Re: LYNX-DEV SSL, Lynx and the USA

[Tom Zerucha]

There is a further complication between ITAR and the first ammendment.
Applied Cryptography, the book is exportable.  The companion floppy disk
which contains excerpts isn't, but this has caused a lawsuit over the
sillyness of the whole thing.  PGP is published as a book with tips on
using OCR programs.

By the way, the book's author has a webpage with an errata section for
the book itself and other information.

So if an offshore location for lynx is found, patches could be published
in a form bearing first ammendment protection (perhaps in the classified
section of a newspaper).  Is email a publication?  News posting?  Faxing?
Web Pages?  Maybe.  The law is contradictory at the moment.

More complicated is the fact that Netscape is exporting browsers with weak
crypto.  But the difference is only a library, though it is statically
linked.  Theoretically it would be possible to create an exportable
libcrypto.so, a US libcrypto.so (using rsaref), and someone outside could
create a fully functional libcrypto.so.  Are unresolved dynamic linking
references "hooks"?  Note that even RSA has RSAeuro - which is their
exportable version of RSAref.

Further, any ability to use proxies could allow for a "hook".  Even if
lynx contained no crypto, but merely passed every snews and https url to
an unencrypted port, a proxy could handle the SSL stuff.  You could
already do that now without any changes with a Socks with an embedded SSL
layer.  There is already a product that does this for Windows based
software, though I haven't looked deeply into it, since I don't use
Windows, and it would be illegal in the US because of the RSA patent.

address@hidden
finger address@hidden for PGP key

;
; To UNSUBSCRIBE:  Send a mail message to address@hidden
;                  with "unsubscribe lynx-dev" (without the
;                  quotation marks) on a line by itself.
;