July 1993 - cypherpunks-legacy

Re: Ad Hominum attacks (was Re: PC Week Clipper article
by tcmay＠netcom.com 04 Jul '93

04 Jul '93

I largely agree with Pat Farrell's comments about the vicious attacks on various crypto folks. I was the one who jokingly used the term "wicked witch of the East" in reference to D.D., though I am almost 100% certain it was only to this mailing list, and not to sci.crypt in general. Perhaps I let my enthusiasm for my wit take precedence over judgment. And in other places, such as sci.crypt, I have in fact defended Denning against ignorant comments along the lines of "Who is this Dorothy Denning person? I can't find her name anywhere in "The Codebreakers." She must not know anything about crypto." Whatever we may think of her position on Clipper, criticizing her personally and imputing motives to her that cannot possibly be known to outsiders, is foolish. What really bothers me is the type of criticism, which I also tend to call "ad hominem" (but which rhetoriticians may have a special name for), in which people impute _motives_ to others. Thus, we see seemingly endless comments about the motives of Denning, of Bidzos, of Sternlight, and of others. (When I posted on the topic of possible cooperation with Bidzos and RSA, I was hit with a barrage of highly critical rebuttals. The substantive ones were fine, and expected, but the ones speculating on my motives and imputing evilness to me were uncalled for. I wrote them off as typical Net zeal, and am still on good terms even with those who foamed at the mouth the most.) "Demonizing" our opponents, or making them look like dunces (as with the many "I've never heard of Dorothy Denning before" posts), does not help our cause. In fact, it probably weakens our cause, for two reasons. First, it cuts off dialog with those we disagree with. Second, we tend to underestimate people we have written off as stooges or dunces. While I think Dorothy Denning is, for various reasons, hopelessly in the camp of the NSA and FBI, I see nothing to be gained by demonizing her. Or imputing evil qua evil motives. Personally, I think being close to the FBI, Justice Dept., NIST, NSA, etc., and socializing with them, having lunch with them, doing contract work for them (nothing evil about that, per se...it's how academic departments fund their research), and generally being in "the Washington scene" has polarized her somewhat, just as we Cypherpunks are polarized by the support we get from our peer group, from the "cognitive dissonance" of seeing mostly the evidence that supports our existing point of view. When you spend your time in a milieu, work with people on their problems, you begin to adopt their world view. Understand, of course, that I am not addressing the underlying issues of who is right and who is wrong...I've already made my beliefs on this clear. I'm just agreeing with Pat Farrell that we all need to be careful not to demonize folks like Denning, Bidzos, or even Sternlight. We don't have to be solicitous (overly polite) toward them, and we can knock down their arguments, but we ought not to use cheap shots and cheap rhetorical tricks (one I hate especially is the "sound effect" jab, the "<snicker, snicker>" sort of comment inserted into postings, sometimes even into the direct quotes of those being attacked!). Pat writes: >Even more annoying are the attacks on Jim Bidzos. He is trying to make a >buck, which was legal last time I looked. And on many issues, he is far more >in our camp than against us. He at least likes strong cryptography, and his >disputable patents expire in a relatively short time. He has agreed to allow >a PGP-compatible program to use RSA without cost, providing the legal >version that many U.S. users would like to see. I agree, though of course he and RSADSI did not fight as hard as they might have, in my opinion, on the subject of the cross-licensing with the DSS and Clipper/Skipjack products. I don't pretend to understand all of the issues involved, though I certainly can imagine he felt a lot more pressure (legal, export, classification) from the Feds than he felt from a loose organization of crypto privacy advocates. We're not where the money is, at least not yet. (In fact, Cypherpunks are generally not even customers of RSADSI, so why should Bidzos really care about our views? The industry security group that has denounced Clipper is undoubtedly much more influential.) Meanwhile, I have no real interest, personally, in the whole RSA v. PGP issue...let those directly involved work it all out. I will applaud loudly if Phil Z. and the other PGP folks do in fact reach an agreement with RSADSI, if only because it will remove one possible avenue of attack on private encryption. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: by arrangement Note: I put time and money into writing this posting. I hope you enjoy it.

