December 2003 - cypherpunks-legacy

Apocalypse Now
by L. Detweiler 17 Dec '03

17 Dec '03

Hey, I heard about a new mailing list some people here may be interested in. Pseudospoofers need not apply. (If you do, fair warning, you will be hunted down...) ===cut=here=== Postings to everyone on the cypherwonks list go to cypherwonks(a)Lists.EUnet.fi. Commands to the MajorDomo mail server go to <Majordomo(a)Lists.EUnet.fi> in the message body. Basic commands are HELP, INFO, SUBSCRIBE, etc. * * * The Cypherwonk Charter, by L. Detweiler, Cypherwonk Janitor The cypherwonks are a splinter group from the cypherpunks also interested in promoting and implementing cryptographic technology. However, we have unique ideas on how to successfully implement these radical new capabilities to ensure privacy without encouraging criminal behaviors like forgery and `online predation'. We are also interested in a far more ambitious goal of `technological progress' that transcends a mere obsession with privacy and anonymity. The cypherwonks believe that many aspects of a identification and government are necessary and crucial for any social stability (particularly related to judicial and law enforcement systems), and are quite alarmed at talk about a `cryptoanarchy' resulting from the mere implementation of software protocols -- although we realize that radical new forms of government may appear with these new technologies, embodied in one term `Electronic Democracy'. We believe that while sometimes the `majority' can become a `tyranny', in general the idea of voting as a civilized way of resolving proposals and `one person, one vote' are sacred, and we are interested in implementing systems that promote interaction and collaboration among motivated and enthusiastic members, whether within the cypherwonk organization or within their nations (cypherwonks, of course, try to think free of local prejudices, and globally). Cypherwonks understand that *trust* and *honesty* are inherent in all human endeavors, *particularly* communication. We recognize that people trust others not to reveal our private email unless given permission, we trust others not to use information from our mail or about their identities to adverse aims, we trust that systems delivering mail will not be corrupted by criminals, or if they get caught there will be serious consequences, and many other explicit and implicit variations. We know that there are many ingenious ways of minimizing the amount of trust required in unknown components such as with the use of cryptography or pseudonyms, and we seek passionately to invent and use them, but at the root level, email is an exchange between human beings who trust each other. Therefore, we hold a sense of ethics and morality in strong reverence, and even though we're not always precisely sure what they entail, we know that they exist and we strive for the right ideal. We abhor the idea that `it's not wrong if you can get away with it' or other variations of moral relativism. We also subscribe to the idea that if you breach ethics, you should be prepared to forfeit some rights, like your `right to privacy'. Cypherwonks are also extremely interested in promoting and implementing `digital cash', but believe that while invariably the state's taxes tend to become burdensome, few civilized, technological societies are free of them, and certainly we do not advocate tax evasion, `black marketeering', or any other subversive or illegal activities through cryptographic techniques, and even beyond this we seek design protocols that discourage these subversive aims in general, because of their toxic, fragmentary effect on social unity. Cypherwonks recognize that our mailing list is extremely critical in coordinating our movement and our fellow members. It is our central nervous system. While the list is informal, we demand a professional atmosphere, and will privately object to people who are publicly rude or belligerent. But we are also extremely careful about what we say to each other in private, because people can be extremely influenced by what they receive in mail. We would be aghast and horrified to find that somebody viciously criticized someone in private mail based on public postings, for example. We place high value on being courteous to each other and minimizing disagreement where possible, forging consensus, and the art of diplomacy in surmounting political barriers. We trust each other on the list and in personal email. We wish to have an open, uplifting, inspiring, honest, representative, polite, respectful, egalitarian dialogue. We will never use the mailing list for personal or selfish reasons -- we strive to serve our fellow cypherwonks through our postings. We are what we claim to be. We abhor secrecy, `security through obscurity', and conspirational cliques. Cypherwonks are extremely interested in promoting some forms of anonymity. However, we do not necessarily believe that others are required to read anonymous postings. To the contrary, we believe that the individual should have the tools and freedom to filter his or her own mail based on real identities. In particular, we condemn the practice of `pseudospoofing,' the dangerous deception where a person builds up a pseudonym and misrepresents it as being that of a real person's identity. We police each other on the list to prevent it, and require a promise that our members refrain from it. While our trust can be betrayed, only those that are honest are true cypherwonks, and anyone who betrays our trust we consider a dishonest hypocrite, or worse, a traitor. Cypherwonks are extremely interested in building tangible systems. Engineers who love to discuss the nitty-gritty details of some scheme are at home on the cypherwonks list. We like to impress each other with our knowledge but at the same time state it in relevant and humble terms. We are not trying to win popularity contests with our postings. We are trying to accomplish ambitious endeavors. We are especially ecstatic to make connections with other cypherwonks interested in the same projects we are, and cooperating to build useful tools. We like to give status reports of our intermittent real-world meetings and progress to other cypherwonks. We do this to inspire and encourage others, not to assuage our egos or flaunt our power. We recognize that this is the true spirit of the Internet embodies in the volunteerism that build the impressive RFC and FAQ repositories. In fact, we are very fond of writing RFCs and FAQs. We keep track of all the things we have accomplished, and are very proud of this group resume, and delight in adding new items. The Cypherwonks are more inclusive than exclusive. We try to accommodate the interests of others. We consider it a high crime to `flame newbies'. In fact, we go out of our way to encourage greet new members with smiles in email. We especially like to have reporters on the list, and treat them like royalty. But we also make sure that no one is hogging the spotlight. We try to match up reporters with different people on the list. Some people are naturally `leaders', particularly the list moderator J. Helsingius, but in general we don't lionize or deify anyone. The greatest cypherwonk is always the last person who posted the most interesting, relevant, and useful article. While we thrive on the Internet, and greatly admire the system, we also realize the structure of the Internet is evolving and growing. We tend to distrust `authorities' regulating the Internet, but at the same time we recognize that the Internet exists and is popular because of a strong community feeling with a `netiquette' that places a strong taboo on things like censorship, cracking, and pseudospoofing and a strong interest in individual effort and innovation. In short, we are interested in `civilizing cyberspace' with the powerful new technological tools like cryptography and digital cash that are available but unimplemented. We believe that the current Internet is a bit raw and untamed in places, like a frontier, and just a `glimmer in the eye' of future cyberspace, and we seek to smooth out the rough spots, build elaborate and hospitable castles to live in, and invite all of humanity here to join us for a party. (In case you are wondering, the word `wonk' is slang for a `meticulous detail person'.) * * * The Cypherwonk Code of Ethics (Including Pseudospoofing and Privacy) By L. Detweiler, Cypherwonk janitor Cypherwonks owe no courtesy to someone who forfeits any expectation of respect from atrocious misbehavior. This is as simple as the maxim, if you are a criminal you forfeit your `rights' in a civilized society. If you mailbomb a cypherwonk, you have forfeited your `right to privacy'. If you email a cypherwonk's postmaster or colleagues in an attempt to censor or intimidate a cypherwonk, especially before consulting that cypherwonk, but not necessarily, you have forfeited your `right to privacy'. If you lie to a cypherwonk, you have forfeited your `right to privacy'. If you fail to adequately respond to personal accusations of impropriety or criminality, especially meeting them with evasion or stonewalling, you have forfeited your `right to privacy'. If you have ever sent a cypherwonk mail under a pseudoanonymous identity, you have forfeited your `right to privacy' -- under ALL your pseudonyms and identities. If you advocate violations of ethical or legal behavior to a cypherwonk, you forfeit your `right to privacy'. Cypherwonks, even highly reputable ones, may attempt to shame you into embarrassment or repentance for violations of ethical behavior by ridiculing you in front of people who appear to be your friends and community, if all other measures have failed. In extreme cases, even this may be ineffective, but if you have no shame, you have no humanity. * * * List topics (not exhaustive) -Projects (secure phones, etc.) -Cryptographic techniques (RSA etc.) -Anonymity -International news events in privacy/anonymity -Identity issues such as databases and pseudospoofing -Clipper -real world meetings (others and our own) -etc. Posting guidelines: we wish to minimize the number of postings to the list so as to attract the busy, influential people that get things done. Please refine your postings highly. We especially appreciate the consolodation of topics with summaries, `tables of contents', headings, etc. where appropriate. At all times, we seek to build consensus and look down on grouchy postings that do nothing but criticize. The list should be regarded as a stepping stone to `getting things done' or `resolving conflicts' in email. * * * The Cypherwonk Resume J. Helsingius has built the most popular and global anonymity server on the Internet, with thousands of active users daily. L. Detweiler has compiled a wide variety of FAQs on Internet subjects. (updates to ld231782(a)longs.lance.colostate.edu) * * * Most Wanted List - key servers that are dedicated only to `true identities'. People who submit their keys promise the keys are that of their real identities and that no one else will ever post under their identities. Penalty is public exposure and stigma if caught. The protocols might also include mechanisms for `challenges' and `resolutions'. - reputation based mailing list software. One idea: people rate each other's postings in different categories. Server tracks everyone's ratings. People can screen mail based on accrued credit. - electronic democracy software (especially tied to reputations). protocols for propositions, resolutions, voting, etc. - other identity servers to prevent pseudospoofing. possibly hooking up with existing government databases. - pseudonymity servers like anon.penet.fi with public key encryption. - support of the Bunyip project for automated Internet resource tracking, including mailing lists. - support for distributed hypertext systems and protocols like XMosaic. - resume & reputation servers. a very premature idea, but these would help track people's accomplishments and reputations in different forums, perhaps even by cross indexing their postings. (additions to ld231782(a)longs.lance.colostate.edu) * * * Cypherwonks of Note (Reporters, take note!) (apply to ld231782(a)longs.lance.colostate.edu) J. Helsingius Operator, anon.penet.fi, first widespread reliable anonymous remailer in popular use on the Internet L. Detweiler Privacy & Anonymity FAQ, Anonymity FAQ, Whistleblowing FAQ

