Internet Surfer 2.0/Internet Surfer 2.0 (Wayzata Technology) (1996).iso/pc/text/mac/faqs.339

Text File | 1996-02-12 | 27.8 KB | 594 lines

Frequently Asked Questions (FAQS);faqs.339



Ordinary splits occur when the company distributes more stock to holders
of existing stock.  A stock split, say 2-for-1, is when a company simply
issues two shares for every one outstanding.  If the stock was at $50
per share, after the split, each share is worth $25, because the company's
net assets didn't increase, only the number of outstanding shares.

Sometimes an ordinary split is referred to as a percent.  A 2:1 split is
a 100% stock split (or 100% stock dividend).   A 50% split would be a 3:2
split (or 50% stock dividend).  You will get 1 more share of stock for
every 2 shares you owned.

Reverse splits occur when a company wants to raise the price of their
stock, so it no longer looks like a "penny stock" but looks more like a
self-respecting stock.  Or they might want to conduct a massive reverse
split to eliminate small holders.  If a $1 stock is split 1:10 the new
shares will be worth $10.  Holders will have to trade in their 10 Old
Shares to receive 1 New Share.

Often a split is announced long before the effective date of the split,
along with the "record date."   Shareholders of record on the record
date will receive the split shares on the effective date (distribution
date). Sometimes the split stock begins trading as "when issued" on or
about the record date.   The newspaper listing will show both the pre-
split stock as well as the when-issued split stock with the suffix "wi."
(Stock dividends of 10% or less will generally not trade wi.)

Theoretically a stock split is a non-event.  The fraction of the company
each of your shares represents is reduced, but you are given enough
shares so that your total fraction of the company owned remains the same.
On the day of the split, the value of the stock is also adjusted so that
the total capitalization of the company remains the same.

In practice, an ordinary split often drives the new price per share up,
as more of the public is attracted by the lower price.  A company might
split when it feels its per-share price has risen beyond what an individual
investor is willing to pay, particularly since they are usually bought
and sold in 100's.  They may wish to attract individuals to stabilize the
price, as institutional investors buy and sell more often than individuals.

-----------------------------------------------------------------------------

Subject: Ticker Tape Terminology
From: [e-mail], [e-mail]

Ticker tape says:        Translation (but see below):
        NIKE68 1/2            100 shares sold at 68 1/2
     10sNIKE68 1/2           1000 shares sold at   "
 10.000sNIKE68 1/2          10000 shares sold at   "

The extra zeroes for the big trades are to make them stand out.  All
trades on CNN and CNBC are delayed by 15 minutes.  CNBC once advertised
a "ticker guide pamphlet, free for the asking", back when they merged
with FNN.  It also has explanations for the futures they show.

However, the first translation is not necessarily correct.  CNBC has
a dynamic maximum size for transactions that are displayed this way.
Depending on how busy things are at any particular time, the maximum
varies from 100 to 5000 shares.  You can figure out the current maximum
by watching carefully for about five minutes.  If the smallest number
of shares you see in the second format is "10s" for any traded security,
then the first form can mean anything from 100 to 900 shares.  If the
smallest you see is "50s" (which is pretty common), the first form
means anything between 100 and 4900 shares.

Note that at busy times, a broker's ticker drops the volume figure and
then everything but the last dollar digit (e.g. on a busy day, a trade
of 25,000 IBM at 68 3/4 shows only as "IBM 8 3/4" on a broker's ticker).
That never happens on CNBC, so I don't know how they can keep up with all
trades without "forgetting" a few.

-----------------------------------------------------------------------------

Subject: Treasury Direct
From: [e-mail]

You can buy T-Bills directly from the US Treasury.  Contact any Federal
Reserve Bank and ask for information on Treasury Direct.  The minimum
for a Treasury Note (2 years and up) is only $5K and in some instances
(I believe 5 year notes) $1K.  There are no fees and you may elect to
have interest payments made directly to your account.  You even may pay
with a personal check, no need for a cashier's or certified check as
Treasury Bills (1 year and under) required.  AAII Journal had an article
on this a couple of years ago. Like they said, the government service is
great, they just do not advertise it well.

