- cypherpunks-legacy@lists.ogf.org

Statement of dissatisfaction with your recent efforts (fwd)
by Mark 09 Jun '93

09 Jun '93

Probably shouldnt have, but they get on my goat. Forwarded message: >From mark Wed Jun 9 10:59:04 1993 >Subject: Statement of dissatisfaction with your recent efforts >To: cert(a)cert.org >Date: Wed, 9 Jun 1993 10:59:04 +1000 (EST) > >Dear cert et al, > >It has come to my notice recently that your organisation has been >involved in a number of accusations against individuals and organisations >with very little to back such accusations. > >I am referring to, and these are the ones I will mention here, the >soda.berkeley.edu and the anon.penet.fi sites., both of which ARE >legitamate in all respects and are SEEN as such by the net.community. >Your organisations actions, in my personal opinion, consititute a form >of harrassment of the worse kind, and it basically smells. > >Whilst any one with any knowledge of your workings already knows the >low quality of feedback, lack of helpfulness and general arrogance of >your methods, it doesnt do you any good at all to set about on a >crusade of self-serving actions against those sites or entities or >groups of individuals you dont like or you see as furthering ideas >and software that might one day make your life difficult. You will >alienate a larger proportion of the net.community than you otherwise >have. > >I would suggest in future you take the time to VERIFY, through whatever >legal means are at your disposal, the authenticity of your information, >to view yourselves the problems/files and then take whatever action your >charter states as appropriate. Going off gun-ho and sending ominous form >letters to people you see as gullible enough to carry out your desires >really is less than professional. > >I fail to see where you get authority for a large proportion of your >actions, but that is a matter between you and your financiers. Just dont >expect people to take you seriously if the above scenarios are repeated. > >The above is my own personal observations and not those of any other >individual or organisation, although they are free to explicitly echo >them if they so desire. As of yet, none have. > >Mark. >mark(a)cheops.anu.edu.au

1 0

Re: CERT
by jet＠nas.nasa.gov 08 Jun '93

08 Jun '93

peter honeyman writes: > jet wrote: > > I personally like being contacted by an organization trying to tell me > > that someone might be misusing my computing resources. > how would you feel about an organization telling your boss that > your actions were contributing to the abuse? I wouldn't care given my current boss(es). If my boss were the sort to believe a vague form letter and take action w/o consulting me, I'd want a different boss anyway.

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by nobody＠cicada.berkeley.edu 08 Jun '93

08 Jun '93

-----BEGIN PGP SIGNED MESSAGE----- This "coincidence" brings a name to mind. Rhymes with "turn right." Starts with S. What could I be thinking? DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.2 iQBFAgUBLBUF/fFZTpBW/B35AQEFfQGArv/awBslh2T7ybcjtiiiT9Ew3wxPz3Vv od0hAFCl5L0VFOA1MczZozJWf4xH0nFM =LNm6 -----END PGP SIGNATURE-----

2 1

CERT and us
by fnerd＠smds.com 08 Jun '93

08 Jun '93

hey folks a poem by fnerd It looks like CERT may have a habit of sending accusatory-looking form letters without doing much checking of their own based on who knows what tips. Looks like they need to polish their policies and their prose a little bit. BUT We, too, are a group formed to look into problems of computer security. We, too, respond to security emergencies. We, too, distribute patches to help people improve their security. We, too, send messages--even rumors--back and forth about threatening situations and people we suspect. Sure, our style and emphasis are different, but our charter is very similar to theirs. Let's not let our name or style distract us from our mission or blind us to potential allies. Instead of thinking of them as the heavies and us as the rebels, WHY NOT us as the net-wise older brothers, and them as the enthusiastic amateurs who need some advice and calming down? Eric can write one of his authoritative letters, and we become the voice of reason, the watchers of the watchers, Liberty's eyes. Gentlemen and ladies (I reproach you), remember who we are. -fnerd quote me

1 0

New PGP Version?
by Kent Hastings 08 Jun '93

08 Jun '93

New PGP Version? Here goes with ANOTHER stupid newbie question: What's the latest PGP version? I have DOS and Mac copies of version 2.2. Is there an e-mail accessible group like this for PGP or crypto in general? I see references to sci.crypt on occasion. Is that easy to get, or do I have to do fancy-smancy things with archie, ftp, usenet, and other Greek words? (I have docs for archie, and will soon have UUCP decode software, but I haven't figured out all this complicated, user-hostile stuff quite yet). I DO know IBM MVS/JES2 JCL, and because there is nothing more difficult to use, I am confident that this Internet jive will seem trivial someday. Kent - kent_hastings(a)qmail2.aero.org#000#

