December 2003 - cypherpunks-legacy

"Dear Newt" Letter...
by rah＠shipwright.com 17 Dec '03

17 Dec '03

My, *this* looks interesting... Cheers, Bob Hettinga --- begin forwarded text Date: 20 Nov 1995 11:21:01 -0800 Subject: please fwd to cpunks if you To: "Bob Hettinga" <RAH(a)shipwright.com> The Ad Hoc Taxpayer Coalition for Computer Privacy November 8, 1995 The Honorable Newt Gingrich Speaker of the House of Representatives H-232 The Capitol Washington, DC 20515-6502 Dear Mr. Speaker: We are writing to express serious concerns about the Administration's efforts to continue to restrict the ability of computer users at home and abroad to protect their personal and private information over electronic networks through the use of encryption technology. The Administration seems determined to ensure government surveillance of all electronic information and communications. It began with President Clinton's "Clipper Chip," but has not stopped. Consumers aren't happy with these proposals, and neither is the business community nor civil libertarians. In fact, it's hard to find anyone supportive outside the Administration except for the few that would benefit from the Administration's "proposed relaxation" of the nation's export policy. The Administration refuses to let American computer hardware and software companies sell products with good encryption worldwide unless the U.S. Government is guaranteed access to a key that unlocks that information. The Administration is trying to leverage these companies' need to export -- they derive more than half their earnings from sales abroad -- and desire to develop a single product worldwide, to force them to include a feature in products they sell in the U.S. and abroad that will allow government access. Administration officials also have said that if American companies do not "voluntarily" include such a feature, then they will seek legislation making such a feature mandatory. The Administration's approach is the wrong policy for today's marketplace. It's anti-consumer. Computer users will not entrust their sensitive information to computer networks unless its security and privacy are assured. Without good privacy protection, there simply will not be a Global Information Infrastructure -- and America won't be in the lead. It's anti-marketplace. There is no consumer demand for encryption products that give the government easy access. The Administration has come forward with a typical big-government approach -- a government designed solution for a government problem. This completely overlooks the realities of a free-market. It is anti-American business. The Administration's current policies are seriously harming the continued competitiveness of one of our fastest growing and most successful industries -- the computer hardware and software industry. Computer users are demanding good encryption but American companies are not allowed to supply it. Yet there are hundreds of foreign encryption products manufactured and encryption programs are widely available on the Internet. Finally, it is anti-progress. Wishing that there was no encryption available will not make it so. The technology is widely understood and available -- you can't put this genie basic in the bottle. Government policies should not encumber the American computing industry as it leads the world technology revolution. We strongly urge you to oppose attempts to limit the ability of Americans to use whatever encryption they wish and to support the immediate relaxation of harmful export controls on American products and programs with encryption features. The Ad Hoc Taxpayer Coalition for Computer Privacy Americans for Tax Reform Association of Concerned Taxpayers Competitive Enterprise Institute Citizens for a Sound Economy The Business Leadership Council The Small Business Survival Committee Citizens Against a National Sales Tax/VAT Virginia Postrel, Editor, Reason magazine Sheldon Richman, Senior Editor, The Cato Institute Tanya Metaksa, Executive Director, Institute for Legislative Action, National Rifle Association Kellyanne Fitzpatrick, The Polling Company Donna Matias, Institute for Justice =+=+=+=+ This information is provided as a service of the National Rifle Association Institute for Legislative Action, Fairfax, VA. This and other information on the Second Amendment and the NRA is available at any of the following URL's: http://WWW.NRA.Org, gopher://GOPHER.NRA.Org, wais://WAIS.NRA.Org, ftp://FTP.NRA.Org, mailto:LISTPROC@NRA.Org (Send the word help as the body of a message) Information may also be obtained by connecting directly to the NRA-ILA GUN-TALK Bulletin Board System at (703) 934-2121. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

4 6

Re: Java & Netscape security [NOISE]
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Joseph Malcolm <jmalcolm(a)alter.net> writes: > Dimitri Vulis writes: > >m5(a)dev.tivoli.com (Mike McNally) writes: > >> Frederick B. Cohen writes: > >> > This is baloney. When you work for Netscape or Sun and speak about you > >> > company's products, you are representing the company whether you > >> > disclaim it or not. > >> > >> Baloney. > > > >Fred is right. I used to work for Goldman Sachs & their internet usage polic > >stated that when you write to Internet or Usenet from a GS account, it will > >reflect on the firm no matter how you disclaim it. > > Dr. Cohen is I believe maintaining it doesn't matter where you write > from. Note that the Sun employee's message that sparked this was sent > from a Netcom account. If that's what Dr. Fred said, then I strongly disagree. (Sorry, I haven't been following what Dr. Fred said very closely. Can you blame me? :) Btw, Goldman has a very reasonable Internet use policy that encourages employees to get accounts on commercial internet providers. Btw^2, didn't Sun fire someone a couple of years ago for posting a homophobic joke to Usenet? --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Spam the Sign!
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>On September 27, Jeff Weinstein of Netscape (and others) wrote: > >> > > ... would be nice if we could get 128 bit keys, though ... (hint, >> > > hint). >> > >> > We are working this issue with the government. As soon as we can >> > make it available for download we will. > >> In other words, we will never see it in our lifetimes -- the >> bureaucreeps aren't known for promoting the spread of strong crypto. > >>> Where did I imply that if the govt. ignored us or said no that we >>> would meekly go away with tail between legs? Here's a question: Why can't Netscape be released WITHIN THE US with 128 bit keys? Admittedly, it would probably...uh...escape within a few hours, but that's no worse than what other cryptosystems (best-known example, PGP) have done.