1 0

tick, tick, tick, ...
by an12070＠anon.penet.fi 17 Dec '03

17 Dec '03

TIME'S UP ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: strong crypto => increase in rubber-hose attacks?
by dmandl＠lehman.com 17 Dec '03

17 Dec '03

> From: jim(a)bilbo.suite.com (Jim Miller) > > Assume you use strong crypto to protect your secrets. > > Assume a lot of people start using crypto to protect their secrets. > > Assume there are people who want to discover these secrets. > > Might we some day see an increase in the number physical attacks as bad guys > resort to rubber-hose methods to get at the keys that protect the secrets? Maybe. This doesn't change the need for strong crypto, though. It's a lot easier to simply intercept someone's (unencrypted) electronic mail from the comfort of your home/office than to send thugs over to her house to kneecap her. Why make it easier for them than we have to? The people who I consider to be the bad guys (governments, corporations) don't have the time or resources to use physical violence against all of their enemies, though of course they do use it against some. It's also bad PR (in the USSR, this wouldn't have stopped them, of course). So if the ONLY means available to the forces of evil were physical attacks, I wouldn't worry too much. Not that physical attacks are pleasant, mind you, but that threat can be addressed separately (as some folks have on this last have done in the last few days). It's also easier for us and harder for them if they're visible. --Dave.

1 0

ANNOUNCEMENT: Markey Bill debuts in house.
by Brian D Williams 17 Dec '03

17 Dec '03

The opinions expressed are my own and do not represent the views of Ameritech or any of its alliance partners. So, Markey proposes a bill that would "allow" the RBOC's to do video..... Markey likes it.... The EFF likes it...... I wouldn't invest a dime in a proposal that stupid..... not interested.......... Brian Williams

1 0

holiday
by Brian D Williams 17 Dec '03

17 Dec '03

Just want to wish everyone a safe and happy holiday. Party on! Brian Williams

3 2

Re: <8c> C-source for diffie-hellman?
by smb＠research.att.com 17 Dec '03

17 Dec '03

DH itself is a trivial algorithm. All you need is a decent multiple precsion math package. I think all it takes is -- random numbers -- primality test -- gcd -- raise-to-power-modulo-some-number One more thing -- you want the base for the exponentiations to be a generator of the subgroup. Also, ideally the modulus should be a prime of the form kp+1, where p is also a prime and k is a small integer. Your DH toolkit should include routines to generate the base and modulus according to those criteria. BTW, schneier is literally a FAQ for cypherpunks. Fantastic book. Cough up the money for it... Indeed, though I've only seen some drafts; my copy of the book itself hasn't arrived yet.

