December 2003 - cypherpunks-legacy

Re: PCS Encryption?
by John Young 17 Dec '03

17 Dec '03

> I was under the impression that Fortezza was ok for classified >traffic. Did I miss the changeover, was it unannounced, or was I >simply misremembering? Fortezza now comes in several implementations for various, variable and multiple levels of classification and message handling. There is info on latest mani-dexterous products at NSA's armadillo and missi sites. If you don't want to be logged by NSA, see the Mykronyx bouquet at: http://jya.com/fortezza.htm To be sure, you might get logged anyway: jya.com may have been approved by the Administrative Office of the United States Courts for a snoop.

1 0

Fortune, 3 Feb
by Mike McNally 17 Dec '03

17 Dec '03

Big article in Fortune about e-mail privace. One little paragraph about encryption ("scrambling"). Fairly clue-free overall, but entertaining. -- ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ Mike McNally -- Egregiously Pointy -- Tivoli Systems, "IBM" -- Austin mailto:m5@tivoli.com mailto:m101@io.com http://www.io.com/~m101 ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^

1 0

Re: My Departure, Moderation, and "Ownership of the List"
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Mon, 3 Feb 1997, Timothy C. May wrote: > Unfortunately, Sandy responded to my post with his own flames ("piffle," > "disingenous," "straw man," etc.). Now he may well think his points are not > flames becuase they are "true," but to me they take the form of flames. But they are not ad hominem attacks on Tim May. The are my opinions of some of his arguments. Even very smart people such as Tim say poorly thought out or even silly things. > But then I have long disliked Sandy's method of argument. Nothing personal. But Nor I, Tim's. Nothing personal, but that's the point. It is still possible to conduct ourselves with mutual respect even if our views and styles differ. > As Sandy did a too-common section-by-section disssection, I'll do the same > for his comments. After reading through Tim's post, I don't think much would be served by doing another point by point response. From Tim's tone, it appears he is still seething about how this all came about, so I'll just leave our two expressions of opinions where they were. I have no wish to exacerbate any hard feelings Tim may be having. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Key Security Question
by William H. Geiger III 17 Dec '03

17 Dec '03

X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.24

2 1

IRS Can't Compete
by Duncan Frissell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Note proof that government agencies are running up against serious problems competing with market actors even though they have the guns. - From today's NYT: February 1, 1997 Leaders of I.R.S. Panel Urge Sweeping Overhaul of Agency By DAVID CAY JOHNSTON The IRS had publicly defended its management of computer modernization until Thursday, when Arthur A. Gross, who was hired last year as an assistant commissioner of the agency to rescue the effort, told the restructuring commission that the new systems being developed "do not work in the real world." Gross also said the IRS lacked the "intellectual capital" to modernize. ["intellectual capital" = brains] Kerrey said that although the modernization project was bigger than any corporate computer system the government would have a hard time hiring the necessary talent to manage the project. "The market is bidding up the price for people who have these skills, and we just can't dole out big salaries," he said. Executives who oversee information systems make as much as $378,000 in salary and bonuses, according to William M. Mercer, the nation's largest pay consulting firm. That is more than twice the highest federal salary and bonus, and corporate information executives typically also get options and other incentive payments. ****************** Translation - since the Feds can't afford to pay CIOs what they're worth, and governments don't offer stock options, they can't get the talent they need to keep up with the market. We are talking about senior management here. If they try and respond by contracting senior management out, eventually the institution disappears as a government institution. DCF -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMvSCgYVO4r4sgSPhAQHhYAP+N80RhT0efc2seO+P99WLVYMJ8/1Q1R7e CkLY8guJw2PnuQlaGG3lj14mYvTPMitZFsQ4pFnkSzzyF57QN4nXPbXajkNeWao+ Kcr2T3TJa5gZcGv309/I7FbZp2MfaugEjyNoielY12q9qsyuJyCv1l4Uh1L/tq9c wEKoLyMoh5U= =orfk -----END PGP SIGNATURE-----

2 1

My Departure, Moderation, and "Ownership of the List"
by Timothy C. May 17 Dec '03

