December 2003 - cypherpunks-legacy

17 Dec '03

One issue is the purpose of the ratings system. I don't think it will help to solve the problem of intentional disruption. If the disrupter is really motivated, he could have multiple identities and give positive ratings to his messages, so they would get through. I think a good purpose would be filtering out uninteresting or lower-quality messages. Unless someone else vouches for a message, it would not appear for a subscriber to the filtered list. Eric asked that discussions on this topic use the "subject tag" concept, putting "RATINGS:" in the subject line. Subject tags are a good idea but are not widely used. If more people would use them it would help people to read those messages that interest them. My suggestion is that the ratings be based on subject tags. A rater reads a message, and if he endorses it as being worth reading he sends in one or more subject tags (keywords) which apply. Then someone on the filtered list could subscribe based on particular tags that interest them. The advantage is that this way even newcomers' messages are tagged with useful keywords, tags provided by old-timers on the list when they approve the messages. This also provides for the multi-dimensional aspect of approval, more useful than a simple "thumbs up". I won't try to suggest a syntax, but under this proposal a rating message would include some message identifier (perhaps the list should produce messages with an incrementing message number), along with a list of applicable subject tags. Hal

3 3

RATINGS: Subject tags
by Hal 17 Dec '03

17 Dec '03

From: hughes(a)ah.com (Eric Hughes) > >If the disrupter is really > >motivated, he could have multiple identities and give positive ratings to > >his messages, so they would get through. > > No one says you have to believe a particular rating. This would imply that subscribers see the source of each rating. You would have to know that in order to judge whether to believe one or not. But I think this might consume too much bandwidth. With possibly many raters, each producing a potentially multi-dimensional rating per message, this would be a lot of stuff to send along with each message. My suggestion would be to just present the union of all the subject tags produced by the raters. This is a moderate amount of information, and to the extent that raters agree on subject tags it could in many cases be a very succinct presentation. We don't want to make this too unwieldy. > >Unless someone else vouches for a message, it would not appear > >for a subscriber to the filtered list. > > The system I want to experiment with for cypherpunks is not filtration > at the mailing list server but rather filtration at the user's end. > The "filtered list" is whatever passes through one's own filter. I am > not talking about making toad into an extropians-style list with lots > of server operations. This makes sense, but there must still be two lists: one, the "raw" list, which is seen (at least) by raters and contains messages which have not yet been rated; and the other, the "rated" list, which has the rated messages. My suggestion was that messages which did not receive any ratings by anyone would not make it into the rated list. Obviously an alternative would be to send it out tagged to show that no one cared enough to rate it. > >My suggestion is that the ratings be based on subject tags. > > I suggest that one kind of rating be based on subject tags, or primary > topic, or keywords, or something similar. I also suggest that other > kinds of ratings exist. > > Hal's suggestion is to make a rating based on salience to topic. This > is fine, it allows a sheaf of related topics and concerns to be > unbundled according to a particular reader's viewpoint. This could also be used for negative ratings: subject tags such as "flame", "faq", "rant", etc. could be used to give more information than just the topic of the message. People could set up their own systems to filter the message to exclude messages with certain of these tags. > > a rating message > >would include some message identifier > > There is already the right message identifier. It appears in each > piece of mail in the header field Message-Id. Message-ID is probably OK, but it is kind of long. Many mail agents will insert an "In-Reply-To" into the header which identifies the message ID, but not all will. It would be a real pain to type one in manually. Another advantage of numbering messages sent on the "raw" list would be that people would be able to tell when they have missed messages (but that is irrelevant to the ratings issue, I admit). Hal

2 1

MacPGP
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Can anyone give me a FTP site where MacPGP is available. i think the Ratings idea is brilliant. Frederic Halper (Reuben Halper) fhalper(a)pilot.njin.net

1 0

RE: the black budget
by Blanc Weber 17 Dec '03

17 Dec '03

"It took the Colonists several decades to get worked up enough to fight a war. We're only halfway through an equivalent time period. And I don't want to change the situation only with crypto, but also with public speech." Would you elaborate? Earlier, Tim May said something about using "the active spreading of disinformation about the compromise of the key escrow system" as part of the attempt to "Actively Sabotage Clipper and Capstone" (title of his message). What sort of public speeches would you (or others) make (to whom)? (Just curious) Blanc