1 0

Re: Give me your password- OR ELSE!
by owen＠autodesk.com 17 Dec '03

17 Dec '03

> From: "Philippe Nave" <pdn(a)dwroll.dw.att.com> > Jim Miller writes : > > > > Assume you use strong crypto to protect your secrets. > > Assume a lot of people start using crypto to protect their secrets. > > Assume there are people who want to discover these secrets. > > Might we some day see an increase in the number physical attacks as bad guys > > resort to rubber-hose methods to get at the keys that protect the secrets? > I think this phenomenon is more or less inevitable, unless serious thought > is given to a way to prevent it. Let's take a simple example and progress > to a more complex scenario: (Interesting examples deleted) One can think up all sorts of hypothetical scenes. Underneath it all however, I believe is a simple axiom. When prevention methods thwart a criminals intent, they find new methods. Car alarms and security systems didn't convince the criminals who make their living ripping off cars that the *Good ole days were over* and it was time to get a job at Burger Sri, it spurred them to find new methods to ply their trade. Beyond that it didn't bother them to up the ante regarding the level of violence they would utilise. Now extrapolate that into the concept of industrial espionage, white collar crime, and put everyone on the same wire. !!!!! LUX ./. owen

2 1

Threats from Detweiler
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

>Brian D Williams writes: > > Just want to wish everyone a safe and happy holiday. > > Party on! > >Party? PARTY?!? How the heck am I supposed to RELAX and ENJOY myself >when we're all here just WAITING for the FINAL JUDGEMENT to fall on >our TENTACLES?!? I'm a BASKET CASE! > >-- >Mike McNally I said I wouldn't comment further on Detweiler unless and until something changed and new information came to light. Folks, this is the time to really take care of yourself. "The Executioner" announced the "time's up" and that more drastic measures are about to occur. "an12070(a)anon.penet.fi" is beyond any doubt Larry Detweiler. Many other folks have posted analyses of why this is so: the use of TeX quotes, the same vocabulary, the same agenda (against TENTACLES of the MEDUSA), and even the same arrival times of messages (I get my death threats from S. Boxx and The Executioner every night around 10 p.m. to midnight, the same time as Detweiler's rants appear). I take him seriously. He's deranged. A lot more than just slightly neurotic, he's transitioned into insanity. His religious rants ("You will be hung by the neck until dead and then sent to Hell"), his death threats, his wailings and moanings....not a lot of doubt that he's psychotic. Me, I'm keeping my guns loaded in case he decides to drive out to California and end his misery by "cutting off the Tentacles," as he keeps threatening to do.I consider this unlikely, though. Too far to drive when he's got closer targets. The "Colorado Tentacles" should be especially careful, I think. Phil Zimmermann is currently back on Larry's good side (I quote: "Phil is God"), but this may not last long. (Hint: Phil Z. was not at all happy with Larry's rant about Tentacles and his quoting of Phil's comments at that Colorado talk he gave. If Larry discovers this, as he surely will, Phil may be back in the boat with the rest of us Spawns of Satan.) I don't think I'm being alarmist in advising you all to watch out for this guy. --Tim P.S. As long as I'm on the subject, let me again say that I'm not sending Detweiler any messages at all. I don't know if he's really getting anonymous messages ("pseudospoofers"), but if he is, they're not from me. And they never have been. John Gilmore wrote a very reasonable piece, addressing Detweiler's source of confusion, and has since been flamed and ranted against. Typical. And now I'll fall silent on this matter until something new happens. I just hope it isn't a "Texas Tower" sort of violent encounter. If you've got a gun, now's the time to make sure it's handy. If you don't have a gun, consider getting one. --TCM -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: by arrangement Note: I put time and money into writing this posting. I hope you enjoy it.

1 0

Re: holiday
by Jef Poskanzer 17 Dec '03

17 Dec '03

> Here is the secret to understanding everything. It also contains the >TRUE identity of Dark Unicorn, S.Boxx, and in fact everyone on the list. >Unfortunately, it is encrypted in an unbelievably complex algorithm based >on the factoring of infinity. Well, here it is. Crack it if you can! Since infinity is the product of all numbers, it was fairly easy to factor. Decrypted text appended. --- Jef o&#&o. ____ ___o\_ d| "9, ?H##""'`"'""'`""`"&o. ,M |b__o=q\ .d*" ___. ,==\\`Ho. H| `"" J* .,MT ,H$odH? dH#DqHD `&?. M| ,&' .dM*' +R96]#P `HMbHP `9b. Mi .HP .#HP' `""""' `9#. M| |H' HH `H, `b H| dP # `H, H |M JM .o 9HdH |b |M. |L MT ,o,HP M| M_ M. M M| ""HM. ,. .&"#HH MM H' T.HH `Mb &#?| `\.JM M# H| |b|M `Hb.^d| .,d#' ,H T| 9L*b. `M##o______oood#&9H" dH' |M `HL`H?. `H/H&$$??????o/?&' dM* |M. `Hb ?M#b_ `*&$P#MMMM#*$/*' ,H#' Mb HHH? `*Mb. `"#H###d*'' ,MP' MM. ?H' "HHb\ .##" TMb .dP' `"#MHbooooooooodHHM *M| ,#H' ""TM"'""""' *M| MH,.oH' .d| .M| |MMH' .H* HP TH, ,H' .dP'

1 0

Re: Archiving mail-lists...
by mcb＠net.bio.net 17 Dec '03

17 Dec '03

Jim choate <ravage(a)wixer.bga.com> writes: > [Plan to archive Usenet on CD-ROMs] > > I would be interested in a discussion on the mail-list on this issue. Please > refrain from sending personal mail. In particular do you think such a archive > without every members permission is un-ethical? Would a archivist necessarily > need the permission of the mail-list sponser? Actually, I would like *not* to discuss this on Cypherpunks, not because it is not an interesting subject, but because this issue (and related issues such as archiving/republishing FAQs) are being discussed in a number of other places, notably the faq-maintainers mailing list, several of the news.* groups intermittently, the moderators mailing list intermittently, and some of the legal-interest groups on Usenet. Besides, cypherpunks is already very high-volume (even if you don't count the Detweiler spew) and the issue is really not that closely related to the purpose of the list (though there are some tangential points). -- Michael C. Berch mcb(a)net.bio.net / mcb(a)postmodern.com