17 Dec '03

A couple of people have sent me pinging messages, asking about my status on the Cypherpunks list....apparently it has taken several weeks for folks to notice my absence! :-} This may speak volumes about why I have left the list, and what the list has become..... I chose not to write a "departing flame" (or message, but some might call it a flame) when I unsubscribed several weeks ago--within an hour of reading that John and Sandy had decided to make "their" list a moderated list, by the way--as I saw little benefit. I was also fed up with things, and saw no point in wasting even more of my time arguing against the New Cypherpunks World Order, as the NCWO was clearly presented as a fait accompli, not something ablut which opinions of list members (or even list _founders_, at least not me) were being sought. It's my nature to just say "Fuck it" and leave when I feel I have overstayed my time, or things are no longer fun, or I am made to feel unwelcome. But since several people have pinged me, asking about my status, I'll take some time to say a few things. I've had access to the hks.net archive site, and/or the Singapore site, to occasionally see what was being said on the list (old habits die slowly, so I sometimes drop in to see what you people are flaming each other about...not surprisingly--in fact utterly predictably--I see vast amounts of bandwidth consumed by arguments about moderation, about the putative biases of the Moderator and Director of the New Cypherpunks World Order, about alternative moderation strategies (which is stupid, as John and Sandy announced what they were going to do, not just some of their preliminary thoughts), and so on. I've also noticed fewer substantive essays. With no false modesty I tried awfully hard to compose substantive essays on crypto-political topics, often more than one per day. (Others did too, but they seem to be tapering off as well, leaving the list to be dominated by something called a "Toto," the "O.J. was framed!" ravings of Dale Thorn, the love letters between Vulis and someone name Nurdane Oksas, and the occasional bit of crypto news. Ho hum. I'm glad I'm not reading the list in e-mail, and thus can easily avoid replying to these inanities...which would probably not be approved for reading by Sandy, so why bother anyway?) Rather than compose a traditional essay, I'll take the easy way out and list some bulleted points. * First, I don't argue that John Gilmore is unfree to do as he wishes with his machine, toad, which has been the major machine host for the Cypherpunks list. John can tell us we have to write in Pig Latin if he wishes. Much of the debate I saw in the archives was debate that missed the point about what John could and couldn't do. No one can seriously question the right of the owner of a machine, or the owner of a restaurant, etc., to set the policies he wishes. The owner of a restaurant is perfectly free--or used to be, and still is to anyone with even slightly libertarian or freedom tendencies--to set the rules of his "house." He may insist that shirts and shoes be worn, or that smoking is not allowed (or even is required, in theory), etc. He may say "All those eating in my restaurant must wear funny hats and have their costumes approved by Sandy Sandfort." This is unexceptionable. * However, anyone who disputes these rules (disputes in the sense of disliking or disagreeing with them, not legally challenging them) is free to leave. Those who don't like crowded, noisy, smoke-filled sports bars are encourgaged to leave. And so on. Again, unexceptionable. (The more complicated case of contracts, verbal or written, and "changing the rules," does not apply here. No one had a contract with John, or Sandy, or Hugh, etc., so this is not germane.) * But the really important issue is this: is the _physical hosting_ of the Cypherpunks mailing list coterminous with the "Cypherpunks"? If the list was hosted by, say, UC Berkeley or PGP Incorporated, would we consider these hosts to be the "owners" of the Cypherpunks group? Would we think that a corporate host, say, would have the authority to direct what we could say on the list? (Again, not disputing their corporate property rights...as a libertarian, I cannot. Other issues are what I'm getting at.) * If a Boy Scout troop meets at a local church, and has for several years, continuously, would we consider the church to be the owner of the troop? Could the church insist on avoidance of certain "cuss words" and demand that prayers be said before each gathering? Certainly the church could tell the troop what policies were to be followed if the the facilities were to be used, etc., and the troop could leave if it didn't like the terms (or, in parallel with my situation, any troop member could choose to leave....). This is what we mean by "property rights": the legal right of a property owner to do with his property as he wishes, modulo prior contractual relationships, criminal laws, etc. * How did the mailing list for the group, now called Cypherpunks, get started, and how did it end up being run off of John's hardare? Hugh Daniel got the actual mailing list rolling, based on a discussion Eric Hughes, Hugh, and I had the day after the first physical meeting, in September 1992. We thought the group we had just spent the day with ought to be able to stay in touch, and that a mailing list was the right way to go. There was talk of siting it on the UC Berkeley computers (actually, the Undergraduate Association computers, a la the Cypherpunks archive site at "csua"), but Hugh thought he might be able to use "toad," and this is what happened. (I have not heard from Hugh on his views of this New and Moderated Non-Anarchic List.) * I think we should all be very grateful to John for agreeing to let it run on his hardware, but not let our gratitude turn into some sort of subservience and blather about how John "owns" the Cypherpunks group. * Again, is the "Cyherpunks community" the same as the mailing list? And is the mailing list, hosted at toad, the "property" of John Gilmore? * In my view, neither John nor Sandy in any sense "own" our group. It is a virtual community which sometimes has physical meetings at various places (including corporations, restaurants, and bookstores, none of which are even partial "owners" of the group) and which has had several instantiations on the Net, including sub-lists not connected to toad.com in any way. While John is of course free at any time to suspend his hosting of the list, I think it a serious misapprehension of the basic nature of virtual communities to accept the claim that John should decide on what is appropriate to bear the "Cypherpunks" list imprimatur and what is to be consigned to the flame list. * The mechanics of the announcement troubled me greatly. To be blunt, I was seething with anger. I was mightily annoyed to read that John had made a decision to appoint Sandy as his Moderator, with no discussion on the list. I don't know if Eric Hughes and Hugh Daniel were asked their opinions, but I certainly know I was not. I feel that as one of the two or three founders, depending on how one is counting, and as a frequent contributor to the list since its inception, and so on, I (and others) should at least have been told of this plan. Better yet, have the plans discussed on the list, as some good ideas may have been generated. I'll have more to say about my problems with how things were handled. Frankly, it smacked of the same kind of fait accompli decision John made with the unsubscribing of Vulis. While John had (and has) every legal right to do with his property as he wished, the effect was very negative. First, Vulis found other ways to post (duh). Second, the list was consumed with flames about this, many from Vulis, and many from others. Third, journalists (who love sizzle over substance any day of the week) lept into the fray with articles which gave Vulis the publicity he craved. Fourth, it sent a message to enemies of liberty that "Even the Cypherpunks have found it necessary to abandon their anarchic ways." (I'm well aware of the issues with pests like Vulis, who seek to destroy virtual communities like ours. But the solution John used did not work, and generated more crap. As you all should know, it was John himself who coined the wonderful saying, "The Net interprets censorship as damage