3 2

Re: "Wired" has more than one cover--why? (fwd)
by mkapor＠kei.com 04 Jul '93

04 Jul '93

They decided that West Coast covers should feature Peter Gabriel and the East Coast covers Mitch Kapor. Something about rock and roll playing better on newsstands than policy everywhere but the Northeasteast corridor. All subscribers got the Gabriel cover. As the Wired editor told me this split cover was a last minute decision and a first-time experiment. The Cypherpunks were on the cover all of copies of issue #2. ------------------------------------------------------------------------------ Mitchell Kapor, Electronic Frontier Foundation Note permanent new email address for all correspondence as of 6/1/93 mkapor(a)kei.com

1 0

Reply to Michael's criticism of Tim
by wet!naga 04 Jul '93

04 Jul '93

I think Michael's reaction to Tim's experiment re alt.binaries.pictures.erotica.children deserves comment. >Date: Sat, 3 Jul 93 06:55:56 -0700 >From: Michael Ross <mross(a)antigone.com> >Subject: Re: (fwd) GIFs--Now it can be told > >Tim, > >That was very manipulative, and did not achieve much. Who was manipulated? Those who reacted did so freely. As Tim said, it was an experiment, not an attempt to achieve anything. The point was to see what would happen. >It has also very little to do with the subject of this mailing list. This mailing list is about encryption and other matters. The use of PGP to distribute erotica is thus a relevant topic. >If anything, you discouraged at least one person I know who became >genuinely interested in encryption and PGP as a result of your post. Tough. >As it turns out, you hid behind a pretty lame scheme, the only object >of which seems to have been to make a fool out of as many people as >possible. I think Michael has missed the point. >This is not how you accomplish constructive change, Tim. >People resent being made to feel stupid, and they certainly will >_not_ listen to what you have to say if you are belittling them. I don't recall Tim's belittling anyone - except perhaps the Net.Censors - who certainy deserve it. I don't think we need be too concerned about hurting their feelings. After all, they plan on doing worse to us. >I happen to agree with those points you deigned to make in a >straightforward manner. But you hid them so well behind trickery that >they will go unnoticed. On the contrary, were it not for the trickery some folks wouldn't bother reading Tim's comments on this subject. >Learn to deal with people, and you'll see >they are willing to listen to reasonable arguments. Ha! Chortle! Where you been all your life, Michael? People listen to reasonable arguments only when it suits them to. >If your parents didn't give you enough attention as a child, don't >take it out on the world by trying to get some here... Learn to work >_with_ people, not _against_ people, lest within ten years ... Garbage. If we are to go into spurious psychoanalysis then I think Michael's post reveals that he is still fixated on pleasing his parents by being a good little boy and not giving anyone any trouble. Fact is, there are people in the world who want to restrict our freedom and make us behave in ways they think best. Fuck 'em all!

1 0

test
by Stanton McCandlish 04 Jul '93

04 Jul '93

Hmm no mail in weeks from this list...I ass-u-me the problem is on my end, so here be a test message. Blah blah blah. -- Stanton McCandlish * Space Migration * Networking * ChaOrder * NO GOV'T. * anton(a)hydra.unm.edu * Intelligence Increase * Nano * Crypto * NO RELIGION * FidoNet: 1:301/2 * Life Extension * Ethics * VR * Now! * NO MORE LIES! * Noise in the Void BBS * +1-505-246-8515 (24hr, 1200-14400, v32bis, N-8-1) *

