HDTenEightyP/NetNews huggingface dataset:
From: bhayden@teal.csn.org (Bruce Hayden)
Subject: Re: Stupid Licenses (YUCK!)
Organization: Colorado SuperNet, Inc.
Date: Wed, 16 Dec 1992 08:38:23 GMT

rat@ruth.UUCP (David Douthitt) writes:

>charlie@umnstat.stat.umn.edu (Charles Geyer) writes:

>Thank goodness someone else noticed those warrantees.  What a load of
>MALARKEY ...  Thank goodness for the part that says "SOME OF THESE
>LIMITATIONS MAY NOT BE VALID IN SOME STATES" -- ie, some states have
>passed laws that actually (GASP!) force a company to be (OH MY!) RESPONSIBLE
>for its products... in Wisconsin, Ibetcha it's the "Lemon Law" that I've
>heard about...

>Now if it was only possible to get rid of the part that says,
>YOU DON'T OWN THIS PRODUCT, WE DO.  YOU ONLY PURCHASED THE RIGHT TO USE IT.
>ANYTHING WE SAY GOES...

Not to give legal advice, but shrink-wrap licenses were recently discussed
either here or on another forum. My feeling is that they are not enforceable
as a license. There is no consideration to support the imposition of
a license. (under the theory that old consideration is bad consideration).

This is not to say that you can duplicate the software. That is still
(and will continue to be) copyright infringement, possibly actionable
today as a felony (see the recent S893 discussion in this forum).
What does change is the waiver of warranties. Under Article II of the
UCC, many waivers of warranties must be priminent, etc. This is hardly
the case when they are embedded in a sealed box. 

For a very good discussion of shrink wrap licenses see _Step-Saver
Data Sys., Inc. v. Wyse Technology_, 939 F.2d 91 (3rd Cir., 1991).

Bruce E. Hayden
(303) 758-8400
bhayden@csn.org

Newsgroups: comp.security.misc,comp.org.eff.talk,alt.society.civil-liberty
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: CERT and the Dept. of Justice on keystr
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Tue, 15 Dec 1992 22:24:17 GMT

In article <jpe.724345261@ee.egr.duke.edu>, jpe@ee (John P. Eisenmenger) writes:
>I think you're wrong here.  Just because your friend owns the physical medium
>does not give him the right to monitor your phone calls.  Your phone call is
>your intellectual property and you deserve a right to privacy.

I disagree with holding "intellectual property" as an important issue
here.  The right to privacy is more important.  Of course copyright
steps into the picture if the caller is reading some of his work, or
singing, etc.

Just a note against equating "intellectual property" with property.  I
think "intellectual property" is a misnomer, as it is not property but
merely some limited monopolies on the use of the result of one's
intellectual or artistic creation.  I don't think John was doing this,
but I think it's a dangerous road to try to solve everything with
"property rights".

>BTW: I have yet to figure out why I would monitor an individual while doing
>system maintenance.  Anyone have any examples?

In an university here, rules of computer use are being worked on and
the admins have voiced opinions against limitations in monitoring
users or examining the files of users.  The obvious case is monitoring
an intruder or a suspected intruder.  They have stated examples of
looking at which users use which software packages (elm) so they could
be notified of a version change (or something like that).  Personally,
also having worked administrating systems, I think monitoring a known
intruder (with permission from the real account holder) would be a
reasonable example of valid monitoring, but other examples don't come
to mind.

>>	- drive a car
>>	- come and go as we please
>>	- drink alcohol
>
>Privacy *is* a right, not a privilege.  I agree that many Americans mistake
>privileges as rights and you cite several good examples, but this is not one
>of them.

I don't think the three examples above are good examples, either.

>Because it is sometimes necessary to use keystroke-logging to protect the
>accunts of authorized users, we must sometimes resort to using it.

One way to solve this is for the computer-using society (users,
admins, owners) to make rules and require a signed form for using the
systems.  The rules would spell out in which situations monitoring may
be done, how the users should be informed of it and so on.

//Jyrki
Xref: sparky comp.security.misc:2298 alt.comp.acad-freedom.talk:3778
Newsgroups: comp.security.misc,alt.comp.acad-freedom.talk
From: mfriedma@uucp (Michael Friedman)
Subject: Re: Security vs usefulness (was Re: reasons
Organization: Oracle Corporation
Date: Wed, 16 Dec 1992 17:30:49 GMT
X-Disclaimer: This message was written by an unauthenticated user
              at Oracle Corporation.  The opinions expressed are those
              of the user and not necessarily those of Oracle.

