HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PGP as a World Standard
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 21 Dec 92 09:03:35 GMT

strnlght@netcom.com (David Sternlight) writes:

> In response to Vesselin Bontchev (who unlike many who sound off
> here seems to have done some work on PGP2.0 and thus deserves
> extra respect):

Thanks for the flowers, but no, I have not done any work on PGP 2.0
(except reading the source), so I do not deserve that much extra
respect... :-)

> Since my position is an ethical one, not a legal one, for Vesselin
> to say that "what is written in the docs doesn't matter" "you must
> PROVE" they copied from a wrongful (PGP1.0) source comes with ill
> grace. The docs amount to a confession which, from an ethical
> point of view is all that's necessary.

You raised a few legal issues in the message of yours to which I
replied. This explains my reply. If you give up on the legal matter
and raise ethical issues instead, well, I don't want to argue on this
topic. I come from a country that even does not have copyright law on
computer software, so obviously our understandings of ethics are
different... (No, that country is NOT Germany; don't look at my e-mail
address. I am Bulgarian.)

> Next he raises the law professor's post. Apparently he has not yet
> received and read my extended response. The Professor doesn't have
> a leg to stand on, since he argues, in effect:

You are not a lawyer, are you? He -is- a lawyer. Therefore I tend to
believe his oppinion, not yours. I wouldn't believe a lawyer's
oppinion on cryptography (unless he happens to be a crypto expert
too), but I do believe his oppinion in legal matters...

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: alt.security.pgp,alt.security.ripem
From: wombat@nfinit.enet.dec.com (Christopher M. Conway)
Subject: Re: RSAREF License
Reply-To: wombat@nfinit.enet.dec.com
Organization: Prickly Wombat Enterprises
Date: Wed, 23 Dec 1992 22:13:09 GMT


In article <1992Dec23.034503.26991@watson.ibm.com>, uri@watson.ibm.com () writes:
- From article <1992Dec22.213613.1404@netcom.com>, by strnlght@netcom.com (David Sternlight):
- > Jim Bidzos has sent me a copy of the final RSAREF license. Here it is.
- 
- > 
- > 1.   LICENSE. RSA grants you a non-exclusive, non-transferable,
- >      perpetual (subject to the conditions of section 8) license
- >      for the "RSAREF" program (the "Program") and its associated
- >      documentation, subject to all of the following terms and
- >      conditions:...........................................
- >      c.   to modify the Program in any manner for porting or
- >           performance improvement purposes (subject to Section 2)
- >           or to incorporate the  Program into other computer programs 
-             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
- [Does this mean - PGP too? :-]
- >           for your own personal or internal use, provided that you 
- >           provide RSA with a copy  of any such modification or 
- >           Application Program by electronic mail, and grant RSA 
- >           a perpetual, royalty-free license to use and distribute 
- >           such modifications and Application Programs on the terms 
- >           set forth in this Agreement.

Probably not.

The thing I really wanted to point out is a cute little clause no one has
mentioned so far-- the clause starting with "provided that you..." Under
my (potentially naive) reading, this would lay claim to any program using
their software in any way as effectively *their property*. I.e., even if
they allowed for use of their "patented invention" in PGP, they would then
lay claim to PGP as belonging to them.

Not so hot, in my mind.

--
In no way should any statement, question, or other transferral of
information in this post should be construed in any way as being an
official communication of Digital Equipment Corporation.
-------------------------------------------------------------------------
Christopher M. Conway		| U*ix and C Guru
wombat@nfinit.enet.dec.com      | Legalize Freedom!
wombat@juliet.ll.mit.edu        | Resist the Tyrants in Washington, D.C.!
nfinit::wombat (DECnet internal)| (505)761-2413 DTN 552-2413
-------------------------------------------------------------------------
Newsgroups: alt.security.pgp,sci.crypt
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: PKP/RSA comments on PGP legality
Organization: /usr/local/lib/news/organization
Date: Tue, 22 Dec 1992 22:28:22 GMT

