuming, he said. We are continuing to monitor all campaign events by both Republican and Democratic candidates. Were prepared to go back into court if we see discrimination occurring. Because Bushs Fourth of July stop in Charleston was billed as an official presidential visit, not a campaign rally, That makes it an even more glaring violation of the First Amendment, said Andrew Schneider, executive director of the ACLU of West Virginia. Its an Orwellian way to keep speech out of sight of those the speech is intended to critique ... We want to nip this in the bud before it becomes a habit of future administrations. A Bush spokesman did not return a telephone call seeking comment on the necessity of the free speech zone. To contact staff writer Tara Tuckwiller, use e-mail or call 348-5189. From Nostra2004 at SAFe-mail.net Fri Jul 16 12:53:18 2004 From: Nostra2004 at SAFe-mail.net (Nostra2004 at SAFe-mail.net) Date: Fri, 16 Jul 2004 15:53:18 -0400 Subject: Blast from the past: USENET Transport Binding for SOAP 1.1 Message-ID: USENET Transport Binding for SOAP 1.1 10 February 2002 Authors (alphabetically): Sister Tornado Copyright) 2002 Sister Tornado. Reproduce with credit at will. -------------------------------------------------------------------------------- Abstract SOAP [1] is a lightweight protocol for exchange of information in a decentralized, distributed environment, using XML. This document details transporting SOAP messages over the USENET. [2] Status This is a draft. Table of Contents 1. Introduction 1.1 Notational Conventions 2. Use Of USENET Message body 2.1 Encoding 3. Identifying USENET transports in WSDL 4. Request / Response semantics 5. Examples 6. Security Considerations 7. References 1. Introduction By binding SOAP to USENET, we can take advantage of USENET's store and forward messaging to provide an asynchronous, broadcast, one way transport for SOAP. Two one way messages can be correlated to provide request / response semantics (this closely follows the SOAP model). This allows SOAP to be used in a number of scenarios where HTTP is not suitable (partially connected nodes, one way notifications etc.) The author wishes to acknowledge that the shameless cribbing of much of the text from "SMTP Transport Binding for SOAP 1.1 " [0]. 1.1 Notational Conventions The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC-2119 [3]. 2. Use of USENET Standard 2.1 Use of USENET Message Headers The USENET Message standard requires the use of a Subject field. This field SHOULD be used to identify the service being called. For example: Subject: SoapRobot 2.2 Use of USENET Message body SOAP payloads in USENET MUST be packaged into the body of the USENET message. 2.3 Encoding A content transfer encoding of base64 is RECOMMENDED. A content transfer encoding of Quoted-Printable MAY be used if the SOAP payload meets the requirements of RFC-1036 [2]. 3. Identifying USENET transports in WSDL The URI http://schemas.xmlsoap.com/soap/usenet/ SHOULD be used to identify USENET transports compliant with this specification in the transport attribute of the soap:binding element of a WSDL [4] document (see section 3.3 of the WSDL spec.) The address of the SOAP service in the soap:address element of a WSDL document SHOULD be the name or handle of the intended recipient and a comma-delimitedlist of newsgroups where a request may be posted. For example: 4. Request / Response semantics SOAP applications requiring request / response semantics will need to perform some sort of message correlation. This SHOULD be achieved via the standard Message-Id and Followup-To USENET headers [2]. The request will include a Message-Id header, and the associated response should include a Followup-To header that contains the Message-Id of the request, and a new Message-Id header. The responder SHOULD also reflect the incoming subject header into the response, prefixing it with "Re: ". 5. Example A request destined for SoapRobot at example.soap.messages From camera_lumina at hotmail.com Fri Jul 16 13:26:53 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Fri, 16 Jul 2004 16:26:53 -0400 Subject: We werent doing anything wrong Message-ID: So...given the legal precedent, might a "citizen's arrest" of the arresting agents be defensible in court? (This assumes that there are large numbers of protestors, of course, willing to apprehend the rogue officers.) -TD >From: Nostra2004 at SAFe-mail.net >To: cypherpunks at al-qaeda.net >Subject: We werent doing anything wrong >Date: Fri, 16 Jul 2004 15:36:32 -0400 > >http://www.wvgazettemail.com/static/stories/2004071346.html > >Couple in anti-Bush T-shirts were arrested at presidents speech >By Tara Tuckwiller >tara at wvgazette.com > >A husband and wife who wore anti-Bush T-shirts to the presidents Fourth of >July appearance arent going down without a fight: They will be represented >by lawyers from the American Civil Liberties Union as they contest the >trespassing charges against them Thursday morning in Charleston Municipal >Court. > >Police took Nicole and Jeff Rank away in handcuffs from the event, which >was billed as a presidential appearance, not a campaign rally. They were >wearing T-shirts that read, Love America, Hate Bush. > >Spectators who wore pro-Bush T-shirts and Bush-Cheney campaign buttons were >allowed to stay. > >We werent doing anything wrong, said Jeff Rank. The couple, who said >they had tickets just like everybody else, said they simply stood around >the Capitol steps with the rest of the spectators. > >We sang the national anthem, Rank said. > >The Ranks hardly fit the image of rabble-rousers. Jeff Rank, 29, has a >masters degree in oceanography. Nicole Rank, 30, has degrees in biological >science and marine biology. They have been married for seven years. > >Nicole Rank arrived in Charleston soon after the Memorial Day floods. She >was working as deputy environmental liaison officer for the Federal >Emergency Management Agency, making sure cities and counties obeyed federal >environmental laws as they repaired roads and bridges. > >After police arrested the Ranks, fingerprinted them and took their mug >shots, FEMA told Nicole Rank she was no longer needed in West Virginia. > >I have not been fired per se, she said. But I was released from this >job. And when they release you from a job, you no longer get paid. > >The Ranks started to go home to Corpus Christi, Texas, but they only got as >far as Roanoke, Va., when it occurred to them that they might not be able >to contest their arrest if they werent in Charleston on their court date. >A phone call confirmed their suspicions. So they turned around. > >Weve been living in motels ever since, said Jeff Rank, who spent Tuesday >evening in his motel room with his wife, their cocker spaniel Feinman, and >their marmalade cat Rowr. > >Its extremely difficult [financially]. We can only afford to do this for >so long. > >But they had to stay and fight the charges, he said, because we didnt >think we were guilty. > >Since Bush took office in early 2001, people have been banned from >displaying anti-Bush messages at dozens of Bush appearances across the >country. In September, the ACLU filed a federal lawsuit against the Secret >Service, seeking an injunction against the Bush administration for >segregating protesters at his public appearances. > >The Secret Service agreed that such censorship was wrong, said Witold >Walczak, one of the lawyers that filed the lawsuit. > >They had an internal memo dated September 2002, saying they couldnt treat >protesters differently or worse than anyone else at a presidential >appearance, Walczak said. The judge said any agent responsible for doing >so could be held liable for damages. > >The Secret Service had been telling local police to sequester anyone >displaying an anti-administration message, usually in areas completely out >of sight and earshot of Bush. Because the Secret Service agreed with the >ACLU that it shouldnt be doing that, the judge dismissed the case. > >Prior to filing our suit in September, wed get a couple of confirmed >protest zone complaints every month, Walczak said. After we filed, >there were practically none. We had two documented incidents between >September and March: one in Little Rock, Ark., and one in Knoxville, Tenn. > >But now, lawyers like Walczak are carefully monitoring cases like the >Ranks  and two similar incidents recently in Pennsylvania. > >Were trying to assess what is going on at these appearances ... whether >these protest zones are resuming, he said. > >We are continuing to monitor all campaign events by both Republican and >Democratic candidates. Were prepared to go back into court if we see >discrimination occurring. > >Because Bushs Fourth of July stop in Charleston was billed as an official >presidential visit, not a campaign rally, That makes it an even more >glaring violation of the First Amendment, said Andrew Schneider, executive >director of the ACLU of West Virginia. > >Its an Orwellian way to keep speech out of sight of those the speech is >intended to critique ... We want to nip this in the bud before it becomes a >habit of future administrations. > >A Bush spokesman did not return a telephone call seeking comment on the >necessity of the free speech zone. > >To contact staff writer Tara Tuckwiller, use e-mail or call 348-5189. > _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/ From Nostra2004 at SAFe-mail.net Fri Jul 16 13:58:35 2004 From: Nostra2004 at SAFe-mail.net (Nostra2004 at SAFe-mail.net) Date: Fri, 16 Jul 2004 16:58:35 -0400 Subject: We werent doing anything wrong Message-ID: -------- Original Message -------- From: "Tyler Durden" To: Nostra2004 at SAFe-mail.net, cypherpunks at al-qaeda.net Subject: RE: We werent doing anything wrong Date: Fri, 16 Jul 2004 16:26:53 -0400 > So...given the legal precedent, might a "citizen's arrest" of the arresting > agents be defensible in court? (This assumes that there are large numbers of > protestors, of course, willing to apprehend the rogue officers.) AFAIK, citizens are still free to arrest anyone they see comitting a crime, however dangerous to one's health :) It might be much more effective for some terminally ill 'demonstartors' to use some sort of difficult to detect explosives that they could detonate if an attempt were made to arrest them for asserting their right to free speeech. From mv at cdc.gov Fri Jul 16 17:27:56 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 16 Jul 2004 17:27:56 -0700 Subject: vacuum-safe laptops ? Message-ID: <40F8728C.CE175E3E@cdc.gov> At 06:35 AM 7/16/04 -0400, An Metet wrote: >Does anyone *know* (first or second hand, I can speculate myself) which laptops, if any, can safely go to zero air pressure (dropping from 1 atm to 0 in, say, 1 minute.) Sorry so late ---but your can-shaped capacitors might not handle the rapid depressurization so well. MV From mv at cdc.gov Fri Jul 16 17:34:07 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 16 Jul 2004 17:34:07 -0700 Subject: US Seeks Bobby Fischer Extradition Message-ID: <40F873FF.AA9F4630@cdc.gov> At 10:30 AM 7/16/04 -0700, Eric Cordian wrote: >So it should be interesting to see how this case unfolds, in a country where Martha >Stewart can go to prison for lying, but Colin Powell can't. Colin was/is played the fool. He was a killer, wanted to be a diplomat. They had to let him; but he's so out of the Real Loop is comedic. thanks for the news re BF. Supposedly my ancestors go back to Abraham, but you've largely convinced me to get over the default amerikan zionism. The germans should have given up a slice of the coast of the Med., price of war, a lot nicer than some desert, fuck the books. Really the UK's fault, but the progression is Romans, Brits, then US. But empire == death, song here, how many whatevers, fuck it, if it moves, bomb it, if you're not with us you're up the chimneys. From mv at cdc.gov Fri Jul 16 17:36:21 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 16 Jul 2004 17:36:21 -0700 Subject: "Terror in the Skies, Again?" Message-ID: <40F87485.3CF2BC83@cdc.gov> At 02:19 PM 7/16/04 -0500, Riad S. Wahby wrote: >I don't quite know what to make of this. Is it just paranoid rambling? > >http://www.womenswallstreet.com/WWS/article_landing.aspx?titleid=1&articleid=711 > What I experienced during that >flight has caused me to question whether the United States of America >can realistically uphold the civil liberties of every individual, even >non-citizens, and protect its citizens from terrorist threats. > Ask the American citizens interned in California during WWII.. From mv at cdc.gov Fri Jul 16 17:41:08 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 16 Jul 2004 17:41:08 -0700 Subject: USA PATRIOT Act Survives Amendment Attempt Message-ID: <40F875A4.C669EF58@cdc.gov> At 03:34 PM 7/16/04 -0400, Nostra2004 at SAFe-mail.net wrote: >> > I posted a few months back offering an alternative to religion in >> > recruitment: the terminally ill. >> >> That's not good for this purpose; their lifetime is too short. > >Do you have evidence to support this (e.g., average survivial times of the TI from their first learning about their condition)? When I find out that I have 6 months left, I will take up motorcycle riding, which my parents prohibited, probably resulting in my respiring currently. A lone sleeper cell for the Constitution would not be so far from this. Should they draft my son, I might have to practice a bit of chemistry (or get a friggin scope and zero it) just then, he being at times a reason for my living. Many slaves died trying to escape, I suspect. However, I have no terminal illness, so its all moot, take note, Herrs Spooks. Have a nice day. From measl at mfn.org Fri Jul 16 17:34:59 2004 From: measl at mfn.org (J.A. Terranson) Date: Fri, 16 Jul 2004 19:34:59 -0500 (CDT) Subject: vacuum-safe laptops ? In-Reply-To: <40F8728C.CE175E3E@cdc.gov> References: <40F8728C.CE175E3E@cdc.gov> Message-ID: <20040716193422.G20489@ubzr.zsa.bet> On Fri, 16 Jul 2004, Major Variola (ret) wrote: > At 06:35 AM 7/16/04 -0400, An Metet wrote: > >Does anyone *know* (first or second hand, I can speculate myself) which > laptops, if any, can safely go to zero air pressure (dropping from 1 atm > to 0 in, say, 1 minute.) I got it! I got it!!! You're building an ICBM? -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From mv at cdc.gov Fri Jul 16 19:37:49 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 16 Jul 2004 19:37:49 -0700 Subject: vacuum-safe laptops ? Message-ID: <40F890FD.B1CBE323@cdc.gov> At 04:03 AM 7/17/04 +0200, Thomas Shaddack wrote: >On Fri, 16 Jul 2004, Major Variola (ret) wrote: >> Sorry so late ---but your can-shaped capacitors might not handle the >> rapid depressurization so well. > >Perhaps it's time to challenge the introductory assumption. Why a laptop? >There are many various embedded computers available on the market, eg. the >one from . Um, even the small form factor PC on a board the size of your palm may still rely on caps in the power supply that don't handle 760 to 0 mm Hg/min so readily. Otherwise, there are many small PCs on a card if you look into the embedded marketplace. Complete with solid state disks, etc. COTS. Power dissipation is not a problem if you use a CPU like Via's and have a nice radiative heatsink. Or dick with Peltier-effect junctions at the expense of watts. ARM's edge is low power, but you may not want to run Linux or BSD or a RTOS, perhaps anon actually wants to run M$ in a low pressure environ. Perhaps that's why he's anonymous :-) My guess is regular ole airplane takeoff, but its not quite 0 torr at 35Kfeet, and I *think* the cargo part is pressurized, lest Fido suffocate. And while a SAM would be a great science fair project, you don't go above that limit. Perhaps anon will be a space tourist, wanting to take notes, on something heavier than a PDA+keyboard. I once TA'd at a UC, one advanced ugrad had a project for an atmospheric science prof building a board for the nose of a spyplane, to sample the air. (For ozone, not nucleotides. No, really.) He was interested in vibration problems; I told him to take his proto board on an offroad trip in his car to shake out the moths. Am not sure that epoxy cover makes a difference, the board manuf. go to lengths to avoid air pockets under traces, the ICs themselves fairly (albeit not guaranteed) encapsulated in an epoxy mix. We-all being scientists, I'd suggest looking up with the vacuum hobbyists do with fridge pumps, etc, and doing a bit of testing. I've even seen using a CRT as a vacuum source, break the glass neck and shazaam, a few litres of hard vacuum. -------- Got Kalman filtering? From shaddack at ns.arachne.cz Fri Jul 16 19:03:42 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sat, 17 Jul 2004 04:03:42 +0200 (CEST) Subject: vacuum-safe laptops ? In-Reply-To: <40F8728C.CE175E3E@cdc.gov> References: <40F8728C.CE175E3E@cdc.gov> Message-ID: <0407170325060.9902@somehost.domainz.com> On Fri, 16 Jul 2004, Major Variola (ret) wrote: > >Does anyone *know* (first or second hand, I can speculate myself) which > laptops, if any, can safely go to zero air pressure (dropping from 1 atm > to 0 in, say, 1 minute.) > > Sorry so late ---but your can-shaped capacitors might not handle the > rapid depressurization so well. Perhaps it's time to challenge the introductory assumption. Why a laptop? There are many various embedded computers available on the market, eg. the one from . (Question for the crowd: anybody knows other comparable or better Linux-ready affordable embedded computer solutions?) You may like to take such module and seal it in resin in order to shield it from the pressure changes (question for the crowd: would it really work?). Use memory card instead of hard drive; you don't want moving parts that depend on air density. The smaller size and lower power consumption than a laptop has makes many issues, from cooling to powering, much easier; vacuum-proofing and testing of the assembly is potentially simplified as well. I'd also be cautious about the fluorescent tubes for the displays, the glass won't necessarily have to withstand the rapid change in air pressure. The LCDs themselves consist from two layers of glass with a electricalyl-sensitive light-polarizing liquid between them, make sure it won't have tendency to boil or vaporize in vacuum. Optionally, for unmanned operation, do without the display completely. For manned operation, use something like the head-worn see-through display, located in the operator's pressure suit, and connect it to the computer by a suitable wired or wireless connection. If the system has to go beyond the reach of the atmosphere, you would like to use some sort of radiation shielding, or use a redundant assembly with several computers working in parallel, compensating lower reliability (silicon-on-insulator chips are difficult to find in off-the-shelf setting) with redundancy. You may also prefer to keep critical systems working on lower frequencies, with older-design parts, using bipolar transistors instead of CMOS (which tends to trap charged particles in the insulator layers of the gates, which shifts the gate threshold voltage), and chips with larger structures (so the ionization traces of particles won't affect the chips that much). Protect the content of the memories - large arrays of rad-sensitive elements - with ECC codes. GaAs is also more radiation resistant material than silicon. Again, combine rad-hard design with redundancy for best results. Cooling is a royal bitch. You can't use anything but radiation cooling. I think satellites use a neat trick with pipes containing a wick soaked in a suitable liquid, eg. some freon. The liquid is vaporizing on the hot end of the pipe, condensing on the cold end, and soaking back to the hot end by capillary forces; this is used to bring the heat from the power parts and the sun-facing side of the satellite to the dark side of the satellite, from where it radiates to space. (Question for the crowd: Can thermal imaging be used for scanning the sky for low-orbit satellites? Other question for the crowd: How suitable would be this wick-in-a-tube approach for "ground-level" computers, could it increase the efficiency of heat transfer from the CPU chips to the wings of the heatsinks? Eg. for the purpose of having the computer sealed in an RF-shielded enclosure, with the heatsinks being part of the case, which could eliminate the cooling air inlets?) From ericm at lne.com Sat Jul 17 08:51:29 2004 From: ericm at lne.com (Eric Murray) Date: Sat, 17 Jul 2004 08:51:29 -0700 Subject: FIPS chassis/linux security engineer? Message-ID: <20040717085129.A12925@slack.lne.com> Does anyone know of a manufacturer of FIPS 140 certified or certifiable 1u/2u rack mount chassis? For a seperate project, does anyone know of a small linux-ready/able box with ethernet? Gumstix looks cool but I need hardwire networking. Last, I'm looking for a Linux expert security engineer in the SF bay area. (I'm managing a security group at a startup that has been shipping products to paying customers for a few years. No its not lne.com, this just address I use to post). This person will need to know linux/unix OS security/hardening _in depth_ and also have an understanding of crypto APIs (writing them not using them) plus significant industry experience. Sorry, no relocation assistance. Eric From bill.stewart at pobox.com Sat Jul 17 14:06:40 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Sat, 17 Jul 2004 14:06:40 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> Message-ID: <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> At 12:11 PM 7/7/2004, Steve Schear wrote: >Perhaps, but at a Bay Area meeting a few years back held to discuss >NSA/SIGINT, I think it was held on the Stanford campus, a developer >disclosed that an American contractor manufacturer had won a contract to >install 250,000 high-capacity disk drives at one of these agenicies. On the other hand, 100,000 employees times two disk drives per desktop and a few departmental servers can get you that much capacity. From camera_lumina at hotmail.com Sat Jul 17 14:15:21 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Sat, 17 Jul 2004 17:15:21 -0400 Subject: vacuum-safe laptops ? Message-ID: Sorry to need educating once again, but I had assumed can-shaped capacitors were gone from laptops in lieu of surface mount. Anyone know? (I don't own a laptop.) -TD >From: "Major Variola (ret)" >To: "cypherpunks at al-qaeda.net" >Subject: Re: vacuum-safe laptops ? >Date: Fri, 16 Jul 2004 17:27:56 -0700 > >At 06:35 AM 7/16/04 -0400, An Metet wrote: > >Does anyone *know* (first or second hand, I can speculate myself) which >laptops, if any, can safely go to zero air pressure (dropping from 1 atm >to 0 in, say, 1 minute.) > >Sorry so late ---but your can-shaped capacitors might not handle the >rapid depressurization >so well. > >MV > > _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/ From camera_lumina at hotmail.com Sat Jul 17 14:26:53 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Sat, 17 Jul 2004 17:26:53 -0400 Subject: "Terror in the Skies, Again?" Message-ID: Sounds to me like Al-Qaeda is just getting the most mileage they can out of their little PR Event a couple of years ago. They don't even need to blow up anything to get the most bang for their buck. Hell, in this story the biggest threat was the incompetence of the airline. -TD >From: "Major Variola (ret)" >To: "cypherpunks at al-qaeda.net" >Subject: Re: "Terror in the Skies, Again?" >Date: Fri, 16 Jul 2004 17:36:21 -0700 > >At 02:19 PM 7/16/04 -0500, Riad S. Wahby wrote: > >I don't quite know what to make of this. Is it just paranoid rambling? > > > > >http://www.womenswallstreet.com/WWS/article_landing.aspx?titleid=1&articleid=711 > > > > >What I experienced during that > >flight has caused me to question whether the United States of America > >can realistically uphold the civil liberties of every individual, even > >non-citizens, and protect its citizens from terrorist threats. > > > >Ask the American citizens interned in California during WWII.. > > > > > _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/ From mv at cdc.gov Sat Jul 17 19:00:50 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 17 Jul 2004 19:00:50 -0700 Subject: vacuum-safe laptops ? Message-ID: <40F9D9D2.7916E578@cdc.gov> At 05:15 PM 7/17/04 -0400, Tyler Durden wrote: >Sorry to need educating once again, but I had assumed can-shaped capacitors >were gone from laptops in lieu of surface mount. Anyone know? (I don't own a >laptop.) >-TD With apologies, you really seem a troll at times. The *power supply* may use can-caps, obviously the bottom of the CPU is littered with solid-state ceramic babies. From shaddack at ns.arachne.cz Sat Jul 17 10:32:23 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sat, 17 Jul 2004 19:32:23 +0200 (CEST) Subject: FIPS chassis/linux security engineer? In-Reply-To: <20040717085129.A12925@slack.lne.com> References: <20040717085129.A12925@slack.lne.com> Message-ID: <0407171929210.9911@somehost.domainz.com> On Sat, 17 Jul 2004, Eric Murray wrote: > For a seperate project, does anyone know of a small linux-ready/able > box with ethernet? > Gumstix looks cool but I need hardwire networking. Soekris, . PXA255, Are there more, and/or better? From shaddack at ns.arachne.cz Sat Jul 17 11:45:15 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sat, 17 Jul 2004 20:45:15 +0200 (CEST) Subject: Secure telephones Message-ID: <0407171949520.-1331463516@somehost.domainz.com> Pondering construction of a secure telephone. (Or at least a cellphone in general. The user interfaces and features available on virtually all the mass-market phones suck, to put it very very mildly, not even mentioning that there's no access to their firmware (so no chance of audit), poor or no support for SSL (while running HTTP through the operator's proxy), and typically no possibility to run more than one Java applet (or other program) at the same time. A combination of a GSM/GPRS module with a suitable embedded Linux-running computer could be the right solution.) The easiest way is probably a hybrid of telephone/modem, doing normal calls in "analog" voice mode and secure calls in digital modem-to-modem connection. The digital layer may be done best over IP protocol, assigning IP addresses to the phones and making them talk over TCP and UDP over the direct dialup. (We cannot reliably use GPRS, as the quality of service is not assured, so we have to use direct dialup. But we can implement "real" IP later, when the available technology reaches that stage.) Once we have the phones talking over IP with each other, we can proceed with the handshake. I'd suggest using OpenSSL for this purpose, as it offers all we need for certificates and secure transfer of the key. Then use UDP for the voice itself, using eg. stripped-down SpeakFreely as the engine. So during the call, two connections will be open over the IP channel: the command one (SSL-wrapped TCP, for key and protocol handshake, ensuring the identity of the caller, etc.), and the data one (a bidirectional UDP stream). As the command connection should be silent for most of the time, a 14k4 modem should offer us enough bandwidth for 9k6 GSM codec, even with the UDP/IP overhead. The problem is with the calls themselves, determining if they have to be connected as secure or as insecure. For landlines, it's easy; we can hold the line open while switching the modem between voice and data modes, even if we'd have to do it the "hardcore" way with a relay and a 600-ohm resistor connected to the phone line during modem hangup. We then can freely alternate between voice and data, starting in voice and getting the telephones negotiate over "analog sound" using some sequences of beeps, like during the time of acoustically coupled modems. We need just few 100s bps to tell each other that we both support secure call, and that we want to switch to it. However, the cellphones pose a much worse problem. The voice/data call type is determined at the connection time, and as far as I know, can't be changed on-fly. So we would have to have the desired call mode specified in the phone's addressbook (with eventual secure mode advertising through the mentioned beep sequence when in insecure mode, and eventual automatic or manual redial in secure mode). Does anybody here know if there is a workaround available for this? How does the Siemens crypto-phone solve this? It is possible to place data calls from a GSM phone. But it is possible to RECEIVE the data calls on it? Can I connect a cellphone to a laptop and have a dial-in server? A workaround here could be exploiting the always-on properties of GPRS (if the Enfora modules offer GPRS simultaneously with GSM calls, it could provide a lot fo advantages), and use eg. Jabber as a messaging platform (overcoming the difficulties with secure SMS messaging), and optionally also for secure call negotiation, serving here as a control connection. A nice feature could be a phone-located voicemail (won't cover the situations when the phone is outside of the network reach, but could be handy for the situations where the phone is just told to not ring). The advantages would be the possibility of the voice being transported in secure mode, and the possibility of encrypting the messages in storage. Another feature, that could make the device rather attractive in some demographics, is the possibility of having the phonebook stored encrypted on the handset, inaccessible without a PIN, or not located there at all, stored remotely. Yet another advantage, useful for closed groups, is the possibility of using Jabber UIDs dynamically mapped to phone numbers, allowing the users to swap the handsets, bringing a bit of deniability into the location tracking. The modularity of the design should allow low degree of lock-in to the vendors and networks; other modules than Enfora can be used for different standards, Enfora produces tri-band (and even quad-band, adding 850 MHz to the mix) ones for both US and EU/AU/NZ markets, the control computer should be exchangeable for any other kind, with just minor tweaks in the software itself. Openness of the design should allow the implementation of other emerging secure comm standards, including but not limited to Skype. Various message-anonymizing tricks could be also done, using mixmaster-style forwarding within the network, and/or using secure messaging clients instead, like eg. Silc . Any comments from the Collective? -- ....Enfora Enabler tri-band GSM module, , $120. Full-featured embedded Gumstix computer, , $185. Big fat lithium battery, $50. Display, keypad, other circuits, case: $100-200. Writing the firmware, 2-3 weeks. Warm fyzzu feeling from pissing into the wiretap operators' beer - priceless! From s.schear at comcast.net Sat Jul 17 22:21:28 2004 From: s.schear at comcast.net (Steve Schear) Date: Sat, 17 Jul 2004 22:21:28 -0700 Subject: Secure telephones In-Reply-To: <0407171949520.-1331463516@somehost.domainz.com> References: <0407171949520.-1331463516@somehost.domainz.com> Message-ID: <6.0.1.1.0.20040717221930.046998e0@mail.comcast.net> At 11:45 AM 7/17/2004, Thomas Shaddack wrote: >Pondering construction of a secure telephone. (Or at least a cellphone in >general. The user interfaces and features available on virtually all the >mass-market phones suck, to put it very very mildly, not even mentioning >that there's no access to their firmware (so no chance of audit), poor or >no support for SSL (while running HTTP through the operator's proxy), and >typically no possibility to run more than one Java applet (or other >program) at the same time. A combination of a GSM/GPRS module with a >suitable embedded Linux-running computer could be the right solution.) How about building a secure cell phone using GnuRadio as a core? That way you have maximum control afforded by the protocols. steve From shamrock at cypherpunks.to Sat Jul 17 23:33:06 2004 From: shamrock at cypherpunks.to (Lucky Green) Date: Sat, 17 Jul 2004 23:33:06 -0700 Subject: FIPS chassis/linux security engineer? In-Reply-To: <20040717230811.155171158C@mail.cypherpunks.to> Message-ID: <20040718063327.E3DDB1154C@mail.cypherpunks.to> Hmm. Looking at the amazing number of unread messages in this folder, the list sure has picked up again. Eric wrote: > Does anyone know of a manufacturer of FIPS 140 certified or > certifiable 1u/2u rack mount chassis? Eric, There is a lot more to FIPS 140-2 than the case. It's what's inside the aluminum case that matters. In principle, any solid case with 6 sides could be the basis for a FIPS certified device. --Lucky Green ________________________________________________________________ This message could have been secured by PGP Universal. To secure future messages from this sender, please click this link: https://keys.cypherpunks.to/b/b.e?r=cypherpunks at al-qaeda.net From pgut001 at cs.auckland.ac.nz Sat Jul 17 05:03:50 2004 From: pgut001 at cs.auckland.ac.nz (Peter Gutmann) Date: Sun, 18 Jul 2004 00:03:50 +1200 Subject: vacuum-safe laptops ? In-Reply-To: <0407170325060.9902@somehost.domainz.com> Message-ID: Thomas Shaddack writes: >There are many various embedded computers available on the market, eg. the >one from . (Question for the crowd: anybody knows >other comparable or better Linux-ready affordable embedded computer >solutions?) When I investigated this a while back, gumstix were about the best deal. They also have pretty good support, it's a small company and the techies directly answer queries on mailing lists. Peter. From bill.stewart at pobox.com Sun Jul 18 00:09:05 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Sun, 18 Jul 2004 00:09:05 -0700 Subject: Secure telephones In-Reply-To: <6.0.1.1.0.20040717221930.046998e0@mail.comcast.net> References: <0407171949520.-1331463516@somehost.domainz.com> <6.0.1.1.0.20040717221930.046998e0@mail.comcast.net> Message-ID: <6.0.3.0.0.20040717235106.043148e0@pop.idiom.com> >At 11:45 AM 7/17/2004, Thomas Shaddack wrote: >>Pondering construction of a secure telephone. (Or at least a cellphone in >>general. The user interfaces and features available on virtually all the >>mass-market phones suck, to put it very very mildly, not even mentioning If you're trying to build a usable cellphone, you've got much more stringent design criteria than a deskphone. You've got packaging requirements that force you into serious industrial design if you want something pocket-sized with good battery life, plus you've got to implement all the cellular interface features. If you're willing to build a backpack-phone, that's a lot simpler, because you can use a laptop with a [pick-your-favorite-cellular-data-standard] card and either a wired headset or a Bluetooth frob for a BT headset. An intermediate design, which other people have done, is an 802.11 phone - take your favorite high-end multimedia PDA and an 802.11 card and write whatever UI you want. Again, you can either do a wire to your pocket or Bluetooth, or do what some of the early Compaq Ipaq phones did and just hold the thing up to your cheek. I'm not aware of any cellular data cards in PDA-usable format (unless you've got a PDA big enough for PCMCIA), but you could take a GSM etc. phone with a wired interface to a PDA. The fun UI to implement is an all-audio one, with speech recognition for commands. There's a lot of market space out there for that. Bluetooth headsets aren't necessarily a great match for it, because you're getting a low bit-rate signal from a cheap microphone, as opposed to 11kHz 16-bit audio sampling. From shaddack at ns.arachne.cz Sat Jul 17 16:13:13 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sun, 18 Jul 2004 01:13:13 +0200 (CEST) Subject: vacuum-safe laptops ? In-Reply-To: References: Message-ID: <0407180049580.9914@somehost.domainz.com> On Sat, 17 Jul 2004, Tyler Durden wrote: > Sorry to need educating once again, but I had assumed can-shaped capacitors > were gone from laptops in lieu of surface mount. Anyone know? (I don't own a > laptop.) The can caps can be surface-mounted as well. The leads then look different, but the inside is still the same: a metal can with etched aluminum strips and an insulator soaked with electrolyte. The magic smoke they are filled with also has the same color and smell as their non-SMD predecessors. See also http://www.elna.co.jp/en/ct/c_al01.htm for brief description of liquid-electrolyte aluminum capacitors. There are also some more modern constructions, where the electrolyte is solid-state. (The tantalum capacitors, which are more common in SMD form than the aluminum ones, use MnO2 as electrolyte and Ta2O5 as insulator. The added advantage here is that during a breakdown, the MnO2 layer locally overheats and is converted to less conductive Mn2O3, which causes the breakdown to "heal". Similar mechanism is used in capacitors with solid-state plastic electrolyte.) I suppose the solid-state caps could be much more reliable in the conditions of rapid pressure changes, if they won't have moisture or air trapped inside their construction. From shaddack at ns.arachne.cz Sat Jul 17 16:52:39 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sun, 18 Jul 2004 01:52:39 +0200 (CEST) Subject: vacuum-safe laptops ? In-Reply-To: <40F890FD.B1CBE323@cdc.gov> References: <40F890FD.B1CBE323@cdc.gov> Message-ID: <0407180136580.9916@somehost.domainz.com> On Fri, 16 Jul 2004, Major Variola (ret) wrote: > Um, even the small form factor PC on a board the size of your palm may > still rely on caps in the power supply that don't handle 760 to 0 mm > Hg/min so readily. However, if you use a low-power board, you have less current to filter the ripples from, so you need smaller caps, which offers you more options. You can also replace the caps in the power supply for vacuum-resistant types, for the price of some soldering. > Otherwise, there are many small PCs on a card if you look into the > embedded marketplace. Complete with solid state disks, etc. COTS. Do you know some worth of being refered to, if possible low-cost? The situation on the market is changing so fast it's difficult to keep track. > perhaps anon actually wants to run M$ in a low pressure environ. > Perhaps that's why he's anonymous :-) Maybe it's agent of Microsoft looking for expanding the market to space! (Blue sky instead of blue screen?) > My guess is regular ole airplane takeoff, but its not quite 0 torr > at 35Kfeet, and I *think* the cargo part is pressurized, lest > Fido suffocate. Also, a lot of cargo can be susceptible to lower pressures. Eg, the mentioned capacitors could be popping. So some overpressure during the flight has to be maintained there. > And while a SAM would be a great science fair project, you don't go > above that limit. Perhaps anon will be a space tourist, wanting to take > notes, on something heavier than a PDA+keyboard. In that case, I'd suggest to build it as a wearable computer, integrated into the space suit. > I once TA'd at a UC, one advanced ugrad had a project for an atmospheric > science prof building a board for the nose of a spyplane, to sample the > air. (For ozone, not nucleotides. No, really.) He was interested in > vibration problems; I told him to take his proto board on an offroad > trip in his car to shake out the moths. Wise. :) > Am not sure that epoxy cover makes a difference, the board manuf. go to > lengths to avoid air pockets under traces, the ICs themselves fairly > (albeit not guaranteed) encapsulated in an epoxy mix. Sealing the boards in resin, under lowered pressure, could possibly help; the pressure of the atmosphere would be replaced by the pressure of the resin. Another option could be mounting the device into a hermetically sealed case, filled with eg. silicone oil for easier heat transfer. From monty at roscom.com Sun Jul 18 03:52:57 2004 From: monty at roscom.com (Monty Solomon) Date: July 18, 2004 3:52:57 PM EDT Subject: Surveillance targeted to convention / Wide network of cameras Message-ID: planned Surveillance targeted to convention Wide network of cameras planned By Ralph Ranalli and Rick Klein, Globe Staff | July 18, 2004 An unprecedented number of video cameras will be trained on Boston during the Democratic National Convention, with Boston police installing some 30 cameras near the FleetCenter, the Coast Guard using infrared devices and night-vision cameras in the harbor, and dozens of pieces of surveillance equipment mounted on downtown buildings to monitor crowds for terrorists, unruly demonstrators, and ordinary street crime. For the first time, 75 high-tech video cameras operated by the federal government will be linked into a surveillance network to monitor the Central Artery, City Hall Plaza, the FleetCenter, and other sensitive sites. Their feeds from cameras mounted on various downtown buildings will be piped to monitoring stations in the Boston area and in Washington, D.C., and officials will be able to zoom in from their work stations to gather details of facial descriptions or read license plates. With Boston Harbor just a few steps from the arena, the Coast Guard will be using its new ''hawkeye system" -- in place in one other port in the nation -- to watch area waterways. The network of infrared imaging, radar, and cameras that operate in both day and night conditions will give security officials a real-time picture of the harbor, and provide agencies an early warning if an unexpected ship enters area waters. An unspecified number of State Police cameras are also being installed, and more than 100 previously existing MBTA cameras will be used to monitor area subway and bus stations. Law enforcement officials will have as-needed access to as many as 900 cameras that have been operated for months or years by the Massachusetts Port Authority, the state Highway Department, and the Big Dig. Civil libertarians warn that the latest technology will be used to scare away protesters and others exercising their rights under the First Amendment. The critics complain that there are few state and federal laws regulating the use of video surveillance in public places. ... http://www.boston.com/news/politics/conventions/articles/2004/07/18/ surveillance_targeted_to_convention/ ------------------------------------- You are subscribed as eugen at leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From measl at mfn.org Sun Jul 18 03:55:02 2004 From: measl at mfn.org (J.A. Terranson) Date: Sun, 18 Jul 2004 05:55:02 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040718102305.GJ1141@leitl.org> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> <20040718102305.GJ1141@leitl.org> Message-ID: <20040718054902.O20489@ubzr.zsa.bet> On Sun, 18 Jul 2004, Eugen Leitl wrote: > For those of you who have worked at major ISPs, can the fact that traffic is > routed through a few "customer" boxes be hidden from employees? Speaking as someone who qualifies: no. However, the fact that you even asked the question begs another question, namely, what do you consider "major"? Savvis was, in my opinion, at the very lower end of "major", operating in ~140 countries, although most of that was vpn and multicast. Lets guess that internet was considerably less, say ~15-20 countries directly. In short, the trouble with trying to stuff all this through a choke point (or even 10 choke points) is it's going to be either seen directly as a router hop (if at layer3), or seen indirectly at layer two. And the kind of detailed troubleshooting that goes on in the first through third level support groups just wouldn't be able to miss this - sooner or later someone whold see something, and then the whole place would know. Now, *mirroring* to a couple of choke points, sure, but then you ave transit and other associated costs (you gotta haul the data to all of the collectors). Just not feasible to do it quietly. Note, I said quietly. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From measl at mfn.org Sun Jul 18 04:13:49 2004 From: measl at mfn.org (J.A. Terranson) Date: Sun, 18 Jul 2004 06:13:49 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040718111021.GM1141@leitl.org> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> <20040718102305.GJ1141@leitl.org> <20040718054902.O20489@ubzr.zsa.bet> <20040718111021.GM1141@leitl.org> Message-ID: <20040718061207.V20489@ubzr.zsa.bet> On Sun, 18 Jul 2004, Eugen Leitl wrote: > I was thinking about a box at each incoming/outgoing point with a NIC in > passive mode. A NIC? You gotta realize that we're talking about mesh circuits here: OC3-OC48 trunks, OC192 backbones... This is no small job. A mom/pop or midsized regional maybe you could do this - you know, the guy with a half a dozen DS3s. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From measl at mfn.org Sun Jul 18 05:50:16 2004 From: measl at mfn.org (J.A. Terranson) Date: Sun, 18 Jul 2004 07:50:16 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040718124609.GO1141@leitl.org> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> <20040718102305.GJ1141@leitl.org> <20040718054902.O20489@ubzr.zsa.bet> <20040718111021.GM1141@leitl.org> <20040718061207.V20489@ubzr.zsa.bet> <20040718124609.GO1141@leitl.org> Message-ID: <20040718074741.Y20489@ubzr.zsa.bet> On Sun, 18 Jul 2004, Eugen Leitl wrote: > On Sun, Jul 18, 2004 at 06:13:49AM -0500, J.A. Terranson wrote: > > > A NIC? You gotta realize that we're talking about mesh circuits here: > > OC3-OC48 trunks, OC192 backbones... This is no small job. A mom/pop or > > At times of 10 GBit Ethernet, OC192 data rate doesn't seem all that > intimidating. > > A standard 1U Dell should have enough crunch to just filter out the > plain text packets of a 1 GBps Ethernet line. I have seen a passive tap on a gig line used for IDS, true, but that's pretty close to the state of the art right now. There's an issue with getting the interfaces for the 1U Dell, and then you have the secondary issues of just how much encapsulated crap do you need to strip off, and how fast. Remeber, you only get 1 shot, and you *can't* ask for more time - if your buffer runneth over, you be screwed. It's not as easy as it feels. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From shaddack at ns.arachne.cz Sun Jul 18 02:02:44 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sun, 18 Jul 2004 11:02:44 +0200 (CEST) Subject: Secure telephones In-Reply-To: <6.0.3.0.0.20040717235106.043148e0@pop.idiom.com> References: <0407171949520.-1331463516@somehost.domainz.com> <6.0.1.1.0.20040717221930.046998e0@mail.comcast.net> <6.0.3.0.0.20040717235106.043148e0@pop.idiom.com> Message-ID: <0407181052120.0@somehost.domainz.com> On Sun, 18 Jul 2004, Bill Stewart wrote: > If you're trying to build a usable cellphone, > you've got much more stringent design criteria than a deskphone. I am painfully aware of it. > You've got packaging requirements that force you into > serious industrial design if you want something pocket-sized > with good battery life, plus you've got to implement all the > cellular interface features. Or use the off-the-shelf modules for industrial applications that already do it, and add some glue logic. > If you're willing to build a backpack-phone, that's a lot simpler, > because you can use a laptop with a > [pick-your-favorite-cellular-data-standard] card > and either a wired headset or a Bluetooth frob for a BT headset. Check the Gumstix and the Enfora Enabler specs. The first is the equivalent of a grossly stripped-down laptop (80x20x6 mm, few mA sleep, 50 mA command-wait, 250mA full power w/o Bluetooth), the second one is the equivalent of a comm card (GSM/GPRS, 50x30x3 mm, tri-band 5mA standby). The laptop approach is good for prototyping, though. > I'm not aware of any cellular data cards in PDA-usable format > (unless you've got a PDA big enough for PCMCIA), > but you could take a GSM etc. phone with a wired interface to a PDA. I'd try the Enfora module in that case. RS232 for data and control, and analog I/O for voice. The PDA approach definitely has its merit. From shaddack at ns.arachne.cz Sun Jul 18 02:11:24 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sun, 18 Jul 2004 11:11:24 +0200 (CEST) Subject: Secure telephones In-Reply-To: <6.0.1.1.0.20040717221930.046998e0@mail.comcast.net> References: <0407171949520.