HDTenEightyP/NetNews huggingface dataset:
From: hallam@zeus02.desy.de (Phill Hallam-Baker)
Subject: Re: PGP as a World Standard
Reply-To: Hallam@zeus02.desy.de
Organization: Deutsches Elektronen Synchrotron, Experiment ZEUS bei HERA
Date: Thu, 17 Dec 1992 22:30:17 GMT

In article <1992Dec16.171637.11957@netcom.com>, strnlght@netcom.com (David
Sternlight) writes:

|>mathew reveals his intelligence, forensic skill, and brilliiant
|>logic with the stunning argument "Go to hell." Of course. That
|>clarifies everything.
|>
|>Then he says "We've standardized on PGP." as if he were justifying
|>something.
|>
|>Let's take a closer look at that. PGP 2.x was written in Europe
|>based on PGP1.0. PGP 1.0 was illegally exported from the U.S.
|>In the U.S. PGP was based on RSA's patents, and used them
|>without permission, i.e. it was stolen goods.
|>
|>Thus PGP 2.0 is based on stolen goods.

In US law perhaps, but given the scope of the RSA patent it clearly has no
validity in Europe or any country which bothers to scrutinize patent
applications, even if mathematical patents were allowed in the first place.

If the US gave a patent away on the wheel (a British invention by the way) you
can imaging that people in Euriope would not be too interested in the
difficulties of wheel-less transport.

There is the question of copyright which may indeed have been infringed. However
patents are very different entities.

There are many standards the US does not take part in, if they tolerate a
patents system designed to generate easy money for large corporations rather
than to encourage inovation, that is their look out.

The big question at the moment though is, how does one connect a mail filter to
the VMS MAIL-11 system? presumably I could simply create a dummy mail system aka
IN% and drop the new "signature generator" in there. Has anybody tried this?
Probably a comp.os.vms query... might possibly be overdrawing my quota in that
area though of late...

--

Phill Hallam-Baker
Xref: sparky alt.security:5119 sci.crypt:5802 talk.politics.guns:25378 talk.politics.misc:64694 alt.security.pgp:247
From: strnlght@netcom.com (David Sternlight)
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: 17 Dec 92 21:53:23 GMT
Organization: Netcom - Online Communication Services (408 241-9760 guest)


Perry Metzger makes the same ethical error many others have, of
looking at PGP2.0 in Europe in isolation. Both ethics and
the law don't do that--they look at the causal chain. There's
a well established principle about the fruits of a crime. The
law often confiscates the money gained, for example, from
insider trading.

PGP 1.0 was a violation of the RSA patents. Consider it having a label
called "fruits of a violation". That label isn't removed simply
because it passes over some wires to Europe.  Note carefully: a copy
of PGP 1.0 brought to Europe from the U.S. is NOT ethically equivalent
to a PGP 1.0 programmed from scratch in Europe.

I would agree completely that a programmed-from-scratch implementation
of RSA in a country where they don't have patent protection is
perfectly legal and ethical. I would not agree that a copy tranported
from the U.S., where it is not legitimate, somehow is washed clean in
the blood of the lamb (have I got the metaphor right?) as it arrives
at the other end of the phone line.

David
x-gateway: rodan.UU.NET from garbage; Wed, 16 Dec 1992 22:40:30 EST
Date: Wed, 16 Dec 1992 22:40:27 -0500
From: kyle@uunet.uu.net (Kyle Jones)
Subject: Re: PGP v. 2.1 Released
Newsgroups: alt.security
References: <1992Dec17.033019.12130@rose.com>
robert heuman writes:
 > 2. PGP is NOT illegal where I am located (if it is illegal anywhere), 
 > since US law does NOT apply to me (I am OUTSIDE the US)

Unless you do something that aggravates our authorities enough,
in which case they will come across the border and get you.
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: strnlght@netcom.com (David Sternlight)
Subject: Re: PGP as a World Standard
Organization: Netcom - Online Communication Services (408 241-9760 guest)
Date: Fri, 18 Dec 1992 21:23:22 GMT


Why do people jump in in the middle without reading the traffic?
As those who have followed even my most recent messages must
know, I'm arguing ethics with respect to PGP outside the U.S.
and Canada etc., and ethics and legality with respect to PGP inside.

Thus legalistic responses about use outside the U.S. etc. are
irrelevant to my position in the matter.

There are plenty of things that are legal but unethical.

Many who defend their use of PGP for reasons of self-interest (we call
that "special pleading" here in the U.S.), would also, in other
contexts support the need to encourage invention, the patent system,
and related matters on the basis of principle, not law. Yet when
it comes to PGP, principle goes out the window and we have nothing
but legalistic arguments.