res@colnet.cmhnet.org (Rob Stampfli) writes:
>>As I remember, ITAR explicitly does not apply to technical data which has 
>>been published in publically available media (books, magazines, etc.).
>
>Two rather highly respected members of the net have made this claim, so
>let's for a moment presume it is true.  If a sympathetic congressman
>could be convinced to place the source code into the Congressional Record,
>would this not constitute publishing the work, and therefore divorce it
>from any ITAR jurisdiction?  Furthermore, I think the congressman would
>be immune from prosecution, by constitutional edict, if this indeed would
>ever become an issue.
>
>This would not, of course, in any sense address PKP's claim as a patent
>holder, but it might lessen the chance of government interdiction.
>
>Comments?

Why not just publish the source code in a magazine?
--
Perry Metzger		pmetzger@shearson.com
--
Laissez faire, laissez passer. Le monde va de lui meme.
Newsgroups: alt.security.pgp,alt.security.ripem
From: strnlght@netcom.com (David Sternlight)
Subject: Re: RSAREF License
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Wed, 23 Dec 1992 23:54:24 GMT


Christopher Conway interprets the clause giving RSA the right to use
and distribute any modifications to RSAREF or the Application as
making such things "their property." This is an unfair misreading.

Assuming the message is not an attempt to make RSA wrong, but Conway
is genuinely concerned:
They give RSA free for non-commercial use; fair is fair and they
should have the right to use and distribute anything that uses
RSA in this way. If you want to have a commercial product then
you should license RSA and pay the fee.

The agreement says clearly that you can't charge (except for media
costs) for anything you develop with RSAREF. Thus no economic
value is lost if RSA also distributes the Application or modification.
To the contrary, since those who use RSAREF do so to provide free
product for what one assumes are altruistic motives, RSA's giving
the products even wider distribution should be viewed as a
"Good Thing" and not some evil or unfair purpose.

A right to use and distribute of the kind in the agreement does
not convey any property rights; just a right to use and distribute.
See the parallel language about RSAREF in the agreement, which gives
the licensee rights to use and distribute, but does not convey
property rights.

Could we please stop the RSA bashing here, assume good faith
until PROVEN otherwise, and get on with things?

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail

Xref: sparky alt.security.pgp:343 sci.crypt:5991
From: amanda@intercon.com (Amanda Walker)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: Legal Stuff!
Date: Mon, 21 Dec 1992 10:51:59 -0500
Organization: InterCon Systems Corporation
Distribution: world
Reply-To: amanda@intercon.com (Amanda Walker)
NNTP-Posting-Host: chaos.intercon.com
X-Newsreader: InterCon TCP/Connect II 1.1fc3

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
> The above statement, is a complete mess. First, according to ITAR, 
> exporting of ANY encryption software might be illegal, not just of DES. 

Correct, by my understanding.

> (I just wonder how all those crypt(3) functions in the Unixes around 
> were exported...)

They weren't.  Export versions of UNIX have the crypt(3) functions removed
from the C libraries.  The login program (which uses crypt(3) internally to 
authenticate passwords) turns out to be OK, because it cannot be used to 
encrypt or decrypt information.  I have seen it reported in print that there 
is an exemption from ITAR for software which performs authentication only 
(and cannot be used for encipherment), but I have not located the specific 
regulation in question.

> Fortunately, the USA is not the only country that has programmers, so 
> there are plenty of free DES implementations around. I really cannot 
> understand why RIPEM is not available for anonymous ftp, without the DES 
> and the RSAREF stuff. Anybody should be able to plug in additional 
> DES- and RSAREF-compatible modules... 

This possibility is being explored.  Making it available without DES included 
is not a problem.  Making it available without RSAREF, but still assuming the 
*use* of RSA in its operation, may not be enough to satisfy RSA's lawyers.  
However, we shall see how this develops.  I hope that something along these 
lines can be worked out.



Amanda Walker
InterCon Systems Corporation


Xref: sparky alt.security.pgp:448 gnu.emacs.vm.info:491
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP as a World Standard
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Mon, 21 Dec 1992 07:44:35 GMT


Perry Metzger has posted some slimy responses in the past, which I've
ignored, but his latest, in which he questions my motives, and then
states, as if it were a fact, that I've painted myself in a corner
takes the cake.