1 0

CERT
by Clark Reynard 08 Jun '93

08 Jun '93

I was disgusted and horrified to read that PGP had been removed from soda, and gratified to find that it had been returned. However, your experiences with CERT are not unique. As could be expected of any agency directly funded by Air Force Intelligence, CERT is a genuinely ugly organization which needs to be stamped out. Frankly, it's a menace to society. Examine their acronym. Computer Emergency Response Team. What a fucking joke! Excepting the Morris Worm, can you name a SINGLE Computer Emergency which CERT has halted? It is simply an organization to keep the crypto-fascists wired into the net. I will assume, as you did not say otherwise, that you do not know the name of the CERT person who reported you, for whatever ridiculous reason. This is standard practice for CERT; it's customary for them to hide behind a shield of anonymity for the purpose of attacking people. My life was severely disturbed three years ago due to similar anonymous tips from CERT, and I have yet to discover the identity of the CERT person who tipped off the authorities to me. CERT is yet another agency which is freed of Constitutional restraints for a vague and undefined 'public good.' If distributing PGP, legal in the entire Free World except for the US, is a "Computer Emergency," then I'm a fucking Republican. Combat this so-called Computer Emergency Response Team wherever you see the tendrils of its evil influence. ---- Robert W. F. Clark "Be sand, not oil, in the machinery rclark(a)nyx.cs.du.edu of the world." Gunter Eich clark(a)metal.psu.edu

8 9

Re: ALERT / My email address is...
by TO1SITTLER＠APSICC.APS.EDU 08 Jun '93

08 Jun '93

Well, actually, it's not even a hack to find out who the subscribers are... You simply use the EXPN command in the SMTP protocol to find out who the recipients of a list are. This is documented in RFC-821. However, the cypherpunks list requires a little bit of ingenuity, or familiarity with sendmail. I periodically get a copy of this list, just in case. Last I checked, there were 409 names on the list. Two were files, about ten or fifteen were either other lists, fidonet echos, or local USENET newsgroups. The rest appeared to be real people. Most of the apparent lists listed on the cypherpunks list were not traceable thru SMTP EXPN. If you desire real privacy, I suggest that you get the cypherpunks list, figure out which ones are hidden lists, and ask to subscribe to those. If it is desired, I can send a list of these lists to the cypherpunks list. Kragen

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by smb＠research.att.com 08 Jun '93

08 Jun '93

steve, like eric, i feel that cert is overstepping their charter by engaging in law enforcement activities. what's your feeling on the matter? don't you agree that this could jeopardize their ability to do the work they are chartered to do? Law enforcement? It's law enforcement if they do more than notify the owner of the site. Most such sites welcome the notifications *if* (and it's a big ``if'') their machines are being abused by outsiders. If CERT is going out and looking for pirated software, or if they try to take any action to enforce their notes -- then, I do agree with both of you; such actions are beyond their charter. (Though one can argue that clandestine distribution of malware would fall be an exception. I specify ``clandestine'' because one could entertain a reasonable suspicion that the motives of such distributors was not purely educational...) If you asked CERT to justify such notes, they'd probably quote the following text from their press release on ftp.cert.org: It will also serve as a focal point for the research community for identification and repair of security vulnerabilities, informal assessment of existing systems in the research community, improvement to emergency response capability, and user security awareness. ``User security awareness'' sounds about right. Look -- CERT did not demand that the ftp area be shut down, they did not threaten to cut the machine off from the Internet, they didn't (as far as I know) turn the note over to the FBI or the Secret Service, and they didn't mention PGP or ``dirty GIFs''. They simply *informed* the administrator, in a polite way, of information that that administrator probably wants to hear. (I've had occasion to notify various system administrators of the same sort of thing. They were all grateful for the report.) The overly-hasty response came from Eric's end. What the administrator's response should be if RSADSI sent a note about PGP is another matter. This is CERT, and they're talking about pirated software. --Steve Bellovin Disclaimer: I'm on friendly terms with CERT, and with a lot of the folks who work there. And -- as anyone who has read my papers knows -- I've sent in my share of incident and vulnerability reports.

2 1

RE:CERT
by Robert Luscombe 08 Jun '93

08 Jun '93

Not having heard of CERT before, and living ten minutes away from their offices at SEI, i checked out their anonymous ftp site (cert.org) and found the CERT faq in the pub directory. From the info THEY provide, it seems like a worthwhile organization. BUT, in their info, they deal with security issues, not copyright infringement. I realise that hidden directories in an incoming dir is a security issue, but it seems to be a thinly veiled attack on the distribution of software of illegal or questionable origins. They do publish security advisories; i would be interested in seeing a list of sites served with notices similar to those julf and soda received. Does anyone have more info on CERT? BTW- SEI at CMU is a scary place. The photo lab i worked for as a messenger had clients there, so i was in the building a couple times a day for more than i year. Because of their DOD affiliation, there are regular protests outside the building. On a normal delivery during one of these protests i was surrounded by guards, searched, and asked some WAY paranoid questions even though the regular guards knew who i was. If you ever happen to be walking the halls of SEI and see the nice big prints of guided missiles and other scary stuff, I probably delivered them. --Robert Luscombe ral(a)telerama.pgh.pa.us | 2201 Sarah Street Apt. 3 robert(a)well.sf.ca.us | Pittsburgh, PA 15203 rluscomb(a)nyx.cs.du.edu | 412/488-0941 (Finger for PGP Public Key)

1 0

CERT
by Sandy 08 Jun '93

08 Jun '93

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, I would guess that the intent of the letter Eric Hughes got from CERT was to intimidate rather than to raise some arguable issue. I hope Eric plans to ask Ms. Katherine T. Fithen, directly, who the tipster was ("I'm sorry, we do not divulge the names of our confidential informants"), why someone at CERT didn't contact Eric first, what specific allegations were made, etc. I would like to see a copy of such an e-mail message and its response, if any. What say, friend, Eric? Intrudingly yours, S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0