and routes around it." A delicious irony.) * In the archives, I did see a bunch of "I support Sandy" and "John is our leader" comments from reasonable people. The obvious noise of Vulis and his cohorts like Aga made a "Do something!" attitude somewhat understandable. I don't think the decision made was a wise one, and I strongly doubt it will work to make the list a better one. * The proper solution to bad speech is more speech, not censorship. Censorship just makes opponents of "speech anarchy" happy--it affirms their basic belief that censors are needed. * "Censorship" is another overloaded term. I don't think the "Definition 1" of dictionary definitions, about _governmental_ restrictions, is the only meaningful definition. Everybody knows what it meant when we say that "Lockheed is censoring the views of employees," even though we know Lockheed is not using government power. A censor is one who censors. And even my "American Heritage Dictionary" gives this as its "definition 1": "censor n. 1. A person authorized to examine books, films, or other material and to remove or suppress morally, politically, or otherwise objectionable." (Other dictionaries of course give similar definitions. The notion that censors are confined to being government employees is a misconception.) * OK, even given that John had decided to censor "his" list, what about his choice of Sandy Sandfort as the censor? I've known Sandy for several years (I was the one who invited him to the second Cypherpunks meeting), but he's a poor choice as a censor, moderator, whatever. First, because he has so often gotten involved in protracted flame wars, such as with Vulis (remember the dozens of messages about the "bet" to bring Vulis out? I stayed out of the charade completely.), with Hallam-Baker, and with others. Second, because he has not been actively composing essays for a while, perhaps because of his job with Community Connexion. Other reasons, too. (I count Sandy as a friend, but I'm just being honest here. Sandy is just not a "Peter Neumann" (moderator of the "RISKS" list). * Nor do the announced criteria make any sense. While the inane one-line scatological insults have been filtered out, many "flames" make it through, based on what I've seen in perusing the hks archive site. And some reasonable comments get dumped in the flame bucket. * As expected, those who only want to talk about cryptography (but who rarely do, themselves, also as expected) waste bandwidth saying the "anarchist" and "libertarian" stuff ought to go in to the "rejected" list. More bandwidth wasted, as each group lobbies to have its ideological opponents censored by Sandy. * I would have had no problem had John announced that he was creating a new list, the "Good Stuff" list, with Sandy has his Chooser of Good Stuff. After all, both Eric Blossom and Ray Arachelian already offer just such lists, and more would not hurt. But by making the _main list_ the censored one, this skewed things considerably. * (Frankly, one of my considerations in leaving was the feeling that I would never know if an essay I'd spent hours composing would be rejected by Sandy for whatever reasons....maybe he might think my essay was off-topic, or used one of the Seven Deadly Words, or was "too flamish." Whatever. I realized that life is too short to have Sandy Sandfort deciding whether my essays should go out to the main list (which is really just a list like Eric Blossom's best-of list, except it is be edict now the main list) or be dumped into the flames list, to be read by a handful of people.) * Why, many reasonable people may ask, did I not simply unsubscribe from the "Cypherpunks" list and subscribe to the "Cypherpunks-Unedited) (or whatever it is called) list? Because of my overall anger with the issues raised above. The imperiousness of the decision, the notion of favoring Sandy's tastes in a more "first class" way than, say, the tastes of Eric Blossom, Ray Arachelian, or, for that matter, me. "Some censors are more equal than others." * The decision to "moderate" (censor) the Cypherpunks list is powerful ammunition to give to our opponents, and Vulis is certainly gleeful that his fondest wishes have been realized. And it won't work. People are consuming even more bandwidth arguing the merits of John's decision, the traffic is presumably being slowed down by the need for Sandy to wade through the traffic and stamp "Approved" or "Rejected" on what he glances at, and people are "testing the limits" of what they can say and what they can't say. * It also sends a message that people are incapable of filtering out bad speech, that they need a censor to do it for them. (Again, I have no problem with competing "screeners," a la having Ray, Eric, or David Sternlight filtering what they think is OK and what is not. Let a thousand filtering services bloom.) But the clear message by having Sandy censor the main list (the default list, the list name with the main name, the list we all know about, etc.) is that Cypherpunks need Big Brother to shelter them from Bad Thoughts, from Naughty Words, from Evil Flames, and from Impure Desires. Foo on that. * Psychologists might point to random reinforcement, even to the effects of terror. How many of us are likely to write controversial posts knowing that Sandy might wake up having a "bad hair day" and thus reject our posts? How many will begin to skew their opinions to match those of Sandy? (I would venture a guess that a Duncan Frissell would almost certainly get a libertarian rant past Sandy while a Phill Hallam-Baker might easily fail to get a leftist rant past him.) * Those who want "less noise" should subcontract with the filter services of their own choosing. This is the "Cypherpunk Way." Having Sandy as the censor is the easy way out. * By the way, the moderated list "RISKS" works pretty well. But it is not a _discussion_ group. It is, rather, a digest of news items related to computer and technology risks, with some discussion by various contributors, and with a long turnaround time of a few issues per week, tops. Peter Neumann also devotes a lot of time to making it run smoothly and bases part of his professional career on running it. I surmise that Sandy is not prepared to do the same. Nor would this be a good idea, as this would kill the spirit of the debate. * Had there been a debate about the policy, I can think of several approaches I'd like better. But inasmuch as John made it clear that there would be no debate (and, perhaps as part of the "problem," John has not really been a active member of the mailing list, in terms of participating in the debates), this is all moot. In any case, my several years with the list have taken a huge amount of my time. Given the way this whole thing was handled, and the way the list is degenerating even further, it looks like it's good that I'm moving on to other things. * To summarize: - the decision to censor the list was made without any discussion on the list, without any discussion with at least some of the longterm core contributors, and was presented as a "fait accompli." - while John has every right to do with his hardware as he wishes, he does not "own" the Cypherpunks group (though whether he owns the "list" is a semantically debatable point) - whatever our group once was, or still is, is not dependent on having a particular mailing list running on someone's home machine...and it cannot be claimed that any person "owns" the Cypherpunks group. - there is some talk of creating another Cypherpunks list, on other machines; I don't know whether or not this will fly, or if I'll devote any time to such lists. - the effect of censorship, such as I have seen it so far, is not producing a better list. In fact, as I would have expected, it is producing a more boring and sheltered list. And so there you have it. I had no plans to set down my views, feeling it was a waste of my time and your time. Rather than foam and rant the way some did (and Vulis must have posted 100 messages on the subject), I chose to simply make my exit, quickly. But as I have recently seen several mentions of my absence (including a particularly complimentary comment from Asgaard--thanks), I do feel I owe it to you all to explain my views. Which I have done. Have a nice year, and a nice millenium in a couple of years. --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 5