-----------------------------------------------------------------------------

Subject: Uniform Gifts to Minors Act (UGMA)
From: [e-mail], [e-mail]

The Uniform Gifts to Minors Act allows you to give $10,000 per year
to any minor, tax free.  You must appoint a custodian.

Some accountants advise that one person should make the gift and
that a different person should be the custoidian, but I have never
seen any IRS publication to justify this, nor any tax case ruling
which makes this a problem.  I suspect some people are just being
conservative.

To give such a gift, go to your friendly neighborhood stockbroker,
bank, mutual fund manager, or (close your eyes now: S&L), etc. and
say that you wish to open a Uniform Gifts (in some states "Transfers")
to Minors Act account.

You register it as:
  [ Name of Custodian ] as custodian for [ Name of Minor ] under the
  Uniform Gifts/Transfers to Minors Act - [ Name of State of Minor's
  residence ]

You use the minor's social security number as the taxpayer ID for this
account.  When you fill out the W-9 form for this account, it will
show this form.  The custodian should certify the W-9 form.

The money now belongs to the minor and the custodian has a legal
fiduciary responsibility to handle the money in a prudent manner for
the benefit of the minor.

So you can buy common stocks but cannot write naked options.  You
cannot "invest" the money on the horses, planning to donate the
winnings to the minor.  And when the minor reaches age of majority -
usually 18 - the minor can claim all of the funds even if that's
against your wishes.  You cannot place any conditions on those funds
once the minor becomes an adult.

Until the minor reaches 14, the first $500 earned by the minor is
tax free, the next $500 is taxed at the minor's rate, and the rest
is taxed at the higher of the minor's or the parent's rate.  After
the minor reaches 14, all earnings over $500 are taxed at the
minor's rate.

Note that if you want to continue doing your childs taxes even after
they turn 18, there is no reason they need to know about their UGMA
account that you set up for them.  They certainly can't blow their
college fund on a Trans Am if they don't know about it.

Even if your child does his/her own taxes, you can still give them
gifts through a trust without them knowing about it until they are
more mature.  Call and ask Twentieth Century Investors for information
about their GiftTrust fund.  The fund is entirely composed of trusts
like this.  The trust pays its own taxes.

-----------------------------------------------------------------------------

Subject: Warrants
From: [e-mail]

There are many meanings to the word warrant.

The marshal can show up on your doorstep with a warrant for your arrest.

Many army helicopter pilots are warrant officers, who have received
a warrant from the president of the US to serve in the Army of the
United States.

The State of California ran out of money earlier this year and
issued things that looked a lot like checks, but had no promise to
pay behind them.  If I did that I could be arrested for writing a
bad check.  When the State of California did it, they called these
thingies "warrants" and got away with it.

And a warrant is also a financial instrument which was issued with
certain conditions.  The issuer of that warrant sets those conditions.
Sometimes the warrant and common or preferred convertible stock are
issued by a startup company bundled together as "units" and at some
later date the units will split into warrants and stock.  This is a
common financing method for some startup companies.  This is the
"warrant" most readers of the misc.invest newsgroup ask about.

As an example of a "condition," there may be an exchange privilege
which lets you exchange 1 warrant plus $25 in cash (or even no cash
at all) for 100 shares of common stock in the corporation, any time
after some fixed date and before some other designated date.
(And often the issuer can extend the "expiration date.")

So there are some similarities between warrants and call options for
common stock.

Both allow holders to exercise the warrant/option before an
expiration date, for a certain number of shares.  But the option is
issued by independent parties, such as a member of the Chicago Board
Options Exchange, while the warrant is issued and guaranteed by the
corporate issuer itself.  The lifetime of a warrant is often
measured in years, while the lifetime of a call option is months.

Sometimes the issuer will try to establish a market for the warrant,
and even try to register it with a listed exchange.  The price can
then be obtained from any broker.  Other times the warrant will be
privately held, or not registered with an exchange, and the price
is less obvious, as is true with non-listed stocks.

