December 2003 - cypherpunks-legacy

Final draft of editorial to SF Chronicle
by raph＠netcom.com 17 Dec '03

17 Dec '03

This is the final cut. Only minor copyedits have been made. Thanks to all who responded -- about a dozen messages all strongly in favor. Anyone know the email address or fax number for the Chicago Tribune? Raph Chaos and Anonymity keep the Internet Vital I could not let Martha Siegel's editorial ("Anarchy, Chaos on the Internet Must End", 2 Jan 1995) go unchallenged. To the uninformed reader, her arguments may seem plausible. However, her distortions give a picture of the Internet quite at odds with the true nature of the Net. Her views are by no means representative of those who actually use the Net. Of the dozens of messages I saw in response to the editorial, not a single one was in favor of her proposals. As Ms. Siegel correctly points out, the Net is not governed by any one individual person or organization. Rather, it is collectively run by those who use it as part of their daily lives. The operation of each Internet node is subject to the individual judgement of the people who own it. Ms. Siegel is wrong, however, in believing that such a state of affairs is intolerable. Rather, this state of affairs has brought us a remarkable flowering of discourse, ideas and culture, which is just now beginning to be recognized in the mainstream press. In a lawyer's dream world, there is a rule covering every action in every situation, along with a well-functioning system to enforce the rules. This is the exact opposite of the spirit of the Net, and in particular of Usenet, the collection of ten thousand newsgroups which carries most public discussion on the Net. Rather, there has evolved an informal set of guidelines for promoting open, civil discourse, collectively known as "netiquette." These guidelines may seem arcane to newcomers, but basically they simply ask people who use the Net to be considerate of other people, their time and their resources. A violation of netiquette brings on not legal action, but responses pointing out why the action was inconsiderate. Continued violation brings on ridicule and scorn -- people who engage in this are considered to be either sociopathic or just obnoxiously self-promoting. The single most infamous breach of netiquette in Usenet history was almost certainly the "green card spam," in which thousands of advertisements for green card services were posted to completely unrelated newsgroups. Advertisements presented in a way considerate to others are tolerated and even welcomed on the Net. Posting thousands of copies, though, is just going too far. Negative response was immediate. The perpetrators were asked to stop, but they refused to. One Norwegian hacker took it upon himself to track down and "cancel" the offending messages. Most people on the Net considered this to be entirely appropriate. A number of other self-promoting hucksters have sensed an opportunity, and have performed similar spams. In response, the Net evolved a defense mechanism to counter these spams and minimize the damage. The person currently serving this role is known by the pseudonym "CancelMoose." Almost everyone on the Net supports this effort, and agrees that it improves the overall value of Usenet. Who was responsible for the original green card spam? Why, Ms. Siegel herself, the same one who is complaining about "chaos and anarchy." Chaos, anarchy, and anonymity are a large part of what keeps the Net so vital. Particularly galling is Ms. Siegel's appeal to free speech. Usenet in its present form is perhaps the most conducive forum for free speech in history. The threat to free speech is not from chaos or anonymity, but from the sorts of changes that Ms. Siegel proposes. Usenet is astonishingly effective in getting around the practical barriers to free speech. These barriers come in many forms, including libel, trademark, and copyright laws, fear of retribution, etc. Because of its decentralized, communal nature, Usenet resists direct attempts to censor. The main tool for circumventing these more indirect barriers is anonymity. As an example of such barriers, take the t-shirt commemorating the green card incident. It was emblazoned with the words, "Green Card Lawyers - Spamming the Globe" and a fist clutching a green card. Shortly after the shirt was proposed, Canter & Siegel threatened to sue if the shirt was in fact produced. It was only after several outraged lawyers promised to defend against such a case pro bono that I and others could be proud owners. Or take one of the sexual abuse recovery newsgroups, where anonymity is the norm. If someone were to post a message asking for support, saying "my uncle did it" under their real name, they would be vulnerable to a libel suit from said uncle. On the other hand, if they used an anonymous service such as the one in Finland, they would not simply escape punishment for the libel, but prevent it from happening at all. In many countries (and even China is on the Net these days), writings critical of the government, such as exposure of human rights abuses, are illegal. The authors face imprisonment, torture and death. By posting anonymously to the Net, the information can be brought safely to the attention of the world. Not all anonymous messages are pleasant or popular. Unpopular speech is a necessary consequence of free speech. At least to the founders of this country, the benefits of free speech outweigh the discomfort. Our founding fathers were also comfortable with anonymity -- the Federalist papers were originally published under the pseudonym Publius, because the authors felt the ideas should stand on their own, without opinion being swayed by the names behind them. Judging from the materials already published by Ms. Siegel, an Internet built according to her vision would be free of such disturbing ideas, but would readily support five hundred channels of green card ads, impassioned pleas to purchase American flag plaques, and, yes, anonymous testimonials for radial keratotomy specialists. ------------------------------ Raph Levien is a graduate student in computer science at the University of California, Berkeley

