[RISKS] Risks Digest 25.76

From: RISKS List Owner <risko_at_private>
Date: Sat, 15 Aug 2009 15:26:48 PDT
RISKS-LIST: Risks-Forum Digest  Saturday 15 August 2009  Volume 25 : Issue 76

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
  <http://catless.ncl.ac.uk/Risks/25.76.html>
The current issue can be found at
  <http://www.csl.sri.com/users/risko/risks.txt>

  Contents:
Amusement rides without Fail-safe States (Debora Weber-Wulff)
Taipei rapid transit line closed until further notice (jidanni)
Twitter disruption (Jenna Wortham via PGN)
UK national ID card cloned in 12 minutes (PGN)
Social security to pay $500 million to victims of database error (Rob McCool)
Computer Error Caused Rent Troubles for Public Housing Tenants 
  (Manny Fernandez via Monty Solomon)
Kentucky election fraud indictments (PGN)
Sequoia e-voting machine manipulated without insider info (Peter Houppermans)
Boy Dies After Mom Says GPS Left Them Stranded in Death Valley (Richard Grady)
China backs off on censorship software ... (Lauren Weinstein)
Revealingerrors.com (Robert P Schaefer)
Apple keyboard firmware hack demonstrated (Monty Solomon)
Re: Software never fails ... (Martyn Thomas, George Jansen, Andrew Brydon,
  Paul Edwards, Rob Seaman, Devin Moore, Nick Keighley, Martin Cohen)
Re: Ari Juels, Tetraktys, a `cryptographic thriller' (Dag-Erling Smørgrav)
Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Sun, 09 Aug 2009 23:14:51 +0200
From: Debora Weber-Wulff <weberwu_at_htw-berlin.de>
Subject: Amusement rides without Fail-safe States

Spiegel-Online reports that not one, but two amusement park rides in Europe
failed in August 2009 - in a non-safe state.

In Berlin, a car in the ride "Stargate" at the German- American Fair that
just used a rail to hold people in was stuck at the top with the 14
passengers on their heads. It took 20 minutes to get the car down by
hand. The passengers could not be retrieved by firetruck ladder, as opening
the rail would cause everyone to fall down. Some were treated for shock, one
woman apparently thought it was part of the ride. The same fair had an
11-year-old child die a week ago on a children's roller-coaster ride, as
reported by the *Abendblatt*.

In Moscow, a Ferris wheel at the Allunions fairgrounds stopped with about 50
people on board and could not be coaxed to move.  Here the fire trucks could
use ladders, as people were sitting right-side up. There had been repeated
technical problems with the wheel.

(Berlin, Stargate) http://www.spiegel.de/panorama/0,1518,641351,00.html
(Berlin, Roller Coaster)
http://www.abendblatt.de/vermischtes/article1120791/Elfjaehriger-stirbt-in-Kinderachterbahn.html
(Moscow, Ferris wheel)
http://www.spiegel.de/panorama/0,1518,641379,00.html

Prof. Dr. Debora Weber-Wulff, HTW Berlin, FB 4, Treskowallee 8, 10313 Berlin  
+49-30-5019-2320  http://www.f4.htw-berlin.de/people/weberwu/

------------------------------

Date: Sat, 15 Aug 2009 02:56:50 +0800
From: jidanni_at_private
Subject: Taipei rapid transit line closed until further notice

Taipei, Aug 6. (CNA) The Taipei Mass Rapid Transit (MRT) Neihu line was
closed Thursday noon until further notice due to problems with the
computer system. http://www.etaiwannews.com/etn/news_content.php?id=1023961
OK, they did fix it, but things have been on and off, up and down,
http://www.taipeitimes.com/News/taiwan/archives/2009/08/15/2003451137

------------------------------

Date: Sat, 8 Aug 2009 12:22:59 PDT
From: "Peter G. Neumann" <neumann_at_private>
Subject: Twitter