1 0

Re: (fwd) GIFs--Now it can be told
by tcmay＠netcom.com 04 Jul '93

04 Jul '93

(I'll only make a few comments.) Ed Carp writes: >> There are some quasi-legitimate issues surrounding the area of child >> erotica. Was the child coerced? Was consent meaningful? Etc. > >There are no quasi-legitimate issues surrounding child pornography in the >United States. It doesn't matter, legally whether consent was obtained or >not, etc. Child pornography is not legal. To make, sell, possess, distribute, >or conspire to do any of the above is a crime. I meant "quasi-legitimate" in the sense of being at least a real criminal issue. By contrast, merely discussing the issues cannot possibly be a crime, nor can, IMHO, the creation of such a group absent actual evidence of criminality. Sort of like shutting down "alt.drugs" on the grounds that illegal drugs are often discussed. (We can all think of several dozen newsgroups that touch on subjects illegal in many states of the U.S., in many countries of the world, etc.) >In the US, it doesn't matter what their actual ages are - if they are >depicted as being under the age of consent, they are illegal. Ah, but what if no mention is made of the age? If I happen to have a collection of pictures of 19-year-olds-who-look-15, because of my own esthetic standards, is this illegal? It sounds totally legal to me, and I think a court opinion will ultimately be rendered that so long as the models actually are over 18, no matter how young they look, no crime as ocurred. (Actually, the various "cheerleader porn" films cater to this fantasy and are not classed as child porn, so long as the actresses are 18 or older.) On purely computer-generated images: >Not at all. It's not an issue of exploitation in that case, nor is it an >issue of "thoughtcrime", since the thought has produced an actual image >that can be viewed by others. I strongly disagree. A computer image that never involved an actual child, cannot reasonably be viewed as child porn. Can a computer-generated "snuff" film be viewed as murder? (I see acted-out murders every day on t.v.) >Nothing in this email should be construed as a personal attack against you, >Tim. I'm just trying to relate the laws and the facts as they are. I don't take it as a personal attack. Ed's comments were thoughtful, even if I disagreed with some of them. By the way, I agree with some comments I've received that this subject is somewhat far afield from the "Cypherpunks charter," such as it is, but I'm finding the hundreds of highly repetitive and arcane postings about the same old remailer issues, and the internals of obscure mail programs, not all that close to the charter either. (I'm not saying they shouldn't be posted, and some have been well-written summaries, but I am saying they're highly-detailed nuts-and-bolts issues which probably are meaninful to only a few readers.) Part of the Cypherpunks approach is to "monkey wrench" the "Surveillance State" by flooding the comm lines with encrypted junk, with suspicious-looking files that will soak up surveillance time, and with various other subversive things that will push the boundaries. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: by arrangement Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Ad Hominum attacks (was Re: PC Week Clipper article
by Pat Farrell 03 Jul '93

03 Jul '93

I'm more than a little concerned about the vicious personal attacks that this list makes on folks that have strongly held beliefs that disagree with some (or all) of the beliefs of hot headed posters to cypherpunks. I thought this was a technical mailing list, that dabbled in politics only as necessary. I see no justification for the personal attacks, especially on 3rd parties that do not read this list. These uncalled for attacks will not convince anyone on the list, and do not become the poster. In Message Tue, 29 Jun 1993 , (someone who should know better) writes: >Dorothy Denning is a fucking idiot. I strongly object to this posting. D.E.Denning is neither an idiot nor a "wicked witch of the East." She just happens to support a view that she strongly believes in. The fact that I think her side is dead wrong does not make her an idiot. Name calling accomplishes nothing but does hurt the signal to noise ratio of this list. Even more annoying are the attacks on Jim Bidzos. He is trying to make a buck, which was legal last time I looked. And on many issues, he is far more in our camp than against us. He at least likes strong cryptography, and his disputable patents expire in a relatively short time. He has agreed to allow a PGP-compatible program to use RSA without cost, providing the legal version that many U.S. users would like to see. I thought cypherpunks wrote code. I think that personal attacks on folks that are not on the list is a waste of bandwidth. (If you want to attack me here, fine, at least I get to respond firsthand) Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