1 0

Media watch
by A.J. Janschewitz 17 Dec '03

17 Dec '03

NPR's "Weekend Edition/Saturday" has an insubstantial piece on Phyber Optik on today's program, check local NPR times/listings. Nexis-hunters might want to check out a manifestly stupid editorial in today's Hartford (CT) Courant, significant only because it is the (L-A Times-owned) paper of record in the state of greatest wealth in the U-S. I would summarize it, but I don't understand it; something to do with shrink-wrap copyrights and digital cash. Fax copies sent to interested parties, just give me a number. ==a.j.== "The large print giveth and the small print taketh away." - Tom Waits

1 0

Re: How do I know if its encrypted?
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

Paul, I think we're after two different objectives here. You want Alice to be sure that Dave can't read her file; I want Dave to be sure that he can't read Alice's files. Alice should worry only about her privacy: if she doesn't want Dave to know what she's sending, she should encrypt her file in a way that Dave cannot break. Dave certainly doesn't want to know what Alice is sending him, because he might have to answer to a Grand Jury if he did. My protocal makes it very difficult for Dave to gain any useful knowledge about Alice's files. Dave does this not as a courtesy to Alice, but for those three wonderful letters, CYA. Of course, any data haven worth paying for will offer lots of neat features, like PGP support, anonymous file drops, and all other sorts of goodies. But that does little good if Alice can trick Dave into selling child pornography. Douglass Floyd asked, "How do I know if [be certain that] it's encrypted?" Unfortunately, I'm pretty sure the answer is, "You decrypt it." My protocol at least delays the decryption until it's [hopefully] too late to matter. b& [Here's part of the thread; nothing new follows.] At 11:00 PM 1/13/95, Paul J. Ste. Marie wrote: >At 10:07 PM 1/13/95, Ben Goren wrote: >> ... Alice hashes her file and uses that hash as the key to encrypt the file. >>She sends the file to Dave, and sends the original hash when she wants it >>back. Dave decrypts, and confirms the hash. >> >>Unfortunately, this still doesn't quite close the loop--Dave knows the >>contents of the file once Alice sends the key. It does, however, make it >>very difficult for Dave to know anything about Alice's file. ... > >This seems overly complicated. If Dave has a known public key, then Alice >should be able to hash her file, sign the hash, encrypt (the hash, her >public key, and the file) with Dave's public key, and (anonymously) sends >the result to Dave's (encrypted) address. Dave then decrypts, verifies the >sig, and stores the file, hash, and PK together, indexed by the hash. > >When Alice wants the file back, she signs (the hash and her encrypted return >address), encrypts the result with Dave's key, and sends it off. Dave >decrypts the request, fetchs the public key based on the decrypted hash, >verifies the signature, encrypts the file with Alice's provided public key, >and sends it back to the encrypted return address. > >To avoid Dave's knowing the file contents, Alice can encrypt it before the >described protocol and decrypt it afterwards. The protocol is subject to a >replay attack, but the result of the replay would cause the file to be sent >to the original sender and not to the replayer. > >The signed hash in the first step prevents people from spamming Dave with >files that have Alice's public key. Alice only requires an encrypted >address and public key for Dave, and Dave validates the retrieval request >against the public sent in the first step. > > --Paul J. Ste. Marie > pstemari(a)well.sf.ca.us, pstemari(a)erinet.com -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0xCFF23BD5.

1 0

RE: State of PGP dll?; Encrypted session projects
by Pat Farrell 17 Dec '03

17 Dec '03

sdw(a)lig.net (Stephen D. Williams) writes: > What is the state of the Windows/.dll PGP libraries? > Does anyone have a usable version yet? I helped David get a compiled version of a .DLL, but it was way too raw to use. Specifically, all we did was make a DLL of all of the code, exporting all of the subroutines. A usefull .DLL would only publish the "important" ones, and leave the internals hidden. The selection of which routines need to be classified as "important" is a bunch of work. Additionally, I expect that some of the routines would really be better off with a wrapper that made less of their internals visible. All quite doable, but a non-trivial effort. I know I'm too busy to attack it. > For Windows: twnsck12.zip, which is simple, is GNU, and has source and > by writing a relatively simple windows serial terminal emulator and > using Comt ($15 or 25 shareware) to convert it to a telnet client. > Both of these could be modified fairly easily. There are sources to a simple terminal emulator in the MSVC samples directory. Changing it to use sockets wouldn't be all that hard. Last time I looked, comt didn't work under NT, and so I stopped looking at it. There are also terminal emulators in the code in at least two books, Monk's Windows Programmer's Guide to Serial Communications, and Nelson's Serial Communications, a C++ developers's Guide. Since I'd much rather write C++ than C, I prefer Nelson's. I use ewan as a terminal emulator, got it from cica or wustl, I forget which. Dunno if sources are availavle. > Does anyone have better ideas? Any suggestions on login/key > exchange sequence? SKey would work if you are talking to a unix box that you can get the admin to change. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