In article <1gkpsmINNn05@iraul1.ira.uka.de> s_titz@ira.uka.de (Olaf Titz) writes:
>In article <1992Dec14.211255.15839@lambda.msfc.nasa.gov> palmer@Trade_Zone.msfc.nasa.gov writes:
> ^^^^^^^^
>You see that the following applies largely to government/military only?

>>>The main job of security is to stop the user from getting his work
>>>done.

>>I disagree, security is not a win/lose scenario...granted when the
>>security officer takes the easy way out when fixing a problem, the end
> ^^^^^^^^^^^^^^^^

>I really don't know about installations where the security people are
>officers...

Personally, I don't think that you know about any installation where
there is any need for security, period.

>>user usually loses functionality or useability.  But when the careful
>>security officer carefully considers the situation, there is almost
>>always a win/win solution.

>...but here (academic) every "security" effort has always been
>inevitably a lose/lose situation. More hassle to deal with on one
>side, less usability on the other.

>You run into this as soon as you start thinking, "the less I allow to
>the users the less damage can/will they do", which is wrong, imho.

>But if the changes involve (e.g.) hiding an
>entire subnetwork behind a firewall, this *does* affect the users. And
>if you argue, "these particular users have all data they ever have to
>deal with on their local machines and may not do anything else", well,
>you're talking government, I'm talking academic. But we (academic)
>have to live with people and OSs who confuse security and unusability,
>too.

Olaf, do you really believe that an academic site should put computers
that students can access on the same network as the ones containing
grades, financial data, and medical records without putting in major
firewalls between the networks?

-- 
-------------------------------------------------------------------------------
I am not an official Oracle spokesman.  I speak for myself and no one else.
Xref: sparky comp.security.misc:2340 comp.org.eff.talk:7797
From: billp@Syntex.COM (Bill Putney)
Subject: Wanted: Ethernet Encryption Device.
Keywords: Ethernet TCP/IP Encryption
Reply-To: billp@Syntex.COM
Organization: Syntex U.S.A. - Palo Alto, CA
Date: Mon, 14 Dec 1992 17:08:01 GMT

Does anyone know of a device that connects in an AUI cable between an
ethernet transceiver and an attached device that will encrypt only the 
data part of the packet.

More exactly I'd like to find a device that will work in a routed TCP/IP
network.  The device has to be TCP/IP aware.  It can`t step on routing
packets and nessary broadcasts that some other unaware device would need to
properly route the packets.  I have heard of devices that encrypt an
ethernet but they encrypt everything above the MAC layer and routers
won't work with what's left.

I'm not worried about traffic analyists finding out who's talking to who 
just so long as the user information is encrypted.  Also this will be used 
on international circuits so it would be nice if it were exportable (with 
the proper paper work if necessary).

This function probabily belongs inside a router but cisco hasn't been very 
interested.  Maybe someone out there has hacked a copy of PC route?

Thanks - Bill


Ideally it would just sit in the AUI cable between a 



---
=====================================================================
#  Bill Putney - WB6RFW            |  billp@Syntex.COM              #
#  Syntex U.S.A.                   |  {oliveb|decwrk}!synseer!billp #
#  M.S. A5-6                       |--------------------------------#
#  3401 Hillview Ave.              |  P.O.T.S.  (415) 855-1259      #
#  Palo Alto, CA  94303            |  FAX       (415) 855-5301      #
=====================================================================

Newsgroups: comp.security.misc,comp.org.eff.talk
From: palmer@Trade_Zone.msfc.nasa.gov (Paul (Cliffy) Palmer)
Subject: Re: CERT and the Dept. of Justice on keystr
Reply-To: palmer@Trade_Zone.msfc.nasa.gov
Organization: New Technology, Inc.
Date: Mon, 14 Dec 1992 20:36:15 GMT

Possibly another helpful analogy to understanding the issue of keystroke
monitoring is the steps taken by department stores against shoplifters in
the U.S. (and possibly elsewhere).

-  Detectors at the exits might be considered as a selective form of
auditing.  When they go off, they trigger the activity of the
appropriate security officers, who usually attempt to handle the
situation politely and discreetly.  They will monitor you until they
can determine whether you have actually tried to do something illegal.
Sometimes false alarms do occur and the unfortunate (and usually
embarrassed) individual is briefly monitored while they demonstrate
their innocence.

-  Some stores that have a high incidence of shoplifting occuring
within the dressing rooms post observers to monitor the dressing rooms
themselves.  Everyone is scrutinized...the observer pays special
attention to what goes into the dressing room and what comes out  (this
may be a little embarassing to the man trying on woman's underwear, but
he can always shop elsewhere :-) This could be analogous to monitoring
file activity for sensitive files.