-1331463516@somehost.domainz.com> <6.0.1.1.0.20040717221930.046998e0@mail.comcast.net> Message-ID: <0407181102550.0@somehost.domainz.com> On Sat, 17 Jul 2004, Steve Schear wrote: > How about building a secure cell phone using GnuRadio as a core? That way you > have maximum control afforded by the protocols. Several reasons valid at this moment (though I suppose (and hope) the situation will improve in next couple years). There is no available implementation for the low-level GSM protocols. Doing it from scratch looks like a royal bitch. The ADC/DAC chips for the required bandwidth are AWFULLY expensive. (I'd be happy if proven wrong here. (Well, I'd be happy if proven wrong in other two arguments too.)) The required processing power (and the related power (and cooling) consumption) is impractically high. But principially it is a very good idea, whose time will hopefully come soon. From eugen at leitl.org Sun Jul 18 03:23:06 2004 From: eugen at leitl.org (Eugen Leitl) Date: Sun, 18 Jul 2004 12:23:06 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> Message-ID: <20040718102305.GJ1141@leitl.org> On Sat, Jul 17, 2004 at 02:06:40PM -0700, Bill Stewart wrote: > On the other hand, 100,000 employees times two disk drives per desktop > and a few departmental servers can get you that much capacity. I understand there is this thing called a black budget. The production rate limit of plain text is human fingers. If you want to keep it all online, your burn rate is a kilobuck/day for hardware. Filtering traffic to extract relevant parts is going to cost a bit more, especially if you're using centralized taps and not server clouds in the periphery. For those of you who have worked at major ISPs, can the fact that traffic is routed through a few "customer" boxes be hidden from employees? -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From measl at mfn.org Sun Jul 18 11:07:10 2004 From: measl at mfn.org (J.A. Terranson) Date: Sun, 18 Jul 2004 13:07:10 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: References: Message-ID: <20040718130154.H20489@ubzr.zsa.bet> On Sun, 18 Jul 2004, Tyler Durden wrote: > "I think it would be far easier if WAN protocols were plain GBit Ethernet." > > WAN won't be 1GbE, but it will probably be 10GbE with SONET framing, or else > OC-192c POS (ie, PPP-encapsulated HDLC-framed MPLS). In either case, I > suspect it will be far cheaper in the long run to monitor a big fat pipe > than to try to break out a zillion lil' tiny DS1s. > > -TD OK, so Tyler [apparently] works in the business :-) Let me fill in what he left out. Yes, the industry is moving towards MPLS over POS. That's not where it is now though. At least not for most interfaces. Right now the industry is chock full of lagacy gear, mostly old fashioned ATM. You think you can just casually reassemble this crap in transit? Let's see it! Besides that old fashioned transport diversity, we have the original problem: even if you could do it (maybe in three to five years), what are you going to do with the data you've snarfed? Backhaul it? Shove it into TB cassettes? Better keep a guy on staff to change the tray!! None of the many obstacles curretly in the way will allow this to be done on the QT. Semi-openly would be another story, as would the scenario of a smaller, say regional, ISP. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From eugen at leitl.org Sun Jul 18 04:10:21 2004 From: eugen at leitl.org (Eugen Leitl) Date: Sun, 18 Jul 2004 13:10:21 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040718054902.O20489@ubzr.zsa.bet> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> <20040718102305.GJ1141@leitl.org> <20040718054902.O20489@ubzr.zsa.bet> Message-ID: <20040718111021.GM1141@leitl.org> On Sun, Jul 18, 2004 at 05:55:02AM -0500, J.A. Terranson wrote: > Now, *mirroring* to a couple of choke points, sure, but then you ave > transit and other associated costs (you gotta haul the data to all of the > collectors). I was thinking about a box at each incoming/outgoing point with a NIC in passive mode. Filtered traffic is a tiny fraction of total, and should be easy to send to a central location (I presume because it's feasible to process and store world's entire relevant text traffic in a pretty small central facility, no one is going to bother with true distributed processing; though filtering at the periphery already qualifies as such). Otoh, presence of a number of such boxes is goign to need a gag order, and a really major ISP. Small shops are too informal to be able to hide something like that. > Just not feasible to do it quietly. Note, I said quietly. Hardware required for tapping major arteries is going to need modified high-end routers (filtering of cloned traffic), no? I don't see how this is going to be a limit on organization of the size of NSA & consorts. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From camera_lumina at hotmail.com Sun Jul 18 10:11:20 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Sun, 18 Jul 2004 13:11:20 -0400 Subject: Magic Smoke? Message-ID: Ah yes. Are you referring to the smoke that powers telecom gear? (ie, the gear works until you see smoke pouring out of the top.) I had imagined this to be distributed throughout the NE... As for trolling, well, ahem. I've NEVER done that before... -TD >From: Thomas Shaddack >To: Tyler Durden >CC: mv at cdc.gov, cypherpunks at al-qaeda.net >Subject: Re: vacuum-safe laptops ? >Date: Sun, 18 Jul 2004 01:13:13 +0200 (CEST) > > >On Sat, 17 Jul 2004, Tyler Durden wrote: > > > Sorry to need educating once again, but I had assumed can-shaped >capacitors > > were gone from laptops in lieu of surface mount. Anyone know? (I don't >own a > > laptop.) > >The can caps can be surface-mounted as well. The leads then look >different, but the inside is still the same: a metal can with etched >aluminum strips and an insulator soaked with electrolyte. The magic smoke >they are filled with also has the same color and smell as their non-SMD >predecessors. > >See also http://www.elna.co.jp/en/ct/c_al01.htm for brief description of >liquid-electrolyte aluminum capacitors. > >There are also some more modern constructions, where the electrolyte is >solid-state. (The tantalum capacitors, which are more common in SMD form >than the aluminum ones, use MnO2 as electrolyte and Ta2O5 as insulator. >The added advantage here is that during a breakdown, the MnO2 layer >locally overheats and is converted to less conductive Mn2O3, which causes >the breakdown to "heal". Similar mechanism is used in capacitors with >solid-state plastic electrolyte.) > >I suppose the solid-state caps could be much more reliable in the >conditions of rapid pressure changes, if they won't have moisture or air >trapped inside their construction. _________________________________________________________________ Discover the best of the best at MSN Luxury Living. http://lexus.msn.com/ From camera_lumina at hotmail.com Sun Jul 18 10:13:26 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Sun, 18 Jul 2004 13:13:26 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: "At times of 10 GBit Ethernet, OC192 data rate doesn't seem all that intimidating." Well, as it turns out the 10GbE standard has a few flavors, and one of them uses a 'lite' version of OC-192 framing. So for all intents and purposes, consider them the same data rate. -TD >From: Eugen Leitl >To: "J.A. Terranson" , cypherpunks at al-qaeda.net >Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto proxies >Date: Sun, 18 Jul 2004 14:46:10 +0200 > >On Sun, Jul 18, 2004 at 06:13:49AM -0500, J.A. Terranson wrote: > > > A NIC? You gotta realize that we're talking about mesh circuits here: > > OC3-OC48 trunks, OC192 backbones... This is no small job. A mom/pop or > >At times of 10 GBit Ethernet, OC192 data rate doesn't seem all that >intimidating. > >A standard 1U Dell should have enough crunch to just filter out the >plain text packets of a 1 GBps Ethernet line. > > > midsized regional maybe you could do this - you know, the guy with a >half > > a dozen DS3s. > >-- >Eugen* Leitl leitl >______________________________________________________________ >ICBM: 48.07078, 11.61144 http://www.leitl.org >8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE >http://moleculardevices.org http://nanomachines.net ><< attach3 >> _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/ From camera_lumina at hotmail.com Sun Jul 18 10:17:09 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Sun, 18 Jul 2004 13:17:09 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: "I think it would be far easier if WAN protocols were plain GBit Ethernet." WAN won't be 1GbE, but it will probably be 10GbE with SONET framing, or else OC-192c POS (ie, PPP-encapsulated HDLC-framed MPLS). In either case, I suspect it will be far cheaper in the long run to monitor a big fat pipe than to try to break out a zillion lil' tiny DS1s. -TD >From: Eugen Leitl >To: "J.A. Terranson" , cypherpunks at al-qaeda.net >Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto proxies >Date: Sun, 18 Jul 2004 15:34:18 +0200 > >On Sun, Jul 18, 2004 at 07:50:16AM -0500, J.A. Terranson wrote: > > > I have seen a passive tap on a gig line used for IDS, true, but that's > > pretty close to the state of the art right now. There's an issue with > >There are dedicated network processors, though, and one can outsorce the >filter bottlenecks into an FPGA board. This is still reasonably small and >cheap. > > > getting the interfaces for the 1U Dell, and then you have the secondary > > issues of just how much encapsulated crap do you need to strip off, and > > how fast. Remeber, you only get 1 shot, and you *can't* ask for more >time > > - if your buffer runneth over, you be screwed. > > > > It's not as easy as it feels. > >I think it would be far easier if WAN protocols were plain GBit Ethernet. > >-- >Eugen* Leitl leitl >______________________________________________________________ >ICBM: 48.07078, 11.61144 http://www.leitl.org >8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE >http://moleculardevices.org http://nanomachines.net ><< attach3 >> _________________________________________________________________ Discover the best of the best at MSN Luxury Living. http://lexus.msn.com/ From die at dieconsulting.com Sun Jul 18 12:44:51 2004 From: die at dieconsulting.com (Die) Date: Sun, 18 Jul 2004 14:44:51 -0500 Subject: Message-ID: The snake [demime 1.01d removed an attachment of type application/octet-stream which had a name of Doll.cpl] From eugen at leitl.org Sun Jul 18 05:46:10 2004 From: eugen at leitl.org (Eugen Leitl) Date: Sun, 18 Jul 2004 14:46:10 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040718061207.V20489@ubzr.zsa.bet> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> <20040718102305.GJ1141@leitl.org> <20040718054902.O20489@ubzr.zsa.bet> <20040718111021.GM1141@leitl.org> <20040718061207.V20489@ubzr.zsa.bet> Message-ID: <20040718124609.GO1141@leitl.org> On Sun, Jul 18, 2004 at 06:13:49AM -0500, J.A. Terranson wrote: > A NIC? You gotta realize that we're talking about mesh circuits here: > OC3-OC48 trunks, OC192 backbones... This is no small job. A mom/pop or At times of 10 GBit Ethernet, OC192 data rate doesn't seem all that intimidating. A standard 1U Dell should have enough crunch to just filter out the plain text packets of a 1 GBps Ethernet line. > midsized regional maybe you could do this - you know, the guy with a half > a dozen DS3s. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From lloyd at randombit.net Sun Jul 18 11:51:40 2004 From: lloyd at randombit.net (Jack Lloyd) Date: Sun, 18 Jul 2004 14:51:40 -0400 Subject: Secure telephones In-Reply-To: <40FAC21F.2040904@gmx.co.uk> References: <0407171949520.-1331463516@somehost.domainz.com> <40FAC21F.2040904@gmx.co.uk> Message-ID: <20040718185140.GC32203@acm.jhu.edu> On Sun, Jul 18, 2004 at 07:31:59PM +0100, Dave Howe wrote: > OpenVPN is of course built on SSL, and can use either X509 certificates > or a preshared key for authentication. Sadly, there is no convenient way > to use DNS-SEC key records for OpenVPN. How well is VoIP going to work over SSL/TLS (ie, TCP) though? I've never used any VoIP-over-TCP software before, but some people I know who have say it sucks (terrible latency, sometimes as bad as 5-10 seconds). That may have just been an artifact of a bad implementation, though. DTLS might be a better pick for securing VoIP. There's also SRTP. From eugen at leitl.org Sun Jul 18 06:34:18 2004 From: eugen at leitl.org (Eugen Leitl) Date: Sun, 18 Jul 2004 15:34:18 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040718074741.Y20489@ubzr.zsa.bet> References: <6.0.1.1.0.20040707120719.046ee708@mail.comcast.net> <6.0.3.0.0.20040717140535.042d31f8@pop.idiom.com> <20040718102305.GJ1141@leitl.org> <20040718054902.O20489@ubzr.zsa.bet> <20040718111021.GM1141@leitl.org> <20040718061207.V20489@ubzr.zsa.bet> <20040718124609.GO1141@leitl.org> <20040718074741.Y20489@ubzr.zsa.bet> Message-ID: <20040718133418.GQ1141@leitl.org> On Sun, Jul 18, 2004 at 07:50:16AM -0500, J.A. Terranson wrote: > I have seen a passive tap on a gig line used for IDS, true, but that's > pretty close to the state of the art right now. There's an issue with There are dedicated network processors, though, and one can outsorce the filter bottlenecks into an FPGA board. This is still reasonably small and cheap. > getting the interfaces for the 1U Dell, and then you have the secondary > issues of just how much encapsulated crap do you need to strip off, and > how fast. Remeber, you only get 1 shot, and you *can't* ask for more time > - if your buffer runneth over, you be screwed. > > It's not as easy as it feels. I think it would be far easier if WAN protocols were plain GBit Ethernet. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From lloyd at randombit.net Sun Jul 18 13:19:46 2004 From: lloyd at randombit.net (Jack Lloyd) Date: Sun, 18 Jul 2004 16:19:46 -0400 Subject: Secure telephones In-Reply-To: <40FAD53F.6010501@gmx.co.uk> References: <0407171949520.-1331463516@somehost.domainz.com> <40FAC21F.2040904@gmx.co.uk> <20040718185140.GC32203@acm.jhu.edu> <40FAD53F.6010501@gmx.co.uk> Message-ID: <20040718201946.GE32203@acm.jhu.edu> On Sun, Jul 18, 2004 at 08:53:35PM +0100, Dave Howe wrote: > >That may have just been an artifact of a bad implementation, though. DTLS > >might be a better pick for securing VoIP. There's also SRTP. > > The strength of a pure VPN solution is that you aren't limited to *just* > VoIP - you can transfer files, use whiteboarding, run videoconferencing, > support text channels..... even play games :) Well, nothing stopping you from treating your datagram-based VPN (ie, DTLS) as an IP tunnel, and doing TCP-like stuff on top of it to handle the IM and file transfer. Actually I'm working on something rather like that now, which may or not get finished soon. -Jack From die at dieconsulting.com Sun Jul 18 14:21:55 2004 From: die at dieconsulting.com (Die) Date: Sun, 18 Jul 2004 16:21:55 -0500 Subject: Message-ID: Lovely animals [demime 1.01d removed an attachment of type application/octet-stream which had a name of Dog.scr] From brian-slashdotnews at hyperreal.org Sun Jul 18 12:26:01 2004 From: brian-slashdotnews at hyperreal.org (brian-slashdotnews at hyperreal.org) Date: 18 Jul 2004 19:26:01 -0000 Subject: 1984 Comes To Boston Message-ID: Link: http://slashdot.org/article.pl?sid=04/07/18/1821223 Posted by: timothy, on 2004-07-18 18:47:00 Topic: 158, 83 comments from the panopticonjob dept. walmass writes "In preparation for the DNC in Boston, [1]75 cameras monitored by the Federal government will be operating around the downtown Boston location. There are also an unspecified number of state police cameras, and 100 cameras owned by the Metro Boston Transit Authority. Quote: 'And it's here to stay: Boston police say the 30 or so cameras installed for the convention will be used throughout the city once the event is over. "We own them now," said police Superintendent Robert Dunford. "We're certainly not going to put them in a closet."'" [2]Click Here References 1. http://www.boston.com/news/politics/conventions/articles/2004/07/18/surveilla nce_targeted_to_convention?mode=PF 2. http://ads.osdn.com/?ad_id=4121&alloc_id=9746&site_id=1&request_id=7686742&op =click&page=%2farticle%2epl ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From DaveHowe at gmx.co.uk Sun Jul 18 11:31:59 2004 From: DaveHowe at gmx.co.uk (Dave Howe) Date: Sun, 18 Jul 2004 19:31:59 +0100 Subject: Secure telephones In-Reply-To: <0407171949520.-1331463516@somehost.domainz.com> References: <0407171949520.-1331463516@somehost.domainz.com> Message-ID: <40FAC21F.2040904@gmx.co.uk> Thomas Shaddack wrote: > The easiest way is probably a hybrid of telephone/modem, doing normal > calls in "analog" voice mode and secure calls in digital modem-to-modem > connection. The digital layer may be done best over IP protocol, assigning > IP addresses to the phones and making them talk over TCP and UDP over the > direct dialup. (We cannot reliably use GPRS, as the quality of service is > not assured, so we have to use direct dialup. But we can implement "real" > IP later, when the available technology reaches that stage.) IIRC, PGPfone (http://www.pgpi.org/products/pgpfone/) did something similar, with a "verbal handshake" protocol that relied on you being able to recognise the remote party's voice over the phone while speaking a list of words.... always seemed both unreliable and odd in something with "PGP" in the name, but.... > Once we have the phones talking over IP with each other, we can proceed > with the handshake. I'd suggest using OpenSSL for this purpose, as it > offers all we need for certificates and secure transfer of the key. Then > use UDP for the voice itself, using eg. stripped-down SpeakFreely as the > engine. So during the call, two connections will be open over the IP > channel: the command one (SSL-wrapped TCP, for key and protocol handshake, > ensuring the identity of the caller, etc.), and the data one (a > bidirectional UDP stream). As the command connection should be silent for > most of the time, a 14k4 modem should offer us enough bandwidth for 9k6 > GSM codec, even with the UDP/IP overhead. Raw data streams would be fine over a point to point modem link - but I can see an advantage to compartmentalization - you can break your secure phone problem down into two distinct subproblems a) establishing a secure IP VPN between two nodes b) optimizing VoIP for low bandwidth links I would add a third - a modem protocol based on something like CSMA/CD to allow conference calls to be used as carrier media for secure conversations, but that is too hairy for me :) Something like OpenVPN (http://openvpn.sourceforge.net/) seems ideal for the secure VPN part of the problem, but requires an underlying IP network.... the VoIP part of the problem has a embarrassment of riches; H323 used to come as standard with windows, in the form of Netmeeting (complete with videoconferencing and whiteboarding) and SIP is now part of Windows XP (a not-particuarly-well-documented) "feature" of windows messager. There are many, many more, and Asterix (sadly not particularly well known, and unix only) is a complete, open source PBX which is conventional telephony, SIP and H323 aware. OpenVPN is of course built on SSL, and can use either X509 certificates or a preshared key for authentication. Sadly, there is no convenient way to use DNS-SEC key records for OpenVPN. From measl at mfn.org Sun Jul 18 18:50:20 2004 From: measl at mfn.org (J.A. Terranson) Date: Sun, 18 Jul 2004 20:50:20 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: References: Message-ID: <20040718204216.G20489@ubzr.zsa.bet> On Sun, 18 Jul 2004, Tyler Durden wrote: > JA, ya' gotta good point here. Or at least, this sheds a lot of doubt on > things. > > But then again, the purpose of GIG-BE may be precisely to move an optical > copy (use a $100 splitter) back to processing centers where the traffic is > stored. In this case, they won't even be trying to break it down to circuits > prior to storage...they may instead dump the raw OC-Ns directly onto some > kind of fast storage medium and then sift through it later. > > The idea of duplicating all optical traffic seems a little farfetched, > though, but I bet everything from the cable landings may soon get swallowed > whole, if it isn't already. Note that this is totally not the scenario we had under discussion (i.e., the intercepts being done at the ISP level). If you were to ask me if Mr. Fed. was currently capable of (a) intercepting offshore, say 3-4mi off the formal landings, (b) splice into transatlantic fibers and send the copy down their own fibers, all of it underwater, well, that would be a different discussion entirely. One we seriously discussed just after a pair of buildings became a pair of dust factories. I *firmly* believe this is possible, if not probable, at least on a large scale (although probably not on a complete scale). When the towers came down and the feds were asking everyone to volunteer to host carnivores, we all thought they gave up *way* too easily when turned away (at least the were turned away where I worked - my understanding is that this was not universal). Subsequently, we discussed, mostly as an academic excersize, whether we believed this was possible - and the consensus was a resounding yes. To listen offshore, just prior to making land, is *doable*. Completely. Now, three years and hundreds of hours of federal agencies interaction later, I'd be surprised if this wasn't at least part of the problem that NSA has with data saturation: Are we deaf, or is the volume too loud? Yes. > -TD -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From DaveHowe at gmx.co.uk Sun Jul 18 12:53:35 2004 From: DaveHowe at gmx.co.uk (Dave Howe) Date: Sun, 18 Jul 2004 20:53:35 +0100 Subject: Secure telephones In-Reply-To: <20040718185140.GC32203@acm.jhu.edu> References: <0407171949520.-1331463516@somehost.domainz.com> <40FAC21F.2040904@gmx.co.uk> <20040718185140.GC32203@acm.jhu.edu> Message-ID: <40FAD53F.6010501@gmx.co.uk> Jack Lloyd wrote: > How well is VoIP going to work over SSL/TLS (ie, TCP) though? you can do SSL over UDP if you like - I think most VPN software is UDP only, while OpenVPN has a "fallback" TCP mode for cases where you can't use UDP (and TBH there aren't many) > I've never used > any VoIP-over-TCP software before, but some people I know who have say it sucks > (terrible latency, sometimes as bad as 5-10 seconds). PGPfone had that problem, even over landlines (no IP involved) - however, I think that was more do to with the compression codecs and the crypto than any external problems, as switching to half-duplex usually cleared the problems up. > That may have just been > an artifact of a bad implementation, though. DTLS might be a better pick for > securing VoIP. There's also SRTP. The strength of a pure VPN solution is that you aren't limited to *just* VoIP - you can transfer files, use whiteboarding, run videoconferencing, support text channels..... even play games :) From camera_lumina at hotmail.com Sun Jul 18 18:02:35 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Sun, 18 Jul 2004 21:02:35 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: JA, ya' gotta good point here. Or at least, this sheds a lot of doubt on things. But then again, the purpose of GIG-BE may be precisely to move an optical copy (use a $100 splitter) back to processing centers where the traffic is stored. In this case, they won't even be trying to break it down to circuits prior to storage...they may instead dump the raw OC-Ns directly onto some kind of fast storage medium and then sift through it later. The idea of duplicating all optical traffic seems a little farfetched, though, but I bet everything from the cable landings may soon get swallowed whole, if it isn't already. I'm still thinking they must do some kind of "grooming" prior to mass backhauls of traffic. There are just too many fibers and too many transmission systems out there for them to duplicate all of it. Perhaps at the routers they sniff, and then CALEA whatever circuit that conversation came out of. -TD >From: "J.A. Terranson" >To: Tyler Durden >CC: eugen at leitl.org, cypherpunks at al-qaeda.net >Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto proxies >Date: Sun, 18 Jul 2004 13:07:10 -0500 (CDT) > > >On Sun, 18 Jul 2004, Tyler Durden wrote: > > > "I think it would be far easier if WAN protocols were plain GBit >Ethernet." > > > > WAN won't be 1GbE, but it will probably be 10GbE with SONET framing, or >else > > OC-192c POS (ie, PPP-encapsulated HDLC-framed MPLS). In either case, I > > suspect it will be far cheaper in the long run to monitor a big fat pipe > > than to try to break out a zillion lil' tiny DS1s. > > > > -TD > >OK, so Tyler [apparently] works in the business :-) > >Let me fill in what he left out. Yes, the industry is moving towards >MPLS over POS. That's not where it is now though. At least not for most >interfaces. Right now the industry is chock full of lagacy gear, mostly >old fashioned ATM. You think you can just casually reassemble this crap >in transit? Let's see it! > >Besides that old fashioned transport diversity, we have the original >problem: even if you could do it (maybe in three to five years), what are >you going to do with the data you've snarfed? Backhaul it? Shove it into >TB cassettes? Better keep a guy on staff to change the tray!! > >None of the many obstacles curretly in the way will allow this to be done >on the QT. Semi-openly would be another story, as would the scenario of a >smaller, say regional, ISP. > >-- >Yours, > >J.A. Terranson >sysadmin at mfn.org >0xBD4A95BF > > "...justice is a duty towards those whom you love and those whom you do > not. And people's rights will not be harmed if the opponent speaks out > about them." Osama Bin Laden > - - - > > "There aught to be limits to freedom!" George Bush > - - - > >Which one scares you more? _________________________________________________________________ Discover the best of the best at MSN Luxury Living. http://lexus.msn.com/ From mv at cdc.gov Sun Jul 18 22:35:19 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sun, 18 Jul 2004 22:35:19 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40FB5D97.1103F6AB@cdc.gov> At 01:07 PM 7/18/04 -0500, J.A. Terranson wrote: >Let me fill in what he left out. Yes, the industry is moving towards >MPLS over POS. That's not where it is now though. At least not for most >interfaces. Right now the industry is chock full of lagacy gear, mostly >old fashioned ATM. You think you can just casually reassemble this crap >in transit? Let's see it! Gimme an intel IXA network processor and no problem. ATM is fixed size data, not as tricky as IP decoding. Predicatable bandwidth. Stream all into megadisks, analyze later. You need to tap the MPLS label assignment service (or watch all the egress ports and correlate to endpoints) too to know which ATM chunks went where. >Besides that old fashioned transport diversity, we have the original >problem: even if you could do it (maybe in three to five years), what are >you going to do with the data you've snarfed? Backhaul it? Shove it into >TB cassettes? Better keep a guy on staff to change the tray!! You don't know about tape robots, or offline indexing, eh? From shaddack at ns.arachne.cz Sun Jul 18 20:25:35 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Mon, 19 Jul 2004 05:25:35 +0200 (CEST) Subject: Cheap TDR for fibers? Message-ID: <0407190503160.-1331463516@somehost.domainz.com> The laser diodes used in eg. CD players have a feedback photodiode, sensing the laser's optical output. If the lasers used for optical fibers have similar mechanism too, and if the diode is sensitive to the light coming to it not only from the chip but also from the fiber itself, and can react quickly enough with high enough sensitivity, maybe it could be exploited. In chosen moments, we could then send a short pulse of laser light into the fiber, then watch the signal from the feedback diode, what gets reflected back from nonhomogenities on the fiber. This would give us the distances of all the splices and connectors, and let us know immediately (if the test is performed eg. once per 5 seconds or with similar short period) that there is an attempt to compromise the line underway. Comparison of snapshots from longer periods apart could also serve to find deterioration of the signal path before it results in failure. The advantage of this approach, if possible, is the ability to add the functionality without having to modify the optical transceivers themselves. It sounds too good to be true, so it probably won't work, but I may be wrong... From rsw at jfet.org Mon Jul 19 05:13:46 2004 From: rsw at jfet.org (Riad S. Wahby) Date: Mon, 19 Jul 2004 07:13:46 -0500 Subject: 1984 Comes To Boston (fwd from brian-slashdotnews@hyperreal.org) In-Reply-To: <20040719085119.GD1141@leitl.org> References: <20040719085119.GD1141@leitl.org> Message-ID: <20040719121346.GA21012@jfet.org> Eugen Leitl wrote: > from the panopticonjob dept. > walmass writes "In preparation for the DNC in Boston, [1]75 cameras > monitored by the Federal government will be operating around the > downtown Boston location. There are also an unspecified number of > state police cameras, and 100 cameras owned by the Metro Boston > Transit Authority. Quote: 'And it's here to stay: Boston police say > the 30 or so cameras installed for the convention will be used > throughout the city once the event is over. "We own them now," said > police Superintendent Robert Dunford. "We're certainly not going to > put them in a closet."'" Maybe it's time to start making those high power IR emitters. Make them cheap enough and we can just hand them out to right-minded folk to drop here and there. Has anyone seen these cameras? Are they noticeable? At least some of them are supposedly on the central artery; your car can certainly spare 100W or so for some IR blasters... -- Riad S. Wahby rsw at jfet.org From measl at mfn.org Mon Jul 19 05:56:05 2004 From: measl at mfn.org (J.A. Terranson) Date: Mon, 19 Jul 2004 07:56:05 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40FB5D97.1103F6AB@cdc.gov> References: <40FB5D97.1103F6AB@cdc.gov> Message-ID: <20040719075452.L20489@ubzr.zsa.bet> On Sun, 18 Jul 2004, Major Variola (ret) wrote: > >Besides that old fashioned transport diversity, we have the original > >problem: even if you could do it (maybe in three to five years), what > are > >you going to do with the data you've snarfed? Backhaul it? Shove it > into > >TB cassettes? Better keep a guy on staff to change the tray!! > > You don't know about tape robots, or offline indexing, eh? None of which qualify here - remember, the discussion was based upon a "quiet" implementation. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From jamesd at echeque.com Mon Jul 19 08:41:08 2004 From: jamesd at echeque.com (James A. Donald) Date: Mon, 19 Jul 2004 08:41:08 -0700 Subject: Why there is no anonymous e-cash In-Reply-To: <0407171929210.9911@somehost.domainz.com> References: <20040717085129.A12925@slack.lne.com> Message-ID: <40FB8924.13079.463467@localhost> As I predicted, transactions are increasingly going on line. And as Hettinga predicted, the more anonymous and irreversible the transaction service, the cheaper and more convenient its services. All happening as predicted. So why don't we have anonymous chaumian cash by now? Because, the more anonymous and irreversible its services, the more fraudsters use it to convert other people's bank accounts, obtained by phishing, into usable money. Why don't we have anonymous e-cash? - because IE and outlook express are full of massive security holes, and because people are idiots. Observe Tim May, who mistook e-gold phishing spam mail for the real thing. Well, not so much that people are idiots, but that we still have not got a satisfactory security model that adequately accommodates human factors. From camera_lumina at hotmail.com Mon Jul 19 06:57:43 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Mon, 19 Jul 2004 09:57:43 -0400 Subject: Cheap TDR for fibers? Message-ID: Telecom-grade laser packages (and the lasers inside them) not only do not have a monitoring diode, they are designed very carefully to prevent the kind of feedback you're talking about (it destabilizes the laser and causes a power penalty). However, there's no real reason not to be able just to splice into the fiber. Hell, you don't even need a splice if you have access to the FDF (Fiber Distributing Frame, or fiber patch panel). -TD >From: Thomas Shaddack >To: Cypherpunks >Subject: Cheap TDR for fibers? >Date: Mon, 19 Jul 2004 05:25:35 +0200 (CEST) > > >The laser diodes used in eg. CD players have a feedback photodiode, >sensing the laser's optical output. > >If the lasers used for optical fibers have similar mechanism too, and if >the diode is sensitive to the light coming to it not only from the chip >but also from the fiber itself, and can react quickly enough with high >enough sensitivity, maybe it could be exploited. > >In chosen moments, we could then send a short pulse of laser light into >the fiber, then watch the signal from the feedback diode, what gets >reflected back from nonhomogenities on the fiber. This would give us the >distances of all the splices and connectors, and let us know immediately >(if the test is performed eg. once per 5 seconds or with similar short >period) that there is an attempt to compromise the line underway. >Comparison of snapshots from longer periods apart could also serve to find >deterioration of the signal path before it results in failure. > >The advantage of this approach, if possible, is the ability to add the >functionality without having to modify the optical transceivers >themselves. > > >It sounds too good to be true, so it probably won't work, but I may be >wrong... > _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar  get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/ From camera_lumina at hotmail.com Mon Jul 19 07:12:18 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Mon, 19 Jul 2004 10:12:18 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: "Gimme an intel IXA network processor and no problem. ATM is fixed size data, not as tricky as IP decoding. Predicatable bandwidth. Stream all into megadisks, analyze later." I'm gonna have to challenge this bit here, Variola. Let's back up. You've got an OC-48 or OC-192 fiber and you want to grab ALL of the data in this fiber. Now I'll grant that in real life there's going to be a lot telephony circuit in there, but let's take a worst-case and assume you need ALL the data. What's in this OC-192? Right now it definitely ain't 10Gb/s of packets. It's going to have LOTS of DS1s, DS3s and, if you're lucky, and STS-3c or two. So you'll need to first of all demux ALL of the tributaries. Next, you've got to un-map any ATM in each of the DS1s, etc, and then pull out the IP data from the ATM cells, remembering to reassemble fragmented packets (and there will be plenty with ATM). And remember, you may have to do this for 5000 simultaneous DS1s. Oh, and let's not forget pointer adjustments. You can't just blindly grab stuff...remember that all those tribs come from different STRATUM 1/3 clocks, so they'll be moving at different speeds and as a result have periodic slips w.r.t the STS-192 container. And that's just one fiber. How will you actually get all of this traffic back to HQ? Remember, it keeps coming and won't stop. No, I think I'm becomming convinced that they can't yet get ALL of it. But they DO probably grab complete wavelengths and backhual them, storing them for later study. (They must do some grooming too. For instance, they probably CALEA everything into and out of Brooklyn, and then that will get switched over to the Beltway where it will be packed into a GIG-BE OC-768 back to storage and processing.) -TD >From: "Major Variola (ret)" >To: "cypherpunks at al-qaeda.net" >Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto >proxies >Date: Sun, 18 Jul 2004 22:35:19 -0700 > >At 01:07 PM 7/18/04 -0500, J.A. Terranson wrote: > >Let me fill in what he left out. Yes, the industry is moving towards > >MPLS over POS. That's not where it is now though. At least not for >most > >interfaces. Right now the industry is chock full of lagacy gear, >mostly > >old fashioned ATM. You think you can just casually reassemble this >crap > >in transit? Let's see it! > >Gimme an intel IXA network processor and no problem. ATM is fixed >size data, not as tricky as IP decoding. Predicatable bandwidth. >Stream all into megadisks, analyze later. >You need to tap the MPLS label assignment service (or watch all the >egress ports and correlate to endpoints) too to know which ATM chunks >went where. > > >Besides that old fashioned transport diversity, we have the original > >problem: even if you could do it (maybe in three to five years), what >are > >you going to do with the data you've snarfed? Backhaul it? Shove it >into > >TB cassettes? Better keep a guy on staff to change the tray!! > >You don't know about tape robots, or offline indexing, eh? > > > > > _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/ From camera_lumina at hotmail.com Mon Jul 19 07:14:18 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Mon, 19 Jul 2004 10:14:18 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: >As suggested, tapping oversea fibres in shallow waters is probably the Way >To >Do It. Apparently NSA has it's own splicing sub for this purpose. As for US fibers, I've spoken to folks who have actually seen the splice in cable landings that went over to W. VA or wherever. -TD _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/ From eugen at leitl.org Mon Jul 19 01:51:19 2004 From: eugen at leitl.org (Eugen Leitl) Date: Mon, 19 Jul 2004 10:51:19 +0200 Subject: 1984 Comes To Boston (fwd from brian-slashdotnews@hyperreal.org) Message-ID: <20040719085119.GD1141@leitl.org> ----- Forwarded message from brian-slashdotnews at hyperreal.org ----- From s.schear at comcast.net Mon Jul 19 12:52:15 2004 From: s.schear at comcast.net (Steve Schear) Date: Mon, 19 Jul 2004 12:52:15 -0700 Subject: Why there is no anonymous e-cash In-Reply-To: <40FB8924.13079.463467@localhost> References: <20040717085129.A12925@slack.lne.com> <40FB8924.13079.463467@localhost> Message-ID: <6.0.1.1.0.20040719124929.053bb1e8@mail.comcast.net> At 08:41 AM 7/19/2004, James A. Donald wrote: >As I predicted, transactions are increasingly going on line. > >And as Hettinga predicted, the more anonymous and irreversible the >transaction service, the cheaper and more convenient its services. >All happening as predicted. > >So why don't we have anonymous chaumian cash by now? > >Because, the more anonymous and irreversible its services, the more >fraudsters use it to convert other people's bank accounts, obtained >by phishing, into usable money. Only if you ignore soft/hard money issues and your internal fraud controls are not up to par. >Why don't we have anonymous e-cash? - because IE and outlook express >are full of massive security holes, and because people are idiots. Or e-currency vendors don't use effective anti-phishing and key logger measures. They do seem to exist. steve From sunder at sunder.net Mon Jul 19 10:43:14 2004 From: sunder at sunder.net (Sunder) Date: Mon, 19 Jul 2004 13:43:14 -0400 (edt) Subject: Reputation Capital Article - 1st Monday: Manifesto for the Reputation Society In-Reply-To: <20040719085119.GD1141@leitl.org> References: <20040719085119.GD1141@leitl.org> Message-ID: Here's a paper/article/screed on reputation capital. A subject we discussed here a long while ago back when dinosaurs ruled the earth, etc... well, not quite that long ago. This doesn't seem to mention anything about anonymous users, however. http://www.firstmonday.org/issues/issue9_7/masum/index.html Abstract Manifesto for the Reputation Society by Hassan Masum and Yi.Cheng Zhang Information overload, challenges of evaluating quality, and the opportunity to benefit from experiences of others have spurred the development of reputation systems. Most Internet sites which mediate between large numbers of people use some form of reputation mechanism: Slashdot, eBay, ePinions, Amazon, and Google all make use of collaborative filtering, recommender systems, or shared judgements of quality. But we suggest the potential utility of reputation services is far greater, touching nearly every aspect of society. By leveraging our limited and local human judgement power with collective networked filtering, it is possible to promote an interconnected ecology of socially beneficial reputation systems . to restrain the baser side of human nature, while unleashing positive social changes and enabling the realization of ever higher goals. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"I find it ironic that, on an amendment designed to protect /|\ \|/ :American democracy and our constitutional rights, the /\|/\ <--*-->:Republican leadership in the House had to rig the vote and \/|\/ /|\ :subvert the democratic process in order to prevail" \|/ + v + : -- Rep. Sanders re vote to ammend the US PATRIOT ACT. -------------------------------------- http://www.sunder.net ------------ From DaveHowe at gmx.co.uk Mon Jul 19 05:51:52 2004 From: DaveHowe at gmx.co.uk (Dave Howe) Date: Mon, 19 Jul 2004 13:51:52 +0100 Subject: Secure telephones In-Reply-To: <20040718201946.GE32203@acm.jhu.edu> References: <0407171949520.-1331463516@somehost.domainz.com> <40FAC21F.2040904@gmx.co.uk> <20040718185140.GC32203@acm.jhu.edu> <40FAD53F.6010501@gmx.co.uk> <20040718201946.GE32203@acm.jhu.edu> Message-ID: <40FBC3E8.9050705@gmx.co.uk> Jack Lloyd wrote: > Well, nothing stopping you from treating your datagram-based VPN (ie, DTLS) as > an IP tunnel, and doing TCP-like stuff on top of it to handle the IM and file > transfer. Actually I'm working on something rather like that now, which may or > not get finished soon. *lol* aren't we all. I suppose its a sign of the times - a decade ago, we were all writing our own crypto packages - now, we are all writing our own VPN (or zero knowledge routers) :) From sfurlong at acmenet.net Mon Jul 19 11:09:59 2004 From: sfurlong at acmenet.net (Steve Furlong) Date: 19 Jul 2004 14:09:59 -0400 Subject: Reputation Capital Article - 1st Monday: Manifesto for the Reputation Society In-Reply-To: References: <20040719085119.GD1141@leitl.org> Message-ID: <1090260599.2175.0.camel@daft> On Mon, 2004-07-19 at 13:43, Sunder wrote: > Here's a paper/article/screed on reputation capital. A subject we > discussed here a long while ago back when dinosaurs ruled the earth, > etc... well, not quite that long ago. It's ok, you can still say "Tim May" around here. From jya at pipeline.com Mon Jul 19 13:49:46 2004 From: jya at pipeline.com (Jya) Date: Mon, 19 Jul 2004 14:49:46 -0600 Subject: Message-ID: >Animals [demime 1.01d removed an attachment of type application/octet-stream which had a name of Dog.com] From eugen at leitl.org Mon Jul 19 06:09:16 2004 From: eugen at leitl.org (Eugen Leitl) Date: Mon, 19 Jul 2004 15:09:16 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040719075452.L20489@ubzr.zsa.bet> References: <40FB5D97.1103F6AB@cdc.gov> <20040719075452.L20489@ubzr.zsa.bet> Message-ID: <20040719130915.GO1141@leitl.org> On Mon, Jul 19, 2004 at 07:56:05AM -0500, J.A. Terranson wrote: > None of which qualify here - remember, the discussion was based upon a > "quiet" implementation. A VPN link from a *nivore box streaming filtered info is pretty quiet. There are plenty of dedicated network processors for packet filtering purposes: http://leitl.org/ct/2004.1/01/160/art.htm As suggested, tapping oversea fibres in shallow waters is probably the Way To Do It. No way to store the entire traffic, and expect to still be able to mine it. What is interesting is how they do VoIP voice recognition, if at all. Too mancy simultaneous channels to screen them all, or are they? -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From dave at farber.net Mon Jul 19 15:01:29 2004 From: dave at farber.net (Dave) Date: Mon, 19 Jul 2004 16:01:29 -0600 Subject: Message-ID: >Predators [demime 1.01d removed an attachment of type application/octet-stream which had a name of Cat.cpl] From dave at farber.net Mon Jul 19 16:07:03 2004 From: dave at farber.net (Dave) Date: Mon, 19 Jul 2004 17:07:03 -0600 Subject: Message-ID: >fotogalary and Music [demime 1.01d removed an attachment of type application/octet-stream which had a name of Doll.scr] From jya at pipeline.com Mon Jul 19 16:55:32 2004 From: jya at pipeline.com (Jya) Date: Mon, 19 Jul 2004 17:55:32 -0600 Subject: Message-ID: >Animals [demime 1.01d removed an attachment of type application/octet-stream which had a name of Doll.scr] From rah at shipwright.com Mon Jul 19 15:12:46 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Mon, 19 Jul 2004 18:12:46 -0400 Subject: A cypherpunk in Baghdad (was re: giantlaser: Ali Baba returns) Message-ID: It looks like Ryan's going to Baghdad... Same as it ever was. Click the link to see details, like a pic or two. :-). Tyler's been running a sattelite ISP there for about a year. I've been reading his LJ for about 6 months now, or so. Great story. Anarchocapitalism at its finest, ladies and germs... Cheers, RAH -------- Tyler (??) (?giantlaser) wrote, @ 2004-07-18 13:24:00 ? ? Ali Baba returnsslownewsday and I woke last night to a battle outside our house. Two thieves (Ali Babas) dressed in black were sneaking around the back garden of our neighbor. It isn't clear who fired first, or how it started at all. What is clear is that the guards on my roof (over our bedroom) opened up with multiple rifles in short automatic bursts. The thieves may have responded with pistols, but clearly decided they were outgunned and beat feet. Jayme and I didn't know any of this when it happened. We bolted from bed and silently dressed in the first thing at hand, our pajamas. Note to self - emergency pants. Jayme put on her armor and I took my med kit, and we went to check what happened. My heart was beating and my mind raced. The firing had ceased after 15 seconds of exchange or so, but it was very close with no distant return fire. Is it Ali Baba? Insurgents? Something really serious? Can we defend the house or do we make a running retreat? Protective, aggressive caveman hovered beneath my consciousness. I could feel everything around me, including my own hands shaking as they grabbed spare magazines. Then I was holding my pistol, and I was still and ready. Strange. I advanced down the hall cop-style with my gun made ready with my arms in lowered shooting stance. It seemed like a good idea at the time - it's what cops do, right? Outside, I found Kak Jalal (the former Brig. General) talking to the guards. He looked me up and down, and laughed. He must have seen thousands of young men like that, armed and scared. I dropped the cop stance. It was all over by the time we were outside. We went back to bed. The post-panic sex was fantastic. So we're reviewing security. The approach the thieves might have taken is covered by a guard post (over my bedroom), a 3-meter wall, and razor wire. However, it's dark on the far side of the wall. Noor al Dien (my personal guard and faithful manservant *) spoke to the neighbor. The neighbor thanked him for guarding the neighborhood and asked us to install a light that shines into his yard. He doesn't have a generator, so he can't power a light reliably. This is good news for us, because we wanted to do this anyway but we didn't want to irritate the neighbors. Well, irritate them more than the razor wire and periodic gun battles already do. * I love saying "faithful manservant". We're adding the lights and working on better coordination between the guards. Some were more careful and gave measure warning shots. Some decided that overwhelming fright was the best tactic, in order to discourage repeat visits. I can't really argue with that, except for the part where it scares the shit out of me. (Post a new comment) octal 2004-07-18 04:39 (link) Amusing that this happens the day before I show up :) Webcams on the perimeter would be fun, too. I think I'll try to get a III + IV vest for the car; is it worth bothering with a coolmax and a IIA concealable? Also, battle dressings seem like a REALLY good idea. Pistol? Why not the AK? I've never really had a problem with confronting people with a gun while naked; if it shocks them for even a second, it's a plus for me. Heh. What are "warning shots"? As in center-of-mass hits on the targets, which the others find out about before attacking again? (Reply to this) (Thread) giantlaser 2004-07-18 06:48 (link) Vest is your call - the hard part is finding one. I don't wear one, but Jayme was issued one by her company. We carry battle dressings and tampons (stick them in wounds) at all times. 