HDTenEightyP/NetNews huggingface dataset:
From: englund@kinglear.cs.colorado.edu (Todd Englund)
Subject: Request for consultant addresses.
Organization: University of Colorado at Boulder
Distribution: usa
Date: Mon, 25 Jan 1993 00:37:46 GMT

I wish to contact organizations that offer security consulting. 
Can anyone direct me to a list of names and addresses (email or postal)
of such organizations?

Thanks,
Todd
From: fetrow@biostat.washington.edu (David Fetrow)
Newsgroups: alt.security
Subject: F-prot (was: Virus Programs ForSale)
Date: 22 Jan 1993 02:17:18 GMT
Organization: Biostatistics, School of Public Health, Univ. of Wash.
Distribution: world
NNTP-Posting-Host: orac.biostat.washington.edu
Summary: Cheap protection available

In article <1jn8k8INNicb@mirror.digex.com> alby@access.digex.com (Albatross) writes:

> See if the Dark Avenger virus really can be detected
> by these money hungry  anti-virus software companies, or if you dollars are
> paying off.

 I'd like to put in a plug for an inexpensive virus checker: f-prot. It's
available via anonymous FTP, is quite cheap ( <$1/copy for most of us ) and
has detected/cleaned  several virii for us (and yes, we have lost disks to
virii in the past; public PC labs in schools are more prone to virii than
most places).

 Anonymous FTP site: risc.ua.edu   (130.160.4.7)

You don't need to spend a lot of money to get a reasonable degree of protection.
My only connection to the program is as a VERY satisfied user.

..and if the author every finds himself in Seattle, he can have a standing
ovation from the PC lab staff whenever he wants.


-- 
   -dave   fetrow-		INTERNET:	fetrow@biostat.washington.edu
   				BITNET:		fetrow@uwalocke
From: earlw@Apple.COM (Earl Wallace)
Newsgroups: alt.security
Subject: Re: National Security vs Personal Security
Date: 25 Jan 93 19:48:50 GMT
Distribution: york
Organization: Apple Computer/ESD/OSBU/SW Dev/App & Tool Dev

In article <1993Jan24.023454.5579@newshub.ariel.yorku.ca> cs911007@ariel.yorku.ca (ANDREW J DICK) writes:
>
>Which has greater rights, the nation's right to be secure from classified
>data crossing its borders without its knowledge, or a person's right to send
>data with knowledge that it will be read by the proper receiver only.
>...

If we assume the government has the greater right in knowing that classified
data is not let out of the country, we have to ensure no one is allowed to
communicate with a foreign person without a government censor present.  This
seems like a big over overkill, but it's necessary to protect goverment
secrets.  Every single phone call, mail, fax, modem/dial-up, street encounter,
whatever would have to be monitored.  Birds would have to be shot down as
they crossed the borders and examined to see if they carry "notes" to the
outsiders.  When you plan a trip overseas, you have to book an extra seat
for the government censors who would be required to travel with you.  Any
physical contact with a foreigner would be out of the question.

How far do we take this security anyway?  Shall we duct tape people's
mouth shut, handcuff them to their homes, take away their phones and
mail boxes?  Wouldn't the government have less of a problem if it didn't
have all these citizens running around like mice and screwing up the
works?  Since we agree the government has a greater right than the citizen,
I think the next logical step is to kill off the citizens.  We have already
decided they have no rights anyway.

Now, I hope you know my feelings about who has a greater right.
From: lsnyder@fig.ucsb.edu (Lowell R. Snyder,,,COMS,Undergraduate)
Newsgroups: alt.security
Subject: Re: Virus Programs ForSale (Virus,Trojan,etc)
Date: 27 Jan 93 00:37:37 GMT
Organization: University of California, Santa Barbara

In article <1jn8k8INNicb@mirror.digex.com> alby@access.digex.com (Albatross) writes:
>                            VIRUS'es    FOR    SALE
>                        ----------------------------------

As a computer security professional, I must object to this posting as an
obvious attempt to make money off a bad sitation, buy making the situation
even worse! Only a fool would buy a virus just to see if the AV product
works, because if the AV does not work, that person is even more screwed
than he was to begin with.

