HDTenEightyP/NetNews huggingface dataset:
From: meyers@leonardo.rtp.dg.com (Bill Meyers)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Date: Thu, 17 Dec 92 20:03:59 GMT
Organization: Data General Corporation, RTP, NC.

In article <1992Dec10.184949.6610@glas.rtsg.mot.com> waider@glas.rtsg.mot.com (Ronan Waide) writes:
>Geoffrey Spear <gs32+@andrew.cmu.edu> writes:
[ ... ]
>>	So what you're saying is that it's ok to do illegal things if you don't
>>get caught?  In that case, anything done to RTM will have NO deterrent
[ ... ]
>to "severe punishment of RTM will deter others" - I believe it's been pretty 
>well established that punishment in the extreme [ I believe the canonical
>example is the death penalty for assorted crimes] does not actually impact the
>statistics noticeably;  [ ... ]

Not established.  Likely false.  Here's a reference-to-a-reference:
-------------------------------------------------------------------
[ ... ]
>From: jalden@eleazar.dartmouth.edu (Joshua M. Alden)
>Newsgroups: talk.politics.guns,soc.motss,talk.politics.misc
>Subject: Re: Homosexual rights
>Keywords: Barbarism, anachronism, random state murder
>Message-ID: <1991Jun6.155018.15569@dartvax.dartmouth.edu>
>Date: 6 Jun 91 15:50:18 GMT
[ ... ]
>In <49995@ut-emx.uucp> rkcorell@ccwf.cc.utexas.edu (Michael Lax) writes:
[ ... ]
>>  The death penalty does NOT deter crime.
>
>    On the contrary.  The deterrent effect is significant and
>measurable, though only about 3.5 weeks long.  This is not really the
>appropriate forum, so I won't go into detail.  See _Sociology_, by
>Rodney Stark.
[ ... ]
-------------------------------------------------------------------
Newsgroups: comp.security.misc
Subject: Re: Security of telephone Answering machines
From: sai@kauri.vuw.ac.nz (Simon McAuliffe)
Date: Sun, 13 Dec 1992 07:21:10 GMT
Organization: VUW Anon-FTP Virus Archives (ftphost.vuw.ac.nz)

In article <1g3ajuINNbk0@iskut.ucs.ubc.ca> unruh@physics.ubc.ca (William Unruh) writes:
> No, no, I meant pick a password from 5 to 20 possibilities, not a 20
> digit long password. Heavens even a 4 digit long password would be
> wonderful compared with the current situation ( after all we rely on
> only 4 digit long one to protect all of the money we have in the banks
> with our PINS.)

While most of the answering machines here are also very insecure with
only 1 or 2 digit codes, there are a couple of brands with 4 digit
combinations (of which I have one).  Unfortunately they are made
locally so you probably can't find them in the US.

Four digits would probably discourage most people from trying to guess
the comibinations.  It's a little different from ATM pin numbers
though since you can try as many times as you like with an answering
machine.

Xref: sparky comp.security.misc:2347 comp.org.eff.talk:7848
From: bhayden@teal.csn.org (Bruce Hayden)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Stupid Licenses (YUCK!)
Date: 20 Dec 92 15:38:31 GMT
Organization: Colorado SuperNet, Inc.

charlie@umnstat.stat.umn.edu (Charles Geyer) writes:

>I agree that legal liability for buggy software is a knotty problem, but
>that's not what's important.  Law suits never improve quality.

Well, I tnk that that is a matter of opinion. I think that many
plaintiffs' attorneys would strongly disagree with your statement.
(but of course, that is enlightened self interest at its max).

>It is fair to say that no computer company puts quality first, ahead of
>featurality.  Until they do, quality will remain abysmal.

>The issue is not whether they exercised "due care" or whether they found
>the last bug.  The issue is whether bug fixes for all serious bugs are
>provided as a matter of course, and by "serious" here I mean anything that
>affects the functionality of the software, and whether product is simply
>not shipped with known serious bugs.

Not the last bug, because as we all know, that is currently not feasable.
What is feasible is getting the major bugs out, and getting the bug count
down to a specified level before release. This is called (or part of)
quality control. Unfortunately, often marketing, and not quality control
has the last say on when software goes out the door. I have seen this
problem at company after company.

I think that your suggestion about not worrying about QC on the front
end, just on the back end is indicative of the American mindset. That
way of thinking about Quality is why I drive a Japanese vehicle
.
>Every time I say something like this on the net.  Industry people tell me
>that economic realities (according to conventional wisdom) dictate that
>deadlines come before quality.  He who ships first gets the customers.