1 0

Making unsubscribes easier
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

As with many mailing lists, we get a lot of mail about subscribes and unsubscribes. Perhaps we should make it easier for people to get off the list, or at least find out where the list maintainer really is. Some possible approaches: 1) Add a header line to all the postings saying something like X-Send-Subscription-Requests-To: cypherpunks-request(a)toad.com 2) Add a dummy subscriber to the list that greps for "subscribe" in Subject lines and uses the vacation-mailer to reply. Some untested code that should work: #!/bin/sh # Subscription-Request-Bouncer # Set your .forward file to read # | subscription-bouncer # and activate by running vacation -I # and putting a useful message in $HOME/.vacation.msg # cat $* > /tmp/msg.$$ if egrep -i 'Subject:.*subscri' /tmp/msg.$$ then /usr/ucb/vacation -t1d cypherpunks-info < /tmp/msg.$$ fi rm /tmp/msg.$$ # You may be able to make this work with the username # in the vacation command set to cypherpunks-request 3) One problem with standard listserv and majordomo software is that it tends to believe addresses as given, without munging anXXXXX into naXXXXX or other subtleties for subscription (though it can at least forward requests from different addresses to a moderator, etc.) - can they handle this, or at least be given the job of unsubscribing people? - do they have any forgery-detection capability? Otherwise some rude person could try unsubscribing lots of people. The austin-cypherpunks listserv sent me a password for use with the listserv; is this code available? Thanks; Bill # Bill Stewart NCR Corp, 6870 Koll Center Parkway, Pleasanton CA, 94566 # Voice/Beeper 510-224-7043, Phone 510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

3 2

Remailers: The Next Generation
by trestrab＠GVSU.EDU 17 Dec '03

17 Dec '03

Tim May writes concerning the need for "new and improved" cypherpunk remailers: ( His comments in " " or after > ) >FEATURES NEEDED IN A SECOND GENERATION REMAILER: >I. DIGITAL POSTAGE Requests for remailing would be accompanied with some form of digi-cash token, with the amount equalling (number of hops requested X price per 'stamp'). The remailers would keep the token that came with the message, and substitute one equalling # stamps -1 that would be digitally signed by it. This new token would be passed down the line, with each remailer keeping the tokens that come in and substituting their own. The tokens that are kept would be sent to a central remailer clearinghouse which would settle accounts. (See * at bottom of msg for further details on the clearinghouse.) >II. JUNK MAIL SCREENING I really don't know how best to accomplish this, either. >III. IDEAL DIGITAL MIX I'm not sure that we can achieve an 'ideal Chaumian digital mix' of messages at this time, but I have a few ideas on how we can improve on what is presently in place. Instead of padding individual messages to improve diffusion, batch several messages together to reach some 'standard' remailer msg length of n bytes, and then encrypt the batch with the next remailer's public key. Noone looking at the message as it leaves the remailer will be able to determine what # of msgs are in the batch, or which particular msgs are present (assuming they don't possess the private key of the remailer to which the batch is being forwarded). The individual msgs in a batch could be seperated with some standard remailer command, e.g. :: Cut here ------------ When the batch arrived at the next remailer, it would be decrypted and the Individual msgs seperated and placed in the remailing queue. Latency could be set by the customer with a command such as: :: Hops = x, Final = Remailer Z [ where x =1-9, and Z = either the remailer address or some alias that could be looked up in a table. 'Final' would be used in place of the nested encryption used now, so that the msg sender would only have to encrypt the final destination of his msg once. The # of Hops would be decremented by one as they were processed by each remailer. Remailers would send a msg to any other remailer randomly, except when Hops = 1, and would then forward the msg to Remailer Z. So I envision a typical msg looking like this: a. The instructions for # of hops and final remailer hop b. The instructions for final destination. c. The msg itself. c would be encrypted as the sender chooses, and then b + c would be encrypted using the public key of remailer Z ( Z to be chosen by the sender of the msg). a would be in the clear, or a+ b+ c could be encrypted with the public key of the first hop in the remailer chain. Of course, all of this ( a, b, and c ) could be done in the clear, but that would place your msg is jeopardy at each and every hop of being intercepted and read. That might be acceptable to some users, though its not very robust. Messages would be batched into groups by taking first m number of msgs whose lengths add up to the standard length n. Diffusion could be increased by shuffling the queue as each message entered the remailer. Latency and diffusion could be increased by inserting "null" msgs into the mix. A few months ago Eric Hughes mentioned that Hal Finney was forwarding list msgs encrypted to some unkwon number of persons. If he is still doing this, these msgs could be inserted into the mix by remailing each msg to _one_ of the remailers in a random fashion. These msgs could contain a command such as :: Hops = {1-9}; Final = Dev.Null They would be remailed within the remailer loop until Hops = 0, when they would be sent to the bit bucket, having served their purpose. > IV. NO LOGGING The important part of this is that the policies of individual remailers should be clear on this point, so that individuals can choose the initial and final remailers if that policy is a concern to them. As Tim says: " Sites which log but say they _don't_ is of course the real issue in the long run....I'll save this interesting topic for another article, maybe. Just be aware that this kind of "collusion" (not exactly, but this is what the literature calls related behaviors) is not easily solved with existing remailers.) " >V. HARDWARE-BASED REMAILERS No particular expertise here. I'll this to those that do. >VI. MARKETS I think it will work better if the routes are chosen randomly by the remailers ( except for final hop, see above ), as this process is more "user friendly". "Pinging" could be centralised into one clearinghouse (*see below), which handled settling of postage accounts between remailers. >VII. STANDARD FORMATS Needed, but to be decided upon. If noone else volunteers, I am willing to host a moderated Cypherpunks sub-list whose topic would be limited to remailers. Moderated, because I don't have the facilities to run an automated mail reflector and so that the signal to noise ratio is kept high enough that contributors don't drop out due to Detweiler or other noise sources. >VIII. RATINGS AGENCIES I think that diversified sources of info for "consumers" of remailers is a "good thing", but there should be a centralised clearinghouse which would concern itself solely with reconciling postage accounts and with "pinging" the remailer net at regular intervals and sending out msgs to remailers to avoid sending packets to sites which are not responding in an appropriate amount of time. ( "Appropriate" to de determined .) >IX. DIVERSE SITES Tim writes: "I also think we also need "virtual sites" which are themselves only accessible by remailers." I agree. "Other names for these sites might be "sacrificial sites" or "digital cutouts" " This can be accomplished now using the commercial site America On Line (AOL), which permits its customers to have a half- dozen or so distinct sign-on names per account. So you could run a site called "Remailer_17" (with apologies to Wm Holden) which received msgs to be remailed. These msgs could be downloaded, processed, and then uploaded through a different name entirely, "Fnord_OMF" or whatever. Unless the <insert favorite bad guy organization here> monitored _all_ possible alias accounts, they would not be able to do traffic analysis on the remailer network. >X. ATTEMPTS TO BREAK REMAILERS I'll leave discussion of this to those with greater knowledge of hacking and/or cracking than myself. * CLEARINGHOUSE The clearinghouse would not be accessible to users of remailers, but would be internal to the remailer network and handle accounting and "pinging" of remailers. Accounting example: I send a msg to remailer A, requesting # Hops = 3 and Final = remailer C. I enclose at the top of the msg digi-cash equalling the cost of three "stamps". ( One stamp for each hop.) Remailer A keeps the original digi-cash token, and substitutes one signed by it equalling two stamps. The msg is remailed to remailer B, which keeps the token supplied by remailer A and substitutes one signed by it equalling one stamp; remailer B notices that the # Hops now = 1, so it remails the msg in a packet to remailer C. Remailer C keeps B's token, and sustitutes nothing since this is the final hop for this particular msg. It then decrypts the msg and follows the remailing instructions encrypted in the "envelope". At the end of some accounting period ( day, week, month, depending on number of msgs passing through the system ) all remailers would forward their accumulated tokens to the clearinghouse, which would credit their accounts with the tokens received and debit them for the tokens sent out. The bookkeeping would get fucked up by lost transmissions, so that would have to be addressed at some point to ensure that remailers didn't just bit bucket incoming msgs and keep their stamps. The clearinghouse would also "ping" the remailers in the network at regular intervals and issue "route around" commands to the remailers if one or more sites didn't respond in a timely fashion. Thats all for now. Jeff trestrab(a)gvsu.edu