And as to your legal disclaimer at the bottom, I will sue you in civil
court for the intentional spread of a virus if any of the the computers
I am responsible for are infected as a result of this post!

NB: The threat of viral infection is real enough without the need to 
test it (do you need to check to see if you bleed?).

------------------------------------------------------------------------------
Try our new Eunichs - a slightly smaller version of the popular original,
featuring the SpermControl Print Queue (the more copies you send, the more
likely one will be printed).
Xref: sparky alt.security:5370 comp.security.misc:2604
From: readingj@nic.cerf.net (John D. Reading)
Newsgroups: alt.security,comp.security.misc
Subject: Summary and Thanks: Help processing SECRET data
Date: 25 Jan 1993 20:11:55 GMT
Organization: CERFnet Dial n' CERF Customer Group
Distribution: us
NNTP-Posting-Host: nic.cerf.net

Last week I posted a request for information about processing
SECRET data on a machine connected to the internet.  I have
received a great number (> 25) of very helpful responses, and
so the first order of business is to send out a big THANKYOU
to all who responded.  I would prefer to respond individually,
but the volume of responses makes that a little difficult.  All
the information was very useful.

To summarize:  If you have a situation dealing with handling
classified data, you really need to refer to the agency providing
the data and/or your local security people; the issues are much
too complex to be dealt with in a generic manner.

That said, several people gave me examples of how data and compute
resources must be handled in a secure environment, and I quickly
understood that my best option is to avoid even trying - I will
maintain a separate set of machines for internet access.

Again, thanks for the help.  You have once again helped me prove
to my management that internet access is a Good Thing (tm), and
must be preserved in order to maintain Right, Justivce and the
American Way.

John Reading
readingj@cerf.net
Newsgroups: alt.security
Newsgroups: alt.security
Subject: Re: Making PGP legal?
From: bthao@eis.calstate.edu (Bisous Thao)
Date: Tue, 26 Jan 1993 17:38:46 GMT
Organization: Calif State Univ/Electronic Information Services

Hi there,
That people outside France consider themself lucky :)
Indeed, a dec 1992 law has prohibited all use of cryptography
for personal data, ie I can't crypt my hard disk without
taking the risk of beeing thrown to jail!
This is no joke, ithe law goes as far as that :(
But, I'm still interested in pgp and in sites such
as the former PAX in Australia that enabled secrecy mail,
and has been shutdown for "that the service is unsuitable
for AARNET" (the Australian Academic Research Net people).
I haven't followed the whole discussion, can anyone brief
me on that. How pgp programs? pgp 2.0 and...Can I use
them outside the US (and France!).
Thanx to all,
Ben
From: palmer@icat.larc.nasa.gov (Michael T. Palmer)
Newsgroups: alt.security
Subject: Re: Caller ID products?
Date: 28 Jan 93 16:13:36 GMT
Organization: NASA Langley Research Center, Hampton, VA  USA
NNTP-Posting-Host: icat.larc.nasa.gov

davidsen@ariel.crd.GE.COM (william E Davidsen) writes:

>  Why do you want to make anonymous calls? Are you the person who calls
>my mother and breathes at her? Or the guy who calls 21 times (so far) to
>sell me siding, and won't believe I have a brick house? What possible
>legal reason would you have for calling someone anonymously?

What possible legal reason?  Suppose I want to call several businesses to
check their prices and services.  Why should I have to tell them my name,
address, and phone number?  Would they require the same info of someone who
walked in the door and asked for prices and services?

I have a "legal" reason: I don't want them to sell my name (like yours
obviously was) to slime buckets who call me during dinner twice a week to
sell me siding and insulated windows.  That's my reason.

