July 2018 - cypherpunks-legacy@lists.ogf.org

Re: Protecting Our Children
by None 06 Jul '18

06 Jul '18

Makes it a crime not to keep the cough medicine in the triple lock gun cabinet it also mandates? Or just gives more money to the DEA to seek Peace With Honor in the War On Drugs? MacN On Mon, 16 Oct 2000, Declan McCullagh wrote: > To be voted on in the House tomorrow: > (9) H.R. 5312 - Protecting Our Children From Drugs Act of 2000 > > It's not on Thomas, and I don't feel like dispatching my intern to get the > text, so your guess is as good as mine. > > -Declan > >

1 0

None
by Jim Salters 06 Jul '18

06 Jul '18

We are pleased to announce a "call for participation" for two new FSTC projects. Each has a committed core group of member institutions and vendors who solicit further participation from fellow members: 1. FSTC e-Authentication Initiative: Business and Technology Proof-of-Concept 2. Business Continuity: Compliance and Status Reporting Project ____________________ 1. FSTC e-Authentication Initiative: Business and Technology Proof-of-Concept Prospectus: http://fstc.org/projects/new.cfm#eauth This 5-month project will assess the viability of the potential business opportunity that exists for financial institutions to leverage their online customer relationships and provide an authentication service to government agencies, and to integrate these services into their own online applications. FSTC, jointly with the GSA's E-Authentication Initiative Project Management Office (EAI PMO), propose to launch a three-track project to ascertain the business model, legal framework, and technical viability of using FIs' identity credentials to permit consumers and businesses to access secure online government applications. The GSA is funding the business track of the initiative. There is no cost to financial institutions, and a $5,000 fee for associate members. In addition, a resource commitment is required for all participants, as outlined in the prospectus. Participation commitments are requested by Sept 24th, and the target kickoff is the week of October 4th. An informational conference call has been scheduled for: Wednesday Sept 15th, 2pm EDT 512-225-3050, 71782# __________________ 2. Business Continuity: Compliance and Status Reporting Project Prospectus: http://fstc.org/projects/new.cfm#compliance The FSTC Business Continuity Standing Committee proposes an initiative to assist the financial industry in coming to a common understanding on the meaning of continuity regulation, prioritization of compliance related activities, and creating efficiencies in documenting regulatory compliance status. To establish a clear understanding of the regulatory environment, a list of continuity related guidance will be pulled together along with the name of the agency responsible. Each regulation will be reviewed and a clearly worded summary of the continuity requirements will be developed. Where possible the regulatory agencies will be contacted for clarification on specific points. Common themes and requirements will be documented and prioritized. >From this list of common themes and prioritized requirements a questionnaire will be developed which will allow a FI to provide or collect continuity compliance status. The project will focus on providing straight forward interpretations of what is needed for an FI to comply with current regulations. The final product will provide: . A comprehensive list of all current regulatory guidance related to business continuity, an overview of the requirements of the key components and the agency that produced it. . Prioritized summary of the key continuity requirements that FIs must address and the timing for implementing them. . Standardized questionnaire that FIs can utilize to collect or provide status of compliance with continuity regulatory requirements. . An ongoing forum for discussion on regulatory direction and for sharing feedback/experiences other FIs have had with regulators. . A documented process that can be utilized to allow FSTC and its members to maintain the regulatory summary and questionnaire. Project Fees: --------------- Financial Institutions: $15,000 Assets over $100 billion (including affiliates) $12,000 Assets from $50 billion to $99 billion (including affiliates) $9,000 Assets from $20 billion to $49 billion (including affiliates) $3,300 Assets under $19 billion (including affiliates) Technology Companies: $15,000 Revenue/funding over $100 million (including affiliates) $12,000 Revenue/funding from $50 million to $99 million (including affiliates) $9,000 Revenue/funding from $20 million to $49 million (including affiliates) $3,300 Revenue/funding under $19 million (including affiliates) ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

