HDTenEightyP/NetNews huggingface dataset:
From: dagolden@phoenix.Princeton.EDU (David Alexandre Golden)
Subject: Re: Making PGP legal?
Originator: news@nimaster
Organization: Princeton University
Date: Wed, 20 Jan 1993 18:25:45 GMT

In article <PCL.93Jan20102914@rhodium.ox.ac.uk> pcl@ox.ac.uk (Paul C Leyland) writes:

>
>Another question: How feasible is it to re-write RIPEM, keeping the
>front end (.... you get the idea).

It's not.  Re-writing RIPEM to be compat with the rest of the world
(i.e. PGP) can't be legally done for the same reason I can't legally
run PGP.

>
>Why on earth should most of the world have to fudge a perfectly ok
>program just to avoid a few local North American difficulties?

Maybe because it's going to be easier to fudge a perfectly ok program than
to solve a few local North American difficulties?  Maybe out of altruism?
To help the privacy of the global community?  Because of the benefits of
a worldwide standard?

>Add 8-) to taste.

Likewise, if it suits you.


>Paul

Dave



-- 
David A. Golden '95           (dagolden@phoenix.princeton.edu)
Princeton University
Newsgroups: alt.security,comp.security.misc
From: smith@sctc.com (Rick Smith)
Subject: Re: Help with handling SECRET data
Organization: SCTC
Distribution: us
Date: Mon, 25 Jan 1993 20:52:29 GMT

casey@anchovy.wpd.sgi.com (Casey Schaufler) writes about connecting
a system with Secret classified information to the Internet:

>Sounds like what you need is a B1 or CMW system to act as your gateway. 

The customary risk index analysis says you need at least a B3 system
to enforce separation between garden variety Secret data and the
unclassified users of the Internet.

CMWs are essentially to keep honest people (i.e. folks with clearances
of varying levels) from blundering across information they don't Need
to Know. They can't protect against serious attacks, and aren't
intended to keep the Uncleared away from really classified data. I
once heard a CMW vendor identify an exploitable hole in their _design_
at a public session at a security conference. Bleah.
Xref: sparky alt.security:5367 comp.security.misc:2600
From: casey@anchovy.wpd.sgi.com (Casey Schaufler)
Newsgroups: alt.security,comp.security.misc
Subject: Re: Help with handling SECRET data
Date: 25 Jan 93 19:12:14 GMT
Distribution: us
Organization: Silicon Graphics, Inc., Mountain View, CA
NNTP-Posting-Host: anchovy.wpd.sgi.com


Sounds like what you need is a B1 or CMW system to act as your gateway. Many
vendors (Silicon Graphics, included) sell such beasts. The details of the
configuration you'd need varies from vendor to vendor. You'll also need a
real push-over Security Officer to attach your Secret system to the
InterNet.

	-casey
From: ifbb657@emx.cc.utexas.edu (Douglas Floyd)
Newsgroups: alt.security
Subject: Re: F-prot (was: Virus Programs ForSale)
Date: 26 Jan 1993 15:04:33 -0600
Organization: The University of Texas at Austin, Austin, Texas
NNTP-Posting-Host: emx.cc.utexas.edu

In article <C1G32A.9x8@trauma.rn.com> sara@trauma.rn.com (Sara Gordon) writes:
->ifbb657@emx.cc.utexas.edu (Douglas Floyd) writes:
->
->>In article <1993Jan22.181703.20039@crd.ge.com> davidsen@crd.ge.com (bill davidsen) writes:
->
->
->>Speaking of virus programs (or virus detector programs, if you want
->>a virus program, find this Dark Avenger chap :-), I have had very
->
->why would finding him help you? if you are interested i just have

Maybe it would hurt to find him.  I would not mind finding
a part, like his head, though. >:-)

->had published the first of a three part interview with him in the
->Virus News International. It will probably be in some U.S.A. based
->magazine shortly. 
->
->he's not making viruses.

OK, he is (to my knowledge) making virus toolkits.