-----------------------------------------------------------------------------

Subject: Zero-Coupon Bonds
From: [e-mail]

Not too many years ago every bond had coupons attached to it.  Every
so often, usually every 6 months, bond owners would take a scissors
to the bond, clip out the coupon, and present the coupon to the bond
issuer or to a bank for payment.  Those were "bearer bonds" meaning
the bearer (the person who had physical possession of the bond) owned
it.  Today, many bonds are issued as "registered" which means even if
you get to touch the actual bond at all, it will be registered in your
name and interest will be mailed to you every 6 months. It is not too
common to see such coupons. Registered bonds will not generally have
coupons, but may still pay interest each year.  It's sort of like the
issuer is clipping the coupons for you and mailing you a check.  But
if they pay interest periodically, they are still called Coupon Bonds,
just as if the coupons were attached.

When the bond matures, the issuer redeems the bond and pays you the
face amount.   You may have paid $1000 for the bond 20 years ago and
you have received interest every 6 months for the last 20 years, and
you now redeem the matured bond for $1000.

A Zero-coupon bond has no coupons and there is no interest paid.

But at maturity, the issuer promises to redeem the bond at face value.
Obviously, the original cost of a $1000 bond is much less than $1000.
The actual price depends on: a) the holding period -- the number of
years to maturity, b) the prevailing interest rates, and c) the risk
involved (with the bond issuer).

Taxes:  Even though the bond holder does not receive any interest while
holding zeroes, in the US the IRS requires that you "impute" an annual
interest income and report this income each year.  Usually, the issuer
will send you a Form 1099-OID (Original Issue Discount) which lists the
imputed interest and which should be reported like any other interest
you receive.  There is also an IRS publication covering imputed interest
on Original Issue Discount instruments.

For capital gains purposes, the imputed interest you earned between the
time you acquired and the time you sold or redeemed the bond is added to
your cost basis.  If you held the bond continually from the time it was
issued until it matured, you will generally not have any gain or loss.

Zeroes tend to be more susceptible to prevailing interest rates, and
some people buy zeroes hoping to get capital gains when interest rates
drop. There is high leverage.   If rates go up, they can always hold them.

Zeroes sometimes pay a better rate than coupon bonds (whether registered
or not).  When a zero is bought for a tax deferred account, such as an
IRA, the imputed interest does not have to be reported as income, so
the paperwork is lessened.

Both corporate and municipalities issue zeroes, and imputed interest on
municipals is tax-free in the same way coupon interest on municipals is.
(The zero could be subject to AMT).

Some marketeers have created their own zeroes, starting with coupon
bonds, by clipping all the coupons and selling the bond less the coupons
as one product -- very much like a zero -- and the coupons as another
product. Even US Treasuries can be split into two products to form a
zero US Treasury.

There are other products which are combinations of zeroes and regular
bonds.  For example, a bond may be a zero for the first five years of
its life, and pay a stated interest rate thereafter.  It will be treated
as an OID instrument while it pays no interest.

(Note:  The "no interest" must be part of the original offering; if a
cumulative instrument intends to pay interest but defaults, that does not
make this a zero and does not cause imputed interest to be calculated.)

Like other bonds, some zeroes might be callable by the issuer (they are
redeemed) prior to maturity, at a stated price.

-----------------------------------------------------------------------------

Compiler's Acknowledgements:
My sincere thanks to the many submitters for their efforts.  Also thanks to
Jonathan I. Kamens for his guidance on FAQs and his post_faq perl script.

Compilation Copyright (c) 1992 by Christopher Lott, [e-mail]
--
Christopher Lott    [e-mail]   [phone], -3331 Fax
Post: FB Informatik - Bau 57, Universitaet KL, W-6750 Kaiserslautern, Germany
Xref: bloom-picayune.mit.edu comp.protocols.kerberos:1896 news.answers:4614
Newsgroups: comp.protocols.kerberos,news.answers
Path: bloom-picayune.mit.edu!athena.mit.edu!bjaspan
From: [e-mail] (Barry Jaspan)
Subject: Kerberos Users' Frequently Asked Questions 1.2
Message-ID: <kerberos-faq/[e-mail]>
Followup-To: poster
Summary: This document answers Frequently Asked Questions about the
    Kerberos authentication system.  Read this before you post a
    question to comp.protocols.kerberos or [e-mail].
Sender: [e-mail] (News system)
Supersedes: <kerberos-faq/[e-mail]>
Nntp-Posting-Host: bill-the-cat.mit.edu
Organization: Aktis, Inc.
Date: Wed, 16 Dec 1992 01:10:35 GMT
Approved: [e-mail]
Expires: Wed, 13 Jan 1993 01:10:25 GMT
Lines: 549