5 5

RATINGS: proposal
by iansmith＠weasel.cc.gatech.edu 17 Dec '03

17 Dec '03

Eric: I was about to send this to the cpunx list, but got your message first. I'll send this to you first, and maybe we can hash out something better before 'going public' with it... here it is. I had not thought about the possibility of rating multiple messages in one "rating message." My scheme doesn't address this, although simple changes could accomplish it. I'm not sure that I understand why a mail message could be rated multiple times by the same rator, unless you mean that one might define "axes of rating", like "content", "spelling", "novelty", etc. I think that such a scheme is good, but is starting to place more load on the rator. I had hoped that I could use a slider widget, and have the user generate somewhat reasonable ratings just by setting the slider to a value between 0 and 100 and hitting a "rate" button. This would automagically put in motion the scheme outlined below. As an MUA implementor, here's my first cut of a proposal for a rating system that would hopefully meet the goals that eric outlined and be quickly implementable. 1) Mail to cypherpunks-ratings will be gatewayed back to all members of the list if it has the following lines in its body [Headers are ignored...] Lines in brackets are optional: [whitespace] Target-Message-Id: <messageId> Rating: <integer> [Comment: <newline terminated string>] [Subtopic: <one word string>] [Rating-originator: <newline terminated identity string: preferably PGP public key ident] [PGP signature] Body lines which don't have the syntax mentioned above are ignored. The comment field is intended to allow the person doing the rating to give info about his rating or the rated message to the rated message reader, when the message is read. I.e. when I read a message from the cypherpunk list from joe blow which has been rated by iansmith(a)cc.gatech.edu with a comment of "this message is fantastic" I can get something like: From: joe blow Subject: foobar Rating-Comment: (iansmith(a)cc.gatech.edu) this message is fantastic! Rating: 100 Similarly the subtopic field is to provide an automatic version of what is now being done by hand with ADMIN: and RATING: in subject fields or the like. This would allow a mail user agent to provide some automatic content help, provided that a displayed mail message meets enough of its criteria for this (have enough ratings been received? do 75% of the ratings agree on the subtopic for the mail message? etc). The PGP information is intended to facilitate "rating reputations" so that MUAs could be configured to "trust" ratings from people with good reputations for rating in ways that meet the user's idea of "goodness." Now, this strategy doesn't say anything about what the numeric rating scale means. I favor a 0-100 scale, with 0 being a "don't read this, its crap" and 100 being "must read." Although ideally this should be a curve with 50 being very common and 100's and 0's being very uncommon, it seems unlikely to me that such a system would occur in practice, as the common case (50) is the MOST unlikely to motivate someone to issue a rating message. I'm not sure what to do about this problem. When the mail messages is echoed out to the ratings mailing list, it would bear the additional header line: X-Mail-Rating: cypherpunks This would allow the MUA of the recipient to easily recognize the "ratings mail" messages and not display them to the user. The MUA should be building a database or otherwise storing the ratings of mail messages, so that when it displays a message it can bring up the appropriate ratings information. This allows clever user interfaces to be constructed based on ratings information, especially reputation-based arragements. Consider our message from Joe Blow above and the message display below: From: joe blow Subject: foobar PGP-Signed-Message-Ratings: 7 PGP-Signed-Rating-Average: 67.5 PGP-Signed-Common-Subtopic: DIGICASH Highest-Rator-Comment: Good discussion of Chaum's methods Lowest-Rator-Comment: Stupid rehash of Chaum's approach Now back the MUA implementation: This database (or other storage) which I have been discussing is somewhat irritating in its complexity and storage requirements, but mostly unavoidable because of the ordering properties of the problem. It is quite likely that one will receive ratings *before* the mail message itself arrives (in fact, this may be exactly what you want!) so the MUA will be forced to "sit on" ratings for messages it hasn't seen yet. To make the database/storage problem a bit more managable, MUA's can delete ratings information when they delete a mail message. However, it seems like a good idea to keep this information lying around for potential searches of an archive of a mailing list. I.e. "Give me messages which have the rating subtopic of DIGICASH and average ratings over 50" Major problems with this scheme: 1) Heavy dependance on Message-Id: field of messages and not all messages bear one of these. I don't see that is avoidable, since we must uniquely identify mail messages and the Message-Id is designed to do this. 2) This scheme rewards people who wait on the mail message ratings to come in then read the mailing list. This could be problematic if we get into a situation where people who should be doing the rating aren't reading messages (and rating them) because they are waiting on others to do so. I'm not really sure how to address this problem; timeliness cannot be used a factor when considering ratings, because of the speed differences in different peoples mail transport system (its unfair to penalize those that have long mail delays or are vacation). I think that perhaps some sort of "carrot" should be used to encourage to rate messages, but I'm not sure what this carrot would be. what do ya think? ian