->>good luck with Norton Antivirus.  The Macintosh version has protected
->>me from numerous encounters, and the MS-DOS version has been equally
->>as strong.  I have heard that NAV and Central Point's products stink
->>from some people.  What is the best antivirus product (commercial)
->>out there?
->
->i personally prefer F-Prot and The Anti-Virus toolkit. i have had many
->clients using NAV or CPAV with bad results, and i always recommend they
>-remove- those things before it is too late...

I have heard different things about NAV and CPAV.  Some swear by CPAV/NAV;
some sware at them.  F-Prot is good, though.


PS:  What is the Anti-Virus toolkit?


Disclaimer:  My information about DA could be inaccurate or wrong.  Please
note that I reserve the right to be wrong about this.
From: craig@ec.uwa.oz.au (Craig Richmond - division)
Newsgroups: alt.security
Subject: Re: Virus Programs ForSale (Virus,Trojan,etc)
Date: 22 Jan 1993 04:16:35 GMT
Organization: The University of Western Australia
NNTP-Posting-Host: accfin.ecel.uwa.edu.au

alby@access.digex.com (Albatross) writes:

>Cost:            $20.00 per disk
>Contents:        10 Viri  per disk

>Disk 1:                             Disk 2:
>---------                          ---------
>1704 Virus                         Jerusalem Virus
>...

>Send  Checks or Money Orders Too:
>--------------------------------------------------

Do you have the authors explicit permission to be selling their products?
:-)

Craig
--
Craig Richmond.  Computer Officer -  Dept of Economics (morning) 380 3860
  University of Western Australia    Dept of Education (afternoon)
craig@ecel.uwa.edu.au Dvorak Keyboards RULE!  "Messes are only acceptable
if users make them.  Applications aren't allowed this freedom" I.M.VI 2-4
Newsgroups: alt.security
From: mbfeld@unix.amherst.edu (A waste of bandwidth originating)
Subject: An apology
Organization: an unknown point
X-Newsreader: TIN [version 1.1 PL7]
Date: Tue, 26 Jan 1993 22:24:08 GMT


Earlier today I posted an ad for Quorum, a network marketing company.
Having seen so many things being sold in so many newsgroups (not just biz.type
groups), I didn't realize I was doing anything wrong.  Once I learned that I
did, I retracted the article.  My apologies for any distress I may have caused.

mbfeld@amh.amherst.edu
From: david@c-cat.UUCP (Dave)
Newsgroups: alt.security
Subject: Re: F-prot (was: Virus Programs ForSale)
Date: 26 Jan 93 15:47:02 GMT
Organization: Intergalactic Rest Area For Weary Travellers

david@c-cat.UUCP (Dave) writes:

{> I find McAfee Antivirus for Networks (Netscan.exe) and Dos (scan.exe)
{> to be very efficient. for about $35 for a single standalone PC
{> unlimited upgrades for 2 years.  I think its the best out there because
{> the upgrades are out at least every quarter.
{> 

Ooooops forgot.   The McAfee Anti-virus now will scan and  clean over 1400
viri and strains.

other side, the $35 is for 3 programs if I remember correctly.
Mcafee Virus Scan, Clean, and Virus shield

One other thing I really enjoy about this company McAfee, they have written 
into the license agreement that if you run a free public access BBS they
will allow the sysop unlimited use of anti-virusware, on the BBS PC, for a
period as long as the BBS remains a publicly accessible free system.

                                                       -David

China Cat System     
(301)604-5976 1200-14,400 8N1
david@sandr.com 
...uunet!sandr!cherise!c-cat!david
Xref: sparky alt.security:5348 sci.crypt:7087 alt.privacy:3026
From: rick@ee.uwm.edu (Rick Miller)
Newsgroups: alt.security,sci.crypt,alt.privacy
Subject: Please, let's not confuse the issue.
Followup-To: alt.security
Date: 22 Jan 1993 14:20:37 GMT
Organization: Just me.
NNTP-Posting-Host: 129.89.2.33
Summary: Was: Making PGP legal?