-  Most stores employ special security officers who patrol the store
looking for suspicious activity.  Everyone is scrutinized to some
degree, but the trained officer can generally spot the individuals who
warrant closer scrutiny.  If he judges that a crime may have taken
place, he can request that the individual subject their belongings to
examination and if they refuse he can detain them until the legal
authorities can be summoned (who will examine their belongings!)  This
is roughly analogous to keystroke monitoring, when performed
ethically.

---
Paul (Cliffy) Palmer

Newsgroups: comp.security.misc,comp.org.eff.talk
From: mdw@theory.TC.Cornell.EDU (Matt Welsh)
Subject: Re: Licence to Net? No! (was Re: Fun things to do to RTM)
Organization: The Linux Inquisition, Propaganda Division
Date: Sat, 12 Dec 1992 01:22:33 GMT

In article <1992Dec11.163322.24608@news2.cis.umn.edu> charlie@umnstat.stat.umn.edu (Charles Geyer) writes:
>In article <1992Dec11.011139.3166@tc.cornell.edu> mdw@db.TC.Cornell.EDU
>(Matt Welsh) writes:
>But the Foo/9000 and Foonix come with licenses that say THIS COMPUTER AND
>ALL OF ITS SOFTWARE ARE NOT GUARANTEED TO DO ANYTHING WHATSOEVER.  ANYTHING
>THEY DO IS NOT OUR PROBLEM.  WE DISCLAIM EVERYTHING.  Those disclaimers
>don't mean anything?  We can all sue computer companies for buggy software?
>How about if you go first?  I don't have the dough.

I'd never invest my time or money in a system that didn't in some way
guarantee that it would operate as expected under certain conditions.
Of course, all software (and hardware) has bugs. All GNU software comes
with "Absolutely no warranty", but I trust it because they make a great
effort to fix bugs that people find. This only means that if it does
break on me, I can't sue them.

Most commercial hardware and software differs in this respect, however.

mdw

-- 
Matt Welsh     mdw@tc.cornell.edu     Cornell Theory Center
  "Go on, emote! I was raised on thought balloons!"
Newsgroups: comp.security.misc
From: newsham@wiliki.eng.hawaii.edu (Timothy Newsham)
Subject: Re: Security of telephone Answering machines
Organization: University of Engineering, College of Engineering
Date: Mon, 14 Dec 1992 20:56:17 GMT

In article <ByvGwA.HC@gator.rn.com> sara@gator.rn.com (Sara Gordon) writes:
>>So, if the beep on someone's machine sounds like mine, chances are I
>>could listen to their messages (as I'd bet most people don't fool with
>>changing the default value).
>
>>Talk about risky!
>
[...]
>instead'....or, much much worse.

like send out anonymous calls from your number.
(wouldnt it be nice having the feds show up at
your house accusing you of sending ransom messages?)


Newsgroups: comp.security.misc,comp.org.eff.talk
From: eric@j30264293.reslife.cornell.edu (Eric L. Beyer)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Content-Type: text/plain; charset=iso-8859-1
Nntp-Posting-User: elb1@cornell.edu
Content-Transfer-Encoding: 8bit
Organization: The Solaris Development Group
X-Newssoftware: GRn-beta 1.16g (10.12.92) by Michael B. Smith & Mike Schwartz
Mime-Version: 1.0
Date: Sun, 13 Dec 1992 21:01:22 GMT

In article <724267084.15019@zooid.guild.org> ron@zooid.guild.org (Secret Mud) writes:
> From: cmcurtin@bluemoon.use.com (Matthew Curtin)
> >
> > . . .
> >To cite just one example, let me remind you of Steve Wozniak. He created 
> >the Apple II computer, which gave birth to the "computer revolution", 
> >bringing computers to everyone. The Apple II was the first "open system," 
> >a term which we hear a lot about nowadays. I doubt that anyone would argue 
> >that Woz was crucial in helping make the computer industry what it is 
> >today. Yet, in getting experience which no doubt helped him create the 
> >Apple II, he had a friend help him to sneak into the Sylvania company to 
> > . . .
> 
> Actually the Apple II wasn't the first open system.  All of the Altair/S-100
> type machines that came out in the two years before the Apple II were open
> systems.

