- cypherpunks-legacy@lists.ogf.org

Introduction...
by Sy Verpunc 30 Apr '93

30 Apr '93

To whoever it was at Ohio who just fingered this account... (whether it's one of us or the obligatory NSA mole :-) [oops, no, the NSA mole works out of uunet.ca, right?]) - I'll save you the bother - it's not a cunning alias, it's just a spare account I created so I don't get all this stuff in my real mailbox; I have an account for every mailing list I'm on. If you want to mail me under my normal account, it's the rather obvious gtoal(a)gtoal.com Graham

1 0

Re: PGP on soda.berkeley.edu
by pfarrell＠cs.gmu.edu 30 Apr '93

30 Apr '93

Hal, I think you are being overly paranoid. Jim Bidzos must protest the use of PGP. If he doesn't, he will lose the ability to claim that companies have to pay for RSA. He has publicaly, and repeatedly, stated that the ITAR is a crock. Don't wave a flag infront of the bull. He has personally told me that he is very interested in a RSA approved program that is PGP compatible. He simply can NEVER say that PGP is OK. If we are to say to the politicians that normal folks need strong encryption, then we have to start without being labled criminals for violating the US laws. If I remember, you are not in the US, so it is fine to ignore Bidzos. I can not write my congressman and saw Clipper is bad, PGP is good when use (and development) of PGP is against the law. We could argue that the law is bad. I can agree. But changing the law will take so long that RSA will be illegal. Then when I use it, it will be grounds for a search warrent. Pat Pat Farrell, Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science, George Mason University, Fairfax, VA

1 0

HELP! Some nut is threatening to sue!
by Stanton McCandlish 30 Apr '93

30 Apr '93

Due to my posts to sci.crypt and elsewhere that I was distributing PGP, I recieved the following, and after that a very biased textfile on the dangers of having PGP and how terrible it is. Can anyone verify that this is a real threat? Last I heard PGP *MIGHT* violate a patent, but that this had not been decided yet. Please reply soon, and by direct email. If it is the Real Shit, I don't think they are going to give me long to ditch PGP... :( Begin forwarded msg -----------------------------------------------------

3 2

Tough Choices: PGP vs. RSA Data Security
by Hal 30 Apr '93

30 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- I thought Eric's analysis of RSADSI/PKP's position was interesting, but I have to take issue with a couple of points: > Premise: RSADSI created RSAREF in order to license individuals. This seems to assume that RSADSI needs to "license" individuals in order to allow them to use the patent. But I don't think this is the case. RSADSI can simply say that individual, non-commercial use of the patents is permitted by them. In fact, they do say that, apparently. As Pat Farrell reported today: > I found that PKP has two simple philosophies: (1) they have a valid patent, > and you must agree to this fact and (2) if you make money, they make > money. I understand that the FAQ from RSA confirms this, that non-commercial, personal use of the patent is OK. (Actually, I don't think this first point, that "you have to agree that their patent is valid" is in the FAQ. I think this was added specifically because the PGP documentation criticizes the patent.) So, it does not seem to me that they had to take _any_ specific action in order to "license" individuals to use their patent non-commercially. They simply had to say, as they already said, that such use is not considered infringing. > Since they don't make any money from it, there's > no reason for them to spend much money paying lawyers to draft license > agreements for products which bring in no income. Therefore they want > all non-income uses of the patents to be filtered through a single > license. Again, there is no need for them to pay lawyers to set up a host of different "non-income" licenses. There is no need to "filter" all such uses through a single package. Rather, a general blessing of non-commercial use should be adequate. > Assertion: The reason that RSADSI requires that individual licenses be > mediated through RSAREF is that non-commercial software is inevitably > used in commercial contexts. Allow personal, non-commercial use does not mean they lose any rights to sue companies which make money off the patent. If a non-commercial product (like PGP) is used in a commercial context then both Phil and Jim may be expected to go after them. This therefore is not at all a reason for RSADSI to require individual licenses to be mediated through RSAREF. Doing that gives them no rights that they didn't already have. > Remember, their main business is > licensing. All software used in a commercial context must be > licensed, otherwise their main business is imperiled. Were they to > make separate licenses for every low end product, they would be in the > same situation as if they licensed individuals--high overhead, small > return. Therefore, they license RSAREF to companies; this allows > RSADSI to economically offer licensed use for all such low end > software packages. Here Eric is apparently talking about commercial use. I think our discussions are in the context of personal, non-commercial use. We should clearly separate these two issues. Where a putatively non-commercial product, whether RIPEM or PGP, is used in a commercial situation then PKP and/or PRZ may choose to take legal action. But the non-commercial situation can be dealt with without restricting users to use RSAREF. In short, Eric has not persuaded me (at least) that RSADSI was in any way forced to restrict non-commercial users to use the RSAREF package. Their general policy of permitting personal, non-commercial use, and demanding that "if you make money, we make money" are more than adequate without RSAREF entering the picture at all. Hal Finney 74076.1041(a)compuserve.com -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK+ExaKgTA69YIUw3AQErDQP/ZMqrgzTm/j2T5xkbLCruCdVfd+a/U9tk aNNE8687LMZsC9RSxh6me60zWEQag1DnLqOA5zhn+9kbQ3HbYsc58oc/5vNgJwEe lAfcRImykqdIq3PLWgGyvhqqBsOib/k9uL8+OijcdYmsnLciDN8z4IdREDDKn7zu w83hCzV7BDc= =zAQ6 -----END PGP SIGNATURE-----