I have no hidden motives or hidden sponsors, have not painted myself
in any corner, and Metzger is beneath contempt.

David


Newsgroups: alt.security
From: root@ento.csiro.au (Operator)
Subject: looking for Unix monitoring tools
Organization: CSIRO Division of Entomology, Canberra, Australia
Date: Tue, 22 Dec 1992 07:06:58 GMT

G'day

	does anybody in net.land have a program that, when
	given a terminal name (e.g. /dev/ttyp3) will echo
	the characters sent to said terminal, on my screen ?

	Basically, what I'm after is some sort of real-time
	monitoring program, and I'm too busy (lazy ? :-) to
	write it myself...

cheers
Phil
-------------------------------------------------------------------------
  Phil Burg   Computer Unit, CSIRO Division of Entomology   ph 246 4071
  "Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn" - HP Lovecraft

Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: pete@extro.ucc.su.OZ.AU (Peter Alexander Merel)
Subject: Re: PGP as a World Standard
Organization: Sydney University Computing Service, Sydney, NSW, Australia
Date: Wed, 30 Dec 1992 00:51:20 GMT

pmetzger@snark.shearson.com (Perry E. Metzger) writes:
>Mr. Sternlight is probably refering to article
><pete.724907978@extro.ucc.su.OZ.AU> posted by Peter Alexander Merel,
>not by me. I have never refered to him as having "painted himself into
>a corner". To my knowledge, I've never posted a "slimy response" to
>anyone, including Mr. Sternlight.

It is true that I implied that David Sternlight has painted himself into a 
corner, though the sliminess in that post was my query about whether 
Sternlight had a pecuniary motive for his extraordinary stance.

But I have another slimey theory about Sternlight that may repair his
reputation in certain corners. I think that possibly Sternlight is Phillip
Zimmerman posting by another name, and that promotion of PGP is his aim 
after all. What better way to do it than this? 

But even if Sternlight is not Zimmerman I think he is to be applauded for
the service he has done in producing so many staunch PGP supporters. We
can only hope that he continues this ironic crusade, thank him and wish
him well.

Thank you David.

-- 
Internet: pete@extro.su.oz.au             UUCP: {uunet,mcvax}!munnari!extro!pete
                       I am a big pond in a small fish.
Newsgroups: alt.security
From: vince@ghost.dsi.unimi.it (David Vincenzetti)
Subject: Fooling DNS-based authentication
Organization: Computer Science Dep. - Milan University
Date: Tue, 29 Dec 1992 15:59:17 GMT

I've been experimenting with ~/.rhosts and /etc/hosts.equiv security
with Sun machines lately, and I've found some interesting things I
would like to discuss. Suppose that host COMMERCIAL.COM has the
following /.rhost:

	COMMERCIAL2.COM		root

Then I change my name server record to rename my site HACKER.COM to
COMMERCIAL2.COM. Then I type in the following command:

	# id
	uid=0(root) gid=0(root)
	# rsh -l root COMMERCIAL.COM

What do you think it happens? This is what happens: usually I don't
get access but *sometimes*, when COMMERCIAL.COM's nameserver is slow
or other the trick *does* work and I successfully log in.

I don't have Sun's rshd.c handy, it is probably not available at all
since it seems Sun Inc. never releases sources, but the following comes
from BSD's rshd.c source:

	[...]
	getpeername(0, (struct sockaddr *)&from, &fromlen)
	[...]
        hp = gethostbyaddr((char *)&fromp->sin_addr, sizeof (struct in_addr),
                fromp->sin_family);
        if (hp) {
                /*
                 * If name returned by gethostbyaddr is in our domain,
                 * attempt to verify that we haven't been fooled by someone
                 * in a remote net; look up the name and check that this
                 * address corresponds to the name.
                 */
                hostname = hp->h_name;
                hp = gethostbyname(remotehost);
	[...]