-- 
  It's very hard to give the credit for any revolution to a single person.
If wasn't for Apple, it would only have been a matter of time before others
did the same exact thing.  The technology as a whole had advanced to a point
where the "computer revolution" was inevitable.
--
  Eric L. Beyer
  Proud owner of his rusty A500
  Paper pusher of Solaris Devlopment Group
  (elb1@cornell.edu)

 
Newsgroups: comp.security.misc
From: dejesus@archimedes.nwc.navy.mil (Francisco X DeJesus)
Subject: Re: They forget rusers, was Re: reasons for disable fingerd
Organization: Science Applications International Corp.
Date: Fri, 11 Dec 1992 18:30:50 GMT

In article <1992Dec9.173938.8706@nntp.hut.fi> jkp@cs.HUT.FI (Jyrki Kuoppala) writes:
>In article <1992Dec2.162425.27877@telebit.com>, bjork@telebit (Steven Bjork) writes:
>>Those that disable finger often forget that nice rpc package
>>originating with a Big workstation vendor.
>
>and enabled by default on OS's by a couple of other vendors.
>
>>So even if they
>>disable finger, crackers could just run rusers.

Still, doesn't rusers (and rup, rlogin, rsh, etc) require a hostname? If
they don't work with IP addresses (they way finger/telnet can) then their
use is restricted if the machine you are trying to "probe" isn't registered.
Anyone know of a way around this (other than making a local entry in your
hosts file)?




-- 
      Francisco X DeJesus  ----- S A I C -----  dejesus@chinalake.navy.mil
 ------------------------------------------------------------------------------
  * disclaimer: Opinions expressed here are mine. Typos and errors are yours *
 "Duck Season!" "Rabbit Season!" "...rabbit season." "It's Duck Season! SHOOT!"
Newsgroups: comp.security.misc,comp.org.eff.talk
From: cmcurtin@bluemoon.use.com (Matthew Curtin)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Organization: Blue Moon BBS ((614) 868-998[024])
Date: Mon, 14 Dec 92 11:58:27 EST

ron@zooid.guild.org (Secret Mud) writes:

> Actually the Apple II wasn't the first open system.  All of the Altair/S-100
> type machines that came out in the two years before the Apple II were open
> systems.

You are correct. I was pointing toward the Apple II being the first open 
computer, as we know computers today, not as assemble-it-yourself(tm) kits.
Sorry for the misinformation :-)

 __________________________________________________________________________
| C. Matthew Curtin             ! "But I am the enlightened one, they are  |
| P.O. Box 27081                ! but mere sheep, following each other in  |
| Columbus, OH 43227-0081       ! the name of compatibility." -B. Heineman |
| 614/365-3272 (voice mail)     !              Apple II Forever!           |
|_cmcurtin@bluemoon.use.com_____!_____________GNO_your_AppleIIGS!__________|
From: mccalld@vax.sonoma.edu
Newsgroups: comp.security.misc
Subject: Re: Backups
Date: 17 Dec 92 21:30:03 GMT
Organization: Sonoma State University

>   Your thoughts are requested... I will let you know if you're
> right!!
I almost forgot.....the programs would 1st use the most convenient
and speedy compression routines to pack the data into a single file.
This would take place prior to the ftp to the backup host!
I think this keeps the information relatively secure from prying
eyes on the network.
dmc
Newsgroups: comp.security.misc,alt.internet.services
From: zcjm0f@wwnv67.hou.amoco.com (CJohn Mace)
Subject: Re: Security caveat used by network service providers
Organization: Amoco Production
Date: Mon, 14 Dec 1992 17:00:37 GMT

In article <92349.095305HANK@BARILVM.BITNET> Hank Nussbacher <HANK@BARILVM.BITNET> writes:
>I am looking for examples of a 'security caveat' used by commercial
>service providers (or regionals) that warn users that the "Internet
>is not safe, and there is no guarantee that their data will not be
>intercepted, or ..."  Can those of you who have such 'Internet security
>warnings' send them to me?

Just out of curiosity...  how can someone "intercept" data on internet
if you set up a router and the data never leaves your LAN?

You are more likely to be "hacked on" on the internet than actual
data theft.  But this can be dealt with in a number of ways...
A good router or a firewall can prevent most of this rif-raf.