CDR: Re: Gnutella scanning instead of service providers.
by Ray Dillinger 06 Jul '18

06 Jul '18

> On Wed, 22 Aug 2001, Gary Jeffers wrote: > > > If a scanner were written and widely deployed, then I think that > >the problem of crushing Gnutella would be at least a magnitude harder. > >Maybe the Gnutella support sites would promote and distribute such > >a scanner? > > It is important to note that knowing where the doors are is as > important to those who want to lock them as to those who want > to open them. > > Bear I'll just reply to both at once. I think that a scanner for Gnutella may be quite an interesting proposition, and it certainly wouldn't be hard to make. This would be much like creating a scanner for a webserver, and Code Red has certainly shown us how effective that can be. I think Bear hit it rather correct when he said that it could be used just as easily by those seeking to shut down as those seeking to look. The question then is who would it benefit more, and what would it cost each side to use it? The legitimate scanners would not significantly benefit from a scanner. The scanner would effectively clog the gateways of common homes for Gnutella servers, creating a significant hazard for using Gnutella, and creating a mass slowdown of the connection on those hosts, which would in turn slow the downloads, driving users to use Gnutella less. The benefits for those looking to shut down the sites would be much greater. They could not only locate and scan the sites themselves for prosecution, they could release the tool and create a massgrave of ISPs that allow the use of Gnutella through publication. Based on this very coarse analysis I think it would be in our own interest to keep the usage of such scanning tools to a minimum, perhaps having just a few central servers that serve up lists of Gnutella hosts. Joe

1 0

Processor VIPER
by FOX2000＠go2.pl 06 Jul '18

06 Jul '18

I am a student from Poland. I learn in Zielona Gora on Technical University of Zielona Gora. I study computing and electronics. My science on that university persist five years, now I am on fifth year. My education on that of university ends when I write and execute M.A. thesis, therefore I apply to You. Subject of my work is "Modelling and Synthesis safety processor VIPER in VHDL". VIPER takes its name from "Verifiable Integrated Processor for Enhanced Reliability" - it is the world's first microprocessor for safety-critical applications. VIPER is 32-bit microprocessor which invented at (RSRE) the UK Royal Signals and Radar Establishment for use in highly safety-critical military and civil systems. This processor is safety processor, which is used to steer systems, in which error, or mistake can't appear during work of system. These systems should characterize high precision of action. VIPER is used at nuclear plants, on board a missile, or at a chemical refinery, it's going to happen: a catastrophic computer- related disaster. My work, I execute in VHDL hardware description language. This language, I have known on studies. VHDL takes its name from "V - Very High Speed Integrated Circuit and HDL - Hardware Description Language". I apply to You; Do You know something about VIPER ?; perhaps Your friends know something about this processor. If You know something about VIPER, Could You make accessible me all materials, documentation, algorithm of programs in VHDL or another languages what You have. Thank You, I wait for answer Marek Salamaj My personal details: MAREK SALAMAJ e-mail: FOX2000(a)go2.pl

1 0

request for assistance for debate on encryption with former
by Peter Swire 06 Jul '18

06 Jul '18

FBI General Counsel Hello Dave: On Monday, November 17 the New America Foundation will be hosting a debate on the topic of FBI Director Comey’s criticisms of Apple and Google for the encryption changes to their phones. The moderator will be Nancy Libin, formerly of both CDT and the Department of Justice. Former FBI General Counsel Andrew Weissmann will be presenting the Comey side of the argument. Andrew is an experienced litigator, former head of the Enron Task Force and other major prosecutions. I was in school years ago with Andrew, and the debate will be on the merits but not personal. With that said, only the best arguments will work. With that in mind, I was wondering if readers of your list might send (off-list) resources to prepare for the debate? Many people, in diverse outlets, have been writing about these topics. Although I am currently in the midst of hiring a full-time researcher, I don’t have that help at the moment. If useful, I could circulate a bibliography once the debate happens. For those in DC, the debate will be 4:00 to 5:30 p.m. at New America, address 1899 L St. NW #400. it will be webcast, and may be on C-Span. Thanks, Peter _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography

1 0

None
by None 06 Jul '18

06 Jul '18

1 0

Call for input to President's Commission on Enhancing Cybersecurity - bridging the trust gap between the IT community and the US government
by Herb Lin 06 Jul '18

06 Jul '18

Dear IPers - You may know that President Obama has established a commission to consider how to strengthen cybersecurity in both the public and private sectors while protecting privacy, ensuring public safety and economic and national security, fostering discovery and development of new technical solutions, and bolstering partnerships between Federal, State, and local government and the private sector in the development, promotion, and use of cybersecurity technologies, policies, and best practices. (See https://www.whitehouse.gov/the-press-office/2016/02/09/executive-order-comm….) I am one of the 12 designated commissioners. Recognizing that trust is hard to build and easy to destroy (and a variety of things have happened over the last 20 years have occurred to do the latter), one issue that has come up is the enormous gap of trust between the U.S. government and the information technology (IT) community, from which many IPers are drawn. This rift is not helpful to either side, and I'd like to solicit input from the IP community about what you think the government can do or refrain from doing to help bridge that gap. It would be most helpful if you could three things in your response: 1 - Your best examples of things the government (and what part of the US government) has done to alienate the IT community specifically. (Or, at the very least, show how the examples you provide connect to the interests of the IT community.) 2 - Things that the U.S. government could realistically do in the short and medium term (i.e., 0-10 year time frame) that would help bridge the trust gap. If your answer is "Don't do dumb things!", it would be better and more useful to provide *examples* of what not to do. 3 - Things that the U.S. government could realistically do in the longer term to do the same. Please send your responses to CENCinput1(a)gmail.com. (I set up this email address, but I'd like to keep the traffic separate from my non-Commission work email.) I promise to read as many as I can individually and share what I learn with the commission membership. Also, feel free to circulate this call for input to anyone else you feel would want to comment. Thanks much Herb ======================================================================= Herb Lin Senior Research Scholar, Center for International Security and Cooperation Research Fellow, Hoover Institution Stanford University Stanford, CA 94305 USA herblin(a)stanford.edu 650-497-8600 office || 202-841-0525 cell || 202-540-9878 fax AIM herblin (any time you see me) Skype herbert_lin (usually by appointment) Twitter @HerbLinCyber This message was sent to the list address and trashed, but can be found online. - - - End forwarded message - - -

