December 2003 - cypherpunks-legacy

(fwd) e$: PBS NewsHour, Path Dependency, IPSEC, Cyberdog, and the Melting of Mr.Bill.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - --- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: e$(a)thumper.vmeng.com Mime-Version: 1.0 From: rah(a)shipwright.com (Robert Hettinga) Date: Mon, 22 Jan 1996 10:37:28 -0500 Precedence: Bulk To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: e$: PBS NewsHour, Path Dependency, IPSEC, Cyberdog, and the Melting of Mr. Bill. I thought I'd crank this out in light of Friday's NewsHour segment about Apple and the path-dependency of the microcomputer market. Contrary to what PBS would have us believe, ;-), the concept of path dependency in technology, and in economics, for that matter, is a proven fallacy. At the risk of sounding credentialist (*I'm* not an economist, either), the NewsHour's Mr. Solman seems to be proof that journalism isn't economics, no matter the journalist's academic credentials. Journalists have to get a story out, and sometimes there's no story in the actual economics of a situation. Certainly there's no story in the non-existance of path dependency. The most famous example of path dependency, the idea that our previous economic choices doom us to repeat those choices forever, is the QWERTY keyboard, which has been proven *not* to be significantly slower than the Dvorak keyboard, its supposedly more efficient alternative. Dvorak, the designer of the alternative keyboard, was also the same person who conducted the "ergonomic" studies (spending our WWII tax dollars, I might add) "proving" it's efficacy, and elevated his keyboard to the status of an urban legend. Dvorak was at worst a fraud and at best deluded with his own grandeur. Reviews of Dvorak's own data show some significant flaws in both research methdology and data handling. In addition, several independent studies since then have shown that randomly selected beginning typists, starting out on one keyboard or the other, have *never* shown any significant difference in typing speed. The Betamax/VHS videocassete war, another example of path dependence, was more one of Sony not having an open standard than anything else. Sony played dog-in-the-manger with it's own technology, and consequently ended up owning the most lucrative market on a profit-per-machine basis, the one in television broadcasting. It also means they were leaving big money on the table where the largest market was, in consumer electronics. Doesn't this sound familiar to Mac fans? Path dependence had nothing to do with it. Consumer Reports did comparisons at the time showing only a marginal difference between Betamax and JVC, and nowadays there is absolutely no percievable difference between the two. I now challenge anyone (including, unfortunately, Apple's own *psychologist*, quoted in the NewsHour piece) to *prove* path-dependence in the current market "hegemony" of Microsoft on the desktop. It ain't so. The reason that Microsoft has business computer market dominance today is *not* because of it's original *perceived* incompatibility with legacy mainframe equipment ("nobody ever got fired for buying IBM -- or Microsoft"). Technically, mainframe compatibility was a non-issue at the time. It certainly wasn't for the first 5 years of the Mac's life, anyway. Apple could have done something about the mainframe compatibility issue with simple marketing communications if they had paid any attention to it at all. Apple's heart was never in the business market. First of all, for all their lip service to business, they really weren't ever attracted to the idea of building better word-processing and spreadsheet boxes, even if they did have the best one, before Excel and Word moved to Windows, at the time of the big ramp up of the business microcomputer market. It showed in their attitude to most business people. Outside consultants and mavericks were always the heroes in Apple's commercials, and so outside consultants and mavericks were attracted to the Mac as a computing platform, but large businesses and conformists weren't. When compatibility with mainframes actually did become an issue, for the short time when people were offloading their mainframe data onto LANs, Apple didn't want to be there anyway. With the advent of LANs, Apple didn't build the technology to deal with LANs head on on their own turf, large corporations. Apple built peer-to-peer networks of collegial desktop machines. Unfortunately, they never paid attention to the bandwidth or the multitasking premia necessary for those networks to function properly from the high-volume user's point of view, and, so, when someone downloaded a file from your machine, and you printed something in the background at the same time, you suffered a performance hit if you tried to do anything else. Your mouse jerked around the screen, or your words wouldn't show up in a window as fast as you typed them. With PC file and print servers, this was less of a problem, because those two jobs were offloaded to a seperate machine, whose job it was to do nothing but run a printer, or to serve files. Since everyone had to be connected to these servers the local area network, or LAN, was born. On Apple networks, every machine is potentially a server for everyone else, and everyone is their own print server. Only after PC LANs became ubiquitous did Apple ever build servers of their own. Again, their hearts weren't in it, because they were more interested in the possiblities of more distributed, collegial, peer-to-peer networks. Fortunately, the first problem, network bandwidth, has been solved, because almost all Macs now come with ethernet, while the second problem, preemptive multitasking on faster processors, is being solved slowly. This is all very good for Apple, because peer-to-peer architecture is where the