Calling individuals, though, I can see how it could be considered impolite
to call with your number blocked.  Fine.  Don't answer (or have the TelCo
play a message saying your line won't accept blocked calls).  If I want to
talk with you, I'll unblock my line and call again - of course, where I
live I can't block my line at all for any price so it's a moot point.

-- 
Michael T. Palmer         |  "A man is crazy who writes a secret in any
m.t.palmer@larc.nasa.gov  |   other way than one which will conceal it
RIPEM key on server       |   from the vulgar." - Roger Bacon
Newsgroups: alt.security
From: strnlght@netcom.com (David Sternlight)
Subject: Re: Please, let's not confuse the issue.
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Sat, 23 Jan 1993 00:55:43 GMT

In article <1jovrlINN8d@uwm.edu> rick@ee.uwm.edu (Rick Miller) writes:
>There's been a thread on alt.security which is misinforming in the extreme.
>Note the former Subject: line, "Making PGP legal?"... Here's the irony of it:
>
>	DISTRIBUTING PGP 2.1 IS *NOT* ILLEGAL, as long as folks
>	follow the export laws, and don't *export* it from the US
>	or Canada.  Remember that PGP 2.1 was developed outside of
>	the US, and that there are sites like nic.funet.fi which
>	have it available for anonymous ftp.  *IMPORTING* PGP 2.1
>	IS STILL LEGAL, even in the US.  (Note that some countries
>	may not wish their citizens to *have* cryptologic technology,
>	and import may there be illegal.)
Without wishing to reopen the discussion of whether it's right or wrong, the
above statement is factually incorrect. Importing ANY cryptographic system,
software, flowcharts, etc. is specified under U.S. law as requiring an
import license. For exact quotation of the regulations, contact Jim Bidzos
of RSA Data Security.

Since no import license has been granted for PGP 2.1, distributing it in the
U.S. is distributing of an illegal import.

This is quite separate from any issues of patents.

Let's not repeat the discussion of whether the law is right or wrong, or
whether one should engage in civil disobedience or not. We need at least to
know the truth about the legal situation, whether we agree with it or not.


>	USING PGP 2.1 IS *NOT* ILLEGAL, at least not in any nation
>	I'm familiar with.  Yes, in the U.S. it is possible that RSA
>	may take you to court for doing it, but it's not against any
>	*law* to do it.  Their only claim against you would be to
>	recover 'damages' to their profits.

Again, this is simply factually incorrect. See above.

There have been a number of messages by others pointing this out, but you
appear to have missed them. Apologies for the tedious repitition of the
basic facts, but as long as messages like the above are posted, they need to
be repeated.

David
-- 
David Sternlight
RIPEM Public Key on server  --  Consider it an envelope for your e-mail
From: tihor@acf3.NYU.EDU (Stephen Tihor)
Newsgroups: alt.security
Subject: Re: Help with handling SECRET data
Date: 26 Jan 93 17:52:00 GMT
Organization: New York University

RUle 1: its your security officer and the agency that makes up the rules
they follow that limit what you can and can not do.
Rule 2: unless you are MLS everywhere and running NSA encryption assume you]
whole facility must meet the highest phsyical security requirements, emisions
containment, etc., and that you will have to run SYSTEM HIGH everywhere, eg 
NETWORK HIGH so everyone is cleared for everything in principle. 

Otherwise you have a bunch of rewiring, pipelaying, etc to do.

SUggestion 3: start looking into firewall boxes now and avoid the rush.
You'll need a very good one, possible an A, again it depends on who's
doing your review, etc.
--
Stephen Tihor/NYU/251 Mercer St/NY NY 10012/+1 212 998 3052/tihor@nyu.edu
From: lpssegel@susssys1.reading.ac.uk (Glen Segell)
Newsgroups: alt.security
Subject: Re: F-prot (was: Virus Programs ForSale)
Date: 25 Jan 93 08:56:26 GMT
Organization: University of Reading

fetrow@biostat.washington.edu (David Fetrow) writes:

>In article <1jn8k8INNicb@mirror.digex.com> alby@access.digex.com (Albatross) writes:

>> See if the Dark Avenger virus really can be detected
>> by these money hungry  anti-virus software companies, or if you dollars are
>> paying off.