Re: Trigger-Words...
by Cynthia H. Brown 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 29 Jan 1997, harka(a)nycmetro.com queried: > Actually, I might not have chosen the correct words for what I > wanted... > I am looking for sniffer-programs, that analyze e-mail traffic on > the Net and filtering out all e-mails potentially interesting for > _intelligence services_. For example, I've heard, that if an e-mail > contains the words: "assassinate President" (DISCLAIMER: I hope, our > President lives a long and happy life, even after his > impeachment...:)), it will automatically get filtered and checked > out by the Secret Service. > Different intelligence agencies might have similar things in place. > Where could I get some more information about that? Many Un*xes (SunOS, Solaris, IRIX, Linux, and probably others) have included their own versions of sniffers, supposedly for network debugging. These are typically called something like "tcpdump", "etherfind", "snoop", etc. You would need to run a sniffer at a "choke point" of an organisation, for example the external router to the Internet, to capture all of the packets to / from that organisation. Putting a sniffer on some arbitrary router out there in cloud-land would probably not be all that productive, since there's no guarantee that all of the IP packets carrying a given TCP connection would take the same route. Cynthia -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: cp850 iQCVAwUBMvSyq5Og7xGCJGQtAQFJPwQAiXbxtfdfVEDL5ZHdktdy6bfH/Wmio3oU J1bYKpfwY4H4NnIoXipGF+oo48Pe4j8x46UneVZ8d4ZsSy93/JsvmQw38TxSj/8o cPbtIaagBw9eofsdimzlwx9Y0VvaTRWt+2Cjd8aQKmG5nwUBSF9BlFoX2/TU3QZY IP+hiecLaag= =rHlB -----END PGP SIGNATURE----- =============================================================== Cynthia H. Brown Ottawa, Ontario, Canada E-mail: cynthb(a)sonetis.com Home Page: http://www.sonetis.com/~cynthb/ PGP Key: See Home Page Junk mail will be ignored in the order in which it is received. It is morally as bad not to care whether a thing is true or not, so long as it makes you feel good, as it is not to care how you got your money as long as you have got it. - Edmund Way Teale, "Circle of the Seasons"

3 3

My Departure, Moderation, and "Ownership of the List"
by Timothy C. May 17 Dec '03