1 0

Re: The Digital Barter Economy
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

As Mike Berch pointed out, an economy can grow just fine without increasing the supply of whatever money is being used - as long as the currency is easy enough to divide into smaller quantities. That's one reason gold and silver are quite good, though paper money and numbers in a ledger do quite well also. Yes, there are difficulties with a fixed money supply in a growing economy - money that you save keeps increasing in value, and money that you borrow becomes harder to pay back. That's ok - markets adjust the interest rates on borrowed money to accomodate people's expectations. It's certainly better than having one group of people decide that there should be more money in the market, print it, and force everybody to accept it from them. On the other hand, in an international free market, no single government's fiat currency is mandated, and if the bank or its customers want to hedge their bets by using multiple currencies, it may be worthwhile to offer them, and any banking protocols we develop should probably accommodate that. Banks have to be more careful in a multi-currency environment - if gold or yen go way up in value, people can do a run on gold or yen accounts even though the dollar accounts aren't getting hit. (e.g. gold prices jumped about 20% at the beginning of the Yankee-UN-Iraqi War, and anything slumps in value after *I* buy much of it.:-) If a bank has all its assets in dollars, and Clinton decides to inflate the currency to pay for Nationalized Health Care, same problem, unless all its acocunts are in dollars and it has to convert when trading with people who use other currencies. As far as inflationary effects go, if you're a government and print lots of fiat currency, the value of that currency goes down. Same thing if you're issuing a private currency, except you can't force your citizens to accept your zorkmids in exchange for real stuff. So either you don't print more zorkmids than you can back with something, or your accountholders get upset, withdraw their money, and you're in big trouble unless you've got insurance - and insurance companies tend to make sure you have a reasonable audit program before they're willing to risk their money insuring you. Private deposit insurance *is* available - a credit union down the street from me insures accounts to $350K, which is $100K federal and $250K private insurance. The only reason it's not more widespread is that people have tended to believe government insurance was enough. Bill # Bill Stewart NCR Corp, 6870 Koll Center Parkway, Pleasanton CA, 94566 # Voice/Beeper 510-224-7043, Phone 510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

Re: Remailers: The Next Generation
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Phil Karn suggests we look at anonymous forwarders for IP as well as mail. It's an interesting idea - Eric Hughes and Matt Blaze have recently talked about "packet laundering" at Bay Area Cypherpunks meetings, and there's been some work done on multi-stage laundering with cutouts in the middle so it really stays anonymous. Some issues include how to pay for it (digicash is one obvious approach), how to set up rendevous, and the usual datagram-vs-circuit problems of how long to maintain an association between addresses at the forwarder. On the other hand, while the Internet is rapidly absorbing email, there are lots of email systems that are *not* IP-based, such as uucp-over-dialup, Fidonet, X.400-over-OSI, and commercial mail systems that may forward to and from the internet but run their own backbones, which help make remailers harder to trace. There's also the hybrid issue, where you tunnel IP across whatever transport medium is available - there are some people doing this over telnet, and it would be a convenient way to do things like get IP service from a flat-rate dialup access provider without paying $2/hour for SLIP, etc. Bill # Bill Stewart NCR Corp, 6870 Koll Center Parkway, Pleasanton CA, 94566 # Voice/Beeper 510-224-7043, Phone 510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

