HDTenEightyP/NetNews huggingface dataset:
From: mkj@world.std.com (Mahatma Kane-Jeeves)
Subject: Re: legal question re anonymity online
Organization: The World Public Access UNIX, Brookline, MA
Date: Thu, 7 Jan 1993 23:31:07 GMT

In a reply to mkj, Mike Godwin wrote:
         
>>Infuriated and in desperate need of financial help, John sues the
>>BELL.  My question:  Does he have a case?
         
>Absent more fact than this, almost certainly not.
         
Thank you for your response to my message.  I find your answers disturbing.  
Although I don't question your expertise (I'm not qualified to do so), your 
answers seem to defy common sense.  And although I do not generally welcome 
increased liability for sysops (I've been one, and may be again), if true, 
this particular lack of liability seems unfortunate to me.

Legal considerations aside for the moment, if I invite people into a situa-
tion which I know is dangerous, or knowingly impose dangerous policies upon 
the innocent, it would certainly bother my conscience.  For example, if I 
keep inviting people to swim at my pool, even though I don't use enough 
chlorine and some of them get sick from time to time, I would certainly 
feel like a heel -- especially if I charged admission.  And in general, if 
anyone suffers unnecessarily as a result of any of my actions, I always 
feel an ethical responsibility to make some amends.

This seems to me like such a fundamental moral minimum that I am surprised 
to hear you say it is not reflected in the law.  Can you elaborate on why?  
Is this a general principle, or do you feel that BBSs are less liable than 
other businesses in analogous situations?

>Absent actual negligence on the BELL's part, it won't be held liable.

Like I said, I'm no lawyer, but I happen to have a reasonably recent copy 
of Black's Law Dictionary, so I decided to take a look at entries relating 
to the term "negligence".  According to Black's, "Doctrine of negligence 
rests on duty of every person to exercise due care in his conduct toward 
others from which injury may result".  This appears to me to bode ill for 
those who impose real-name policies.  But elsewhere in Black's, I found 
that the standard by which legal negligence is judged is "Failure to exer-
cise that degree of care ... which a man of ordinary prudence in the same 
situation and with equal experience would not have omitted."  Would I be on 
the right track, therefore, in speculating that the reason why you feel 
real-name policies cannot constitute negligence is simply that such poli-
cies are so widespread as to define "ordinary prudence"?

Thanks again for your attention.

                                        ---  mkj

Newsgroups: comp.org.eff.talk
From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Beneficial Virus?
Organization: Digital Transmission Systems, Duluth, GA.
Date: Wed, 6 Jan 1993 15:22:43 GMT

In article <C0EJAu.HuI@panix.com> rpowers@panix.com (Richard Powers) writes:
>In <1993Jan5.153018.18935@nastar.uucp> phardie@nastar.uucp (Pete Hardie) writes:
>>My point is that you do not necessarily know which file is the marker.
>
>How would this be possible?  You would have to have installed the
>marker file in the first place to enable the virus to operate on your
>system!  There is no way you could not know which it is.  The whole
>point of this thing is that you have to deliberately let the virus
>have access to your system.  They way you would do this is by placing
>a specific file on your system that the virus would look for.
>Otherwise it simply does not propogate.

Consider a multi-user system where another user installed the virus, and I
want to transfer a file to my home system, and need to transfer the marker
file, but I do not know which file it is.

>The files are not changed by being without the marker!!  The only
>thing which is changed is that the virus will no longer spread itself.
>The compressed file _still_ has the virus prepended.  Thus it will
>_still_ be able to decompress the file upon execution.  It will then:
>[commit hari-kari/notify the user/do nothing] (discussed elsewhere).

This is noted.  See below.

>>Still, the question arises - suppose I decide I don't want those files stored
>>compressed any more.  How would I get rid of the virus?
>
>Simple.  You remove the marker.  That is what the marker is for! 

But the virus still remains embedded in the compressed files.  Unless the
virus code is remove on decompression, and re-inserted on write-to-disk, it
remains in the file, albeit dormant.  Sure, no more files are infected once
I delete the marker file (assuming I know which file it is), but suppose I
want/need to transfer a file to another system that is required to be virus-
free?  How to I get an uninfected copy of my file?