world's going to go anyway. The whole internet is a peer-to-peer, "geodesic" network, where each machine is optimized for it's own particular function, be it serving, or switching information. There is no central repository of anything. That has been Apple's view of networks since day one. If it's any consolation, we won't even need LANs to do business with, anyway. A couple months ago, I saw Netscape running in the bond trading room of this country's largest institutional trustee bank, of all places. In their case, Netscape beat Powerbuilder hands-down in a prototype development shootout. The prototype *was* the production version. Netscape can do anything from secure outside-the-firewall SQL calls to actually conducting cash commerce. Game over. By the way, Netscape is not special in this regard at all. So can any other sufficiently secure browser server combination. Either one, client or server, can be developed for a dime a dozen even now. This is especially true when compound document architectures come on-line, like Apple's Cyberdog, an internet implementation of their OpenDoc software object technology. The reason we won't need LANs is because the only real difference between a LAN and the internet is a firewall for security, and the need for clients to speak Novell's TCP/IP-incompatible proprietary network protocol. With internet-level encryption protocols like the IETF IPSEC standard, you won't even need a firewall anymore. The only people who can establish a server session with *any* machine connected to the net will be those issuing the digital signatures authorized to access that machine, no matter where those people are physically. When that happens, networks will need to be as public as possible, which means, of course, TCP/IP, and not Netware. It's like Heinlein's old joke about space, "once you're in Earth orbit, you're halfway to anywhere". So, once you've gotten *rid* of the firewall, you're everywhere. So much for the path dependence of the LAN market. What happens to the information concentrated behind those firewalls -- or proprietary software markets, for that matter -- when, because of strong cryptography, firewalls disappear? Remember what happened to those floating globs of grease in the detergent commercial? Surfacted away into little tiny bits. I can hear Bill Gates now: "I'm melting!, I'm melting!". Ding, dong, Mr. Bill is dead... Game over. Now you see why he's fighting so hard to be net-compatible all of the sudden. In this "decade of the internet", the [user interface, platform, desktop, LAN, whatever] is meat, and real life is on the net, to paraphrase William Gibson. For the time being, I have come to the conclusion that the Mac, at least as long as Apple makes most of them, is the computer for the "best of us", and, unfortunately, not "the rest of us". I've learned to live with that. I no more worry about Apple's prospects than I do about Porsche's. I expect that Apple management, like Herr Doktor Porsche, is just waking up to the fact that even though they designed the Volkswagen, they can't possibly mass produce them efficiently at a decent enough profit to advance the state of the art, which is really where their hearts have been all along. Sooner or later, Apple will go back to cranking out 917s, to demonstrate the power of the technology, 911s, for a more affordable version of that power, and 928s, for those of us who only want to look the part. ;-). Fortunately, there are lots of companies, like Power Computing, to produce those Volkswagens for those of us who can't afford Porches, and "Macintosh" won't mean just "Apple" anymore. So, for developers, and for me, a fully-credentialled Mac Bigot and camp-follower, the future for Apple means Cyberdog, because Cyberdog means breaking down large "glops" of information and software "grease" and surfacting them, fractally, into little bitty bits out into the net, where *all machines*, not just dumb Java-terminals, can use them better. It also means developing cryptographically strong internet-level security, so that anyone can talk to any machine from anywhere if they have permission to do so, and *nobody* with out permission can either get in or see what those authorized people are doing, with a packet sniffer, or worse, with a key-cracker. It means building into all network applications the ability to do digital commerce. That is, the ability to handle digital bearer certificates, like Digicash's ecash, and the ability to handle micropayments, like the MicroMint protocol or it's successor technologies. Imagine if your code could send you money in the mail, or if a router did real-time load balancing by changing it's micropayment price-per-thru-packet when traffic got too high or too low. The future of the net's going to be a strange place, indeed. Until that happens, I suppose Porsche parts is still a lucrative business, as long as developers keep in mind what business they're really in. Cheers, Bob Hettinga - -------------------------------------------------- The e$ lists are brought to you by: Making Commerce Convenient (tm) - Oki Advanced Products - Marlboro, MA Value-Checker(tm) smart card reader= http://www.oki.com/products/vc.html Where people, networks and money come together: Consult Hyperion http://www.hyperion.co.uk info(a)hyperion.co.uk See your name here. Be a charter sponsor for e$pam, e$, and Ne$ws! See http://thumper.vmeng.com/pub/rah/ or e-mail rah(a)shipwright.com for details... - ------------------------------------------------- - --- end forwarded text -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQO/sPgyLN8bw6ZVAQGuSgP/fkKrI6aTSmPIGOu+LOxRzO5Ptt7QZNxh 48+b7975jIfUMgovphKBWdWtO+jGMCyUWxUVqjVbN8nmwfLT1RZFckOdLK0iM4nD Fgl5+s9yoI0OllHS+oOMcAIyuLIkzazUgtQojm8qBFGSGulW0Keq2dIRNsThGLrk Kk7K3oGMrQs= =71fv -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

