waashk/20ng huggingface dataset:
jhan@debra.dgbt.doc.ca (Jerry Han) writes: > The point of the matter is that; yes this is a serious problem.  But it is > not the end of the world.  Guess what?  We're doing something now you > can't do in a Communist country or Nazi Germany.   Or John Edgar Hoover's USA.  > We're complaining about > it, (or rather, you're complaining about it) and nobody is shooting at us.    yet.  > GUESS WHAT PEOPLE?  You live in one of the few countries in the world > where a person can complain without getting shot at.    yet.  > People are always complaining that somebody did this wrong, or somebody > did that wrong, or whatever.  Sit down and figure out two things: >  > 1)  What have they done right? > 2)  How much worse can it get? >  > And you'll find that you and I, are pretty damn lucky.  so far.  > So let's talk about it, get some action going, decide what's going on.  > But let's not overreact!    What harm is there in overreacting? This may be the largest single threat to civil liberties yet in my lifetime.  The US has done some pretty heinous things in the past,  and we haven't yet recovered from all of them.  There certainly seems to be a historical trend towards less liberty, with occasional perturbations.   Time to break out the quotes from American political radicals.  Lyle		Transarc		707 Grant Street 412 338 4474	The Gulf Tower		Pittsburgh 15219
>>For your application, what you can do is to encrypt the real-time clock >>value with a secret key.  Well, almost.... If I only had to solve the problem for myself, and were willing to have to type in a second password (the secret key) whenever I logged in, it could work. However, I'm trying to create a solution that anyone can use, and which, once installed, is just as effortless to start up as the non-solution of just using xhost(1) to control access. I've got religeous problems with storing secret keys on multiuser computers.  >For a good discussion of cryptographically "good" random number >generators, check out the draft-ietf-security-randomness-00.txt >Internet Draft, available at your local friendly internet drafts >repository.  Thanks for the pointer! It was good reading, and I liked the idea of using several unrelated sources with a strong mixing function. However, unless I missed something, the only source they suggested (aside from a hardware RNG) that seems available, and unguessable by an intruder, when a Unix is fresh-booted, is I/O buffers related to network traffic. I believe my solution basically uses that strategy, without requiring me to reach into the kernel.  >A reasonably source of randomness is the output of a cryptographic >hash function (e.g., MD5), when fed with a large amount of >more-or-less random data. For example, running MD5 on /dev/mem is a >slow, but random enough, source of random bits; there are bound to be >128 bits of entropy in the tens (or hundreds) of megabytes of data in >a modern workstation's memory, as a fair amount of them are system >timers, i/o buffers, etc.  I heard about this solution, and it sounded good. Then I heard that folks were experiencing times of 30-60 seconds to run this, on reasonably-configured workstations. I'm not willing to add that much delay to someone's login process. My approach (etherfind|compress, skip 10K) takes a second or two to run. I'm considering writing the be-all and end-all of solutions, that launches the MD5, and simultaneously tries to suck bits off the net, and if the net should be sitting __SO__ idle that it can't get 10K after compression before MD5 finishes, use the MD5. This way I could have guaranteed good bits, and a deterministic upper bound on login time, and still have the common case of login take only a couple of extra seconds.
