HDTenEightyP/NetNews huggingface dataset:
From: dododge@wam.umd.edu (David O. Dodge)
Subject: Re: Software Copyright protection devices
Organization: University of Maryland, College Park
Date: Thu, 3 Sep 1992 07:03:25 GMT

In article <1992Sep2.111408.13462@iti.gov.sg> wangw@iti.gov.sg (Wang Wei Jun (CC)) writes:
>Greetings!
>I am looking for information about designing software copyright protection 
>devices.

You might find some information in the recently-created newsgroup
"comp.software.licensing".

                                              -Dave Dodge/dododge@wam.umd.edu
From: gk@skyline.UUCP (Gary Kremen)
Newsgroups: alt.security
Subject: Looking for references to an AT&T security product called Quest
Date: 2 Sep 92 08:48:56 GMT
Reply-To: gk@skyline.UUCP (Gary Kremen)
Organization: Skyline Ridge Partners
X-Mailer: uAccess - Mac Release: 1.5

If you have any information, please send me E-mail and I will post
a summary if there is interest.

Gary Kremen  {uunet,mips, fernwood}!dikta.chicago.com!skyline!gk, fss@btr.com

 
Newsgroups: alt.security,comp.security.misc
Newsgroups: alt.security,comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: Software Copyright protection devices
Date: 4 Sep 92 12:55:38 GMT

lars@spectrum.CMC.COM (Lars Poulsen) writes:
>every month, the MIS group scans the hard disk of every MacIntosh and compares
>the list of executable programs with the list of programs licensed for that
>workstation. We find problems every time !!

I'm curious about two things:
	1) Do these "problems" include shareware/pd software, or is a "problem"
	   only reported when they have a known application that they're not
	   licensed for?
	2) What is your response to discovering a "problem"?  Do you:
		a) delete the application
		b) purchase it
		c) nag someone else to purchase it but they don't, so this
		   remains a "problem" each week, thus skewing the statistics?

My questions are because of a similar discussion at one of the places I work.
I don't want anyone scanning my hard disk.  I don't know how many copies of
which programs we're licensed for, but if I have a copy of something that we're
not licensed for, it's not my fault, it should just be purchased (if I need
it).  I'd be willing to provide a list of commercial applications I have to
some bureaucrats IF they were going to purchase licenses.  But if they're going
to tell me to delete them, or break into my office (via master key, of course)
and delete them and then I'll have trouble doing my work, I'm not going to tell
them.

Also, I have a very large amount of pd software which I rely on, and I'm not
sure where I ftp'd it all from.  It would be a BIG pain if people started
deleting it off my machine.

If you do pay for applications you need, I'd also be interested in your policy
on paying for shareware.
From: cappucci@crs.cl.msu.edu (horny Italian bastard)
Newsgroups: alt.security
Subject: why?
Date: 31 Aug 92 02:08:28 GMT
Organization: Art of Technology Digest

Why do places like bellcore.com allow anonymous ftp?
Newsgroups: alt.security
From: jgd@csd4.csd.uwm.edu (John G Dobnick)
Subject: Re: American Federation of Teachers on School Violence
Originator: jgd@csd4.csd.uwm.edu
Reply-To: jgd@csd4.csd.uwm.edu
Organization: University of Wisconsin - Milwaukee
Distribution: na
Date: Sat, 29 Aug 1992 06:27:15 GMT

From article <928712496DN5.61R@tanda.isis.org>, by marc@tanda.isis.org (Marc Thibault):
> In article <1992Aug17.232435.21825@samba.oit.unc.edu> 
> (Nigel Allen) writes: 
> 
>> Here is a press release from the American Federation of Teachers
>      ...
>>  American Federation of Teachers to Offer Resolution to Combat
>> School Violence
>>    * Establishing a "crisis network clearinghouse" at the AFT

All the world's a crisis to some of these folks, it seems.

>>    * Supporting the creation of alternative sites and education for
>>    * Urging Congress to provide federal assistance to school

We're from the government.  We're here to help you.  :-}

>>    * Continuing to support the Brady Bill and/or other stringent
>>    * Supporting the concept of a code of behavior for students and

Support the "concept", but not the "code" itself?  Damnable mealy-mouthed
do-gooders.    Why don't they say what they mean?  Or _did_ they? 
Or is this wording perhaps an example of what current "teachers' education"
creates?   As Homer Simpson would say, "Hmmm... concept."  1/2 :-)

>>    * Promoting the development of anti-violence curricula and

Yet another "course of study", eh?  What's wrong with the old 3 R's.
Enough of that, and there wouldn't be _time_ for this extra stuff.