And that is why they are wide open to lawsuits. Its a business decision.
As long as you stand to make more money selling defective software, 
than software that works properly, companies will continue to ship
before they get the bugs out. When enough software companies have lost
enough money through law suits, we will gesoftware that works properly
the first time. 

Just take a software engineering course. We know how to test for bugs,
how to do software QC. We just don't do it. Often the company that is
shipping the premature software has a QC section. Almost as often
that QC group is at some level preempted by marketing. But how does
it look when I ask for that QC data when I sue you for defective
software. This is what is called a "smoking gun" by attorneys.

Bruce E. Hayden
(303) 758-8400
bhayden@csn.org
From: jpe@ee.egr.duke.edu (John P. Eisenmenger)
Newsgroups: comp.security.misc
Subject: Re: New "official" motd
Keywords: motd
Date: 14 Dec 92 14:05:10 GMT

bdixon@wap.oau.org (Bill Dixon) writes:

>In article <jpe.723910551@ee.egr.duke.edu> jpe@ee.egr.duke.edu (John P. Eisenmenger) writes:
>>While we're on this subject of the MOTD notice.  Will that actually do
>>the job? ...

>Why not change the login herald so that the notice is displayed at each
>login?  On AIX, the herald is in /etc/security/login.cfg, and can be
>changed to anything you want [...]

This is true and I've already looked at the possibility, but I handle 6
architecture/OS combinations and each handles login banners its own way.
Like an earlier posting stipulated, some login banners are limited in
size, so it just won't work to do that on all my systems.  I guess I
could just do it on my central machine (an RS6k), since that would be
the most likely entry point for an intruder.

One thing to note is that if someone were to breakin via a users remote
account (a la ~/.rhosts) a login banner would not be displayed.  So that
kills the login banner idea.

-John
-- 
*************************************************************************
* John P. Eisenmenger			 Phone: (919) 660-5248		*
* Duke University			 FAX:   (919) 660-5293		*
* Department of Electrical Engineering	 Email: jpe@egr.duke.edu (pref)	*
* Box 90291				        jpe@cs.duke.edu		*
* Durham, NC 27708-0291							*
*									*
*  Reports of problems w/EE systems should go to problem@egr.duke.edu	*
*************************************************************************
From: rennie@pembvax1.pembroke.edu
Newsgroups: comp.security.misc
Subject: Encryption Source Needed
Date: 16 Dec 92 10:41:09 EDT
Organization: Pembroke State University
NNTP-Posting-Host: pembvax1.pembroke.edu

I'm in need of the source for a 2-way encryption program (not in Turbo though)
for text files and/or binaries.

Thanks in Advance

Newsgroups: comp.security.misc
From: palmer@Trade_Zone.msfc.nasa.gov (Paul (Cliffy) Palmer)
Subject: Re: Security vs usefulness (was Re: reasons
Reply-To: palmer@Trade_Zone.msfc.nasa.gov
Organization: New Technology, Inc.
Date: Tue, 15 Dec 1992 16:27:03 GMT

In article 1gkpsmINNn05@iraul1.ira.uka.de, s_titz@ira.uka.de (Olaf Titz) writes:
>In article <1992Dec14.211255.15839@lambda.msfc.nasa.gov> palmer@Trade_Zone.msfc.nasa.gov writes:
> ^^^^^^^^
>You see that the following applies largely to government/military only?

Please do not do me the disservice of discounting my statements simply
because I happen to have sent my message from a NASA provided host.  My
statements apply just as well to the purely commercial organizations I
have worked for that have a vested interest in maintaining the
integrity of their computers.

---
Paul (Cliffy) Palmer

Xref: sparky comp.security.misc:2259 alt.comp.acad-freedom.talk:3762
From: s_titz@ira.uka.de (Olaf Titz)
Newsgroups: comp.security.misc,alt.comp.acad-freedom.talk
Subject: Re: Security vs usefulness (was Re: reasons
Date: 15 Dec 1992 14:25:26 GMT
Organization: Fachschaft math/inf, Uni Karlsruhe, FRG
NNTP-Posting-Host: irau31.ira.uka.de

In article <1992Dec14.211255.15839@lambda.msfc.nasa.gov> palmer@Trade_Zone.msfc.nasa.gov writes:
 ^^^^^^^^
You see that the following applies largely to government/military only?