There's been a thread on alt.security which is misinforming in the extreme.
Note the former Subject: line, "Making PGP legal?"... Here's the irony of it:

	DISTRIBUTING PGP 2.1 IS *NOT* ILLEGAL, as long as folks
	follow the export laws, and don't *export* it from the US
	or Canada.  Remember that PGP 2.1 was developed outside of
	the US, and that there are sites like nic.funet.fi which
	have it available for anonymous ftp.  *IMPORTING* PGP 2.1
	IS STILL LEGAL, even in the US.  (Note that some countries
	may not wish their citizens to *have* cryptologic technology,
	and import may there be illegal.)

	USING PGP 2.1 IS *NOT* ILLEGAL, at least not in any nation
	I'm familiar with.  Yes, in the U.S. it is possible that RSA
	may take you to court for doing it, but it's not against any
	*law* to do it.  Their only claim against you would be to
	recover 'damages' to their profits.

	As a North-American, the only thing you're *legally* bound
	not to do is to give stuff like PGP to foreigners.  Big deal!
	They already *have* it!!

To clarify my point, take divorce as an example.  There's nothing *illegal*
about getting a divorce, right?  Still, if one side thinks they're getting
ripped off, they sue the other side for "just compensation".

Likewise, distributing PGP 2.1 (within legal boundaries) isn't *illegal*,
but RSA may think they have grounds upon which to sue you for "damages".

Noting that RSA has released their RSAREF to be licensed at no cost to
non-commercial users, it seems unlikely that they'll actually litigate.
Unless one of you folks is distributing more copies of PGP 2.1 than the
Finnish ftp-site, nic.funet.fi, I really don't see how they could make
a case against you that would hold up in court.

Rick Miller   <rick@ee.uwm.edu> | <rick@discus.mil.wi.us>   Ricxjo Muelisto
Occupation:  Husband, Father, WEPCo. WAN Mgr., Discus Sys0p, and  Linux fan
Disclaimer:  The word "lawyer" does not appear at all in the previous line.
From: alby@access.digex.com (Albatross)
Newsgroups: alt.security
Subject: Re: Virus Programs ForSale (Virus,Trojan,etc)
Date: 28 Jan 1993 23:29:42 -0500
Organization: Express Access Online Communications, Greenbelt, MD USA
NNTP-Posting-Host: access.digex.com


And as to your legal disclaimer at the bottom, I will sue you in civil
court for the intentional spread of a virus if any of the the computers
I am responsible for are infected as a result of this post!
						by Lowell Synder



  Well Lowell.. You'll sue eh.. Well remmber you gotta prove that
 the virus even came from me, and if the person who toasted your
system with a virus says it was me, it gotta be proven.. And unless
somebody is keep records of transactions (Not me) then life is gonna be 
rouf for ya in a court of law... Ohh and by the way.. I hope it's federal
court because Calif. and Maryland sure arn't  next door, and I ain't coming
to Calif to face a civil trial.. You can come here...  


PS: Tell it to the States Attonery in Calif and see how good your
    chances are...  0000 if ya ask me
From: unruh@physics.ubc.ca (William Unruh)
Newsgroups: alt.security
Subject: Re: Please, let's not confuse the issue.
Date: 22 Jan 1993 20:04:43 GMT
Organization: The University of British Columbia
Distribution: world
NNTP-Posting-Host: physics.ubc.ca

rick@ee.uwm.edu (Rick Miller) writes:

>There's been a thread on alt.security which is misinforming in the extreme.
>Note the former Subject: line, "Making PGP legal?"... Here's the irony of it:

>	DISTRIBUTING PGP 2.1 IS *NOT* ILLEGAL, as long as folks

Seems to be a semantic discussion about civil vs criminal law- criminal
=illegal, civil=? . The law provides civil law remedies for patent
infringement. Does that make infringement legal because it's not
criminal? The state won't bring a
case against you, but a case can be brought nevertheless, and with much
weaker protection for you than in criminal cases ( beyond probably doubt
in the latter.) 
but the probability of RSA actually doing so is probably extremely
small
From: ck041@cleveland.Freenet.Edu (Kevin Currie)
Newsgroups: alt.security
Subject: FTP SITE WITH IBM 370 X/Y/Z modem
Date: 27 Jan 93 13:34:24 GMT
Organization: Case Western Reserve University, Cleveland, Ohio (USA)
NNTP-Posting-Host: hela.ins.cwru.edu


	I know this isn't the right area, but I'm desperate!!
	Does anybody know of an FTP site that would have a zmodem program
for a IBM 370 series mainframe??  I need one BADLY!  I have kermit now,
but I'm haveing a VERY hard time trying to download binary files.
	Note that the zmodem (or even x or ymodem) program must be
UNCOMPRESSED!!  See, I have FTP access but I can't get the files back from
the IBM home to my Amiga.  Any help would be greatly appreciated.