1/3 of my normal man-bag (read: European Carry-All, or purse) is devoted to bulletwound care. I went shooting with the AK a few days ago. It performed poorly - aim is fine, but after 30 rounds it heats up and jams frequently. I won't carry a weapon that's going to get me killed at a random time in the future. Killing is a very serious thing here. Even if they are thieves, we pay fassel if we kill them. So you give them a chance to flee before taking serious aim. A real attack is one thing. Simple thieves are another. (Reply to this) (Parent) (Thread) travisd 2004-07-18 15:27 (link) If you capture them though, can you demand ransom for their return? (Reply to this) (Parent) (Thread) giantlaser 2004-07-18 22:46 (link) Uh, yes. :) But it's not a wise business to get into. Our engineers are far too vulnerable as they travel around to make a profit on ransom possible. (Reply to this) (Parent) habibi 2004-07-18 08:18 (link) wow! (Reply to this) valiss 2004-07-18 08:41 (link) Another note-to-self: emergency shoes. Nothing like trying to flee from a building when glass is all over the floor. (Reply to this) gori11a 2004-07-18 09:21 (link) In Nairobi, our Askari ("night guard"? There's no real translation) carried Rungas, which are short narrow clubs with knotted gnarls at the end. Bandits usually were armed with Machettes. A siren and spinning light alarm on the top of a house would summon all the Askaris on the block to beat the bandits to within an inch of their lives. It was not uncommon for an Askari to be found asleep on his watch. I'm glad guns weren't as prevalent there as they seem to be in Baghdad. (Reply to this) cambler 2004-07-18 10:14 (link) I've said it before, and I'll say it again - I look forward to your book more than you can know. (Reply to this) re: turns of phrase (Anonymous) 2004-07-18 12:30 (link) "faithful manservant", eh? "aide-de-camp" is also very good. (Reply to this) pinkish 2004-07-18 23:55 (link) What about good ole motion sensor lights? Scare the shit out of me walking by someone's garage at 4am. (Reply to this) (Post a new comment) -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From eugen at leitl.org Mon Jul 19 11:21:40 2004 From: eugen at leitl.org (Eugen Leitl) Date: Mon, 19 Jul 2004 20:21:40 +0200 Subject: Reputation Capital Article - 1st Monday: Manifesto for the Reputation Society In-Reply-To: <1090260599.2175.0.camel@daft> References: <20040719085119.GD1141@leitl.org> <1090260599.2175.0.camel@daft> Message-ID: <20040719182139.GG1141@leitl.org> On Mon, Jul 19, 2004 at 02:09:59PM -0400, Steve Furlong wrote: > It's ok, you can still say "Tim May" around here. You rang? http://groups.google.com/groups?q=%22Tim+May%22&hl=en&lr=&ie=UTF-8&sa=G&scori ng=d -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From isn at c4i.org Tue Jul 20 05:12:55 2004 From: isn at c4i.org (InfoSec News) Date: Tue, 20 Jul 2004 07:12:55 -0500 (CDT) Subject: [ISN] Stolen code shop back in business - on Usenet Message-ID: http://www.itworld.com/Man/2681/040719stolencode/ Paul Roberts IDG News Service 7/19/04 An online group claiming to have the source code for two popular computer programs for sale opened its doors for business again on Saturday. An e-mail message that claims to come from "larry hobbles" and the Source Code Club was sent to the Full-Disclosure security discussion list. The message said that the group has moved operations to Usenet, the network of online bulletin boards that makes up part of the Internet, where interested customers can buy the source code for the Dragon intrusion detection system (IDS) software from Enterasys Networks Inc. and peer-to-peer server and client software from Napster LLC, now owned by Roxio Inc. The club made headlines last week after posting messages to online discussion groups that advertised a Web site selling the source code and design documents for Dragon and Napster. By Thursday, the group's Web page displayed a message saying the club had ceased operations due to "fears our customers faced." A subsequent "newsletter" from the club dated July 17 and posted to the Usenet group alt.gap.international.sales at 10:28 PM Pacific Standard Time called Usenet the "official home" of the Source Code Club and said the informal network was "better suited" to the club and would give potential customers two ways to contact club members: through a club e-mail address and through messages posted in the Usenet group. The newsletter claims that the Source Code Club soon hopes to go underground and stop offering code for sale in public, but is offering the Dragon and Napster code "to authenticate our skills." The Enterasys code would allow purchasers to understand the "secrets behind Dragon," whereas the Napster code could give "any company interested in breaking into the online music industry" a jump-start, the newsletter said. The club also expressed regret for the "public fiasco that ensues when you publicly offer source code," an apparent reference to media attention to the group's unveiling. The club also posted instructions for potential customers to purchase the stolen code. Customers are encouraged to contact the group using e-mail and PGP (Pretty Good Privacy) encryption to disguise their requests. Source code for the Dragon software was priced at US$16,000 and Napster for $10,000, with payments made through one of a number of online payment services. Those wary of sending money to the club have the option of buying the source code in $500 increments to build confidence. Enterasys is working with the U.S. Federal Bureau of Investigation and reviewing the club's claims. The company claims that its product code was lifted off stolen media, such as a compact disc or computer hard drive, rather than stolen directly from its computer network, according to Kevin Flanagan, an Enterasys spokesman. A Napster spokeswoman said last week that while Roxio owns the rights to the original Napster code being sold by the club, the current Napster online service does not use any code from the original, free music swapping service and is not affected by the alleged theft. _________________________________________ Help InfoSec News with a donation: http://www.c4i.org/donation.html --- end forwarded text -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From dave at farber.net Tue Jul 20 07:55:20 2004 From: dave at farber.net (Dave) Date: Tue, 20 Jul 2004 08:55:20 -0600 Subject: Message-ID: >Animals [demime 1.01d removed an attachment of type application/octet-stream which had a name of Cat.scr] From justin-cypherpunks at soze.net Tue Jul 20 04:52:46 2004 From: justin-cypherpunks at soze.net (Justin) Date: Tue, 20 Jul 2004 11:52:46 +0000 Subject: Texas oil refineries, a White Van, and Al Qaeda Message-ID: <20040720115246.GA25822@arion.soze.net> http://news.myway.com/top/article/id/415877|top|07-19-2004::15:07|reuters.html Jul 19, 2:57 PM (ET) HOUSTON (Reuters) - Law enforcement officials said on Monday they are looking for a man seen taking pictures of two refineries in Texas City, Texas. Texas City, located on the Texas Gulf coast about 30 miles south of Houston, has three refineries including the largest U.S. plant operated by BP Plc., which is the third-largest U.S. refinery, processing 470,000 barrels of crude oil per day. The man, described as white with dark hair, was seen taking pictures outside the refineries, all located on the same highway, at about 5 p.m. CDT on Saturday, said Bruce Clawson, emergency management and homeland security director for Texas City. While it is not illegal to take pictures of a refinery from a highway or street, officials would like to talk to the man to find out his reason for taking the photographs. "This is based on the idea that al Qaeda does its homework," Clawson said. "That's not to say we don't have enough home-grown idiots already who might want to do something." The man was seen driving a white van. Valero Energy Corp. operates a 243,000 barrel per day (bpd) refinery in Texas City. Marathon Ashland Petroleum LLC, a joint venture between Marathon Oil Corp., and Ashland Inc., operates a 76,000 bpd refinery in Texas City. The U.S. Federal Bureau of Investigation has repeatedly warned refiners that they are possible targets for would-be terrorists. U.S. refinery security officials say their security guards regularly report people observing or taking pictures of refineries. During the Independence Day holiday, ExxonMobil Corp. tightened security at the largest U.S. refinery, the 538,000 bpd plant in Baytown, Texas, 30 miles east of Houston, because of general warnings about possible terrorist activity. -- "When in our age we hear these words: It will be judged by the result--then we know at once with whom we have the honor of speaking. Those who talk this way are a numerous type whom I shall designate under the common name of assistant professors." -- Kierkegaard, Fear and Trembling (Wong tr.), III, 112 From alan at clueserver.org Tue Jul 20 13:40:34 2004 From: alan at clueserver.org (alan) Date: Tue, 20 Jul 2004 13:40:34 -0700 (PDT) Subject: Texas oil refineries, a White Van, and Al Qaeda In-Reply-To: <017630AA6DF2DF4EBC1DD4454F8EE2971616A0@rsana-ex-hq1.NA.RSA.NET> Message-ID: On Tue, 20 Jul 2004, Trei, Peter wrote: > > > > -----Original Message----- > > From: owner-cypherpunks at minder.net > > [mailto:owner-cypherpunks at minder.net]On Behalf Of Thomas Shaddack > > Sent: Tuesday, July 20, 2004 3:48 PM > > To: Justin > > Cc: cypherpunks at minder.net > > Subject: Re: Texas oil refineries, a White Van, and Al Qaeda > > > > > > > > On Tue, 20 Jul 2004, Justin wrote: > > > > > HOUSTON (Reuters) - Law enforcement officials said on > > Monday they are > > > looking for a man seen taking pictures of two refineries in > > Texas City, > > > Texas. > > > > > > > The person in question was just somebody with a weakness for > > industrial > > architecture. > > Indeed. Among the endless variety of things people do with > their spare time are trainspotters and planespotters. This > seems to be more popular in Britain than in the US, but > I wonder if even over there people who park themselves near > airports railway statiions, obsessively noting the arrival > and departure of each vehicle, attract the attention of > security? Maybe the Patriot Act can get struck down because it violates the American's With Disablities Act. It discriminates against obsesive-compulsives. From camera_lumina at hotmail.com Tue Jul 20 13:19:37 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Tue, 20 Jul 2004 16:19:37 -0400 Subject: Texas oil refineries, a White Van, and Al Qaeda Message-ID: >The person in question was just somebody with a weakness for industrial >architecture. > Either that, or they wanted to see if there'd be ANOTHER apocalyptic chain reaction decimating Texas City, just in the off chance someone hits just one of the tanks.* In other words, does public safety still boil down to "just trust us"? *: A year or two ago someone posted about the blow up of Texas City back in the early 1950s. Apparently, some kind of tanker hit something else and set of a chain reaction killing thousands and wiping out the town (I know someone who walked over to Texas City right after it happened and looked around.) _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/ From measl at mfn.org Tue Jul 20 15:10:12 2004 From: measl at mfn.org (J.A. Terranson) Date: Tue, 20 Jul 2004 17:10:12 -0500 (CDT) Subject: Texas oil refineries, a White Van, and Al Qaeda In-Reply-To: <017630AA6DF2DF4EBC1DD4454F8EE2971616A0@rsana-ex-hq1.NA.RSA.NET> References: <017630AA6DF2DF4EBC1DD4454F8EE2971616A0@rsana-ex-hq1.NA.RSA.NET> Message-ID: <20040720170623.X29547@ubzr.zsa.bet> On Tue, 20 Jul 2004, Trei, Peter wrote: > I wonder if even over there people who park themselves near > airports railway statiions, obsessively noting the arrival > and departure of each vehicle, attract the attention of > security? Yes, at least here in St. Louis, Missouri, backwater of the Late American Redneck. The "parking lot" (read: makeout spot/planespotter parking, etc.) abut a half mile from the end of the main runways at Lambert are now permanently closed, and trying to pull over is an open invite for immediate attention. :-( > > Peter > > -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From ptrei at rsasecurity.com Tue Jul 20 14:14:14 2004 From: ptrei at rsasecurity.com (Trei, Peter) Date: Tue, 20 Jul 2004 17:14:14 -0400 Subject: Texas oil refineries, a White Van, and Al Qaeda Message-ID: <017630AA6DF2DF4EBC1DD4454F8EE2971616A0@rsana-ex-hq1.NA.RSA.NET> > -----Original Message----- > From: owner-cypherpunks at minder.net > [mailto:owner-cypherpunks at minder.net]On Behalf Of Thomas Shaddack > Sent: Tuesday, July 20, 2004 3:48 PM > To: Justin > Cc: cypherpunks at minder.net > Subject: Re: Texas oil refineries, a White Van, and Al Qaeda > > > > On Tue, 20 Jul 2004, Justin wrote: > > > HOUSTON (Reuters) - Law enforcement officials said on > Monday they are > > looking for a man seen taking pictures of two refineries in > Texas City, > > Texas. > > > The person in question was just somebody with a weakness for > industrial > architecture. Indeed. Among the endless variety of things people do with their spare time are trainspotters and planespotters. This seems to be more popular in Britain than in the US, but I wonder if even over there people who park themselves near airports railway statiions, obsessively noting the arrival and departure of each vehicle, attract the attention of security? Peter From rah at shipwright.com Tue Jul 20 15:12:01 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Tue, 20 Jul 2004 18:12:01 -0400 Subject: [ISN] Stolen code shop back in business - on Usenet Message-ID: --- begin forwarded text From dave at farber.net Tue Jul 20 17:22:37 2004 From: dave at farber.net (David Farber) Date: Tue, 20 Jul 2004 20:22:37 -0400 Subject: [IP] Surveillance targeted to convention / Wide network of cameras Message-ID: planned X-Mailer: Apple Mail (2.618) Reply-To: dave at farber.net Begin forwarded message: From mv at cdc.gov Tue Jul 20 20:55:36 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 20 Jul 2004 20:55:36 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40FDE938.71721039@cdc.gov> At 07:56 AM 7/19/04 -0500, J.A. Terranson wrote: >On Sun, 18 Jul 2004, Major Variola (ret) wrote: >> You don't know about tape robots, or offline indexing, eh? > >None of which qualify here - remember, the discussion was based upon a >"quiet" implementation. The thread was about wiretapping. My point was that you can record at linespeed an analyze at leisure. Nothing more, nothing less. From mv at cdc.gov Tue Jul 20 21:00:49 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 20 Jul 2004 21:00:49 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40FDEA71.6DBF9CAF@cdc.gov> At 10:12 AM 7/19/04 -0400, Tyler Durden wrote: >"Gimme an intel IXA network processor and no problem. ATM is fixed >size data, not as tricky as IP decoding. Predicatable bandwidth. >Stream all into megadisks, analyze later." > >I'm gonna have to challenge this bit here, Variola. Please. Truth requires skepticism. Be bold. >Let's back up. You've got an OC-48 or OC-192 fiber and you want to grab ALL >of the data in this fiber. Now I'll grant that in real life there's going to >be a lot telephony circuit in there, but let's take a worst-case and assume >you need ALL the data. As cryptographers, we must assume this. >What's in this OC-192? Right now it definitely ain't 10Gb/s of packets. It's >going to have LOTS of DS1s, DS3s and, if you're lucky, and STS-3c or two. So >you'll need to first of all demux ALL of the tributaries. And how much *dark fiber* is there? Lots and lots, thanks to irrational exuberance. Guess what? SiO2 doesn't care which direction the beam is pumped into. >Next, you've got to un-map any ATM in each of the DS1s, etc, and then pull >out the IP data from the ATM cells, remembering to reassemble fragmented >packets (and there will be plenty with ATM). And remember, you may have to >do this for 5000 simultaneous DS1s. Yawn. You underestimate the Adversary. Never ever do that. Isn't there some chink who wrote that? >Oh, and let's not forget pointer >adjustments. Oh no, not pointers! What next, MPLS? >And that's just one fiber. How will you actually get all of this traffic >back to HQ? Remember, it keeps coming and won't stop. Dark fiber. >No, I think I'm becomming convinced that they can't yet get ALL of it. Enjoy your childhood while it lasts. Its a beautiful time. From justin-cypherpunks at soze.net Tue Jul 20 14:01:59 2004 From: justin-cypherpunks at soze.net (Justin) Date: Tue, 20 Jul 2004 21:01:59 +0000 Subject: Texas oil refineries, a White Van, and Al Qaeda In-Reply-To: <0407202142150.10013@somehost.domainz.com> References: <20040720115246.GA25822@arion.soze.net> <0407202142150.10013@somehost.domainz.com> Message-ID: <20040720210159.GA27045@arion.soze.net> On 2004-07-20T21:47:31+0200, Thomas Shaddack wrote: > > The person in question was just somebody with a weakness for industrial > architecture. You're missing the big picture: A light-skinned person with dark hair, a camera, a white van and an oil refinery, all in Shrub's home state. That's a bona fide threat to national security if I've ever heard one, yet people like you are suggesting we let it slide! Viper! Getteth thee back to the deserts of the middle east where you belong. The DHS has done a lot to make me ashamed of being an American. I can't believe how stupid my new guardians are. It was probably some photo-journalist working on an expose of Shrub's crooked/failed oil dealings. -- "When in our age we hear these words: It will be judged by the result--then we know at once with whom we have the honor of speaking. Those who talk this way are a numerous type whom I shall designate under the common name of assistant professors." -- Kierkegaard, Fear and Trembling (Wong tr.), III, 112 From mv at cdc.gov Tue Jul 20 21:03:40 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 20 Jul 2004 21:03:40 -0700 Subject: phishing: catch and release Message-ID: <40FDEB1C.45F8A92E@cdc.gov> At 08:41 AM 7/19/04 -0700, James A. Donald wrote: >And as Hettinga predicted, the more anonymous and irreversible the >transaction service, the cheaper and more convenient its services. >All happening as predicted. D'uh. >So why don't we have anonymous chaumian cash by now? USPTO >Observe Tim May, who mistook e-gold phishing spam mail for the real >thing. Interesting if true, but only your assertion. I know not the man. Phishing relies on humans being stupid. Half are below average, by definition, you know. Bait is cheap. The net is not meant for commerce. Dig? From mv at cdc.gov Tue Jul 20 21:07:22 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Tue, 20 Jul 2004 21:07:22 -0700 Subject: Reputation Capital Article Message-ID: <40FDEBFA.6C88C177@cdc.gov> At 01:43 PM 7/19/04 -0400, Sunder wrote: >Here's a paper/article/screed on reputation capital. A subject we >discussed here a long while ago back when dinosaurs ruled the earth, >etc... well, not quite that long ago. > >This doesn't seem to mention anything about anonymous users, however. > Then they are morons. Endpoints = identities, some have more persistance and robustness to men-with-guns than others. Any meat entity can have any number of comm endpoints (aka identities) with variable persistance, from one-time-session to forever til revokation. -------- "When I was your age we didn't have Tim May! We had to be paranoid on our own! And we were grateful!" --Alan Olsen From shaddack at ns.arachne.cz Tue Jul 20 12:47:31 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Tue, 20 Jul 2004 21:47:31 +0200 (CEST) Subject: Texas oil refineries, a White Van, and Al Qaeda In-Reply-To: <20040720115246.GA25822@arion.soze.net> References: <20040720115246.GA25822@arion.soze.net> Message-ID: <0407202142150.10013@somehost.domainz.com> On Tue, 20 Jul 2004, Justin wrote: > HOUSTON (Reuters) - Law enforcement officials said on Monday they are > looking for a man seen taking pictures of two refineries in Texas City, > Texas. How difficult it is to wait for a sunny day, wire a digital camera to take two pictures per second with very short exposition time, ducttape it on the dashboard or at the side or the back window in suitable angle, and then drive by in normal speed? If you screw up the angle, you can do it again (and again, and again...), because nobody pays attention to the "normally" behaving vehicles. That way, no suspicion is ever aroused. Or, use a big-lens camera from long distance. The person in question was just somebody with a weakness for industrial architecture. From rah at shipwright.com Tue Jul 20 20:07:55 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Tue, 20 Jul 2004 23:07:55 -0400 Subject: The Trouble with Libertarianism Message-ID: Tech Central Station The Trouble with Libertarianism By Edward Feser Published 07/20/2004 E-Mail Bookmark Print Save TCS "Libertarianism" is usually defined as the view in political philosophy that the only legitimate function of a government is to protect its citizens from force, fraud, theft, and breach of contract, and that it otherwise ought not to interfere with its citizens' dealings with one another, either to make them more economically equal or to make them more morally virtuous. Most libertarian theorists emphasize that their position is not intended to be a complete system of ethics, but merely a doctrine about the proper scope of state power: their claim is not that either egalitarian views about the distribution of wealth or traditional attitudes about sexuality, drug use, and the like are necessarily incorrect, but only that such moral views ought not to guide public policy. A libertarian society is in their view compatible with any particular moral or religious outlook one might be committed to, and this is taken to be one of its great strengths: people of all persuasions in a pluralistic society can have reason to support a libertarian polity, precisely because it does not favor any particular persuasion over another. A libertarian society is, it is claimed, genuinely neutral between diverse moral and religious worldviews. In this respect, as in others, libertarians take their creed to be superior to that political philosophy that most prides itself on its purported tolerance and neutrality, namely egalitarian liberalism. The liberal philosopher John Rawls characterized the various moral and religious worldviews represented in modern pluralistic societies as "comprehensive doctrines," and he argued that his own brand of liberalism was compatible with all reasonable comprehensive doctrines. Libertarians have objected that the details of Rawls's theory so incorporate his social and economic egalitarianism into what he counts as "reasonable" that his claim to neutrality between actually existing worldviews is disingenuous; for Rawlsians are ultimately prepared to apply that honorific only to those comprehensive doctrines compatible with an extensive regime of anti-discrimination laws, forced income redistribution, and whatever other consequences are taken to follow from Rawls's famous "difference principle" (which holds that no inequalities can be permitted in a just society unless they benefit its least well-off members). The "comprehensive doctrines" of moral traditionalists and individualist free spirits alike, doctrines having millions of adherents, end up being effectively written off as "unreasonable" from the egalitarian liberal point of view. Libertarianism is truly neutral where Rawls and other liberals only pretend to be. Or so it seems. I want to suggest, however, that many libertarians are - no doubt unwittingly - guilty of the very same sort of disingenuousness as Rawls. For it simply isn't true that libertarianism is neutral between various moral and religious worldviews, notwithstanding that most libertarians would like to believe (indeed do believe) that it is. The reason, as it turns out, is that there is no such thing as "libertarianism" in the first place: it would be more accurate to speak in the plural of "libertarianisms," a variety of doctrines each often described as "libertarian," but having no common core, and each of which tends in either theory or practice to favor some moral worldviews to the exclusion of others. It also turns out that the illusion that there is such a thing as "libertarianism" - a basic set of beliefs and values that all so-called "libertarians" have in common - is the source of the illusion that a libertarian society would be a truly neutral one. When one gets clear on exactly which version of libertarianism one is talking about, it will be seen that what one is talking about is a doctrine with substantial moral commitments, commitments which cannot fail to promote some worldviews and to push others into the margins of social life. Classical liberalism To see that this is so, we need only look at some specific and paradigmatic examples of libertarian political theories, and there is no more appropriate place to start than at the beginning, with the early classical liberal (as opposed to modern, egalitarian liberal) political thinkers whom libertarians typically regard as their intellectual forebears. Take John Locke (1632-1704), who famously argued that the primary function of a government was to protect the property rights of its citizens, with the most fundamental property right being that of self-ownership. That we own ourselves entails, in Locke's view, that we own our labor and its fruits, and this in turn entails that we can (with certain qualifications) come to own whatever previously unowned natural resources we "mix" our labor with. Self-ownership thus grounds the right to private property, and with it the basic rights that determine the proper scope and functions of state power. But what grounds the right of self-ownership itself? The answer, according to Locke, was that it derives from God. How? God, being the creator of everything that exists other than Himself - including us - is the ultimate owner of everything that exists - including us. Therefore, when a person harms another person by killing him, stealing from him, and so forth, he in effect violates the rights of God, because he damages what is God's property. To respect God's rights over us, therefore, we must recognize our duty not to kill, harm, or steal from each other, which entails treating each other as having certain rights relative to each other - the rights to life, liberty, and property. And these rights can usefully be summed up as rights of self-ownership. But ultimately, as it turns out, we don't really own ourselves: God does. Relative to Him, we are merely "leasing" ourselves, as it were, and are accountable to Him for how we use His property. Relative to other human beings, however, we are in effect self-owners; we must treat others as if they owned themselves, and not use them as if they were our property. That Locke's version of classical liberalism favors a decidedly religious social order should be obvious. Of course, Locke is also famous for promoting the idea of religious toleration, and would vehemently reject the suggestion that any particular denomination or its teachings ought to be promoted by government. But Locke was nevertheless very far in his thinking from the interpretation of the doctrine of the separation of church and state favored by the ACLU. For he also held that toleration cannot be extended to atheists, precisely because their denial of the existence of God amounted, in his view, to the denial of the very foundations of the moral order in general, and the classical liberal political order in particular. In Locke's estimation, if the suggestion that liberalism entails a right of toleration of atheism isn't exactly a self-contradiction, it will do until the real thing comes along; for the existence of any rights at all presupposes the falsity of atheism. Locke is also commonly thought to have denied that Roman Catholics had a right to toleration, on the grounds that their loyalty to a foreign power - the Pope - was incompatible with allegiance to a classical liberal state (though scholars like Jeremy Waldron have argued that Locke has been misinterpreted here). Now as both a Roman Catholic and an admirer of Locke (and, I suppose, as a former atheist too), it is with some trepidation that I note these aspects of his views. But whatever one thinks of their ultimate defensibility, Locke's position does at least arguably form a coherent and systematic whole; and, more to the present point, it quite obviously is not, and does not pretend to be, consistent with any claim to "neutrality" between all moral and religious worldviews. This commitment to a particular moral view of the world was typical of the early classical liberals. Adam Smith (1723-1790) favored modern liberal capitalist society precisely because of what he took to be its moral advantages: it provided an unprecedented degree of material well-being for the masses, and it promoted such bourgeois virtues as sobriety, moderation, and diligence. Moreover, because in Smith's view capitalist society failed to promote certain other virtues (namely martial and aristocratic ones), and even tended positively to undermine some of them (insofar as consumerism and the hyper-specialization entailed by the division of labor oriented men's minds away from learning), there was an urgent need for government to foster institutions outside the market - a professional military and publicly financed education, for example - that would make up for its deficiencies. Tradition and natural rights It ought not to be supposed that the moralism of these early classical liberals was merely an artifact of their having written in a less secularist age. Indeed, one finds many of the same themes in their recent successors. F.A. Hayek (1899-1992) was perhaps the foremost champion of the free society and the market economy in the 20th century. He was also firmly committed to the proposition that market society has certain moral presuppositions that can only be preserved through the power of social stigma. In his later work especially, he made it clear that these presuppositions concern the sanctity of property and of the family, protected by traditional moral rules which restrain our natural impulses and tell us that "you must neither wish to possess any woman you see, nor wish to possess any material goods you see."[1] "[T]he great moral conflict which has been taking place over the last hundred years or even the last three hundred years," according to Hayek, "is essentially a conflict between the defenders of property and the family and the critics of property and the family,"[2] with the latter comprising an alliance of socialists and libertines committed to "a planned economy with a just distribution, a freeing of ourselves from repressions and conventional morals, of permissive education as a way to freedom, and the replacement of the market by a rational arrangement of a body with coercive powers."[3] The former, by contrast, comprise an alliance of those committed to the more conservative form of classical liberalism represented by writers like Smith and Hayek himself with those committed to traditional forms of religious belief. Among the benefits of such religious belief in Hayek's view is its "strengthening [of] respect for marriage," its enforcement of "stricter observance of rules of sexual morality among both married and unmarried," and its creation of a socially beneficial "taboo" against the taking of another's property.[4] Indeed, though he was personally an agnostic, Hayek held that the value of religion for shoring up the moral presuppositions of a free society cannot be overestimated: "We owe it partly to mystical and religious beliefs, and, I believe, particularly to the main monotheistic ones, that beneficial traditions have been preserved and transmitted If we bear these things in mind, we can better understand and appreciate those clerics who are said to have become somewhat sceptical of the validity of some of their teachings and who yet continued to teach them because they feared that a loss of faith would lead to a decline in morals. No doubt they were right "[5] For these reasons, Hayek, though like Locke a great defender of the classical liberal belief in toleration of diverse moral and religious points of view, also held that such toleration must have its limits if a free society is to maintain itself, as the following passages illustrate: "I doubt whether any moral rule could be preserved without the exclusion of those who regularly infringe it from decent company - or even without people not allowing their children to mix with those who have bad manners. It is by the separation of groups and their distinctive principles of admission to them that sanctions of moral behavior operate."[6] "It is not by conceding 'a right to equal concern and respect' to those who break the code that civilization is maintained. Nor can we, for the purpose of maintaining our society, accept all moral beliefs which are held with equal conviction as morally legitimate, and recognize a right to blood feud or infanticide or even theft, or any other moral beliefs contrary to those on which the working of our society rests For the science of anthropology all cultures or morals may be equally good, but we maintain our society by treating others as less so."[7] "Morals must be restraints on complete freedom, they must determine what is permissible and what not [T]he difficulties begin when we ask whether tolerance requires that we permit in our community the observance of a wholly different system of morals, even if a person does so entirely consistently and conscientiously. I am afraid I rather doubt whether we can tolerate a wholly different system of morals within our community, although it is no concern of ours what moral rules some other community obeys internally. I am afraid that there must be limits even to tolerance "[8] It is significant that Hayek's view was as conservative and moralistic as it was despite its not being, like Locke's view, based on theological premises or even on the notion of natural rights. And as might be expected, contemporary natural rights theories have a tendency to imply no less conservative a moralism. To be sure, Robert Nozick (1938-2002), the most influential proponent of natural rights libertarianism in recent political philosophy, was no conservative, and was also a proponent of the idea that libertarianism is neutral between moral and religious worldviews. Indeed, given that his predecessors included people like Locke, Smith, and Hayek, Nozick might even have the distinction of being the first major classical liberal or libertarian theorist to suggest such a thing. The trouble is, Nozick is also notoriously unclear about where natural rights, and in particular the right of self-ownership, come from. But surely what we take to be the source of rights cannot fail to imply, as it does in Locke, a specific moral view of the world. So if Nozick's position seems to allow for neutrality between all worldviews, this is arguably precisely because he is so vague about the grounds of natural rights. The history of recent libertarian theorizing about natural rights only confirms this suspicion, in my view. From the work of Ayn Rand (1905-1982) onward, such theorizing has been dominated by Aristotelianism, and in particular by some version or other of the idea that natural rights are ultimately to be grounded in the sort of natural end or purpose that Aristotle held all human beings to have. Now sometimes libertarian theorists try to cash out the idea of a "natural end" in only the thinnest of terms - in Rand's case, in terms of the need to survive as a rational being. Notoriously, however, such an approach fails plausibly to yield a distinctively libertarian conception of rights: one might need some sort of rights in order to survive, but it is hard to see why one would need the extremely strong rights to liberty and private property (rights strong enough to rule out an egalitarian redistribution of wealth, say) libertarians want to affirm. So to make this sort of attempt to justify a libertarian conception of natural rights work, the libertarian needs to appeal to a much "thicker" conception of the natural end or purpose human beings have. In that case, though, it is very hard to see how anyone committed to this sort of approach can consistently avoid committing himself also to the very conservative moral views Aristotelian "natural end" theories are usually thought to entail, especially when worked out systematically after the manner of St. Thomas Aquinas and other natural law theorists. Contractarianism, utilitarianism, and "economism" So far my examples have all been cases where the failure of libertarianism to be neutral between all the moral and religious worldviews that exist within a modern pluralistic society involves a bias in favor of decidedly conservative points of view. Do I mean to imply, then, that all versions of libertarianism entail moral conservatism? By no means. Some versions in fact entail exactly the opposite; and in this very different way, they too fail to be neutral between moral and religious points of view. Many libertarian theorists eschew any suggestion that rights are "natural," and with it any appeal to God or human nature as the source of rights. They take our rights to be in some way artificial - historically contingent conventions, say, or the products of some kind of "social contract." The latter approach is an application to the defense of libertarianism of a view in moral theory sometimes called "contractarianism," which holds that moral obligations in general and rights in particular can only be grounded in a kind of implicit agreement between all the members of society. Contrary to Locke, who held that our rights, being natural, pre-exist and put absolute conditions on any contract that can be made between human beings, the contractarian view is that rights only come into existence after, and as a result of, a social contract, and that their content is determined by the details of the contract. Libertarian contractarians argue that the details of such a social contract, when rightly understood, will be seen to entail libertarianism. Now since any such contract can only ever be purely hypothetical (the claim is not that we literally have ever made or could make such an agreement), the contractarian approach raises all sorts of philosophical questions. Moreover, the claim that the details of the contract would favor libertarianism is by no means uncontroversial. (The non-libertarian Rawls, after all, also appeals to a kind of social contract theory.) But since the libertarian social contract theorist typically denies that there is any robust conception of human nature which can plausibly determine the content of morality, and typically characterizes what he regards as a "rational" party to the social contract as refusing to agree to any rule that he does not personally see as in his self-interest (where his "self-interest" is typically defined in terms of whatever desires or preferences he actually happens to have), it is easy to see how conservative moral views are going to be ruled out as indefensible from a contractarian point of view: not all parties to the social contract will agree to them, and so they cannot be regarded as morally binding. Utilitarianism is another moral theory libertarians have sometimes appealed to in defense of their position. This is, to oversimplify, the view that what is morally required is whatever promotes "the best consequences," where this is usually understood to entail maximizing the satisfaction of individual desires or preferences. Here too, whether either utilitarianism as a general moral philosophy or the strategy of using it to defend libertarianism in particular is defensible are matters of great controversy. But just as utilitarianism in general tends to be radically unconservative (as it is in the work of Peter Singer, perhaps the best known contemporary utilitarian) so too is it when applied to a defense of libertarianism. For any view that appeals merely to what people happen in fact to desire or prefer - without asking, after the fashion of Aristotelianism or natural law theory, what desires or preferences we ought to have given our nature - is bound not to sit well with the conservative moralist's tendency to see certain kinds of desires and preferences as intrinsically disordered and immoral, so that there can be no question of maximizing their satisfaction. Of course, the expression "utilitarian" is sometimes used by libertarians in a much looser way, to refer, not to utilitarianism as a general moral philosophy, but merely to a defense of libertarianism which emphasizes certain practical economic benefits of the free market, such as its ability to generate wealth and technological innovation. Now by itself, this sort of economic approach doesn't count as a complete defense of libertarianism, since many egalitarian liberals and non-libertarian conservatives would acknowledge these benefits of the market but deny that such considerations address all their concerns, such as moral ones. But there is a tendency among some economics-oriented defenders of libertarianism to go well beyond this modest appeal to what are generally recognized to be economic considerations - a tendency to try to analyze all human behavior and social institutions in economic terms, and thereby to reduce all considerations to purely economic ones. At its most extreme, the results are artifacts like Richard Posner's book Sex and Reason, which attempts to account for all human sexual behavior in terms of perceived costs and benefits. This sort of thing is exactly what Pope John Paul II has in mind when he criticizes contemporary capitalist society for its tendency toward what he calls "economism," and while many libertarians would regard it as merely a regrettable bit of over-enthusiasm, it does have a tendency to confirm in the minds of non-libertarians the caricature they have of the free marketer as a vulgar philistine bent on the total commoditization of human life. Moreover, it is clearly and utterly incompatible with a conservative understanding of our moral situation. As the conservative philosopher Roger Scruton argues: "Posner proceeds to consider hypothetical cases: for example, the case where a man sets a 'value' of 'twenty' on 'sex' with a 'woman of average attractiveness,' and a 'value' of 'two' on 'sex' with a 'male substitute.' If you adopt such language, then you have made woman (and man too) into a sex object and sex into a commodity. You have redescribed the human world as a world of things; you have abolished the sacred, the prohibited, and the protected, and presented sex as a relation between aliens Posner's language reduces the other person to an instrument of pleasure, a means of obtaining something that could have been provided equally by another person, by an animal, by a rubber doll or a piece of Kleenex."