Remailer Policies
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

A certain Tentacle of Medusa writes about problems with anonymous remailers being abused, and apparently speaks with some experience about mailbombing and other obnoxious behaviour. He suggests a few policies that he'd like somebody to enforce on remailer operators, as near as I can tell? > 1. Remailers should *not* be able to send anything to any list on the > Lists of Lists or any other known mailing list, by default. If the > moderator approves it, the remailers are allowed. Unless you control all the mail-users in the world, you can't stop this. On the other hand, it would be good if the standard remailer tools make it easy for remailer-operators to prevent the remailer from sending mail to specified destinations, and perhaps to restrict mail originating *from* certain users either in general or to specific destinations. The latter are more difficult, since networks of remailers do tend to make it difficult to tell where mail really came from, but sometimes remailer-operators need to do this in self-defense. It would also be worthwhile and courteous for remailer-operators to decide policies for blocking remailing. For example, Julf's anon.penet.fi remailer doesn't post news anonymously to newsgroups that have voted that they don't want it, and he's had to deal with a number of abusive users who he's blocked. > 2. Mailbombing through the remailers should be dampened with > limitations on the size of messages and the frequency. This is difficult to define or implement. I can often recognize mailbombing when I see it, if it's unencrypted, but a remailer operator has trouble determining whether something is a long train of abuses, or merely the transactions from the First Digital Bank Anonymous Credit Card or the responses from the ftp-by-mail server at NASA that somebody really wanted. On the other hand, letting a recipient specify throttles would be useful, and charging for remailing (whether by message, by size, or both) can also cut down on abuse. > 3. The ability for *anyone* to state that they do not want to receive > anonymous mail should be *automated*-- and the remailers should act as > a *whole network* in propagating these `requests for denial' between them. It's not difficult, if you're using a modern mail system, to filter out messages based on anything you can easily automate. There are some mailing list handlers, like the ones the Extropians bought for their list, that are friendly and flexible about it, so you can decide who to exclude, and a next generation of anonymous remailers should probably include similar capabilities. On the other hand, it's about like junk mail - there are groups of junk mail senders who will drop you from their list by a single request, and other junk mail senders who buy those requests to target you :-) I'd personally be disturbed if the software easily supported this sort of voluntary blacklisting without good authentication, since otherwise one of your Medusa buddies will go around unsubscribing people from anonymous remailer lists who don't want to unsubscribe; digicash banks and customers and political organizers are particularly vulnerable to this kind of abuse. > 4. You should keep and pass around lists of people that have caused one > remailer operator problems, so that others have the option of denying service. I thought *you* were the one who was just complaining about remailer operators who divulge the identity of their users, though maybe I misinterpreted you. While people who abuse remailers as publicly as you do are easy to put on these lists, most abusers are probably doing so for the fun of abusing people rather than to make a point about how easy these systems are to abuse, so they're more difficult to stop without violating privacy. This also opens up the possibility of forged abuse, with an attempt to get someone widely blacklisted, and censorship by remailer operators claiming a user is abusive. Then, of course, there are people who call for others to be Shunned, while making nuisances of themselves.... Bill # Bill Stewart NCR Corp, 6870 Koll Center Parkway, Pleasanton CA, 94566 # Voice/Beeper 510-224-7043, Phone 510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

Re: Remailers: The Next Generation
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

The issue of bogus traffic between remailers is yet another parallel to the Crying of Lot 49 :-) Got to send at least one every week to keep the system going..... On the other hand, some of those mail folders are really named WASTE and not W.A.S.T.E., as I found out from my ATTMAIL friendly user interface one day :-) As far as telling real traffic from bogus traffic on remailers goes, the implementation issues are much different between cleartext remailers and remailers that accept encrypted mail. The latter, if anybody's written and implemented them, can easily handle bogus mail, since eavesdroppers can't tell it form the real stuff. It would be helpful if we agree on a standard format for mail that should be discarded by remailers, e.g. X-Anon-Discard: N would either be discarded immediately or possibly be forwarder to another destination with N replaced by N-1. Alternatively, sending mail to some remailers without the Anon-Remail-To: or equivalent header may cause it to be sent to a real person; creating a standard "discard" user on some machines or having the remailer discard mail from the local MAILER-DAEMON equivalent will allow anon-forwarding to bogususer on whatver machine. Bill # Bill Stewart NCR Corp, 6870 Koll Center Parkway, Pleasanton CA, 94566 # Voice/Beeper 510-224-7043, Phone 510-484-6204 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

1 0

mailing list software
by rjc＠gnu.ai.mit.edu 17 Dec '03

17 Dec '03

If you really want to block posters and trap unsubscribe messages, cypherpunks is welcome to use the extropian's list software (by the end of next week it should be complete enough for someone else to run it without my help) Here's what it can do: Major: o modular design o mail delivered by custom "user agents" which can filter a user's mail at the distribution site (``remote kill file'') o remote system administraion (optional) o password authentication (optional) o accounting system for commercial "pay for use" subscription mode (optional) o caches messages (user definable) so users who filter a thread can retrieve it later o internalized cron for running time dependent activities (right now, the utilities that come with it generate weekly list statistics (with pretty ascii graphs), back up user list, move and compress logs, send digests, filterlists, and more) o incoming filter interface for doing useful things like decrypting signed messages or remapping anonymous id's into real e-mail addresses (``cryptofilt'' is a utility I wrote to try this out, although it needs lots of work) o user controllable digestification - users can turn digest mode on or off and alter the size of their digests o nightly filter list - when messages are filtered out by your filtering agent, you still get a list of who and what was filtered incase something was killed that you wanted to receive. You can then request to have it resent o anti-spamming routines * small messages can be configured to be trapped (such as 1 liner ``unsubscribes'' which are then forwarded to the list administrator) * large messages are truncated and stored for later retrieval for those who request them (configurable, I have it set to 50k right now) * blacklist - a regexp can be applied to incoming headers to prevent certain addresses getting through * ``members only mode'' - the list software rejects posts from those who are not subscribed o duplicate messages trapped - the list software keeps a recent database of message-ids and their header info o thread tracking via subject and ``in-reply-to:'' o built in help system o automatic sending of welcome/goodbye messages for subscribe/unsubscribe o automated billing (part of the accounting system) o complete logging of almost every list transaction (optional) o cpu cost logging (in case the list is run from a commercial service like the extropians where we have to pay to run the list) o distributed distribution - if your machine can't handle the mail bandwidth, the list software packs up the message and the list of users it is addressed to and sends it off to another machine for delivery The delivery agent which comes with the software supports the following: exclude messages by user exclude messages by thread include messages by user include messages by thread Several people on Extropians leave their agent settings in ``exclude all'' mode. They then view the list of filtered messages and include the threads which interest them. ``exclude user detweiler|sboxx'' would prevent Detweiler's posts from reaching you for example. (assuming he wasn't blacklist or he wasn't a subscriber and the list software was in members only mode) Other agent commands: private - automatically deliver response to a list of users privately and set ``reply-to'' to point to you resend - grab ranges of messages or messages by thread from the message cache sorts them into a digest and sends them to you search - performs an agrep on the cache and sends you a list of messages that match The disadvantages of running it: o command syntax learning curve for new users o documentation sucks (virtually nonexistent) o code needs to be cleaned up a lot. I learned perl at the same time I wrote it. Fortunately, perl is easy to learn and the greatest language in the universe. o cpu hog (5-8 seconds to process a message, only a problem if your list is high volume like extropian's which averages 50 messages per day) (extropians runs multiple agents so our cpu is much higher) o complicated to set up (but easy to administrate) o a little bugged, because I keep extending it however in the two weeks (before classes start) I have been doing nothing but bug killing Requirements o perl o a good dbm library (normal dbm is a little tight, so users won't be able to store that many exclude settings. about 10-15 is the max) I personally recommend the berkeley db/hashing package. I recompiled perl with it and the code is faster and the disk space used is a lot less o about 4 megs disk space * 1 meg for the message cache * 1 meg for the code * 1 meg for the recompiled perl with better libdbm * 1 meg to hold the logs (although you can disable this) you can get away with 2 megs of space or less o patience I would consider leasing it (free) to cypherpunks. Other people will have to wait to get it. The reason is because I am not yet done developing it, documenting it, and I don't own it. (I developed it on a contract with Extropy Institute and they own it.) Cypherpunks has already been given permission to use it if they want (and I wish they would, or atleast run a digest list so I can resubscribe) -Ray -- Ray Cromwell | Engineering is the implementation of science; -- -- rjc(a)gnu.ai.mit.edu | politics is the implementation of faith. --