-----BEGIN PGP SIGNED MESSAGE-----  In article <strnlghtC5wKH0.62x@netcom.com> strnlght@netcom.com (David Sternlight) writes:  > The number of court ordered wire taps is pretty low. Law enforcement has to > present pretty good evidence to get even that limited number of > authorizations. >  > Thus the overwhelming majority of conversations are neither tapped nor > recorded by the government, and for that to happen they have to: > a) Have a pretty good reason, with evidence; > b) Use this sparingly on highest priority "pretty good reasons."  David, given the proposition of the first first paragraph, the conclusion of the second *should* read:  > Thus the overwhelming majority of conversations are neither tapped nor > recorded legally by the government [...]            ^^^^^^^  Which completely overturns your argument.  To not see this requires an unbelievable degree of stupidity or naivete on your part.  Perhaps it's time for you to own up and say which spook agency you work for...  - --Paul   -----BEGIN PGP SIGNATURE----- Version: 2.2
In article <sfqPuJu00WC7IqOP5T@andrew.cmu.edu> "Jon C. R. Bennett" <jb7m+@andrew.cmu.edu> writes: > > >strnlght@netcom.com (David Sternlight) writes: >> If the crooks use an innocent person's clipper phone on the tapped line >> there's no problem. The Feds don't care whose phone instrument is used, just >> that the conversation is by the suspect on the tapped line. They get the >> serial number, get the keys, and they are in business. >>  >> No clipper chip to person association is ever needed. > >celular phones...........  Direction-finding and directional monitoring receivers. Can you say "little black bakery truck"?  :-)  David  > >jon
In article <Apr23.215306.83257@yuma.ACNS.ColoState.EDU> holland@CS.ColoState.EDU (douglas craig holland) writes:    OK, I heard a lot of talk about the NSA's infamous control over encryption    export through the ITAR.  Here's a question.  Say I develop this great new    encryption system, and I want to sell my software worldwide.  The thought    police then come in and say "This algorithm is a threat to national security.    You will not be permitted to export it."  At this point, what kind of trouble    could I get into if I ignored the ITAR and sold my program to international    customers anyway?  First of all, it's not the thought police, it's the export police. If you move overseas with your great thoughts in your head, write the software there, and then sell it, the US Thought Police probably can't do too much about it, though you might want to check with your lawyer first.  However, if you write the program here, and sell it to furriners, you are now an international arms dealer and can get thrown in the clink for *many* years, especially if they decide you'd be a good example, and Cuban Drug Dealers and Fanatic Middle Eastern Terrorists buy your stuff.  (Definitions of "public domain" are different for ITAR purposes, so if you've got a good enough lawyer who'll do your case for free after they've confiscated everything you own as evidence, you might win. But nobody wants to go first, since the stakes are _quite_ high.)
In article <gradyC5uAMw.BnG@netcom.com> grady@netcom.com (1016/2EF221) writes: >I guess the cryptowranglers read this group too.  But of >course I knew that because it is so easy to do.  There is >not a single doubt in my mind that every byte that passes >every significant gateway or 'bone is captured for the >colligation of data about __________?  (Maybe your name is here).  	I really like these claims. Where did they come from? We hear, practically daily, that the NSA monitors, oh, everything. They can crack anything. They'd never release a cryptosystem they couldn't crack.  	Where do people get these fascinating facts? 'The Puzzle Palace'? If you can get it for a buck, 2nd hand, it must be true, eh? I'm pretty sure the NSA is supposed to, among many other things, provide high-quality cryptosystems to a variety of places. I don't recall reading anywhere reliable that they're supposed to:  	1) Monitor my phonecalls. 	2) Monitor usenet. 	3) Provide only cryptosystems they can easily crack. 	4) etc etc.  	This is not to say that they *don't*, they might. But you don't know that they do, and you have no evidence that they do, for almost all values of you. It follows, therefore, that for most values of 'you', your claims about the NSA border on paranoia.
I don't wish to rehash the PGP patent issue at all, but I do feel that some potential misconceptions in interpretting intellectual property laws need to be raised.  In article <a_rubin.736125803@dsg4.dse.beckman.com> a_rubin@dsg4.dse.beckman.com (Arthur Rubin) writes: > >If PGP violates RSAs patents, then only executing PGP could be a violation. >Distributing PGP could be contributory infringement, but the PGP >documentation seemed sufficient to me to protect distributors (before I >deleted it -- using PGP might be a patent violation in the US, so I have no >need to keep it.)  You are correct that executing PGP would be a violation (unless the patent were declared invalid by the courts), but...  there is a question as to when, how, or if distributing PGP would be a violation.  If the person or company distributing PGP receives money for doing so, then it is clearly a sale (for example, if it were on Compuserve, they charge you for access so they would be selling PGP).  When there is no charge for PGP things get less clear, but there would still be a reasonable view that it is inducing an infringement.  > ... [nb re: Jim Bidzos] >You have no legal action you can take, unless you believe you can prove >someone is using PGP in the US, for a purpose other than that specifically >allowed by patent laws.  (Not entirely correct, anyone can sue for any >reason, but, you cannot prevail unless you can prove that by a prepoderance >of evidence).  Under patent laws, PGP does have legitimate uses, as a means >to study your algorithm, in order to produce improvements (which would >still require your approval to execute, until the patent runs out around >2000).  This is a common misconception.  The patent laws do not mention any valid purpose for infringing a patent.  Although it is clear that in order to create a new invention either based on a prior patent or to avoid infringing a prior patent, one must perform research on an existing patent.  To just say that you infringed a patent (assume we're not talking the RSA patent) only for research purposes (wink wink, nudge nudge) and then never develop any related invention (ie. only use it), would be a clear infringement.