[9] How the difference makes a difference Now many of those committed to the sorts of unconservative versions of libertarianism I've just described would insist that their position really is neutral between moral worldviews, since they would not advocate keeping those with conservative sensibilities from living in accordance with their views or expressing them in public. But this misses the point. For the versions of libertarianism described in the last section do not treat conservative views as truly moral views at all; they treat them instead as mere prejudices: at best matters of taste, like one's preference for this or that flavor of ice cream, and at worst rank superstitions that pose a constant danger of leading those holding them to try to restrict the freedoms of those practicing non-traditional lifestyles. Libertarians of the contractarian, utilitarian, or "economistic" bent must therefore treat the conservative the way the egalitarian liberal treats the racist, i.e. as someone who can be permitted to hold and practice his views, but only provided he and his views are widely regarded as of the crackpot variety. Just as the Lockean, Smithian, Hayekian, and Aristotelian versions of libertarianism entail a social marginalization of those who flout bourgeois moral standards, so too do these unconservative versions of libertarianism entail a social marginalization of those who defend bourgeois moral standards. Neither kind of libertarianism is truly neutral between moral worldviews. There are two dramatic consequences of this difference between these kinds of libertarianism. The first is that a society self-consciously guided by principles of the Lockean, Smithian, Hayekian, or Aristotelian sort will, obviously, be a society of a generally conservative character, while a society self-consciously guided by principles of a contractarian, utilitarian, or "economistic" sort will, equally obviously, be a society of a generally anti-conservative character. The point is not that the former sort of society will explicitly outlaw bohemian behavior or that the latter will explicitly outlaw conservative behavior. The point is rather that the former sort of society is bound to be one in which the bohemian is going to feel out of place, while the latter is one in which the conservative is going to feel out of place. In either case, there will of course be enclaves here and there where the outsider will find those of like mind. But someone is inevitably going to get pushed into the cultural catacombs. In no case is a "libertarian" society going to be genuinely neutral between all the points of view represented within it. The second dramatic consequence is that there are also bound to be differences in the public policy recommendations made by the different versions of libertarianism. Take, for example, the issue of abortion. Those whose libertarianism is grounded in Lockean, Aristotelian, or Hayekian thinking are far more likely to take a conservative line on the matter. To be sure, there are plenty of "pro-choice" libertarians influenced by Hayek. But by far most of these libertarians are (certainly in my experience anyway) inclined to accept Hayek's economic views while soft-pedaling or even dismissing the Burkean traditionalist foundations he gave for his overall social theory. Those who endorse the latter, however, are going to be hard-pressed not to be at least suspicious of the standard moral and legal arguments offered in defense of abortion. Even more clearly, libertarians of a Lockean or Aristotelian-natural law bent are going to have strong grounds for regarding abortion as no less a violation of individual rights than is the murder of a man, woman, or child: a fetus is no less God's property than is a child or adult; and on the standard Aristotelian-natural law view, the fetus is fully human - not a "potential human being," but rather a human being which hasn't yet fulfilled all its potentials - and thus has all the rights that any other human being has. By contrast, libertarians influenced by contractarianism are very unlikely to oppose abortion, because fetuses cannot plausibly be counted as parties to the social contract that could provide the only grounds for a prohibition on killing them. Utilitarianism and "economism" too would provide no plausible grounds for a prohibition on abortion, since fetuses would seem to have no preferences or desires which could be factored into our calculations of how best to maximize preference- or desire-satisfaction. There are also bound to be differences over the question of "same-sex marriage." From a natural rights perspective, whether Lockean or Aristotelian, it is hard to see how the demand for a right to same-sex marriage can be justified. For if there is a natural right to marriage, then marriage must be a natural institution; and the standard defense of marriage as a natural institution appeals to the idea that it is has a natural function, namely procreation, which entails in turn that it is inherently heterosexual. Nor can a Hayekian analysis of social institutions fail to imply anything but skepticism about the case for same-sex marriage. Hayek's position was that traditional moral rules, especially when connected to institutions as fundamental as the family and found nearly universally in human cultures, should be tampered with only with the most extreme caution. The burden of proof is always on the innovator rather than the traditionalist, whether or not the traditionalist can justify his conservatism to the innovator's satisfaction; and change can be justified only by showing that the rule the innovator wants to abandon is in outright contradiction to some other fundamental traditional rule. But that there is any contradiction in this case is simply implausible, especially when one considers the traditional natural law understanding of marriage sketched above. On the other hand, it is easy to see how contractarianism, utilitarianism, and "economism" might be thought to justify same-sex marriage. If the actual desires or preferences of individuals are all that matter, and some of those individuals desire or prefer to set up a partnership with someone of the same sex and call it "marriage," then there can be no moral objection to their doing so. Freedom and self-ownership If these different versions of libertarianism differ so radically in terms of their justifying grounds and implications, why are they usually regarded as variations of the same doctrine? And why are they so commonly held to be neutral between various moral and religious worldviews if, as I have tried to show, they clearly are not? The answer to both questions, I think, is that all these versions of libertarianism are often thought, erroneously, to be committed fundamentally to the value of "freedom": they are versions of libertarianism, after all, so liberty or freedom would seem to be their common core, and this might seem to include the freedom of every person to follow whatever moral or religious view he likes. But in fact none of these doctrines takes liberty or freedom to be fundamental. What is taken to be fundamental is rather natural rights, or tradition, or a social contract, or utility, or efficiency; "freedom" falls out only as a consequence of the libertarian's more basic commitment to one of these other values, and the content of that "freedom" differs radically depending on precisely which of these fundamental values he is committed to. For the Aristotelian-natural law theorist, freedom includes not only freedom from excessive state power, but also freedom from those moral vices which prevent the realization of our natural end; for the contractarian or utilitarian, however, freedom may well include freedom from the very concepts of moral vice and natural ends. Freedom would also entail for the latter the right to commit suicide, while for the Lockean, there can be no such right, since suicide would itself violate the rights of the God who created and owns us. This difference in the understanding of freedom has its parallel in a difference in what we might call the tone in which various libertarians assert the right of self-ownership. In the mouth of some libertarians, what self-ownership is fundamentally about is something like this: "Other human beings have an intrinsic dignity and moral value, and this entails a duty on my part not to use them as means to my own ends; I therefore have no right to the fruits of another man's labor." In the mouths of other libertarians, what it means is, at bottom, rather this: "I can do whatever what I want to do, as long as I let everyone else do what they want to do too; there are no grounds for preventing any of us from doing, in general, what we want to do." The first view expresses an attitude of deference, the second an attitude of self-assertion; the first reflects a commitment to strong moral realism and a rich conception of human nature, the second a thin conception of human nature and a tendency toward moral minimalism or even moral skepticism. And the first, I would submit, is more characteristic of libertarians of a Lockean, Hayekian, or Aristotelian bent, while the latter is more typical of libertarians influenced by contractarianism, utilitarianism, or "economism." It is sometimes said that contemporary conservatism is an uneasy alliance between libertarians and traditionalists, and that this alliance is destined eventually to collapse due to the inherent conflict between the two philosophies. But it can with equal or even greater plausibility be argued that it is in fact contemporary libertarianism which comprises an uneasy alliance, an association between incompatible factions committed to very different conceptions of freedom. The trouble with libertarianism is that many of its adherents have for too long labored under the illusion that things are otherwise, that their creed is a single unified political philosophy that does not, and need not, take a stand on the most contentious moral issues dividing contemporary society. This has led to confusion both at the level of theory and at the level of policy. Libertarians need to get clear about exactly what they believe and why. And when they do, they might find that their particular version of libertarianism commits them - or ought to commit them - to regard as rivals those they might once have considered allies. Edward Feser (edwardfeser at hotmail.com) is the author of On Nozick (Wadsworth, 2003). [1] F.A. Hayek, "Individual and Collective Aims," in Susan Mendus and David Edwards, eds. On Toleration (Oxford: Clarendon Press, 1987), p. 37. [2] Ibid., p. 38. [3] F.A. Hayek, Law, Legislation, and Liberty, vol. 3: The Political Order of a Free People (Chicago: University of Chicago Press, 1979), p. 176. [4] F.A. Hayek, The Fatal Conceit (Chicago: University of Chicago Press, 1989), p. 157. [5] Ibid., pp. 136-7. [6] Hayek, Law, Legislation, and Liberty, p. 171. [7] Ibid., p. 172. [8] Hayek, "Individual and Collective Aims," p. 47. [9] Roger Scruton, An Intelligent Person's Guide to Philosophy (London: Duckworth, 1996), p. 135. -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From bill.stewart at pobox.com Tue Jul 20 23:17:36 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Tue, 20 Jul 2004 23:17:36 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40FDEA71.6DBF9CAF@cdc.gov> References: <40FDEA71.6DBF9CAF@cdc.gov> Message-ID: <200407210618.i6L6IG6g064399@outlier.minder.net> At 09:00 PM 7/20/2004, Major Variola (ret) wrote: >At 10:12 AM 7/19/04 -0400, Tyler Durden wrote: > >No, I think I'm becoming convinced that they can't yet get ALL of it. >Enjoy your childhood while it lasts. Its a beautiful time. I think you're talking at cross-purposes. If you're the Good Guy, trying to keep from being wiretapped, you need to assume that the Bad Guys are going to get everything, or at least everything of _yours_. If you're the Wiretapper, trying to figure out how to get everything, it's still difficult and expensive and annoying, and much easier to just administrative-subpoena-gag-order the ISP, limiting the number of people at the ISP who know anything. > > Tape Drives > How will you do _that_ quietly? You don't put the tape drives on ISP premises, you put the extra fiber connections to the Homeland Security Office there, and put the tape drives somewhere convenient - or if the ISP also runs a colo center, you put them there in a cage rented by the Maryland Procurement Agency or something. > OC192s full of ATM and T1s and T3s, oh my! Most ISPs can roughly be divided into the access-side connections (lots of small circuits out to end users), backbones (fat pipes to your other POPs and other ISPs), and processing/hosting/etc. equipment. Wiretapping the backbone doesn't get you everything, but it's a small number of fat pipes, and you don't need to go tracking and demuxing all the thousands of little access circuits or demodulating the modems or whatever - just get the good stuff, where it's all been routed together on a fat IP channel (possibly running MPLS, but that's just a few extra headers.) If an ISP is buying an access ring from an access ring provider, you can subpoena _that_ provider to find out which channels or wavelengths are probably the ones you want and do a passive tap there. > Tapping fibers under the ocean. Most big US ISP backbones these days run OC48 or OC192 between bigger cities; connections to small cities vary a lot depending on concentrator-deployment philosophies. The OC48 and OC192 are usually wavelengths on big DWDM pipes, though in concentrated areas like New York to Boston you'll see a certain amount of large bundles of fiber running single wavelengths. Some of the older undersea cables are still one or two OC48s, but most of the new stuff is DWDM, typically with bandwidths of 40-160 Gbps now which can be fired up to faster speeds if demand grows. JYA's web site, by the way, has some absolutely terrific maps and photographs of a lot of undersea cable systems; we occasionally use the stuff at work (it's especially good when you're giving talks, because it's public material you don't have to clear with bureaucrats...) > Legacy ATM equipment Oh, right, you work at one of those _little_ ISPs :-) Actually, there is a huge amount of ATM equipment out there, because DSL usually runs ATM protocols on the access lines, so CLECs and LEC DSL providers usually hand it to the ISPs as ATM. There's also a lot of ATM and frame for enterprise use within companies, but in the big ISP world it's mostly phased out except for DSL, because the router companies and ethernet switching caught up with ATM speeds a few years ago and are now long past them. MPLS is pretty much reimplementing all the things that ATM was good at, and for the last few years everybody's been hyping how MPLS will make things really cool real soon now, and it's gradually taking over. > [ how much data there is ] AT&T's Internet Protect security service collects IP headers from our peering points and hub locations, analyzing trends like rapid increases in uses of some protocols. We saw the Slammer worm make a couple of startup attempts or trial runs (not sure which) for about four days before it hit, so we had filters ready, and we've seen similar things on a number of other viruses and port-scanning attacks. It also lets us see things like "Yes, there's a big spike in use of Protocol _x_ but it's just a DDOS against one university machine", and it's starting to be helpful in blocking DDOSs. The system uses passive optical taps (there are lots of vendors who sell gear like that), and collects over 10TB a day (our total Internet traffic is about 1.4PB/day, so this is about 1%.) The database at the head end is a bit less flexible than MS Access or MySQL, but it's a lot larger than typical databases can handle, and the kinds of calculations that make sense at that scale are a bit different than what you could use if you were targeting a smaller data set. Some of the most useful calculations are "what percentage of bits/packets/flows are protocol X or TCP or UDP to/from port Y." Disclaimer: None of this is an official statement from any three-and-a-half-letter-acronym organization. ---- Bill Stewart bill.stewart at pobox.com From anmetet at freedom.gmsociety.org Tue Jul 20 21:33:30 2004 From: anmetet at freedom.gmsociety.org (An Metet) Date: Wed, 21 Jul 2004 00:33:30 -0400 Subject: Texas oil refineries, a White Van, and Al Qaeda Message-ID: >The person in question was just somebody with a weakness for industrial >architecture. The "no cameras" signs were very popular in east block countries. It was forbidden to take pictures of bridges, government buildings, airports, railway stations, industrial installations, water dams etc. The signs were prominently displayed and the consensus on their purpose was essentially to scare and comfort the sheeple. There was an interview somewhere in early 90-ties when ex-government employee attested to that. The counter-intelligence purpose was irrelevant even then - it was just too easy to hide cameras. But harassment of tourists and hobbyists was great PR, proof that 'authorities' are doing the job and disarming the imminent evil. In a depressingly predictable manner US of A is sliding into the same mode of operation. And, depressingly, it works. Expect more manufactured everyday threats, more citizen-informants, the works. Contracting or subcontracting airborne demolition artists is not practical on ongoing basis ... we need a terrorist threat everywhere, every day. Make sure your children do not overhear your non-compliant conversations. From morlockelloi at yahoo.com Wed Jul 21 02:19:20 2004 From: morlockelloi at yahoo.com (Morlock Elloi) Date: Wed, 21 Jul 2004 02:19:20 -0700 (PDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40FDEA71.6DBF9CAF@cdc.gov> Message-ID: <20040721091920.71011.qmail@web40604.mail.yahoo.com> >Let's back up. You've got an OC-48 or OC-192 fiber and you want to grab ALL >of the data in this fiber. Now I'll grant that in real life there's A. You don't want all data. A nice illustration on ether speeds is obtained by using simple tools like putting the NIC in promiscuous mode, using simple reassembler and filter that discards everything but smtp/pop text parts. This can be trivially done with tcpdump+awk. The percentage of mail texts is usually less than 2-3% of all traffic. And it's not even because of porn - it's stupidity of html generators (humans & software). B. Even 'All data' is far less than line speed. Average fiber utilisation is under 4% in US. Buffers! ===== end (of original message) Y-a*h*o-o (yes, they scan for this) spam follows: __________________________________ Do you Yahoo!? New and Improved Yahoo! Mail - Send 10MB messages! http://promotions.yahoo.com/new_mail From shaddack at ns.arachne.cz Tue Jul 20 18:04:04 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Wed, 21 Jul 2004 03:04:04 +0200 (CEST) Subject: Low-cost thermal/multispectral imaging via mechanical slow-scan TV Message-ID: <0407210237150.-1289080716@somehost.domainz.com> Thermal imaging is a very powerful and very cool technology with many many applications in both security and engineering. However, the main obstacle for its wider usage in civilian sector is very high cost of the microbolometer array sensors. However, there are affordably cheap remote thermometers on the market, using a thermopile or bolometric sensor, which can be considered to be the equivalent of a single-pixel array. In the very beginnings of image transmission, there were various technologies being used, many of them using a single-"pixel" optical sensor and a mechanical scanning device - a spinning mirror, Nipkow's disk, etc.. Can this approach be used in combination with a thermopile sensor? The result could be a potentially quite cheap slow-scan thermal imager. Because of the lower energy radiated in far-infrared and longer reaction time of the sensors, we would have to have much slower scanning speed, not allowing real-time imaging, but still enough for engineering purposes, eg. finding thermal leaks of buildings or overheating parts on the boards or in power installations. One possible construction is a two-axis polar mount, allowing the directional sensor to be aimed in any direction within a range of vertical and horizontal angle (eg. a camera tripod with two servos). This would have the advantage of being a generic base for any slow-scan multispectral imaging device - instead of a directional thermopile use a directional 2.4 GHz antenna, and scan the city from a roof or a hilltop for the access points. (Or use 0.9/1..8/1.9 GHz, and look for cellular towers. Etc.) Position the device, set the pixel exposition time, set the angle range and step, run the "exposition". What do you think? Opinions, comments? From eugen at leitl.org Tue Jul 20 22:58:15 2004 From: eugen at leitl.org (Eugen Leitl) Date: Wed, 21 Jul 2004 07:58:15 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40FDE938.71721039@cdc.gov> References: <40FDE938.71721039@cdc.gov> Message-ID: <20040721055814.GQ1141@leitl.org> On Tue, Jul 20, 2004 at 08:55:36PM -0700, Major Variola (ret) wrote: > The thread was about wiretapping. My point was that you can record > at linespeed an analyze at leisure. Nothing more, nothing less. This makes no sense. Most of the traffic out there is garbage, and it is ridiculously expensive to record all of it. It is not at all difficult to analyze it, and extract useful info: all plain text information, which endpoints use which crypto, VoIP streams, etc. We *do* remember the Pakistan-UK email on wire intercept, don't we? How else is this supposed to have happened by means other than a total tap? You better believe they're doing it -- but they capture only traffic that contains useful information. -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From eugen at leitl.org Tue Jul 20 23:27:12 2004 From: eugen at leitl.org (Eugen Leitl) Date: Wed, 21 Jul 2004 08:27:12 +0200 Subject: [IP] Surveillance targeted to convention / Wide network of cameras planned (fwd from dave@farber.net) Message-ID: <20040721062712.GW1141@leitl.org> ----- Forwarded message from David Farber ----- From jya at pipeline.com Wed Jul 21 08:31:54 2004 From: jya at pipeline.com (John Young) Date: Wed, 21 Jul 2004 08:31:54 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <200407210618.i6L6IG6g064399@outlier.minder.net> References: <40FDEA71.6DBF9CAF@cdc.gov> <40FDEA71.6DBF9CAF@cdc.gov> Message-ID: There's a trial underway in New York City which involves extensive testimony from the FBI on its means and methods of tapping phone, fax and e-mail as well as covert video tapping and audio recording of the three defendants, one of whom is a NYC lawyer, Lynne Stewart, the other two usual Muslim suspects. The daily transcripts: http://cryptome.org/usa-v-ssy-dt.htm A lot of the early proceeding is dry legal maneurvering so you got to dig for the technical testimony. One defendant had 85,000 interceptions over several years, and as intercept systems changed from analogue (Lockheed Martin) to digital (Raytheon) the conversion and archiving process lost a crucial portion of the intercepts, a basis of charges. Defense lawyers are hammering the FBI witnesses on how this could have occurred, and in the process eliciting a good bit of interesting info on the means and methods, as well as the reputation and ability of the witnesses and the Lockheed and Raytheon interception, manipulation and archiving systems. Testimony shows that the FBI continues to rely upon service providers and contractors for the technical intercepts and freely admit that the bureau could not do it otherwise. What is done with the raw intercepts afterwards by the FBI collection, analysis and technical staff in the field and at the Quantico Engineering Research Facility, meticulously directed by US Attorneys to pick and choose among the data to support the charges, is what the defense is challenging. At some point the contractors will be called to describe what takes place beyond FBI capability. The prosecution appears not to want to go there, so accustomed are they to using the FBI as expert witnesses to set the limits of jury and the public exposure to the possibilities of counter-interception. Not a word yet about encryption, although some of the testimony has been sealed. From dave at farber.net Wed Jul 21 08:02:23 2004 From: dave at farber.net (Dave) Date: Wed, 21 Jul 2004 09:02:23 -0600 Subject: Message-ID: >foto3 and MP3 [demime 1.01d removed an attachment of type application/octet-stream which had a name of New_MP3_Player.com] From camera_lumina at hotmail.com Wed Jul 21 07:09:07 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Wed, 21 Jul 2004 10:09:07 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: Variola wrote... Dark fiber. "Dark Fiber" ain't a talisman you merely wave at data to get it to magically move to where you want it to.You've got to LIGHT that fiber, and to light that fiber you need LOTS and LOTS of power-hungry, space-occupying equipment. In other words, you'd need to duplicate a significant fraction of the current public transport network. And that can't be done in one location, you'd need this shadow network to have either it's own COs all over the country, or to have significant POPs in practically every CO in the country. And I can tell you unequivocally that neither are the case. What this points to is CALEA + Grooming + Massive Optical Transport for offline sifting in a few centralized locations. And I strongly suspect that the recent GIG-BE contract is precisely the massive optical part. What I get from what you've pointed out, however, is that processing power isn't the limitation any longer. If they COULD get it ALL, then they probably would. So perhaps that's just a matter of time (ULH systems can move lots of traffic very long distances these days, with only the occasional optical amplifier.) -TD >From: "Major Variola (ret)" >To: "cypherpunks at al-qaeda.net" >Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto >proxies >Date: Tue, 20 Jul 2004 21:00:49 -0700 > >At 10:12 AM 7/19/04 -0400, Tyler Durden wrote: > >"Gimme an intel IXA network processor and no problem. ATM is fixed > >size data, not as tricky as IP decoding. Predicatable bandwidth. > >Stream all into megadisks, analyze later." > > > >I'm gonna have to challenge this bit here, Variola. > >Please. Truth requires skepticism. Be bold. > > >Let's back up. You've got an OC-48 or OC-192 fiber and you want to grab >ALL > >of the data in this fiber. Now I'll grant that in real life there's >going to > >be a lot telephony circuit in there, but let's take a worst-case and >assume > >you need ALL the data. > >As cryptographers, we must assume this. > > >What's in this OC-192? Right now it definitely ain't 10Gb/s of packets. >It's > >going to have LOTS of DS1s, DS3s and, if you're lucky, and STS-3c or >two. So > >you'll need to first of all demux ALL of the tributaries. > >And how much *dark fiber* is there? Lots and lots, thanks to irrational > >exuberance. Guess what? SiO2 doesn't care which direction the beam >is pumped into. > > >Next, you've got to un-map any ATM in each of the DS1s, etc, and then >pull > >out the IP data from the ATM cells, remembering to reassemble >fragmented > >packets (and there will be plenty with ATM). And remember, you may have >to > >do this for 5000 simultaneous DS1s. > >Yawn. > >You underestimate the Adversary. Never ever do that. Isn't there some >chink who wrote that? > > >Oh, and let's not forget pointer > >adjustments. > >Oh no, not pointers! What next, MPLS? > > >And that's just one fiber. How will you actually get all of this >traffic > >back to HQ? Remember, it keeps coming and won't stop. > >Dark fiber. > > >No, I think I'm becomming convinced that they can't yet get ALL of it. > >Enjoy your childhood while it lasts. Its a beautiful time. > > > > > _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/ From camera_lumina at hotmail.com Wed Jul 21 07:20:36 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Wed, 21 Jul 2004 10:20:36 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: Yes, but I think it's fairly clear that if one needs to dissasemble the OC-Ns in the field, you simply need too much gear. It's going to be far easier to grab whole swathes of it and ship it back to Montana or wherever for it to be sifted through later. What they probably do, however, is grab specific DS1s/3s locall and switch those via CALEA back to optical access points, where all of this stuff is pulled together into OC-192s or (very soon) OC-768s. As Variola suggests, once you get it back then you can plow through it at your leisure. Got a disident you want to shut down? "Surely he's said SOMETHING over the last 2 years that you could incriminate him on....find it, dammit!" -TD >From: Morlock Elloi >To: cypherpunks at al-qaeda.net >Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto >proxies >Date: Wed, 21 Jul 2004 02:19:20 -0700 (PDT) > > >Let's back up. You've got an OC-48 or OC-192 fiber and you want to grab >ALL > >of the data in this fiber. Now I'll grant that in real life there's > >A. You don't want all data. > >A nice illustration on ether speeds is obtained by using simple tools like >putting the NIC in promiscuous mode, using simple reassembler and filter >that >discards everything but smtp/pop text parts. This can be trivially done >with >tcpdump+awk. The percentage of mail texts is usually less than 2-3% of all >traffic. And it's not even because of porn - it's stupidity of html >generators >(humans & software). > >B. Even 'All data' is far less than line speed. Average fiber utilisation >is >under 4% in US. Buffers! > > > > >===== >end >(of original message) > >Y-a*h*o-o (yes, they scan for this) spam follows: > > > >__________________________________ >Do you Yahoo!? >New and Improved Yahoo! Mail - Send 10MB messages! >http://promotions.yahoo.com/new_mail > _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/ From measl at mfn.org Wed Jul 21 08:36:13 2004 From: measl at mfn.org (J.A. Terranson) Date: Wed, 21 Jul 2004 10:36:13 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: References: Message-ID: <20040721103551.E29547@ubzr.zsa.bet> On Wed, 21 Jul 2004, Tyler Durden wrote: > I guess the question arises as to whether the FBI, for instance, shares it's > network with the NSA. You've got it backwards. > -TD -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From camera_lumina at hotmail.com Wed Jul 21 08:28:10 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Wed, 21 Jul 2004 11:28:10 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: Eugen Leitl wrote... >It's clearly not viable to process much underwater. How much machine room >square meters do you need at those cable landings, though? Not that much, if all you need to do is send a spliced copy over to your own undersea Optical Fiber Amplification node or undersea DWDM OADM. As for the cable landings, likewise I've never heard anyone mention that they saw any government equipment at the landings, so I suspect it's relatively minimal. A the least, it's a splice over to the FDF (THAT they've seen). At the most, they have a card in the carrier's transport gear where they've dropped-and-continued some of the traffic. I guess the question arises as to whether the FBI, for instance, shares it's network with the NSA. -TD _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/ From adam at cypherspace.org Wed Jul 21 03:46:16 2004 From: adam at cypherspace.org (Adam) Date: Wed, 21 Jul 2004 11:46:16 +0100 Subject: Message-ID: >fotoinfo [demime 1.01d removed an attachment of type application/octet-stream which had a name of Cat.com] From andrew at ceruleansystems.com Wed Jul 21 12:36:37 2004 From: andrew at ceruleansystems.com (J. Andrew Rogers) Date: Wed, 21 Jul 2004 12:36:37 -0700 Subject: [FoRK] For those indoctrinated by the military Message-ID: > An alternative perspective. You should try to cultivate more of them. > Attack helicopters - I guess that would be one of the things the Russians > copied from Vietnam - dumbasses. That is simply the evolution of warfare. Helicopters were great for about twenty years, and then the US started deploying effective countermeasures against them in the 1980s (as the Russians learned in Afghanistan). The Russians learned how to design for close air support the very expensive way. The US has actually been scrapping new helicopter development, though it is committed to upgrading existing ones. While I don't remember where I heard it very recently, but the A-10 (a very well-engineered combat aircraft) has been granted a last minute reprieve and is slated to be upgraded i.e. they are substantially extending its service life. The US is still mostly using Cold War equipment that has been patched with some upgrades. A broad slate of completely new technology platforms is scheduled for deployment over the next several years, bringing a very substantial leap in capability over what the US already has. The new platforms are, quite frankly, pretty scary to the extent they completely obsolete existing platforms. The ability to effectively and methodically destroy irregular forces and guerillas in urban and not so urban settings were explicit design goals in many of these systems. The targeting and tracking granularity of the automated fire control and surveillance systems is no longer vehicle and unit size nor is it dependent on the centralization of resources in big capital equipment. Instead it is more like a decentralized swarm of smaller machines that can work at the granularity of a specific individual. This is actually big picture bad in the same way that strong AI is big picture bad. In an environment where such things exist, all you can do is hope that it isn't used against you because there isn't much you can do about it in such cases. If the initial conditions aren't favorable, then you are all but hosed. Naturally, the US military is already testing primitive active countermeasures against such weapons. j. andrew rogers _______________________________________________ FoRK mailing list http://xent.com/mailman/listinfo/fork ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From sunder at sunder.net Wed Jul 21 12:56:37 2004 From: sunder at sunder.net (Sunder) Date: Wed, 21 Jul 2004 15:56:37 -0400 (edt) Subject: Osama says "Vote for Bush!" Message-ID: http://www.aaronsw.com/weblog/001393 Not that (m)any of us really expected Al-Qaeda to want Kerry. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"I find it ironic that, on an amendment designed to protect /|\ \|/ :American democracy and our constitutional rights, the /\|/\ <--*-->:Republican leadership in the House had to rig the vote and \/|\/ /|\ :subvert the democratic process in order to prevail" \|/ + v + : -- Rep. Sanders re vote to ammend the US PATRIOT ACT. -------------------------------------- http://www.sunder.net ------------ From eugen at leitl.org Wed Jul 21 07:56:43 2004 From: eugen at leitl.org (Eugen Leitl) Date: Wed, 21 Jul 2004 16:56:43 +0200 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: References: Message-ID: <20040721145643.GB1141@leitl.org> On Wed, Jul 21, 2004 at 10:20:36AM -0400, Tyler Durden wrote: > Yes, but I think it's fairly clear that if one needs to dissasemble the > OC-Ns in the field, you simply need too much gear. It's going to be far It's clearly not viable to process much underwater. How much machine room square meters do you need at those cable landings, though? http://cryptome.quintessenz.at/mirror/cable-eyeball.htm > easier to grab whole swathes of it and ship it back to Montana or wherever > for it to be sifted through later. There is no "later", there's only "elsewhere". Traffic filtering is an embarrassingly parallel problem. It's the data mining that needs to integrate and correlate. Here is your centralized bottleneck. How many .gov in http://top500.org/list/2004/06/ ? Data mining is different from Linpack. > What they probably do, however, is grab specific DS1s/3s locall and switch > those via CALEA back to optical access points, where all of this stuff is > pulled together into OC-192s or (very soon) OC-768s. As Variola suggests, > once you get it back then you can plow through it at your leisure. Got a > disident you want to shut down? "Surely he's said SOMETHING over the last 2 > years that you could incriminate him on....find it, dammit!" -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From mv at cdc.gov Wed Jul 21 19:39:23 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Wed, 21 Jul 2004 19:39:23 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40FF28DB.521C9E2C@cdc.gov> At 10:09 AM 7/21/04 -0400, Tyler Durden wrote: >Variola wrote... > >Dark fiber. > >"Dark Fiber" ain't a talisman you merely wave at data to get it to magically >move to where you want it to.You've got to LIGHT that fiber, and to light >that fiber you need LOTS and LOTS of power-hungry, space-occupying >equipment. In other words, you'd need to duplicate a significant fraction of >the current public transport network. With all due respect, you think Ft. Meade uses the same COTS crap as you are forced to deal with? Bwah hah hah. Gilmore et al used a bunch of old Sun Chassis for his & Kocher's DEScracker. You think this is somehow more than 100 watts, in a diplo suitcase, nowadays? Just curious as to the depth of navite in the field.... From mv at cdc.gov Wed Jul 21 19:42:09 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Wed, 21 Jul 2004 19:42:09 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40FF2981.58B92A7C@cdc.gov> At 11:28 AM 7/21/04 -0400, Tyler Durden wrote: > >As for the cable landings, likewise I've never heard anyone mention that >they saw any government equipment at the landings, so I suspect it's >relatively minimal. I'm sorry but I have to puke at your cluelessness. Do you actually think the folks in the Know would let *your kind* know of their taps? Frankly, you trolls are too easy; but you're probably not, which is even more painful. Take it as a compliment, if there really is a TD. From eugen at leitl.org Wed Jul 21 12:50:06 2004 From: eugen at leitl.org (Eugen Leitl) Date: Wed, 21 Jul 2004 21:50:06 +0200 Subject: [FoRK] For those indoctrinated by the military (fwd from andrew@ceruleansystems.com) Message-ID: <20040721195006.GQ1141@leitl.org> ----- Forwarded message from "J. Andrew Rogers" ----- From mv at cdc.gov Wed Jul 21 22:04:50 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Wed, 21 Jul 2004 22:04:50 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <40FF4AF2.C3405675@cdc.gov> At 10:12 PM 7/21/04 -0500, J.A. Terranson wrote: >On Wed, 21 Jul 2004, Major Variola (ret) wrote: >> >> With all due respect, you think Ft. Meade uses the same COTS crap >> as you are forced to deal with? Bwah hah hah. > >Sorry Major, I'm gonna have to call you on that one. Yes, they are >lighting that fiber on COTS. Likely on Nortel gear, which I can tell you >from personal experience requires an incredible amount of power, cooling, >and rackspace. >> Just curious as to the depth of navite in the field.... > >As we are curious of yours. Fair 'nuff. I'm following the Principle of not underestimating the adversary, who does plenty of R&D, just look at their tech-transfer program, multiply by a few decades in capacity.. Perhaps that grants the Maryland trogdyltes too much, but again, conservatism rules in this game. Remember, "Nortel" is cost-bound. TLAs are not. They also get radioisotope power supplies, etc. And unpublished tech made in unknown fabs. Albeit, "Nortel" (even if Canadian, eh?) etc are 0wn3d by the USG, so taps through COTS are not so hard, and my "dark fiber" only means the physical capacity is there. And of course people are cheaper than tech. Hell, the counter-intel folks seem to be real bargains, whether FBI or CIA. But if you prefer to believe they play on the same field as us, go ahead, I'll still read your posts, and appreciate the questioning. MV From measl at mfn.org Wed Jul 21 20:12:38 2004 From: measl at mfn.org (J.A. Terranson) Date: Wed, 21 Jul 2004 22:12:38 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40FF28DB.521C9E2C@cdc.gov> References: <40FF28DB.521C9E2C@cdc.gov> Message-ID: <20040721220900.P29547@ubzr.zsa.bet> On Wed, 21 Jul 2004, Major Variola (ret) wrote: > At 10:09 AM 7/21/04 -0400, Tyler Durden wrote: > >Variola wrote... > > > >Dark fiber. > > > >"Dark Fiber" ain't a talisman you merely wave at data to get it to > magically > >move to where you want it to.You've got to LIGHT that fiber, and to > light > >that fiber you need LOTS and LOTS of power-hungry, space-occupying > >equipment. In other words, you'd need to duplicate a significant > fraction of > >the current public transport network. > > With all due respect, you think Ft. Meade uses the same COTS crap > as you are forced to deal with? Bwah hah hah. Sorry Major, I'm gonna have to call you on that one. Yes, they are lighting that fiber on COTS. Likely on Nortel gear, which I can tell you from personal experience requires an incredible amount of power, cooling, and rackspace. > Gilmore et al used a bunch of old Sun Chassis for his & Kocher's > DEScracker. You think this is somehow more than 100 watts, in a > diplo suitcase, nowadays? Totally different animal. We are talking about lighting single mode fiber and doing so for long distances: likely to standard 60-per-hop rule. You can't send light out that kind of distances without BIG power inputs: lasers are not very efficient. > Just curious as to the depth of navite in the field.... As we are curious of yours. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From measl at mfn.org Wed Jul 21 22:39:45 2004 From: measl at mfn.org (J.A. Terranson) Date: Thu, 22 Jul 2004 00:39:45 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40FF4AF2.C3405675@cdc.gov> References: <40FF4AF2.C3405675@cdc.gov> Message-ID: <20040722001258.N29547@ubzr.zsa.bet> On Wed, 21 Jul 2004, Major Variola (ret) wrote: > I'm following the Principle of not underestimating the > adversary, Don't go overboard: remember that there is a difference between underestimating your adversary and unrealistically *over*estimating your adversary. > who does plenty of R&D, just look at their tech-transfer program, > multiply by a few decades in capacity.. I (and I suspect you) live in the "high tech" world, so we have a pretty good grasp of the current state of the art. As a rule, Joe Sixpack thinks that the g'mint is a couple of trillion years ahead of Moore's Law ("Shure they can break all that there commie crypto ssl hidden horsesheet!"), while a large part of academia tends to believe that the USG is around ten years *behind* them (oh, to have such an ego!). In my personal experience, they tend to have roughly a five year lead on what my world considers "bleeding edge". That said, I'm willing to cut them a few more years of slack when doing the necessary threat assessment, but I just do not believe they are 20, or even 10 years ahead. And that is not an "idle" belief, it's a considered, long formed opinion, based on an awful lot of input data. > Perhaps that grants the Maryland trogdyltes too much, but again, > conservatism rules in this game. Conservatism in the real world, unreasonable paranoia in the academic world (a necessary thing in that context). These are the right move. But in real-world assessment, if you use the academic paranoia model, you will never be able to engineer an appropriate solution (i.e., one that successfully balances current and expected lifetime threats, along with project expense and elegance of implementation. I truly think we are all addressing the very same thing - we are just approaching it from slightly different perspectives. I see these as "real" engineering problems, while you are looking at them as pure academic excersizes. We will obviously be reaching different endpoints this way, since we are assuming a different input set :-) > Remember, "Nortel" is cost-bound. TLAs are not. Ahhh, but they are! That's why they went to COTS in the first place (they were forced). The scale of that cost binding may be difficult to ascertain since their outer cost limit is just astronomical (unless you are Shrub, who thinks he can just print more money when he runs out), but it does exist. > They also get radioisotope power supplies, etc. This is actually a *very* good point. It would also address the off-shore splice vs power issue nicely. But we are still constrained by backhaul. In answer to the earlier question of how much dark fiber is there: roughly 12% of the fiber now in the ground is lit. Yes, there is a shitload of capacity sitting unused. Unfortunately, the people who buried all that glass were all competing in pretty much the same basic areas, so what we ended up with was orders of magnitude too much capacity around several large hub cities, while there is a critical shortage in other places. Yes, VA and DC have gluts of glass. In fact, that is one of the most concentrated glut areas. > And unpublished tech made in unknown fabs. While this cannot be discounted in toto, the tech comes to them from academia (most of the time), so generally, if you are widely read, you'll have a pretty good idea of what's *possible*. You are likely dead-on accurate about the fabs though. > Albeit, "Nortel" (even if Canadian, eh?) Yup. The Irony Meter is hanging out at the right of the scale again :-) > etc are 0wn3d by the USG, so taps through COTS are not so hard, Undersea taps are hard. No matter how you figure it. Pressurized cables with PSI monitors and microsecond resolution monitoring is not something you can break into and splice without a great deal of care. For the record, yes, I believe it can be, and is being done. I would be surprised if it was on a large scale though - even with "nukular poweer". > and my "dark fiber" only means the physical capacity is there. Or not, depending on geographic location. > And of course people are cheaper than tech. Always. And *this* is the lesson most often forgotten. > Hell, the counter-intel > folks seem to be real bargains, whether FBI or CIA. Man, you would not believe what these guys are [not] paid! A senior guy may naver break 100K in his lifetime (unless s/he (a) has a terminal degree, (b) swallows, and (c) decides to work a desk as an ASAC or somesuch. The actual intel/counterintel guys make shit for money. > But if you prefer to believe they play on the same field as us, go > ahead, I'll still read your posts, and appreciate the questioning. Thanks, I think :-) > MV -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From pfitza at inf.tu-dresden.de Thu Jul 22 00:21:49 2004 From: pfitza at inf.tu-dresden.de (Andreas Pfitzmann) Date: Thu, 22 Jul 2004 09:21:49 +0200 Subject: Anonymity, ... - A Proposal for Terminology v 0.18 Message-ID: Hi all, Marit Hansen and myself are happy to release herewith Anonymity, Unobservability, Pseudonymity, and Identity Management - A Proposal for Terminology v0.18 Since the beginning of this undertaking in 2000, it is joint work with many criticizing and contributing. Thanx a lot to them all. May I encourage you to make use of this document and help in its further development as well? To help you in this, I did put online at http://dud.inf.tu-dresden.de/Literatur_V1.shtml all older versions of this document (starting with v0.5) not only in .pdf, but in .doc as well. The latter you can use easily using, e.g. MS Word, to highlight any delta between versions, e.g. the differences between the last version you have read and the current version. Happy to hear from you Andreas -- Andreas Pfitzmann Dresden University of Technology Phone (mobile) +49 170 443 87 94 Department of Computer Science (office) +49 351 463 38277 Institute for System Architecture (secretary) +49 351 463 38247 01062 Dresden, Germany Fax +49 351 463 38255 http://dud.inf.tu-dresden.de e-mail pfitza at inf.tu-dresden.de From camera_lumina at hotmail.com Thu Jul 22 07:27:03 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Thu, 22 Jul 2004 10:27:03 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: Variola: You say a lotta good shit here, but you're really out of your area in this case. You seem to miss the basic points, and then fill in your blindspot with pure theoretical conjecture. Let me point out some of the lil' flaws in your thinking.... > >With all due respect, you think Ft. Meade uses the same COTS crap >as you are forced to deal with? Bwah hah hah. For some things, sure. Actually I know from first hand experience. (I've actually been in an NSA, DISA, and a few other experimental network nodes.) Lots of the equipment I saw was from the big vendors, most notably Lucent and Nortel. Somewhere deeper than I had access to, however, they almost certainly use special silicon. >Gilmore et al used a bunch of old Sun Chassis for his & Kocher's >DEScracker. You think this is somehow more than 100 watts, in a >diplo suitcase, nowadays? OK, so you're saying that this suitcase takes in say 10 OC-192s, demuxes all of them down to the DS1 level (we're at 50,000 DS1s), demaps and unpacks the ATM cells, and then reassembles all of the packets therein? Questions: 1) How does this majic box store all that data? 2) I've been in dozens of COs myself, and have worked extensively with people who have spent (collectively speaking) centuries in them. They never saw such a magic box a you describe, and indeed would certainly know about someone trying to install one. Or perhaps the NSA has developed a cloaking device making the box invisible? 2) What silicon does it use? Are you saying that the government can do a LOT better than 0.13 microns these days? Somehow I doubt it. Look at the off-the-shelf SONET chip architectures. Sure, there's lots of stuff onboard that you wouldn't need for what you're talking about, but getting rid of that stuff would still put the most advanced chip lightyears behyind what you're talking about. 