Archive-name: kerberos-faq/user
Version: 1.2

Kerberos Users' Frequently Asked Questions
December 15, 1992
Compiled by: Barry Jaspan, <[e-mail]>
             Aktis, Inc.

     Kerberos; also spelled Cerberus.  "n.  The watch dog of
     Hades, whose duty it was to guard the entrance--against
     whom or what does not clearly appear; .  . . is known to
     have had three heads. . ."

        -Ambrose Bierce, The Enlarged Devil's Dictionary

This document answers Frequently Asked Questions about the Kerberos
authentication system.  It is freely distributable.  Direct all
responses and questions to [e-mail].  Most of the
information presented here has been collected from postings to the
comp.protocols.kerberos newsgroup (gatewayed to the mailing list
[e-mail]) and in general credit has not been given;
complain if you feel offended.

DISCLAIMER: Aktis, Inc., makes no representations about the
suitability of this information for any purpose.  It is provided "as
is" without express or implied warranty.  In particular, this document
is not intended as legal advice for exporting Kerberos, DES, or any
other encryption software.

Please make suggestions and contribute any information that you can.

Questions addressed in this release:
    (a * indicates that no answer is currently available)

1.  Kerberos and its Many Incarnations
----------------------------------------------------------------------

(1.1)    What is Kerberos?  What is it good for?
(1.2)    Where can I get Kerberos version 4 or 5?
(1.3)    What is the current status of version 4?
(1.4)    What is the current status of version 5?
(1.5)    Are version 4 and version 5 compatible?
(1.6)    How/why is Transarc's Kerberos different from MIT Kerberos V4?
    Can they interoperate?
(1.7)*    How/why is OSF DCE Kerberos different from MIT Kerberos V5?
    Can they interoperate?
(1.8)    How/why is DEC Ultrix Kerberos different from MIT Kerberos V4?
    Can they interoperate?
(1.9)    What is Bones?  What is it for?

2.  Using and Administering Kerberos
----------------------------------------------------------------------

(2.1)    Can I use Kerberos for local password validation?
(2.2)    What is the export status of Kerberos?
(2.3)    How can I delete a principal from the database?
(2.4)    What are the officially assigned Kerberos port numbers?
(2.5)    Are there Kerberos versions of telnet and ftpd?
    What other Kerberos clients exist?
(2.6)    Why does rlogin print "Warning: No Kerberos tickets obtained"?
(2.7)    What operating systems has Kerberos been ported to?
    What vendors provide commercial support for Kerberos?

3.  Building and Installing Kerberos
----------------------------------------------------------------------

(3.1)    Why do I get an error message from ld when make_commands is
    executed?
(3.2)    Why doesn't KRB5_defs.h exist when I build version 5?

4.  Miscellaneous
----------------------------------------------------------------------

(4.1)    List references for Kerberos and network security in general.
(4.2)    Where are archives of comp.protocols.kerberos (a.k.a
    [e-mail])?

======================================================================

1.  Kerberos and its Many Incarnations
----------------------------------------------------------------------

(1.1)    What is Kerberos?  What is it good for?

The following is an excerpt from [1]:

   Kerberos is a trusted third-party authentication service based on
   the model presented by Needham and Schroeder.[3] It is trusted in
   the sense that each of its clients believes Kerberos' judgement as
   to the identity of each of its other clients to be accurate.

[This really isn't a very good description.]

It is important to realize that Kerberos is a one-trick pony.  It
provides for mutual authentication between principals on an open
network.  It does not provide a mechanism for authorization; that is
left to the application.  It also does not provide password validation
for individual workstations unless care is taken; see question 2.1.

(1.2)    Where can I get Kerberos version 4 or 5?