-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
Newsgroups: comp.org.eff.talk
From: mnemonic@eff.org (Mike Godwin)
Subject: Re: Computers, Freedom and Privacy Conferences: Proceedings?
Originator: mnemonic@eff.org
Organization: Electronic Frontier Foundation
Distribution: comp
Date: Mon, 11 Jan 1993 18:40:47 GMT

In article <PLUMMER.93Jan11102854@cilantro.cs.swarthmore.edu> plummer@cs.swarthmore.edu (David Barker-Plummer) writes:
>Are there proceedings available for the Computers, Freedom and Privacy
>conferences available?  If so, could someone send me publication
>details, or preferably on-line sources.

I believe Judi Clark (judic@well.sf.ca.us) can provide pointers to sources
for transcripts and proceedings.


--Mike



-- 
Mike Godwin,    |"I'm waiting for the one-man revolution
mnemonic@eff.org| The only one that's coming."
(617) 864-0665  |                           
EFF, Cambridge  |                   --Robert Frost 
Newsgroups: comp.org.eff.talk
From: rpowers@panix.com (Richard Powers)
Subject: Re: Beneficial Virus?
Organization: PANIX Public Access Unix, NYC
Date: Wed, 6 Jan 1993 22:46:37 GMT

In <BETSYS.93Jan5233720@ra.cs.umb.edu> betsys@cs.umb.edu (Elizabeth Schwartz) writes:

>You are missing a basic point.

You're the one missing the point.  (Actually several points).

>For a virus to "check for the presence
>of a marker file" that virus has to be executing on my system, whether
>or not I have authorized it to. 

>    Besides, how does the virus *get* to my system? Either it cracked my
>security, again without my permission, or it was hidden on a file
>imported onto my system, without my knowledge[...]

As I have said SEVERAL TIMES this virus would be deliberately placed
on a system.  The permission/marker file is there to keep it from
spreading to other systems inadvertently.

>[...] (if I *know* about it,
>and import it deliberately, then packaging it as a virus was not
>necessary.)

"Packaging it as a virus"???  Am I to call the virus something else?
The subject of this thread is a beneficial virus (or specifically BCV-
Beneficial Compression Virus- as I've called it elsewhere), how it is
packaged is irrelevant(sp?), it doesn't cease to be a virus because of
what you call it.
 
>As another poster said, I don't see that there's anything you can do
>with a virus that doesn't have a non-viral alternative that is safer
>for the rest of the world.

The BCV does _NOT_ pose a danger to the rest of the world in any way,
shape, or form.  Is it a threat to National Security that I have a
program replicating itself on _my_ home computer with no way of it
unintentionally spreading elsewhere? 

-- 
 Richard Powers    / Disclaimer: My keyboard is \   Computer=Amiga
rpowers@panix.com <  screwy.   Missing  letters  >  Music=Industrial
   Hail Eris!      \ should     be    expected. /   Food=Vegetarian
Newsgroups: comp.org.eff.talk
From: Clayten_Hamacher@mindlink.bc.ca (Clayten Hamacher)
Subject: Re: Beneficial Virus?
Organization: MIND LINK! - British Columbia, Canada
Date: Fri, 8 Jan 1993 00:34:17 GMT

>But if the environment requires virus-free code, ANY infected program is not
>acceptable.  Just because the pop-up message says "I'm just a decompression
>virus, I won't hurt your system." does NOT means that's true.  Once this
>compressor virus was out for a while, there would be a dangerous virus that
>mimicked it up to the point where it entered the system, then attacked.

Then you shouldn't use any program that is over a month old.. Someone could
have written a trojan into it. But then you can't trust new programs because
they might be trojans... Hmmm, hire in-house programmers to make ALL your
s/w.

P.S. if someone was going to write a virus they wouldn't have it say "Hi, i'm
nice, trust me", they'd have it secretly infect..

I do agree that it should have a suicide flag so that if you ever want a
clean version (Maybe you use stacker or one of the disk doublers already) you
could get it. I'm just saying that if it's a 'clean' system you shouldn't use
ANY outside programs at all.

--

Clayten_Hamacher@Mindlink.bc.ca                 Land of the rising snow.
From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Beneficial Virus?
Organization: Digital Transmission Systems, Duluth, GA.
Date: Mon, 11 Jan 1993 17:05:04 GMT

In article <19423@mindlink.bc.ca> Clayten_Hamacher@mindlink.bc.ca (Clayten Hamacher) writes:
>Then why wouldn't someone d/l a new version of some PD utility and install a
>virus in there? It's just as likely to happen in the compression virus as a
>space invanders clone.