1 0

List of remailers 4/30/93
by Karl Barrus 30 Apr '93

30 Apr '93

-----BEGIN PGP SIGNED MESSAGE----- Q1: What cypherpunk remailers exist? A1: 1: hh(a)pmantis.berkeley.edu 2: hh(a)cicada.berkeley.edu 3: hh(a)soda.berkeley.edu 4: nowhere(a)bsu-cs.bsu.edu 5: ebrandt(a)jarthur.claremont.edu 6: hal(a)alumni.caltech.edu 7: remailer(a)rebma.mn.org 8: elee7h5(a)rosebud.ee.uh.edu 9: phantom(a)mead.u.washington.edu 10: hfinney(a)shell.portal.com 11: remailer(a)utter.dis.org 12: 00x(a)uclink.berkeley.edu 13: remail(a)extropia.wimsey.com NOTES: #1-#4 remail only, no encryption of headers #5-#12 support encrypted headers #13 special - header and message must be encrypted together #7,#11,#13 introduce larger than average delay (not direct connect) #12 public key not yet released ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks directory at soda.berkeley.edu (128.32.149.19). Instructions on how to use the remailers are in the remailer directory, along with some unix scripts and dos batch files. Mail to me (elee9sf(a)menudo.uh.edu) for further help and/or questions. ====================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.2 iQCVAgUBK+FaUYOA7OpLWtYzAQHAkwP/XeYgJtC+oSWPkg84wMrkWUjuim7vMPgm XVpf90hvHyMy7dJbmCliQachBMV2/5ddgTipISdYzD3xeExIVNYOPruuQLSCDhrC 1zXpsqHlTUw9gppem58NoUPuQl2OP2vSUyWf12yxFpfTQ7Qg3gQ7GBiROa8xuaoC 31IzbfsvqE0= =iMsm -----END PGP SIGNATURE----- /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

1 0

Re: Need some Advice
by bcox＠gmu.edu 30 Apr '93

30 Apr '93

"Stephen P. Marting" <spam+(a)CMU.EDU> wrote >The difference between Software Engineering and Computer Science is sort >of like the difference between Differential Equations and Mathematics. >SoftEng is a subset of CompSci. Isn't it more like the difference between epicyclic computation and Ptolemaic Astronomy? In other words, don't these labels really denote software pre-engineering and computer pre-science? -- Brad Cox; bcox(a)gmu.edu; 703 968 8229 Voice 703 968 8798 Fax George Mason Program on Social and Organizational Learning