1 0

None
by Jim Salters 06 Jul '18

06 Jul '18

*** January/February Project Update *** Since our last update, we have launched two new projects (Business Continuity Compliance and Status Reporting, Image Quality and Usability Assurance Phase II), completed one project (Counter-Phishing Phase I), and have added two new projects to our pipeline (Better Mutual Authentication, Resiliency Maturity Model) in addition to Interoperable Verification of Check Security Features. [As a reminder, projects show up in this update only after it has a high probability of launching. We have a number of initiatives in earlier stages of development.] Our Standing Committees (SCOMs) and Special Interest Groups (SIGs) continue to provide a forum for discussion that results in networking, knowledge sharing, and action in the form of projects and workshops. If you are not yet active in one or more committees, please contact me or the committee's Managing Executive. SCOMs and SIGs are still open to non-members, however, projects are members-only. FSTC provides an action-oriented, collaborative forum for our members to address shared business opportunities and challenges through technology projects and knowledge-sharing. We view our projects as our core activity, and one of the key benefits of FSTC membership is eligibility to participate in these projects. In our efforts to keep our members and friends up-to-date on the latest developments in these active and developing initiatives, we provide our colleagues this periodic project update As always, please contact me or Zach Tumin, FSTC Executive Director, for more information. Or visit our website at http://fstc.org. Active Projects: 1. Counter-Phishing Phase I (completed Dec 2004) 2. e-Authentication: Business and Technology Proof-of-Concept (launched Oct 2004) 3. Business Continuity: Compliance and Status Reporting (launched Nov 2004) 4. Image Quality and Usability Assurance Phase II (launched Nov 2004) Projects in Formation (soliciting commitments): [coming soon] Projects in Development: 1. Interoperable Verification of Check Security Features 2. Resilience Maturity Model (RMM): Phase I 3. Better Mutual Authentication: Phase I ______________ ACTIVE PROJECTS: 1. Counter-Phishing Phase I (completed Dec 2004) http://fstc.org/projects/counter-phishing-phase-1/ FSTC has completed a first-phase initiative to address the problem of phishing and related threats in financial services, as it affects the relationship between customer and firm. In collaboration with other industry groups, the project team developed a suite of documents and tools that allowed institutions to understand the comprehensive nature of the problem, and understand the available solution options available to the industry. The project developed a detailed model of the problem, a cost/impact model, the solution space, and a survey of over 60 solution providers. In addition, the project developed a next-phase proposal draft for coordinated industry action to enable Better Mutual Authentication (described below). 12 financial institutions and over 15 technology companies participated in the initiative, and recently published the project's core findings and recommendations to the public. These documents are available from the FSTC web site (link above). A core group is currently developing a next-phase initiative in Better Mutual Authentication, which is described below, and other areas. This project originated from the Security SCOM: co-chaired by Mike McCormick of Wells Fargo, and Mike Versace of NEC. (http://fstc.org/advisory/security.cfm) ______________ 2. FSTC/GSA e-Authentication: Business and Technology Proof-of-Concept (launched Oct 2004, to complete in late March) http://fstc.org/projects/new.cfm#eauth This 5-month project is assessing the viability of the potential business opportunity that exists for financial institutions to leverage their online customer relationships and provide a federated identity-driven authentication service to government agencies, and to integrate these services into financial institutions' online applications. FSTC, jointly with the GSA's E-Authentication Initiative Project Management Office (EAI PMO), have launched a three-track project to ascertain the business model, legal framework, and technical viability of using institutions' identity credentials to permit consumers and businesses to access secure online government applications through federation. There are 7 financial institutions and 10 technology companies and other organizations participating in the project. An in-person meeting is currently scheduled for mid-March in Atlanta, hosted by Bank of America. The project should complete in late March. ______________ 3. Business Continuity: Compliance and Status Reporting (launched Dec 2004) http://fstc.org/projects/new.cfm#compliance The FSTC Business Continuity Standing Committee has launched an initiative to assist the financial industry in coming to a common understanding on the meaning of continuity regulation, prioritization of compliance related activities, and creating efficiencies in documenting regulatory compliance status. To establish a clear understanding of the regulatory environment, a list of continuity related guidance will be pulled together along with the name of the agency responsible. Each regulation will be reviewed and a clearly worded summary of the continuity requirements will be developed. Where possible the regulatory agencies will be contacted for clarification on specific points. Common themes and requirements will be documented and prioritized. The project will focus on providing straight forward interpretations