It's easier policy to say: "No games allowed on this machine"

>>You can compare an executable (for non-changing code) against a known clean
>>copy, to check for infection after the clean copy date.
>
>Not if you d/l it from a BBS or FTP site, you can't be sure that what you are
>getting is clean code.. You can compare later versions with this to see if it
>changes, but that's another story, you're not sure it's clean.

Again, if you are trying to run a virus-free operation, then you do not d/l
code from othe rplaces unless you CAN vet them for virii, etc., and can get
a clean executable copy.



-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
From: david.brooks@cutting.hou.tx.us (David Brooks) 
Newsgroups: comp.org.eff.talk
Subject: Re: Beneficial Compressio
Date: 7 Jan 93  3:17:00 GMT
Distribution: world
Organization: The Cutting Edge - Houston, TX - 713-466-1525
Reply-To: david.brooks@cutting.hou.tx.us (David Brooks) 

RP> I wouldn't say that the project has _no_ practical use.  When the idea
RP> originally came to me it was because I use PowerPacker on my Amiga.
RP> PowerPacker can be used to compress an executable, with the
RP> decompression code prepended.  There are a few nuisances associated
RP> with using this.  One is that I had to manually select every file to
RP> be compressed.  With a BCV I wouldn't have to do this.  I also would
RP> have to recompress after every time I wanted to edit a file
RP> (decompressing to view the original code of course).  A BCV would take
RP> care of this for me.

   Perhaps a bit off subject, but rather than PowerPacker, why not use
TurboImploder for you executibles? It will allow you to compress in batch
mode so that you can implode an entire directory at one shot. It also
gives a slightly beter compression rate, and best of all, its freeware!
   The catch is that it works ONLY on executibles, so you will still need
PowerPacker for your data files.

RP> Richard Powers    / Disclaimer: My keyboard is \   Computer=Amiga
RP> rpowers@panix.com <  screwy.   Missing  letters  >  Music=Industrial
RP>   Hail Eris!      \ should     be    expected. /   Food=Vegetarian

   David Brooks

david.brooks@cutting.hou.tx.us

 * Q-Blue v0.7 [NR] *      
----
+---------------------------------------------------------------------+
| The Cutting Edge BBS (cutting.hou.tx.us)    A PCBoard 14.5a system  |
| Houston, Texas, USA    +1 713 466 1525          running uuPCB       |
+---------------------------------------------------------------------+
Newsgroups: comp.org.eff.talk
From: wack@ariel.ncsl.nist.gov (John Wack)
Newsgroups: comp.org.eff.talk,alt.comp.acad-freedom.talk,comp.security.misc,alt.privacy,alt.society.civil-liberty
Subject: Re: Boycotting CERT because of the keystroke monitoring advisory?
Date: 5 Jan 93 14:01:14 GMT
Followup-To: comp.org.eff.talk
Organization: National Institute of Standards & Technology

In article <1993Jan4.212439.4278@nntp.hut.fi> jkp@cs.HUT.FI (Jyrki Kuoppala) writes:
>
>I don't know who does CERT's policy decisions and how one might
>influence them via other means (possibly organizations like the EFF
>and CPSR could work on this) but I do think the most simple thing to
>do about an organization doing something you seriously disapprove of
>is to stop all support and cooperation with it and suggest others do
>the same.
>
>//Jyrki

I'm hesitant to enter the fray on this issue, but I'd like to point out
that CERT/CC is simply passing on some guidance from the U.S. DoJ and 
shouldn't be blamed if you disagree with the guidance -- although I don't 
dispute your right to disagree.  I believe that CERT/CC felt that the 
guidance should be out there to the widest audience, despite the
guidance being less than precise.  But I don't think that the CERT/CC
should be avoided or "ignored" or whatever because of this issue.  By
and large I think that the CERT does a lot of good.

Just my two cents worth,
John Wack

Newsgroups: comp.org.eff.talk
From: matt@wardsgi.med.yale.edu (Matt Healy)
Subject: RE: Bugs
Followup-To: comp.org.eff.talk
Organization: Yale University--Genetics
Date: Tue, 5 Jan 1993 22:17:20 GMT

There has been a lot of discussion about whether software authors
should be liable for bugs.

A while back, a columnist in some computer mag (forget which)
proposed a modification to copyright laws along the following
lines.

After a certain date, anyone wishing to copyright software *must*
choose one of several options or forfeit copyright:

    1 Provide complete source to *any* registered user who asks
      (they could make users sign nondisclosure aggreements), or

    2 Assume *strict* liability for meeting all reasonable, or 
      user expectations

    3 Publish a list of *all* reported bugs.


I am going by memory of something I read *once* in a library;
anyone who can provide a more complete citation please do so.

