- cypherpunks-legacy@lists.ogf.org

Anarchist Gathering in Philadelphia
by dmandl＠lehman.com 29 Jul '93

29 Jul '93

OK, I've gotten a whole bunch of requests for more information, so I'll post it to the group. The gathering runs from tomorrow (Friday, 7/30) through Monday 8/2. I don't have details handy here at work, but Giuseppe Cimmino <0005533039(a)mcimail.com> called Wooden Shoe Books (Philly's major Anarchist center and the main organizer of the gathering) and got the following info from them... ----------------------------------------------------------------- Action is Friday and Monday at 1st Unitarian Church, 2125 Chestnut - Friday 2pm-7pm, Monday 9am-1:30pm. Saturday and Sunday at Friends Select Church, 16th and Arch - both days 10am-6pm. Wooden Shoe's phone number is 215-569-2477 ----------------------------------------------------------------- --Dave.

1 0

DSA liscence
by treason＠gnu.ai.mit.edu 29 Jul '93

29 Jul '93

Can someone mail me the NIST dsa liscence agreement? John? It was deleted out of my mail by a co-student...I really wanted that. treason(a)gnu.ai.mit.edu

1 0

Jurrasic revisited
by Brian D Williams 29 Jul '93

29 Jul '93

This is from this weeks Network World, I thought we'd all enjoy it. The following text is Copyright (c) 1993 by Network World. All rights reserved. Permission is granted by the copyright holder and the author to distribute this file electronically or otherwise as long as the entire file is printed without modification (other than cosmetic or formatting changes). <<begin text>> Velocihackers and Tyrannosaurus superior by M. E. Kabay, Ph.D. Director of Education National Computer Security Association 10 South Courthouse Avenue Carlisle, PA 17013 Tel 717-258-1816 Fax 717-243-8642 The current hit movie "Jurassic Park" stars several holdovers from 65 million years ago. It also shows errors in network security that seem to be as old. For those of you who have just returned from Neptune, "Jurassic Park" is about a dinosaur theme park that displays live dinosaurs created after scientists cracked extinct dinosaur DNA code recovered from petrified mosquitoes. The film has terrific live-action dinosaur replicas and some heart-stopping scenes. It also dramatizes awful network management and security. Unfortunately, the policies are as realistic as the dinosaurs. Consider a network security risk analysis for Jurassic Park. The entire complex depends on computer-controlled electric fences and gates to keep a range of prehistoric critters from eating the tourists and staff. So at a simple level, if the network fails, people turn into dinosaur food. Jurassic Park's security network is controlled by an ultramodern Unix system, but its management structures date from the Stone Age. There is only one person who maintains the programs which control the security network. This breaks Kabay's Law of Redundancy, which states, "No knowledge shall be the property of only one member of the team." After all, if that solitary guru were to leave, go on vacation, or get eaten by a dinosaur, you'd be left without a safety net. Jurassic Park's security system is controlled by computer programs consisting of two million lines of proprietary code. These critical programs are not properly documented. An undocumented system is by definition a time bomb. In the movie, this bomb is triggered by a vindictive programmer who is angry because he feels overworked and underpaid. One of the key principles of security is that people are the most important component of any security system. Disgruntled and dishonest employees cause far more damage to networks and computer systems than hackers. The authoritarian owner of the Park dismisses the programmer's arguments and complaints as if owning a bunch of dinosaurs gives him the privilege of treating his employees rudely. He pays no attention to explicit indications of discontent, including aggressive language, resentful retorts, and sullen expressions. If the owner had taken the time to listen to his employee's grievances and take steps to address them, he could have prevented several dinosaur meals. Bad housekeeping is another sign of trouble. The console where the disgruntled programmer works looks like a garbage dump; it's covered in coffee-cup fungus gardens, historically significant chocolate bar wrappers, and a treasure trove of recyclable soft drink cans. You'd think that a reasonable manager would be alarmed simply by the number of empty calories per hour being consumed by this critically important programmer. The poor fellow is so overweight that his life expectancy would be short even if he didn't become dinosaur fodder. Ironically, the owner repeats, `No expense spared' at several points during the movie. It doesn't seem to occur to him that with hundreds of millions of dollars spent on hardware and software--not to mention the buildings and grounds and an entire private island--modest raises for the staff would be trivial in terms of operating expenses but significant for morale. In the movie, the network programmer is bribed by competitors to steal dinosaur embryos. He does so by setting off a logic bomb that disrupts network operations completely. The network outage causes surveillance and containment systems to fail, stranding visitors in, well, uncomfortable situations. Even though the plot is not exactly brilliant, I'd like to leave at least something to surprise those who haven't seen the movie yet. When the systems fail, for some reason all the electric locks in the park's laboratory are instantly switched to the open position. Why aren't they automatically locked instead? Normally, when a security controller fails, the default should be to keep security high, not eliminate it completely. Manual overrides such as crash bars (the horizontal bars that open latches on emergency exits) can provide emergency egress without compromising security. As all of this is happening, a tropical storm is bearing down on the island. The contingency plan appears to consist of sending almost everyone away to the mainland, leaving a pitifully inadequate skeleton crew. The film suggests that the skeleton crew is not in physical danger from the storm, so why send essential personnel away? Contingency plans are supposed to include redundancy at every level. Reducing the staff when more are needed is incomprehensible. At one point, the systems are rebooted by turning the power off to the entire island on which the park is located. This is equivalent to turning the power off in your city because you had an application failure on your PC. Talk about overkill: why couldn't they just power off the computers themselves? Where were the DPMRP (Dinosaur Prevention, Mitigation and Recovery Planning) consultants when the park was being designed? Surely everybody should know by now that the only way to be ready for dinosaurs, uh, disasters, is to think, plan, rehearse, refine and update. Didn't anyone think about what would happen if the critters got loose? Where are the failsafe systems? The uninterruptible power supplies? The backup power generators? Sounds like Stupidosaurians were in charge. We may be far from cloning dinosaurs, but we are uncomfortably close to managing security with all the grace of a Brontosaurus trying to type. I hope you see the film. And bring your boss. <<end text>> Best wishes, Mich Michel E. Kabay, Ph.D. Director of Education National Computer Security Association <<end file>> Brian Williams Cypherpunk