>>    * Organizing violence-prevention training for school staff and

I'm getting ill.

> 
>         All this to avoid hitting the little monsters!
> 
>         It's obscene.
 
Agreed.

Grumble...  mumble.... mutter.... growl.... snarl.... [grinding of teeth]


[Yes, this is a bit off topic.  I'll go away now.]
-- 
John G Dobnick, Curmudgeon              ATTnet: (414) 229-5727
Computing Services Division             INTERNET: jgd@uwm.edu
University of Wisconsin - Milwaukee     UUCP: uunet!uwm!jgd

"Knowing how things work is the basis for appreciation,
and is thus a source of civilized delight."  -- William Safire
Newsgroups: alt.security
From: yee@spectre.arc.nasa.gov (Peter Yee)
Subject: Re: IEEE 802.10b
Keywords: standard
Organization: NASA Ames Research Center, Moffett Field, CA
Date: Tue, 25 Aug 1992 19:51:24 GMT

In article <1992Aug25.133945.20585@jarvis.csri.toronto.edu>, nestor@hub.toronto.edu (John Nestor) writes:
|> Does anybody out there have any information on IEEE standard 802.10b?
|> I.e. what it is, where further information is available on it, etc.
|> Also, if there is an FTP site with this info, it would be helpful.

Sure, what sort of information do you need?  Although the 802.10b standard
cannot be may available for anonymous ftp (the last draft is what is about
to be published, and IEEE rules don't allow us to put out that version), 
I can send you copies of 802.10b, the current draft for 802.10c
(key management), meeting schedule, etc.  Send your physical address for a
copy.  We will, in the future, make materials like current drafts available
for anonymous ftp.  Warning!  These are probably going to be things like
WordPerfect documents.  Perhaps Postscript, if I can the editor to produce
that.

						-Peter Yee
						yee@atlas.arc.nasa.gov
						IEEE 802.10 Recording Secretary
Newsgroups: alt.security
From: newsham@wiliki.eng.hawaii.edu (Timothy Newsham)
Subject: Re: Secure setuid programs: A model
Organization: University of Engineering, College of Engineering
Date: Tue, 25 Aug 1992 18:34:56 GMT

In article <1992Aug24.194120.15741@Demax.COM> mikel@Demax.COM (Mikel Lechner) writes:
>Rather than a list of trusted users encoded into the program why not simply
>assign the group on the binary to a special group to which only
>your "privileged" users are assigned.
>
>-r-sr-x---  1 sources  software    24576 Apr 21 13:51 /usr/local/bin/smanager
>
>
>In this example only users who are members of the gorup 'software' are allowed
>to execute the program 'smanager' via the execute permissions.  The program
>runs with the permissions needed to access the source code tree.
>
>Controlling access to the program is a simple matter of updating the
>'/etc/group' file to include the appropriate users.
>
>
>-- 
>Mikel Lechner				E-mail:		mikel@Demax.COM
>Software Developer
>Demax Software, Inc.			Phone:		(415) 341-9017

why not get a unix that implements ACL's?

Xref: sparky alt.security:4236 comp.security.misc:1134
From: skilby@ucqais.cba.uc.edu (Steven M. Kilby)
Newsgroups: alt.security,comp.security.misc
Subject: Re: Software Copyright protection devices
Date: 3 Sep 92 06:43:58 GMT
Organization: University of Cincinnati, College of Business
Originator: skilby@ucqais.cba.uc.edu

In <1992Sep2.180717.14061@hou.amoco.com> jim@n5ial.chi.il.us writes:

>QUESTION:  is alt.security the right group for this?  somehow, I suspect
>not, but who knows....  if this belongs elsewhere, someone who knows where
>it should be, please redirect followups there.

>In article <1992Sep2.111408.13462@iti.gov.sg> wangw@iti.gov.sg
>(Wang Wei Jun (CC)) writes:

>>I am looking for information about designing software copyright protection 
>>devices. As I understand, there are two type of protection:

[ first option deleted... ]

>>  2. For networked workstation, the protection software constantly
>>     broadcast a signature to the network and try to detect the
>>     same signature.

>you really don't trust your users at all, do you?  well, in that case, do
>you honestly expect them to trust *YOU*?  personally, I demand that a
>vendor trust me to some degree, and if they don't, and someone else offers
>the same type/quality product, guess what.....  by forcing users to contend
>with the hassles you plan to cause them, just to prevent them from pirating
>your work, you not only alienate them because of the major hassle your
>software is (or can be) for them to use, but you also alienate them because
>you are directly implying that w/o that protection, they would steal your
>software.

Isn't this one of the very reasons that caused Lotus 1-2-3 to alter the way
they set up their copy protection?