[corrections welcomed; flames *not* welcomed!]


Matt Healy
"I pretend to be a network administrator; the lab
 net pretends to work!"

matt@wardsgi.med.yale.edu
From: patth@panix.com (Patt Bromberger)
Newsgroups: comp.org.eff.talk,panix.chat
Subject: PBS Tonight at 8: Adam Smith "The Secret Sharers"
Summary: information in a computer anyone can access
Date: 7 Jan 93 15:33:54 GMT
Followup-To: comp.org.eff.talk,panix.chat
Distribution: na
Organization: Panix Public Access Internet & Unix, NYC

Tonight's PBS 8 PM show lists Adam Smith: "The Secret Sharers" and
will detail information about the data market place.  One of the
teasers for this program touted it as a "how to" for accessing any
existing information in any online computer.



-- 
Patricia Ann Bromberger                            patth@panix.com
I shall go out in my slippers in the rain. And pick flowers in 
other people's gardens And learn to spit. -- "Warning" by Jenny Joseph
Xref: sparky comp.org.eff.talk:8337 alt.comp.acad-freedom.talk:3863 comp.security.misc:2451 alt.privacy:2851 alt.society.civil-liberty:7273
From: barmar@think.com (Barry Margolin)
Newsgroups: comp.org.eff.talk,alt.comp.acad-freedom.talk,comp.security.misc,alt.privacy,alt.society.civil-liberty
Subject: Re: Boycotting CERT because of the keystroke monitoring advisory?
Date: 5 Jan 1993 23:17:48 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
Distribution: inet
NNTP-Posting-Host: telecaster.think.com

In article <1993Jan5.114722.5863@nntp.hut.fi> jkp@cs.HUT.FI (Jyrki Kuoppala) writes:
>In article <1ib0grINNhq3@early-bird.think.com>, barmar@think (Barry Margolin) writes:
>>My interpretation was that CERT was recommending that *if* you have a
>>policy where you might monitor input, that you should put this warning in a
>>login banner.
>
>I didn't see anything to this effect in the advisory - it was an
>unconditional recommendation the way I read it.

That's a silly interpretation.  The only purpose of the warning is to get
the people monitoring off the hook if the monitoree complains about
invasion of his privacy.  Why would anyone who has no plans to monitor
keystrokes need to warn that they do?
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
Newsgroups: comp.org.eff.talk
From: Clayten_Hamacher@mindlink.bc.ca (Clayten Hamacher)
Subject: Re: Beneficial Virus?
Organization: MIND LINK! - British Columbia, Canada
Date: Sat, 9 Jan 1993 10:48:06 GMT

>But that's just what the BCV does, in one description.  It prompts the user
>for an action (suicide, install marker file, etc).  If the BCV existed,
>how long do you think it would be before someone wrote a copy-cat virus
>that looked for the same marker file, performed the same compression, and
>at some later date, wiped the disk clean?

Then why wouldn't someone d/l a new version of some PD utility and install a
virus in there? It's just as likely to happen in the compression virus as a
space invanders clone.

>You can compare an executable (for non-changing code) against a known clean
>copy, to check for infection after the clean copy date.

Not if you d/l it from a BBS or FTP site, you can't be sure that what you are
getting is clean code.. You can compare later versions with this to see if it
changes, but that's another story, you're not sure it's clean.

--

Clayten_Hamacher@Mindlink.bc.ca                 Land of the rising snow.
From: spp@zabriskie.berkeley.edu (Steve Pope)
Newsgroups: comp.org.eff.talk
Subject: Re: legal question re anonymity online
Date: 8 Jan 1993 08:56:09 GMT
Organization: U.C. Berkeley -- ERL
Distribution: inet
NNTP-Posting-Host: zion.berkeley.edu

In article <1993Jan8.010839.899@uoft02.utoledo.edu> jsteiner@anwsun.phya.utoledo.edu (jason 'Think!' steiner) writes:
>IMHO, John Q. doesn't have a case. the fact that he's bringing it 
>against BELL instead of the perpetrator is an indication of just how 
>screwed up the current system is.

But, there's some evidence that the BELL is already worried 
about what their users might do with the system.  (For example,
as an ass-covering move, the BELL doesn't let its users 
telnet out to SMTP ports for fear that its users will create 
mail forgeries and incur a liability.)