In article <1993Apr21.031524.11080@news.weeg.uiowa.edu>,  holthaus@news.weeg.uiowa.edu (James R. Holthaus) writes:  > What is the status of cruptology for private citizens throughout the > world? or, more clearly, is there a listing of countries and their > policies on citizens encrypting electronic data?   >  > I'm curious how the Europeans handle this, for instance. > --   Good question. I also wanted to find out and I did a while ago.  In our former communist times such activity (i.e. sending crypto emails) would be prevented sooner ot later, law or no law. But now there is no law  against it. So we are free to use it. We now have an EC conformant law for  protection and registration of personal files. You must remember that the  situation in small countries is vastly different from the big ones. --  Borut B. Lavrencic, D.Sc.     | X.400   :C=si;A=mail;P=ac;O=ijs;S=lavrencic J. Stefan Institute           | Internet:Borut.B.Lavrencic@ijs.si University of Ljubljana,      | Phone   :+ 386 1 159 199 SI-61111 Ljubljana, Slovenia  |	    PGP Public Key available on request
Also note (from <branstad@tis.com> and <walker@tis.com>):  % whois -h rs.internic.net tis-dom Trusted Information Systems, Inc. (TIS-DOM)    3060 Washington Road, Route 97    Glenwood, MD 21738     Domain Name: TIS.COM     Administrative Contact:       Walker, Stephen T.  (STW3)  walker@TIS.COM       (301) 854-6889    Technical Contact, Zone Contact:       Dalva, David I.  (DID1)  dave@TIS.COM       (301) 854-6889     Record last updated on 02-Jul-92.     Domain servers in listed order:     TIS.COM                      192.33.112.100    LA.TIS.COM                   192.5.49.8  	And "dockmaster" is an infamous address ...
In <MARC.93Apr18174241@oliver.mit.edu> marc@mit.edu (Marc Horowitz N1NZU) writes:  >I received mail from Mitch Kapor saying that he did not ask to be on >the list, and does not know why he was added.  I'm sure the same >applies to others on the list.  So, I guess my initial theory was >right, that the clipper list was just someone's idea of a bad joke.  I >guess I should be happy it wasn't a conspiracy.  I have also been in contact with Mitch about this. I believe him when he says he didn't ask to be on the "clipper" list.  He also forwarded the traffic he had recieved through that list to me which will be placed at some ftp site.  However, the first alias on the "clipper list" was csspab which was another mailing list. It basically contained the addresses for staffers and board members of the NIST security board. Several of these people had their accounts within the dockmaster domain.  These are the people we might wish to FOIA...  /harry
srt@duke.cs.duke.edu (Stephen R. Tate) writes: > >Now, I'm not one of the people who distrusts the government at every >turn, but taking someone's word for it that the S1/S2 pairs are not kept >around is pushing what I'm willing to believe just a little bit too far. >  Even if they somehow address this issue it is unlikely to be the only back door in -- they might even have a few intentionally visible to distract from the ones that aren't visible.  -- Perry Metzger		pmetzger@shearson.com
In article <1qmugcINNpu9@gap.caltech.edu> hal@cco.caltech.edu (Hal Finney) writes: >It looks like the worst nightmares raised by Dorothy Denning's proposals >are coming true.  If the government continues on this course, I imagine >that we will see strong cryptography made illegal.  Encryption programs >for disk files and email, as well as software to allow for encrypted >voice communications, will be distributed only through the >"underground".  People will have to learn how to hide the fact that >they are protecting their privacy.  Some thoughts:  Has any work been done on encapsulating encrypted data inside "non-encrypted" data files?  Many file formats can be written with "gaps" in them to hide other data.  New file formats could be designed to have alternate data hidden by dispersing it amongst the "legitimate" data.  The hidden data would only show up with the right key(s), and a file with hidden data would be indistinguishable from one without.  So, only the correct key(s) would reveal the presence of an "illegal" document.  If I devise a custom file compression algorithm and only I and a friend have the uncompressor, and otherwise the file appears to be total gigerish, do I have the right to transmit the file?  Will we have to "escrow" all our data file formats?  Are gangs required to escrow their hand signals, colors and catch phrases?