>
>Thanks,
>Hank Nussbacher
>hank@vm.tau.ac.il

just some thoughts,
cjohn mace
Xref: sparky comp.security.misc:2200 comp.org.eff.talk:7614
From: honey@citi.umich.edu (Peter Honeyman)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Fun things to do to RTM (was: Internet worm)
Date: 13 Dec 1992 14:25:32 GMT
Organization: Center for Information Technology Integration, Univ of Michigan
Distribution: world
Reply-To: honey@citi.umich.edu
NNTP-Posting-Host: hone.citi.umich.edu

fred j mccall writes:
|> >I would still ask you why if someone gets busted for fraud using a telephone,
|> >should his phone privs be taken away? 
|> 
|> No, but if the fraud involves things like wiretaps and such, I'd sure
|> think twice about putting them into a position as a telephone
|> maintenanceman or operator.

robert's position was not "telephone maintenanceman or operator" or
any sort of computer professional.  it was "graduate student."  is
your argument that he should be kept out of graduate school?  that's
in fact how cornell saw it; would you take that decision out of their
hands and cast it into law?

	peter
Xref: sparky comp.security.misc:2229 comp.org.eff.talk:7649
From: mccall@mksol.dseg.ti.com (fred j mccall 575-3539)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Fun things to do to RTM (was: Internet worm)
Date: 14 Dec 92 18:42:29 GMT
Organization: Texas Instruments Inc

In <1gffv7INNb91@terminator.rs.itd.umich.edu> honey@citi.umich.edu (Peter Honeyman) writes:

>fred j mccall writes:
>|> In <1992Dec8.160732.13055@eff.org> mnemonic@eff.org (Mike Godwin) writes:
>|> 
>|> >In article <1992Dec7.160649.3039@mksol.dseg.ti.com> mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:
>|> 
>|> >>No, I think he's telling you that his lack of judgement in releasing
>|> >>it in the first place indicates that he is not to be trusted in a
>|> >>position from which he could decide to do some other 'harmless' thing.
>|> 
>|> >What position, specifically, is that? Graduate student?
>|> 
>|> I know you're not this stupid, Mike, so I have to assume that this is
>|> a deliberate 'cute but obfuscatory' tactic.  Color me unimpressed.
>|> And unconvinced.

>fred, i wanted to ask you the same question.  i saw mike had asked it and
>reckoned that you would answer him.  can you elaborate?

Seems obvious, Peter.  The 'tool' central to the crime is the
computer.  Simply don't allow him to work with them for a while.  I'm
curious as to just how many people really don't 'get' this; that
think, as Mike would have us believe, that we're talking about not
letting him go to graduate school or something equally silly.  Of
course, if he was working on a C.S. degree, he might have a few
problems attending for a while, if not programming on computers was
part of his probation.

-- 
"Insisting on perfect safety is for people who don't have the balls to live
 in the real world."   -- Mary Shafer, NASA Ames Dryden
------------------------------------------------------------------------------
Fred.McCall@dseg.ti.com - I don't speak for others and they don't speak for me.
Newsgroups: comp.security.misc
From: mrgreen@mullian.ee.mu.OZ.AU (matthew green)
Subject: Re: They forget rusers, was Re: reasons for disable fingerd
Organization: Computer Science, University of Melbourne, Australia
Date: Sat, 12 Dec 1992 17:54:16 GMT

dejesus@archimedes.nwc.navy.mil (Francisco X DeJesus) writes:

>In article <1992Dec9.173938.8706@nntp.hut.fi> jkp@cs.HUT.FI (Jyrki Kuoppala) writes:
>>In article <1992Dec2.162425.27877@telebit.com>, bjork@telebit (Steven Bjork) writes:
>>>Those that disable finger often forget that nice rpc package
>>>originating with a Big workstation vendor.
>>
>>and enabled by default on OS's by a couple of other vendors.
>>
>>>So even if they
>>>disable finger, crackers could just run rusers.

>Still, doesn't rusers (and rup, rlogin, rsh, etc) require a hostname? If
>they don't work with IP addresses (they way finger/telnet can) then their
>use is restricted if the machine you are trying to "probe" isn't registered.
>Anyone know of a way around this (other than making a local entry in your
>hosts file)?

Um..  rusers with an IP number works fine..   at least it does for me.

Matt..
From: evans@c4west.eds.com (Bill Evans)
Subject: help with crack
Keywords: crack passwords
Organization: EDS C4 West
Date: Wed, 16 Dec 1992 16:51:48 GMT

We are running Alec Muffetts crack program to improve security
on our local net.  The initial run of the program went smoothly
and ran through 1/3 of the password file before exiting.  Now,
I cannot get it to run and get the following error in the "out"
file:

ran with:  ./Crack <name of password file) (the file exists and is 
                                            world readable)

pwc: Dec 16 08:53:06 Loading Data, host=hostname
pwc: Dec 16 08:53:06 No input supplied: everything removed by feedback ?
pwc: Dec 16 08:53:06 Nothing to Crack. Exiting...
 
Please respond direct to me.  I will post a summary if there are
any requests.  Thanks

     Bill Evans, 206.562.4505, FAX-206.562.4509
          evans@c4west.eds.com || evans@ug.eds.co
Newsgroups: comp.security.misc