(I specifically exempt from the above those, with whom I disagree,
whose consistent position is against any invention protection
and who think all software and cryptography ought to be both
universally available and free. I understand that position,
but think it both ethically wrong and practically unrealistic.)

David

Xref: sparky alt.security:5111 alt.security.pgp:238 sci.crypt:5789
From: amanda@intercon.com (Amanda Walker)
Newsgroups: alt.security,alt.security.pgp,sci.crypt
Subject: Re: PGP as a World Standard
Date: 17 Dec 92 18:04:20 GMT
Reply-To: amanda@intercon.com (Amanda Walker)
Organization: InterCon Systems Corporation
NNTP-Posting-Host: chaos.intercon.com
X-Newsreader: InterCon TCP/Connect II 1.1fc2

In article <N3LXVB15w165w@mantis.co.uk>, mathew <mathew@mantis.co.uk> writes:
> If *you* have a problem with the worldwide standard (PGP) because of 
> *your* stupid laws, it is up to *you* to do the work to get around that 
> problem. 

PGP is a worldwide standard?  Funny, I keep reasonable track of ISO/JTC1 
activities, and I haven't noticed so much as a PGP working group, much less a 
standardization effort...

Widespread use does not a standard make.

PGP is simply the winner of the current popularity contest.
Xref: sparky alt.security:5136 sci.crypt:5852 talk.politics.guns:25424 talk.politics.misc:64768 alt.security.pgp:278
From: bd@fluent@dartmouth.EDU (Brice Dowaliby)
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: 18 Dec 92 13:42:24 GMT
Reply-To: bd%fluent@dartmouth.EDU
Organization: Fluent Inc., Lebanon NH


All this PGP stuff on talk.politics.guns is getting to be a pain.
Could you folks please edit your "newsgroups" lines and
take talk.politics.guns out of it?

Thanks,
BD
-- 
   Brice Dowaliby, Fluent Inc., 10 Cavendish Court, Lebanon, NH  03766
                         bd%fluent@dartmouth.edu        
             I don't speak for them, they don't speak for me
                              DoD # 0698
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: rja14@cl.cam.ac.uk (Ross Anderson)
Subject: Re: PGP as a World Standard
Organization: U of Cambridge Computer Lab, UK
Date: Thu, 17 Dec 1992 12:43:26 GMT


strnlght@netcom.com (David Sternlight) writes:

[...]
>Let's take a closer look at that. PGP 2.x was written in Europe
>based on PGP1.0. PGP 1.0 was illegally exported from the U.S.
>In the U.S. PGP was based on RSA's patents, and used them
>without permission, i.e. it was stolen goods.
[...]

Get your facts right:

(1) New Zealand was not part of Europe last time I looked at a map

(2) If you don't live in the USA, US law doesn't apply and so neither
    the ITAR regulations or the RSA patents have any force.

Or are you one of those people who claim that the USA should enforce 
its laws wherever it likes, regardless of other jurisdictions?

Ross
Xref: sparky alt.security:5130 sci.crypt:5831 talk.politics.misc:64747
From: amanda@intercon.com (Amanda Walker)
Newsgroups: alt.security,sci.crypt,talk.politics.misc
Subject: Re: PGP v. 2.1 Released
Date: Fri, 18 Dec 1992 01:37:39 -0500
Organization: InterCon Systems Corporation
Distribution: world
Reply-To: amanda@intercon.com (Amanda Walker)
NNTP-Posting-Host: chaos.intercon.com
X-Newsreader: InterCon TCP/Connect II 1.1fc2

pmetzger@snark.shearson.com (Perry E. Metzger) writes:
> If the package is any good, it will take approximately 24 hours for it 
> to appear for anonymous FTP all over the world. 

It's quite good.  The above observation is true, and of course, the reason 
it's not available yet.  Ironically enough, PEM with certificates would make 
it much easier to release a product like RIPEM.  There's just a bit of a 
catch-22 at the moment.

I don't think that anyone is under the illusion that RIPEM (or any other PD 
implementations of PEM) are not going to be smuggled out of the U.S. almost 
immediately.  The issue is simply one of putting enough safeguards at the 
distribution sites to ensure that said sites are not the ones that will get 
hit by any legal repercussions.

After all, if I give you the software and you smuggle it out of the country, 
that's your problem.  I just have to be able to show that it wasn't me that 
did the exporting, and that I didn't know you were going to.  This is not an 
intractable problem by any means; it's just slightly more complex than 
plopping a tar file into an FTP directory.  Working out those sorts of 
details is what is taking the time.