1 0

REMAILER ABUSE: Detweiler Accounts
by an6244＠anon.penet.fi 17 Dec '03

17 Dec '03

------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

the termination of wild "deteiler" accounts
by an6244＠anon.penet.fi 17 Dec '03

17 Dec '03

Hi all, I suspect that after was related to me via the BlackNet(a)cyperspace.nil key and anonymous remailer block that come monday we will find that our problem with LD has evaporated temporarily. On The subject of "MEDUSA".... I didnt realize until I got a few responses back that there are a few of you that post under that pseudonym and typically ALL CAPS posting... monotonous to read but great fun, you realize all 6 of you, that you and the tentacles probably have driven that poor soul buggy... great fun.... but its 2-3 of that latest series that I was convinced that was coming from the same person... and quickly realized that due to syntactical habits and patterns that you are at least 2 if not 3 people.... and checking over blacknet archives I find good evidence of at least 4-6 additional people..... bout those non-responses from BlackNet(a)cyberspace.nil.... I am sorry we have to occasionally turn down requests from our growing subscriber base but we do have to be careful with what falls into our virtual hands and act as middleman for... you know who you are... and to the "spooks" we dont do business for or with police/govermental/TLA's of any types.... sorry... but you guys really dont pay your bills in the specified payment methods too well... if you have something to trade again take it somewhere else... I heard basically from one of those MEDUSA's that there was a booby trap in the posting itself by the Original MEDUSA poster that would at least result in all the nis accounts that MEDUSA paid us to publish being temporarily if not permanently revoked... I promised not to tell.... (for one wweek) the only way we will know is when Detweiller arranges for yet another account "someplace else" and finds another way to get on the net to belabor the tentacles for the MEDUSAs actions... I hope source filtering for remailers is implemented by then... At least one of the MEDUSA posting made reference to AARM of richard depew fame would that MEDUSA send it to our penet account for archiving? Thanx in advance.... Regards Sam Hill - BlackNet researcher p.s. thanks Perry for your actions regarding the sysadmin... it worked and coordinated beautifully with the various MEDUSAs that have corresponded and done business with BlackNet(a)cyberspace.nil ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

2 1

No Subject
by css＠netcom.com 17 Dec '03

17 Dec '03

I would like to apologize to the administrator of the cypherpunks mailing list and any readers who were affected by my attempt to get off the list. I admit that I lost my temper and acted inappropriately. I missed the introductory statement probably because it failed to stand out from all the other 50 messages I received on the first day, and got deleted. I also have never subscribed to a mailing list before so was unfamiliar with conventions for unsubscribing. I lost my temper because all my attempts to get off the list seemed totally ineffectual, I was receiving 30-50 messages a day, and I accidentally deleted some of my other mail in the mass deletions I was doing. I would recommend that mailing list administrators include a small signature with all messages describing how to get off the list for people like me who aren't familiar with conventions and may have missed the introductory message. I would also recommend automation for such a high-volume list so that people can get a quick response. I assumed all along that I was dealing with remailer software, not a human administrator. Of course I knew there was a person responsible for the software, but I assumed it was automated and that since I couldn't seem to get the software to respond I would have to take stronger measures. I'm obviously new to the net and don't know things like how to find a phone number or address for the person responsible for a remailer (I now know thanks to the advice of a cypherpunks reader). What I did whan I felt I had no other recourse was set up a file full of UNSUBSCRIBE messages and put in a loop mailing it to three administrative addresses at toad.com. I let it run for 5 or 10 minutes. I hope all these messages did not go to everyone on the list. I was just trying to get the attention of an administrator. It worked. Please accept my apology for the inconvenience I caused. I acted immaturely. I now know how to get off a mailing list thanks to many helpful responses from cypherpunks readers. It is ironic that my initial futile attempts to get some response by bouncing letters drew vicious flames, but whan I crashed the remailer I got many polite and helpful letters on how to get off mailing lists. I must say that the foul-languaged flames I got from some cypherpunks readers played a major role in my losing my temper. All I did was bounce one days worth of messages not knowing what else to do and boy, did some people go through the roof. After I received numerous letters with four-letter words and other verbal attacks, I sent another message to the two cypherpunks addresses I had requesting for the third or fourth time to be withdrawn from the list. I said that if I did not get any response, I would try to shut- down the remailer. I waited several days and got no response. Enough said. I think I am off your list now so I will get out of your hair.