Many of Twitter's 45 million customers were disrupted for several hours by a
denial-of-service attack on 6 Aug 2009.  This resulted from a spam flood
relating to the Russian-Georgian dispute over Abkhazia.  The messages
contained links to Twitter, Facebook, YouTube, and Google (among others).
However, Twitter users seem to have been affected the most.  Source: Jenna
Wortham, {\it The New York Times,} 7 Aug 2009; PGN-ed

------------------------------

Date: Tue, 11 Aug 2009 6:10:38 PDT
From: "Peter G. Neumann" <neumann_at_private>
Subject: UK national ID card cloned in 12 minutes

The prospective national ID card was broken and cloned in 12 minutes.  The
*Daily Mail* hired computer expert Adam Laurie to test the security that
protects the information embedded in the chip on the card.  Using a Nokia
mobile phone and a laptop computer, Laurie was able to copy the data on a
card that is being issued to foreign nationals in minutes.  He then created
a cloned card, and with help from another technology expert, changed all the
data on the new card. This included the physical details of the bearer,
name, fingerprints and other information.  He then rewrote data on the card,
reversing the bearer's status from "not entitled to benefits" to "entitled
to benefits".  He then added fresh content that would be visible to any
police officer or security official who scanned the card, saying, "I am a
terrorist - shoot on sight."

According to the paper, Home Office officials said the foreign nationals
card uses the same technology as the UK citizens card that will be issued
beginning in 2012.

http://www.computerweekly.com/Articles/ArticlePage.aspx?ArticleID=237215
<http://www.computerweekly.com/Articles/2009/07/30/237113/picture-uk-id-card-unveiled.htm>  
<http://www.dailymail.co.uk/news/article-1204641/New-ID-cards-supposed-unforgeable--took-expert-12-minutes-clone-programme-false-data.html#> 

For more information on the National ID Card scheme:
<http://www.computerweekly.com/Articles/://www.computerweekly.com/blogs/the-data-trust-blog/2009/07/id-cards-communications-genius.html>
<http://www.computerweekly.com/Home/tags/id-card.htm> 

------------------------------

Date: Thu, 13 Aug 2009 22:27:19 -0700 (PDT)
From: Rob McCool <robm_at_private>
Subject: Social security to pay $500 million to victims of database error

The Social Security Administration has agreed to pay more than $500 million
in back benefits to more than 80,000 recipients whose benefits re unfairly
denied after they were flagged by a federal computer program designed to
catch serious criminals, officials said Tuesday. ...  At issue was a 1996
law, which contained language later nicknamed the "fleeing felon" provision,
that said fugitives were ineligible to receive federal benefits. As part of
its enforcement, the administration began searching computer databases to
weed out people who were collecting benefits and had outstanding
warrants. ...  The lead plaintiff in the class-action suit, Rosa Martinez,
52, of Redwood City, Calif., was cut off from her $870 monthly disability
benefit check in January 2008 because the system had flagged an outstanding
drug warrant in 1980 for a Rosa Martinez from Miami. An investigation showed
that the warrant was for a different Rosa Martinez.  Martinez tried for
months to convince officials that she was innocent, but failed.
  http://www.washingtonpost.com/wp-dyn/content/article/2009/08/11/AR2009081103282.html

------------------------------

Date: Sat, 8 Aug 2009 17:30:28 -0400
From: Monty Solomon <monty_at_private>
Subject: Computer Error Caused Rent Troubles for Public Housing Tenants
  (Manny Fernandez)

The city's public housing agency overcharged hundreds of welfare families
because of a rent calculation error and took many of them to court,
threatening them with eviction for failing to pay the higher amount.  The
computer problem at the agency, the New York City Housing Authority, is in
the process of being corrected, and none of the tenants were evicted,
officials said.  But the error, which began last September and continued
until May, had serious legal, financial and personal consequences for many
low-income families.