Additional safeguards will also help distribution sites cooperate with 
investigators if a U.S. attorney *does* decide to pursue the matter.

Examples of these safeguards might include:

 - detailed logs of all transfers
 - excluding non-US Internet domains and IP networks
 - requiring explicit requests for access, which would be kept on file

and so on.



Amanda Walker
InterCon Systems Corporation


Newsgroups: alt.security
From: bear@tigger.cs.Colorado.EDU (Bear Giles)
Subject: Re: Just a thought...
Organization: National Oceanic & Atmospheric Adminstration / Boulder Labs
Date: Wed, 16 Dec 1992 03:23:01 GMT

In article <u0TZuB1w165w@Blue.Kludge.COM> alizard@Blue.Kludge.COM (A.Lizard) writes:
>> > o ENCRYPTED, COMPRESSED hard drive.
>> 
>> I've thought a lot about a compressed/encrypted drive, that would require 
>> a password entry upon bootup to use as the key. (storeable in memory or a 
>> environmental variable for MS-DOS users) 
>> 
>What happens if your hard drive eats it? Just how are you going to
>recover the data?

A long time ago I thought about writing a semi-transparent encrypted
device driver for DOS.  (As I recall, I was going to sit on top of the
BIOS services, so you could specify encrytion for any (or all) drives.
The boot information would be stored unencrypted).

This had a lot going for it, not least of which was the fact that all
reads and writes were the same size, but I gave it up due to the user-
interface problems.

You _know_ that some user will call you up and demand recovery of an
encrypted disk despite all of your warnings that you have no way of
retrieving that information....

Or that someone will complain that a disgrunted employee encrypted the
disk and you need the information back....

Or someone will write to the disk with the wrong encryption key, destroying
valid data...

Or.... 

(On a more serious note, whenever the user changes the encryption key
you have to decrypt/reencrypt the entire disk, except for the programs
which weren't encrypted (IBMSYS, command.com, etc).  It just wasn't worth
it).

-- 
Bear Giles
bear@fsl.noaa.gov/cs.colorado.edu
Newsgroups: alt.security,sci.crypt,alt.security.pgp
From: Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu>
Subject: Re: PGP v. 2.1 Released
X-Quoted: 36%
Organization: Computer Science Dept, Indiana University
Date: Sat, 19 Dec 1992 00:06:03 -0500

Thus said strnlght@netcom.com (David Sternlight):
>Marc VanHeyningen posts an otherwise sensible message in which he
>characterizes the protections ripem sites will have as "CYA games."
>This constitutes both mind reading and the imputation of motives,
>neither of which can, I think, be supported.

David Sternlight posts a message in which he asserts that I am guilty of
"mind reading".  It is in fact David Sternlight who is guilty of mind
reading, since he is assuming that I merely am making guesses and have
not been in touch with the people involved with setting up the RIPEM
distribution server.
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted


The dead fish goes with the flow.
Xref: sparky alt.security:5182 sci.crypt:5947
From: amanda@intercon.com (Amanda Walker)
Newsgroups: alt.security,sci.crypt
Subject: Re: PGP v. 2.1 Released
Date: Sat, 19 Dec 1992 02:09:20 -0500
Organization: InterCon Systems Corporation
Distribution: world
Reply-To: amanda@intercon.com (Amanda Walker)
NNTP-Posting-Host: chaos.intercon.com
X-Newsreader: InterCon TCP/Connect II 1.1fc3

strnlght@netcom.com (David Sternlight) writes:
> Marc VanHeyningen posts an otherwise sensible message in which he 
> characterizes the protections ripem sites will have as "CYA games." This 
> constitutes both mind reading and the imputation of motives, 
> neither of which can, I think, be supported. 

Well, it's not an unreasonable characterization, even if it's a little blunt.  
These precautions are indeed meant to make sure that the sites (and their 
corporate or educational sponsors) do not get stuck with federal legal 
complications or criminal charges.  If that means they're playing "CYA 
games," so be it.  As long as the posterior is in fact covered :)...



Amanda Walker
InterCon Systems Corporation


Newsgroups: alt.security,alt.security.pgp,sci.crypt
From: karn@servo.qualcomm.com (Phil Karn)
Subject: Re: PGP as a World Standard
Organization: Qualcomm, Inc
Date: Thu, 17 Dec 1992 20:37:00 GMT

In article <9212171304.AA20561@chaos.intercon.com> amanda@intercon.com (Amanda Walker) writes:
>PGP is a worldwide standard?  Funny, I keep reasonable track of ISO/JTC1 
>activities, and I haven't noticed so much as a PGP working group, much less a 
>standardization effort...
>
>Widespread use does not a standard make.