1 0

Re: How do I know if its encrypted?
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 09:17 PM 1/12/95 -0600, Larry E wrote: > ... > (1) the people who use the remailer, who get a measure of > comfort from knowing their communication is secure They know it's secure because they made it secure. If they don't care, I don't particularly see why the remailer should care. > (2) legal groups etc. who may try to hold the remailer > liable in some way for what passes through their remailer. It strikes me that this is a very weak defense. Legal beagles will probably argue that the remailer should have either prohibited encrypted communications or else was in collusion with the sending party. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

2 1

Slogan/procmail help
by jsled＠free.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Speaking of testing stuff.... After my last question about C'punks slogans, I've messed up some stuff and haven't storage of the list since, therefore I don't have any of the replies. If anyone would like to compile a list of what's been said (if anything) and mail to to me (to jsled(a)ctp.org) I'd be eternally grateful. Also, if anyone is fluent in procmail (I think there are a couple of you floating around), please mail me at jsled(a)ctp.org... Thanks a bunch, sorry for the annoyance. Joshua M. Sled <jsled@ctp.org/jsled@free.org> -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLxfoaaTT29daLBKRAQGXlQP/dYc4aPR7rNApmqG78jIDhYZJh6bqMg4i AXVAAZ5IzLP4Z/qch7zkiTM05DjbmXOzkcVBmhlGlO+H2VfNug569A/jEKFnDrDs wg0Rv5mPWLo74zUECHxp7faviAVmOxt7Bx3JzQCmHZXBekq+owUetEraq9hKzCzr qQR+KUq3X+k= =4gq8 -----END PGP SIGNATURE----- --- þ KWQ/2 1.2g NR þ "MTV get off the air!" - DKs

1 0

Re: Cybersmut
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

John Young quotes NY Post on Kiddie porn: Rule No. 1 is that [kids] must never ever give their real name, address or telephone number to anyone on-line. Hurray! Let's teach the next generation the value of pseudonymity now! BAN TRUE NAMES! Note: I still have mine in my sig though... too late for me. Tim's axed his phone # suddenly! ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Data Havens, NOT!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Hal Finney writes: > The data haven concept as I understood it held data for public access in > some form (for sale or for free) which would be illegal in some > jurisdiction. This might include credit information that was older than > the legal limit, libelous claims, damaging medical records, etc. > Frankly, I suspect that most usages would be directed towards reducing, > rather than increasing, individual privacy. So this is not an area I am > interested in working towards. I believe the Data Haven started out as a Message Haven to get the effect of anon remailers with less traffic analysis hassles, so there would be no pseudonymous login or anything, you'd either download everything, or apply some filter (as with an alt.anon-messages group). However, the current discussion of glorified remote file systems makes no sense to me. If you can keep something encrypted on a remote site as an archive, you can do it at home. A data haven is more likely to get busted than your home PC; serious efforts (RF pickup of keystrokes/display) will be equally effective in either case. Here's a summary of data havens as I see them: Remote file system where people can anon/pseudonymously dump and read files - in the 'pure' variety there'd be no record of who posted/can read a file. Advantages: 1. Could hinder traffic analysis, if they did not have pseudonymous login in any form. 2. Could act as a store of encrypted data for those who can't/don't encrypt on their own systems 3. Could act as a backup OTOH: 1. Would depend on 'correct usage' ie download of enough irrelevant cover data, and would be vulnerable to analysis at the TCP/IP level. Newsgroups remain far better as means to evade traffic analysis 2. Don't keep all your encrypted BlackNet commodities in one basket - it can be busted more easily than your home machine. If you can encrypt there you can encrypt at home; if encryption is illegal at home, you can't legally access the havens. 3. Pfaugh! Rent space on Netcom. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Re: How do I know if its encrypted?
by Hal 17 Dec '03

17 Dec '03

If you want to not be able to read the files on your storage site, then why not just try reading them? Check their entropy to make sure it is maximal, check that they can't be unzipped, unstuffed, displayed as gif or jpeg files. When a new format becomes popular add that to the list. This is all you can do. What does this gain you? I'm not sure. If someone posts encrypted Windows 95, then publicizes the location and the key, people will get the data just as easily as if it were not encrypted. Hal