1 0

[mimir@illuminati.io.com: Re: your mail]
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>From: Al Billings <mimir(a)illuminati.io.com> >On Sun, 23 Jan 1994, Chris Schefler wrote: >> As I said, I am still receiving your messages. >Ever try sending mail to cypherpunks-request(a)toad.com? That IS the Admin >address. They took my request and processed it within 24 hours when I had >to switch my membership to another account. I must say that I attempted to subscribe in december and didn't start receiving mail until the second week in january. At that time Eric explained to the list that he had been away for some time. By that time I had subscribed from another address, and suddenly found myself reading the list from two accounts. It had been so long since I subscribed that I had forgotten the cypherpunks-request bit, and just remembered that it was some 'toad' thing. When I saw someone had sent a cancel request to cypherpunks(a)toad.com, I assumed that was correct. My own attempt to unsubscribe from the extra account resulted immediately in 3 mail messages, two of which were somewhat abusive. One person seemed to be under the impression that this is a usenet group, and therefore I shouldn't send unsubscribe messages to it, since only mailing lists are for subscribing/unsubscribing. The next day, Eric sent me mail with the right address for unsubscribe requests.

1 0

subpoenas of personal papers
by smb＠research.att.com 17 Dec '03

17 Dec '03

I just saw a news story that bears on one of the perpetual questions on this newsgroup: can you be compelled to turn over your encryption key? In Doe vs. U.S. (93-523), the Supreme Court declined to rule on whether or not someone can be forced to turn over his personal appointment calendar. By doing so, they let stand an Appeals Court (2nd Circuit) that he could *not* invoke the Fifth Amendment. That court ruled that ``testimony'' was protected, but not personal papers. There was a Supreme Court ruling in 1886 protecting such papers, but that's been eroded over the years, and the Supreme Court has ruled several times that business records are not protected. And in a concurring opinion in 1986, O'Connor wrote ``The Fifth Amendment provides absolutely no protection for the contents of private papers of any kind''. --Steve Bellovin

4 3

Re: subpoenas of personal papers
by Ron Davis 17 Dec '03

17 Dec '03

>I just saw a news story that bears on one of the perpetual questions on >this newsgroup: can you be compelled to turn over your encryption >key? In Doe vs. U.S. (93-523), the Supreme Court declined to rule on >whether or not someone can be forced to turn over his personal >appointment calendar. By doing so, they let stand an Appeals Court >(2nd Circuit) that he could *not* invoke the Fifth Amendment. That >court ruled that ``testimony'' was protected, but not personal papers. >There was a Supreme Court ruling in 1886 protecting such papers, but >that's been eroded over the years, and the Supreme Court has ruled >several times that business records are not protected. And in a >concurring opinion in 1986, O'Connor wrote ``The Fifth Amendment >provides absolutely no protection for the contents of private papers of >any kind''. Being a relative newbie to cypherpunks I realize I'm posting at my own risk... It is my understanding that you can be compelled to at least provide decrypted information. In other words the court can say, "We want your PGP e-mail, deliever it to us in an unencrypted form." A question may be how they could prove you didn't alter the information while decrypting. This could be acomplished by supervising you while you decrypted the info, with attorneys for both parties present. Of course an attorney could still argue you could change it and want the court to do the actual decryption, therefore demanding you turn over your key. ___________________________________________________________________________ "I want to know God's thoughts...the rest are details." -- Albert Einstein _________________________________________ Ron Davis rondavis(a)datawatch.com Datawatch, Research Triangle Park, NC (919)549-0711

1 0

REMAIL: Cover traffic
by Hal 17 Dec '03

17 Dec '03

Several people have suggested that the remailers could send bogus messages amongst themselves in order to allow more "confusion and diffusion" of the other messages passing through the remailer network. The remailers could then batch up incoming messages fairly frequently and still have many messages in a batch. The problem with this that I see is that, looking at the remailer network as a whole, you still may have one message in and one message out a short while later. The fact that it was temporarily mixed up with a bunch of other messages doesn't help much if this message is the only one to leave the network. If the Opponent has the ability to monitor all traffic into and out of all nodes of the network (as he would have to do anyway to defeat remailers even without this cover traffic) then he will easily be able to find the messages which are not aimed at other remailers. For cover traffic to be useful, it would have to be indistinguishable from real traffic as it enters and leaves the network. So messages aimed at known "bit bucket" addresses, or at a few cooperating individuals who accept and discard incoming addresses (the same thing, really) will not help. Hal

2 1

archiving on inet
by Jim choate 17 Dec '03

17 Dec '03

I want to thank everyone for their input on this topic, very enlightening... Seems to me that if a work is by simply being created has a copyright on it then every inet provider who stores material a hard drive could be prosecuted for copyright infringement. There has been some question raised as to why this is important to cpunks, it goes like this. If we are going to creat a workable system then some form of release has to be done so that work that goes over inet is public unless explicity noted as copyrighted and must include a fair use statement OR it must be in a form that prohibits casual access. What this last point means to me is that if it is copyrighted it should be encrypted. This encryptred file would have a address and public key attacked. To unlock the file you would contact the author and fulfill their requirements for fair use (ie pay money for a book). The author would then send a private key to the user who coul then unlock the file and use it. Anyone who had possession of a unlocked file without a private key and being on the authors list of authorized users would be committing a clear case of theft. Anyone who gave a third party a valid private key would be committing conspiracy. At this point I expect my home node to come online in a couple of weeks (we may have finaly solved the bugs that kept us down) and should start allowing public access a week or so after that. Each user who calls my system will need agree to a statement of something like the following: I, (username), agree that any material which I create on this system or one of its satellite systems is public domain. I also agree that this statement is binding to my physical person and not to a particular handle or name that I may choose to use or change. I further agree that any material of commercial or of a copyrighted nature MUST contain a fair use policy that prohibits ONLY commercial use AND will contain a real address by which any person may contact me for further interaction. I further agree that any file which is of a commercial or copyrighted nature and does not fulfill the above conditions MUST be encrypted and contain in plain-text a address whereby a person may contact me for access the un-encrypted material. I further agree that as long a the file is encrypted OR contains a fair use statement I wiwll not bring any legal proceeding against ANY provider or user in Internet or other electronic system this material may be transfered to for storage. Does anyone see any problems with such a proviso?

3 3