> I'd like to put in a plug for an inexpensive virus checker: f-prot. It's
>available via anonymous FTP, is quite cheap ( <$1/copy for most of us ) and
>has detected/cleaned  several virii for us (and yes, we have lost disks to
>virii in the past; public PC labs in schools are more prone to virii than
>most places).

> Anonymous FTP site: risc.ua.edu   (130.160.4.7)

>You don't need to spend a lot of money to get a reasonable degree of protection.
>My only connection to the program is as a VERY satisfied user.

>..and if the author every finds himself in Seattle, he can have a standing
>ovation from the PC lab staff whenever he wants.

The latest updates of F-prot can be found  on COMPLEX.IS anonymous FTP
is permitted. This is the authors site and frequently the latest versions
are not always distributed. 

Glen Segell
Dept of Politics
University of Reading

>-- 
>   -dave   fetrow-		INTERNET:	fetrow@biostat.washington.edu
>   				BITNET:		fetrow@uwalocke
Newsgroups: alt.security,comp.dcom.modems
From: fmcgee@ccscae.Columbia.NCR.COM (Frank McGee - Naperville)
Subject: Re: Caller ID products?
Followup-To: poster
Summary: automatic callback feature
Distribution: na
Date: Wed, 27 Jan 93 21:14:05 GMT
Expires: 2/25/93

In article <1993Jan27.174418.18400@ee.ubc.ca> johnt@ee.ubc.ca (John Jay G. Tanlimco) writes:
>In article <palmer.728073717@news.larc.nasa.gov> palmer@icat.larc.nasa.gov (Michael T. Palmer) writes:
>>unruh@physics.ubc.ca (William Unruh) writes:
>
>But wouldn't prank callers think twice, knowing their calls can be traced 
>easily.  Even if it isn't admissible as evidence, if you call them back
>right after they called you, that should scare the prankster.

Actually, there is/was a feature that you could kind of use to get this
kind of functionality (ability to call back the person that just called
you).  I can't remember what the service is called, and it's too new to
be in our phone books here at work, but in the Chicago area (serviced
by Illinois Bell) there was a feature that could best be described as
"call back the last person that called me".  Real nifty.  Primarily you
could use it to call back that person that called you that you just
missed.  You could also call back an obscene phone caller immediately
after they've called you.

A friend of mine had a problem with recurring obscene phone calls for
over 2 years, and Illinois Bell wasn't much help because the person
only called once every 2 or 3 months.  He heard about the new phone
feature, had it turned on, and the next time the person called he
called them back.  He got one of their parents (turned out the person
was someone we went to high school with who still lived with his
parents), and after a brief conversation the harassment ended.

My friend also had to pay to have the feature turned on, plus a monthly
service for having it.

However, the service does not give you the caller's number; it only
allows you to call them back.  So if you didn't get a voice on the other
end, you might not be able to find out much.  But then again if it was a
toll call the local telco should have a record of it.

Might also be a neat way to chase back hackers too (assuming you knew
that an inbound call was from a hacker).

Anyway, my 2 cents worth,

-- 
Frank McGee
NCR Product Maintainability and Support (PM&S) Naperville
email:  nap-top!fmcgee@ccscae.ColumbiaSC.NCR.COM
email:  !att!iwcs!iwtbn!nap-top!fmcgee
Newsgroups: alt.security
From: btf57346@uxa.cso.uiuc.edu (Byron "Bohr" Faber)
Subject: Re: Making PGP legal?
Organization: University of Illinois at Urbana
Date: Thu, 21 Jan 1993 20:25:18 GMT

Just a note:  When source code is out of the box and when SO many 
people use it there is LITTLE ANYONE can do to stop them
from using it.  I like pgp, I AM in the U.S. and I really
don't care WHAT Uncle Sam says people outside the U.S. and what
they can and can't have.   