Residents affected by the miscalculations were ordered to appear in Housing
Court for nonpayment of the extra rent, tried in vain to convince building
managers that there had been a mistake and lived in constant fear of losing
their homes because they could not or would not pay the extra money - often
as little as $50 to $200 a month - that the agency claimed it was owed.  The
problem affected only households whose sole income is public assistance.
[Source: Manny Fernandez, *The New York Times*, 6 Aug 2009; PGN-ed]
http://www.nytimes.com/2009/08/06/nyregion/06rent.html

------------------------------

Date: Mon, 10 Aug 2009 8:06:39 PDT
From: "Peter G. Neumann" <neumann_at_private>
Subject: Kentucky election fraud indictments

In the November 2009 election in Kentucky, there was a serious discrepancy
between how ES&S's iVotronic voting machines worked and how some voters were
instructed.  Some voters were apparently falsely told that touching `Vote'
completed the voting process.  However, that only displayed the review
screen, whereas subsequently touching `Cast Ballot' was required.
Conspiratorial election judges were then able to modify the ballot and cast
it.  In addition to the fraud, it is clear that the `vote' screen should
have instead been labeled something such as `review'.  Five insiders were
indicted -- including conspiracy to commit vote fraud, extortion, and
tampering with grand jury witnesses in a subsequent attempt at a cover-up.
[I've been meaning to get this item into the RISKS archives for a long time,
and finally got around to it.  PGN]

------------------------------

Date: Wed, 12 Aug 2009 10:22:38 +0200
From: Peter Houppermans <peter_at_private>
Subject: Sequoia e-voting machine manipulated without insider info

So much for Sequoia's security through obscurity - researchers bought some
machines legally at an auction, and without access to Sequoia's information
(which is heavily and heavy handedly protected) they managed to manipulate
the machines regardless..

Source:
http://www.theregister.co.uk/2009/08/12/sequoia_evoting_machine_felled/:

Computer scientists have figured out to how trick a widely used electronic
voting machine into altering tallies with a technique that bypasses measures
that are supposed to prevent unauthorized code from running on the device.
[..]  The computer scientists were able to evade this safety mechanism using
return-oriented programming. Rather than designing the malicious code from
scratch, the technique reassembles programming expressions already found in
the targeted software in a way that gives the researchers the ability to
take complete control over the machine. It's tantamount to kidnappers who
write a ransom note using letters cut from the headline of a newspaper.

  [No surprise to the red-team folks involved in last summer' California's
  Top-To-Bottom Review (http://www.sos.ca.gov/elections/elections).  PGN]

------------------------------

Date: Sun, 09 Aug 2009 20:36:29 -0700
From: Richard Grady <richard_at_private>
Subject: Boy Dies After Mom Says GPS Left Them Stranded in Death Valley

Alicia Sanchez, 28, was found severely dehydrated and remained hospitalized
in Las Vegas a day after being found with her dog, her dead son and a Jeep
Cherokee buried up to its axles in sand.  She told rescuers in California's
San Bernardino County that her son Carlos died Wednesday, days after she
fixed a flat tire and continued into Death Valley, relying on directions
from a GPS device in the vehicle.
  http://www.foxnews.com/story/0,2933,538323,00.html

------------------------------

Date: Thu, 13 Aug 2009 08:50:04 -0700
From: Lauren Weinstein <lauren_at_private>
Subject: China backs off on censorship software,
	but may still require real names on comments

Greetings.  *The New York Times* is reporting that China has now
definitively backed off from requiring the installation of
filtering/censorship software on all PCs sold in China.  Internet cafe and
other public computers would still be required to use the software, and two
major manufacturers are already including it on PCs sold in China.

http://www.nytimes.com/2009/08/14/world/asia/14censor.html

China blames the controversy over the software on "confusion" related
to badly written regulations.

On a related front, the same article reports that China is considering a
requirement that all posters to Internet chat rooms, bulletin board systems,
etc. use their real names (and, I'd be willing to bet, eventually include
other identifying information as well) on all postings.  The stifling
effects of such a requirement on speech are obvious, but I should note that
I regularly hear from people in the U.S. promoting a similar misguided
("Internet Driver's License") concept.