7 6

Re: You want to read MY e-mail?
by Alan Pugh 17 Dec '03

17 Dec '03

=snip= >A bill by Sen. Paul Weissmann, R-Louisville, to make e-mail as privileged as >telephone conversations was killed in a Senate committee. > >A somewhat stronger bill still rests in the House. =snip= >Jim Carpenter, press secretary for Romer, said his office was "looking at all >the issues, all the options." > >Duke said he has always complied with requests for public records, but said the >request for e- mail messages goes too far. > >"I'm disturbed by it," Duke said. > >(John Sanko writes for the Rocky Mountain News in Denver.) > > OK, if _I_ can't read your e-mail Mr. Legislator, why should you >be able to read _mine_? a good question. perhaps _now_ they'll get serious about recognising email as eqivalent to postal mail. this would be an excellent way of pushing this elsewhere. when _their_ ox is gored, they'll scream like stuck pigs. one interesting aspect of this would be whether regular mail is considered a public record under the law as far as legislooters mail goes. if so, then she should get it. amp

1 0

RE: Netscape + Verifone
by Steve Makrecky 17 Dec '03

17 Dec '03

What is the frequency on the back of your pager? Some people would like to monitor this type of information. ---------- From: owner-cypherpunks(a)toad.com on behalf of Perry E. Metzger Sent: Monday, January 22, 1996 11:13 To: cypherpunks(a)toad.com Subject: Netscape + Verifone My pager delivers me selected miniaturized Reuters news stories. I just got one that reads: REDWOOD CITY, CA - Netscape Communications Corp. and Verifone Inc. will devise a system to make electronic payments on the internet more secure. Anyone know anything about this? I'm away from my normal sources of such things (like Bloomberg terminals)... .pm