3 2

Re: Anonymity and Intellectual Capital
by Hal 17 Dec '03

17 Dec '03

The analogy between corporations protecting physical capital and anonymity protecting intellectual capital is interesting, and I will write a bit about it here. I don't think it quite works in all ways but it does suggest some ideas. Capital, as I use the word, means stuff which helps you be productive. Money can be physical capital, as can machines, computers, and so on, but generally not consumer goods. Traditionally, intellectual capital by the same definition refers to training, knowledge, experience, education - those mental skills and characteristics which help you produce. We have sometimes extended this notion here to reputation capital, which we often use just to mean your reputation itself, your good name. But if we are going to call it "capital" it should really be those aspects of your reputation which lead to productivity. To the extent that your good reputation helps you accomplish your productive goals, it can be considered capital. Particularly if you are a manager or performer in some other position where people's opinions of you make a big difference in how much you get done, you have a lot of reputation capital. Business reputations have many of the characteristics of capital, too. For some uses of anonymity it does make sense to think of them as protecting reputation capital. If you are going to send a message which carries a risk of harming your reputation, perhaps because it is terribly stupid or harsh, then anonymity can protect you in that way. I think some people do communicate anonymously for this reason. However there is another motivation, too, and that is fear of physical consequences. Some anonymous messages might lead to lawsuits or retribution in other forms, such as firing or blackballing. There is more involved in these cases than just loss of reputation capital. Physical capital is involved as well. So this is one way in which I think the analogy does not work. Another difference relates to the number of people involved. As I understand it, the motivation for the corporate veil of immunity from liability is so that people can safely band together in business. If there were no veil, and one harmful act by a member of the corporation could result in any stockholder being held liable, then few people would be willing to commit their assets to such an activity. The risk would be too great. The point is that this protection is oriented towards protecting large numbers of people. It does not make much sense for a single person to incorporate in order to try to protect himself from his own harmful acts, and in fact I understand that the veil can often be easily pierced in such situations. On the other hand, with anonymity we are generally dealing with single individuals. There is no apparent need for people to pool reputation capital in an endeavor, and have it be protected by the use of anonymity. The closest I can think of would be for a bunch of highly regarded individuals to announce that they were going to join together and create commentaries which would demonstrate all the insight, wit, and other traits which gave these people such a high reputation in the first place, but that the resulting missives would be released anonymously, so that if one of them ended up reflecting badly on the writers, there would be no way to know who had actually created it (it could be a fake created by an imitator). While I can't rule this out, it doesn't seem like a likely scenario, and it doesn't seem to offer the opportunities that corporations do for increasing productivity. Another issue is the different forms of anonymity, which don't have clear analogies with physical capital. Using a pseudonym you can build up reputation capital (or at least reputation) in the nym, but then you no longer have immunity from harm if it commits some gaffe. (Actually I suppose this is not too different from the corporation whose assets can be attacked but not those of the shareholders.) Then there are the limited pseudonyms discussed by David Chaum, where there are limits in how many pseudonyms of a particular type a person can create. You could have one "committed" pseudonym, unlinkable to your True Name, which you post under; but you'd only get that one. (You could post under other pseudonyms but they wouldn't be able to get that "committed" stamp.) You'd have to be pretty careful what you say via that nym, much as you are today with your True Name (which BTW a lot of people don't realize yet). Then people could filter so they only received messages from committed nyms, figuring that senders would be more likely to put meaningful content into these kinds of messages. Chaum's system of credentials also could allow you to transfer endorsements from one pseudonym to another. We have discussed the idea that such endorsements could be considered an embodiment of reputation capital. You could post a wide range of messages under different pseudonyms, collect the positive endorsements (and discard the negative ones), and attach them to your True Name or committed nym. This might encourage people to abandon their natural caution in making postings which will come back to haunt them years hence (again, this will be more an issue once people realize that this will happen). Hal

1 0

Happy Thanksgiving L. Detweiller!
by carolann＠censored.org 17 Dec '03

17 Dec '03

And to all of your tentacles, And to all of you on The Cypherpunk List. Love Always, Carol Anne ps Is that L for Laura or Lori? -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