17 Dec '03

A couple of people have sent me pinging messages, asking about my status on the Cypherpunks list....apparently it has taken several weeks for folks to notice my absence! :-} This may speak volumes about why I have left the list, and what the list has become..... I chose not to write a "departing flame" (or message, but some might call it a flame) when I unsubscribed several weeks ago--within an hour of reading that John and Sandy had decided to make "their" list a moderated list, by the way--as I saw little benefit. I was also fed up with things, and saw no point in wasting even more of my time arguing against the New Cypherpunks World Order, as the NCWO was clearly presented as a fait accompli, not something ablut which opinions of list members (or even list _founders_, at least not me) were being sought. It's my nature to just say "Fuck it" and leave when I feel I have overstayed my time, or things are no longer fun, or I am made to feel unwelcome. But since several people have pinged me, asking about my status, I'll take some time to say a few things. I've had access to the hks.net archive site, and/or the Singapore site, to occasionally see what was being said on the list (old habits die slowly, so I sometimes drop in to see what you people are flaming each other about...not surprisingly--in fact utterly predictably--I see vast amounts of bandwidth consumed by arguments about moderation, about the putative biases of the Moderator and Director of the New Cypherpunks World Order, about alternative moderation strategies (which is stupid, as John and Sandy announced what they were going to do, not just some of their preliminary thoughts), and so on. I've also noticed fewer substantive essays. With no false modesty I tried awfully hard to compose substantive essays on crypto-political topics, often more than one per day. (Others did too, but they seem to be tapering off as well, leaving the list to be dominated by something called a "Toto," the "O.J. was framed!" ravings of Dale Thorn, the love letters between Vulis and someone name Nurdane Oksas, and the occasional bit of crypto news. Ho hum. I'm glad I'm not reading the list in e-mail, and thus can easily avoid replying to these inanities...which would probably not be approved for reading by Sandy, so why bother anyway?) Rather than compose a traditional essay, I'll take the easy way out and list some bulleted points. * First, I don't argue that John Gilmore is unfree to do as he wishes with his machine, toad, which has been the major machine host for the Cypherpunks list. John can tell us we have to write in Pig Latin if he wishes. Much of the debate I saw in the archives was debate that missed the point about what John could and couldn't do. No one can seriously question the right of the owner of a machine, or the owner of a restaurant, etc., to set the policies he wishes. The owner of a restaurant is perfectly free--or used to be, and still is to anyone with even slightly libertarian or freedom tendencies--to set the rules of his "house." He may insist that shirts and shoes be worn, or that smoking is not allowed (or even is required, in theory), etc. He may say "All those eating in my restaurant must wear funny hats and have their costumes approved by Sandy Sandfort." This is unexceptionable. * However, anyone who disputes these rules (disputes in the sense of disliking or disagreeing with them, not legally challenging them) is free to leave. Those who don't like crowded, noisy, smoke-filled sports bars are encourgaged to leave. And so on. Again, unexceptionable. (The more complicated case of contracts, verbal or written, and "changing the rules," does not apply here. No one had a contract with John, or Sandy, or Hugh, etc., so this is not germane.) * But the really important issue is this: is the _physical hosting_ of the Cypherpunks mailing list coterminous with the "Cypherpunks"? If the list was hosted by, say, UC Berkeley or PGP Incorporated, would we consider these hosts to be the "owners" of the Cypherpunks group? Would we think that a corporate host, say, would have the authority to direct what we could say on the list? (Again, not disputing their corporate property rights...as a libertarian, I cannot. Other issues are what I'm getting at.) * If a Boy Scout troop meets at a local church, and has for several years, continuously, would we consider the church to be the owner of the troop? Could the church insist on avoidance of certain "cuss words" and demand that prayers be said before each gathering? Certainly the church could tell the troop what policies were to be followed if the the facilities were to be used, etc., and the troop could leave if it didn't like the terms (or, in parallel with my situation, any troop member could choose to leave....). This is what we mean by "property rights": the legal right of a property owner to do with his property as he wishes, modulo prior contractual relationships, criminal laws, etc. * How did the mailing list for the group, now called Cypherpunks, get started, and how did it end up being run off of John's hardare? Hugh Daniel got the actual mailing list rolling, based on a discussion Eric Hughes, Hugh, and I had the day after the first physical meeting, in September 1992. We thought the group we had just spent the day with ought to be able to stay in touch, and that a mailing list was the right way to go. There was talk of siting it on the UC Berkeley computers (actually, the Undergraduate Association computers, a la the Cypherpunks archive site at "csua"), but Hugh thought he might be able to use "toad," and