In the United States and Canada (*), Kerberos is available via
anonymous FTP from athena-dist.mit.edu (18.71.0.38).  For specific
instructions, cd to pub/kerberos and get the file README.KRB4 (for
version 4) or README.KRB5_BETA2 (for version 5).  Note that *YOU WILL
NOT BE ABLE TO RETRIEVE KERBEROS WITHOUT READING THIS FILE*.

Outside the United States, you can get Bones via anonymous ftp from
ftp.funet.fi (128.214.6.100) in pub/unix/security/kerberos.  A DES
library is available from the same place.  See question 1.9 for
information on Bones.

(*) Kerberos and DES can be exported to Canada.  See question 2.2.

(1.3)    What is the current status of version 4?

With the release of patch level 10 on December 10, 1992, MIT Kerberos
4 is now in its final form.  MIT does not anticipate ever making a new
Kerberos 4 release.

Several vendors provide their own versions of Kerberos which may
contain improvements or extensions; see question 2.7.

(1.4)    What is the current status of version 5?

A new beta release of MIT Kerberos V5 is available as of September 30,
1992; see question 1.2.  This release brings MIT's implementation into
full compliance with the current protocol.  It is not backwards
compatible with the previous beta release; according to MIT, this is
the last release that will contain non-backwards compatible changes.

(1.5)    Are version 4 and version 5 compatible?

No.  Versions 4 and 5 are based on completely different protocols.
The MIT Kerberos V5 distribution contains some compatibility code,
however: (a) there is a library which converts Kerberos V4 library
calls into Kerberos V5 requests, so you can run many V4 programs in a
V5 environment by relinking; (b) the Kerberos server can optionally
service V4 requests; (c) there is a program to convert a V4 format
Kerberos database to a V5 format database.  The names used by the V5
library have a prefix "krb5_" so they do not conflict with the V4
library.

(1.6)    How/why is Transarc's Kerberos different from MIT Kerberos V4?
    Can they interoperate?

This is a fairly complex question, and my answer is almost guaranteed
to be incomplete.  The issue is regularly discussed on the
[e-mail] mailing list; send mail to the -request
list for subscriptions.

Years ago, the designers of AFS decided to implement their own
security system based on the Kerberos specification instead of using
the (then, not yet publicly available) MIT Kerberos V4.  As a result,
Transarc's AFS Kerberos speaks a different protocol but also
understands the MIT Kerberos V4 protocol.  They can, in principal,
talk to each other; however, there are a sufficient number of annoying
details and an insufficient number of advantages such that it may not
be practical.

The two versions use a different string-to-key function (the algorithm
that turns a password into a DES key); the AFS version uses the realm
name as part of the computation while the MIT version does not.  A
program that uses a password to acquire a ticket (e.g.  kinit or
login) will only work with one version.

The two versions also use a different method of finding Kerberos
servers.  MIT Kerberos uses /etc/krb.conf and /etc/krb.realms to map
hostnames to realms and realms to Kerberos servers.  AFS kaservers for
a realm, by definition, are located on the AFS database servers and
can therefore be located using /usr/vice/etc/CellServDB.  This means
that a program built using the MIT Kerberos libraries will look in one
place for the information while a program built using the AFS Kerberos
libraries will look in another.  You can certainly set up all three
files and use both libraries, but be sure that everything is
consistent.

The two versions have a different password changing protocol, so you
must use the correct 'kpasswd' program for the server you are talking
to.  In general, AFS clients that talk directly to the kaserver use an
Rx-based protocol, instead of UDP as with MIT Kerberos, so those AFS
clients cannot talk to an MIT server.

In summary, AFS Kerberos and MIT Kerberos can interoperate once you've
acquired a ticket granting ticket, which you can do with kinit (MIT)
or klog (AFS, use the version that writes a ticket file).  With a tgt,
Kerberos applications such as rlogin can talk to an MIT or AFS
Kerberos server and achieve correct results.  However, it is probably
best to pick one implementation and use it exclusively

(1.7)*    How/why is OSF DCE Kerberos different from MIT Kerberos V5?
    Can they interoperate?

(1.8)    How/why is DEC Ultrix Kerberos different from MIT Kerberos V4?
    Can they interoperate?