of what is needed for an FI to comply with current regulations. This project is sponsored by the Business Continuity SCOM, co-chaired by Tom Hirsch of US Bank, and Damian Walch of IBM. Please contact FSTC Managing Executive Charles Wallen for more information (charles.wallen(a)fstc.org) (http://fstc.org/advisory/business_continuity/) ______________ 4. Image Quality and Usability Assurance: Phase II (launched Nov 2004) http://fstc.org/projects/new.cfm#iqa2 In Phase I, more than 20 companies, representing 2/3 of US check volume, most major vendors, and key industry associations, undertook a 90-day effort to assess the impact of poor quality check images, and defined 16 technical metrics and 4 usability levels that can be used to measure image quality and usability in a standard and interoperable way. The findings of the Phase I project team justified further development, to test these metrics in a real-world scenario, on millions of images, to determine the quantitative thresholds for the 16 metrics that will define a minimum baseline "standard" for acceptable quality images for the industry. The business objectives are to maximize efficiencies, cost savings, and ensure strong adoption of image exchange. The project will undertake a robust, "real-world" analysis and test to provide actionable specifications and direction to the industry to allow financial institutions, technology vendors, standards organizations, and other key partners to collectively implement baseline image quality and usability through industry collaboration under the FSTC umbrella. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) co-chaired by James Burroughs, Wells Fargo; Glen Ulrich, US Bank; and Ian Goodall, NCR. 7 financial institutions and 18 vendors and industry organizations are participating. ______________ PROJECTS IN DEVELOPMENT: 1. Interoperable Verification of Check Security Features (IV-CSF) As a follow-on to the recently completed Survivability of Check Security Features project (http://fstc.org/projects/csf/) this initiative will seek to develop the business and technology foundation to enable interoperable verification of check security features. As a growing number of banks offer their customers security features targeted at surviving the imaging process, interoperability becomes an important enabler. The objective of this initiative, through interoperability, is to mitigate fraud risk for all stakeholders (banks, customers, merchants, etc.) by shortening the time between a check being presented, and the check verification process, and to enable any receiver of a check to verify it as close to the point of presentment as possible. This project originates from the Check Truncation SIG (http://fstc.org/advisory/check-truncation.cfm) A whiteboard session was held January 26-27 in Tempe, AZ, hosted by Bank of America and co-hosted by JPMorgan Chase. A full draft proposal will be published to the Check Truncation SIG in the coming week to ten days, reflecting the refined objectives and deliverables that were developed in Tempe. Potential project launch is in the March/April timeframe. ______________ 2. Resilience Maturity Model (RMM): Phase I A group of FSTC member institutions and vendors met at the FSTC Technology Recovery Roundtable, hosted by US Bank on October 6th in St. Paul. At the meeting, the group defined a potential project that would develop metrics to evaluate an institution's resilience, much like the Carnegie Mellon CMM model in software development. Resilience in this context is an institution's overall business continuity, disaster recovery, and crisis management program. The business objective of the project would be to allow financial institutions to "rate" themselves and their key business partners against industry-vetted definitions and metrics, and justify investment (or not) where needed to achieve the desired level of resilience. The group met again in New York on January 13th, hosted by JPMorgan Chase, and further refined the concept with 7 of the top 10 institutions in the US represented. A proposal is currently being finalized, and will be published in the next 7-10 days to the general public. More than 8 firms have already committed to participate. If you are interested, please contact Charles Wallen, Business Continuity SCOM Managing Executive, at charles.wallen(a)fstc.org. ______________ 3. Better Mutual Authentication: Phase I As a next-phase concept coming out of the Counter-Phishing: Phase I project, the initiative will focus on establishing a blueprint for the financial industry to establish better mutual authentication between customers and financial institutions. The three components of better mutual authentication include: customer to institution, institution to customer, and email communications from the institution to customer. The objective is to create a framework that supports individual institutions' efforts, while defining a "blueprint" of requirements to ensuring a level of consistency in customer experience (if affected), leveraging customer education efforts, and establishing interoperability wherever possible and prudent. An in-person, large-institution-only meeting is currently being scheduled for mid-late-March to create the charter, objectives, and deliverables for such an initiative. More information will be available in the coming weeks under the auspices of the Security Standing Committee. ## ---------------------------------------------------------------- To subscribe or unsubscribe from this elist use the subscription manager: <http://ls.fstc.org/subscriber> --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