this is what happened. (I have not heard from Hugh on his views of this New and Moderated Non-Anarchic List.) * I think we should all be very grateful to John for agreeing to let it run on his hardware, but not let our gratitude turn into some sort of subservience and blather about how John "owns" the Cypherpunks group. * Again, is the "Cyherpunks community" the same as the mailing list? And is the mailing list, hosted at toad, the "property" of John Gilmore? * In my view, neither John nor Sandy in any sense "own" our group. It is a virtual community which sometimes has physical meetings at various places (including corporations, restaurants, and bookstores, none of which are even partial "owners" of the group) and which has had several instantiations on the Net, including sub-lists not connected to toad.com in any way. While John is of course free at any time to suspend his hosting of the list, I think it a serious misapprehension of the basic nature of virtual communities to accept the claim that John should decide on what is appropriate to bear the "Cypherpunks" list imprimatur and what is to be consigned to the flame list. * The mechanics of the announcement troubled me greatly. To be blunt, I was seething with anger. I was mightily annoyed to read that John had made a decision to appoint Sandy as his Moderator, with no discussion on the list. I don't know if Eric Hughes and Hugh Daniel were asked their opinions, but I certainly know I was not. I feel that as one of the two or three founders, depending on how one is counting, and as a frequent contributor to the list since its inception, and so on, I (and others) should at least have been told of this plan. Better yet, have the plans discussed on the list, as some good ideas may have been generated. I'll have more to say about my problems with how things were handled. Frankly, it smacked of the same kind of fait accompli decision John made with the unsubscribing of Vulis. While John had (and has) every legal right to do with his property as he wished, the effect was very negative. First, Vulis found other ways to post (duh). Second, the list was consumed with flames about this, many from Vulis, and many from others. Third, journalists (who love sizzle over substance any day of the week) lept into the fray with articles which gave Vulis the publicity he craved. Fourth, it sent a message to enemies of liberty that "Even the Cypherpunks have found it necessary to abandon their anarchic ways." (I'm well aware of the issues with pests like Vulis, who seek to destroy virtual communities like ours. But the solution John used did not work, and generated more crap. As you all should know, it was John himself who coined the wonderful saying, "The Net interprets censorship as damage and routes around it." A delicious irony.) * In the archives, I did see a bunch of "I support Sandy" and "John is our leader" comments from reasonable people. The obvious noise of Vulis and his cohorts like Aga made a "Do something!" attitude somewhat understandable. I don't think the decision made was a wise one, and I strongly doubt it will work to make the list a better one. * The proper solution to bad speech is more speech, not censorship. Censorship just makes opponents of "speech anarchy" happy--it affirms their basic belief that censors are needed. * "Censorship" is another overloaded term. I don't think the "Definition 1" of dictionary definitions, about _governmental_ restrictions, is the only meaningful definition. Everybody knows what it meant when we say that "Lockheed is censoring the views of employees," even though we know Lockheed is not using government power. A censor is one who censors. And even my "American Heritage Dictionary" gives this as its "definition 1": "censor n. 1. A person authorized to examine books, films, or other material and to remove or suppress morally, politically, or otherwise objectionable." (Other dictionaries of course give similar definitions. The notion that censors are confined to being government employees is a misconception.) * OK, even given that John had decided to censor "his" list, what about his choice of Sandy Sandfort as the censor? I've known Sandy for several years (I was the one who invited him to the second Cypherpunks meeting), but he's a poor choice as a censor, moderator, whatever. First, because he has so often gotten involved in protracted flame wars, such as with Vulis (remember the dozens of messages about the "bet" to bring Vulis out? I stayed out of the charade completely.), with Hallam-Baker, and with others. Second, because he has not been actively composing essays for a while, perhaps because of his job with Community Connexion. Other reasons, too. (I count Sandy as a friend, but I'm just being honest here. Sandy is just not a "Peter Neumann" (moderator of the "RISKS" list). * Nor do the announced criteria make any sense. While the inane one-line scatological insults have been filtered out, many "flames" make it through, based on what I've seen in perusing the hks archive site. And some reasonable comments get dumped in the flame bucket. * As expected, those who only want to talk about cryptography (but who rarely do, themselves, also as expected) waste bandwidth saying the "anarchist" and "libertarian" stuff ought to go in to the "rejected" list. More bandwidth wasted, as each group lobbies to have its ideological opponents censored by Sandy. * I would have had no problem had John announced that he was creating a new list, the "Good Stuff" list, with Sandy has his Chooser of Good Stuff. After all, both Eric Blossom and Ray Arachelian