>>The main job of security is to stop the user from getting his work
>>done.
>
>I disagree, security is not a win/lose scenario...granted when the
>security officer takes the easy way out when fixing a problem, the end
 ^^^^^^^^^^^^^^^^

I really don't know about installations where the security people are
officers...

>user usually loses functionality or useability.  But when the careful
>security officer carefully considers the situation, there is almost
>always a win/win solution.

...but here (academic) every "security" effort has always been
inevitably a lose/lose situation. More hassle to deal with on one
side, less usability on the other.

You run into this as soon as you start thinking, "the less I allow to
the users the less damage can/will they do", which is wrong, imho.

>It is especially important to inform the users of changes mandated by
>security requirements and to provide them with methods to perform their
>duties that are not impacted by the change.  Often the changes that are
>necessary do not impact the user at all (like activating auditing, or
>applying the NIS patch to implement "securenets").

I'm not sure about audits (at least they give the system management
more control over the users, which *can* by itself be bad, depending
on the admin people). But if the changes involve (e.g.) hiding an
entire subnetwork behind a firewall, this *does* affect the users. And
if you argue, "these particular users have all data they ever have to
deal with on their local machines and may not do anything else", well,
you're talking government, I'm talking academic. But we (academic)
have to live with people and OSs who confuse security and unusability,
too.

>System security is one of the toughest jobs I have ever performed, which
>consequently makes it one of the easiest to perform badly.

Agreed.

Olaf
-- 
| Olaf Titz - comp.sc.student  |   o     | uknf@dkauni2.bitnet | old address |
| univ. of karlsruhe - germany |  _>\ _  | s_titz@ira.uka.de   | is still    |
| +49-721-60439                | (_)<(_) | praetorius@irc      | valid       |
  "My heart is human - my blood is boiling - my brain IBM" - Mr. Roboto
Newsgroups: comp.security.misc,comp.org.eff.talk
From: mnemonic@eff.org (Mike Godwin)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Originator: mnemonic@eff.org
Organization: Electronic Frontier Foundation
Date: Tue, 15 Dec 1992 19:41:12 GMT

In article <1992Dec14.185513.22840@mksol.dseg.ti.com> mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:

>No, what I cited is what the Texas law says.  Whether or not sentences
>on multiple charges are served concurrently or consecutively is up to
>the judge.  No bending of the law required.

On the contrary: it would take a major bending of the way criminal law is
applied in Texas for it to be applied as you suggested.

>I'm simply following your logic
>and doing what the law says instead of what I think would be a
>'better' sentence.

You seem to have confused me with someone else; I haven't made the
statement you attribute to me here.

>I would question this.  If he was never charged under the Texas
>statute, would it be double jeopardy to so charge him, even if the
>same actions were charged for something else in another jurisdiction? 

Yes, under Texas double-jeopardy law.

(The converse is not true; if Morris had been tried first in Texas,
the Feds could probably prosecute him without violating double-jeopardy
principles.)

>[Actually, I think the real reason that this isn't feasible is that
>the superior court gets jurisdiction first -- which means if the Feds
>want him, they get him first.  It's simply not worth dragging him
>around charging him hither and yon.]

What you say here about "the superior court" is inaccurate. There is no
rule of this sort as to who gets jurisdiction first.

>>What you have written is in accord neither with my principles nor with
>>Texas criminal law.
>
>I believe you may be mistaken on that last one.  And it certainly
>seemed to flow from what your principles were complaining about.

I can't figure out where you're getting this conclusion from my principles.
As for what I'm saying about Texas law, well, it's always possible that
the law has changed since I was admitted to the bar in Texas in 1990
(after gaining my law degree at the University of Texas School of Law).

>>In the Morris case, in my opinion, the law (as interpreted by the
>>government) was wrong. So your discussion here seems inapposite.
>
>Then you're just acting like a jerk, as usual.

This looks like a non sequitur on your part.

>I don't.  I'm hardly the only one you've ever done this sort of crap
>to, Mike.

Oh, I see. You have been elected to represent a group with grievances
against me. How proud you must be.