	This message is going to be cross-posted to a couple of areas so
please respond via email.
	Thanks.

-- 
"Chalk up another soul that's lost, |       Kevin Currie  
 Calculate the social cost,         |   Ottawa,Ontario,Canada     
 You know what's not inside of me,  | ck041@cleveland.Freenet.Edu
 Raging mad insanity!!"  - S.T.     |      ag816@yfn.ysu.edu
Xref: sparky alt.security.pgp:608 alt.security.ripem:146
From: cme@ellisun.sw.stratus.com (Carl Ellison)
Newsgroups: alt.security.pgp,alt.security.ripem
Subject: Re: Create group for dist. of pub. keys?
Date: 27 Jan 93 18:24:40 GMT
Organization: Stratus Computer, Software Engineering
NNTP-Posting-Host: ellisun.sw.stratus.com

In article <1993Jan27.114919.26878@infodev.cam.ac.uk> gtf1000@cus.cam.ac.uk (G.T. Falk) writes:
>With the tacit understanding that it will not be secure (but perhaps
>very helpful), I suggest the creation of a newsgroup devoted solely to
>the distribution of public keys. It would facilitate the distribution of
>new signatures, key compromise certificates, and just getting in touch
>with people in order to perform separate-channel verification.
>
>Software could even be written to periodically check this newsgroup
>for new signatures and keys.
>
>Each message in the group should be signed and should include a postal
>address (for snail-mail verification).


I think this is a very good idea.  I would suggest it be used to handle
both PGP and RIPEM keys.

As long as a key is signed along with Snail mail address and phone numbers,
I don't see this as very weak in security.

A USENET newsgroup is the closest thing we have to a true broadcast medium.



-- 
-- <<Disclaimer: All opinions expressed are my own, of course.>>
-- Carl Ellison						cme@sw.stratus.com
-- Stratus Computer Inc.	M3-2-BKW		TEL: (508)460-2783
-- 55 Fairbanks Boulevard ; Marlborough MA 01752-1298	FAX: (508)624-7488
Xref: sparky alt.security.pgp:610 alt.security.ripem:147
From: uni@acs.bu.edu (Shaen Bernhardt)
Newsgroups: alt.security.pgp,alt.security.ripem
Subject: Re: Create group for dist. of pub. keys?
Date: 27 Jan 93 21:55:17 GMT
Followup-To: alt.security.pgp
Organization: Boston University, Boston, MA, USA



I second the motion


uni
-- 
uni@acs.bu.edu  ->  Public Keys by finger and/or request
Soverignty is the sign of a brutal past.
Newsgroups: alt.security.pgp,alt.security.ripem
From: povlphp@uts.uni-c.dk (Povl H. Pedersen)
Subject: Re: Create group for dist. of pub. keys?
Organization: UNI-C, Danish Computing Centre for Research and Education
Date: Thu, 28 Jan 1993 00:27:55 GMT

I do not think it is a good idea. There is no reason to have that huge a 
key database. Also, it is possible to post fraud keys. It is not worth 
it. But having a newscroup to post compromised keys is OK.

Normally you always can exchange keys in advance when you send mail,
and lots of people have started to put it in their .plan file, so just
giving them the finger will help :-)


-- 
Povl H. Pedersen   -   Macintosh specialist. Knows some DOS and UNIX too.
pope@imv.aau.dk    -   povlphp@uts.uni-c.dk
--- Finger me at pope@imv.aau.dk for PGP Public Key ---
Newsgroups: alt.security.pgp,comp.mail.mime
From: Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu>
Subject: Re: pgp headers for MIME
X-Quoted: 27%
Organization: Computer Science Dept, Indiana University
Date: Thu, 21 Jan 1993 22:31:11 -0500

Thus said andyr@wizzy.com (Andy Rabagliati):
>TW> I think pgp data should go so:
>TW> 
>TW> Content-Type: text/plain; charset=ISO-8859-1
>TW> Content-transfer-encoding: X-PGP-{VERSION}
>TW> 
>TW> Where {VERSION} would be: 2.0, 2.1, etc...
>TW> 
>TW> This would allow the benefit of transferring text, sounds,
>TW> graphics, etc...