None
by science-feedback＠forsythe.stanford.edu 06 Jul '18

06 Jul '18

> NEW Password: 858548 > (Your password is case-sensitive. Please type > it in _exactly_ as it appears above.) LOL... Mark

1 0

Nov. 26: Barry Hurewitz, HIIP Seminar on Privacy; Nov. 29: Jerry
by HIIP＠Harvard.edu 06 Jul '18

06 Jul '18

Hausman, New Directions in Regulation Seminar on Broadband Access To: HIIP(a)Harvard.edu Date: Wed, 21 Nov 2001 17:07:35 -0500 HIIP Seminar "Current Developments in U.S. Data Privacy Regulation" Barry J. Hurewitz Government and Regulatory Affairs, Hale and Dorr LLP Monday, November 26, 2001 noon-1:30 p.m. BCSIA Library, Littauer Room 369, 3rd Floor John F. Kennedy School of Government Regulatory protection of personal privacy in the U.S. has risen from obscurity in the past few years. Sector by sector, privacy regulations have transformed e-commerce and invigorated advocates of personal information privacy. Privacy protections have been extended to driver's license information, children's online information, financial data, wireless communications, and health records. A combination of industry self- regulation and government enforcement has shaped emerging practices in consumer online privacy. Now, the change in administrations, the war on terrorism, emerging technologies and economic trouble in the online industry are changing the privacy debate in Washington. The FTC has abandoned its call for new privacy laws, and Congress has expanded law enforcement surveillance powers. What is the U.S. regulatory structure for privacy protection? What is happening to e-privacy? Does better information need to compromise privacy? How will the current trend affect e-business? Barry Hurewitz, a partner in Hale and Dorr's Government & Regulatory Affairs Department, has a multidisciplinary practice focusing on federal legislative and regulatory matters affecting technology companies, including federal technology policy, regulatory compliance, government procurement, and technology transfer. As data privacy and security issues have expanded across the high- technology sector, Mr. Hurewitz has advised clients on U.S. and international data privacy developments, including Internet privacy, health data privacy, financial privacy, the U.S.-EU Safe Harbor program for protecting personal data about EU persons, federal surveillance techniques, and privacy in telecommunications. Hurewitz' practice includes regulatory counseling, developing internal corporate data protection procedures, responding to enforcement actions and private claims, participating in the development of new regulations, and tracking emerging state and federal privacy legislation. HIIP Seminar - Schedule for Remaining Sessions, Autumn 2001 December 3 Tim Berners-Lee, Director, World Wide Web Consortium (W3C), and Senior Research Scientist, Laboratory for Computer Science, MIT Seminars to be held on Mondays, 12-1:30pm, BCSIA Library, Room Littauer 369, John F. Kennedy School of Government This is a brown bag style seminar with limited seating available. The schedule is posted at <http://www.ksg.harvard.edu/iip/HIIP-Seminar.html >. The 2001-2002 HIIP Seminar Series is dedicated to the memory of Michael L. Dertouzos (1936-2001). Thursday, November 29, 2001 12:00 - 1:30 p.m. Bell Hall John F. Kennedy School of Government The Regulatory Policy Program and The Harvard Information Infrastructure Project, Center for Business and Government, John F. Kennedy School of Government invite you to attend a New Directions in Regulation Lunch Seminar with Jerry Hausman on "Broadband Internet Access: The Effect of Asymmetric Regulation" The growing market for current digital cellular service (2G) is beginning to decrease the usage of wireline (traditional) telephone service. Although long distance usage is decreasing, as is local usage in countries where consumers pay to make local calls, wireline telephone service offers broadband (high speed) Internet service which current mobile 2G technology cannot offer. Professor Hausman will explore whether the next generation mobile technology, 3G, will provide an adequate data substitute for wireline service. If it does, the need for regulation for wireline service is likely to disappear along with the numerous distortions in the economy that traditional forms of regulation create. Jerry A. Hausman is the John and Jennie S. MacDonald Professor of Economics at the Massachusetts Institute of Technology. He has taught at MIT for 28 years. He is Director of the MIT Telecommunications Economics Research Program. Professor Hausman teaches a course, "Competition in Telecommunications," to graduate students in economics and business. He is also a Special Consultant to Lexecon, Inc. Professor Hausman received the John Bates Clark Award from the American Economics Association in 1985 for the most outstanding contributions to economics by an economist under 40 years of age. He also received the Frisch Medal from the Econometric Society. Professor Hausman has published numerous papers in econometrics and applied microeconomics. His recent applied research has been in differentiated products and in telecommunications. --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0