3 2

Re: ratings
by nobody＠rosebud.ee.uh.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Robert Hayden said: >Forgive my ignorance, but isn't this a lot of overkill? I mean, one >could simply set up a filter for subjects/people you don't want to see >or press the 'D' key. Well, a rating system like the one I think Eric is talking about would disassociate "people" (the authors) from their post... so for example in the future when everybody is using anonymous remailing services to participate here and elsewhere, you would be able to read messages from "people" (pseudonyms on digitally signed posts). Of course, the anonymous remailing services would prevent you from figuring out the true author, so you can't filter for people in the manner you describe. Then you could pay attention to mail from Pr0duct Cipher and Deadbeat, who have kept their identities secret, but filter out other "anonymous" messages. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWp/s4OA7OpLWtYzAQEaowP9FVOSEFtOR2WNV4a5cjleR06BRTBB2eZd HB7cPwsiOzReufDJz9/i1PMeFBzd548DtC8AnyIriAY/c8zDAuK3ujMDgWM0FQ2+ W8khShw19GrFg0gsnuozHjorrivXw9OZzK3wOQQL5xx1BvWZ8kehM+YMjjKaq0vh 6Sjlt0RzKmM= =IWy1 -----END PGP SIGNATURE-----

2 1

MAIL: list
by nobody＠rosebud.ee.uh.edu 17 Dec '03

17 Dec '03

Okay, here is an updated remailer list * elee7h5(a)rosebud.ee.uh.edu has been renamed to elee7h5x(a)rosebud.ee.uh.edu. elee6ue(a)rosebud.ee.uh.edu has been renamed to elee6uex(a)rosebud.ee.uh.edu. Other that that both appear to working just fine, but I took them out of the list since I think they are on the edge of extinction ;-) * barrus(a)tree.egr.uh.edu is also down for a bit. That was an experimental one which had offered different features and a different command syntax than the others... I'll look at re-enabling it after making some more changes. * Matt's new remailer isn't listed here yet, since I think I'll change the format of this file to somehow seperate out remailers which work differently than Hal's standard, like Matt's and barrus@tree. * Mark Briceno notified me that ftp to 129.82.156.104 for MAC remailer tools seems to be gone. I can't locate the programs that used to be there anywhere else (pgpc22.tar.gz and .Z). * I've gotten responses from anon(a)hacktic.nl, but it now appears to be temporarily down, so I'll add it in again when it's back up. -----BEGIN PGP SIGNED MESSAGE----- Cypherpunk anonymous remailers, 2/22/94 Q1: What are the anonymous remailers? A1: 1: remailer(a)chaos.bsu.edu 2: nowhere(a)bsu-cs.bsu.edu 3: hh(a)soda.berkeley.edu 4: hal(a)alumni.caltech.edu 5: ebrandt(a)jarthur.claremont.edu 6: catalyst(a)netcom.com 7: remailer(a)rebma.mn.org 8: hfinney(a)shell.portal.com 9: remailer(a)utter.dis.org 10: remailer(a)entropy.linet.org 11: elee9sf(a)menudo.uh.edu 12: remail(a)extropia.wimsey.com NOTES: 1-3 no encryption of remailing requests 4-12 support encrypted remailing requests 12 special - header and message must be encrypted together 7,9,10,12 introduce larger than average delay (not direct connect) 7,9,12 running on privately owned machines 11 supports RIPEM encryption, caches remailing requests 3 features USENET posting ====================================================================== Q2: What help is available? A2: Check out the pub/cypherpunks/remailer directory at soda.berkeley.edu (128.32.149.19). chain.zip - program that helps with using remailers dosbat.zip - MSDOS batch files that