Quoting from RFC 1341:

            However, unlike Content-Types and subtypes, the creation  of
            new   Content-Transfer-Encoding  values  is  explicitly  and
            strongly  discouraged,  as  it  seems   likely   to   hinder
            interoperability  with  little potential benefit.  Their use
            is allowed only  as  the  result  of  an  agreement  between
            cooperating user agents.

What's wrong with merely using a new Content-Type, something like
application/x-pgp or message/x-pgp, and having an encapsulated
Content-Type: contain the actual variety of data?

Or, you could model it after the MIME-PEM standard, and make a
multipart/x-pgp type.  That would be the ideal solution, but it's only
worth doing if you thing PGP's current mechanism for message
formatting will really become the (or at least a) long-term standard.

Including version is a good idea, but it doesn't need to be part of
the subtype, you can just throw in version=2.1.

Creating a new Content-Transfer-Encoding is a very bad idea.
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted

What's the use of a good quotation if you can't change it?
		- Doctor Who
From: steve@cs.hw.ac.uk (Steven Salvini)
Newsgroups: alt.security
Subject: Re: Making PGP legal?
Date: 25 Jan 93 10:38:40 GMT
Organization: Dept of Computing & Electrical Engineering, Heriot-Watt University, Scotland

In article <PCL.93Jan20102914@rhodium.ox.ac.uk> pcl@ox.ac.uk (Paul C Leyland) writes:
>In article <1993Jan18.172342.7553@Princeton.EDU> dagolden@phoenix.Princeton.EDU (David Alexandre Golden) writes:
>
>
>   It seems that PGP (2.x) is popular because of its well conceived interface
>   and because of its wide distribution.  However, it is illegal to use in the
>   US (and Canada?) because of a patent infringement.  Now, while the rest of
>   the world is saying "Well that's your problem," it really doesn't make 
>   sense to have a split
>
>Why on earth should most of the world have to fudge a perfectly ok
>program just to avoid a few local North American difficulties?
>
>Add 8-) to taste.
>
>Paul
>

Does this remind anyone else about DES in "the rest of the world" ;-)

Steve.
Xref: sparky alt.security:5365 comp.security.misc:2599
From: dejesus@archimedes.nwc.navy.mil (Francisco X DeJesus)
Newsgroups: alt.security,comp.security.misc
Subject: Re: Help with handling SECRET data
Date: 25 Jan 93 18:15:33 GMT
Distribution: us
Organization: Science Applications International Corp.

In article <1jpbtgINNrgd@news.cerf.net> readingj@nic.cerf.net (John D. Reading) writes:
[...]
>I am working in an environment where we are soon going to have to deal 
>with both DOD SECRET data and unclassified data.  We currently have a 
>number of PC's, X-terminals, and an Alliant fx2800 tied together with 
>an ethernet.  In the very near future I have hopes that the ethernet 
>will connect to a machine on the Internet (right now I use a dial-up 
>account).  The question has been raised as to how to be able to deal 
>with the varying levels of security required.  I personally have never 
[...]

It has always been my understanding that it is *illegal* to put any
classified data on a machine that is hooked up to the Internet. Just
hooking up a machine to the 'net makes it unsecure. You will have to
isolate the machine(s) that will handle classified data from the rest
of your LAN.