1 0

Digital Money again
by nobody＠alumni.cco.caltech.edu 29 Jul '93

29 Jul '93

You want David Chaum's company, Digicash. They are in Holland. I have tried and failed to find telephone, address, or e-mail info for them. If you do find out, could you let me know? Thanks. One of the seminal papers on DC-nets and some of the protocols behind digital cash is available by anonymous ftp from pub/cypherpunks at soda.berkeley.edu. It's a paper by Chaum. Also, Hal Finney wrote an excellent article on the basics of digicash that appeared in Extropy #10. Eric Watt Forste <arkuat(a)joes.garage.com> PGP key ID 0x431347

2 1

(fwd) VINYL STICKERS: NEW PRICES, BETTER QUALITY
by tcmay＠netcom.com 29 Jul '93

29 Jul '93

Here's mention of getting vinyl stickers made. Even smaller stickers, for a "Big Brother Inside" negative campaign, could be even cheaper. Paper labels could be cheaper still. -Tim May From: menchett(a)pyramid.unr.edu (Peter J Menchetti) Newsgroups: alt.cyberpunk.tech Subject: VINYL STICKERS: NEW PRICES, BETTER QUALITY Date: 18 Jul 1993 00:11:00 GMT I have new prices on my vinyl stickers. They are now SCREEN PRINTED so that the vinyl will NOT scratch off. My prices are now lower and the stickers are better. Anyone interested in these VINYL WEATHERPROOF GLOSSY STICKERS should email menchett(a)cs.unr.edu for details. They are CHEAP. $15 buys 100 cassette sized 2-color vinyl stickers! Pete Menchetti ** Vinyl stickers for cheap, email me! **

2 1

NSA FOIA hearing in SF -- Monday 2 August, 10AM
by gnu 29 Jul '93

29 Jul '93

My Freedom of Information case against the NSA continues to grind on. This is the case where I found two manuscripts by William Friedman in public libraries and got them formally declassified (they were never properly classified). The one that got national press coverage. At this point, the case has been resolved except for the issue of whether NSA has to follow the Freedom of Information Act with regard to time limits. The Act states that requests will be answered within ten days, with exceptionally hard requests getting another ten days. NSA doesn't even send you a postcard back within ten days; they often take several months. I have a FOIA request that's been in there more than a year now and hasn't been answered. The last courtroom action involved NSA's lawyer and my lawyer presenting oral arguments about whether the lawsuit could be amended to invoke the First Amendment, and whether the case should be thrown out of court (`summary judgement'). After the hearing, Judge Henderson decided that we couldn't bring in the First Amendment, since NSA had made the question `moot' by declassifying the documents I wanted to publish. But he also decided that our case had merit with respect to time limits, so it would not be thrown out of court. He also decided that our requests for documents from NSA should be honored. Since then, NSA has filed a second motion asking that the case be thrown out, and has also gotten a temporary stop in the clock for giving us documents. Their reasoning on throwing the case out is very interesting. They claim that since I have all the documents I'm going to get from my original FOIA request, the question of whether they responded in a timely fashion is `moot'. My lawyer, Lee Tien (tien(a)toad.com or tien(a)well.sf.ca.us) wrote an excellent response in which he shows six ways from Sunday that they can't throw this out. Since it takes much longer to push such a case through the courts than it takes NSA to eventually respond, they would NEVER have to confront the issue, if this was how the courts worked. (Often NSA uses this as yet another delaying tactic: they simply don't respond, or deny having any records, and force you to take them to court to get ANYTHING -- which then takes forever. This is part of what we want to help change by making them follow the time limits in the law -- we'd like to see them penalized for withholding documents that they later reveal when forced to.) The upcoming hearing should include oral arguments on these points. The judge probably won't decide anything right there and then. Judge Henderson's courtroom 19th floor Federal Building 450 Golden Gate Avenue (a few blocks off Van Ness Avenue) San Francisco, CA Monday, 2 August, 1993, 10AM I know 10AM on a Monday is early for many cypherpunks to be seen at the Federal Building, but a show of solidarity would be heartening. It helps to convince the judge -- and the government lawyers -- that the public really cares about the outcome of the case. Also, you get to see and talk with a real live lawyer for the NSA! (I'm not sure who will show up -- last time it was Jack Martin, who actually works for the Dept. of Justice, defending the NSA.) John Gilmore PS: Some early NSA documents in the case are available on ftp.eff.org in pub/crypto. I'll add a draft version of Lee's recent filing under pub/crypto/Plaintiff/930718-statement-opposing-dismissal. It's all in Legalbol, so it's sort of like reading a paper on cryptography -- you have to read between the lines until you get used to the terms and ideas. I recommend reading Defendant/declaration-of-michael-smith for some info on the internal workings of the NSA FOIA process. We haven't scanned in the NSA's recent documents yet, nor put up most of our own (they're on Lee's Mac, and Macs are congenitally unable to produce ASCII text, it seems).