already offer just such lists, and more would not hurt. But by making the _main list_ the censored one, this skewed things considerably. * (Frankly, one of my considerations in leaving was the feeling that I would never know if an essay I'd spent hours composing would be rejected by Sandy for whatever reasons....maybe he might think my essay was off-topic, or used one of the Seven Deadly Words, or was "too flamish." Whatever. I realized that life is too short to have Sandy Sandfort deciding whether my essays should go out to the main list (which is really just a list like Eric Blossom's best-of list, except it is be edict now the main list) or be dumped into the flames list, to be read by a handful of people.) * Why, many reasonable people may ask, did I not simply unsubscribe from the "Cypherpunks" list and subscribe to the "Cypherpunks-Unedited) (or whatever it is called) list? Because of my overall anger with the issues raised above. The imperiousness of the decision, the notion of favoring Sandy's tastes in a more "first class" way than, say, the tastes of Eric Blossom, Ray Arachelian, or, for that matter, me. "Some censors are more equal than others." * The decision to "moderate" (censor) the Cypherpunks list is powerful ammunition to give to our opponents, and Vulis is certainly gleeful that his fondest wishes have been realized. And it won't work. People are consuming even more bandwidth arguing the merits of John's decision, the traffic is presumably being slowed down by the need for Sandy to wade through the traffic and stamp "Approved" or "Rejected" on what he glances at, and people are "testing the limits" of what they can say and what they can't say. * It also sends a message that people are incapable of filtering out bad speech, that they need a censor to do it for them. (Again, I have no problem with competing "screeners," a la having Ray, Eric, or David Sternlight filtering what they think is OK and what is not. Let a thousand filtering services bloom.) But the clear message by having Sandy censor the main list (the default list, the list name with the main name, the list we all know about, etc.) is that Cypherpunks need Big Brother to shelter them from Bad Thoughts, from Naughty Words, from Evil Flames, and from Impure Desires. Foo on that. * Psychologists might point to random reinforcement, even to the effects of terror. How many of us are likely to write controversial posts knowing that Sandy might wake up having a "bad hair day" and thus reject our posts? How many will begin to skew their opinions to match those of Sandy? (I would venture a guess that a Duncan Frissell would almost certainly get a libertarian rant past Sandy while a Phill Hallam-Baker might easily fail to get a leftist rant past him.) * Those who want "less noise" should subcontract with the filter services of their own choosing. This is the "Cypherpunk Way." Having Sandy as the censor is the easy way out. * By the way, the moderated list "RISKS" works pretty well. But it is not a _discussion_ group. It is, rather, a digest of news items related to computer and technology risks, with some discussion by various contributors, and with a long turnaround time of a few issues per week, tops. Peter Neumann also devotes a lot of time to making it run smoothly and bases part of his professional career on running it. I surmise that Sandy is not prepared to do the same. Nor would this be a good idea, as this would kill the spirit of the debate. * Had there been a debate about the policy, I can think of several approaches I'd like better. But inasmuch as John made it clear that there would be no debate (and, perhaps as part of the "problem," John has not really been a active member of the mailing list, in terms of participating in the debates), this is all moot. In any case, my several years with the list have taken a huge amount of my time. Given the way this whole thing was handled, and the way the list is degenerating even further, it looks like it's good that I'm moving on to other things. * To summarize: - the decision to censor the list was made without any discussion on the list, without any discussion with at least some of the longterm core contributors, and was presented as a "fait accompli." - while John has every right to do with his hardware as he wishes, he does not "own" the Cypherpunks group (though whether he owns the "list" is a semantically debatable point) - whatever our group once was, or still is, is not dependent on having a particular mailing list running on someone's home machine...and it cannot be claimed that any person "owns" the Cypherpunks group. - there is some talk of creating another Cypherpunks list, on other machines; I don't know whether or not this will fly, or if I'll devote any time to such lists. - the effect of censorship, such as I have seen it so far, is not producing a better list. In fact, as I would have expected, it is producing a more boring and sheltered list. And so there you have it. I had no plans to set down my views, feeling it was a waste of my time and your time. Rather than foam and rant the way some did (and Vulis must have posted 100 messages on the subject), I chose to simply make my exit, quickly. But as I have recently seen several mentions of my absence (including a particularly complimentary comment from Asgaard--thanks), I do feel I owe it to you all to explain my views. Which I have done. Have a nice year, and a nice millenium in a couple of years. --Tim May Just say "No" to "Big Brother Inside" We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: PGP 2.1
by Larry Johnson 17 Dec '03