Shot.  By the time they can say that no people outside the U.S. can 
have X product (source code here) the chances are they ALREADY have it.

Oh well.

Since pgp is supposedly bad.  Anybody out there know another good, 
almost no-fail security system for free, with source code and portable?

If you do e-mail me.   :)    I won't be holding my breath though.

Byron Faber
-- 
Please Note:  Some Quantum Physics Theories Suggest that When the Reader   
              Is Not Directly Observing This Message, It May Cease to Exist
              or Will Exist Only in a Vague and Undetermined State.
Internet:  btf57346@uxa.cso.uiuc.edu  & btf57346@sumter.cso.uiuc.edu
Newsgroups: alt.security
From: cs911007@ariel.yorku.ca (ANDREW J DICK)
Subject: National Security vs Personal Security
Originator: cs911007@t12.ariel.yorku.ca
Organization: York University, Toronto, Canada
Distribution: york
Date: Sun, 24 Jan 1993 02:34:54 GMT


Which has greater rights, the nation's right to be secure from classified
data crossing its borders without its knowledge, or a person's right to send
data with knowledge that it will be read by the proper receiver only.

I am currently writing a paper which discusses these two views, and I would
be interested in hearing some opinions from people out on the nets.  Please
send post a reply or email one.

Thanks alot,
    Andrew J. Dick

===============================================================================
Andrew J. Dick       IRC Administrator | The opinions stated above are mine and
irc@ariel.yorku.ca            Wildmage | quite  possibly  mine  alone.  However 
cs122014@sol.yorku.ca           on IRC | they could  be yours  too for  a short
cs911007@ariel.yorku.ca                | time  and a  nominal  fee.  Call  Now!
cs911007@moose.cs.yorku.ca             | Operators are standing by...
===============================================================================
From: davidsen@ariel.crd.GE.COM (william E Davidsen)
Newsgroups: alt.security
Subject: Re: F-prot (was: Virus Programs ForSale)
Date: 22 Jan 93 18:17:03 GMT
Reply-To: davidsen@crd.ge.com (bill davidsen)
Organization: GE Corporate R&D Center, Schenectady NY

In article <1jnlfeINNc0l@shelley.u.washington.edu>, fetrow@biostat.washington.edu (David Fetrow) writes:

|  I'd like to put in a plug for an inexpensive virus checker: f-prot. It's
| available via anonymous FTP, is quite cheap ( <$1/copy for most of us ) and
| has detected/cleaned  several virii for us (and yes, we have lost disks to
| virii in the past; public PC labs in schools are more prone to virii than
| most places).
| 
|  Anonymous FTP site: risc.ua.edu   (130.160.4.7)

  I concur, this is fine software! We had a site license, but corporate
negotiated a corporate license with someone else so we use that now. We
were happy with f-prot, and I still use it personally. During the years
I was moderator of c.b.i.p I used it regularly and was happy with it.

| You don't need to spend a lot of money to get a reasonable degree of protection.
| My only connection to the program is as a VERY satisfied user.
| 
| ..and if the author every finds himself in Seattle, he can have a standing
| ovation from the PC lab staff whenever he wants.

  Amen. From me, too.