Excuse me, but you just pushed one of my hot buttons. There are also
no ISO international standardization efforts for TCP/IP, but that
hasn't kept the Internet from becoming by far the largest packet
switched network in the world. And the supposedly "international
standard" OSI protocols are almost totally ignored, just as they
should be. (There *is* some justice in the world.)

A group of telco bureaucrats who couldn't write a line of C code to
save their lives may spend a dozen years and enjoy many fine lunches
and dinners in the great cities of the world while razing entire
forests to write an incomprehensible document they call an "official
international standard". But that doesn't mean anyone will actually
use it, or that it's even technically sound.

The computer industry has discovered a far more effective and
realistic way to set standards.  First you produce an experimental
product and get it out into the market. Then you revise it as needed
to meet actual customer needs. Once it has stablized and is in
widespread use, only THEN do you codify it as an "official standard".

What a novel concept.

Phil
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: gardner@convex.com (Steve Gardner)
Subject: Re: PGP as a World Standard
Date: Fri, 18 Dec 1992 17:27:14 GMT
Organization: Engineering, CONVEX Computer Corp., Richardson, Tx., USA
X-Disclaimer: This message was written by a user at CONVEX Computer
              Corp. The opinions expressed are those of the user and
              not necessarily those of CONVEX.

In article <1992Dec17.124326.17185@infodev.cam.ac.uk> rja14@cl.cam.ac.uk (Ross Anderson) writes:
>(2) If you don't live in the USA, US law doesn't apply and so neither
>the ITAR regulations or the RSA patents have any force.
	What you say SHOULD be the case.  However, unfortunately, our
	benighted government doesn't agree with you.  I'm sad to say this
	but my government thinks that its laws can be applied anywhere.
	The Alvarez Machain case proves this.  Dr. Alvarez Machain 
	broke no laws in the US but was kidnapped by thugs in the pay
	of the US DEA (international terrorists by any definition) and 
	brought to the US for trial.  Fortunately, the US courts don't
	always toe the line and they released him.  The outrage of his
	kidnapping remains however and it is a stain on all of us
	that our government thinks that international kidnapping and
	terror is a perfectly acceptable way to accomplish its goals.
	
	
>Or are you one of those people who claim that the USA should enforce 
>its laws wherever it likes, regardless of other jurisdictions?
	Sadly, many Americans believe this.  I have no doubt that I will
	be flamed for holding the "disloyal" view that my government has
	no right to be kidnapping people in foreign countries to prosecute
	them for alleged crimes committed in foreign countries. 

	

						smg


	

Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp
From: smb@research.att.com (Steven Bellovin)
Subject: Re: PGP as a World Standard
Date: Mon, 21 Dec 1992 06:48:20 GMT
Organization: AT&T Bell Laboratories

In article <pete.724907978@extro.ucc.su.OZ.AU>, pete@extro.ucc.su.OZ.AU (Peter Alexander Merel) writes:
> Besides which, creation and distribution of PGP source is not illegal in
> any sense, any more than dissemination of any description of the RSA 
> algorithm is illegal. It is only the use of the program within the USA that 
> may be forbidden by US law.

There's a fine line here, but basically, you're wrong.  Patent law
bars the *making*, *selling*, or *use* of the protected invention.
Writing source code, as opposed to writing a book or paper that describes
RSA, would be considered an infringement.  I know that that's a fine line.
That's part of the LPF's argument against algorithmic patents.  Besides,
courts are in the business of drawing fine lines.  And yes, they would
consider context and intent.  For example, if your intent was demonstrably
education and teaching, you'd be fine -- that's part of the intent of
patent law, that others learn of the invention.  If your intent is to
enable others to actually use the invention, you have committed an
infringment.

And no, I'm not going to attempt to rule on other hypothetical or
non-hypothetical situations -- there are lots of reasons I'm not a
lawyer or a judge.  Let's leave it at this -- my intention is purely
educational....  (Besides, we never patented netnews.)

> I am really curious about David Sternlight's motivation in this bunfight. 
> Does he have a financial stake in PKP, or has he simply painted himself into
> a corner and is trying to salvage his honour?