1 0

Self-service computers
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

A friend of mine forwarded this to me; I couldn't resist forwarding it to the list. b& ---- Date: 4 JAN 1995 16:32:23 -0500 From: Kay Lukens <klukens(a)halcyon.com> Newgroups: alt.humor.best-of-usenet Subject: [pdx.general] Re: Keep self-service COMPUTERS out of Oregon! From: keithl(a)chip.klic.rain.com (Keith Lofstrom) Newsgroups: pdx.general,or.politics Subject: Re: Keep self-service COMPUTERS out of Oregon! It has been pointed out by the stalwart defenders of our rights (to be told what to do) that self-service for gasoline is a Bad Thing. We are assured by many of the same people that self-service for pharmaceuticals, personal defense, transportation, and education are also Bad Things. Other folks, nominally their political competitors (in the same sense that Burgerville and Burger King are competitors) assure us that self-service in personal morality is an *extremely* Bad Thing. And look at what happened to Joycelin Elders when she suggested self-service for sex... >From this, we must conclude that self-service is in itself highly suspicious. Look at self-service grocery stores - all the time people are buying things that are bad for them. Self-service entertainment has resulted in Beavis and Butthead. And look at the way many computer professionals dress - if this is not an indictment of self-service apparel, what is? However, in the finest tradition of bureaucratic micromanagement, we as computer professionals are not qualified to even consider these effects on other aspects of Society. Such thoughts must be reserved for Wiser Heads Than Ours (unless of course the subject is economics or nuclear power, in which case Our Opinions Count). No, we as computer professionals must confine our thoughts to self-service as it affects us - through our flagrant, dangerous, and socially irresponsible use of Self-Service Computers! Self-Service Computers: Threat or Menace? Carpal Tunnel Syndrome. Backaches. Obesity. Bleeding Piles. Bill Gates and Steve Jobs. Computers are a known health threat. Reputed Scientific Journals, such as the National Enquirer, are full of stories of people being turned into three-headed cabbages by Nucular Radiation from video displays. It is obvious that the average computer professional, while quite able to find obscure flaws in Pentiums or the secret levels in Doom, is a helpless incompetent when it comes to actually typing on or reading from personal computers. We get so caught up in our alleged thinking that we don't notice our bodies turning into rickety tubs of cancerous lard. We Need Help! Meanwhile, the Great Unwashed Masses are being deprived access to the Information Super Duper Highway. Confined to low paying jobs as sanitation workers or Congressional Representatives, these poor wretches are unable to share in this cornucopia of undocumented, virus-ridden software, poorly informed opinion, and stolen pornography that we call the Internet. These outcasts of the information age must fritter away their time which such mind-numbing activities as outdoor sports, rampant sex, and junkets to the Caribbean. When these people accidentally find their way onto the Internet, perhaps by mistakenly sending their rent check to America On Line, they begin posting meaningless, inappropriate drivel such as spam advertisements for shady lawyers, or actual referenced facts from original sources, violating the hallowed traditions of the Internet. While all citizens must have access to the Net, LET'S NOT GET CARRIED AWAY HERE. What Should We Do? (That is, how can we find new excuses to control other people with minority opinions?) The only solution is to ELIMINATE self-service computers! Every computer in the State of Oregon *must* be operated by THREE OR MORE people - one to do the thinking, one to do the typing, and one to read the screen - preferably through a foot of leaded glass! Think of all the jobs this would create! Not only would we have jobs for all the new operators themselves, we could create vast new bureaucracies to insure that the operators are specially trained, certified, and licensed! Computer Cops could roam the streets, equipped with special Jolt-sniffing dogs, breaking down the doors of self-service scofflaws! Pizza delivery drivers would find new income and respect by turning in their hacker clients! Elizabeth Furse, famous for not reading her own email and for having flunkies type in press releases, will become our shining symbol of the new, socially responsible computer age! You can help. Send your checks to C.A.S.H., the Committee to Abolish Selfservice Hardware, care of me (thnx Frank). I will see that your donation gets the attention it deserves. And on behalf of all of us here at C.A.S.H. (Arnold who handles the left side of the keyboard, Julia the right side, Millie the punctuation, Sam who reads the verbs, Trevor who reads the nouns, and our shop steward Penny, who is lobbying for a government grant to bring in a mentally-challenged lesbian vegetarian special needs hispanic-surnamed person of color to watch the blinky lights on the modem) may you have an appropriate and socially enlightening seasonal celebration! -- Moderators accept or reject articles based solely on the criteria posted in the Frequently Asked Questions. Article content is the responsibility of the submittor. Submit articles to ahbou-sub(a)acpub.duke.edu. To write to the moderators, send mail to ahbou-mod(a)acpub.duke.edu. -- Ben.Goren(a)asu.edu, Arizona State University School of Music Finger ben(a)tux.music.asu.edu for PGP public key ID 0x875B059.

1 0