RE: PGP and offline-readers
by James Still 03 Jul '93

03 Jul '93

>> I am getting involved in networking some local BBS' and >> message bases. I'm beta testing a privacy-oriented BBS right now that I just finished programming, called CryptoBBS and what better place to introduce/ask questions on it than among the cypherpunks! It is geared towards the hobbyist sysop with an old XT clone or something lying around as it is a mere 80K (for the floppy-sysops!) There is no logon prompt asking for name, birthdate, SSAN, and who knows what else, it goes directly onto the board. Callers wishing to post messages, are asked for an alias name to fill in the FROM: block, but real names or call-back verifiers are not supported. My hope is to offer sysop's a choice, between *choosing* to preserve privacy, rather than the current practice of obtaining personal information because the questionnaire's are preprogrammed that way. The unique feature about CryptoBBS is it's "Post Office." The P.O. allows callers to set up a p.o. box from which they can up/download any file (pgp encrypted files for instance) to any other user on the board without the sysop's approval/knowledge. It encourages and nurtures an anonymous "mail drop" community while protecting the caller's privacy. The question is, should I throw away the virtues of a lean 'n mean app at 80K by adding a dolphin or pgp to it that automatically encrypts the message base, uploaded messages, etc? Should we give the BBS caller a little credit and assume he knows to encrypt at his own machine before uploading the text? Or is the temptation to make everyone *lick and seal their message envelopes* too invasive? I know the issue of encouraging pgp use by making it as painless as possible on the end-user is nothing new around here, but as far as I know no one has ever discussed whether or not BBS's should handle the job for the caller.

4 6

Junk mail/return encrypted-blo
by s.summers1＠genie.geis.com 03 Jul '93

03 Jul '93

>From zane(a)genesis.mcs.com (Sameer) >The second solution I thought of seems like it would work. When I >create the return-address block, it can be given some sort of ID-code >(again, like with my other idea posted, similar to the ID-code on peices >of Digicash in Chaum's scheme) so when the vendor delivers the product, >she sends to encrypted block to the remailer, and the remailer forwards >the product to me, and stores the ID-code in its database (doing the >proper one-way transformation for untraceability) so that further >attempts to use the exact same address-block will be noticed and not >delivered. Why not just include an Expire: header in the encrypted block, after which the remailer would just junk any mail sent with that return address?

1 0

Science News article request
by fergp＠sytex.com 03 Jul '93

03 Jul '93

On 01 Jul 93 21:00:49 EDT, Sandy Sandfort <uunet!CompuServe.COM!72114.1712> wrote - > I have missed some messages because of a computer problem. > Perhaps someone has already mentioned or reprinted an article > by Ivars Peterson ("Encryption Controversy -- A Fierce Debate > Erupts over Cryptography and privacy") about the Clipper, > Capstone, et al. in June 19 issue of SCIENCE NEWS. If not, I > would be willing to transcribe the article into ASCII and upload > it to the list if enough folks are interested. Please do. I'm interested in seeing any article relative to the subject at hand... Cheers. Paul Ferguson | "Confidence is the feeling you get Network Integrator | just before you fully understand Centreville, Virginia USA | the problem." fergp(a)sytex.com | - Murphy's 7th Law of Computing Quis Custodiet Ipsos Custodes?