1 0

Re: Digital Silk Road
by norm＠netcom.com 29 Jul '93

29 Jul '93

The "gunzip" command expands .gz files on some Unix systems. I hear that some ftp systems magically do it for you but I can't confirm that. If none of that works let me know.

1 0

Digital Silk Road
by norm＠netcom.com 29 Jul '93

29 Jul '93

This is the stuff that Dean Tribble and I talked about at a couple of Saturday Cypherpunk meetings in Calif. While it has nothing directly to do with crypto it is an architecture that avoids central control and thus has an anarchical flavor. Let me know if you can't use either RTF or PostScript or cant do FTP. Abstract: of The Digital Silk Road Existing and proposed mechanisms for digital money all require large overhead to transfer money between parties. This overhead makes them unsuitable for extremely low cost activities such as delivering and routing packets. We propose a money system with extremely low transaction cost built into the communication protocols. The money introduced by this system is much more like coins than like bank accounts; it supports only small transactions, requires limited trust among the participants, and requires no central bank. With this as a foundation, we then describe elements of an open system that fully supports network resource management, routing, interconnection with the Internet, and so forth, across trust boundaries with competing providers for all services. This supports a style of informal information commerce. This paper is available thru anonymous ftp at netcom.com:pub/joule/DSR1.ps.gz and DSR1.rtf.gz. The file format, .rtf, (Rich Text Fotmat) can be read by many different word processors including those from Microsoft, MacWrite II, and some Unix systems. I will produce other formats with a bit of pressure.

3 2

Info wanted on DVP & DVG
by thug＠phantom.com 28 Jul '93

28 Jul '93

Does anyone out there have any technical specs and/or prices and/or purchasing restrictions on Motorola's "Digital Voice Privacy" (DVP) and General Electric's "Digital Voice Guard" (DVG) radio systems? From what I know, these are supposed to be DES encrypted voice radio systems used by federal agencies like the DEA, FBI, SS, ATF, and perhaps the CIA. I'm assuming that there are purchasing restrictions on these systems. Are there similar systems that are made by companies outside of the U.S., which perhaps could be imported without restriction and/or registration with the NSA or Customs? Thug

1 0

Batteries not included
by fergp＠sytex.com 28 Jul '93

28 Jul '93

On Tue, 27 Jul 1993 11:51:56 -0700, Dave Mandle <uunet!pmantis.berkeley.edu!nobody> wrote - > I considered (for a couple of seconds) responding to P.M.'s > request, but then decided against it. I'm sure he's a nice > guy, but I generally don't trust mainstream journalists too > much and don't go out of my way to talk to them. People may > have actually made a decision not to talk to him, so I > wouldn't assume it's "apathy" or anything like that. (I'm > sensitive about this because people are always accusing > anti-voting anarchists of "apathy," and that gets us > hopping mad.) While I'm not trying to offend anyone in particular, I think this attitude hurts cypherpunks more than it helps us. I called Phil Mulivor this morning and had a long chat with him. He seems very knowledgeable about the intrinsic value of digital communications mediums, especially the Internet. Speaking your mind in a public fashion can sometimes help progress, Dave. Get involved. Cheers, Paul Ferguson | "Government, even in its best state, Network Integrator | is but a necessary evil; in its worst Centreville, Virginia USA | state, an intolerable one." fergp(a)sytex.com | - Thomas Paine, Common Sense I love my country, but I fear its government.

1 0