For more information, you should contact your local security office.
They should at least know who to point you towards regarding this
sort of question...
-- 
      Francisco X DeJesus  ----- S A I C -----  dejesus@chinalake.navy.mil
 ------------------------------------------------------------------------------
  * disclaimer: Opinions expressed here are mine. Typos and errors are yours *
 "Duck Season!" "Rabbit Season!" "...rabbit season." "It's Duck Season! SHOOT!"
Newsgroups: alt.security
From: tinsel@uiuc.edu (Thomas Aaron Insel)
Subject: Re: Virus Programs ForSale (Virus,Trojan,etc)
Originator: tai50080@uxa.cso.uiuc.edu
Reply-To: tinsel@uiuc.edu
Organization: Masticating Illini, Urbana Illinois
Date: Sat, 23 Jan 1993 23:55:01 GMT

alby@access.digex.com (Albatross) writes:

>         Well now you can play with some of the most ruthless & destructive
> virus'es known to man. See if the Dark Avenger virus really can be detected
> by these money hungry  anti-virus software companies, or if you dollars are
> paying off.

> Cost:            $20.00 per disk
> Contents:        10 Viri  per disk

I remember hearing how the DEA would set up fake chemical distributors,
advertising controlled reagents typically used in the production of illegal 
drugs, in certain magazines.  They just had to sit back and wait for the
orders to come in, and add names to their list of potential drug 
manufacturers.

Don't see any parallels here, do you?  Perhaps I'm being paranoid, and I'm
not completely sure distribution of viruses like this is illegal, but one
could assume the Secret Service would like to have the names of people who 
might be interested in an offer like this.
-- 
Thomas Insel (tinsel@uiuc.edu)
  "We must not confuse dissent with disloyalty." -- Edward R. Murrow
Newsgroups: alt.security
From: sara@trauma.rn.com (Sara Gordon)
Subject: Re: F-prot (was: Virus Programs ForSale)
Organization: Gator Communications - Feeds-R-Us 219-289-3745 
Date: Wed, 27 Jan 1993 17:35:46 GMT

ifbb657@emx.cc.utexas.edu (Douglas Floyd) writes:

>Maybe it would hurt to find him.  I would not mind finding
>a part, like his head, though. >:-)

hurt him, you mean. thats too bad you feel that way. 


>OK, he is (to my knowledge) making virus toolkits.


no, he is not. the last thing attributed to him was the
mutation engine. most of todays 'virus programmers' aren't even
skilled enough to use this elegant work......and, its children
don't seem to be making such a problem in the real world.

this engine was made very long time ago by virus appearance standards.

the mutation engine is not a virus toolkit. those are things like
the VCL or the slightly less pretty but more functional MPC. More
sophisticated programs (MtE, Trident) require more skill on the part
of the person attempting to use the program. Most people with such
skill don't waste their time writing destructive code to use for
unethical purposes.

>I have heard different things about NAV and CPAV.  Some swear by CPAV/NAV;
>some sware at them.  F-Prot is good, though.


well, like i said, i recommend always to anyone who 1. asks or 2. i see using
these cpav and nav to -remove- them before it is too late. of course, if
i did not do this, i would probably make a lot of money taking care of
non existant viruses...

>PS:  What is the Anti-Virus toolkit?

it is a product offered by S&S International. It is a very good product,
which identifies viruses well and has good written documentation, and user
support. This is one reason it is good for businesses where the specialist
actually reads the docs :). it is offered for sale in usa by ontrack software,
and i have seen it in some magazines, such as computer shopper.
it has options like fprot for command line use or you can use the regular
one, and it also has versions for windows (and maybe OS2..im not sure
about that..i cant remember, cause i dont have OS2 and have not had occasion
to use it much).

>Disclaimer:  My information about DA could be inaccurate or wrong.  Please
>note that I reserve the right to be wrong about this.

:). well, it was/is wrong at least for now.

-- 
           #  "talk to me about computer viruses............" 
           #  fax/voice:    219-277-8599     sara@gator.use.com
           #  data          219-273-2431     SGordon@Dockmaster.ncsc.mil
           #  fidomail      1:227/190        vfr@netcom.com
From: bap@mace.cc.purdue.edu (Bret Pennington)
Newsgroups: alt.security
Subject: Re: F-prot (was: Virus Programs ForSale)
Date: 22 Jan 93 18:14:24 GMT
Organization: Purdue University

I concur wholeheartedly!!! We have had several PCs with an attack of the
green catepillar and F-PROT has done a great job cleaning it up.
Newsgroups: alt.security,comp.security.misc