2 1

Welcome to cypherpunks
by Majordomo＠toad.com 17 Dec '03

17 Dec '03

-- Welcome to the cypherpunks mailing list! If you ever want to remove yourself from this mailing list, you can send mail to "Majordomo(a)toad.com" with the following command in the body of your email message: unsubscribe cypherpunks Cypherpunks Mailing List <cypher(a)infinity.nus.sg> Here's the general information for the list you've subscribed to, in case you don't already have it: About cypherpunks ----------------- I. Administrivia (please read, boring though it may be) The cypherpunks list is a forum for discussing personal defenses for privacy in the digital domain. It is a high volume mailing list. If you don't know how to do something, like unsubscribe, send mail to majordomo(a)toad.com and the software robot which answers that address will send you back instructions on how to do what you want. If you don't know the majordomo syntax, an empty message to this address will get you a help file, as will a command 'help' in the body. Even with all this automated help, you may still encounter problems. If you get really stuck, please feel free to contact me directly at the address I use for mailing list management: cypherpunks-owner(a)toad.com Please use this address for all mailing list management issues. Hint: if you try to unsubscribe yourself from a different account than you signed up for, it likely won't work. Log back into your old account and try again. If you no longer have access to that account, mail me at the list management address above. Also, please realize that there will be some cypherpunks messages "in transit" to you at the time you unsubscribe. If you get a response that says you are unsubscribed, but the messages keep coming, wait a day and they should stop. For other questions, my list management address is not the best place, since I don't read it every day. To reach me otherwise, send mail to eric(a)remailer.net This address is appropriate for emergencies (and wanting to get off the list is never an emergency), such as the list continuously spewing articles. Please don't send me mail to my regular mailbox asking to be removed; I'll just send you back a form letter. Do not mail to the whole list asking to be removed. It's rude. The -request address is made exactly for this purpose. To post to the whole list, send mail to cypherpunks(a)toad.com If your mail bounces repeatedly, you will be removed from the list. Nothing personal, but I have to look at all the bounce messages. There is no digest version available. There is an announcements list which is moderated and has low volume. Announcements for physical cypherpunks meetings, new software and important developments will be posted there. Mail to cypherpunks-announce-request(a)toad.com if you want to be added or removed to the announce list. All announcements also go out to the full cypherpunks list, so there is no need to subscribe to both. II. About cypherpunks The cypherpunks list is not designed for beginners, although they are welcome. If you are totally new to crypto, please get and read the crypto FAQ referenced below. This document is a good introduction, although not short. Crypto is a subtle field and a good understanding will not come without some study. Please, as a courtesy to all, do some reading to make sure that your question is not already frequently asked. There are other forums to use on the subject of cryptography. The Usenet group sci.crypt deals with technical cryptography; cypherpunks deals with technical details but slants the discussion toward their social implications. The Usenet group talk.politics.crypto, as is says, is for political theorizing, and cypherpunks gets its share of that, but cypherpunks is all pro-crypto; the debates on this list are about how to best get crypto out there. The Usenet group alt.security.pgp is a pgp-specific group, and questions about pgp as such are likely better asked there than here. Ditto for alt.security.ripem. The cypherpunks list has its very own net.loon, a fellow named L. Detweiler. The history is too long for here, but he thinks that cypherpunks are evil incarnate. If you see a densely worded rant featuring characteristic words such as "medusa", "pseudospoofing", "treachery", "poison", or "black lies", it's probably him, no matter what the From: line says. The policy is to ignore these postings. Replies have never, ever, not even once resulted in anything constructive and usually create huge flamewars on the list. Please, please, don't feed the animals. III. Resources. A. The sci.crypt FAQ anonymous ftp to rtfm.mit.edu:pub/usenet-by-group/sci.crypt The cryptography FAQ is good online intro to crypto. Very much worth reading. Last I looked, it was in ten parts. B. cypherpunks ftp site anonymous ftp to ftp.csua.berkeley.edu:pub/cypherpunks This site contains code, information, rants, and other miscellany. There is a glossary there that all new members should download and read. Also recommended for all users are Hal Finney's instructions on how to use the anonymous remailer system; the remailer sources are there for the perl-literate. C. Bruce Schneier's _Applied Cryptography_, published by Wiley This is required reading for any serious technical cypherpunk. An excellent overview of the field, it describes many of the basic algorithms and protocols with their mathematical descriptions. Some of the stuff at the edges of the scope of the book is a little incomplete, so short descriptions in here should lead to library research for the latest papers, or to the list for the current thinking. All in all, a solid and valuable book. It's even got the cypherpunks-request address. IV. Famous last words My preferred email address for list maintenance topics only is hughes(a)toad.com. All other mail, including emergency mail, should go to hughes(a)ah.com, where I read mail much more regularly. Enjoy and deploy. Eric ----------------------------------------------------------------------------- Cypherpunks assume privacy is a good thing and wish there were more of it. Cypherpunks acknowledge that those who want privacy must create it for themselves and not expect governments, corporations, or other large, faceless organizations to grant them privacy out of beneficence. Cypherpunks know that people have been creating their own privacy for centuries with whispers, envelopes, closed doors, and couriers. Cypherpunks do not seek to prevent other people from speaking about their experiences or their opinions. The most important means to the defense of privacy is encryption. To encrypt is to indicate the desire for privacy. But to encrypt with weak cryptography is to indicate not too much desire for privacy. Cypherpunks hope that all people desiring privacy will learn how best to defend it. Cypherpunks are therefore devoted to cryptography. Cypherpunks wish to learn about it, to teach it, to implement it, and to make more of it. Cypherpunks know that cryptographic protocols make social structures. Cypherpunks know how to attack a system and how to defend it. Cypherpunks know just how hard it is to make good cryptosystems. Cypherpunks love to practice. They love to play with public key cryptography. They love to play with anonymous and pseudonymous mail forwarding and delivery. They love to play with DC-nets. They love to play with secure communications of all kinds. Cypherpunks write code. They know that someone has to write code to defend privacy, and since it's their privacy, they're going to write it. Cypherpunks publish their code so that their fellow cypherpunks may practice and play with it. Cypherpunks realize that security is not built in a day and are patient with incremental progress. Cypherpunks don't care if you don't like the software they write. Cypherpunks know that software can't be destroyed. Cypherpunks know that a widely dispersed system can't be shut down. Cypherpunks will make the networks safe for privacy. [Last updated Mon Feb 21 13:18:25 1994]

1 0

yo subscribe!!
by Garry Bentlin 17 Dec '03

17 Dec '03

how do I? and can you ? thanks heeeps! reg, garryb

1 0

NY State to restrinct netporn?!
by Deranged Mutant 17 Dec '03

17 Dec '03

This in today's LI Newsday, p. A6: Crime Time in Albany Bills Reflect now popular get-tough stance by Liam Pleven, Albany Bureau Albany - A bill that would restrict sexually explicit material on the Internet - which the Assembly took little notice of last year - is suddenly headed tothe governor's desk after winning legislative approval yesterday. ... --- "Mutant" Rob <wlkngowl(a)unix.asb.com> Send a blank message with the subject "send pgp-key" (not in quotes) for a copy of my PGP key.