Steven M. Kilby
-- 
Steven M. Kilby..................Coordinator, Computer Information Systems
University of Cincinnati................College of Business Administration
(Steven.Kilby@UC.EDU or skilby@ucqais.cba.uc.edu)   PHONE:  (513) 556-7159
From: roxy@beaune.NoSubdomain.NoDomain (Roland Buresund)
Newsgroups: alt.security
Subject: Privilegies and Threads
Keywords: Security, Privilegie, Threads
Date: 2 Sep 92 14:27:00 GMT
Reply-To: r.buresund@frec.bull.fr
Followup-To: alt.security
Organization: Groupe Bull

Hi all.

I'm wondering if anybody has any experience regarding
threads/light-weight-processes and privilegies in a secure system ?

The reason I'm asking is that I'm a bit confused how to handle
privilegie bracketing in a multi-threaded program.

Will all threads share the same effective privilegie and I as an
application programmer has to protect the possible conflicts that may 
arise or will each thread has it's own effective privilegie ?

I've been trying to find anything in Posix 1003.6/D12 about threads,
but they don't seem to acknowledge the existance of P1003.4 and
P1003.4a at all.

So in short:
	- Does any multi-threaded secure O/S that uses privilegies
	  exists, and if Yes, how has it been solved ?
	- System V Release 4 ES/MP is supposed to have threads and
	  security, does they have privilegies on a per-thread or per-
	  process basis ?

Any answer is appreciated.

--
Roland Buresund
r.buresund@frec.bull.fr
From: yoakum@matt.ksu.ksu.edu
Newsgroups: alt.security
Subject: Shadow Login Suite on System V ???
Date: 2 Sep 1992 12:46:16 -0500
Organization: Kansas State University
NNTP-Posting-Host: matt.ksu.ksu.edu

	Hi. I was just wondering how you would do it or even 
	if you can. Please post replies here or mail them to:
	
	yoakum@matt.ksu.ksu.edu
		or
	yoakum@ksuvm.ksu.edu (129.130.021.011)
Xref: sparky alt.security:4241 alt.locksmithing:1570 rec.pyrotechnics:3044
From: salsbury@acsu.buffalo.edu (The Caterpillar Cannot Understand The Butterfly)
Newsgroups: alt.security,alt.locksmithing,rec.pyrotechnics
Subject: Looking for info on "Life Force Technologies" catalog
Keywords: Trying to locate
Date: 3 Sep 92 14:58:34 GMT
Organization: Evolutionary Acceleration, Inc.

Not sure exactly where to post this, but I'm looking for a catalog from a
company called "Life Force Technologies" for a friend. Has anyone ever
heard of it? 
	If so, please email me, as I don't get into these groups that
often.

	Thanks!

Pat

-- 
   Patrick G. Salsbury			  State University of NY @ Buffalo, USA
SALSBURY@ACSU.BUFFALO.EDU			Disclaimers are silly. ;^)

			  "All bound for Mu Mu Land!"
From: marc@tanda.isis.org (Marc Thibault)
Reply-To: marc@tanda.isis.org
Newsgroups: alt.security
Subject: Re: American Federation of Teachers on School Violence
Date: Thu, 20 Aug 92 07:48:55 
Distribution: na
Organization: Thibault & Friends

In article <1992Aug17.232435.21825@samba.oit.unc.edu> 
(Nigel Allen) writes: 

> Here is a press release from the American Federation of Teachers
     ...
>  American Federation of Teachers to Offer Resolution to Combat
> School Violence
>    * Establishing a "crisis network clearinghouse" at the AFT
>    * Supporting the creation of alternative sites and education for
>    * Urging Congress to provide federal assistance to school
>    * Continuing to support the Brady Bill and/or other stringent
>    * Supporting the concept of a code of behavior for students and
>    * Promoting the development of anti-violence curricula and
>    * Organizing violence-prevention training for school staff and

        All this to avoid hitting the little monsters!

        It's obscene.

---
 Marc Thibault        |                              |  Any Warming,
 marc@tanda.isis.org  |  Oxford Mills, Ontario       |  Global or otherwise,
 CIS:71441,2226       |     Canada                   |   appreciated.