3) If the majic box doesn't store the data, how does it get it back to HQ? Telepathy? Or, does it use a bank of lasers that somehow are several orders of magnitude more efficient that off-the-shelf lasers? (And let us remember that there's a fundamental constraint with bulk optics..an optical multiplexer or ciculator can't be an order of magnitude smaller than the wavelength it will support.) JA's comments about fiber exhaust are dead-on, and were not known to most of the Telecom Bubble participants. (Indicates the dude knows what he's talking about with respect to telecom.) But dark fibers aren't a real concern. It would be easy to develop a DWDM system that operated over the L or M bands, "under" the C-band wavelengths used by a carrier. So the problem isn't the fiber, it's lighting it. As for my comments about cable landings, I explicity stated that the splices back to VA were seen and known. And yes, I was in a position to know. (There's not a lot you can hide in a CO...it's not like they staff them with NSA agents or something.) As for trolling, well when I do it I do it with friggin' style m'friend. But sometimes, the truth is so mundane it looks fairly boring. Sorry to dissappoint you. I'm going to have to confiscate your copy of "Deepness in the Sky"... -TD _________________________________________________________________ MSN Toolbar provides one-click access to Hotmail from any Web page  FREE download! http://toolbar.msn.click-url.com/go/onm00200413ave/direct/01/ From rah at shipwright.com Thu Jul 22 09:21:30 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Thu, 22 Jul 2004 12:21:30 -0400 Subject: Anonymity, ... - A Proposal for Terminology v 0.18 Message-ID: I've been sent the pdf and .doc versions of this. If you can't get this through the site or the author, ping me and I can send you what they sent me. Cheers, RAH --- begin forwarded text From mv at cdc.gov Thu Jul 22 19:37:34 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Thu, 22 Jul 2004 19:37:34 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <410079EE.30AE9858@cdc.gov> At 12:39 AM 7/22/04 -0500, J.A. Terranson wrote: >On Wed, 21 Jul 2004, Major Variola (ret) wrote: > >> I'm following the Principle of not underestimating the >> adversary, > >Don't go overboard: remember that there is a difference between >underestimating your adversary and unrealistically *over*estimating your >adversary. Good point. Channelling Hettinga, crypto is economics. >I (and I suspect you) live in the "high tech" world, Um, yes :-) >while a large part of academia tends to believe that the USG is around ten >years *behind* them (oh, to have such an ego!). In my personal >experience, they tend to have roughly a five year lead on what my >world considers "bleeding edge". That said, I'm willing to cut them a few >more years of slack when doing the necessary threat assessment, but I just >do not believe they are 20, or even 10 years ahead. And that is not an >"idle" belief, it's a considered, long formed opinion, based on an awful >lot of input data. Fair 'nuff. You know that 5 year predictions are too conservative, and 20 year predictions too liberal. Ask Orwell. My point is only that they will be killed should they leak their actual capabilities. >> Perhaps that grants the Maryland trogdyltes too much, but again, >> conservatism rules in this game. > >Conservatism in the real world, unreasonable paranoia in the academic >world (a necessary thing in that context). My academic experience had nothing to do with networking. I'm just a manic mechanic, okay? >> They also get radioisotope power supplies, etc. > >This is actually a *very* good point. It would also address the off-shore >splice vs power issue nicely. But we are still constrained by backhaul. Ergo my dark fiber remark, even if naif. >Yes, VA and DC have gluts of glass. In fact, that is one of the most >concentrated glut areas. And most worth observing... >While this cannot be discounted in toto, the tech comes to them from >academia (most of the time), so generally, if you are widely read, you'll >have a pretty good idea of what's *possible*. You are likely dead-on >accurate about the fabs though. In the *public* lit. >> Albeit, "Nortel" (even if Canadian, eh?) > >Yup. The Irony Meter is hanging out at the right of the scale again :-) Bent so many needles, I don't even know my real name... >Undersea taps are hard. No matter how you figure it. You think subs are just toys? >The actual intel/counterintel guys make shit for money. What I meant was, Ames and that FBI dude Hansen (sp?), at least the KGB got Ames' wife as part of the package, whereas the FBI CI dude let his wife off as part of the deal he cut. Nice xian that he was, he was into strippers. All under $2e6, all capable of reading their own records. Go figure, eh? See you in Athens, or before :-) From mv at cdc.gov Thu Jul 22 19:44:55 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Thu, 22 Jul 2004 19:44:55 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <41007BA7.EDDE8508@cdc.gov> At 10:27 AM 7/22/04 -0400, Tyler Durden wrote: >>Gilmore et al used a bunch of old Sun Chassis for his & Kocher's >>DEScracker. You think this is somehow more than 100 watts, in a >>diplo suitcase, nowadays? My point was, Gilmore et al were way behind what's capable. Proof of concept needn't be compact. A suitcase can handle his DesCrack, with all due respect, nowadays. >OK, so you're saying that this suitcase takes in say 10 OC-192s, demuxes all >of them down to the DS1 level (we're at 50,000 DS1s), demaps and unpacks the >ATM cells, and then reassembles all of the packets therein? Questions: Just for yucks, look up the specs on an Intel IXA processor. >1) How does this majic box store all that data? No store, just bridge. >2) I've been in dozens of COs myself, and have worked extensively with >people who have spent (collectively speaking) centuries in them. They never >saw such a magic box a you describe, and indeed would certainly know about >someone trying to install one. Or perhaps the NSA has developed a cloaking >device making the box invisible? Do you think they so naif they'd expose themselves to a poster who dares post *here* ? >2) What silicon does t use? Are you saying that the government can do a LOT >better than 0.13 microns these days? I'm saying that tech xfer on metal coated diamond is not just for fun. And years behind reality, for those with $400 toilet seat budgets. >3) If the majic box doesn't store the data, how does it get it back to HQ? >Telepathy? One more time: dark fiber and compact drivers. Or even your more subtle unused-bandwith usage, "back atcha". >As for trolling, well when I do it I do it with friggin' style m'friend. True 'nuff. I mean no harm, only to provoke some to think, is all. Clearly you are the uber-Sonet-troll. :-) From atom at suspicious.org Thu Jul 22 21:08:30 2004 From: atom at suspicious.org (Atom 'Smasher') Date: Fri, 23 Jul 2004 00:08:30 -0400 (EDT) Subject: Cryptographers and U.S. Immigration Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ...atom _________________________________________ PGP key - http://atom.smasher.org/pgp.txt 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808 ------------------------------------------------- "When the government fears the people, you have liberty. When the people fear the government, you have tyranny." --Thomas Jefferson <<<<<<<<<<<<<<<<<<<<<<<<<< http://www.schneier.com/crypto-gram-0407.html#3 Cryptographers and U.S. Immigration Seems like cryptographers are being questioned when they enter the U.S. these days. Recently I received this (anonymous) comment: "It seems that the U.S. State Department has a keen interest in foreign cryptographers: Yesterday I tried to renew my visa to the States, and after standing in line and getting fingerprinted, my interviewer, upon hearing that my company sells [a cryptography product], informed me that "due to new regulations," Washington needs to approve my visa application, and that to do so, they need to know exactly which companies I plan to visit in the States, points of contact, etc. etc. Quite a change from my last visa application, for which I didn't even have to show up." I'm curious if any of my foreign readers have similar stories. There are international cryptography conferences held in the United States all the time. It would be a shame if they lost much of their value because of visa regulations. #### -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.3.6 (FreeBSD) Comment: What is this gibberish? Comment: http://atom.smasher.org/links/#digital_signatures iQEcBAEBCAAGBQJBAI9EAAoJEAx/d+cTpVcibb0IAIPYNzglmGiNyBLP4ogd5bI8 bSUCTLLIHkp4+dOKuxcuoNTagsNBfDC1Ny1BCL60grW5yoY0hiS1SzY+aw2/VrHg 6DEJVtXTSae/oEZv/czlVJsvI+U+OBD2JqlXIyFiayfR1R6yMVoMrX3RVyB7UklG 3a10ehfuY+pKkZa6JwYlM+TGxrNNCR5UOoNV1TdL40oLBTb0uFs+WG2tY+KYuypO ChdyAsTlBQw7b6rGRoOti93Wi4XxkFH39cFxDfRIG8Ah+J2QkRjwFrO+aUwCG7ds SjBfjV1kBWsXChS+vfzZBmwvGwZx3EDKfpBecybokyvV1jpdugyiRnV/UPERnro= =ytcR -----END PGP SIGNATURE----- _______________________________________________ Gnupg-devel mailing list Gnupg-devel at gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-devel --- end forwarded text -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From rah at shipwright.com Fri Jul 23 06:09:19 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Fri, 23 Jul 2004 09:09:19 -0400 Subject: Cryptographers and U.S. Immigration Message-ID: --- begin forwarded text From alan at clueserver.org Fri Jul 23 09:48:32 2004 From: alan at clueserver.org (alan) Date: Fri, 23 Jul 2004 09:48:32 -0700 (PDT) Subject: Cryptographers and U.S. Immigration In-Reply-To: Message-ID: On Fri, 23 Jul 2004, R. A. Hettinga wrote: > <<<<<<<<<<<<<<<<<<<<<<<<<< > > http://www.schneier.com/crypto-gram-0407.html#3 > > Cryptographers and U.S. Immigration > > Seems like cryptographers are being questioned when they enter the U.S. > these days. Recently I received this (anonymous) comment: "It seems that > the U.S. State Department has a keen interest in foreign cryptographers: > Yesterday I tried to renew my visa to the States, and after standing in > line and getting fingerprinted, my interviewer, upon hearing that my > company sells [a cryptography product], informed me that "due to new > regulations," Washington needs to approve my visa application, and that to > do so, they need to know exactly which companies I plan to visit in the > States, points of contact, etc. etc. Quite a change from my last visa > application, for which I didn't even have to show up." > > I'm curious if any of my foreign readers have similar stories. There are > international cryptography conferences held in the United States all the > time. It would be a shame if they lost much of their value because of visa > regulations. > > #### It makes you wonder what they are going to do to cryptographers that try to leave the country. "Please step onto the square marked 'trap door'." From shaddack at ns.arachne.cz Fri Jul 23 03:40:29 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Fri, 23 Jul 2004 12:40:29 +0200 (CEST) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <410079EE.30AE9858@cdc.gov> References: <410079EE.30AE9858@cdc.gov> Message-ID: <0407231155220.10080@somehost.domainz.com> On Thu, 22 Jul 2004, Major Variola (ret) wrote: > My point is only that they will be killed should they leak their > actual capabilities. Well... I am reading a book about intelligence now. Specifically, "Ernst Volkman: Spies - the secret agents who changed the course of history". Amusing book; describes many ways of intelligence fieldwork, most of them pretty lowtech. Eg, using business representatives as business/technology spies (as eg. a skilled steelworker can assess the capacity and capability and current processing of a factory quite at a glance, and he's often let in during contract negotiations), using pretty women to lure officers into honeytraps... or, recruiting young pretty men to seduce the not exactly pretty old maids who so often work as secretaries in important places. You don't need a *LOT* of money to pull smaller-scale tricks of this kind. Also, using "amateurs", private enterpreneurs in the arts of burglaries, safecracking and other relevant areas, instead of "governmental" employees, poses a counterintelligence advantage that these recruits are unknown to the adversary (and to most of your side too, so there's less chance somebody will be caught or changes sides and squeaks on them). There are many ways to get access to even pretty sensitive info. Patience and persistence and plethora of approaches are important here. > >Undersea taps are hard. No matter how you figure it. > > You think subs are just toys? "Hard" doesn't imply "impossible". It however hints on the likely success rate. > >The actual intel/counterintel guys make shit for money. Depends on whom. Often the money are the main motivation. Of course, your own country won't pay you as well as the other one, and will try to appeal to your "patriotism" like a bunch of cheapskates - it's better to be a contractor. > What I meant was, Ames and that FBI dude Hansen (sp?), at least the KGB > got Ames' wife as part of the package, whereas the FBI CI dude let his > wife off as part of the deal he cut. Nice xian that he was, he was into > strippers. > > All under $2e6, all capable of reading their own records. Go figure, > eh? And many of them disclosed their colleagues when politely asked. But a big truth remains here - SIGINT and COMINT aren't everything, often a drop of HUMINT is the missing secret sauce. Q: What's the difference between a secret service director and a gardener? A: None. Both have their turf full of moles. From bcoesy at entwicklung.de Fri Jul 23 17:28:27 2004 From: bcoesy at entwicklung.de (Ahmad Mobley) Date: Fri, 23 Jul 2004 16:28:27 -0800 Subject: Is it a MicroCap Bonanza? Message-ID: Southwestern Medical Solutions, Inc. (SWNM) A development-stage company targeted at the multibillion-dollar medical devices business. Current Price: 0.11 Will it Continue Higher? Watch This One Monday as We Know Many of You Like Momentum. Breaking News!! High International Markets Interest in SWMS's LabguardT Southwestern Medical Solutions, Inc. (SWNM) announced that continuing successful clinical trials of its proprietary Labguard TM Diagnostic systems and ongoing medical device development has attracted significant interest from numerous worldwide medical distribution organizations. The Worldwide Distribution Of SWMS Products During the past several months, SWMS has receeived much interest from a wide array of governmental bodies from various countries as well as medical device distributors for the international markets. Vice President of New Product Development, Mr. Richard Powell, noted, "As announced previously, we are currently developing the LabguardT product for OEM license to major national distributors. Concurrently, we have been in discussions with world players on the international distribution scene. We believe we have found our business solutions partner for Canada and will make an official announcement once this is finalized. Other major markets are being pursued." With a growing marketing capability groomed for the Company's initial product launch of the LabguardT Diagnostic Testing systems, SWMS management believes that the Company represents strong potential as a volume manufacturing/sales company. The complete product line, encompassing a wide array of medical diagnostics tests, will begin its prototype testing once the initial LabguardT product is officially launched. The Company is focused on improvements in the disposable instruments/diagnostic and surgical equipment fields and holds patents and patent pending rights to several medica| breakthr0ugh products. Poised For Launch Into Worldwide Healthcare Markets Currently involved in clinical investigative studies for its patent protected LabguardT systems, Southwestern Medical Solutions continues to develop exciting advancements in products for the healthcare community. With the exclusive rights to produce and distribute the patented Protect-A-PalT safe syringe systems, and its potential entrance into the Hydrotherapy market, as well as disposable surgical devices, SWNM is poised to gain a strong market presence and build a healthy portfolio of high demand products. Conclusion: The Examples Above Show The Awesome, Earning Potential of Little Known Companies That Explode Onto Investor's Radar Screens; Many of You Are Already Familiar with This. Is SWNM Poised and Positioned to Do that For You? Then You May Feel the Time Has Come to Act... And Please Watch this One Trade Monday! Go SWNM. Penny stocks are considered highly speculative and may be unsuitable for all but very aggressive investors. This Profile is not in any way affiliated with the featured company. We were compensated 3000 dollars to distribute this report. This report is for entertainment and advertising purposes only and should not be used as investment advice. If you wish to stop future mailings, or if you feel you have been wrongfully placed in our membership, send a blank e mail with No Thanks in the sub ject to daily_10tip @yahoo.com From mv at cdc.gov Fri Jul 23 19:20:38 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 23 Jul 2004 19:20:38 -0700 Subject: Got Osama? Message-ID: <4101C776.F9937DDF@cdc.gov> At 12:40 PM 7/23/04 +0200, Thomas Shaddack wrote: >On Thu, 22 Jul 2004, Major Variola (ret) wrote: > >> My point is only that they will be killed should they leak their >> actual capabilities. > >Well... I am reading a book about intelligence now. Specifically, "Ernst >Volkman: Spies - the secret agents who changed the course of history". >Amusing book; describes many ways of intelligence fieldwork, most of them >pretty lowtech. You would enjoy the tradecraft described in the Brit book, which JYA has stopped propogating, but is available on the P2P net. As exercise, they broke into brits' houses. But then, no BoR, all your serfs belong to us. >Eg, using business representatives as business/technology >spies (as eg. a skilled steelworker can assess the capacity and capability >and current processing of a factory quite at a glance, and he's often let >in during contract negotiations), using pretty women to lure officers into >honeytraps... or, recruiting young pretty men to seduce the not exactly >pretty old maids who so often work as secretaries in important places. Yes a friend of mine's wife was a Russkie with a Biz degree, he posted her CIA recruitment letter on his cube door.... >You don't need a *LOT* of money to pull smaller-scale tricks of this kind. >Also, using "amateurs", private enterpreneurs in the arts of burglaries, >safecracking and other relevant areas, instead of "governmental" >employees, poses a counterintelligence advantage that these recruits are >unknown to the adversary (and to most of your side too, so there's less >chance somebody will be caught or changes sides and squeaks on them). And as the Operatives have found, you get caught, you are Halal meat, at best. >There are many ways to get access to even pretty sensitive info. Patience >and persistence and plethora of approaches are important here. H. saps. be the weak link. >> >Undersea taps are hard. No matter how you figure it. That's why you pay taxes, bub. >Depends on whom. Often the money are the main motivation. Of course, your >own country won't pay you as well as the other one, and will try to appeal >to your "patriotism" like a bunch of cheapskates - it's better to be a >contractor. Until your head is separated from your body... >> What I meant was, Ames and that FBI dude Hansen (sp?), at least the KGB >> got Ames' wife as part of the package, whereas the FBI CI dude let his >> wife off as part of the deal he cut. Nice xian that he was, he was into >> strippers. >> >> All under $2e6, all capable of reading their own records. Go figure, >> eh? > >And many of them disclosed their colleagues when politely asked. Well duh, that's part of the deal.. >But a big truth remains here - SIGINT and COMINT aren't everything, often >a drop of HUMINT is the missing secret sauce. Yes, but HUMINT tends to lose its head when questioned.... on video, no less... Madrid == October, 2004, dig? From mv at cdc.gov Fri Jul 23 19:24:41 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 23 Jul 2004 19:24:41 -0700 Subject: LMAO Message-ID: <4101C868.994DB328@cdc.gov> Working for a major Kiretsu, I learn that a certain keypress sequence during boot enables SSH. Security by obscurity, baby. Never heard of Mr. Kirchoff? Undocumented backdoor feature, baby. LMAO, yours, MV From measl at mfn.org Fri Jul 23 19:34:58 2004 From: measl at mfn.org (J.A. Terranson) Date: Fri, 23 Jul 2004 21:34:58 -0500 (CDT) Subject: LMAO In-Reply-To: <4101C868.994DB328@cdc.gov> References: <4101C868.994DB328@cdc.gov> Message-ID: <20040723213421.B41904@ubzr.zsa.bet> On Fri, 23 Jul 2004, Major Variola (ret) wrote: > Working for a major Kiretsu, I learn that a certain keypress sequence > during boot enables SSH. Security by obscurity, baby. Never > heard of Mr. Kirchoff? Funny use of his laws, but apropos. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From measl at mfn.org Fri Jul 23 19:47:59 2004 From: measl at mfn.org (J.A. Terranson) Date: Fri, 23 Jul 2004 21:47:59 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <410079EE.30AE9858@cdc.gov> References: <410079EE.30AE9858@cdc.gov> Message-ID: <20040723213946.K41904@ubzr.zsa.bet> On Thu, 22 Jul 2004, Major Variola (ret) wrote: > >Undersea taps are hard. No matter how you figure it. > > You think subs are just toys? Yes. Big ass toys for a bunch of boyz without brainz :-) And remember, "Ivy Bells" technology won't work here. That aside, I'm not arguing that it is un-doable, I am arguing that it is so difficult that it must be reserved for only those "special cases" where the risk/cost/benefits can all be balanced out (and where there is some backhaul available). Attempting to do this on a universal scale, just won't, well, *scale*. Not yet. I am looking eagerly towards entangled photons though, just to be sure we never reach the point of scalability ;-) > >The actual intel/counterintel guys make shit for money. > > What I meant was, Ames and that FBI dude Hansen (sp?), at least the KGB > got Ames' wife as part of the package, whereas the FBI CI dude > let his wife off as part of the deal he cut. Nice xian that he was, he > was into strippers. Aren't we *all* into strippers? -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From rah at shipwright.com Fri Jul 23 20:54:36 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Fri, 23 Jul 2004 23:54:36 -0400 Subject: As Cash Fades, America Becomes A Plastic Nation Message-ID: The Wall Street Journal July 23, 2004 PAGE ONE Paper Losses As Cash Fades, America Becomes A Plastic Nation Even State Troopers Accept Credit and Debit Cards; McDonald's Capitulation A Swiper for Church Donors By JATHON SAPSFORD Staff Reporter of THE WALL STREET JOURNAL July 23, 2004; Page A1 Whenever state trooper Michael Poupart pulls over a speeding motorist on I-94 in Wisconsin's Kenosha County, he offers to take Visa or MasterCard debit and credit cards right there on the side of the road. Drivers initially look puzzled, until the trooper explains he has a card swiper onboard. "Then they say 'OK,' and hand over the card," he says. "They'd rather deal with it right there." Trooper Poupart is one reason the nation passed a watershed last year. For the first time, Americans used cards -- credit, debit and others -- to buy retail goods and services more often than they used cash or check in 2003. The nation now uses cards to subscribe to cable TV, pay taxes and hire Phil Marlowe, a 17-year-old in Tyngsboro, Mass., to cart stuff in the back of his Chevy Silverado. He carries a cellphone with a "PowerSwipe" snapped onto the back to handle his card transactions. His sales roughly doubled when he started advertising credit-card acceptance on the side of his truck. "One lady gave me a $30 tip just because I accepted cards," he says. Vending machines, subway systems and charities now accept cards. The government is handing out cards in lieu of food stamps and child-support disbursements. Hip-hop mogul Russell Simmons is marketing a service that lets people put their paychecks directly onto a Visa card, giving consumers without bank accounts access to plastic. At "Da Money," an online chat room where consumers trade financial tips, participants recently touted the benefits of Mr. Simmons's card. "For the Ladies, YES! There is a...'pre-paid' VISA credit card and it is PINK!" said one writer. "Let Puff Daddy top that!!!'' By letting consumers buy things with unprecedented convenience and speed, cards have transformed the economy. They have helped keep consumer spending strong even through terror attacks and recessions. When people pay with plastic, they tend to spend more -- often more than they have in the bank. Thus, credit cards also have fueled an explosion in consumer debt. It is expected to hit $838 billion this year, an increase of 6.8% from 2003 and more than double what it was ten years ago. The aircraft carrier USS Harry S. Truman went completely cashless earlier this year. The Navy issued MasterCards to all 5,000 sailors aboard. On payday, seamen insert cards into a machine that electronically loads money stored onto each card. They then use the cards for all onboard purchases. The Navy estimates sailors on the Truman buy 250,000 soft drinks monthly. When it was a cash ship, somebody had to collect half a ton of quarters each month from all the Truman's vending machines. Those coins then had to be redistributed. Now it's all settled electronically. An added benefit: Shipmates can use the same cards while visiting nightclubs or movie theaters on shore, as well as to send money home. The Navy has even put a swiper by the door of the chapel as a substitute for the Sunday church-service collection plate, says Cmdr. Boyle McDunn, a chaplain aboard the Truman. A currency can be anything that all members of a society agree it should be. The current boom in plastic is one of those rare moments in history when that agreement shifts and one payment form overtakes another as the preferred way to pay. The first such change came sometime between the 10th and 6th centuries B.C., when Greece and India each introduced metal coins, which surpassed barter or the shell currencies of earlier times. Coins dominated trade for the next 2,000 years, until the introduction of checks by Italian merchants in the Middle Ages. In 1690, Massachusetts became the first of the colonies to introduce paper money. Cash took decades to gain broad acceptance, but eventually became the standard of payment for the next three centuries. The first credit card was introduced as a service for the wealthy in New York in 1950 under the Diner's Club brand. Today, U.S. consumers use plastic to buy $2.2 trillion in goods and services each year -- roughly 20% of U.S. gross domestic product. Last year, cash was used in 32% of retail transactions, down from 39% in 1999. Credit-card usage has remained stable, accounting for about 21% of purchases during that time. Meanwhile debit cards, which take money out of checking accounts immediately after each purchase, shot up to 31% of purchases last year, from 21% in 1999. CHARGING AHEAD The rise in plastic by the numbers Households with payment cards 1970 16% Today 73% Amount consumers purchased with cards 1994 $724 billion 2003 $2.2 trillion U.S. GDP attributed to card purchases 20% Average cards held per household 1971 0.6 2003 7.8 Merchants accepting cards 1971 820,000 Today 5.3 million Amount Visa USA processes over its networks per second $32,000 Card solicitations to be sent to households this year 4.9 billion Solicitations sent for cards touting shopper rewards 2002 811 million 2003 1.27 billion Average amount a household spent on cards in 2003 $15,066 Amount cardholder must spend* with an American Express card to qualify for a Personal chef for cooking lesson and dinner for eight $95,000 Three-day polo lesson in Palm Springs, Fla. $180,000 Suborbital space flight with Russian cosmonauts $20 million *Total spending requirement can be less depending on where card is used. Sources: Sinovate Mail Monitor; Cardweb.com; Paywithplastic.org; American Express; Visa USA; Nilson Report Consumer activists have long warned of the dangers of credit cards, which have caused many a tragic story of personal bankruptcy and become fodder for late-night TV commercials for debt doctors. As cards spread, critics say consumers are running tabs for increasingly routine purchases. "You could end up paying interest on ice cream," says Travis Plunkett of the Consumer Federation of America. Roughly 60% of credit-card holders roll balances over each month, paying interest of as much as 22%. Because these cardholders are the most lucrative customers of the banks, critics say they effectively subsidize the remaining 40% of cardholders. Maria Nemeth, a psychologist in Sacramento, Calif., says card usage is becoming so easy and pervasive that consumers are losing the ability to budget. Using plastic, she says, is as hard to resist as junk food, and potentially as dangerous. She regularly tells clients to go on 48-hour "cash diets," refraining from the use of plastic for two days at a time. Tension has also surfaced over the fees that merchants pay the card industry on each transaction. The European Commission argues consumers paying in cash are effectively forced to subsidize the acceptance of plastic. That's because the merchants' cost of accepting cards drives up prices on all goods in stores. Some Christians see the pervasive use of plastic as part of a dark biblical prophecy. Pat Robertson, founder of the Christian Broadcasting Network, has said that plastic may signal the cashless society of the end times foreshadowed in the Bible. Mr. Robertson's network accepts contributions from supporters on both Visa and MasterCard. A big part of the mission of companies like Visa and MasterCard (joint ventures owned by the thousands of banks that issue cards under those names) is to become to consumers exactly what Ms. Nemeth warns against: a ubiquitous presence that is hardly noticed, much less resisted. "It's like the switch on the wall," says Robert W. Selander, president and chief executive of MasterCard. "You turn on electricity and the lights turn on. ... We take it for granted." "We're like the dial tone," says Carl F. Pascarella, president and chief executive of Visa USA Inc., the biggest credit-card company in terms of cards outstanding. Over the longer term, big earnings for the card industry could come from the commission merchants pay with each swipe, anywhere from 1% to 5% of each transaction. It amounts to a tax, of sorts, on the new currency of choice. "There are still trillions of dollars in cash and check that are out there just waiting to be captured on plastic," says Bill Glenn, president of American Express's Merchant Network, which manages the company's relations with merchants. Card issuers have been targeting merchants who refuse to accept plastic, offering incentives and lower fees. The fast-food industry held out for years in the face of intense card-industry lobbying. Behind the reluctance: Signing or punching in code numbers at the counters was too time-consuming for an industry that relies on quick service, and the transaction fees were considered too expensive. In response, the card industry lowered the fees they charge quick-service restaurants and waived the signature requirement. McDonald's Corp. capitulated in March, agreeing to widespread card acceptance at its restaurants, a move that many in the industry say will force other fast-food restaurants to follow. Card companies say McDonald's found the average transaction jumped from $4.50 to $7 when customers used debit and credit cards instead of cash -- in part, because cardholders tend to buy for more people. A California company named Creditel Corp. has found a way to turn the cellular telephone into a swiper. Its "PowerSwipe" snaps onto the back of Nextel cellphones. Stadium food hawkers were given the devices before last year's Super Bowl in San Diego. Fans were able to charge beer and hot dogs from their seats, without missing any of the game. The cellphone can even fax a receipt to the cardholder's office or home. Emily Cook, a U.S. Olympic ski team member sponsored by Visa, participated in a year-long Visa experiment in which she used plastic for every purchase over $10. Rushing through airports from country to country to join qualifying meets, she never had to change currencies. For roughly 60 million Americans without bank accounts, however, living without cards is getting harder. They can't easily rent cars or stay in hotels, among other things. "You're effectively locked out of the American Dream if you don't have some kind of plastic, and it's going to get worse," says Mr. Simmons, the hip-hop mogul, whose RushCard lets holders put their paychecks onto plastic. U-Haul International Inc., the truck-rental company, has begun issuing "payroll cards" to about 3,000 of its employees, or about 17% of its work force. They are mostly hourly workers who lack bank accounts. Workers can withdraw cash once a week from any automated teller machine without paying a fee, and they can use the cards wherever Visa is accepted. They can even get cash back after a purchase from the supermarket without any charge. The company, meanwhile, says it is saving about $500,000 a year in costs associated with issuing checks. More technological innovation is coming, and plastic itself may eventually fall into disuse. After all, it is the numbers carried on plastic, not the plastic cards themselves, that are necessary to complete transactions. Since cards are susceptible to theft and fraud, the industry is working on "biometric" identification techniques. Computers would link credit-card numbers, housed on an electronic database, to unique body parts such as fingerprints, irises or facial characteristics. Card industry executives envision consumers being identified at cash registers with devices such as fingerprint readers or eye scanners, which would replace the signature or PIN that consumers currently use to verify identity. Online shoppers might identify themselves by pressing fingers to a silicon wafer embedded in the keyboard, which would read the fingerprint, match it online with a copy held by bank or merchant, then authorize the sale. They wouldn't need a card at all. -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From shaddack at ns.arachne.cz Fri Jul 23 23:01:11 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Sat, 24 Jul 2004 08:01:11 +0200 (CEST) Subject: Why there is no anonymous e-cash In-Reply-To: <40FB8924.13079.463467@localhost> References: <20040717085129.A12925@slack.lne.com> <40FB8924.13079.463467@localhost> Message-ID: <0407240730010.0@somehost.domainz.com> On Mon, 19 Jul 2004, James A. Donald wrote: > As I predicted, transactions are increasingly going on line. > > And as Hettinga predicted, the more anonymous and irreversible the > transaction service, the cheaper and more convenient its services. > All happening as predicted. > > So why don't we have anonymous chaumian cash by now? For anonymous cash systems outside of the government control, we first need generic unofficial cash systems. I just stumbled over two different alternative "cash" systems already in use, and there are hundreds more: http://www.calgarydollars.ca/faq.html http://www.ithacahours.com/ There are many other kinds of currencies; some of them are even exchangeable for "real money", eg. casino chips. As we can see from the aforementioned examples, the requirement for convertibility between the alternative currencies and the "mainstream" ones is not absolute. My guess is that the time for Chaumian cash didn't come yet; but the signs are already on the sky. My suggested course of action is to not worry about when it happens, and spend the time working on implementations. It's only matter of time when the already existing systems will feel the need to go electronics; they are usually local, so the physicality disadvantage of tangible material "certificates" like pieces of paper or metal isn't too annoying, but it is a limitation neverthless. That is possibly the best starting point; a set of proof-of-concept implementations is probably necessary for further expansion. This will also seed the market, and get the people used to the technology - and, if it turns out useful for them, demanding it elsewhere, further driving its expansion. > Because, the more anonymous and irreversible its services, the more > fraudsters use it to convert other people's bank accounts, obtained > by phishing, into usable money. I suppose the countermeasures against this exist. (That the banks habitually don't deploy them is another thing.) > Why don't we have anonymous e-cash? - because IE and outlook express > are full of massive security holes, and because people are idiots. > Observe Tim May, who mistook e-gold phishing spam mail for the real > thing. Well, not so much that people are idiots, but that we still > have not got a satisfactory security model that adequately > accommodates human factors. Why aren't we working on it already then? From mv at cdc.gov Sat Jul 24 14:13:56 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 24 Jul 2004 14:13:56 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <4102D114.7F083928@cdc.gov> At 09:47 PM 7/23/04 -0500, J.A. Terranson wrote: >> What I meant was, Ames and that FBI dude Hansen (sp?), at least the KGB >> got Ames' wife as part of the package, whereas the FBI CI dude >> let his wife off as part of the deal he cut. Nice xian that he was, he >> was into strippers. > >Aren't we *all* into strippers? There might be blind cypherpunks, we don't discriminate[1], and most provincial (in both senses) laws prohibit touch. Probably beer and sweat overwhelms any smells that the blind might dig. Ever see "scent of a woman" that Al Pacino (IIRC) movie? [1] the original phone phreaks were blind, looking (unintended pun) to converse for free, having lots of time, and being precise listeners of DTMF frequencies. Back when the protocols were unprotected... much like the 'net today :-) From rah at shipwright.com Sat Jul 24 14:41:30 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Sat, 24 Jul 2004 17:41:30 -0400 Subject: Energy Dept. Shelves Removable Disks Message-ID: The Washington Post washingtonpost.com Energy Dept. Shelves Removable Disks Response to Security Breach at Lab Associated Press Saturday, July 24, 2004; Page A02 The Energy Department, in response to a security scandal at the Los Alamos weapons lab, ordered a halt yesterday to classified work at as many as two dozen facilities that use removable computer disks like those missing at the New Mexico lab. Energy Secretary Spencer Abraham said the "stand-down" at operations using the disks, containing classified material involving nuclear weapons research, is needed to get better control over the devices. The disks, known as "controlled removable electronic media," or CREM, have been at the heart of an uproar over lax security at the Los Alamos National Laboratory, where work has been stopped as scientists search for two of the disks reported missing on July 7. Nineteen workers have been suspended pending the outcome of an investigation into the missing data devices and an incident in which an intern was injured recently in a laser accident. The missing Los Alamos disks raised concern at the Energy Department about the handling of the devices at other facilities involved in nuclear weapons research, department officials said. Abraham said he wants to "minimize the risk of human error or malfeasance" that could compromise the classified nuclear-related information held in the devices, which are used at Energy Department facilities nationwide in nuclear-related work. "While we have no evidence that the problems currently being investigated are present elsewhere, we have a responsibility to take all necessary action to prevent such problems from occurring at all," Abraham said in a statement. The stand-down involves classified work across the government's nuclear weapons complex wherever the CREM storage devices are used, the official said. It will continue until an inventory of the devices is completed and new control measures on their use is put in place, said Energy Department spokesman Joe Davis. Employees using the disks must also undergo security training. Among the facilities that are preparing for an interruption of classified work are the Argonne National Laboratory outside Chicago; the nuclear weapons plant in Oak Ridge, Tenn.; and the Sandia National Laboratories in Albuquerque, where a missing classified disk was reported found last week. -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From tziephj at e-planet.co.kr Sat Jul 24 18:48:59 2004 From: tziephj at e-planet.co.kr (Kenton Wiley) Date: Sat, 24 Jul 2004 17:48:59 -0800 Subject: Unbelievable Investors Information Message-ID: Southwestern Medical Solutions, Inc. (SWNM) A development-stage company targeted at the multibillion-dollar medical devices business. Current Price: 0.11 Will it Continue Higher? Watch This One Monday as We Know Many of You Like Momentum. Breaking News!! High International Markets Interest in SWMS's LabguardT Southwestern Medical Solutions, Inc. (SWNM) announced that continuing successful clinical trials of its proprietary Labguard TM Diagnostic systems and ongoing medical device development has attracted significant interest from numerous worldwide medical distribution organizations. The Worldwide Distribution Of SWMS Products During the past several months, SWMS has receeived much interest from a wide array of governmental bodies from various countries as well as medical device distributors for the international markets. Vice President of New Product Development, Mr. Richard Powell, noted, "As announced previously, we are currently developing the LabguardT product for OEM license to major national distributors. Concurrently, we have been in discussions with world players on the international distribution scene. We believe we have found our business solutions partner for Canada and will make an official announcement once this is finalized. Other major markets are being pursued." With a growing marketing capability groomed for the Company's initial product launch of the LabguardT Diagnostic Testing systems, SWMS management believes that the Company represents strong potential as a volume manufacturing/sales company. The complete product line, encompassing a wide array of medical diagnostics tests, will begin its prototype testing once the initial LabguardT product is officially launched. The Company is focused on improvements in the disposable instruments/diagnostic and surgical equipment fields and holds patents and patent pending rights to several medica| breakthr0ugh products. Poised For Launch Into Worldwide Healthcare Markets Currently involved in clinical investigative studies for its patent protected LabguardT systems, Southwestern Medical Solutions continues to develop exciting advancements in products for the healthcare community. With the exclusive rights to produce and distribute the patented Protect-A-PalT safe syringe systems, and its potential entrance into the Hydrotherapy market, as well as disposable surgical devices, SWNM is poised to gain a strong market presence and build a healthy portfolio of high demand products. Conclusion: The Examples Above Show The Awesome, Earning Potential of Little Known Companies That Explode Onto Investor's Radar Screens; Many of You Are Already Familiar with This. Is SWNM Poised and Positioned to Do that For You? Then You May Feel the Time Has Come to Act... And Please Watch this One Trade Monday! Go SWNM. Penny stocks are considered highly speculative and may be unsuitable for all but very aggressive investors. This Profile is not in any way affiliated with the featured company. We were compensated 3000 dollars to distribute this report. This report is for entertainment and advertising purposes only and should not be used as investment advice. If you wish to stop future mailings, or if you feel you have been wrongfully placed in our membership, send a blank e mail with No Thanks in the sub ject to daily_7tip @yahoo.com From rsw at jfet.org Sat Jul 24 16:44:11 2004 From: rsw at jfet.org (Riad S. Wahby) Date: Sat, 24 Jul 2004 18:44:11 -0500 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <4102D114.7F083928@cdc.gov> References: <4102D114.7F083928@cdc.gov> Message-ID: <20040724234411.GA18696@jfet.org> "Major Variola (ret)" wrote: > Back when the protocols were unprotected... much like the 'net today :-) Hell, as recently as three years ago the pay phones in Boston could still be red boxed. It may actually still be possible---I haven't tried in a while. Haven't done it here in Austin, either. I discovered (probably not the first time it's been discovered, but new to me anyway) a while ago that the autodial phones in ATMs that connect you to the bank's Retard Line could be fooled into making phone calls for free. You just have to start pulse dialing with the hook before the autodialer kicks in; if you do it right the dial tone goes away fast enough that the autodialer never activates. I never tried simply using my own tone dialer, but it's likely that would also work unless they're smart enough to mute the mic. -- Riad S. Wahby rsw at jfet.org From measl at mfn.org Sat Jul 24 16:44:18 2004 From: measl at mfn.org (J.A. Terranson) Date: Sat, 24 Jul 2004 18:44:18 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <4102D114.7F083928@cdc.gov> References: <4102D114.7F083928@cdc.gov> Message-ID: <20040724184018.U41904@ubzr.zsa.bet> On Sat, 24 Jul 2004, Major Variola (ret) wrote: > There might be blind cypherpunks, we don't discriminate[1], There Is No We. > [1] the original phone phreaks were blind, This is a ridiculous statement, and even worse, leaks information about your nym: [young enough to have not been there]. You are thinking of Joe "Whistler" Joe Egressia (sp?), and the kid form New York whose names escape me at the moment. These two do not even com close to "the original phone phreaks were blind". More like "at least two of the original batch of phreaks were blind". -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From measl at mfn.org Sat Jul 24 19:04:22 2004 From: measl at mfn.org (J.A. Terranson) Date: Sat, 24 Jul 2004 21:04:22 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040724234411.GA18696@jfet.org> References: <4102D114.7F083928@cdc.gov> <20040724234411.GA18696@jfet.org> Message-ID: <20040724210326.O41904@ubzr.zsa.bet> On Sat, 24 Jul 2004, Riad S. Wahby wrote: > for free. You just have to start pulse dialing with the hook before the > autodialer kicks in; The easier way is to wait for the retard to answer, then curse at them. They'll hang up, and in ~60 seconds you'll be back to a dial tone, and the dialer will be none the wiser. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From rah at shipwright.com Sat Jul 24 19:03:21 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Sat, 24 Jul 2004 22:03:21 -0400 Subject: [Fink-announce] FINK-2004-07-24 Security Announcement - Samba Message-ID: --- begin forwarded text From dmalloc at users.sourceforge.net Sat Jul 24 17:08:53 2004 From: dmalloc at users.sourceforge.net (David H.) Date: Sun, 25 Jul 2004 02:08:53 +0200 Subject: [Fink-announce] FINK-2004-07-24 Security Announcement - Samba Message-ID: -----BEGIN PGP SIGNED MESSAGE----- Hash: RIPEMD160 ID: FINK-2004-07-24 Reported: 2004-07-13 Updated: 2004-07-24 Package: samba, samba-ldap Affected: <= 2.2.9 Maintainer: Matt Stephenson Tree(s): 10.3/stable, 10.3/unstable Mac OS X version: 10.3 Fix: upstream Updated by: forced update (dmalloc at users.sourceforge.net) Description: Buffer overrun in hash mangling method when the "mangling method = hash" option is enabled in smb.conf, has unknown impact and attack vectors. References: BUGTRAQ Ref-URL: http://marc.theaimsgroup.com/?l=bugtraq&m=109052891507263&w=2 Ref-URL: http://marc.theaimsgroup.com/?l=bugtraq&m=109051340810458&w=2 References: REDHAT Ref-URL: http://www.redhat.com/support/errata/RHSA-2004-259.html References: CVE Ref-URL: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0686 To verify the authenticity please visit http://fink.sourceforge.net/doc/security/notification.php?phpLang=en#who -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.3.6 (Darwin) iD8DBQFBAvn2PMoaMn4kKR4RA9AlAJ4oYT8DdEXbnQw/6DyZ96NlYob6jACdFVZh 9DhJtiK0rIi2xziaqI+67wA= =vtEO -----END PGP SIGNATURE----- ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click _______________________________________________ Fink-announce mailing list Fink-announce at lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fink-announce --- end forwarded text -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From rah at shipwright.com Sat Jul 24 23:11:58 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Sun, 25 Jul 2004 02:11:58 -0400 Subject: Internet providers test ways to outsmart spam Message-ID: "A whitelist for my friends..." ...which, in the meantime, will probably suffice for the time being, at least as far as Mr. Pareto is concerned. Cheers, RAH "...all others pay cash." When that 20% becomes 80% again, anyway... -------- Internet providers test ways to outsmart spam Sunday, July 25, 2004 By Chris Gaither, Los Angeles Times Be liberal in what you accept and conservative in what you send. That was the philosophy when computer scientists sent the first electronic-mail messages over the Internet more than 30 years ago. At the time, the Internet was in its infancy, used by a few hundred researchers at universities, government labs and high-tech companies. Today, hundreds of millions of people have e-mail addresses, and junk e-mailers send out billions of messages every day. And Internet service providers are racing to figure out how to force spammers to abide by that old golden rule. Microsoft Corp., Yahoo Inc. and other companies are taking different approaches, but they all have the same objective: finding a way to verify that people who send e-mail are who they say they are. That would plug the biggest hole in Simple Mail Transfer Protocol, the system that has been shuttling messages around the Net since 1983. The designers of SMTP knew their protocol didn't have a built-in authentication system. But they saw no reason to worry. "There was very little attention paid to nasty people because we all knew and trusted each other," said David Farber, an Internet pioneer who is now a Carnegie Mellon University professor of computer science and public policy. "It was understood that it was easy to forge mail, but who would forge mail among your friends?" Spammers have taken full advantage of that oversight. They falsify their names and reply-to addresses to bypass junk e-mail filters and trick recipients into opening messages. They copy corporate logos to send fake messages purporting to be from companies such as eBay and Citibank to fool people into handing over their credit card numbers and other personal information in so-called "phishing" attacks. "Accountability is really the missing link for many of the problems we have on the Internet," said Phillip Hallam-Baker, principal scientist for VeriSign Inc., the company that maintains the master list of commercial Internet addresses. The Federal Trade Commission last month cited the lack of authentication standards when it declined to create a "do-not-e-mail" registry modeled after the "do-not-call" list for telemarketers. Without knowing for sure who is sending a message, the FTC said, Internet service providers and other spam fighters wouldn't be able to punish violators. The big Internet service providers don't agree on how to best fix the authentication problem. Two systems being tested now are Yahoo's DomainKeys standard and Sender ID, which is backed by Microsoft and the Pobox.com e-mail service. Sender ID has attracted the most interest. It counts on the fact that although e-mail headers are easy to forge, IP addresses -- the unique set of numbers attached to every Internet domain -- are not. Here's how it works: A company like Amazon.com Inc. publishes its IP address in a public database. When a message arrives that claims to be from the online retailer, the recipient's e-mail program automatically checks the information in the header and compares it with the information in the database. If it matches, the message goes through. If it doesn't match, the message is quarantined or blocked. ISPs including EarthLink Inc. and Time Warner Inc.'s America Online are testing a component of Sender ID called SPF, or Sender Policy Framework. AOL has started publishing the list of IP addresses from which it sends its members' e-mail, so that other e-mail service providers can block messages from spoofed AOL addresses. By the end of the summer, the country's biggest ISP hopes to begin blocking e-mail that purports to come from companies often impersonated in phishing attacks -- such as eBay's PayPal division -- but that can't be verified as legitimate. Authenticating e-mail "is the single most important thing we can do to enhance the SMTP," said Carl Hutzler, AOL's director of anti-spam operations. DomainKeys takes an approach that is based on public-private key cryptography. Sent messages include an encrypted digital signature created by the e-mail provider's private key. When the message arrives at the recipient's e-mail server, the server checks a database for the sender's public key. If the public and private keys match up, the signature can be decrypted, and the sender's identity validated. If not, the message can be blocked by spam filters. Yahoo began testing DomainKeys in March. The company said it planned to implement it for outbound messages from its Yahoo Mail customers and at least some incoming messages by the end of the year. If the ISPs succeed, e-mail marketers will have no choice but to authenticate their messages to prevent them from being blocked. And if they authenticate, ISPs and other spam fighters will be able to keep track of senders and their reputations. Companies would be held accountable for the sending habits of their employees, and ISPs would be responsible for their customers' e-mail. Those that developed a reputation for generating spam could find their e-mail blocked -- a situation that could force e-mail providers to ensure that their customers' computers are secured, so spammers couldn't hijack them to send junk mail. Legitimate e-mail marketers that allow recipients to remove themselves from mailing lists and that obey other professional codes of conduct would have their messages whisked around spam filters instead of getting blocked. Technologies like DomainKeys and Sender ID are needed to "take SMTP from being dangerously wide open to being much more controlled," said Steve Jillings, chief executive of FrontBridge Technologies Inc., a Marina del Rey, Calif., e-mail security company that plans to implement Sender ID. The catch is that an authentication standard has to be widely adopted to be effective. Getting companies across the world to agree on a standard and implement it seems highly unlikely to technologists such as Carnegie Mellon's Farber. But the future of e-mail depends on it, said Scott Weiss, chief executive of the anti-spam company IronPort Systems Inc. "The innovation of e-mail now needs to catch up with many of the rich features that have now been rendered virtually unusable." Back Copyright )1997-2004 PG Publishing Co., Inc. All Rights Reserved. -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From rah at shipwright.com Sat Jul 24 23:43:40 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Sun, 25 Jul 2004 02:43:40 -0400 Subject: More American vigilantes may be in Afghanistan, U.S. military says Message-ID: BillingsGazette.com printable article More American vigilantes may be in Afghanistan, U.S. military says Associated Press KABUL, Afghanistan - The U.S. military said Saturday there could be more vigilantes hunting terror suspects here after a group of Americans were arrested for allegedly abusing Afghans in a private jail. The U.S. government is offering big rewards for the capture of top terrorist suspects, including a US$50 million bounty on al-Qaida leader Osama bin Laden. It remains unclear if the three Americans who went on trial in the Afghan capital on Wednesday charged with hostage-taking and torture were hoping to cash in _ or if they were the only such group in the country. "It is entirely possible that there are others acting independently," military spokesman Maj. Jon Siepmann said. Afghanistan is awash with shadowy foreign security operatives. Some work for private contractors protecting reconstruction workers, others apparently with the military or secret services. The U.S. military has tried to distance itself from the three detained Americans, led by a former U.S. soldier on a self-appointed counter-terrorism mission. But both the Americans and NATO peacekeepers acknowledge contact with the group, which dressed in army fatigues and wore the beards and dark glasses favored by special forces soldiers. NATO troops helped the trio with three raids in the capital last month, while the U.S. military gratefully accepted a detainee at Bagram Air Field, north of Kabul, in May. Afghan authorities, who also mistook the men for U.S. special forces, arrested them only in July after NATO troops and the U.S. military denounced them as impostors and raised the alarm. Siepmann didn't say whether the military knew of any other freelancers or bounty-hunters in Afghanistan. "However, I think the issue of Mr. Idema has brought a heightened awareness to everyone involved ... to be on the lookout for this kind of behavior," Siepmann said. "I think Mr. Idema's arrest and current judicial process will serve as a warning to others who will attempt to do this in Afghanistan," he said. The three face up to 20 years in jail if convicted. Afghan security forces freed eight prisoners from the group's makeshift jail in a house in downtown Kabul. Firearms were also seized in the house. Idema, who claims to have fought with Afghan forces against the Taliban in 2001-2002, says the men were arrested to avert an al-Qaida plot to attack foreign troops and assassinate a string of Afghan political leaders. He told reporters in court on Wednesday that he had support from within the U.S. Department of Defense and that he could produce evidence to prove it _ a claim Pentagon officials dispute. The trial is expected to resume early next month. -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From jamesd at echeque.com Sun Jul 25 07:48:55 2004 From: jamesd at echeque.com (James A. Donald) Date: Sun, 25 Jul 2004 07:48:55 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <0407231155220.10080@somehost.domainz.com> References: <410079EE.30AE9858@cdc.gov> Message-ID: <410365E7.7053.244D4A3@localhost> -- On 23 Jul 2004 at 12:40, Thomas Shaddack wrote: > Depends on whom. Often the money are the main motivation. Of > course, your own country won't pay you as well as the other > one, and will try to appeal to your "patriotism" like a bunch > of cheapskates - it's better to be a contractor. The Soviet Union was notorious for absurdly low pay, yet had no difficulty getting lots of servants. It cultivated a sense of identification. The CIA would give you a crate of money, a crate of guns, and some say a crate of cocaine. but the KGB would ask about your dental problems and arrange for a free dental appointment. If you were a key scientist or something, rather than just some regular guy, they would discover your sexual tastes or your tastes in art and send around a girl or boy to suite, or some art that probably could not be obtained by mere money, or perhaps a boy carrying some art. To the best of my knowledge no one EVER got any decent sized cash payment from the Soviet Union for any act of treason, no matter how crucial. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG TKc9QQNccF421kjpfih8YdB96RpYw17p3sjofelQ 4yBG3NNFrBGZu5Zy/GwjHsjbhkfnJhmOU2OYDAyFn From declan at well.com Sun Jul 25 09:52:56 2004 From: declan at well.com (Declan McCullagh) Date: Sun, 25 Jul 2004 11:52:56 -0500 Subject: Texas oil refineries, a White Van, and Al Qaeda In-Reply-To: <20040720170623.X29547@ubzr.zsa.bet>; from measl@mfn.org on Tue, Jul 20, 2004 at 05:10:12PM -0500 References: <017630AA6DF2DF4EBC1DD4454F8EE2971616A0@rsana-ex-hq1.NA.RSA.NET> <20040720170623.X29547@ubzr.zsa.bet> Message-ID: <20040725115256.A2578@baltwash.com> On Tue, Jul 20, 2004 at 05:10:12PM -0500, J.A. Terranson wrote: > The "parking lot" (read: makeout spot/planespotter parking, etc.) abut a > half mile from the end of the main runways at Lambert are now permanently > closed, and trying to pull over is an open invite for immediate attention. A similar parking lot about the same distance north of the runway of Washington Reagan National (and very close to the Pentagon) along the Potomac River off the parkway is sitll open. It's also used for a boat launch by politically influential Washingtonians, which might explain why it hasn't been closed. No double standards here, of course... -Declan From declan at well.com Sun Jul 25 10:38:36 2004 From: declan at well.com (Declan McCullagh) Date: Sun, 25 Jul 2004 12:38:36 -0500 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <6.0.3.0.0.20040706223732.044b3030@pop.idiom.com>; from bill.stewart@pobox.com on Wed, Jul 07, 2004 at 01:11:58AM -0700 References: <20040706214743.5D26657E2A@finney.org> <6.0.3.0.0.20040706223732.044b3030@pop.idiom.com> Message-ID: <20040725123836.B2578@baltwash.com> On Wed, Jul 07, 2004 at 01:11:58AM -0700, Bill Stewart wrote: > Google's Gmail is an interesting case. > Unlike Councilman's ISP, who were sneaky greedy wiretapping bums, > Google tells you that they'll grep your mail for advertising material, > and tells you how much of that they'll leak to the advertisers > and makes you some promises not to leak more. > The data's just sitting there waiting for a subpoena, > and there's not much point in having it all encrypted because > the cool features of Gmail aren't much use on cyphertext. FYI here's something I wrote in April... --Declan http://news.com.com/Is+Google+the+future+of+e-mail%3F/2010-1032_3-5187543.html If Google wanted to veer in a more privacy-protective direction, it could look to the intriguing model of Vancouver, Canada-based Hush Communications, which runs the Hushmail Web mail system. Unlike rivals, Hush encrypts mail sent between Hush users. It uses a Java-based technique that allows for only its intended recipient--and not Hush employees--to decrypt a scrambled e-mail message. If a subpoena arrives, or if a security breach ever happens, disclosure would be limited. Hush offers 2-megabyte-limit free accounts and pay accounts, and it said 900,000 accounts have been created since its May 1999 launch. The company also lets users store files in an encrypted volume and this week plans to announce a feature that permits encrypted volumes to be shared among multiple users. Hush's patent No. 6,154,543 covers some aspects of encrypted e-mail. The company said it'd happy to license it to Google. Originally, Hush Chief Technology Officer Brian Smith said, the patent was quite broad, but "we have narrowed the patent to apply only to e-mail and messaging systems. The modifications were accepted but don't yet appear" on the U.S. Patent and Trademark Office's Web site. True, if the archived e-mail is encrypted, Gmail won't be able to search message bodies very efficiently, but users might be willing to give up that feature and even pay a monthly charge in exchange for additional security. "We'll think about it," said Google's Rosing. "We don't have any explicit plans right now...If someone really needs to encrypt a lot of e-mail, maybe they should be putting that on their laptop. We're trying to provide a service that offers some utility to our users. If you change the service to take away all the value of the service, you're back where you started." Maybe. But until that happens, would-be users of Gmail or any similar service should recognize that their so-called free e-mail comes at a price. From pgut001 at cs.auckland.ac.nz Sat Jul 24 17:47:06 2004 From: pgut001 at cs.auckland.ac.nz (Peter Gutmann) Date: Sun, 25 Jul 2004 12:47:06 +1200 Subject: Texas oil refineries, a White Van, and Al Qaeda In-Reply-To: <20040720115246.GA25822@arion.soze.net> Message-ID: Justin writes: >HOUSTON (Reuters) - Law enforcement officials said on Monday they are looking >for a man seen taking pictures of two refineries in Texas City, Texas. At Usenix Security a few years back, we [a bunch of random security people, most of whom were foreign nationals] drove around Buckley AFB taking photos of the radomes, SCIF, etc etc. As we were doing this, we noticed a Chinese national doing the same thing. We wondered what the etiquette for this was, do we exchange business cards, offer to trade photos, etc etc? This was before 9/11, no-one took any notice of us at the time. Peter. From declan at well.com Sun Jul 25 10:54:56 2004 From: declan at well.com (Declan McCullagh) Date: Sun, 25 Jul 2004 12:54:56 -0500 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <40FB5D97.1103F6AB@cdc.gov>; from mv@cdc.gov on Sun, Jul 18, 2004 at 10:35:19PM -0700 References: <40FB5D97.1103F6AB@cdc.gov> Message-ID: <20040725125456.C2578@baltwash.com> On Sun, Jul 18, 2004 at 10:35:19PM -0700, Major Variola (ret) wrote: > You don't know about tape robots, or offline indexing, eh? FYI from a recent trip to the NSA crypto museum: http://www.mccullagh.org/image/10d-15/storagetek-automated-cartridge-system.html http://www.mccullagh.org/image/10d-15/robot-arm-tape-cartridge.html I think that was circa 1994 (I'd have to look at the high-res image to see the date on the brass plaque to be sure). -Declan From pgut001 at cs.auckland.ac.nz Sat Jul 24 17:55:21 2004 From: pgut001 at cs.auckland.ac.nz (Peter Gutmann) Date: Sun, 25 Jul 2004 12:55:21 +1200 Subject: Texas oil refineries, a White Van, and Al Qaeda In-Reply-To: Message-ID: "Tyler Durden" writes: >*: A year or two ago someone posted about the blow up of Texas City back in >the early 1950s. 1947. >Apparently, some kind of tanker hit something else and set of a chain >reaction killing thousands and wiping out the town After several earlier events (the biggest being Oppau in Germany in 1921, which left a crater the size of a city block), fire safety folk were given an incentive to discover the true chemistry of ammonium nitrate. Google for "Texas city" + Grandcamp (the ship carrying the ammonium nitrate) for the full story. Peter. From declan at well.com Sun Jul 25 11:44:39 2004 From: declan at well.com (Declan McCullagh) Date: Sun, 25 Jul 2004 13:44:39 -0500 Subject: Mexico Atty. General gets microchipped (fwd) In-Reply-To: <40F4C2AC.827EEB2D@cdc.gov>; from mv@cdc.gov on Tue, Jul 13, 2004 at 10:20:44PM -0700 References: <40F4C2AC.827EEB2D@cdc.gov> Message-ID: <20040725134439.D2578@baltwash.com> On Tue, Jul 13, 2004 at 10:20:44PM -0700, Major Variola (ret) wrote: > "No, I don't know that Atheists should be considered as > citizens, nor should they be considered patriots. This is one nation > under > God." -GW Bush Do you have a good cite for that? One source attributes it to George Bush I, not Bush II. http://www.calpundit.com/archives/001626.html -Declan From measl at mfn.org Sun Jul 25 11:54:29 2004 From: measl at mfn.org (J.A. Terranson) Date: Sun, 25 Jul 2004 13:54:29 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040725125456.C2578@baltwash.com> References: <40FB5D97.1103F6AB@cdc.gov> <20040725125456.C2578@baltwash.com> Message-ID: <20040725135302.X47156@ubzr.zsa.bet> On Sun, 25 Jul 2004, Declan McCullagh wrote: > On Sun, Jul 18, 2004 at 10:35:19PM -0700, Major Variola (ret) wrote: > > You don't know about tape robots, or offline indexing, eh? > > FYI from a recent trip to the NSA crypto museum: > http://www.mccullagh.org/image/10d-15/storagetek-automated-cartridge-system.html > http://www.mccullagh.org/image/10d-15/robot-arm-tape-cartridge.html > > I think that was circa 1994 (I'd have to look at the high-res image > to see the date on the brass plaque to be sure). > > -Declan I've actually worked with slightly more recent tech from the same company. Note the limited size of the library (300tb), and also note that seek time to any one sector on any one tape is *incredibly* long. This is strictly a near-line bulk solution - useless for anything but permanent archives with an occasional pull. -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From jya at pipeline.com Sun Jul 25 14:39:14 2004 From: jya at pipeline.com (John Young) Date: Sun, 25 Jul 2004 14:39:14 -0700 Subject: Feds and Yahoo Muzzle DNC Security Whistleblower Message-ID: It appears that the Feds and LEA at the DNC Convention have ordered Yahoo to axe the mail list TSCM-L run by James Atkinson for his blistering attack on security at the convention. http://cryptome.org/dncsec-yahoo.htm Jim's reports on the inferior security: http://cryptome.org/dnc-insec.htm http://cryptome.org/dnc-dauphine.htm The mail list had nothing to do with these reports, and the gag appears to be spite against Atkinson for whistleblowing. However, the mail list purpose is likely to have scared them more than his insecurity reports: http://finance.groups.yahoo.com/group/TSCM-L/ TSCM-L Technical Security Mailing List Dedicated to TSCM specialists engaging in expert technical and analytical research for the detection, nullification, and isolation of eavesdropping devices, wiretaps, bugging devices, technical surveillance penetrations, technical surveillance hazards, and physical security weaknesses. This also includes bug detection, bug sweep, and wiretap detection services. Special emphasis is given to detecting and countering espionage and other threats and activities directed by foreign intelligence services against the United States Government, United States corporations, establishments, and citizens. The list includes technical discussion regarding the design and construction of SCIF facilities, Black Chambers, and Screen Rooms. This list is also for discussing DIAM 50-3, NSA-65, and DCID 1/21, 1/22 compliance. The primary goal and mission of this list is to "raise the bar" and increase the level of professionalism present within the TSCM business. The secondary goal of this list is and increase the quality and effectiveness of our efforts so that we give spies and eavesdroppers no quarter, and to neutralize all of their espionage efforts. This mailing list is moderated by James M. Atkinson and sponsored by Granite Island Group as a public service to the TSCM, Counter Intelligence, and technical security community. -- From bill.stewart at pobox.com Sun Jul 25 15:39:47 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Sun, 25 Jul 2004 15:39:47 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040724184018.U41904@ubzr.zsa.bet> References: <4102D114.7F083928@cdc.gov> <20040724184018.U41904@ubzr.zsa.bet> Message-ID: <200407260316.i6Q3GPKF004615@positron.jfet.org> At 04:44 PM 7/24/2004, J.A. Terranson wrote: > > [1] the original phone phreaks were blind, > >This is a ridiculous statement, and even worse, leaks information about >your nym: [young enough to have not been there]. >You are thinking of Joe "Whistler" Joe Egressia (sp?), and the kid form >New York whose names escape me at the moment. These two do not even com >close to "the original phone phreaks were blind". More like "at least two >of the original batch of phreaks were blind". Cap'n Crunch may have bad teeth, but his eyes were fine the last time I saw him. From measl at mfn.org Sun Jul 25 20:21:48 2004 From: measl at mfn.org (J.A. Terranson) Date: Sun, 25 Jul 2004 22:21:48 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <200407260316.i6Q3GPKF004615@positron.jfet.org> References: <4102D114.7F083928@cdc.gov> <20040724184018.U41904@ubzr.zsa.bet> <200407260316.i6Q3GPKF004615@positron.jfet.org> Message-ID: <20040725222119.H47156@ubzr.zsa.bet> On Sun, 25 Jul 2004, Bill Stewart wrote: > Cap'n Crunch may have bad teeth, but his eyes were fine the last time I saw > him. Yeah, but what's left of his mind is more like what's left of his teeth :-( -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From observer at westnet.com Mon Jul 26 02:09:11 2004 From: observer at westnet.com (John F. McMullen) Date: July 26, 2004 2:09:11 PM PDT Subject: No subject Message-ID: , Peter Neumann Subject: [johnmacsgroup] Cybersecurity: they just don't get it... FYI ---------- Forwarded message ---------- From: wes_morgan at US.IBM.COM To: johnmacsgroup at yahoogroups.com Subject: [johnmacsgroup] Cybersecurity: they just don't get it... I'm watching CNN's Headline News, and they run a story on security preparations for this week's Democratic Convention in Boston. They go on, at great length, about the extensive network of cameras--approximately 75 of them, scattered around various Federal buildings and convention sites--and make it a point to illustrate how the security force, with their wireless networks and handheld devices, can grab the feed from any of these cameras at the tap of a stylus. So, they show one such device - with it's 802.11b card clearly identifiable - and show another agent viewing a webcam of the Boston Harbor shoreline - with the URL of the hosting site clearly readable. When talking about the cameras, they show several different cameras on different buildings, some of which seem fairly unusual in their architecture. I now know that they're using 802.11b, and I know the name at least one system handling the webcam feeds, and (with a bit of reconaissance) I can probably determine the position of at least one camera. So much for cybersecurity; I can't believe that the Feds even let that stuff on the air, much less that they did so without obfuscating critical information. *sigh* What were they thinking? --------------------------------------------------------------------~-> "When you come to the fork in the road, take it" - L.P. Berra "Always make new mistakes" -- Esther Dyson "Any sufficiently advanced technology is indistinguishable from magic" -- Arthur C. Clarke "You Gotta Believe" - Frank "Tug" McGraw (1944 - 2004 RIP) John F. McMullen johnmac at acm.org johnmac at computer.org johnmac at m-net.arbornet.org johnmac at tmail.com johnmac at panix.com johnmac at echonyc.com jmcmullen at monroecollege.edu johnmac at alumni.iona.edu ICQ: 4368412 Skype, AIM & Yahoo Messenger: johnmac13 http://www.westnet.com/~observer ------------------------------------- You are subscribed as eugen at leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl leitl ______________________________________________________________ ICBM: 48.07078, 11.61144 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE http://moleculardevices.org http://nanomachines.net [demime 1.01d removed an attachment of type application/pgp-signature] From justin-cypherpunks at soze.net Mon Jul 26 00:16:11 2004 From: justin-cypherpunks at soze.net (Justin) Date: Mon, 26 Jul 2004 07:16:11 +0000 Subject: Mexico Atty. General gets microchipped (fwd) In-Reply-To: <20040725134439.D2578@baltwash.com> References: <40F4C2AC.827EEB2D@cdc.gov> <20040725134439.D2578@baltwash.com> Message-ID: <20040726071611.GC22372@arion.soze.net> On 2004-07-25T13:44:39-0500, Declan McCullagh wrote: > On Tue, Jul 13, 2004 at 10:20:44PM -0700, Major Variola (ret) wrote: > > "No, I don't know that Atheists should be considered as citizens, > > nor should they be considered patriots. This is one nation under > > God." -GW Bush > > Do you have a good cite for that? One source attributes it to George > Bush I, not Bush II. I've seen it more than once identified as a quote by Bush I (GHWB, #41). http://www.positiveatheism.org/writ/ghwbush.htm The quote was (allegedly) reported by Robert I. Sherman of the American Atheist News Journal, at an informal outdoor news conference at O'Hare on August 27, 1987. -- "When in our age we hear these words: It will be judged by the result--then we know at once with whom we have the honor of speaking. Those who talk this way are a numerous type whom I shall designate under the common name of assistant professors." -- Kierkegaard, Fear and Trembling (Wong tr.), III, 112 From dailyarticle at mises.org Mon Jul 26 05:57:34 2004 From: dailyarticle at mises.org (Mises Daily Article) Date: Mon, 26 Jul 2004 08:57:34 -0400 Subject: Ten Recurring Economic Fallacies, 1774-2004 Message-ID: http://www.mises.org/fullstory.aspx?control=1568 Ten Recurring Economic Fallacies, 17742004 By H.A. Scott Trask [Posted July 26, 2004] As an American historian who knows something of economic law, having learned from the Austrians, I became intrigued with how the United States had remained prosperous, its economy still so dynamic and productive, given the serious and recurring economic fallacies to which our top leaders (political, corporate, academic) have subscribed and from which they cannot seem to free themselvesand alas, keep passing down to the younger generation. Lets consider ten. Myth #1: The Broken Window One of the most persistent is that of the broken windowone breaks and this is celebrated as a boon to the economy: the window manufacturer gets an order; the hardware store sells a window; a carpenter is hired to install it; money circulates; jobs are created; the GDP goes up. In truth, of course, the economy is no better off at all. True, there is a sudden burst of activity, and some persons have surely gained, but only at the expense of the proprietor whose window was broken, or his insurance company; and if the latter, the other policyholders who will pay higher premiums to pay for paid-out claims, especially if many have been broken. The fallacy lies in a failure to grasp what has been foregone by repair and reconstructionthe labor and capital expended, having been lost to new production. This fallacy, seemingly so simple to explain and grasp, although requiring an intellectual effort of some mental abstraction to comprehend, seems to be ineradicable. After the horrific destruction of the Twin Towers in September 2001, the media quoted academic and corporate economists assuring us that the governments response to the attacks would help bring an end to the recession. What was never mentioned was that resources devoted to repair, security, and war-fighting are resources that cannot be devoted to creating consumer goods, building new infrastructure, or enhancing our civilization. We are worse off because of 9-11. Myth #2: The Beneficence of War A second fallacy is the idea of war as an engine of prosperity. Students are taught that World War II ended the Depression; many Americans seem to believe that tax revenues spent on defense contractors (creating jobs) are no loss to the productive economy; and our political leaders continue to believe that expanded government spending is an effective way of bringing an end to a recession and reviving the economy. The truth is that war, and the preparation for it, is economically wasteful and destructive. Apart from the spoils gained by winning (if it is won) war and defense spending squander labor, resources, and wealth, leaving the country poorer in the end than if these things had been devoted to peaceful endeavors. During war, the productive powers of a country are diverted to producing weapons and ammunition, transporting armaments and supplies, and supporting the armies in the field. William Graham Sumner described how the Civil War, which he lived through, had squandered capital and labor: "The mills, forges, and factories were active in working for the government, while the men who ate the grain and wore the clothing were active in destroying, and not in creating capital. This, to be sure, was war. It is what war means, but it cannot bring prosperity." Nothing is more basic; yet it continues to elude the grasp of our teachers, writers, professors, and politicians. The forty year Cold War drained this country of much of its wealth, squandered capital, and wasted the labor of millions, whose lifetime work, whether as a soldier, sailor, or defense worker, was devoted to policing the empire, fighting its brush wars, and making weapons, instead of building up our civilization with things of utility, comfort, and beauty. Some might respond that the Cold War was a necessity, but thats not the questionalthough we now know that the CIA, in yet another massive intelligence failure, grossly overestimated Soviet military capabilities as well as the size of the Soviet economy, estimating it was twice as large and productive as it really was. The point is the wastefulness of war, and the preparation for it; and I see no evidence whatever that the American people or their leaders understand that, or even care to think about it. An awareness and comprehension of these economic realities might lead to more searching scrutiny of the aims and methods that the Bush administration has chosen for the War on Terror. Only a few days after 9-11, Rumsfeld declared that the war shall last as long as the Cold War (forty plus years), or longera claim the administration has repeated every few months since thenwithout eliciting the slightest notice or questioning from the media, the public, or the opposing party. Would that be the case, if people understand how much a second Cold War, this time with radical Islam, will cost us in lives, treasure, and foregone comfort and leisure? Myth #3: The Best Way to Finance a War is by Borrowing Beginning with the War of Independence and continuing through the War on Terror, Americans have chosen to pay for their wars by borrowing money and inflating the currency. Adam Smith believed that the war should be financed by a levy on capital. This way the people of the country understand how much the war is costing them, and then can better judge whether it is really necessary. While he conceded that borrowing might be necessary in the early part of a war, before the revenue from war taxes began to flow into the treasury, he insisted that borrowing be kept to a minimum as a temporary expedient only. Borrowing increases the costs of war in the form of interest. Inflating the currency, which often accompanies massive borrowing, as it did during the War of Independence, the War Between the States, and the War in Vietnam (just to name three), is the worst method of war finance, for it drives up prices, increases costs, enlarges debt, spawns malinvestments and speculation, and worsens the redistributive effects of war spending. In 1861, the Lincoln administration decided that the people of the north would not stand for much taxation, and that it would increase the already considerable opposition to the southern war. According to Sumner, the financial question of the day was "whether we should carry on the war on specie currency, low prices, and small imports, or on paper issues, high prices, and heavy imports?" The latter course was chosen, and the consequences were a national debt that soared from $65 million in 1860 to $27 thousand million ($2.7 billion) in 1865, and a massive redistribution of wealth to federal bondholders. In 1865, the financial question recurred. It was: "Shall we withdraw the paper, recover our specie [gold and silver coin], reduce prices, lessen imports, reduce debt, and live economically until we have made up the waste and loss of war, or shall we keep the paper as money, export all our specie which had hitherto been held in anticipation of resumption, buy foreign goods with it, and go on as if nothing had happened?" The easy route was taken again (specie payments were not resumed until 1879, fourteen years later, and almost twenty years after the 1861 suspension) and the consequences were an inflation-driven stock market and railroad boom that culminated in the panic of 1873, the failure of the House of Cook, and the Great Railway Strike of 1877, the first outbreak of large-scale industrial violence in American history. Myth #4: Deficit Spending Benefits the Economy and Government Debt Three years ago, when then treasury secretary Paul ONeill objected to the Bush administrations policy of guns, butter, and tax cuts he was told by the vice president, Dick Cheney, that, "deficits dont matter." Of course, they dont matterto him, but they matter to the country. John Maynard Keynes's prescription for curing a recession included tax cuts and increased government spending. "We are all Keynesians now" should be the new motto inscribed on the front of the Treasury building in Washington. However, Keynes taught that once the recession was over government spending should be reduced, taxes increased, and the deficit eliminated. Current American policy is to continue deficit spending after the recession is over, and to borrow in peace as well as war. One longstanding criticism of such policies is that government borrowing "crowds out" private investment, thus raising interest rates. In an era when credit creation is so easy, and interest rates remain low despite massive deficits reaching $500 billion per annum, economists no longer take this objection seriously. Another criticism is that an accumulating debt saddles future generations with a heavy burden, which is both unfair and detrimental to future growth. Once again, economists and politicians regard this objection as groundless. They reason that future generations derive benefits from deficit expendituresgreater security, more infrastructure, improved health and welfareand that since the principal need never be paid, it is not much of a burden anyway. They are wrong. By avoiding having to increase taxes, borrowing hides the price to be paid for increased government spending (the destructive diversion of capital and labor from private pursuits to government projects), and defuses potential public opposition to new or expanded government initiatives, here and abroad. It is thus both unrepublican and anti-democratic. Second, depending on how long the redemption of the principal is deferred, accumulating interest payments can double, triple, quadruple, . . . the cost of the initial expenditure (This country has never yet discharged its Civil War debt!) Third, interest payments represent a perpetual income transfer from the working public to the bondholdersa kind of regressive tax that makes the rich, richer and the poor, poorer. Finally, the debt introduces new and wholly artificial forms of uncertainty into financial markets, with everyone left to guess whether the debt will be paid through taxes, inflation, or default. Myth # 5: Government Policies to Promote Exports are a Good Idea The fallacy that government is a better judge of the most profitable modes of directing labor and capital than individuals is well illustrated by exporting policies. In the twentieth century, the federal government has sought to promote exports in various ways. The first was by forcing open foreign markets through a combination of diplomatic and military pressure, all the while keeping our own markets wholly or partially closed. The famous "open door" policy, formulated by Secretary of State John Hay in 1899 was never meant to be reciprocal (after all, he served in the McKinley administration, the most archly protectionist in American history), and it often required a gun boat and a contingent of hard charging marines to kick open the door. A second method was export subsidies, which are still with us. The Export-Import Bank was established by Roosevelt in 1934 to provide cash grants, government-guaranteed loans, and cheap credit to exporters and their overseas customers. It remains todayuntouched by "alleged" free market Republican administrations and congresses. A third method was dollar devaluation, to cheapen the selling price of American goods abroad. In 1933, Roosevelt took the country off the gold standard and revalued it at $34.06, which represented a significant devaluation. The object was to allow for more domestic inflation and to boost exports, particularly agricultural ones, which failed; now Bush is trying it. A fourth method, tried by the Reagan administration, was driving down farm prices to boost exports, thereby shrinking the trade deficit. The plan was that America would undersell its competitors, capture markets, and rake in foreign exchange. (When others do this it is denounced as unfair, as predatory trade.) What happened? Well, it turned out that the agricultural export market was rather elastic. Countries like Brazil and Argentina, depending on farm exports as one of their few sources of foreign exchange, which they desperately needed to service their debt loads, simply cut their prices to match the Americans. Plan fails. But it got worse: American farmers had to sell larger quantities (at the lower prices) just to break even. Nevertheless, although the total volume of American agricultural exports increased, their real value (in constant dollars) fellmore work, lower profits. Furthermore, farmers had to import more oil and other producer goods to expand their production, which worsened the trade deficit. Then, there were the unforeseen and deleterious side-effects. Expanded cultivation and livestock-raising stressed out and degraded the quality of the soils, polluted watersheds, and lowered the nutritional value of the expanded crop of vegetables, grains, and animal proteins. Finally, the policy of lower price/higher volume drove many small farmers, here and abroad, off the land, into the cities, and across the border, our border. Here is an economic policy that not only failed in its purpose but worsened the very problem it was intended to alleviate, and caused a nutritional, ecological, and demographic catastrophe. Myth #6: Commercial Warfare Works Sumner pointed out that the Americans declared their political independence, they had not entirely freed themselves from the fallacies of mercantilism. Mercantilists believed that government should both regulate and promote certain kinds of economic activity, the economy being neither self-regulating, nor capable of reaching maximum efficiency if left alone. Thus, in their struggle for independence, the Americans turned to two dubious policies: commercial warfare; and inflationary war finance. I wont rehash the history of the depreciating Continentalwhich led to the confiscation of property without adequate compensation, defrauded creditors, impoverished soldiers and sailors, price controls, a larger war debtbut I will point out what Sumner so amply demonstrated in his financial history of the Revolutionary War: the commercial war harmed the Americans far more than the British. In the eighteenth and nineteenth centuries, commercial war took the form of boycotts and embargoes. The idea was that by closing our markets to British goods, or by denying them our exports, agriculture and raw materials, we could coerce them, peacefully, into changing their policies. This policy worked only one time, helping to persuade the British to repeal the Stamp Act of 1765; but each time thereafter it was tried it only antagonized them and led to some form of retaliation. In 177475, on the eve of war, the Americans stood in desperate need of supplies to prepare for war, and the English offered the best goods at the best prices. By refusing to trade, hoping to coerce the British into abandoning their own Coercive Acts, the Americans began the war suffering from a supply shortage, which only grew worse; after a few years of war, they found themselves under the necessity of trading with the enemy, which was carried on through the Netherlands and the West Indian islands of Antigua and St. Eustatius. President Jeffersons embargo of 180709 was a complete fiasco. Not only did it fail to accomplish its purpose of forcing the British and French to respect our neutral commerce; it devastated the New England economy, which was dependent on commerce and ship-building, hurt southern planters (who could no longer export), reduced federal tariff revenue, and drove the New England states to the brink of secession. Myth #7: The Late Nineteenth Century was an Era of Laissez-Faire Capitalism Certainly, the late nineteenth century was not an era of laissez-faire, despite the stubborn and persistent myth to the contrary. True, there were few government regulations on business, but high tariffs, railroad subsidies, and the national banking system prove that the government was no neutral bystander. Sumner more accurately termed it the era of plutocracy, in which politically organized wealth used the power of the state for selfish advantage. He also warned, "Nowhere in the world is the danger of plutocracy as formidable as it is here." For these indiscretions, the manufacturing and bond-holding hierarchy tried to get him kicked out of Yale, where they thought he was poisoning the minds of their sons with free trade heresies. Only during two periods since 1776 has the government mostly left the economy alone: during the early years of the federal republic; and in the two decades previous to the Civil War. The political economist Condy Raguet called the first period of economic freedom, from 1783 to 1807, "the golden age" of the republic: Trade was free, taxes were low, money was sound, and Americans enjoyed more economic freedom than any other people in the world. Sumner thought the years from 1846 to 1860the era of the independent treasury, falling tariffs, and gold moneywas the true "golden age." (Historians consider the presidents during this last periodFillmore, Pierce, and Buchananas among the worst we have ever had. Yet, from 18481860, the country was at peace, the economy prosperous, taxes low, money hard, and the national debt was shrinking. This tells us how historians define political greatness. Myth #8: Business Corporations Favor a Policy of Laissez-Faire Never in the history of our country have corporations, Wall Street financiers, bond holders, and other large capitalists, as a class or interest, favored a policy of economic liberty and nonintervention by government. They have always favored some form of mercantilism. It is surely significant that the second Republican Party, founded in Michigan in 1854, was funded and led by men who wished to overthrow the libertarian desideratum of the 1840s and 50s. Of course there have been exceptions. The merchants and ship-owners of maritime New England put up a good fight for free trade and sound money in the early years of the republic, and the New York City bankers in the nineteenth century were conservative Democrats who supported free trade, low taxes, sound money, and the gold standard. But these were exceptions. Consider the testimony of William Simon, who was Secretary of the Treasury under Nixon: I watched with incredulity as businessmen ran to the government in every crisis, whining for handouts or protection from the very competition that has made this system so productive. I saw Texas ranchers, hit by drought, demanding government-guaranteed loans; giant milk cooperatives lobbying for higher price supports; major airlines fighting deregulation to preserve their monopoly status; giant companies like Lockheed seeking federal assistance to rescue them from sheer inefficiency; bankers, like David Rockefeller, demanding government bailouts to protect them from their ill-conceived investments; network executives, like William Paley of CBS, fighting to preserve regulatory restrictions and to block the emergence of competitive cable and pay TV. And always, such gentlemen proclaimed their devotion to free enterprise and their opposition to arbitrary intervention into our economic life by the state. Except, of course, for their own case, which was always unique and which was justified by their immense concern for the public interest. During the nineteenth century, those who clamored loudest and most effectively for government intervention in the economy were businessmen; of course farmers sometimes did so as well. Businessmen sought promotional policies in the form of protective tariffs, a national bank, and public funding of "internal improvements," such as turnpikes, bridges, and canals. By the 1820s, proponents of this program called it "the American System," with Senator Henry Clay of Kentucky its most prominent champion. Raguet more accurately referred to it as the "British System." Clay ran for president on this platform three times, and lost three times (1824, 1832, and 1844). His protigi, Abraham Lincoln, learned from this experience, and so when he ran for president in 1860, hoping to implement the same program, he rarely mentioned it; instead, he promised to save the western territories from the blight of slavery and to overthrow the "slave power"political camouflage that worked brilliantly. The American System was an egregious form of redistributive special-interest politics. It enriched Louisiana sugar planters, Kentucky hemp growers, New York sheep herders, Pennsylvania iron mongers, New England textile magnates, canal companies, and railroad corporationsall at the expense of planters, farmers, mechanics, and consumers. The antebellum protectionist movement reached its apogee with the tariff of 1828, doubling tax rates on dutiable imports to an average of 44 percent in 1829 and 48 percent the next year. At the time, Raguet calculated that the average American worked one month a year just to pay the tariff. To his readers, who paid no direct federal taxes at all, nor any excise taxes, this figure was shocking. In 1830, tax-freedom day was the first of February; today it is in June, rendering our tax burden five times greater. Another income transfer was affected by the vicious banking system of the