Gethostbyname() may fail sometimes, for istance the nameserver could
be unreachable or too slow. If it happens BSD's rshd sets the name of
the remote host to inet_ntoa(fromp->sin_addr), so it is not possible
to fool the rsh daemon. Sun's rshd, on the contrary, seems to act a
malenky bit randomly: sometimes you log in, sometimes you don't.

What is the reason of this strange behaviour? Can anyone clear me
the point? I know this is all undocumented stuff but I'm truly
interested in the matter since I'm adminstrating the security of
many machines, including Suns. Many thanks in advance.

Regards,
David
-- 
David Vincenzetti, system administrator
Department of Computer Science,         Email: vince@ghost.dsi.unimi.it
via Comelico 41, 20135 Milan, ITALY     Phone: ++39 2 55006 391
$PUBLIC KEY available by finger(1)$     Fax  : ++39 2 55006 373
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: PGP as a World Standard
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 21 Dec 92 22:24:08 GMT

strnlght@netcom.com (David Sternlight) writes:

> Since the professor's message clearly is mostly opinion, and
> by his language he reveals partisanship at the end, I suggest
> that Vesselin's position is a straight appeal to authority,
> without considering the substance.

Ah, his message is mostly an oppinion? And what are all your messages?
Theorems maybe? I just pointed out that his message was an oppinion
backed up with professional knowledge of the law, while yours weren't.
That's why I tend to agree with his oppinions and not with yours.

> That seems very odd to me, given that most of those arguing against my
> position explicitly reject authority when it doesn't suit their
> arguments.

It just means that you make the serious error to assume that all your
oponents think in one and the same way.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Xref: sparky alt.security:5236 sci.crypt:6234 talk.politics.guns:25718 talk.politics.misc:65431 alt.security.pgp:439
From: russotto@vnet.ibm.com (Matthew T. Russotto)
Date: Mon, 28 Dec 92 11:04:12 EST
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP as a World Standard
Disclaimer: This posting represents the poster's views, not those of IBM
News-Software: UReply 3.1
            <1992Dec21.064820.25343@ulysses.att.com>

In <1992Dec21.064820.25343@ulysses.att.com> Steven Bellovin writes:
>
>There's a fine line here, but basically, you're wrong.  Patent law
>bars the *making*, *selling*, or *use* of the protected invention.
>Writing source code, as opposed to writing a book or paper that describes
>RSA, would be considered an infringement.  I know that that's a fine line.
Fine line?  That's a nonexistent line.  All source code is is a
description-- it doesn't DO anything.  Its not a device.  Now, if you
compile the stuff, there might be some grounds, but how can the source
itself infringe?

Of course, none of this will really be settled until someone makes a
Federal case of it.  Has PKP actually sued anyone, or is bullying and
threats the whole of their style?

Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: PGP as a World Standard
Organization: /usr/local/lib/news/organization
Date: Tue, 22 Dec 1992 22:37:35 GMT

strnlght@netcom.com (David Sternlight) writes:
>
>Perry Metzger has posted some slimy responses in the past, which I've
>ignored, but his latest, in which he questions my motives, and then
>states, as if it were a fact, that I've painted myself in a corner
>takes the cake.
>
>I have no hidden motives or hidden sponsors, have not painted myself
>in any corner, and Metzger is beneath contempt.


Mr. Sternlight is probably refering to article
<pete.724907978@extro.ucc.su.OZ.AU> posted by Peter Alexander Merel,
not by me. I have never refered to him as having "painted himself into
a corner". To my knowledge, I've never posted a "slimy response" to
anyone, including Mr. Sternlight. I am agressive about positions I
hold dearly, but I do not post ad hominem attacks. It would appear
that Mr. Sternlight is the individual who is wrongfully lashing out in
this instance.