17 Dec '03

Mark Henderson wrote: > > Larry Johnson writes: > > Hello, > > Can any;one tell me how to get a version of PGP 2.1? > > Thanks > > > But, why do you want version 2.1? Because the guy who wrote it was let off after that on his jail charges, so I'm not going to use anything he made after that if I don't know why. I'm not saying that he rolled over or nothin buyt I'm gonna be paranoyd like he said in the book. I dont suposse he'd mind, since he said it. I'm not real smart sometimes but I'nm not a real lamer, either. (I don't think)

4 3

Re: "Strong" crypto and export rule changes.
by Vin McLellan 17 Dec '03

17 Dec '03

Ian popped the 40-bit RC5 (not RC4) challenge with 259 processors, almost all standard Unix college-lab workstations, as I understand it. (RC5 has a variable block size and a variable number of rounds; but the unknown plaintexts for this contest were enciphered using a declared 12-round RC5 with a 32-bit word size.) The message Ian revealed was something like: "That's why you need a longer key!!!!!" RSA posted rewards for anyone who can break a 56-bit DES challenge and/or any of 12 variable-length RC5 challenge messages. The 40-bit RC5 cipher was the least of these and was expected to fall quickly. The initial RSA announcement of the contest emphatically declared that even 56-bit-key crypto (DES or RC5) offers only "marginal protection" against a committed adversary -- which is not to in any way minimize Ian's accomplishment, or the efforts (some also successful!) of others who also tackled the 40-bit challenge. SDTI/RSA celebrated Ian's achievement enthusiastically at the RSA Security Conference in San Fran last week. Burt Kalisky, the Chief Scientist at RSA, preempted a main session at the Conference to do an on-stage telephone interview with Ian about his attack. SDTI (RSA) apparently hopes to use Ian's "timely" achievement to urge Congress to challenge the idiotic 40-bit EAR ceiling and the key-escrow contracts required to get a 56-bit export license. (The network Ian used to link his lab workstations, NOW at Berkeley, is definitely not standard, however. I think there is a description of it online; but briefly, NOW seems designed to very efficiently handle this sort of intensive distributed processing project. More important, perhaps, was the fact that Ian just chewed through the possible keys with a pure brute-force attack on the key space. His attack was not really optimized for RC5, or designed to attack any specific element in the RC5 crypto architecture.) Jim Bitzos of RSA also gave a thought-provoking thumbnail summary of the IBM Key Recovery Alliance (making a better case for it in 30 seconds than the long technical presentatations from IBM.) As Bitzos explained it, the variable key-size control allows a corporate user to communicate through encrypted links to a variety of international recipients -- dynamically adjusting the encryption mechanism to whatever varied restrictions are required by the French, German, US, UK, etc. , govenments. "It's an imperfect world," growled Bitzos -- but both users and vendors need workable mechanisms today to allow them to adapt to whatever contraints on strong encryption that are, or will be, required by the various national authorities. It's a mistake, he suggested, to think of the IBM Key Recovery Initiative soley in terms of US controls. Many governments are reacting with hostility to the availability of strong encryption -- and until the Market finds a voice and educates the political and spook cultures, commercial entities will inevitably have to adapt their work-a-day communications security to a wide variety of national crypto controls and key-length restrictions. (What I got about the IBM presentations was the realization that there is nothing in the key recovery mechanism, per se, that requires the recovery key to be held by a third party. That, to my mind, is the essential distinction between key escrow and key recovery. I also realized that IBM has, for years, quietly held a crucial piece of the PKC scheme in its patented "control vector" tech, which irrevocably binds a whole set of context-specific rules and constraints to a decryption key. I now realize that the control vector technology was the foundation much of the the DoD's Blacknet development. Important stuff -- check it out!) Like Big Jim said, it's an imperfect world -- and likely to become more so, from the C'punk perspective, before it becomes better. The rumor mill among the 2,500 cryptographers, mostly developers, who attended the RSA Conference was pumping overtime. One of the saddest and most persistent rumors was that the Clinton Administration would, within months, introduce a Congressional bill to make unescrowed strong encryption illegal in the US. (Personally, I'd put bitter money on that one. <sigh>) David Aaron, US Crypto Ambassador and the US permanent rep to the OECD -- in which role he has strove to convince the newly liberated nations of Eastern Europe that built-in wiretap links are essential design components for a modern democratic nation's communications infrastructure -- was charming and gracious... but it was no surprise that he didn't budge a bit from the "sovereign right to listen" policy line. You shouldn't have skipped the RSA bash, Adam, not even for your DCS gig in the sunny Caribbean. There were numerous Lion and the Lamb drinking bouts thoughout the week (some rather amazing, in terms of both the participants and the volume of "input".) You would have loved it. Passions often ran high, but usually in quiet intense coversations. I (one Lamb, white wool turning gray;-) had distinct impression that there many US government cryptographers uncomfortable with the Administration's NSA/FBI-inspired absolutist POV. Not even all senior feds feel that Constitutional Law should be (re)written by FBI case agents obsessed with making it easier to bust some two-bit crack dealer next month. (Doesn't mean much in the larger scheme of things, but the pained ambivalence vividly reminded me of Vietnam debates so many years ago.) My favorite quote, from a federal LEA lawyer deep in his cups: "If the colonial cops, rather than the philosophers, had drafted the Constitution -- would Madison and Jefferson, et al, have been willing to even put their names to it??" Suerte, _Vin -------- In Reply To: >Steve Schear wrote: >| > What the US government will allow to be exported is not "strong >| >encryption." It is encryption only slightly too strong to be broken >| >by an amateur effort. For the right investment in custom hardware, it >| >falls quickly. (500,000 $US = 3.5 hour avg break). >| > >| >| Considering Ian's feat you certainly seem to have had your crystal >| ball in hand. Adam Shostack responded: > I wear three around my neck. Its a new age thing. > > More seriously, that estimate is the cost of breaking DES on >custom hardware, based on Wiener's figures. Ian got RC4-40 in 3.5 >hours on I don't know how much hardware, not a lot of it custom, >AFAIK. Vin McLellan + The Privacy Guild + <vin(a)shore.net> 53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548

2 1