In article <m5c5fkj@rpi.edu> antonh@rpi.edu writes: >say, can anyone send my info on how to encrpyt a hard disk [...] >ps.  I would also like know the consequences of those types of actions if i >so chose to do them in the future in this country and european countries.  People have been encrypting notes in their notebooks for hundreds of years -- maybe over a thousand.  It's a long tradition dating at least back to the alchemists.  I know of nothing bad happening to them.  I would assume that nothing bad would happen to you, given this long history establishing encryption as the property of individuals, to do with as they please.
|>    The Attorney General will procure and utilize encryption devices to |>    the extent needed to preserve the government's ability to conduct |>    lawful electronic surveillance and to fulfill the need for secure |>    law enforcement communications.  Further, the Attorney General |>    shall utilize funds from the Department of Justice Asset Forfeiture |>    Super Surplus Fund to effect this purchase.  This is the one part that really scares me. Without the keys, it can likely be determined if a person is using the "State Approved" encryption method, and if not then that persons life is forfet, and the profits go to making more busts, and more  profit.   "Power corrupts. Absolute power corrupts absolutely." Human nature has not changed very much in only a few hundred years....
In article <C5JA6s.A59@cs.psu.edu> so@eiffel.cs.psu.edu (Nicol C So) writes: >In article <897@pivot.sbi.com> bet@sbi.com (Bennett Todd @ Salomon Brothers Inc., NY ) writes: >>This came up because I decided to configure up MIT-MAGIC-COOKIE-1 security >>for X11R5. For this to work you need to stick some bits that an intruder >>can't guess in a file (readable only by you) which X client applications >>read. They pass the bits back to the server when they want to establish a >>connection. >> >>... >>What I settled on was grabbing a bunch of traffic off the network. >>Basically, I ran >> >>	etherfind -u -x greater 0|compress >> >>and skipped over 10K of output, then grabbed my bits. As best I can tell, >>these are bits that can be expected to be reasonably uniformly distributed, >>and quite unguessable by an intruder. > >For your application, what you can do is to encrypt the real-time clock >value with a secret key.  For a good discussion of cryptographically "good" random number generators, check out the draft-ietf-security-randomness-00.txt Internet Draft, available at your local friendly internet drafts repository.   A reasonably source of randomness is the output of a cryptographic hash function (e.g., MD5), when fed with a large amount of more-or-less random data. For example, running MD5 on /dev/mem is a slow, but random enough, source of random bits; there are bound to be 128 bits of entropy in the tens (or hundreds) of megabytes of data in a modern workstation's memory, as a fair amount of them are system timers, i/o buffers, etc.
David Sternlight writes: > A little perspective might be in order.  I cannot believe you can make these claims given hard evidence of abuse.  Do you ignore stories about survellience of Martin Luther King, have you blocked from your mind McCarthy's crusade in the 50's?  > The number of court ordered wire taps is pretty low.  And how many illegal wiretaps are performed?  Funny, but I'll be that the FBI doesn't keep statistics on these!  "confidential informer" = illegal wiretap  /-----------------------------------\ | Karl L. Barrus                    | | elee9sf@menudo.uh.edu             | <- preferred address | barrus@tree.egr.uh.edu (NeXTMail) | \-----------------------------------/
In article <strnlghtC5M2Cv.8Hx@netcom.com> strnlght@netcom.com (David Sternlight) writes:    Here's a simple way to convert the Clipper proposal to an unexceptionable    one: Make it voluntary.     That is--you get high quality secure NSA classified technology if you agree    to escrow your key. Otherwise you are on your own.  That's the disturbing part - use of other products IS voluntary, for now, and the press releases talk about the White House's unwillingness to decide that citizens have a right to good commercial crypto gear, and about how commercial alternatives will be permitted as long as they provide key escrow services.  That's a clear implication that they're considering banning alternatives.  Additionally, use of real alternatives ISN'T totally legal - you're not allowed to export really good crypto equipment except to the government's friends (e.g. the Australian government) you can only export even BAD crypto equipment with their permission, and the regulators who control the cellular telephone companies make sure there are only two competitors, so Joe's Garage Cellular can't start offering a secure service.