1 0

Re: Hassles taking App. Crypt. to Taiwan?
by pclow＠pc.jaring.my 17 Dec '03

17 Dec '03

>If this were Singapore, they might consider it subversive literature, >because it is :-) ...............and the next thing you'll probably say is that Asians live in tree houses and have pet gorillas or whatever :)......

2 1

Re: Crippled Notes export encryption
by droelke＠rdxsunhost.aud.alcatel.com 17 Dec '03

17 Dec '03

Herb Sutter wrote: > At 20:32 01.17.1996 -0500, Perry E. Metzger wrote: > > > >Alan Pugh writes: > >> infoMCI (sm) > >> Lotus-Security - Lotus Announces Compromise for Export of Strong > >> Encryption > > > >So, Lotus thinks they can fool people by back-dooring in key escrow, eh? > > > >Time to break out the artillery. > > > >Perry > > Careful... what would YOU have done, with your customers demanding stronger > crypto today and you unable to legally give it to them? > > Again, folks, try to remember that this is NOT key escrow... international > Notes customers are no worse off than before, and a darn sight better off > against everyone besides Uncle Sam. > > Herb Not key escrow - WHAT?!?!? Then, what do you call giving government access to 24 out of 64 bits of the key. This reduces the keyspace to a measly 40 bits. As we have seen - 40 bits is trivial to crack without a multi-billion dollar budget. I think that Lotus did what all corporations do - it thought was best for it's bottom line, and so chose the limited keyspace with key-escrow approach. It is our job (as cypherpunks and US citizens) to show Lotus and the world that this is NOT a good approach. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

SS Obergruppenfuhrer Zimmermann (NOT!)
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Anonymous User <nobody(a)c2.org> writes: > "Private communications between neo-Nazis on the network are > effected under a program called "Pretty Good Privacy", > devised by an American neo-Nazi sympathiser." > Robin Gedye (in Bonn) p.23 of "The Sunday Telegraph" > January 21, 1996 Before anyone takes this nonsense too seriously, one should realize that the exhibition of such microscopic views of technology by journalists and politicians is fairly common. Who can forget Caspar Weinburger's stirring speech in front of an illegally exported low-end VAX, explaining that the machine was a sophisticated electronic device for the tracking of missiles and troop movements, now in the hands of America's enemies. Then there was the newspaper article which explained in perfect seriousness that "GIF" was a secret computer code used by child molesters to encode images of their victims. Characterizing PGP as a neo-Nazi tool for private communications written by a sympathizer, while absurd in a larger sense, is hardly sillier than the prior examples. And all such scenarios contain a microscopic grain of truth as seen by someone somewhere with a severe case of tunnel vision. The reporter no doubt reports correctly that some neo-Nazis use PGP to communicate privately. Doubtless PKZ supports the right of all people, including those with diverse political views, to conduct legal private conversations which cannot be overheard by their governments, as do most of the people on this list. I suppose in some obtuse sense this is sympathy. It is highly unlikely that anyone who uses Cypherpunk technology is as ignorant as this reporter. So let's just mail the poor guy a clue and move on. Things like this happen often, and it's not really worth a prolongued debate. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd(a)netcom.com $ via Finger. $

7 6

January 22 Infoworld
by Dwight Brown 17 Dec '03

17 Dec '03

Nicholas Petreley's "Down To the Wire" column is a short take on the insecurity of encryption schemes used by most commercial software. There shouldn't be much new here to cypherpunks (he discusses the vulnerabilities of WordPerfect, Word for Windows, Excel, and Compuserve's CIS.INI, and uses some out of date examples "to protect the integrity of current software": bad move, Nicholas), but it'd make a good introduction for people who aren't familiar with the issues. Petreley also announces that InfoWorld is planning a "network-cracking event", in which they plan to set up various network OS'es, make them as secure as they can, invite "a small number of accomplished hackers" to attack them, and publish the results. He says they're looking for participants... InfoWorld's web site is http://www.infoworld.com. Petreley can be reached at nicholas_petreley(a)infoworld.com. ==Dwight

1 0