DEC ULTRIX contains Kerberos for a single reason, namely, to provide
authenticated name service for the ULTRIX enhanced security option.
It does not support user-level authentication in the normal manner.

DEC's version is essentially the same as (and derived from) MIT
Kerberos V4 with a few changes.  The most significant change is that
the ability to perform any kind of end-to-end user data encryption has
been eliminated in order to comply with export restrictions.  Minor
changes include the placement of ticket files (/var/dss/kerberos/tkt
vs. /tmp) and the principal names used by some standard Kerberos
services (e.g.: kprop vs. rcmd); there are probably other minor
changes as well.

These changes make it annoying but not impossible to use DEC ULTRIX
Kerberos in the normal way.  However, there is no reason at all to do
so, because the MIT distribution supports ULTRIX directly.  [This may
not be completely true.  I imagine that using ULTRIX Kerberos for
enhanced security and MIT's Kerberos at the same time would cause
problems.  Has anyone tried this?]

(1.9)    What is Bones?  What is it for?

Bones is a system that provides the Kerberos API without using
encryption and without providing any form of security whatsoever.  It
is a fake that allows the use of software that expects Kerberos to be
present when it cannot be.

Why does it exist?  Kerberos is a network security system which relies
on cryptographic methods for its security.  Since Kerberos' encryption
system, DES, is not exportable, Kerberos itself cannot be exported or
used outside of the United States in its original form.  (See question
2.2 for more information.)

As a partial solution to this problem, the Kerberos source code was
modified by the addition of #ifdef NOENCRYPTION around all calls to
DES functions.  Compiling this version with the symbol NOENCRYPTION
defined results in a system that looks like Kerberos from an
application's point of view but that does not require DES libraries
(and, as a result, does not speak the real Kerberos protocol and does
not provide any security).

The final piece in this puzzle is a program called "piranha" which
takes the Kerberos sources and removes all of the calls to the
encryption routines, replacing it with the code which was under #ifdef
NOENCRYPTION, producing the system known as Bones.  Bones has the
property that there is absolutely no question about whether or not it
is legal to transport its sources across national boundaries, since it
neither has any encryption routines nor any calls to encryption
routines.

#ifdef NOENCRYPTION was not documented, and it was only intended to be
used in the above manner.  Someone who tries compiling Kerberos with
that #define has in some sense "voided the warranty", and will get
something which is both (a) not secure and (b) not Kerberos.

2.  Using and Administering Kerberos
----------------------------------------------------------------------

(2.1)    Can I use Kerberos for local password validation?

Yes, but only under certain circumstances and only if you are
careful.

Requests for Kerberos ticket granting tickets (tgts) (e.g. from kinit
or login) are sent in plaintext to the Kerberos server, which then
responds with credentials encrypted in the requesting principal's
secret key.  The program then attempts to decrypt the data with the
supplied password and considers the authentication "successful" if the
decryption appears to yield meaningful results (such as the correct
principal name).

The problem here is that the requesting program cannot know for sure
whether the decryption succeeded or, more importantly, whether the
response actually came from the Kerberos server.  An attacker could,
for example, walk up to an unattended machine and "log in" as a
non-existent user.  Kerberos will eventually respond with an
appropriate error, but the attacker can arrange for another program to
deliver a fake response to login first; he then types the correct
password (which he knows because he created the fake response in the
first place) and succeeds in spoofing login.

The solution to this problem is for login to verify the tgt by using
it to acquire a service ticket with a known key and comparing the
results.  Typically, this means requesting an rcmd.<hostname> ticket,
where <hostname> is the local hostname, and checking the response
against the key store in the machine's /etc/srvtab file.  If the keys
match then the original tgt must have come from Kerberos (since the
key only exists in the srvtab and the Kerberos database), and login
can allow the user to log in.

The solution works only so long as the host has a srvtab containing an
rcmd.<hostname> (or any other standard principal) entry.  This is fine
for physically secure or single-user workstations, but does not work
on public workstations in which anyone could access the srvtab file.

(2.2)    What is the export status of Kerberos?

There is a tremendous amount of confusion on this topic.