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by geoffw＠nexsys.net 30 Apr '93

30 Apr '93

Maybe this is a solution... A core group of us coders take on the task of merging PGP functionality into MailSafe, we do the work for nominal cost or for free, this new version of MailSafe can become REALLY slick and worth paying the $125 or what-ever he is charging for it, AND it will be PGP compatable. We them retrofit PGP to use RSA's RSAREF or whatever else it takes to bring PGP into complience and PGP stays FREE, and unsupported, we suspend further development and make it sort of like a demo program or freeware, but if you want the really seemless UI you buy the product, Bidzos gets money, we get to deploy a program that educates the masses about the use of strong crypto, and since they are compatible, the use of the freeware can't help but encourage the use of the "product". The bottom line is that strong crypto is made available to the public, This solution might require that a few egos deflate a bit but I'm sure a varient of this could work.

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by Sy Verpunc 30 Apr '93

30 Apr '93

From: Theodore Ts'o <tytso(a)athena.mit.edu> From: Sy Verpunc <svp(a)gtoal.com> (Graham Toal) Thats what people have *always wanted* to do. RSA won't let them. That's why any talk of a newer friendlier Bizdos is bullshit. Have you actually tried? *I* don't need to. PKP don't have a patent in Britain. Several people from RSA, including Bidzos at the last Cypherpunks meeting at Mountain View (I wasn't there, but take a look at the meeting "minutes"), have stated repeatedly that if someone were to ask for permission to use the internal interfaces of RSAREF in order to write a PGP-compatible program, they would grant permission. That's *NOT* what we want to do. We have perfectly good code that we trust already, called pgp. We're offering to pay a patent licence for pgp, not some RSADEF-derived code with DES that we don't trust. Hell, *I* would even pay a license fee for pgp and I'm not even legally obliged to... However, as of two weeks ago, *NOT* *A* *SINGLE* *PERSON* *HAS* *ASKED*. Because that's the wrong question. G

1 0

Fw: RSA approval for freeware, PGP compatible user program.
by Pat Farrell 30 Apr '93

30 Apr '93

I'm a cypherpunk. I write code. I have already told the list my feelings on TC "the suit" May's suggestion. I read the post that no one asked PKP for permission to include RSA in a freely distributed strong cryptography package that was PGP compatible. So I asked. I found that PKP has two simple philosophies: (1) they have a valid patent, and you must agree to this fact and (2) if you make money, they make money. I don't have the interest, energy, time, or money to argue with (1), so fine, I'll say I agree. I sure haven't made any money off PGP, and probably won't off of this. I found that Jeff Schiller of MIT suggested an effort to develop something on RSAREF from scratch that would bring the pgp, RIPEM, TIS/PEM, etc. communities together. The PKP folks are strongly supportive. They (PKP, MIT, pfarrell. et al) need to do programming and reverse engineering. If other cypherpunks can code, volunteer. While the source for PGP is available, it is copyrighted. Unless we can get the copyright owner's permission, we'll have to reimplement it from scratch. Not an attractive idea. If you have a religious belief that software patents are immoral, that PKP is really a front for the NSA, etc. and don't want to help, that is fine with me. Simply don't volunteer. I'd like to believe that this really isn't a splintering of the cypherpunks. My guess as to why PKP is willing to talk to me and others now, and was not willing to agree to license PGP was that Phil never got permission to use RSA, and so agreeing to license users use of PGP is admission that using RSA without PKP permission is OK. There is no way that PKP can allow that to be infered. Pat

1 0

Re: Tough Choices: PGP vs. RSA Data Security
by George A. Gleason 30 Apr '93

30 Apr '93

Quoting, "Thats what people have *always wanted* to do. RSA won't let them. That's why any talk of a newer friendlier Bizdos is bullshit. Well, maybe or maybe not... the main thing is to judge by concrete actions. I know there have been problems in the past, and reason for serious scepticism. But the main thing here is to keep the channels open and work toward some kind of concrete action on RSA's part. -gg

1 0