Obviously, the plaintiff in such a lawsuit would present
a case the BELL allowed criminal bombers to use
the BELL conferencing system for selecting targets.  Picking
a target is an integral part of terrorist activity.
Seems to me the BELL lured in the unsuspecting John Q.,
tricked him into providing his real name, seduced him into 
participating in one of their controversial conferences
and next thing you know, John Q. became Molotov fodder.

By aiding and abetting terrorist bombers in this 
critical phase of their mission, the BELL could be
held to be in a position of "contributory negligence".

It is not necessary that the BELL have specific
knowledge that leftwing bomber types would use
their system for picking targets.  It need only be
shown that the BELL "should have known" this was
likely.  (Precedent: "Soldier of Fortune" was held
liable as being a forum used by killers-for-hire,
even though SOF had no specific knowledge of their
activities.  The plaitiffs would similarly argue the BELL 
is a forum for left-leaning Molotov-cocktail types!)

But in reality, John Q. would have lots of trouble
finding an attorney to represent him.  As it turns
out, the BELL is flat broke, and has very few assets
to attach.   (Can't get much cash for those old
Sequent superminis...)

Steve
From: bhv@areaplg2.corp.mot.com (Bronis Vidugiris)
Subject: Re: Programmers and Libertarians (was: Re: [misc.activism.progressive] Clinton Office Requests Comments)
Organization: Motorola, CCR&D, CORP, Schaumburg, IL
Date: Mon, 4 Jan 1993 17:43:24 GMT

In article <C0A8tJ.Dy@panix.com> pnh@panix.com (Patrick Nielsen-Hayden) writes:
)lachman@netcom.com (Hans Lachman) writes:
)
)>My guess is that the correlation between programmers and
)>Libertarians is due to the fact that programmers (the smart
)>ones at least) keenly understand the KISS principle (Keep
)>It Simple, Stupid).

...

)Analogies between engineering & politics like the above have a checkered
)history, to say the least.  For much of the first part of this century it
)was widely assumed that Communism more precisely mapped onto the principles
)of design efficiency espoused by technologists; in fact, many
)anti-communists granted their antagonists the point, and anchored their
)opposition in a wider critique of technological rationalism in general. 
)These days both sides of that argument seem quaint.  The day will come when
)the above reads like a period piece, too.

IMO the analogy between programs and society is stronger than the analogy
between machines in general and society.

In the ACM a fairly long time ago, Djykstra (I think) wrote an essay on
how computer programming was a fundamental novelty.  I think he was wrong -
I think the aspect of programming he mentioned (a large unit made up
of very large - up to billions - of smaller general units) fits an aspect
of society.  To be specific, hierarchy of some sort has been found to be
necessary to organize such large structures - either large programs or large
societies.  For smaller societies (and programs) hierarchy is not so
essential.

This analogy is not absolutely perfect, of course.  But I think some of
the parallels are provocative.  

Some of the 'best' programs are written by a single person, and some of
the 'best' societies are led by one person.  And, some of the worst
programs and societyes are written/led by one person - there is a large
variability.  A design by comittee (either of a program or of a society)
tends to be clunky and inefficient compared to the best of individual
designs, but much better than the truly awful messes created by the
bad designs of a single individual.
From: raoul@eplunix.UUCP (Nico Garcia)
Newsgroups: comp.org.eff.talk
Subject: Re: "Civil Disobedience" et al.
Date: 7 Jan 93 13:46:02 GMT
Organization: Eaton-Peabody Lab, Boston, MA

In article <van-060193103022@gerard.eff.org>,
van@eff.org (Gerard Van der Leun) writes:

> As Editor of EFFector Online, I'd like to note that Rita and I and

All Hail, the Chief!

> For articles that are, in our opinion, satirical... well it would be
> churlish to our readers and our authors to label them "satire". If
> some of our readers do not or cannot see the humor or the intent, well
> that is a failure of either the editor, the author, or the reader and
> has to be settled on a case by case basis. I will say that I find it

It might be considered a success, Gerard. Sometimes, if they "just don't
get it", that is hilarious in and of itself.

> interesting that you can fool around with a lot of amendments with
> no flashback, but if you even jostle the second amendment the flames
> rise up on all sides.

So they're heavily armed: if such people get upset, we notice a lot
more....

I like it. Keep the leavened format.

-- 
			Nico Garcia
			CIRL/MEEI
			eddie.mit.edu!eplunix!raoul
Newsgroups: comp.org.eff.talk