--Mike Godwin, Texas Bar # 08056825



-- 
Mike Godwin,    |"Everything one invents is true."
mnemonic@eff.org| 
(617) 864-0665  |                           --Flaubert
EFF, Cambridge  |                           
Newsgroups: comp.security.misc,comp.org.eff.talk,alt.privacy
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Tue, 15 Dec 1992 22:27:46 GMT

In article <1992Dec14.172517.3525@nic.csu.net>, oleg@gd writes:
>Do traceroute to my host and think how fun a life would be if an owner of each
>gateway would capure our packets to ensure that out use of Internet is legal and
>ethical.

paranoia time..

If?  Do you know they aren't doing this?

At least that's exactly what the Digital Telephony proposal is aiming
at, a capability to do exactly that.

//Jyrki
Newsgroups: comp.security.misc,alt.society.civil-liberty
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: CERT and the Dept. of Justice on keystr
Followup-To: alt.society.civil-liberty
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Tue, 15 Dec 1992 22:27:13 GMT

In article <Bz9Dzy.Ln2@avalon.nwc.navy.mil>, jd@parcival (John de la Garrigue) writes:
>Don't know about other states, but the State of California explicitly
>states in thier driver's license policy that driving is a privilege, *not*
>a right.  Just because we take it for granted does not mean we are entitled
>to it.

I've heard about legislation that says that pi is 3, but the existence
of such legislation doesn't really change the value of pi.  Equally,
just because a policy document somewhere says that something isn't a
right, it doesn't make the right nonexistent.

>>(2) come and go as we please  -  as long as we dont intrude on
>>other peoples "property".  
>
>Actually, I think this is a right guaranteed by the US government, but I could 
>be wishful thinking.  Any lawyers care to confirm this?

US government doesn't guarantee rights - it recognizes them (see the
Bill of Rights).

>>(3) drink alchohol, take drugs etc - again as long as it doesnt
>>intrude on other peoples rights.   
>
>Again, not a *right*.  The government clearly states drug use is illegal, and
>which drugs can't be used or can only be used when properly prescribed.

Again, this is an example of where the U.S. government (and many
others) don't recognize people's rights, and wrt drug laws blatantly
violate them.  Unconstitutionally in USA, I think - also in Germany
marijuana prohibition is thought to be against the Constitution and
some judges have been working on it.

>Good point.  Which group should this go to?

Perhaps alt.society.civil-liberty, alt.politics.usa.constitution.

Followups directed to alt.society.civil-liberty.

//Jyrki
From: wetmore@bongos.EBay.Sun.COM (Brad R. Wetmore)
Newsgroups: comp.security.misc
Subject: Re: Am I being hacked?
Date: 17 Dec 92 20:22:26 GMT
Reply-To: wetmore@bongos.EBay.Sun.COM
Organization: Sun Microsystems, Inc.
NNTP-Posting-Host: bongos.ebay.sun.com

In article 5w2@ecf.toronto.edu, steve@ecf.toronto.edu (Steve Kotsopoulos) writes:

>You should read Bill Cheswick's excellent "An Evening with Berferd ..."
>paper, in the conference proceedings from the January 1992 Usenix.

Yes, an excellent paper.  Also you should check out the dragon paper, as well
as the gateway paper, if you are interested in how the environment was set up.
Around UC Davis, we called the collection "The Berferd Trilogy," due to the overtures
of the Tolkien Trilogy made in the dragon paper.

You can find them all on research.att.com in /dist/internet_security

Brad

   /
O /                         Steal here.
 X ----------------------------------------------------------------
O \     Brad Wetmore:                 wetmore@bongos.EBay.Sun.COM
   \    Help!!!  I've been robbed.  Someone stole my .sig, and sold 
        it back at the UCD used .sigstore.
Newsgroups: comp.security.misc
From: medley@sun44.synercom.hounix.org (Bert Medley)
Subject: COPS 1.04 suggestion
Summary: passwd.chk
Organization: Synercom Technology, Inc., Houston, TX
Date: Fri, 11 Dec 1992 15:40:14 GMT

I think COPS needs another test added to the password check phase:  accounts
whouse password is the account name -

login: dsuser
Password: dsuser

My last run did not report this simple problem.

-- 
Bert Medley				medley@synercom.hounix.org 	[work]
					bert@medley.ssdl.com		[home]
Xref: sparky comp.security.misc:2210 comp.org.eff.talk:7637
From: rat@ruth.UUCP (David Douthitt)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Stupid Licenses (YUCK!)
Date: Sun, 13 Dec 92 14:27:08 CST
Organization: Network XXIII - +1 608 222 9253

charlie@umnstat.stat.umn.edu (Charles Geyer) writes:

| But the Foo/9000 and Foonix come with licenses that say THIS COMPUTER AND
| ALL OF ITS SOFTWARE ARE NOT GUARANTEED TO DO ANYTHING WHATSOEVER.  ANYTHING
| THEY DO IS NOT OUR PROBLEM.  WE DISCLAIM EVERYTHING.