time, under which incorporated bankers, without capital, charged interest for lending out pieces of paper and deposit credit, which cost them nothing except the cost of printing. Some libertarians have contended that this was the era of free banking. It was nothing of the sort. Bankers were protected under the shield of limited liability and, during financial panics and bank runs, by special laws authorizing the suspension of specie paymentswhen they refused their contractual obligation to pay specie for their notes. And their paper was accepted by the federal and state governments; whether one was buying land, paying import duties, purchasing a bond, or buying bank stock, for the government, bank paper was as good as gold. These plutocratic measures thus effected a redistribution of wealth, long before the emergence of socialism. Sumner said that the plutocrats of his own postbellum era (manufacturers, railroad barons, national bankers, and federal bond holders) were "simply trying to do what the generals, nobles, and priests have done in the pastget the power of the State into their hands, so as to bend the rights of others to their own advantage." The plutocrats of today are still at it, even more successfully, with almost no opposition. Myth #9: Hamilton Was Great Another myth is that the financial genius and economic statesmanship of Alexander Hamilton saved the credit of the infant United States and established the sound financial and economic foundation essential for future growth and prosperity. Ron Chernows hagiographic biography of Hamilton is now moving up the best seller charts, cluttering the display tables of Borders and Barnes & Noble, and taking up time on C-Spans Booknotes; but its greatest contribution will be to perpetuate the Hamilton myth for another generation. Sumners concise and devastating biography of that vainglorious puffin jay, written over a hundred years ago, remains the best. He closely studied Hamiltons letters and writings, including the big threehis Report on the Public Credit (1790), Report on a National Bank (1790), and Report on Manufactures (1791)and came to three conclusions: first, the New Yorker had never read Smiths Wealth of Nations (1776), the most important economic treatise written in the Anglo-American world in that period; second, he was a mercantilist, who would have been quite at home serving in the ministry of Sir Robert Walpole or Lord North; and third, Hamilton believed many things that are not truethat federal bonds were a form of capital; that a national debt was a national blessing; that the existence of banks increased the capital of the country; that foreign trade drained a country of its wealth, unless it resulted in a trade surplus; and that higher taxes were a spur to industry and necessary because Americans were lazy and enjoyed too much leisure. The idea here was that if you taxed Americans more, they would have to work harder to maintain their standard of living, thus increasing the gross product of the country and providing the government with more revenue to spend on grand projects and military adventures. Hamilton was once stoned by a crowd of angry New York mechanics. Is it any wonder why? Myth #10: Agrarianism or Industrialism: We Must Choose Historians teach that Americans in the 1790s and 1800s had two economic choicesHamilton and the Federalists who believed in sound money, banking, manufacturing, and economic progress, and the Jeffersonians who believed in inflation, agrarianism, and stasis. This is a gross simplification. Not all Federalists were Hamiltonian; many despised him. Hamilton dogmatically believed that the United States should become a manufacturing nation like England and that it was the duty of the federal government to bring this about by promotional policies. Jefferson, on the other hand, oscillated between liberalism and agrarianism. At his best, he was liberal, but for a long time he dogmatically believed that the United States should remain an agricultural nation, and that it was the duty of the federal government to keep it in such a state by delaying the onset of large-scale manufacturing. Hence, to expand trade, it should fight protectionist powers and hostile trading blocs, acquire more agricultural land through purchase or war, and, after obtaining the requisite amendment, fund the construction of internal improvements to foster the movement of agricultural produce to the seaports. Thus, Jefferson authored the Louisiana Purchase, the Tripolitan War, the Embargo; and his chosen successor, James Madison, the War of 1812, all designed to fulfill this agrarian vision. As president, Madison became ever-more Hamiltonian, supporting the re-establishment of the Bank of the United States, the raising of tariffs, conscription, and the appointment of nationalists to the Supreme Court. He appointed Joseph Story, which is like Ike appointing Earl Warren, or Bush appointing Souter. Meanwhile, in retirement, Jefferson advocated manufacturing to achieve national economic self-sufficiency. Why not Freedom? Besides industrialism and agrarianism, there was a third positioncall it liberalism, or laissez-fairewhich maintained that the government should promote neither manufacturing nor agriculture, but leave both alone, to prosper or not, expand or recede, according to the unerring guides of profitability, utility, individual choice, and economic law. Inspired by the writings of Adam Smith and David Ricardo, but even more those of the French radical school of Turgot, Say, and de Tracy, whose mottos laissez nous faire (leave the people alone) and ne trop gouverneur (do not govern too much) captured the essence of good government. Outstanding representatives of this liberal philosophy were the young Daniel Webster, who made his reputation for oratory with fiery speeches on behalf of free trade, hard money, and state rights as a New Hampshire congressman, and the great John Randolph of Virginia, who broke with Jefferson over the embargo and opposed the War of 1812, losing his seat as a consequence, and Condy Raguet, the influential political economist, who was the first American to develop a monetary theory of the business cycle, which he did in response to the panic of 1819. Laissez-faire was the cause of those who opposed plutocracy and supported the people. It represented both the moral high ground and sound economic reasoning. Conclusion When he was writing his masterful History of American Currency, Sumner grappled with the question of how North America had withstood levels of inflation and indebtedness that would have ruined any European country. His answer: "The future which we discount so freely honors our drafts on it. Six months [of] restraint avails to set us right, and our credit creations, as anticipations of future product of labor, become solidified." In other words, the country was so productive that the losses engendered by these excesses were quickly made up. He went on: "We often boast of the resources of our country, but we did not make the country. What ground is there for boasting here? The question for us is: What have we made of it? No one can justly appreciate the natural resources of this country until, by studying the deleterious effects of bad currency and bad taxation, he has formed some conception of how much, since the first settlers came here, has been wasted and lost." The unseen again. Let us begin with geography and resources, to which Sumner alludes. The lower 48 states are entirely in the temperate zone. Apart from the desert states of the southwest, all receive ample rainfall. Most of the land is fertile, and it is abundant. The country teems with natural resources. Then there are the people. Until very recently, the United States enjoyed a low density of population, which meant high wages and low land prices. And for centuries, the population has been one of the hardest working in the world, creating an infrastructure to build on. Then there is the culture. Largely because of the influence of Christianity, the debilitating sin of envy has no social standing here, unlike the Third World where it is perhaps the chief impediment to wealth-creation and development. Also, for the same reason, there is little bribery, which also impedes growth. Finally, there is the tradition of law, respect for private property, tradition of profit, and contractual freedom. These institutionsand not the fallacious ideas, corrupt institutions, and bad policies named aboveform the core of American prosperity. ____________________________ Historian Scott Trask is an adjunct scholar of the Mises Institute. hstrask at highstream.net. See his article archive. Discuss this article on the blog. (Note: This speech was delivered before the July meeting of the St. Louis Discussion Club, 14 July 2004.) In response to many requests, it is now possible to set your credit-card contribution to the Mises Institute to be recurring. You can easily set this up on-line with a donation starting at $10 per month. See the Membership Page. This is one way to ensure that your support for the Mises Institute is ongoing. [Print Friendly Page] Mises Email List Services Join the Mises Institute Mises.org Store Home | About | Email List | Search | Contact Us | Periodicals | Articles | Games & Fun News | Resources | Catalog | Contributions | Freedom Calendar You are subscribed as: rahettinga at earthlink.net Manage your account. Unsubscribe here or send email to this address. --- end forwarded text -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From bill.stewart at pobox.com Mon Jul 26 11:19:25 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Mon, 26 Jul 2004 11:19:25 -0700 Subject: "Terror in the Skies, Again?" In-Reply-To: <4104E277.4020508@students.bbk.ac.uk> References: <4104E277.4020508@students.bbk.ac.uk> Message-ID: <6.0.3.0.0.20040726110909.037fbab0@pop.idiom.com> At 03:52 AM 7/26/2004, ken wrote: >Assuming its true (*) the one security breach is the action of the cabin >crew member who tried to reassure this woman by going on about air >marshalls. That security breach should certainly get them sacked, and >probably interrogated by the men in cheap suits. >Or does she assume that apparently nervous middle-aged middle-class white >women can't be bombers? The flight attendant didn't identify which six people were air marshals, and since the normal number of them ranges from zero to two per flight, she was almost certainly just lying to calm down the troublesome passenger (who definitely had no class, middle or otherwise.) One of the entertaining followup items from this event was that, yes, the group of ~14 Syrian musicians were really just musicians on tour, but in fact their visas had expired about 3 weeks earlier, though the TSA thugs who interrogated them after they arrived didn't notice it. I was surprised they were musicians - I'd expected them to have been a soccer team, and I've been on enough airplanes with sports teams on them that their behavior sounds totally typical. And Middle Easterners flying out of Detroit? What a surprise! (Detroit's one of the main places that Arab immigrants move.) Anne Jacobsen, prejudiced white columnist, wrote > What I experienced during that flight has caused me to question > whether the United States of America > can realistically uphold the civil liberties of every individual, > even non-citizens, and protect its citizens from terrorist threats. And she's obviously in favor of "protection", whether or not it takes a police state to do it. From bbrow07 at students.bbk.ac.uk Mon Jul 26 03:52:39 2004 From: bbrow07 at students.bbk.ac.uk (ken) Date: Mon, 26 Jul 2004 11:52:39 +0100 Subject: "Terror in the Skies, Again?" In-Reply-To: References: Message-ID: <4104E277.4020508@students.bbk.ac.uk> Tyler Durden wrote: > Sounds to me like Al-Qaeda is just getting the most mileage they can out > of their little PR Event a couple of years ago. They don't even need to > blow up anything to get the most bang for their buck. > > Hell, in this story the biggest threat was the incompetence of the airline. Assuming its true (*) the one security breach is the action of the cabin crew member who tried to reassure this woman by going on about air marshalls. That security breach should certainly get them sacked, and probably interrogated by the men in cheap suits. Or does she assume that apparently nervous middle-aged middle-class white women can't be bombers? (*) (which it might be, US print journalistic standards are higher than our British ones - if I read this in a UK paper like the Dally Mail or the Sun I'd assume it was some rambling racist fantasy put ion as political propaganda - on the other hand our broadcast journalism is mostly better than yours, so there) From jdd at dixons.org Mon Jul 26 06:29:23 2004 From: jdd at dixons.org (Jim Dixon) Date: Mon, 26 Jul 2004 14:29:23 +0100 (BST) Subject: "Terror in the Skies, Again?" In-Reply-To: <4104E277.4020508@students.bbk.ac.uk> References: <4104E277.4020508@students.bbk.ac.uk> Message-ID: On Mon, 26 Jul 2004, ken wrote: > > Sounds to me like Al-Qaeda is just getting the most mileage they can out > > of their little PR Event a couple of years ago. They don't even need to > > blow up anything to get the most bang for their buck. > > > > Hell, in this story the biggest threat was the incompetence of the airline. > > Assuming its true (*) the one security breach is the action of the > cabin crew member who tried to reassure this woman by going on > about air marshalls. That security breach should certainly get > them sacked, and probably interrogated by the men in cheap suits. > > Or does she assume that apparently nervous middle-aged > middle-class white women can't be bombers? > > > (*) (which it might be, US print journalistic standards are > higher than our British ones - if I read this in a UK paper like > the Dally Mail or the Sun I'd assume it was some rambling racist > fantasy put ion as political propaganda - on the other hand our > broadcast journalism is mostly better than yours, so there) The article was reprinted in the News Review section of yesterday's Sunday Times (which Americans seem to prefer calling "the London Times"). -- Jim Dixon jdd at dixons.org tel +44 117 982 0786 mobile +44 797 373 7881 http://jxcl.sourceforge.net Java unit test coverage http://xlattice.sourceforge.net p2p communications infrastructure From dave at farber.net Mon Jul 26 16:44:37 2004 From: dave at farber.net (David Farber) Date: Mon, 26 Jul 2004 16:44:37 -0700 Subject: [IP] Cybersecurity: they just don't get it... Message-ID: Begin forwarded message: From pique at netspace.net.au Mon Jul 26 02:23:13 2004 From: pique at netspace.net.au (Tim Benham) Date: Mon, 26 Jul 2004 19:23:13 +1000 Subject: cypherpunks-digest V1 #13888 In-Reply-To: <200407260525.i6Q5PNnm013956@waste.minder.net> References: <200407260525.i6Q5PNnm013956@waste.minder.net> Message-ID: <200407261923.13776.pique@netspace.net.au> > Date: Sun, 25 Jul 2004 15:39:47 -0700 > From: Bill Stewart > Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto > proxies > > At 04:44 PM 7/24/2004, J.A. Terranson wrote: > > > [1] the original phone phreaks were blind, > > > >This is a ridiculous statement, and even worse, leaks information about > >your nym: [young enough to have not been there]. > >You are thinking of Joe "Whistler" Joe Egressia (sp?), and the kid form > >New York whose names escape me at the moment. These two do not even com > >close to "the original phone phreaks were blind". More like "at least two > >of the original batch of phreaks were blind". > > Cap'n Crunch may have bad teeth, but his eyes were fine the last time I saw > him. Who stole the Cap'n's mind? was it the Fedz?? :?) TimB From s.schear at comcast.net Mon Jul 26 23:13:34 2004 From: s.schear at comcast.net (Steve Schear) Date: Mon, 26 Jul 2004 23:13:34 -0700 Subject: Downloading for Democracy In-Reply-To: <20040727032441.GS1174@leitl.org> References: <20040727032441.GS1174@leitl.org> Message-ID: <6.0.1.1.0.20040726231047.05e2f320@mail.comcast.net> By Kim Zetter 02:00 AM Jul. 19, 2004 PT http://www.wired.com/news/politics/0,1283,64237,00.html While legislators in Washington work to outlaw peer-to-peer networks, one website is turning the peer-to-peer technology back on Washington to expose its inner, secretive workings. But outragedmoderates.org isn't offering copyright music and videos for download. The site, launched two weeks ago, has aggregated more than 600 government and court documents to make them available for download through the Kazaa, LimeWire and Soulseek P2P networks in the interest of making government more transparent and accountable. From eugen at leitl.org Mon Jul 26 20:24:42 2004 From: eugen at leitl.org (Eugen Leitl) Date: Tue, 27 Jul 2004 05:24:42 +0200 Subject: [IP] Cybersecurity: they just don't get it... (fwd from dave@farber.net) Message-ID: <20040727032441.GS1174@leitl.org> ----- Forwarded message from David Farber ----- From bill.stewart at pobox.com Tue Jul 27 09:10:21 2004 From: bill.stewart at pobox.com (Bill Stewart) Date: Tue, 27 Jul 2004 09:10:21 -0700 Subject: [Meetingpunks] SF Bay Area Cypherpunks August 2004 Physical Meeting Announcement Message-ID: <200407271610.i6RGAr6g060304@outlier.minder.net> Rick Moen suggested we have a Cypherpunks meeting in August, so: SF Bay Area Cypherpunks August 2004 Physical Meeting Announcement General Info: DATE: Saturday 14 August 2004 TIME: 12:00 - 5:00 PM (Pacific Time) PLACE: Stanford University Campus - Tressider Union courtyard Agenda: "Our agenda is a widely-held secret." (This will be our first meeting since April 2003, so the agenda is somewhat up for grabs. Among upcoming events to note is the 7th annual Information Security Conference, aka ISC04, Sept. 27-29 at Xerox PARC, http://isc04.uncc.edu/ . Also of note: Our friendly Federalistas seem to be imposing unprecedented visa restrictions on visiting foreign cryptographers. Is it time for all international cryptography conferences to move off-shore? See: http://www.schneier.com/crypto-gram-0407.html#3 ) As usual, this is an "Open Meeting on US Soil", and the public is invited. Location Info: The meeting location will be familiar to those who've been to our outdoor meetings before, but for those who haven't been, it's on the Stanford University campus, at the tables outside Tressider Union, at the end of Santa Theresa, just west of Dinkelspiel Auditorium. We meet at the tables on the west side of the building, inside the horseshoe "U" formed by Tresidder. Ask anyone on campus where Tressider is and they'll help you find it. Food and beverages are available at the cafe inside Tresidder. Location Maps: Stanford Campus (overview; Tressider is dead-center). http://campus-map.stanford.edu/campus_map/bldg.jsp?cx=344&cy=471&zoomto=50&zoomfrom=30&bldgID=02-300 Tressider Union (zoomed detail view). http://campus-map.stanford.edu/campus_map/results.jsp?bldg=Tresidder Printable Stanford Map (407k). http://www.stanford.edu/home/visitors/campus_map.pdf [ This announcement sent to the following mailing lists: cypherpunks-announce at toad.com, meetingpunks at cryptorights.org, cypherpunks-request at minder.net, cryptography-request at metzdowd.com Mailing list complaints or address corrections to bill.stewart at pobox.com. ] ---- Bill Stewart bill.stewart at pobox.com _______________________________________________ Meetingpunks mailing list Meetingpunks at lists.cryptorights.org http://lists.cryptorights.org/mailman/listinfo/meetingpunks ---- Bill Stewart bill.stewart at pobox.com From ptrei at rsasecurity.com Tue Jul 27 07:28:09 2004 From: ptrei at rsasecurity.com (Trei, Peter) Date: Tue, 27 Jul 2004 10:28:09 -0400 Subject: DES: Now 'really most sincerely dead' Message-ID: <017630AA6DF2DF4EBC1DD4454F8EE2971616BA@rsana-ex-hq1.NA.RSA.NET> Back in late 1996, I wrote to Jim Bidzos, proposing an RSA Challenge to break single DES by brute force computation. Later in 1997, the first DES Challenge was successfully completed. Its taken another 7 years, but NIST has finally pulled single DES as a supported mode. Favorite line: "DES is now vulnerable to key exhaustion using massive, parallel computations." Triple DES is still a supported mode, as it should be. So, if a product claims to use DES for protection, you can now officially diss them for it. Peter Trei ------------------------------------------ http://edocket.access.gpo.gov/2004/04-16894.htm [Federal Register: July 26, 2004 (Volume 69, Number 142)] [Notices] [Page 44509-44510] >From the Federal Register Online via GPO Access [wais.access.gpo.gov] [DOCID:fr26jy04-31] ----------------------------------------------------------------------- DEPARTMENT OF COMMERCE National Institute of Standards and Technology [Docket No. 040602169-4169-01] Announcing Proposed Withdrawal of Federal Information Processing Standard (FIPS) for the Data Encryption Standard (DES) and Request for Comments AGENCY: National Institute of Standards and Technology (NIST), Commerce. ACTION: Notice; request for comments. ----------------------------------------------------------------------- SUMMARY: The Data Encryption Standard (DES), currently specified in Federal Information Processing Standard (FIPS) 46-3, was evaluated pursuant to its scheduled review. At the conclusion of this review, NIST determined that the strength of the DES algorithm is no longer sufficient to adequately protect Federal government information. As a result, NIST proposes to withdraw FIPS 46-3, and the associated FIPS 74 and FIPS 81. Future use of DES by Federal agencies is to be permitted only as a component function of the Triple Data Encryption Algorithm (TDEA). TDEA may be used for the protection of Federal information; however, NIST encourages agencies to implement the faster and stronger algorithm specified by FIPS 197, Advanced Encryption Standard (AES) instead. NIST proposes issuing TDEA implementation guidance as a NIST Recommendation via its ``Special Publication'' series (rather than as a FIPS) as Special Publication 800-67, Recommendation for Implementation of the Triple Data Encryption Algorithm (TDEA). DATES: Comments on the proposed withdrawal of DES must be received on or before September 9, 2004. ADDRESSES: Official comments on the proposed withdrawal of DES may either be sent electronically to DEScomments at nist.gov or by regular mail to: Chief, Computer Security Division, Information Technology Laboratory, ATTN: Comments on Proposed Withdrawal of DES, 100 Bureau Drive, Stop 8930, National Institute of Standards and Technology, Gaithersburg, MD 20899-8930. FOR FURTHER INFORMATION CONTACT: Mr. William Barker (301) 975-8443, wbarker at nist.gov, National Institute of Standards and Technology, 100 Bureau Drive, STOP 8930, Gaithersburg, MD 20899-8930. SUPPLEMENTARY INFORMATION: In 1977, the Federal government determined that, while the DES algorithm was adequate to protect against any practical attack for the anticipated 15-year life of the standard, DES would be reviewed for adequacy every five years. DES is now vulnerable to key exhaustion using massive, parallel computations. The current Data Encryption Standard (FIPS 46-3) still permits the use of DES to protect Federal government information. Since the strength of the original DES algorithm is no longer sufficient to adequately protect Federal government information, it is necessary to withdraw the standard. In addition, NIST proposes the simultaneous withdrawal of FIPS 74, Guidelines for Implementing and Using the NBS Data Encryption Standard and FIPS 81, DES Modes of Operation. FIPS 74 is an implementation guideline specific to the DES. An updated NIST Special Publication 800- 21, Guideline for Implementing Cryptography in the Federal Government, will provide generic implementation and use guidance for NIST-approved block cipher algorithms (e.g., TDEA and AES). Because it is DES- specific, and DES is being withdrawn, the simultaneous withdrawal of FIPS 74 is proposed. FIPS 81 defines four modes of operation for the DES that have been used in a wide variety of applications. The modes specify how data is to be encrypted (cryptographically protected) [[Page 44510]] and decrypted (returned to original form) using DES. The modes included in FIPS 81 are the Electronic Codebook (ECB) mode, the Cipher Block Chaining (CBC) mode, the Cipher Feedback (CFB) mode, and the Output Feedback (OFB) mode. NIST Special Publication 800-38A, Recommendation for Block Cipher Modes of Operation, specifies modes of operation for generic block ciphers. Together with an upcoming message authentication code recommendation, SP 800-38B, SP 800-38A is a functional replacement for FIPS 81. FIPS 81 is DES-specific and is proposed for withdrawal along with FIPS 46-3 and FIPS 74. NIST invites public comments on the proposed withdrawal of FIPS 46- 3, FIPS 74 and FIPS 81. After the comment period closes, NIST will analyze the comments and make appropriate recommendations for action to the Secretary of Commerce. Future use of FIPS 46-3 by Federal agencies is proposed to be permitted only as a component function of the Triple Data Encryption Algorithm or ``TDEA.'' TDEA encrypts each block three times with the DES algorithm, using either two or three different 56-bit keys. This approach yields effective key lengths of 112 or 168 bits. TDEA is considered a very strong algorithm. The original 56-bit DES algorithm can be modified to be interoperable with TDEA. Though TDEA may be used for several more years to encourage widespread interoperability, NIST instead encourages agencies to implement the stronger and more efficient algorithm specified by FIPS 197, Advanced Encryption Standard (AES) when building new systems. TDEA implementation guidance will be issued as a NIST Recommendation rather than as a FIPS. NIST plans to issue TDEA as Special Publication 800-67, Recommendation for Implementation of the Triple Data Encryption Algorithm (TDEA). Authority: Federal Information Processing Standards Publications (FIPS PUBS) are issued by the National Institute of Standards and Technology after approval by the Secretary of Commerce pursuant to section 5131 of the Information Technology Management Reform Act of 1996 and the Federal Information Security Management Act of 2002, Public Law 107-347. E.O. 12866: This notice has been determined not to be significant for purposes of E.O. 12866. Dated: July 18, 2004. Hratch Semerjian, Acting Director, NIST. [FR Doc. 04-16894 Filed 7-23-04; 8:45 am] From camera_lumina at hotmail.com Tue Jul 27 12:52:40 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Tue, 27 Jul 2004 15:52:40 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: Variola wrote... >>While this cannot be discounted in toto, the tech comes to them from >>academia (most of the time), so generally, if you are widely read, you'll >>have a pretty good idea of what's *possible*. You are likely dead-on >>accurate about the fabs though. >In the *public* lit. Well, perhaps but perhaps not. Burst-mode signaling, transceivers, and networking technology are a good example. If you see DISA, NSA, and DARPA all working with the acknoledged experts inthe academic field, and if you see them spending $$$ on burst-mode testbeds, then it's clear that there are some issues they haven't solved. Of course, they may not be the issues WE think they are, but you get some idea. What that also hints at is that they can't actually always backhaul EVERYTHING. Their interest in burst-mode indicates they still view bandwidth as an obstacle (and not dark fiber, but actual lit bandwidth). Of course, their bandwidth "problem" is probably at orders of magnitude greater than we'd consider a problem, but their continued interest in burst mode probably indicates there are times when they have huge amounts of data that needs to get through i a short amount of time, and they don't want to clog up a channel. >Fair 'nuff. You know that 5 year predictions are too conservative, and >20 year predictions too liberal. Ask Orwell. Well, there's the famous Adaptive Optics story centered around bringing Manua Kea online. When the Manua Kea designers were trying to solve some of the big issues ca. 1988, the military (as part of one of their dual-use programs) declassified Laser Guidestar research they had done in 1962! In other cases you can, however, take a reasonably good guess. Remember, during the bubble there was billions poured in by the private sector in making lasers more efficient, smaller, etc...There just happen to be physical limitations. But I have zero doubt that the NSA can't make a laser that is siginificantly more efficient than what I can buy off the shelf. >You think subs are just toys? Actually, this is a most interesting point. Those cables are not merely giant rubber hoses running around on the sea floor...the telecom equipment is actually powered via an electrical layer in the cable sheath. And then remember that there are lots of fibers in any one of those cables, and that the signal therein might easily need to be amplified due to splice losses. So that Sub (which I know exists) must really be something to see. Almost makes me want to join the dark side! (Oh yeah, come to think of it I did actually work on an NSA project that examined some undersea optical component failures out of one of their networks. From the components we looked at, I can only guess what their network topology must have been (OC-3 ATM, BTW), but I can only take vague guesses as to what it must do). -TD _________________________________________________________________ Dont just search. Find. Check out the new MSN Search! http://search.msn.click-url.com/go/onm00200636ave/direct/01/ From ecc at crypto.rub.de Tue Jul 27 09:15:49 2004 From: ecc at crypto.rub.de (ECC 2004) Date: Tue, 27 Jul 2004 18:15:49 +0200 Subject: ECC 2004 Message-ID: ========================================================================= ------------------------------------------------------------------------- THE 8TH WORKSHOP ON ELLIPTIC CURVE CRYPTOGRAPHY (ECC 2004) Ruhr-University Bochum, Germany September 20, 21 & 22, 2004 FOURTH ANNOUNCEMENT 27th July , 2004 This announcement lists one more hotel. Note that meanwhile there are more details available on the summer school. -------------------------------------------------------------------------- ECC 2004 is the eighth in a series of annual workshops dedicated to the study of elliptic curve cryptography and related areas. The main themes of ECC 2004 will be: - The discrete logarithm problem. - Efficient parameter generation and point counting. - Provably secure cryptographic protocols. - Efficient software and hardware implementation. - Side-channel attacks. - Deployment of elliptic curve cryptography. It is hoped that the meeting will continue to encourage and stimulate further research on the security and implementation of elliptic curve cryptosystems and related areas, and encourage collaboration between mathematicians, computer scientists and engineers in the academic, industry and government sectors. There will be approximately 15 invited lectures (and no contributed talks), with the remaining time used for informal discussions. There will be both survey lectures as well as lectures on latest research developments. SPONSORS: BSI - Bundesamt f|r Sicherheit in der Informationstechnik Bundesdruckerei GmbH DFG-Graduate School on Cryptography ECRYPT - European Network of Excellence in Cryptography ESCRYPT - Embedded Security GTEM - European Research Training Network Ruhr-University Bochum University of Duisburg Essen, Campus Essen University of Waterloo ORGANIZERS: Gerhard Frey (University of Duisburg-Essen) Tanja Lange (Ruhr-University Bochum) Alfred Menezes (University of Waterloo) Christof Paar (Ruhr-University Bochum) Scott Vanstone (University of Waterloo) CONFIRMED SPEAKERS: Roberto Avanzi (University of Duisburg-Essen, Germany) The state of HEC efficient implementation Paulo Barreto (Scopus Tecnologia and University of Sao Paulo, Brazil) The Well-Tempered Pairing Ming-Deh Huang (University of Southern California, USA) Global methods for discrete logarithm problems Pierrick Gaudry (LIX Paris, France) Discrete logarithm in elliptic curves over extension fields of small degree Marc Joye (Gemplus, France) Secure Implementation of Elliptic Curve Cryptography Norbert Luetkenhaus (University of Erlangen, Germany) Quantum Key Distribution - Chances and Restrictions Kim Nguyen (Bundesdruckerei, Germany) Cryptography & Travel documents Alexander May (University of Paderborn, Germany) New RSA Vulnerabilities using Coppersmith's Method Wayne Raskind (University of Southern California, USA) (see Ming-Deh Huang) Matt Robshaw (Royal Holloway University of London, UK) The Advanced Encryption Standard: A Four Year Anniversary Werner Schindler (BSI, Germany) Optimizing the Efficiency of Side-Channel Attacks with Advanced Stochastical Methods Jasper Scholten (KU Leuven, Belgium) Cover attacks on trace-zero groups Hovav Shacham (Stanford University, USA) A New Life for Group Signatures Igor Shparlinski (Macquarie University, Australia) Pseudorandom Points on Elliptic Curves Nigel Smart (University of Bristol, UK) The link between ECDHP and ECDLP revisited Thomas Wollinger (Ruhr-University Bochum, Germany) Hardware Implementation of Hyperelliptic Curve Cryptosystems SUMMER SCHOOL ON ELLIPTIC CURVE CRYPTOGRAPHY: For the first time the ECC workshop will be held together with a summer school on elliptic curve cryptography. This summer school is organized by VAMPIRE, the Virtual Application and Implementation Research Lab within the European project ECRYPT www.ecrypt.eu.org The school will take place September 13.-17.th in the Ruhr-University Bochum. Our target audience are students, PhD students and practitioners with background in applications and industry. It would be nice if you could guide interested people to the summer school web-page: www.rub.de/itsc/tanja/summerschool ---------------------------------------------------------------------- LOCAL ARRANGEMENTS AND REGISTRATION: Bochum is situated approximately 50 km from Dusseldorf International Airport and about 300 km from Frankfurt Airport. Participants should plan to arrive on September 19 to be able to attend the lectures on Monday morning. If you did not receive this announcement by email and would like to be added to the mailing list for the third announcement, please send a brief email to ecc at crypto.rub.de. The announcements are also available from the web site www.cacr.math.uwaterloo.ca/conferences/2004/ecc2004/announcement.html ----------------------------------------------------------------------- REGISTRATION: The website for registration is open and can be found at: http://www.ruhr-uni-bochum.de/hgi/tanja.html For this year the full conference fee is 170 EUR, we offer a reduced fee of 80 EUR for students. Please register as soon as possible as the number of participants is limited. ---------------------------------------------------------------------- ACCOMMODATIONS: We set aside a number of rooms on a first-come first-serve basis at following hotels. To get the prices listed below include the respective quotations when making your reservation Hotel Acora http://www.acora.de/html/bochum.html Tel.: (+49)234 68 96 0 Fax: (+49)234 68 96 700 Nordring 44-50 (center of Bochum) single 66,50 EUR double 80,50 EUR both including breakfast mention "ECC-Workshop" These rooms are set aside till 30.07.2004. Holiday Inn Bochum http://www.ichotelsgroup.com/h/d/hi/394/de/hd/bocge Tel.: 49-234-9690 Fax: 49-234-9692222 Massenbergstrasse 19-21 (center, close to main station) single 85,00 EUR incl. breakfast mention "ECC-Workshop" These rooms are set aside till 13.08.2004. Hotel Haus Oekey http://www.oekey.de/ Tel.: (+49)234 388 13 0 Fax: (+49)234 388 13 88 Auf dem Alten Kamp 10 (halfway between university and city center) single 52 EUR double 70 EUR both including breakfast mention "Ruhr-University, Lange" These rooms are set aside till 10.08.2004. Hotel IBIS am Hauptbahnhof http://www.ibishotel.com Tel.: (+49)234/91430 Fax : (+49)234/680778 Kurt- Schumacher- Platz 13-15 (next to main station) single 58 EUR double 67 EUR (The prices include breakfast for 9 EUR.) The fee includes free public transport in Bochum mention "ECC" These rooms are set aside till 12.08.2004. Hotel Kolpinghaus http://www.kolpinghaus-bochum.de/html/hotel.html Maximilian-Kolbe-Str. 14-18 (close to main station, center) single 46 EUR double 24 EUR including breakfast. Facilities include linen and have communal bathrooms on each floor. Please make your booking via Tanja Lange lange at itsc.rub.de and mention with whom you would like to share a room. These rooms are available till 09.08.2004. Other hotels can be found at http://www.bochum.de/english/ http://www.bochum.de/bochum/bohotel.htm (the hotel page is available in German only) ========================================================================== FURTHER INFORMATION: For further information, please contact: Tanja Lange Information Security and Cryptography Ruhr-University Bochum e-mail: ecc at crpyto.rub.de Fax: +49 234 32 14430 Tel: +49 234 32 23260 ========================================================================== ------------------------------------------------------- ------------------------------------------------------- --- end forwarded text -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From lloyd at randombit.net Tue Jul 27 15:50:49 2004 From: lloyd at randombit.net (Jack Lloyd) Date: Tue, 27 Jul 2004 18:50:49 -0400 Subject: NSA crypto at DNC? Message-ID: <20040727225049.GA14909@acm.jhu.edu> http://www.nytimes.com/2004/07/26/business/26verizon.html "Nextel, the official mobile provider to both conventions, is deploying its iDEN network with encryption codes used by the National Security Agency to make sure no one eavesdrops on all the deal making." Anyone know what's up with this? I'm guessing this just means AES, or maybe Skipjack, but it would be interesting (and very strange) if they were using BATON or JUNIPER. -Jack From DaveHowe at gmx.co.uk Tue Jul 27 18:11:54 2004 From: DaveHowe at gmx.co.uk (Dave Howe) Date: Wed, 28 Jul 2004 02:11:54 +0100 Subject: X-Cypher, SIP VoIP, stupid propriatory crapola Message-ID: <4106FD5A.90404@gmx.co.uk> Particularly disgusted by the last paragraph.... |http://www.visual-mp3.com/review/14986.html | | X-Cipher - Secure Encrypted Communications | |The Internet is a wonderful shared transmission technology, allowing |any one part of the Internet to communicate to any other part of the |Internet. Like any technology, it is neither inherently good nor bad |but can be put to use for either purpose. | |X-Cipher can be used to make regular VoIP calls on any SIP network and |can also be used to make Highly Secure VoIP calls between X-Cipher |users. | |The X-Cipher Service includes: |- X-Cipher Softphone |- MD5 or SHA1 challenges |- 3DES or AES 128, 192 or 256 bit encryption |- Crypto safe random generators |- X-Cipher to X-Cipher encryption |- X-Tunnels NAT traversal functionality | |Eliminate Eavesdropping |X-Cipher is designed to combat the negative aspects of Voice Over IP. |X-Cipher ensures all voice stream data is encrypted using strong AES or |Triple DES encryption. Furthermore, X-Cipher establishes and validates |the identity of parties communicating. While voice data can be |intercepted intentionally or accidentally, it can't be understood, as |it can't be readily decrypted. | |With encryption comes the problem of either managing public/private |keys, which must be kept secret, or the annoyance of transmitting a |secure key to a remote party over other secure methods. X-Cipher |eliminates these issues. No public/private keys exist to guard and keep |safe and worry about theft and reuse. Each conversation through |X-Cipher gets a unique secure key generated by an X-Cipher server using |strong Crypto random safe algorithms. From dailyarticle at mises.org Wed Jul 28 05:55:15 2004 From: dailyarticle at mises.org (Mises Daily Article) Date: Wed, 28 Jul 2004 08:55:15 -0400 Subject: The Cultural and Spiritual Legacy of Fiat Inflation Message-ID: http://www.mises.org/fullstory.aspx?control=1570 The Cultural and Spiritual Legacy of Fiat Inflation by J.G. H|lsmann [Posted July 28, 2004] The notion that inflation is harmful is a staple of economic science. But most textbooks underrate the extent of the harm, because they define inflation much too narrowly as a lasting decrease of the purchasing power of money (PPM), and also because they pay scant attention to the concrete forms of inflation. To appreciate the disruptive nature of inflation in its full extent we must keep in mind that it springs from a violation of the fundamental rules of society. Inflation is what happens when people increase the money supply by fraud, imposition, and breach of contract. Invariably it produces three characteristic consequences: (1) it benefits the perpetrators at the expense of all other money users; (2) it allows the accumulation of debt beyond the level debts could reach on the free market; and (3) it reduces the PPM below the level it would have reached on the free market. While these three consequences are bad enough, things get much worse once inflation is encouraged and promoted by the state (fiat inflation). The governments fiat makes inflation perennial, and as a result we observe the formation of inflation-specific institutions and habits. Thus fiat inflation leaves a characteristic cultural and spiritual stain on human society. In what follows, we will take a closer look at some aspects of this legacy. I. Hyper-Centralized Government Inflation benefits the government that controls it, not only at the expense of the population at large, but also at the expense of all secondary and tertiary governments. It is a well-known fact that the European kings, during the rise of their nation states in the 17th and 18th centuries, crushed the major vestiges of intermediate power. The democratic nation states of the 19th and 20th centuries completed the centralization of power that had been begun under the kings. The economic driving force of this process was inflation, which at that point was entirely in the hands of the central state apparatus. More than any other economic reason, it made the nation state irresistible. And thus it contributed, indirectly at least, to the popularity of nationalistic ideologies, which in the 20th century ushered into a frenetic worshipping of the nation state. Inflation spurs the growth of central governments. It allows these governments to grow larger than they could become in a free society. And it allows them to monopolize governmental functions to an extent that would not occur under a natural production of money. This comes at the expense of all forms of intermediate government, and of course at the expense of civil society at large. The inflation-sponsored centralization of power turns the average citizen more and more into an isolated social atom. All of his social bonds are controlled by the central state, which also provides most of the services that formerly were provided by other social entities such as family and local government. At the same time, the central direction of the state apparatus is removed from the daily life of its protigis. II. Fiat Inflation and War Among the most gruesome consequences of fiat money, and of paper money in particular, is its ability to extend the length of wars. The destructions of war have the healthy effect of cooling down initial war frenzies. The more protracted and destructive a war becomes, therefore, the less is the population inclined to support it financially through taxes and the purchase of public bonds. Fiat inflation allows the government to ignore the fiscal resistance of its citizens and to maintain the war effort on its present level, or even to increase that level. The government just prints the notes it needs to buy cannons and boots. This is exactly what happened in the two world wars of the 20th century, at least in the case of the European states. The governments of France, Germany, Italy, Russia, and the United Kingdom covered a large part of their expenses through inflation. It is of course difficult to evaluate any precise quantitative impact, but it is not unreasonable to assume that fiat inflation prolonged both wars by many months or even one or two years. If we consider that the killings have reached their climax toward the end of the war, we must assume that many millions of lives could have been saved. Many people believe that, in war, all means are just. In their eyes, fiat inflation is legitimate as a means to fend off lethal threats from a nation. But this argument is rather defective. It is not the case that all means are just in a war. There is in Catholic theology a theory of just war, which stresses exactly this point. Fiat inflation would certainly be illegitimate if less offensive means were available to attain the same end. And fact is that such means exist and have always been at the disposition of governments, for example, credit money and additional taxation. Another typical line of defense of fiat money in wartime is that the government might know better than the citizens just how close victory is at hand. The ignorant population grows weary of the war and tends to resist additional taxation. But the government is perfectly acquainted with the situation. Without fiat money, its hands would be tied up, with potentially disastrous consequences. The inflation just gives it the little extra something needed to win. It is of course conceivable that the government is better informed than its citizens. But it is difficult to see why this should be an obstacle in war finance. The most essential task of political leadership is to rally the masses behind its cause. Why should it be impossible for a government to spread its better information, thus convincing the populace of the need for additional taxes? This brings us to the following consideration. III. Inflation and Tyranny War is just the most extreme case in which fiat inflation allows governments to pursue their goals without genuine support from their citizens. The printing press allows the government to tap the property of its people without having obtained their consent, and in fact against their consent. What kind of government is it that arbitrarily takes the property of its citizens? Aristotle and many other political philosophers have called it tyranny. And monetary theorists from Oresme to Mises have pointed out that fiat inflation, considered as a tool of government finance, is the characteristic financial technique of tyranny. IV. Race to the Bottom in Monetary Organization As Austrian economists have argued in some detail, fiat inflation is an inherently unstable way of producing money because it turns moral hazard and irresponsibility into an institution. The result is frequently recurring economic crises. Past efforts to repair these unwelcome effects, yet without questioning the principle of fiat inflation per se, have entailed a peculiar evolution of monetary institutionssome sort of an institutional "race to the bottom." Important milestones of this process were fractional-reserve banking, national central banking, international central banking, and finally paper money. The devolution of monetary institutions has been on its way for centuries, and it has still not quite reached the absolute bottom, even though the process has accelerated very considerably in our age of paper money. V. Business Under Fiat Inflation Fiat inflation has a profound impact on corporate finance. It makes liabilities (credits) cheaper than they would be on a free market. This prompts entrepreneurs to finance their ventures to a greater extent than otherwise through credits, rather than through equity (the capital brought into the firm by its owners). In a natural system of money production, banks would grant credit only as financial intermediaries. That is, they could lend out only those sums of money that they had either saved themselves or which other