Lauren Weinstein +1 (818) 225-2800 http://www.pfir.org/lauren
http://www.pfir.org  Network Neutrality Squad: http://www.nnsquad.org [and more]

------------------------------

Date: Thu, 6 Aug 2009 14:52:27 -0400
From: "Schaefer, Robert P  \(US SSA\)" <robert.p.schaefer_at_private>
Subject: Revealingerrors.com

Another website aggregating faults and errors, some of which are due to
computers:

http://revealingerrors.com/

  [Weblog maintained by Benjamin Mako Hill.  Lots of RISKS-worthy stuff,
  e.g., a recent item on Akamai and SSL.  PGN]

------------------------------

Date: Mon, 3 Aug 2009 08:17:54 -0400
From: Monty Solomon <monty_at_private>
Subject: Apple keyboard firmware hack demonstrated

Charlie Demerjian at Defcon 17, 31 Jul 2009: Apple needs to patch it ASAP

Apple keyboards are vulnerable to a hack that puts keyloggers and malware
directly into the keyboard. This could be a serious problem, and now that
the presentation and code is out there, the bad guys will surely be
exploiting it.

The vulnerability was discovered by K. Chen, and he gave a talk on it at
Blackhat this year. The concept is simple, a modern Apple keyboard has about
8K of flash memory, and 256 bytes of working ram. For the intelligent, this
is more than enough space to have a field day.

K. Chen demonstrated the hack to S|A at Defcon today and it worked quite
well. You start out by running GDB, and set a breakpoint in Apple's
HIDFirmwareUpdaterTool. This tool is meant to update the firmware in human
interface devices, hence the name. The tool is run, a breakpoint set, and
then you simply cut and paste the new code into the firmware image in
memory. That's it.

Nothing is encrypted, decrypted, and the process is simple. You then resume
HIDFirmwareUpdaterTool, and in a few seconds, your keyboard is
compromised. Formatting the OS won't do you any good, the code is in
keyboard flash. There are no batteries to pull, no nothing, the keyboard is
simply compromised. ...

http://www.semiaccurate.com/2009/07/31/apple-keyboard-firmware-hack-demonstrated/

Reversing and Exploiting an Apple Firmware Update
http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Chen

------------------------------

Date: Thu, 06 Aug 2009 21:30:59 +0100
From: Martyn Thomas <martyn_at_thomas-associates.co.uk>
Subject: Re: Software never fails ... (Robinson, RISKS-25.75)

This rambling piece is nonsense and so are the articles it refers to. If
software engineering is not engineering because the specification contains
human requirements that cannot be completely formalised, then nor are civil
engineering, electrical engineering, or any other form of engineering.

The excuses that people come up with to justify their unwillingness to learn
and use some simple mathematics should be collected in a book and studied by
psychiatrists. Meanwhile, as an engineer, I shall continue to believe that
if my square-root function crashes, loops forever, or returns a value that
is not the square root of its argument, then it has failed. And that its
failure is independent of my personal opinion or anyone else's. And that the
straightforward application of some engineering methods can deliver a square
root function that does not fail, together with a proof.

And before anyone says that this is a toy example: (a) it only takes one 
counterexample to disprove an absolute claim,and (b) the same methods 
are being used routinely, successfully and cost-effectively on many 
industrial and commercial projects.

------------------------------

Date: Thu, 06 Aug 2009 15:18:34 -0400
From: "George Jansen" <GJANSEN_at_private>
Subject: Re: Software never fails ... (Robinson, RISKS-25.75)

Perhaps the subject line would more justly be "Software never fails more or
less than it did on release." I am struck in particular by two things:

1. "Any software package ...  only requires maintenance or change because in
   someone's subjective opinion it needs a change." I think that the
   expression "someone's subjective opinion" is not usefully defined. In the
   preceding paragraph it covers changes in the tax law--the subjective
   opinion of the legislators that taxes should go up or down, and of
   businesses that they had better comply--and of network providers that
   they must provide new features. Subjective opinions held by the IRS and
   by enough consumers tend to become compelling enough to affect the
   continued existence of a business, don't they?

This also does not cover such cases as they year 2038 issue. I don't think
it useful to say that it is merely my subjective opinion that we can't stick
with 32 bits and reset the clock to 1970.

2.  "A bridge needs replacement when it collapses or when it is beyond its
    useful life; a building needs replacement under the same circumstances."
    Yet "useful life", unless referring to safety, reflects "subjective
    opinion". Every day (unless in depressed markets), building are
    demolished that could have stood for many years yet; a developer has the
    opinion he'd make more money building a new one. Does the engineer's
    employment by a developer make him less an engineer?

------------------------------

Date: Fri, 7 Aug 2009 06:40:54 +0100
From: Andrew Brydon <andrew_at_private>
Subject: Software never fails ... (Robinson, RISKS-25.75)

> But the claim by someone that a software package needs change, updating or
  replacement is, and always will be, a subjective opinion based on nothing
  more than "because I say so."

One difference between engineering software and something physical such as a
bridge is the general population's experience of the domain. The average
person on the street can readily conceive the failure modes of bridges,
their causes and outcomes. The effects of software on the domain world, be
it returning the wrong tax deductions from payroll after a governmental rule
change or simply freezing/crashing are less easily perceived and much less
understood by a non-programmer. However, that does not inhibit someone other
that the originator from making an informed and educated decision, based on
engineering principles, that the product requires updating or replacing.

------------------------------

Date: Fri, 7 Aug 2009 22:01:56 +1000 (EST)
From: "Paul Edwards" <paule_at_private>
Subject: Re: Software never fails ... (Robinson, RISKS-25.75)

Paul Robinson asserts that "the claim by someone that a software package
needs change, updating or replacement is, and always will be, a subjective
opinion based on nothing more than "because I say so." " This assertion
does not stand up at a practical level, nor at a philosophical level. It
fails to recognize that software exists to provide support for specific
real-world activities; software does not exist for its own sake (with the
exception of games and entertainment software).

Well designed and implemented software will reflect the constraints and/or
requirements of the real-life application it is supporting, and if those
constraints and/or requirements change, the software (objectively)
requires updating, otherwise it will fail to achieve its purpose.

Suppose it's 2001, and you have some financial reporting software. As a
result of Sarbanes-Oxley passing in 2002, this software will need updating
in order to accurately support its real-world activity (financial
reporting). Of course, the "do nothing" option here would result in
additional expense for reporting companies through increased headcount,
and an ongoing reduction in efficiency of the financial reporting
activity.

Further, whilst I can't speak for the two men involved in drafting SOX,
I'm confident their motivation had precious little to do with software,
and more to do with strengthening financial reporting activities to avoid
another Enron.

The bridge analogy in the original article also fails to stand up to
scrutiny. A bridge near where I used to live was a good solid bridge,
there were no issues with its structural integrity, and it was nowhere
near the end of its life. However, due to unanticipated demographic
movements, the bridge became a bottleneck. It was updated to double the
number of traffic lanes it could handle, to reflect the changing
requirements that the bridge supported (pun intended).

Note that the above holds when instantiating "system" for "software" as well.

Paul Edwards, IT Service Management Consultant, Melbourne, Australia

------------------------------

Date: Tue, 11 Aug 2009 10:33:59 -0700
From: Rob Seaman <seaman_at_private>
Subject: Re: Software never fails ... (Robinson, RISKS-25.75)

Paul Robinson makes an interesting observation - that success in  
software is subjective - but then overgeneralizes to suggest that  
software engineering can never be a rigorous discipline.  Bridges must  
be maintained because the external world changes.  This is also true  
of software.  Traffic load increases, the balance of expense of  
necessary resources (toll plazas, police, paramedics) shifts.  Yes,  
tax laws change and cellular networks evolve to vex software  
engineers, but this is precisely the same with other types of  
engineering.

More to the point, almost every modern system includes software  
dependencies.  Systems engineering would be impossible without taking  
software into account.  And programmers - whether or not they are  
using formal system engineering methods - should be held as  
responsible to the intrinsic requirements of each project as any other  
engineer.  Projects are defined by their requirements.  Requirements  
are discovered from use cases.  Use cases evolve more rapidly for  
certain kinds of projects - those are simply the projects for which  
software solutions are most appropriate.  Requirement management  
techniques exist precisely to control the subjective aspects of a  
project.  These techniques are even *more* appropriate to software  
than to other engineering disciplines.

It is also naive to suggest that software never rots or rusts.  The  
existence of software is contingent on the vessel containing it.  At  
great ongoing expense one can preserve digital copies indefinitely,  
but entropy will always win (cf. Claude Shannon).  To suggest,  
therefore, that software never fails is naive.  One could similarly  
assert that bridges never fail, by redefining their collapse as an  
exercise in performance art.  Alternately, even the collapse of  
natural bridges (http://earthobservatory.nasa.gov/NaturalHazards/view.php?id=37806 
) may reflect our subjective, but not therefore less real failures  
(human induced climate change).

It is true that software failures tend to reflect failures during  
design, but this is true of bridges as well.  The total system  
involving both must surely include life-cycle maintenance and the  
periodic review of external requirements, such as exponentially  
growing usage patterns exceeding initial assumptions.  All failures  
reveal shortcomings of the human imagination.

The Risk?  Software is only as perfect as its creators.

Rob Seaman <seaman_at_private>

------------------------------

Date: Thu, 13 Aug 2009 08:20:46 -0400
From: Devin Moore <devin.moore_at_private>
Subject: Re: Software never fails ... (Robinson, RISKS-25.75)

I would like to comment on the RISKS-25.75 editorial advancing the idea that
software engineering failures or changes are always subjective.  I agree
that for software engineering projects that are proven to have no existing
bugs, any change from that point forward may be a subjective change because
the product is proven to meet its functional requirements.  However,
software can contain bugs and will fail just like any other engineering
project.  For example, if I build a bridge and it collapses, that failure
was because of a flaw rather than someone's opinion about whether the bridge
is failing or not.

Furthermore, I believe in many circumstances software engineering is
rigorous and formally designed, as in safety-critical systems (1)(2).  In
these cases, opinion is not enough to advance that a system is capable of
serving its desired functionality without failure.

Devin Moore
[I am currently a Ph.D student in Information Systems Science at Nova
Southeastern University]

(1) Ponsard, C; Massonet, P; & Dallons, G.  (2008, October).  From Rigorous
Requirements Engineering to
Formal System Design of Safety-Critical Systems.  *ERCIM News **Special:
Safety-Critical Software*.* (75) *  Retrieved August 9, 2009, from
 http://deploy-eprints.ecs.soton.ac.uk/40/1/EN75-CETIC.pdf

(2) Merino, P.; & Shoitsch, E. (2009).  Introduction to the Special Theme:
Safety-Critical Software.  Retrieved August 9, 2009, from
http://ercim-news.ercim.org/content/view/474/699/

http://www.devinmoore.com  |  http://novastudentlounge.proboards.com

------------------------------

Date: Fri, 14 Aug 2009 14:14:16 +0100
From: Nick Keighley <nick_keighley_nospam_at_private>
Subject: Software never fails ... (Robinson, RISKS-25.75)

> An engineer can determine by experience and judgment that the structure
  is at its lifespan limit or can point to signs of physical rust,
  deterioration, or structure failure indicators that prove their opinion.