1 0

Re: Spam the Sign!
by Corey Bridges 17 Dec '03

17 Dec '03

Hm. Well, if you think spamming us will help convince the gov't to export strong crypto, go crazy. (Heck, I don't mind--it makes my job more secure.) And yes, we HAVE enjoyed the message "Strong Crypto NOW" that's been scrolling for the last 3 hours. Corey Bridges Security Scribe Netscape Communications Corporation 415-528-2978

5 4

(cpx) Re: "Junk E-Mail"
by Dave Dittrich 17 Dec '03

17 Dec '03

> At 06:47 PM 11/19/95 -0500, you wrote: > > > > Is anyone else getting lots of junk e-mail lately? I'm getting all > >kinds of direct marketing crap to both of my main accounts and I haven't > >posted to usenet in months. > > On a related note, Compuserve had a note on their system last week from > the sysop. Their customers are receiving unwanted e-mail advertisements > from the Internet. Compuserve sysops are attempting to block the spaming > but are finding it difficult because the advertiser is coming in via > different routes. They are also attempting to stop them using the court > system. > > The advertiser, according to the Compuserve sysop, threatened a > mail-bombing if Compuserve tried to block them!!! This would be a just > cause to call in the CSOF (Cypherpunk Soldier of Fortune) for a "measured > response". Yes, I've noticed these as well. One troubling thing I noted with one such spam-handed "attack" was the use of a group of internal email addresses (in the sense that we don't advertise these addresses) as addressees for a message that had an analog sent to www-buyinfo and some other web related addresses. This seems to indicate a way of organizing lists into sets based on location/topic, but doesn't include all other potential addressees in the same domain or organization. I guess it was only a matter of time before someone wrote sophisticated spamming servers that somehow capture/analyze log files, or is this just some idiot front end that lets ad-happy fools spam with a smaller apparent footprint? By the way... One reply I got from an ISP re: one of these drive by spammings indicated that they were charging the idiot for disobeying policy. I've started suggesting to ISPs that they dis-user and charge the offender (in case they haven't thought of this yet). If non-spam policies were more widely used, and these idiots loose their email/access and a few hundred dollars in charges for wasting ISP admin time, perhaps this trend won't continue. -- Dave Dittrich Client Services, Computing & Communications dittrich(a)cac.washington.edu University of Washington <a href="http://www.washington.edu/People/dad/"> Dave Dittrich / dittrich(a)cac.washington.edu</a>

1 0

Remailer list or FAQ?
by Thomas E Zerucha 17 Dec '03

17 Dec '03

Is there a FAQ or other list of anonymous remailers? Or how to use the one at portal.com (I had this info somewhere, but it takes forever to do a zgrep `find...). zerucha(a)shell.portal.com -or- 2015509 on MCI Mail finger zerucha(a)jobe.portal.com for PGP key

1 0

Pix Lox
by John Young 17 Dec '03

17 Dec '03

Bill Gates in "The Road Ahead": A complete failure of the information highway is worth worrying about. Because the system will be thoroughly decentralized, any single outage is unlikely to have a widespread effect. If an individual server fails, it will be replaced and restored. But the system could be susceptible to assault. As the system becomes more important, we will have to design in more redundancy. One area of vulnerability is the system's reliance on cryptography -- the mathematical locks that keep information safe. Excerpted in Newsweek, November 27, pp. 67-68. Rubberneck the roadwreck with Steven Levy in "Bill's New Vision."

1 0

Re: remailer abuse
by Hal 17 Dec '03

17 Dec '03

From: Greg Broiles <greg(a)ideath.goldenbear.com> > I think adopting a submissive or apologetic stance with respect to the > operation of a remailer is a mistake. What we do is protected by the First > amendment, supports a 200+ year tradition of anonymous political speech in > America, provides a valuable service to a worldwide community, and can help > avoid the very abuse they are accused of facilitating. The problem is that the time when someone complains about the remailer is exactly when they have received some obnoxious message. This is often their first exposure to the idea of anonymous remailers. Such people are the last ones who are going to be receptive or interested in hearing a lecture about how remailers are protecting the First Amendment. I generally do my best to avoid getting into a debate with these people. I tell them I have added them to the block list, and usually that is the end of it. So while I think Greg's approach is fine as part of an intellectual debate over the pros and cons of anonymity, it does not address the most frequent complaints I see as a remailer operator. I hope that over time more people will become exposed to the idea of remailers and anonymity other than in the form of some annoying anonymous message. Then I think they will be better able to deal with it when they do get some problem mail. > The child who was the > target of the "Mr. Pedophile" message(s) should have been taught how to use > remailers and how to maintain his privacy on the net so that, if he really > is the victim of some sort of random child stalker, it won't happen again. That message was not posted to Cypherpunks. It asked in some graphic detail whether this boy engaged in sexual relations with his parents. However, the mother was surprisingly calm about it, and simply asked to be blocked. The fact that she knew about blocking gave me the impression she was remailer-savvy, and as I wrote above this seems to make a big difference. Hal

1 0