--
Perry Metzger		pmetzger@shearson.com
--
Laissez faire, laissez passer. Le monde va de lui meme.
From: marc@tanda.isis.org (Marc Thibault)
Newsgroups: alt.security
Subject: Re: PGP as a World Standard
Date: Wed, 23 Dec 92 11:24:41 EST
Reply-To: marc@tanda.isis.org
Distribution: na
Organization: Thibault & Friends

In article <1992Dec17.215323.1154@netcom.com> 
(David Sternlight) preaches:

> PGP 1.0 was a violation of the RSA patents. Consider it having a label
> called "fruits of a violation". That label isn't removed simply
> because it passes over some wires to Europe.  Note carefully: a copy
> of PGP 1.0 brought to Europe from the U.S. is NOT ethically equivalent
> to a PGP 1.0 programmed from scratch in Europe.

    this can be rephrased...
        (A book smuggled out of a Soviet gulag was a violation of USSR
        law. Consider it having a label called "fruits of a
        violation". That label wasn't removed simply because it took a
        train to Europe. Note carefully: a copy of a Soviet
        dissident's book brought to the West from the USSR was not
        ethically equivalent to an exposee written from scratch in the
        West.)

        David is still having a major problem distinguishing between
        ethics and local laws.

        From a viewpoint outside the USA, not only is the RSA patent
        invalid, it has no reasonable claim to validity and should not
        be valid inside the USA either. It attempts to patent a
        published mathematical principle and, as such, it is an
        abomination without precedent. I applaud the courage of those
        U.S. dissidents with the chutzpa to actively resist this
        repression. ;-)

        I'm not up to interfering in the internal affairs of a
        sovereign state (even one with no such scruples itself). On
        the other hand, I'm not about to let a specious accusation go
        without comment.

        Cheers,

                Marc

---
 Marc Thibault        |  Automation Architect        |  The PC: Colt '45
 marc@tanda.isis.org  |  R.R.1, Oxford Mills,        |  of the information
 CIS:71441,2226       |  Ontario, Canada  K0G 1S0    |   frontier
 NC FreeNet: aa185    |                              |

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.0

mQBNAiqxYTkAAAECALfeHYp0yC80s1ScFvJSpj5eSCAO+hihtneFrrn+vuEcSavh
AAUwpIUGyV2N8n+lFTPnnLc42Ms+c8PJUPYKVI8ABRG0I01hcmMgVGhpYmF1bHQg
PG1hcmNAdGFuZGEuaXNpcy5vcmc+
=HLnv
-----END PGP PUBLIC KEY BLOCK-----

                
Xref: sparky alt.security:5207 sci.crypt:6044
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP as a World Standard
From: a_rubin@dsg4.dse.beckman.com (Arthur Rubin)
Date: 22 Dec 92 17:12:58 GMT
 <a_rubin.724966865@dn66> <1992Dec22.001709.29529@netcom.com>
Organization: Beckman Instruments, Inc.

In <1992Dec22.001709.29529@netcom.com> strnlght@netcom.com (David Sternlight) writes:


>I think Arthur Rubin is wrong about PGP in the U.S. not being covered by
>the patent laws against making. Since it infringes RSA, it is an
>object covered by the patent laws against making.

Fair enough, we disagree.  Because we don't (according to law) have
software patents in the US, it follows that software, by itself, cannot
infringe a patent, regardless of the patent claims.  Hence, in my opinion
(supported by at least one lawyer posting publically on CompuServe),
software cannot directly infringe on a patent.  However, if the only use is
infringing, it can induce infringement, and be subject to damages for
contributory infringement.


--
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
Newsgroups: alt.security
From: dockhorn@probitas.cs.utas.edu.au (Patrick Dockhorn)
Subject: pgp language files & rs6000 port
Organization: University of Tasmania, Australia.
Date: Sat, 2 Jan 1993 08:37:55 GMT

I have two questions concerning pgp :

1. Where can I find other language files ?
   They're mentioned in the documentation but I couldn't
   find a hint on where to get them from.  
   I'm particularkly interested in the german version.

2. I tried to install pgp 2.1 on a RS6000 and got no
   error messages during the make process - but the
   initial key generation fails (keygen failed).
   The same source code compiled on a Sparcstation
   works fine - anybody ran into similar trouble ?

Any help would be appreciated
-patsch

--
There are very few personal problems that cannot be solved through a
suitable application of high explosives.