people had saved and then lent to the banks. The bankers would of course be free to grant credits under any terms (interest, securities, duration) they like; but it would be suicidal for them to offer better terms than those that their own creditors had granted them. For example, if a bank receives a credit at 5 percent, it would be suicidal for it to lend this money at 4 percent. It follows that on a free market, profitable banking is constrained within fairly narrow limits, which in turn is determined by the savers. It is not possible for a bank to stay in business and to offer better terms than the savers who are most ready to part with their money for some time. But fractional-reserve banks can do precisely that. Since they can produce additional banknotes at virtually zero cost, they can grant credit at rates that are lower than the rates that would otherwise have prevailed. And the beneficiaries will therefore finance some ventures through debts that they would otherwise have financed with their own money, or which they would not have started at all. Paper money has very much the same effect, but in a far greater dimension. A paper-money producer can grant credits to virtually any extent and at virtually any terms. In the past few years, the Bank of Japan has offered credits at 0 percent interest, and it right now proceeds in some cases to actually pay people for taking its credits. It is obvious that few firms can afford to resist such offers. Competition is fierce in most industries, and the firms must seek to use the best terms available, lest they lose that "competitive edge" that can be decisive for profits and also for mere survival. It follows that fiat inflation makes business more dependent on banks than they otherwise would be. It creates greater hierarchy and central decision-making power than would exist on the free market. The entrepreneur who operates with 10 percent equity and 90 percent debts is not really an entrepreneur anymore. His creditors (usually bankers) are the true entrepreneurs who make all essential decisions. He is just a more or less well-paid executivea manager. Thus fiat inflation reduces the number of true entrepreneursindependent men who operate with their own money. Such men still exist in astonishing numbers, but they can only survive because their superior talents match the inferior financial terms with which they have to cope. They must be more innovative and/or work harder than their competitors. They know the price of independence and they are ready to pay it. Usually they are more attached to the family business and care more for their employees than the puppets of bankers. Because credits springing from fiat inflation provide an easy financial edge, they have the tendency to encourage reckless behavior by the chief executives. This is especially the case with managers of large corporations who have easy access to the capital markets. Their recklessness is often confused with innovativeness. The economist Josef Schumpeter has famously characterized fractional-reserve banking as some sort of a mainspring of innovative economic development, because it provides additional money for entrepreneurs with great ideas. It is conceivable that in some cases it played this role, but the odds are overwhelmingly on the other side. As a general rule, any new product and any thoroughgoing innovation in business organization is a threat for banks, because they are already more or less heavily invested in established companies, which produce the old products and use the old forms of organization. They have therefore every incentive to either prevent the innovation by declining to finance it, or to communicate the new ideas to their partners in the business world. Thus, factional-reserve banking makes business more conservative than it otherwise would be. It benefits the established firms at the expense of innovative newcomers. Innovation is much more likely to come from independent businessmen, especially if income taxation is low. VI. The Debt Yoke Some of the foregoing considerations also apply outside of the business world. Fiat inflation provides easy credits not only to governments and firms, but also to private persons. The mere fact that such credits are offered at all incites some people to go into debt who would otherwise have chosen not to do so. But easy credits become nearly irresistible in connection with another typical consequence of inflation, namely, the constantly rising price level. Whereas in former times the increase of prices has been barely noticeable, in our day all citizens of the western world are aware of the phenomenon. In countries such as Turkey or Brazil, where prices increase at annual rates of 80 to 100 percent, even younger people have personally experienced it. Such conditions impose a heavy penalty on cash savings. In the old days, saving was typically done in the form of hoarding gold and silver coins. It is true that such hoards did not provide any revenuethe metal was "barren"and that they therefore did not lend themselves to the lifestyle of rentiers. But in all other respects money hoards were a reliable and effective form of saving. Their purchasing power did not just evaporate in a few decades, and in times of economic growth they even gained some purchasing power. Most importantly, they were extremely suitable for ordinary people. Carpenters, masons, tailors, and farmers are usually not very astute observers of the international capital markets. Putting some gold coins under their pillow or into a safe deposit box saved them lots of sleepless nights, and it made them independent of financial intermediaries. Now compare this old-time scenario with our present situation. The contrast could not be starker. It would be completely pointless in our day to hoard dollar or euro notes to prepare for retirement. A man in his thirties who plans to retire thirty years from today (2004) must calculate with a depreciation factor in the order of 3. That is, he needs to save three dollars today to have the purchasing power of one of these present-day dollars when he retires. And the estimated depreciation factor of 3 is rather on the low side! It follows that the rational saving strategy for him is to go into debt in order to buy assets the price of which will increase with the inflation. This is exactly what happens today in most western countries. As soon as young people have a job and thus a halfway stable source of revenue, they take a credit to buy a housewhereas their great-grandfather might still have first accumulated savings for some thirty years and then bought his house in cash. Needless to say that the latter has always been the Christian way. In Saint Pauls letter to the Romans (13:8) we read: "Owe nothing to anyone, except to love one another; for the one who loves another has fulfilled the law." Things are not much better for those who have already accumulated some wealth. It is true that inflation does not force them into debt, but in any case it deprives them of the possibility of holding their savings in cash. Old people with a pension fund, widows, and the wardens of orphans must invest their money into the financial markets, lest its purchasing power evaporate under their noses. Thus they become dependent on intermediaries and on the vagaries of stock and bond pricing. It is clear that this state of affairs is very beneficial for those who derive their living from the financial markets. Stockbrokers, bond dealers, banks, mortgage corporations, and other "players" have reason to be thankful for the constant decline of moneys purchasing power under fiat inflation. But is this state of affairs also beneficial for the average citizen? In a certain sense, his debts and increased investment in the financial markets are beneficial for him, given our present inflationary regime. When the increase of the price level is perennial, private debt is for him the best available strategy. But this means of course that without government interventionism into the monetary system other strategies would be superior. The presence of central banks and paper money make debt-based financial strategies more attractive than strategies based on prior savings. It is not an exaggeration to say that, through their monetary policy, Western governments have pushed their citizens into a state of financial dependency unknown to any previous generation. Already in 1931, Pius XI stated: [. . .] it is obvious that not only is wealth concentrated in our times but an immense power and despotic economic dictatorship is consolidated in the hands of a few, who often are not owners but only the trustees and managing directors of invested funds which they administer according to their own arbitrary will and pleasure. This dictatorship is being most forcibly exercised by those who, since they hold the money and completely control it, control credit also and rule the lending of money. Hence they regulate the flow, so to speak, of the life-blood whereby the entire economic system lives, and have so firmly in their grasp the soul, as it were, of economic life that no one can breathe against their will.[1] One wonders what vocabulary Pius XI would have used to describe our present situation. The usual justification for this state of affairs is that it allegedly stimulates industrial development. The money hoards of former times were not only sterile; they were actually harmful from an economic point of view, because they deprived business of the means of payments they needed for investments. The role of inflation is to provide these means. However, money hoarding does not have any negative macroeconomic implications. It does definitely not stifle industrial investments. Hoarding increases the purchasing power of money and thus gives greater "weight" to the money units that remain in circulation. All goods and services can be bought, and all feasible investments can be made with these remaining units. The fundamental fact is that inflation does not bring into existence any additional resource. It merely changes the allocation of the existing resources. They no longer go to companies that are run by entrepreneurs who operate with their own money, but to business executives who run companies financed with bank credits. The net effect of the recent surge in household debt is therefore to throw entire populations into financial dependency. The moral implications are clear. Towering debts are incompatible with financial self-reliance and thus they tend to weaken self-reliance also in all other spheres. The debt-ridden individual eventually adopts the habit of turning to others for help, rather than maturing into an economic and moral anchor of his family, and of his wider community. Wishful thinking and submissiveness replace soberness and independent judgment. And what about the many cases in which families can no longer shoulder the debt load? Then the result is either despair or, on the contrary, scorn for all standards of financial sanity. VII. Some Spiritual Casualties of Fiat Inflation Fiat inflation constantly reduces the purchasing power of money. To some extent, it is possible for people to protect their savings against this trend, but this requires thorough financial knowledge, the time to constantly supervise ones investments, and a good dose of luck. People who lack one of these ingredients are likely to lose a substantial part of their assets. The savings of a lifetime often vanish in thin air during the last few years spent in retirement. The consequence is despair and the eradication of moral and social standards. But it would be wrong to infer that inflation produces this effect mainly among the elderly. As one writer observed: These effects are "especially strong among the youth. They learn to live in the present and scorn those who try to teach them old-fashioned morality and thrift. Inflation thereby encourages a mentality of immediate gratification that is plainly at variance with the discipline and eternal perspective required to exercise principles of biblical stewardshipsuch as long-term investment for the benefit of future generations."[2] Even those citizens who are blessed with knowledge, time, and luck to protect the substance of their savings cannot evade inflations harmful impact, because they have to adopt habits that are at odds with moral and spiritual health. Inflation forces them to spend much more time thinking about their money than they otherwise would. We have noticed already that the old way for ordinary citizens to make savings was the accumulation of cash. Under fiat inflation this strategy is suicidal. They must invest into assets the value of which grows during the inflation; the most practical way to do this is to buy stocks and bonds. But this entails many hours spent on comparing and selecting appropriate titles. And it compels them to be ever watchful and concerned about their money for the rest of their lives. They need to follow the financial news and monitor the price quotations on the financial markets. Similarly, people will tend to prolong the phase of their life in which they strive to earn money. And they will place relatively greater emphasis on monetary returns than on any other criterion for choosing their profession. For example, some of those who would rather be inclined to gardening will nevertheless seek an industrial employment because the latter offers greater long-run monetary returns. And more people will accept employment far from home, because it allows them to earn just some little extra money, than under a natural monetary system. The spiritual dimension of these inflation-induced habits seems to be obvious. Money and financial questions come to play an exaggerated role in the life of man. Inflation makes society materialistic. More and more people strive for money income at the expense of personal happiness. Inflation-induced geographical mobility artificially weakens family bonds and patriotic loyalty. Many of those who tend to be greedy, envious, and niggardly anyway fall prey to sin. Even those who are not so inclined by their natures will be exposed to temptations they would not otherwise have felt. And because the vagaries of the financial markets also provide a ready excuse for an excessively parsimonious use of ones money, donations for charitable institutions will decline. Then there is the fact that perennial inflation tends to deteriorate product quality. Every seller knows that it is difficult to sell the same physical product at higher prices than in previous years. But increasing money prices are unavoidable when the money supply is subject to relentless growth. So what do sellers do? In many cases the rescue comes through technological innovation, which allows for a cheaper production of the product, thus neutralizing or even overcompensating the countervailing influence of inflation. This is, for example, the case with personal computers and other equipment built with a large input of information technology. But in other industries, technological progress plays a much smaller role. Here the sellers confront the above-mentioned problem. They then fabricate an inferior product and sell it under the same name, along with the euphemisms that have become customary in commercial marketing. For example, they might offer their customers "light" coffee and "non-spicy" vegetableswhich translates into thin coffee and vegetables that have lost any trace of flavor. Similar product deterioration can be observed in the construction business. Countries plagued by perennial inflation seem to have a greater share of houses and streets that are in constant need of repair than other countries. In such an environment, people develop a more than sloppy attitude toward their language. If everything is what it is called, then it is difficult to explain the difference between truth and lie. Inflation tempts people to lie about their products, and perennial inflation encourages the habit of routine lies. The present writer has argued in other works that routine lies play a great role in fractional-reserve banking, the basic institution of the fiat money system. Fiat inflation seems to spread this habit like a cancer over the rest of the economy. VIII. Suffocating the Flame In most countries, the growth of the welfare state has been financed through the accumulation of public debt on a scale that would have been unthinkable without fiat inflation. A cursory glance at the historical record shows that the exponential growth of the welfare state, which in Europe started in the early 1970s, went in hand with the explosion of public debt. It is widely known that this development has been a major factor in the decline of the family. But it is commonly overlooked that the ultimate cause of this decline is fiat inflation. Perennial inflation slowly but assuredly destroys the family, thus suffocating the earthly flame of Christian morals. The Christian family is the most important "producer" of a certain type of morals. Family life is possible only if all members endorse norms such as the legitimacy of authority, the heterosexual union between man and woman, and the prohibition of incest. And Christian families are based on additional norms such as the love of the spouses for one another and for their offspring, the respect of children for their parents, the reality of the Triune God, the truth of the Christian faith, etc. Parents constantly repeat, emphasize, and live these norms. This daily experience "brainwashes" all family members into accepting them as the normal state of affairs. In the wider social sphere, then, these persons act as advocates of the same norms in business associations, clubs, and politics. Friends and foes of the traditional Christian family agree on these facts. It is among other things because they recognize the familys effectiveness in establishing social norms that Christians seek to protect it. And it is precisely for the same reason that advocates of moral license seek to destroy it. The welfare state has been their preferred tool for the past thirty years. Today the welfare state provides a great number of services that in former times were provided by families (and which, we may assume, would still be provided to a large extent by families if the welfare state ceased to exist). Education of the young, care for the elderly and the sick, assistance in times of emergenciesall of these services are today effectively "outsourced" to the state. The families have been degraded into small production units that share utility bills, cars, refrigerators, and of course the tax bill. The tax-financed welfare state then provides them with education and care.[3] >From an economic point of view, this arrangement is a pure waste of money. The fact is that the welfare state is inefficient; it provides comparatively lousy services at comparatively high costs. We need not dwell on the inability of government welfare agencies to provide the emotional and spiritual assistance that only springs from charity. Compassion cannot be bought. But the welfare state is also inefficient in purely economic terms. It operates through large bureaucracies and is therefore liable to lack incentives and economic criteria that would prevent the wasting of money. In the words of Pope John Paul II: By intervening directly and depriving society of its responsibility, the Social Assistance State leads to a loss of human energies and an inordinate increase of public agencies, which are dominated more by bureaucratic ways of thinking than by concern for serving their clients, and which are accompanied by an enormous increase in spending. In fact, it would appear that needs are best understood and satisfied by people who are closest to them and who act as neighbours to those in need. It should be added that certain kinds of demands often call for a response which is not simply material but which is capable of perceiving the deeper human need.[4] Everyone knows this from first-hand experience, and a great number of scientific studies drive home the same point. It is precisely because the welfare state is an inefficient economic arrangement that it must rely on taxes. If the welfare state had to compete with families on equal terms, it could not stay in business for any length of time. It has driven the family and private charities out of the "welfare market" because people are forced to pay for it anyway. They are forced to pay taxes, and they cannot prevent the government from floating ever-new loans, which absorb the capital that otherwise would be used for the production of different goods and services. The excessive welfare state of our days is an all-out direct attack on the producers of Christian morals. But it weakens these morals also in indirect ways, most notably by subsidizing bad moral examples. The fact is that some alternative "life styles" carry great economic risks and therefore tend to be more expensive than the traditional family arrangements. The welfare state socializes the costs of such behavior and therefore gives it far greater prominence than it would have in a free society. Rather than carrying an economic penalty, public license might then actually go hand in hand with economic advantages, because it dispenses the protagonists from the costs of family life (for example, the costs associated with raising children). With the backing of the welfare state, these protagonists may mock conservative morals as some sort of superstition that has no real-life impact. The spiritual dimension seems to be clear: The welfare state systematically exposes people to the temptation of believing that there are no time-tested moral precepts at all. Let us emphasize that the point of the preceding observations was not to attack welfare services, which are in fact an essential component of Christian societies. The point is, rather, that fiat inflation destroys the democratic control over the provision of these services; that this invariably leads to excessive growth of the aggregate welfare system and to excessive forms of welfare; and that this in turn is not without consequences for the moral and spiritual character of the population. The foregoing considerations are by no means an exhaustive account of the cultural and spiritual legacy of fiat inflation. But they should suffice to substantiate the main point: that fiat inflation is a powerhouse of social, economic, cultural, and spiritual destruction. ________________________ J.G. H|lsmann is senior fellow of the Mises Institute. This is an excerpt from his book forthcoming from the Acton Institute. jgh at mises.org. Comment on the Mises blog. Notes [1] Pius XI, Quadragesimo Anno (1931), '' 105, 106. See also Deuteronomy 28: 12, 4344. [2] Thomas Woods, "Money and Morality: The Christian Moral Tradition and the Best Monetary Regime," Religion & Liberty, vol. 13, no. 5 (Sept./Oct. 2003). The author quotes Ludwig von Mises. [3] In many countries it is today possible for families to deduct expenses for private care and private education from the annual tax bill. But ironically (or maybe not quite so ironically) this trend has reinforced the erosion of the family. For example, recent provisions of the U.S. tax code allow family budgets to increase through such deductionsbut only if the deductible services are not provided at home, but bought from other people. [4] John Paul II, Centesimus Annus, ' 48. In response to many requests, it is now possible to set your credit-card contribution to the Mises Institute to be recurring. You can easily set this up on-line with a donation starting at $10 per month. See the Membership Page. This is one way to ensure that your support for the Mises Institute is ongoing. [Print Friendly Page] Mises Email List Services Join the Mises Institute Mises.org Store Home | About | Email List | Search | Contact Us | Periodicals | Articles | Games & Fun News | Resources | Catalog | Contributions | Freedom Calendar You are subscribed as: rahettinga at earthlink.net Manage your account. Unsubscribe here or send email to this address. --- end forwarded text -- ----------------- R. A. Hettinga The Internet Bearer Underwriting Corporation 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' From declan at well.com Wed Jul 28 08:17:24 2004 From: declan at well.com (Declan McCullagh) Date: Wed, 28 Jul 2004 10:17:24 -0500 Subject: Mexico Atty. General gets microchipped (fwd) In-Reply-To: <20040726071611.GC22372@arion.soze.net>; from justin-cypherpunks@soze.net on Mon, Jul 26, 2004 at 07:16:11AM +0000 References: <40F4C2AC.827EEB2D@cdc.gov> <20040725134439.D2578@baltwash.com> <20040726071611.GC22372@arion.soze.net> Message-ID: <20040728101724.A17991@baltwash.com> Just did a Lexis-Nexis search. One early reference is a Washington Times article on July 27, 1989: "I don't know that atheists should be considered citizens, nor should they be considered patriots. This is one nation under God," said Mr. Bush, as reported in the November issue of American Atheist magazine. A LA Times letter to the editor in July 1990: And what the head of his party, then-Vice President George Bush, told a Chicago airport press conference in August, 1987: "I don't know that atheists should be considered as citizens, nor should they be considered as patriots. This is one nation under God." A letter to the editor to the Post-Standard (Syracuse) in March 1989: To President Bush:I understand that you are on tape saying, "I don't know that atheists should be considered as citizens, nor should they be considered as patriots. This is one nation under God." UPI April 1990: While campaigning in 1987, President Bush was quoted by a reporter for an Atheist publication as saying, '''I guess I'm pretty weak in the Atheist community. My belief in God is important to me,''' O'Hair said. ''He said, and again this is verbatim, 'I don't know if atheists should be considered citizens. ... This is one nation under God.''' So there's no definitive reference in the database. -Declan On Mon, Jul 26, 2004 at 07:16:11AM +0000, Justin wrote: > On 2004-07-25T13:44:39-0500, Declan McCullagh wrote: > > On Tue, Jul 13, 2004 at 10:20:44PM -0700, Major Variola (ret) wrote: > > > "No, I don't know that Atheists should be considered as citizens, > > > nor should they be considered patriots. This is one nation under > > > God." -GW Bush > > > > Do you have a good cite for that? One source attributes it to George > > Bush I, not Bush II. > > I've seen it more than once identified as a quote by Bush I (GHWB, #41). > > http://www.positiveatheism.org/writ/ghwbush.htm > > The quote was (allegedly) reported by Robert I. Sherman of the American > Atheist News Journal, at an informal outdoor news conference at O'Hare > on August 27, 1987. > > -- > "When in our age we hear these words: It will be judged by the result--then we > know at once with whom we have the honor of speaking. Those who talk this way > are a numerous type whom I shall designate under the common name of assistant > professors." -- Kierkegaard, Fear and Trembling (Wong tr.), III, 112 From mv at cdc.gov Wed Jul 28 21:21:43 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Wed, 28 Jul 2004 21:21:43 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <41087B57.364D7AF0@cdc.gov> At 06:44 PM 7/24/04 -0500, J.A. Terranson wrote: >On Sat, 24 Jul 2004, Major Variola (ret) wrote: > >> There might be blind cypherpunks, we don't discriminate[1], > >There Is No We. touche' >> [1] the original phone phreaks were blind, > >This is a ridiculous statement, and even worse, leaks information about >your nym: [young enough to have not been there]. Yes. Did you know that your teeth enamel contain isotope ratios that encode regions where you might have grown up around age 6? Ask Otzi. >You are thinking of Joe "Whistler" Joe Egressia (sp?), and the kid form >New York whose names escape me at the moment. These two do not even com >close to "the original phone phreaks were blind". More like "at least two >of the original batch of phreaks were blind". Ok, so this was book reading. Sosume. I once worked for a guy who hired Capt'n Crunch, *briefly*. [This is reference to a digression later in the thread. His dentition was not discussed.] ------ WE are all just voices in Tim May's head. From mv at cdc.gov Wed Jul 28 21:34:59 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Wed, 28 Jul 2004 21:34:59 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <41087E73.571C6692@cdc.gov> At 03:52 PM 7/27/04 -0400, Tyler Durden wrote: >Variola wrote... >>In the *public* lit. > >Well, perhaps but perhaps not. Burst-mode signaling, transceivers, and >networking technology are a good example. If you see DISA, NSA, and DARPA >all working with the acknoledged experts inthe academic field, and if you >see them spending $$$ on burst-mode testbeds, then it's clear that there are >some issues they haven't solved. You're right on this, I admit. Its clear that things like smart dust and gait recognition and autonomous cruising across the desert are not things the Beast has yet. >There just happen to be >physical limitations. But I have zero doubt that the NSA can't make a laser >that is siginificantly more efficient than what I can buy off the shelf. I'm not one to dispute physics. However most professional skeptics (eg cryptographers) grant the adversary anything from 2 to 10 x the COTS tech. Do you *really* think the NSA's DesCrack was built with old Sun chassis like Gilmore, Kocher, et als??? Remember that the spookfabs don't have to contend with *economics and yield*. They can use *radioisotopes*. Subs can lay independant cable. Not a lot of folks walk along the undersea cables, to say nothing of how bribable telecom folks are. Conservativism sometimes means being liberal in modelling others' capabilities. ------ Be Useful -the Baron From measl at mfn.org Wed Jul 28 22:07:14 2004 From: measl at mfn.org (J.A. Terranson) Date: Thu, 29 Jul 2004 00:07:14 -0500 (CDT) Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <41087B57.364D7AF0@cdc.gov> References: <41087B57.364D7AF0@cdc.gov> Message-ID: <20040728235641.E2483@ubzr.zsa.bet> On Wed, 28 Jul 2004, Major Variola (ret) wrote: > Did you know that your teeth enamel contain isotope ratios that > encode regions where you might have grown up around age 6? Yes. I am also aware that tooth enamel has the interesting property of trapping a fantastic number of parmaceuticals. The teeth can be used to lay out a life history of drug [ab]use, from simple tetracycline use as a kid through to the occasional lines as an adult. AFAIK, the tests now available are simply qualitative, and without accurate date-stamping, but I am no expert in this area (so if it's important to you, seek Knowledgeable Assistance (tm)). > I once worked for a guy who hired Capt'n Crunch, *briefly*. Yeah. Most people find John a bit difficult to stomach for long. While I won't go into my personal interactions with him here, it is worth noting that I take pains to point out that John is *not* representative of the "average" phreak when I teach classes touching on that area. Remember: John spent a great deal of time bemoaning the fact that "secrets" was published, and that it was "going to end phreaking", yet *he* was the one who spent all the time talking to the goddamned reporter! John is not, IMNSHO, well pasted together. Besides, he has the most disturbing physical motions I have ever seen in another human being. The way he moves his body tells you there is something wrong - you don't even need to talk to him before the hairs on the back of your neck start screaming for cover :-( > [This is reference to a digression later in the thread. His dentition > was not discussed.] Thank god... -- Yours, J.A. Terranson sysadmin at mfn.org 0xBD4A95BF "...justice is a duty towards those whom you love and those whom you do not. And people's rights will not be harmed if the opponent speaks out about them." Osama Bin Laden - - - "There aught to be limits to freedom!" George Bush - - - Which one scares you more? From shaddack at ns.arachne.cz Wed Jul 28 18:10:47 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Thu, 29 Jul 2004 03:10:47 +0200 (CEST) Subject: X-Cypher, SIP VoIP, stupid propriatory crapola In-Reply-To: <4106FD5A.90404@gmx.co.uk> References: <4106FD5A.90404@gmx.co.uk> Message-ID: <0407290309140.10156@somehost.domainz.com> On Wed, 28 Jul 2004, Dave Howe wrote: > Particularly disgusted by the last paragraph.... > | With encryption comes the problem of either managing public/private > | keys, which must be kept secret, or the annoyance of transmitting a > | secure key to a remote party over other secure methods. X-Cipher > | eliminates these issues. No public/private keys exist to guard and keep > | safe and worry about theft and reuse. Each conversation through > | X-Cipher gets a unique secure key generated by an X-Cipher server using > | strong Crypto random safe algorithms. Sounds like an anonymous Diffie-Hellman session key, wrapped in marketing bullshit. Usable, but susceptible to MITM. From DaveHowe at gmx.co.uk Thu Jul 29 02:22:17 2004 From: DaveHowe at gmx.co.uk (Dave Howe) Date: Thu, 29 Jul 2004 10:22:17 +0100 Subject: X-Cypher, SIP VoIP, stupid propriatory crapola In-Reply-To: <0407290309140.10156@somehost.domainz.com> References: <4106FD5A.90404@gmx.co.uk> <0407290309140.10156@somehost.domainz.com> Message-ID: <4108C1C9.1020208@gmx.co.uk> Thomas Shaddack wrote: > Sounds like an anonymous Diffie-Hellman session key, wrapped in marketing > bullshit. Usable, but susceptible to MITM. Unless I am reading this wrong, it is much, much worse than that - it seems to say that, unless you are running your own server (which requires a DNS entry and server rights, etc), the session key is being generated at the central server and *issued* to the two parties - with all the third party compromise, LEAK order problems and sheer poor design issues that implies. SIP *has* a crypto negotiation field in the protocol - why aren't they using that, instead of "rolling their own"? From shaddack at ns.arachne.cz Thu Jul 29 02:33:29 2004 From: shaddack at ns.arachne.cz (Thomas Shaddack) Date: Thu, 29 Jul 2004 11:33:29 +0200 (CEST) Subject: X-Cypher, SIP VoIP, stupid propriatory crapola In-Reply-To: <4108C1C9.1020208@gmx.co.uk> References: <4106FD5A.90404@gmx.co.uk> <0407290309140.10156@somehost.domainz.com> <4108C1C9.1020208@gmx.co.uk> Message-ID: <0407291129200.0@somehost.domainz.com> On Thu, 29 Jul 2004, Dave Howe wrote: > Thomas Shaddack wrote: > > Sounds like an anonymous Diffie-Hellman session key, wrapped in marketing > > bullshit. Usable, but susceptible to MITM. > Unless I am reading this wrong, it is much, much worse than that - it seems to > say that, unless you are running your own server (which requires a DNS entry > and server rights, etc), the session key is being generated at the central > server and *issued* to the two parties - with all the third party compromise, > LEAK order problems and sheer poor design issues that implies. Didn't thought about this. Noticed the "generated by server" thing, but thought it'll be a local process collecting entropy from some hardware source. Yes, your Honor, I admit I am guilty from assuming lack of stupidity on the vendor side. :( > SIP *has* a crypto negotiation field in the protocol - why aren't they using > that, instead of "rolling their own"? Perhaps because they don't want to make a really secure system, aren't aware about this possibility, were politely told to not use it by some Third Party, don't know how to do it this way...? Maybe it could be a good idea to ask them. From camera_lumina at hotmail.com Thu Jul 29 09:36:32 2004 From: camera_lumina at hotmail.com (Tyler Durden) Date: Thu, 29 Jul 2004 12:36:32 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: "Remember that the spookfabs don't have to contend with *economics and yield*." Damn, this is precisely where I wish Tim May was still around. Certainly, the Spooks have their own fabs, and I don't think they even hide this fact (I doubt they could, ultimately). And certainly, the Spooks crank out all sort of special ASICs using their own IP as well as some store-bought stuff they drop onto their designs. However, where I have some BIG doubts is whether their fab is X generations ahead of the most advanced commercial fabs. Frankly, I bet they have a pretty good fab that was modified by a commercial vendor to support small production runs. This fab, however, does not utilize cosmic rays for etching or whatever. It's probably 0.13 microns at best (wait...I think Taiwan Semi and a couple of other places are one step ahead of this). This limits what they can do with a chip or chipset, and implies that they won't be orders of magnitude better at opening up LOTS of traffic. (In non-troll mode.) -TD >From: "Major Variola (ret)" >To: "cypherpunks at al-qaeda.net" >Subject: Re: Email tapping by ISPs, forwarder addresses, and crypto >proxies >Date: Wed, 28 Jul 2004 21:34:59 -0700 > >At 03:52 PM 7/27/04 -0400, Tyler Durden wrote: > >Variola wrote... > >>In the *public* lit. > > > >Well, perhaps but perhaps not. Burst-mode signaling, transceivers, and > >networking technology are a good example. If you see DISA, NSA, and >DARPA > >all working with the acknoledged experts inthe academic field, and if >you > >see them spending $$$ on burst-mode testbeds, then it's clear that >there are > >some issues they haven't solved. > >You're right on this, I admit. Its clear that things like smart dust >and gait recognition and >autonomous cruising across the desert are not things the Beast has yet. > > >There just happen to be > >physical limitations. But I have zero doubt that the NSA can't make a >laser > >that is siginificantly more efficient than what I can buy off the >shelf. > >I'm not one to dispute physics. However most professional skeptics >(eg cryptographers) grant the adversary anything from 2 to 10 x the >COTS tech. Do you *really* think the NSA's DesCrack was built >with old Sun chassis like Gilmore, Kocher, et als??? > >Remember that the spookfabs don't have to contend with *economics and >yield*. >They can use *radioisotopes*. Subs can lay independant cable. >Not a lot of folks walk along the undersea cables, >to say nothing of how bribable telecom folks are. > >Conservativism sometimes means being liberal in modelling others' >capabilities. > >------ >Be Useful -the Baron > > _________________________________________________________________ Overwhelmed by debt? Find out how to Dig Yourself Out of Debt from MSN Money. http://special.msn.com/money/0407debt.armx From sunder at sunder.net Thu Jul 29 11:12:16 2004 From: sunder at sunder.net (Sunder) Date: Thu, 29 Jul 2004 14:12:16 -0400 (edt) Subject: [OT] Apple calls Real "a hacker" Message-ID: http://money.cnn.com/2004/07/29/technology/apple_real/ Interesting non-cypherpunkish stuff. So Real goes off and does some reverse engineering so it can use Apple's DRM to publish its own stuff for iPod's. Interestingly, Apple wants to sue using the DMCA, *BUT* where it gets interesting is that IMHO, Real didn't provide a crack to Apple's DRM, rather it used it for its own benefit. So will the DMCA even apply? Even more interesting, Real used "publically available documents" so they didn't do the reverse engineering themselves, so they're not likely to be sued on that aspect - though quite likely this is based on the fair play stuff which was based on reverse engineering... This might also have ramifications concerning things like X-Box and modchips. i.e. if Apple loses, then it will be legal for someone to build a modchip to allow X-Box's to run Linux (but not play copied games.) It will be an interesting fight, and if we, the consumers, are lucky, then perhaps some of the evil provisions in the DMCA will go away so we can get some more interoperability instead of vendor lock-in. ----------------------Kaos-Keraunos-Kybernetos--------------------------- + ^ + :"I find it ironic that, on an amendment designed to protect /|\ \|/ :American democracy and our constitutional rights, the /\|/\ <--*-->:Republican leadership in the House had to rig the vote and \/|\/ /|\ :subvert the democratic process in order to prevail" \|/ + v + : -- Rep. Sanders re vote to ammend the US PATRIOT ACT. -------------------------------------- http://www.sunder.net ------------ From rah at shipwright.com Thu Jul 29 12:28:43 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Thu, 29 Jul 2004 15:28:43 -0400 Subject: ECC 2004 Message-ID: --- begin forwarded text From rah at shipwright.com Fri Jul 30 07:31:45 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Fri, 30 Jul 2004 10:31:45 -0400 Subject: Ten Recurring Economic Fallacies, 1774-2004 Message-ID: --- begin forwarded text From rah at shipwright.com Fri Jul 30 07:38:40 2004 From: rah at shipwright.com (R. A. Hettinga) Date: Fri, 30 Jul 2004 10:38:40 -0400 Subject: The Cultural and Spiritual Legacy of Fiat Inflation Message-ID: --- begin forwarded text From Poindexter at SAFe-mail.net Fri Jul 30 08:47:10 2004 From: Poindexter at SAFe-mail.net (Poindexter at SAFe-mail.net) Date: Fri, 30 Jul 2004 11:47:10 -0400 Subject: Cruise Missile Clearance! Everything that Blows Shit Up Must Go! Message-ID: My name is Bruce Simpson and I'm the guy who designed and built a low-cost cruise missile last year (as extensively reported by the world's media). As a result of this, the New Zealand government has seen fit to ensure that I can no longer engage in the activities, research or other work that resulted in this project. Indeed, I'm now effectively prohibited from using any of my key skills to support myself and my family, leaving us very much on the breadline. I have been forced to move from the modern 2,500 sq ft house (2 bathrooms, six bedrooms) I used to own, to a series of old and run-down rented houses, finally leading me to the current rat and flea-infested dwelling I'm in now. My family have suffered greatly as a result of this and, to be quite frank, I've had enough. It would appear that the only way for me to now survive with anything like a modest standard of living is to offer my skills, knowledge and experience to anyone outside of New Zealand who is willing to pay for them. So, if you're located outside of New Zealand and need a missile (or UAV or RPV) designed, built and tested for you, I'm the person to talk to. I won't charge you millions of dollars like the big-boys might. I won't question your politics or religious beliefs. I simply ask that you provide me with travel to your location plus safe, warm, comfortable accommodation for the duration of the project, and employ me at an agreed rate for my services. Whether you're a verysmall nation looking to extend its military capabilities while perhaps creating a highly profitable export industry, or an entrepreneur seeking to enter the massive market low-cost UAVs, RPVs and other pilotless vehicles, or whether you just want a single missile to mount on your SUV as a roof ornament -- I'm your man. Events of the past year have taught me the folly of patriotism, putting the interests of others ahead of your own, and trying to work with government to improve the security of the nation -- so I given up on that and adopted a far more mercenary attitude. Note however, that I will not knowingly work for anyone involved in the planning or committing of terrorist acts. Now I'm prepared to relocate to any part of the planet (at the employer's expense) and provide whatever skills, knowledge, experience and hard work is required to meet their requirements. If you need a UAV, RPV or low-cost cruise missile then look no further. You can buy 15+ years of professional experience in electronic hardware design and implementation, 15+ years of software development experience, the benefit of 5-years hard-core R&D into modern pulsejet technology, and 10+ years of small airframe design and construction all in one slightly aged package. You'll also get the benefit of all the work I've performed on my own LCCM project, including engine, airframe, stability and guidance systems. All correspondence will be kept in the utmost confidence. If you wish to discuss the options further, please establish initial contact using this form, http://aardvark.co.nz/contact/ , after which a more secure method of communicating can be established if required. ---------------------------- From mv at cdc.gov Fri Jul 30 19:22:06 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 30 Jul 2004 19:22:06 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <410B024E.27FF712E@cdc.gov> At 12:07 AM 7/29/04 -0500, J.A. Terranson wrote: >On Wed, 28 Jul 2004, Major Variola (ret) wrote: > >> Did you know that your teeth enamel contain isotope ratios that >> encode regions where you might have grown up around age 6? > >Yes. I am also aware that tooth enamel has the interesting property of >trapping a fantastic number of parmaceuticals. No. Your tooth enamel is static after you grow adult teeth. Your bones recycle every 10-20 years. Your hair gives away your indulgences though, which is what you allude to. Of interest to anthropologists, eg the folks who pinned Otzi's birthplace to other than where he was found. Anyone who wants to piss-test me will find his desk fully irrigated next day. From mv at cdc.gov Fri Jul 30 19:25:16 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Fri, 30 Jul 2004 19:25:16 -0700 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies Message-ID: <410B030C.3A887CCB@cdc.gov> At 12:36 PM 7/29/04 -0400, Tyler Durden wrote: >"Remember that the spookfabs don't have to contend with *economics and >yield*." > >Damn, this is precisely where I wish Tim May was still around. We are all just echoes of the voices in his head. But I did work for a company that owned fabs. And have kept up with the semiconductor lit. Yield is a big deal ---you either fit it on a square inch of Si or you don't make it (profitably). The "profitably" part is a non-issue when you have black budgets, ie $400 toilet seats. Bottom line: they're not ahead in tech, but they can make things that private-co engineeers only dream of. DesCrack is a suitcase, get it? I'll let you speculate on AESCrack :-) From bjonkman at sobac.com Fri Jul 30 22:11:01 2004 From: bjonkman at sobac.com (Bob Jonkman) Date: Sat, 31 Jul 2004 01:11:01 -0400 Subject: Email tapping by ISPs, forwarder addresses, and crypto proxies In-Reply-To: <20040724184018.U41904@ubzr.zsa.bet> References: <4102D114.7F083928@cdc.gov> Message-ID: <410AF1A5.32666.170A4AC@localhost> This is what J.A. Terranson said about "Re: Email tapping by ISPs, forwarde" on 24 Jul 2004 at 18:44 > > On Sat, 24 Jul 2004, Major Variola (ret) wrote: > > > There might be blind cypherpunks, we don't discriminate[1], > > There Is No We. > > > [1] the original phone phreaks were blind, > > This is a ridiculous statement, and even worse, leaks information > about your nym: [young enough to have not been there]. > > You are thinking of Joe "Whistler" Joe Egressia (sp?), and the kid > form New York whose names escape me at the moment. These two do not > even com close to "the original phone phreaks were blind". More like > "at least two of the original batch of phreaks were blind". Or are you thinking of the "Three Blind Phreaks", profiled in Wired magazine earlier this year? http://www.wired.com/wired/archive/12.02/phreaks.html --Bob. From mv at cdc.gov Sat Jul 31 17:50:36 2004 From: mv at cdc.gov (Major Variola (ret)) Date: Sat, 31 Jul 2004 17:50:36 -0700 Subject: On how the NSA can be generations ahead Message-ID: <410C3E5C.8E8891C@cdc.gov> Tyler D asked about how the NSA could be so far ahead. Besides their ability to make 2" sq. chips at 10% yield (not something a commercial entity could get away with) they can also *thin and glue* those chips into say stacks of 5 thinned die. 2" sq = 4 x performance 5 thinned die with GHz vias = 20 x performance. Both are uneconomical but feasible. Get it? Any questions? ----- all your burst-mode wall-chair-molding-bugs in the state dept are belong to us...