Newsgroups: alt.security
From: jokerman@colores.informatik.rwth-aachen.de (Karl-Heinz Meurer)
Subject: Specification Language
Organization: Rechnerbetrieb Informatik  /  RWTH Aachen
Date: 28 Aug 92 11:29:14 GMT

Oh no!
The last two answers i've got on my posting Bell-LaPadula/
Specification-Language were lost due to a dumb move of
mine in my file system. There was one mail, which told me 
where to get an update of SPECIAL and one which asked for
a mailing of my collected answers. 
Would you please remail these for me?
Thanks
Karl-Heinz Meurer (jokerman@i1.informatik.rwth-aachen.de)

Xref: sparky alt.security:4252 comp.security.misc:1157
From: jim@n5ial.chi.il.us
Newsgroups: alt.security,comp.security.misc
Subject: Re: Software Copyright protection devices
Date: 4 Sep 92 13:16:54 GMT
Reply-To: jim@n5ial.chi.il.us
Organization: me?  have you seen my desk?  : -)
Originator: jim@eddie

In article <19@ucqais.cba.uc.edu> skilby@ucqais.cba.uc.edu
(Steven M. Kilby) writes:
>In <1992Sep2.180717.14061@hou.amoco.com> jim@n5ial.chi.il.us writes:

>>by forcing users to contend
>>with the hassles you plan to cause them, just to prevent them from pirating
>>your work, you not only alienate them because of the major hassle your
>>software is (or can be) for them to use, but you also alienate them because
>>you are directly implying that w/o that protection, they would steal your
>>software.
>
>Isn't this one of the very reasons that caused Lotus 1-2-3 to alter the way
>they set up their copy protection?

I can't say for sure if this is correct, but that is what I heard.  it
might also have something to do with a competitor who, I believe, has no
BS devices like this to contend with.

as for my comments to the original poster for his followup to my followup,
I stand by what I said.  you talk about making this device completely
transparent, so the user doesn't even know it exists.  I trust, then,
that it is not a piece of hardware they have to put on their system (this
is not transparent), and it isn't anything involving signatures on the
disk, etc. --- so, uhh, what exactly are you thinking of?

now, there is one case where the above statement might be false --- if
your software is designed to work in conjunction with a specific I/O
card or something, and you put some type of key on that card.  actually,
from your description, this is probably the most likely.  so we'll assume
this is what you're thinking about doing.  question:  why bother, then?
if they have to have the card for the software to be of any use, what
good will it do them to copy the software onto a machine w/o this card?
or do you expect people to be printing up PC templates for the board,
etching their own board, duplicating your EPROMs, etc., and thus
bootlegging the board, too?

well, all I can say is this:  I am a user who pays for software, and I
will not pay for any that uses dongles, looking up codes every time you
run it, etc. --- if I do pay for it, you can expect me to return it to
the store the instant I find out about it.....

later.
   --jim

\input std_disclaimer                     % 73 DE N5IAL (/9)
------------------------------------------------------------------------------
"[...] the plural of `mongoose' ought to be `polygoose'." [Jargon file 2.9.10]

INTERNET:  jim@n5ial.chi.il.us  |  grahj@gagme.chi.il.us  |  j.graham@ieee.org
ICBM:  41.70N 87.63W            UUCP:  gagme!n5ial!jim@clout.chi.il.us
AMATEUR RADIO:  n5ial@n9hsi (Chicago.IL.US.Earth)
------------------------------------------------------------------------------
Newsgroups: alt.security,comp.security.misc
From: wangw@iti.gov.sg (Wang Wei Jun (CC))
Subject: Software Copyright protection devices
Organization: Information Technology Institute, National Computer Board, S'pore
Date: Wed, 2 Sep 1992 11:14:08 GMT

Greetings!
I am looking for information about designing software copyright protection 
devices. As I understand, there are two type of protection:
	1. A hardware device that connects to host's parallal port and
	   do a challenge-response from time to time

	2. For networked workstation, the protection software constantly
	   broadcast a signature to the network and try to detect the
	   same signature.

Could some one give me some ideas and references on more concret designs
and implementation products for the above. 

Thank you!

Weijun Wang
National Computer Board
Singapore
wangw@iti.gov.sg	weijun@itivax.bitnet

Newsgroups: alt.security,comp.security.misc
From: kja2192@tamsun.tamu.edu (Kevin Alexander)
Subject: Re: WANTED - Information on Security in EFT (Electronic Data Transfer) Systems
Organization: Texas A&M University, College Station
Date: Thu, 27 Aug 1992 23:28:47 GMT

In article <1992Aug18.093922.4272@usage.csd.unsw.OZ.AU> s1000101@spectrum.cs.unsw.oz.au (Saqib Razzaq) writes:
>        I am looking for any information on Electronic Data Transfer 
>System and the security features used in such systems. Please e-mail.