Thank goodness someone else noticed those warrantees.  What a load of
MALARKEY ...  Thank goodness for the part that says "SOME OF THESE
LIMITATIONS MAY NOT BE VALID IN SOME STATES" -- ie, some states have
passed laws that actually (GASP!) force a company to be (OH MY!) RESPONSIBLE
for its products... in Wisconsin, Ibetcha it's the "Lemon Law" that I've
heard about...

Now if it was only possible to get rid of the part that says,
YOU DON'T OWN THIS PRODUCT, WE DO.  YOU ONLY PURCHASED THE RIGHT TO USE IT.
ANYTHING WE SAY GOES...


--
UUCP: ....!fullfeed.com!ruth!rat        |  Network XXIII - +1 608 222 9253
InterNet: rat@ruth.UUCP                 |  80Megs+ of Usenet/Fido programs!
Fidonet: David Douthitt 1:121/23        |
"...because appealing to the masses has |  Files available more ways than
 never appealed to us."                 |  any other BBS in America!
Files via: anon uucp, Fidonet FREQ, mail to archive-server@ruth.uucp, etc.
Xref: sparky comp.security.misc:2312 alt.comp.acad-freedom.talk:3789
From: craig@ec.uwa.oz.au (Craig Richmond - division)
Newsgroups: comp.security.misc
Subject: Re: Am I being hacked?
Date: 15 Dec 1992 08:42:16 GMT
Organization: The University of Western Australia
NNTP-Posting-Host: decel.ecel.uwa.edu.au

subbarao@fc.hp.com (Kartik Subbarao) writes:

>In article <1frfh9INNil3@network.ucsd.edu> mbk@lyapunov.ucsd.edu (Matt Kennel) writes:

>Well, the /etc/passwd probably wouldn't be of any use, since it most likely
>has '*'s in the place of the password. At least I hope so, in your case.

I wanted to create a bogus password file with passwords like

have
you
cracked
every
password
yet

so that you got a nice message when you unscrambled it after running crack
on the password file :)

Alternatively you set up a dummy account with a crackable password in the
ftp passwd file and when the account is logged into, you record the IP,
finger the machine and set of alarms on your local machine.  That way, you
catch the potential hackers.

Craig
--
Craig Richmond.  Computer Officer -  Dept of Economics (morning) 380 3860
  University of Western Australia    Dept of Education (afternoon)
craig@ecel.uwa.edu.au Dvorak Keyboards RULE!  "Messes are only acceptable
if users make them.  Applications aren't allowed this freedom" I.M.VI 2-4
Xref: sparky comp.security.misc:2243 comp.org.eff.talk:7662
From: cummings@natinst.com (Rodney Cummings)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Fun things to do to RTM (was: Internet worm)
Date: 14 Dec 1992 17:03:02 -0600
Organization: National Instruments, Austin, TX
Distribution: inet
NNTP-Posting-Host: falcon.natinst.com

In article <1992Dec14.184229.22277@mksol.dseg.ti.com> mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:
>Seems obvious, Peter.  The 'tool' central to the crime is the
>computer.  Simply don't allow him to work with them for a while.  I'm
>curious as to just how many people really don't 'get' this; that
>think, as Mike would have us believe, that we're talking about not
>letting him go to graduate school or something equally silly.  Of
>course, if he was working on a C.S. degree, he might have a few
>problems attending for a while, if not programming on computers was
>part of his probation.

Enforcement of this hypothetical punishment doesn't seem obvious or simple
to me, so I guess you can count me as one of those who don't 'get' it.

Are you saying that Morris should be prevented from using computers, or
just programming them?  For example, if he decided to go back to graduate
school for a P.H.D. in English, should he be forced to use a typewriter
to do his thesis?  If word processing is acceptable, then should he be
allowed to buy a personal computer for that task?

I guess what I'm not clear on is your definition of "don't allow him to
work with them".  This could range anywhere from not allowing him to do
computer security work to not using the corner ATM machine.
-- 
     Rodney Cummings            cummings@natinst.com
     National Instruments       Austin, Texas
Newsgroups: comp.security.misc,comp.org.eff.talk