Let's leave the personal attacks out of this.  It cheapens and weakens your
own arguments.
Xref: sparky alt.security:5086 sci.crypt:5720 talk.politics.guns:25276 talk.politics.misc:64440
From: boucher@csl.sri.com (Peter K. Boucher)
Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc
Subject: Re: PGP v. 2.1 Released
Date: 16 Dec 1992 01:11:43 GMT
Organization: Computer Science Lab, SRI International
Distribution: world
NNTP-Posting-Host: affirmed.csl.sri.com

In article <19921214.055706.262@almaden.ibm.com>, russotto@vnet.ibm.com (Matthew T. Russotto) writes:
|> In <palmer.724336017@news.larc.nasa.gov> Michael T. Palmer writes:

[stuff gone...]

|> >to be told we should switch to a program we can't even get our hands on
|> >yet, and away from a program that works now (even though the legality of
|> >use is still being debated).
|> 
|> Who's to say RIPEM's legality won't be debated too?  As I recall, PKP
|> claims a patent broad enough to stop ANY public key scheme-- they claim
|> to have the use of arithmetic in a public key scheme patented....

Three corrections:
  1) RIPEM can be found with archie and obtained via anonymous ftp.
  2) The legality of PGP is not being seriously debated.  It's illegal.
  3) RIPEM uses RSAREF, which comes with an imbedded license from PKP.

-- 
Peter K. Boucher
--
RIPEM public key available upon request.
Newsgroups: alt.security
From: bear@tigger.cs.Colorado.EDU (Bear Giles)
Subject: Re: I have a problem with a ATM transaction
Organization: National Oceanic & Atmospheric Adminstration / Boulder Labs
Date: Wed, 16 Dec 1992 20:56:29 GMT

In article <BzD3vz.AqF@bcstec.ca.boeing.com> anthis@bcstec.ca.boeing.com (Mike Anthis) writes:
>In article <1992Dec16.031322.12493@colorado.edu> bear@tigger.cs.Colorado.EDU (Bear Giles) writes:
>>Now, what I liked was the people who put an "out-of-order" sign on the
>>night-deposit box of a Denver bank, and then put this flimsy box in front
>>of it.  A number of people were actually dumb enough to put their deposits
>>in this freestanding box.
>>
>>Somebody called the police and they arrested these rather creative people
>>when they returned to collect the loot.  WHAT WAS THE CRIME?  They put a
>>bogus "out-of-order" sign on the night-deposit box, but should they be
>>held accountable that other people were dumb enough to leave their deposits
>>in the other box?!
>
>How about fraud, plus conspiracy to commit same?
>
>The crooks are not accountable for other people's stupidity,
>but they _are_ accountable for their own dishonesty.
>
>Cute trick, but a crook is a crook and theft is theft.

If they put up a sign that said "put your money in the box provided,"
then you could make a strong argument for fraud.

However, would it be fraud to put up a bogus sign saying "out of order"
and simply leave? 

What if the sign actually said something else, but some people misread it?

Would it be fraud to put up a bogus sign and _accidently_ leave a box
nearby?

What if someone put up a bogus sign as a prank, and another party
left the box?

How do you know the "crooks" intended to steal the money?  Maybe they
wanted to get names of companies to contact regarding Acme Security
Agency... (which would not be known at the time the newspaper article
was written).

... or they were conducting a psychology experiment, but got lazy and
decided to simply count the number of deposits made in the morning rather
than stay up all night to count the number of people who refused to use
the box while safeguarding the deposits that were made).

-- 
Bear Giles
bear@fsl.noaa.gov/cs.colorado.edu
Xref: sparky alt.security:5153 sci.crypt:5879 alt.security.pgp:287
From: mathew <mathew@mantis.co.uk>
Newsgroups: alt.security,sci.crypt,alt.security.pgp
Subject: Re: PGP as a World Standard
Date: Fri, 18 Dec 92 15:40:34 GMT
Distribution: world
Organization: Mantis Consultants, Cambridge. UK.

strnlght@netcom.com (David Sternlight) writes:
> PGP 1.0 was a violation of the RSA patents. Consider it having a label
> called "fruits of a violation". That label isn't removed simply
> because it passes over some wires to Europe.

To use your metaphor, the label is in ink which only shows up under UV light. 
And they only use UV lights in the USA.

So as long as PGP stays outside the US, there is no illegality.  But if it is
taken within the bounds of US law, the illegality appears again.

It's like copyright.  If a copy of MS-DOS reaches Singapore, it can be copied
freely, as Singapore has no copyright law.  However, if one of those
Singaporean copies is transported back to America, it immediately becomes an
illegal copy again.


mathew
-- 
Lung cancer and arteriosclerosis.
For people who like to smoke.

Newsgroups: alt.security,sci.crypt,talk.politics.guns,talk.politics.misc,alt.security.pgp