Please include myself also.

						thanks in advance,
						Kevin Alexander
From: James_Zuchelli@qm.claris.com (James Zuchelli)
Newsgroups: alt.security
Subject: Re: Computer Security - What to study
Date: 4 Sep 92 00:48:06 GMT
Distribution: ba
Organization: Claris Corp

One idea would be to do an Information Interview with a computer security
specialist.  I did this a few years ago with one of the top people and got 
a very informative interview. 

An Information Interview is never an attempt to get a job, only to learn.  You
might try some of the major corporations with computer security teams, or ask
here who you could talk to.

Some people suggested that you practise breaking into systems.  This is, in
my opinion, only valid under controlled situations where the people in charge
of the system have given you written permission and have full knowledge of 
what you are doing.

There is a caveat here, "people in charge" does not mean a friend who is
the night system op at the local hospital, or any other place.  It means the
top people on the system who have absolute authority over what is or is not
done on their system.  Only if you do this under their authorization and
approval can you even think of breaking into a system as a learning experience.

-------------------------
The above is my personal opinion and not that of Claris Corp. or my employers.
Newsgroups: alt.security
From: nestor@hub.toronto.edu (John Nestor)
Subject: IEEE 802.10b
Keywords: standard
Date: 25 Aug 92 17:39:45 GMT

Does anybody out there have any information on IEEE standard 802.10b?
I.e. what it is, where further information is available on it, etc.
Also, if there is an FTP site with this info, it would be helpful.

Thanks in advance!
-- 
John P. Nestor  <nestor@hub.toronto.edu>  |  "Gotta take a chance,
Dept. of Electrical Engineering           |   Gotta make a move,
University of Toronto                     |   Got everything to gain
Toronto, Canada  M5S 1A4                  |   And nothing to lose." - Kylie
From: epstein@trwacs.fp.trw.com (Jeremy Epstein)
Newsgroups: alt.security
Subject: Re: Privilegies and Threads
Keywords: Security, Privilegie, Threads
Date: 3 Sep 92 15:42:11 GMT
Organization: TRW Systems Division, Fairfax VA

roxy@beaune.NoSubdomain.NoDomain (Roland Buresund) writes:

>I'm wondering if anybody has any experience regarding
>threads/light-weight-processes and privilegies in a secure system ?

Yes...we have many multi-threaded servers in our prototype B3 trusted 
window system.  Having done that, I wouldn't recommend it: I think
it'll be *very* hard to show proper functioning of a multi-threaded
program.  As hard as it is to show that a single-threaded program
doesn't have security holes, enforces the security policy, etc.,
it's a whole lot harder when there are multiple threads all operating
at the same time.  You have to show that data structures are properly
protected from screwups.

>The reason I'm asking is that I'm a bit confused how to handle
>privilegie bracketing in a multi-threaded program.

>Will all threads share the same effective privilegie and I as an
>application programmer has to protect the possible conflicts that may 
>arise or will each thread has it's own effective privilegie ?

>I've been trying to find anything in Posix 1003.6/D12 about threads,
>but they don't seem to acknowledge the existance of P1003.4 and
>P1003.4a at all.

You're right: POSIX.6 says nothing about POSIX.4 (and vica versa),
because they're both evolving in parallel.  POSIX.6 is chartered as
a set of changes to POSIX.1 and POSIX.2.  One of the future work
items for POSIX.6 should be to examine POSIX.4, and how to address
these sorts of issues.  Frankly, we've never even discussed the
issue in the POSIX.6 group, although I'll raise the issue now :-)

>So in short:
>	- Does any multi-threaded secure O/S that uses privilegies
>	  exists, and if Yes, how has it been solved ?

An example is TMach 2.5 (a prototype B3 operating system from Trusted
Information Systems), which doesn't have a notion of privilege
bracketing, but does allow changing your user ID (which is roughly
equivalent).  They change user ID on a task (process) basis, not on
a thread basis.

>	- System V Release 4 ES/MP is supposed to have threads and
>	  security, does they have privilegies on a per-thread or per-
>	  process basis ?

Don't know...someone else?
-- 
Jeremy Epstein			Internet: epstein@trwacs.fp.trw.com
Trusted X Research Group	Voice: +1 703/803-4947
TRW Systems Division
Fairfax Virginia
From: barmar@think.com (Barry Margolin)
Newsgroups: alt.security
Subject: Re: why?
Date: 31 Aug 1992 05:09:29 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
NNTP-Posting-Host: gandalf.think.com

In article <1992Aug31.020828.21257@msuinfo.cl.msu.edu> cappucci@crs.cl.msu.edu (horny Italian bastard) writes:
>Why do places like bellcore.com allow anonymous ftp?

Presumably for the same reasons everyone else does -- to distribute free
stuff and to allow colleagues to upload files.

Why not?
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar