MIME and PGP (was: Gnus and Crypto stuff)

MIME and PGP (was: Gnus and Crypto stuff)

[Jack Vinson]

The message from our Stainless Steel Rat is supposed to be a MIME message,
but pgnus 0.62 read it as a flat text file, so I saw the lovely message:
     This is a MIME multipart message.  If you are reading
     this, you shouldn't.

Actually, this message was inserted twice.  Once before the beginning of
the PGP signature and once after.  It looked to me like there should have
been about three parts, but that the PGP signature broke the MIME parsing
somehow.


-- 
Jack Vinson <jvinson@chevax.ecs.umass.edu>    http://www.cis.upenn.edu/~vinson/
Zippy: I'm also against BODY-SURFING!!

Re: MIME and PGP (was: Gnus and Crypto stuff)

[Norbert Koch]

Jack Vinson <jvinson@chevax.ecs.umass.edu> writes:

> The message from our Stainless Steel Rat is supposed to be a MIME message,
> but pgnus 0.62 read it as a flat text file, so I saw the lovely message:
>      This is a MIME multipart message.  If you are reading
>      this, you shouldn't.

[...]

Same with 0.65.

-- 
Then, it's off to RED CHINA!!

Re: MIME and PGP (was: Gnus and Crypto stuff)

[Karl Kleinpaste]

Jack Vinson <jvinson@chevax.ecs.umass.edu> writes:
> It looked to me like there should have been about three parts, but
> that the PGP signature broke the MIME parsing somehow.

Assuming that one wants to PGP-sign an entire message, one needs the
ability for Gnus to MIME-encode the whole thing and then let MailCrypt
do its PGP thing to the result.  Similarly, on receipt, we need the
ability to make gnus-article-hide-pgp happen rather early on, followed
by MIME decoding.  The fundamental problem we're up against is that,
at least for the recipient, PGP armor is removed rather late in the
game, long after Gnus has reached its conclusions about the MIME
components in the message.  PGP needs to be the last thing added and
the first thing removed.

I'm not really sure what semantic would be in order, if one wanted to
PGP-sign individual components of a message, rather than the whole
thing.

Re: MIME and PGP (was: Gnus and Crypto stuff)

[Karl Kleinpaste]

Stainless Steel Rat <ratinox@peorth.gweep.net> writes:
> If you have gnus-article-hide-pgp in your gnus-article-prepare-hook,
> everything comes out all hunky-dory.

Oh!  That's the piece I was missing.  I'd forgotten about the
-prepare-hook, being stuck only on the -display-hook.  /mutter/

Re: MIME and PGP (was: Gnus and Crypto stuff)

[Jack Vinson]

>>>>> "KK" == Karl Kleinpaste <karl@justresearch.com> writes:

KK> Jack Vinson <jvinson@chevax.ecs.umass.edu> writes:
>> It looked to me like there should have been about three parts, but
>> that the PGP signature broke the MIME parsing somehow.

KK> Assuming that one wants to PGP-sign an entire message, one needs the
KK> ability for Gnus to MIME-encode the whole thing and then let MailCrypt
KK> do its PGP thing to the result.  Similarly, on receipt, we need the
KK> ability to make gnus-article-hide-pgp happen rather early on, followed
KK> by MIME decoding.  The fundamental problem we're up against is that,
KK> at least for the recipient, PGP armor is removed rather late in the
KK> game, long after Gnus has reached its conclusions about the MIME
KK> components in the message.  PGP needs to be the last thing added and
KK> the first thing removed.

KK> I'm not really sure what semantic would be in order, if one wanted to
KK> PGP-sign individual components of a message, rather than the whole
KK> thing.

At least for message-send, the current set of actions is something like
	- fixup the message
	- encode the message body
	- run message-send-hook
	- send the message
		- message-header-hook, message-send-mail-hook or
		  message-send-news-hook 
	- deal with fcc
	- run message-sent-hook
	- housekeeping

It looks like message-send-mail/news-hook are run with the final version of
the message (i.e. just before it goes out to the world).  I am guess this
is where the pgp stuff *should* be called.  But that means adding pgp to
two hooks instead of just one.

As I mentioned earlier, I would like a hook that is called before the
message body is encoded so that things like ispell-message don't have to
deal with the MIME stuff.

-- 
Jack Vinson <jvinson@chevax.ecs.umass.edu>    http://www.cis.upenn.edu/~vinson/
Zippy: I'm shaving!!  I'M SHAVING!!

Re: MIME and PGP (was: Gnus and Crypto stuff)

[Robert Bihlmeyer]

Hi,

>>>>> On 11 Dec 1998 10:27:02 -0500
>>>>> Stainless Steel Rat <ratinox@peorth.gweep.net> said:

 Rat> If you have gnus-article-hide-pgp in your
 Rat> gnus-article-prepare-hook, everything comes out all hunky-dory.

There are mailers other than gnus, I saw them myself, I swear ...

aaaaargh CARRIER LOST

-- 
Robert Bihlmeyer	reads: Deutsch, English, MIME, Latin-1, NO SPAM!
<robbe@orcus.priv.at>	<http://stud2.tuwien.ac.at/~e9426626/sig.html>

Re: Gnus and Crypto stuff

[Lars Magne Ingebrigtsen]

Stainless Steel Rat <ratinox@peorth.gweep.net> writes:

> Of particular note, software released under the GPL, such as Gnus,
> is by definition "made available without restrictions upon its
> further dissemination."  In other words, as far as Wassenaar is
> concerned, Gnus is in the public domain (even if they are misusing
> the term "public domain").

I'm not quite sure -- they use "without restrictions", and all GPL'd
software has one restriction -- it's impossible to impose further
restrictions.  :-)

Anyway, I don't understand what the point of Wassenar is.  Crypto
software is everywhere and imposing these weird export restrictions
is, well, weird.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@gnus.org * Lars Magne Ingebrigtsen

Re: Gnus and Crypto stuff

[Dave Love]

A citation for the `GENERAL SOFTWARE NOTE' would be useful in view of
the current GNU appeal for volunteers outside the afflicted countries
to do crypto work.

Re: Gnus and Crypto stuff

[Hrvoje Niksic]

Dave Love <d.love@dl.ac.uk> writes:

> A citation for the `GENERAL SOFTWARE NOTE' would be useful in view
> of the current GNU appeal for volunteers outside the afflicted
> countries to do crypto work.

On a different note: is the agreement retroactive?  I mean, are my old 
programs suddenly unexportable?

The reason why I ask is this: for instance, I have a feeling that
Croatia didn't sign the agreement not because the government would
disagree, but simply because we are out of the general loop.  If, a
few years from now, Croatia signs the agreement, will my potential
crypto become endangered wrt export?

Re: Gnus and Crypto stuff

[Dave Love]

>>>>> "HN" == Hrvoje Niksic <hniksic@srce.hr> writes:

 HN> On a different note: is the agreement retroactive?  I mean, are
 HN> my old programs suddenly unexportable?

One would rather expect so if this sort of law was enacted...

I found the citation anyhow:
<URL:http://jya.com/wa/watoc.htm#General>; see also the `definitions
of terms' link from the same page.  Not that it looks as though that
will be relevant under the current regime in the UK :-(.

-- 
There's no reason for it Minister, it's just policy.  -- Humphrey Appleby

Re: Gnus and Crypto stuff

[David Hedbor]

Stainless Steel Rat <ratinox@peorth.gweep.net> writes:

> Hash: SHA1
> 
> "Hrvoje" == Hrvoje Niksic <hniksic@srce.hr> writes:
> 
> Hrvoje> On a different note: is the agreement retroactive?  I mean, are my
> Hrvoje> old programs suddenly unexportable?
> 
> Wassenaar is more or less 33 nations saying, "we think these are good
> ideas".  Compliance with Wassenaar is not mandatory for any of the
> signatory nations.  It is not law unless your government institutes
> Wassenaar or some variant into law.  AFAIK, no nation has yet done so.

This is unfortunately incorrect. For example Sweden has had strict
Crypto export laws since 1995 (from the first Wassenaar I
believe). Also ISP has imposed stronger restriction on export of Roxen 
than the law required due to a possible future stricter, US-friendly
law. I don't know the exact details, but Sweden is just as bad as the
US, if not worse.

Also Microsoft has been a strong force behind the new Wassenaar, since 
they want equal possibilities to sell crypto software outside of the US 
(of course non-US companies has a much harder time in the US because
of it). Anyway, http://www.roxen.com/crypto/ is a good place for more
information about the Swedish crypto situation.

-- 
[ Below is a random fortune, which is unrelated to the above message. ]
During the voyage of life, remember to keep an eye out for a fair wind; batten
down during a storm; hail all passing ships; and fly your colors proudly.

Re: Gnus and Crypto stuff

[Johan Danielsson]

David Hedbor <david@hedbor.org> writes:

> For example Sweden has had strict Crypto export laws since 1995
> (from the first Wassenaar I believe).

This is not really correct either. The law very clearly says that you
can export (publicly available) software. ISP's (the strategic arms
control authority) interpretation of the law is very different from
what other make out of it.

/Johan

Re: Gnus and Crypto stuff

[David Hedbor]

joda@pdc.kth.se (Johan Danielsson) writes:

> David Hedbor <david@hedbor.org> writes:
> 
> > For example Sweden has had strict Crypto export laws since 1995
> > (from the first Wassenaar I believe).
> 
> This is not really correct either. The law very clearly says that you
> can export (publicly available) software. ISP's (the strategic arms
> control authority) interpretation of the law is very different from
> what other make out of it.

I said that ISP does impose stricter rules than the law in preparation 
for possible future changes (or so they say).

-- 
[ Below is a random fortune, which is unrelated to the above message. ]
And on the seventh day, He exited from append mode.

Re: Gnus and Crypto stuff

[Jason R Mastaler]

Lars Magne Ingebrigtsen <larsi@gnus.org> writes:

> Anyway, I don't understand what the point of Wassenar is.  Crypto
> software is everywhere and imposing these weird export restrictions
> is, well, weird.

For those of you who disagree with the Wassenaar Arrangement, I'd
recommend voicing these concerns to your respective governments.
Visit <URL:http://www.freecrypto.org/> for more info.