This just isn't true. Look at an old street in a European country. Every
building has had substantial changes made to it over time. Building have
changed use. Medieval pubs stand on Roman bath houses and office blocks on
old monastaries. Buildings get removed when they can no longer be adapted
for their new purpose. This is a better model of software maintenance.

Software isn't as different from other designed objects as Mr Robinson thinks.

------------------------------

Date: Thu, 6 Aug 2009 14:50:14 -0700 (PDT)
From: Martin Cohen <mjc_q_at_private>
Subject: Re: Software never fails ... (Robinson, RISKS-25.75)

If software requirements change, and the software no longer meets the
requirements, then it has objectively failed - no opinion needed.

This was definitely one of the weirder risks posts.

------------------------------

Date: Thu, 06 Aug 2009 20:40:35 +0200
From: Dag-Erling Smørgrav <des_at_private>
Subject: Re: Ari Juels, Tetraktys, a `cryptographic thriller' (RISKS-25.75)

> The book, which might be the world's first cryptographic thriller [...]

Not by 10 years:

http://www.amazon.com/Cryptonomicon-Neal-Stephenson/dp/0380973464/

------------------------------

Date: Thu, 29 May 2008 07:53:46 -0900
From: RISKS-request_at_private
Subject: Abridged info on RISKS (comp.risks)

 The ACM RISKS Forum is a MODERATED digest, with Usenet equivalent comp.risks.
=> SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent)
 if possible and convenient for you.   The mailman Web interface can
 be used directly to subscribe and unsubscribe:
   http://lists.csl.sri.com/mailman/listinfo/risks
 Alternatively, to subscribe or unsubscribe via e-mail to mailman
 your FROM: address, send a message to
   risks-request_at_private
 containing only the one-word text subscribe or unsubscribe.  You may
 also specify a different receiving address: subscribe address= ... .
 You may short-circuit that process by sending directly to either
   risks-subscribe_at_private or risks-unsubscribe_at_private
 depending on which action is to be taken.

 Subscription and unsubscription requests require that you reply to a
 confirmation message sent to the subscribing mail address.  Instructions
 are included in the confirmation message.  Each issue of RISKS that you
 receive contains information on how to post, unsubscribe, etc.

=> The complete INFO file (submissions, default disclaimers, archive sites,
 copyright policy, etc.) is online.
   <http://www.CSL.sri.com/risksinfo.html>
 The full info file may appear now and then in RISKS issues.
 *** Contributors are assumed to have read the full info file for guidelines.

=> .UK users should contact <Lindsay.Marshall_at_private>.
=> SPAM challenge-responses will not be honored.  Instead, use an alternative
 address from which you NEVER send mail!
=> SUBMISSIONS: to risks_at_private with meaningful SUBJECT: line.
 *** NOTE: Including the string "notsp" at the beginning or end of the subject
 *** line will be very helpful in separating real contributions from spam.
 *** This attention-string may change, so watch this space now and then.
=> ARCHIVES: ftp://ftp.sri.com/risks for current volume
     or ftp://ftp.sri.com/VL/risks for previous VoLume
 <http://www.risks.org> redirects you to Lindsay Marshall's Newcastle archive
 http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue.
   Lindsay has also added to the Newcastle catless site a palmtop version
   of the most recent RISKS issue and a WAP version that works for many but
   not all telephones: http://catless.ncl.ac.uk/w/r
 <http://the.wiretapped.net/security/info/textfiles/risks-digest/> .
==> PGN's comprehensive historical Illustrative Risks summary of one liners:
    <http://www.csl.sri.com/illustrative.html> for browsing,
    <http://www.csl.sri.com/illustrative.pdf> or .ps for printing
==> Special Offer to Join ACM for readers of the ACM RISKS Forum:
    <http://www.acm.org/joinacm1>

------------------------------

End of RISKS-FORUM Digest 25.76
************************
Received on Sat Aug 15 2009 - 15:26:48 PDT

This archive was generated by hypermail 2.2.0 : Sat Aug 15 2009 - 16:24:34 PDT