-- 
bill davidsen, GE Corp. R&D Center; Box 8; Schenectady NY 12345
    Keyboard controller has been disabled, press F1 to continue.
Newsgroups: alt.security
From: johnt@ee.ubc.ca (John Jay G. Tanlimco)
Subject: Re: Virus Programs ForSale (Virus,Trojan,etc)
Organization: University of BC, Electrical Engineering
Date: Wed, 27 Jan 1993 17:50:14 GMT

In article <7490@ucsbcsl.ucsb.edu> lsnyder@fig.ucsb.edu (Lowell R. Snyder,,,COMS,Undergraduate) writes:
>In article <1jn8k8INNicb@mirror.digex.com> alby@access.digex.com (Albatross) writes:
>>                            VIRUS'es    FOR    SALE
>>                        ----------------------------------
>
>As a computer security professional, I must object to this posting as an
>obvious attempt to make money off a bad sitation, buy making the situation
>even worse! Only a fool would buy a virus just to see if the AV product
>works, because if the AV does not work, that person is even more screwed
>than he was to begin with.
>
>And as to your legal disclaimer at the bottom, I will sue you in civil
>court for the intentional spread of a virus if any of the the computers
>I am responsible for are infected as a result of this post!

I, too, don't approve of the posting.  But, what are the chances of you 
winning in court?  From the posting, it seems legal, although unethical.
-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
John Jay Tanlimco | University of British Columbia  | #$%!#^H&*(()_4|&^$M#}!@
johnt@ee.ubc.ca   | Dept. of Electrical Engineering | @{$%8&*()!M#$%^&*()_=!S
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Newsgroups: alt.security
From: sara@trauma.rn.com (Sara Gordon)
Subject: Re: F-prot (was: Virus Programs ForSale)
Organization: Gator Communications - Feeds-R-Us 219-289-3745 
Date: Tue, 26 Jan 1993 04:56:33 GMT

ifbb657@emx.cc.utexas.edu (Douglas Floyd) writes:

>In article <1993Jan22.181703.20039@crd.ge.com> davidsen@crd.ge.com (bill davidsen) writes:


>Speaking of virus programs (or virus detector programs, if you want
>a virus program, find this Dark Avenger chap :-), I have had very

why would finding him help you? if you are interested i just have
had published the first of a three part interview with him in the
Virus News International. It will probably be in some U.S.A. based
magazine shortly. 

he's not making viruses.

>good luck with Norton Antivirus.  The Macintosh version has protected
>me from numerous encounters, and the MS-DOS version has been equally
>as strong.  I have heard that NAV and Central Point's products stink
>from some people.  What is the best antivirus product (commercial)
>out there?

i personally prefer F-Prot and The Anti-Virus toolkit. i have had many
clients using NAV or CPAV with bad results, and i always recommend they
-remove- those things before it is too late...


-- 
           #  "talk to me about computer viruses............" 
           #  fax/voice:    219-277-8599     sara@gator.use.com
           #  data          219-273-2431     SGordon@Dockmaster.ncsc.mil
           #  fidomail      1:227/190        vfr@netcom.com
Newsgroups: alt.security
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Making PGP legal?
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 25 Jan 93 13:56:42 GMT

-----BEGIN PGP SIGNED MESSAGE-----

dagolden@phoenix.Princeton.EDU (David Alexandre Golden) writes:

> It's not.  Re-writing RIPEM to be compat with the rest of the world
> (i.e. PGP) can't be legally done for the same reason I can't legally
> run PGP.

Uh, why not?? I don't want to re-start the flame war, but as far as I
understood, using PGP might be a petent infringement, because it is
not licensed by PKP and importing it seems to be against ITAR.

However, if you want to make RIPEM compatible with PGP, nothing
prevents you to import the description of the formats of PGP's
messages and to implement it using the code from the RSAREF library...

Regards,
Vesselin

-----BEGIN PGP SIGNATURE-----
Version: 2.1

iQCVAgUBK2PyTjZWl8Yy3ZjZAQEeYwQAlrXK4/666wcUc59Ckl/kod/6G7InGtCp
Agp2tXlydupyZ3gqExnVnXaBbOnK70OlaJTszWFmLqKIezzcdpKPV2ngKr+iOCtZ
0MK75yRnFw+Os7rR2LouTOEAxk8rrGgDpq3kwb465bC8jx98xPglm0wBEdONJxyV
MhV64ZUO0M4=
=jte6
-----END PGP SIGNATURE-----
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: alt.security