1 0

CPSR Workplace Privacy Test
by Dave Banisar 03 Jul '93

03 Jul '93

CPSR Workplace Privacy Testimony ===================================================== Prepared Testimony and Statement for the Record of Marc Rotenberg, Director, CPSR Washington office, Adjunct Professor, Georgetown University Law Center on H.R. 1900, The Privacy for Consumers and Workers Act Before The Subcommittee on Labor-Management Relations, Committee on Education and Labor, U.S. House of Representatives June 30, 1993 Mr. Chairman, members of the Subcommittee, thank for the opportunity to testify today on H.R. 1900, the Privacy for Consumers and Workers Act. My name is Marc Rotenberg and I am the director of the CPSR Washington office and an adjunct professor at Georgetown University Law Center where I teach a course on information privacy law. Speaking on behalf of CPSR, we strongly endorse the Privacy for Consumers and Workers Act. The measure will establish important safeguards for workers and consumers in the United States. We believe that H.R. 1900 is particularly important as our country becomes more dependent on computerized information systems and the risk of privacy abuse increases. CPSR has a special interest in workplace privacy. For almost a decade we have advocated for the design of computer systems that better serve the needs of employees in the workplace. We do not view this particular goal as a trade-off between labor and management. It is our belief that computer systems and information policies that are designed so as to value employees will lead to a more productive work environment and ultimately more successful companies and organizations. As Charles Hecksher of the Harvard Business School has said good managers have no use for secret monitoring. Equally important is the need to ensure that certain fundamental rights of employees are safeguarded. The protection of personal privacy in the information age may be as crucial for American workers as the protection of safety was in the age of machines. Organizations that fail to develop appropriate workplace privacy policies leave employees at risk of abuse, embarrassment, and harassment. The concern about workplace privacy is widely felt in the computer profession. This month MacWorld magazine, a leading publication in the computer industry, released a special report on workplace privacy. The report, based on a survey of 301 companies in the United States and authored by noted science writer Charles Piller, made clear the need for a strong federal policy. Among the key findings of the MacWorld survey: > More than 21 percent of those polled said that they had "engaged in searches of employee computer files, voice mail, electronic mail, or other networking communications." > "Monitoring work flow" is the most frequently cited reason for electronic searches. > In two out of three cases, employees are not warned about electronic searches. > Only one third of the companies surveyed have a written policy on privacy What is also interesting about the MacWorld survey is the high level of concern expressed by top corporate managers about electronic monitoring. More than a half of those polled said that electronic monitoring was either "never acceptable" or "usually or always counterproductive." Less than five percent believed that electronic monitoring was a good tool to routinely verify honesty. These numbers suggest that managers would support a sensible privacy law. Indeed, they are consistent with other privacy polls conducted by Professor Alan Westin for the Lou Harris organization which show that managers are well aware of privacy concerns and may, with a little prodding, agree to sensible policies. What would such a policy look like? The MacWorld report also includes a model privacy policy that is based on several U.S. and international privacy codes. Here are the key elements: > Employees should know what electronic surveillance tools are used, and how management will use the data gathered. > Management should minimize electronic monitoring as much as possible. Continuous monitoring should not be permitted. > Data should only be used for clearly defined, work-related purposes. > Management should not engage in secret monitoring unless there is credible evidence of criminal activity or serious wrongdoing. > Data gathered through monitoring should not be the sole factor in employee evaluations. > Personal information gathered by employers should not be disclosed to any third parties, except to comply with legal requirements. > Employees or prospective employees should not be asked to waive privacy rights. > Managers who violate these privacy principles should be subject to discipline or termination. Many of these provisions are contained in H.R. 1900, the Privacy for Consumers and Workers Act. Clearly, the policies and the bill itself are not intended to prohibit monitoring, nor to prevent employers from protecting their business interests. What the bill will do is help establish a clear framework that ensures employees are properly notified of monitoring practices, that personal information is not misused, and that monitoring capability is not abused. It is a straightforward, sensible approach that does not so much balance rights as it clarifies interests and ensures that both employers and employees will respect appropriate limitations on monitoring capability. The need to move quickly to establish a framework for workplace privacy protection is clear. Privacy problems will become more acute in the years ahead as new monitoring schemes are developed and new forms of personal data are collected. As Professor Gary Marx has made clear, there is little that can be imagined in the monitoring realm that can not be achieved. Already, some members of the computer profession are wearing "active badges" that provide full-time geographical monitoring. Properly used, these devices help employees use new tools in the hi-tech workplace. Improperly used, such devices could track the physical movements of an employee throughout the day, almost like a blip on a radar screen. Computers are certainly powerful tools. We believe that they can be used to improve productivity and increase job satisfaction. But this requires that appropriate policies be developed to address employee concerns and that laws be passed, when necessary, to ensure that computer abuse does not occur. This concludes my testimony. I would be pleased to answer your questions. =====================================================

1 0