ted@nmsu.edu (Ted Dunning) writes: >nobody seems to have noticed that the clipper chip *must* have been >under development for considerably longer than the 3 months that >clinton has been president.  this is not something that choosing >choosing bush over clinton would have changed in the slightest; it has >been in the works for some time.  I've got no doubts that this would probably have gone ahead if Bush was still president.  What's puzzling to me are the people who are apparently amazed that Clinton is going along with it.
could someone repost or send to me via email the original posting of the Clipper Chip press release.  thanks  andrew kriger hampshire college agk@neural.hampshire.edu
In article <1993Apr19.193528.5655@cs.ucla.edu> geoff@ficus.cs.ucla.edu (Geoffrey Kuenning) writes: >In article <2073@rwing.UUCP> pat@rwing.UUCP (Pat Myrto) writes: > >> fishing expeditions without the target's knowlege.  Don't give up the >> right to be safe from that - that should be non-negotiable, and Clinton >> and Co. know it (which is probably why they quietly developed this thing, >> figuring if they get it this far, they can ram it on through). > >It always amazes me how quick people are to blame whatever >administration is current for things they couldn't possibly have >initiated.  This chip had to take *years* to develop, yet already >we're claiming that the Clinton administration sneaked it in on us. >Bullshit.  The *Bush* administration and the career Gestapo were >responsible for this horror, and the careerists presented it to the >new presidency as a fait accompli.  That doesn't excuse Clinton and >Gore from criticism for being so stupid as to go for it, but let's lay >the body at the proper door to start with.  You are so correct - Clinton did not initiate it.  He just cast it in GRANITE by implimenting, NOT stopping the DECISION.  I also stated in another post I don't give a damn what administration does it, I still find it totally unacceptable, and whoever impliments it or rams it down our throats ought to be run out of office.  Also, Bush was not trying to deprive us of our Second Amendment rights. Clinton is BUSTING HIS BUTT in that regard.  That reveals a total difference in philosophy.  Clinton appears to support the idea of TOTAL people control.  Eavesdropping whenever they feel like it, no real security for the common person, and no ability to defend oneself against illegal attack, from whatever source.  "Trust us, we will protect (and control) you... if we don't find it inconvenient..."  Clinton has also shown his utter contempt for public disclosure and accountability, as well.  He had plenty of time to change the policy.  HE DIDN'T.  HE EXPANDED ON IT.  I bet had Bush been in office, you would be in there howling louder than I.
In <15314.735453769@moose.cs.indiana.edu> Marc VanHeyningen <mvanheyn@cs.indiana.edu> writes:  >PGP is not available on the archive site rsa.com.  If it were, it >would be highly amusing, since rsa.com (actually Public Key Partners, >but it's the same entity) is the organization holding the patents >which they claim are violated if you actually "make, use or sell" PGP. >I believe those patents also apply in Canada, but I'm not a patent >lawyer or anything.  (Sorry about double posting, but I forgot something.)  "make, use or sell" in this context have non-standard meanings:  "Make" means making an encrypted message.  "Use" may mean using PGP, or using an encrypted message.  "Sell" would probably mean selling an encrypted message.  It is the message created by a "patented" process incorporated in PGP, which infringes.
What is the expected run time (+/- a factor of 10) on a 486DX/50 using the best known algorithm for finding the shortest path solution for Rubicks Cube from a randomly chosen position?  I have read the FAQ and followed the recent discussion on Rubicks Cube but I don't believe this question has been answered.  Notice that I am specifically looking for an algorithm that finds the  SHORTEST path, not just any solution.  It seems to me that the underlying assumption is that such a program would need to do a brute force search though 10^20 positions.  That seems an unreasonably pessimistic assumption to me and I want to  know if someone has significantly improved on that.  I have some ideas of my own on how to approach this problem, but before I spend to much time developing them I wanted to know if someone else has already done the work.  ADMINISTRIVIA:  I have posted this to three groups and attempted to set the followup to rec.puzzles which seems to me to be the place to continue this discussion.  I will cross post a summary when and if it becomes appropriate.  Email replies gladly accepted.