help with using remailers hal's.instructions.gz - in depth instruction on how to use hal's.remailer.gz - remailer code pubkeys.tar.gz - public keys of remailers which support encryption pubkeys.zip - MSDOS zip file of public keys scripts.tar.gz - scripts that help with using remailers Or try the cypherpunks gopher site (chaos.bsu.edu) and look in "Anonymous Mail" for instructions. Mail to me (klbarrus(a)owlnet.rice.edu) for further help and/or questions. ====================================================================== Q3. Email-to-Usenet gateways? A3. 1: group-name(a)cs.utexas.edu 2: group.name.usenet(a)decwrl.dec.com 3: group.name(a)news.demon.co.uk 4: group.name(a)news.cs.indiana.edu 5: group-name(a)pws.bull.com 6: group-name(a)ucbvax.berkeley.edu NOTES: * This does not include ones that work for single groups, like twwells.com. * Remember to include a Subject: with your post, may cause failures if missing #6 blocks from non-berkeley sites (so use the berkeley remailers :-) ====================================================================== This is the remailer.data file I use with nestping, a script for pinging anonymous remailers: 01:n:remailer@chaos.bsu.edu 02:n:nowhere@bsu-cs.bsu.edu 03:n:hh@soda.berkeley.edu 04:y:hal@alumni.caltech.edu 05:y:ebrandt@jarthur.claremont.edu 06:y:catalyst@netcom.com 07:y:remailer@rebma.mn.org 08:y:hfinney@shell.portal.com 09:y:remailer@utter.dis.org 10:y:remailer@entropy.linet.org 11:y:elee9sf@menudo.uh.edu 12:s:remail@extropia.wimsey.com -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLWqC9IOA7OpLWtYzAQHYMQP9Esnc6TMQrpp0Hb7EKZ6N8msskC8oN4uE NpgvweNJCRCyDX4utuqJAh+Z5fSzsflSoYRPaUUVf/48o90UYWnue51sAPuxmjzZ UksmbhXyI/pAoEbsDjKj1q71vFQaZdcsViqDIhWTKZgwBGrmho9jVaDQe0tClJtN 5tdSjy7O65I= =eMSB -----END PGP SIGNATURE-----

1 0

Re: Disinformation (or the Truth?) About Clipper
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

The idea of a disinformation campaign to oppose Clipper really bothers me. Isn't the true about Clipper damning enough? Lying about Clipper seems like moral and ethical surrender. I agree that lying can produce favorable results, but I'm not willing to stoop to that level. If the anti-Clipper people (and I count myself one of them) can't defeat Clipper with the truth, this tells me the world is so fucked up it deserves Clipper and Capstone in every machine on the planet. Jim_Miller(a)suite.com

3 2

RATINGS: say what?
by Panzer Boy 17 Dec '03

17 Dec '03

Ok a few things. To help me, and possibly others, understand this. (Replace the word "YOU", with your name if you think you understand the rating system...) You want two lists: (of sorts) 1. Current list, as is, anything in -> everyone out. 2. Rated List, anything in -> filtering/rating -> out. Now my question is, who's going to spend the time dealing with this. And how are you going to disallow stuffing the ballot, as we all know about spoofing. And who's actually going to spend the time wading through all the Cypherpunk mail, and rating it all? Are you planning on letter the general readers of "list 1" rate articles, and then people who subscribe to "list 2" will get anything that passes a certain "rating level" (or other criteria)? Are we looking for something that you run the articles through, and it will spit out a "reading level" like most PC word-processors. Then you could ask for just the articles that have <15 misspellings, and a reading level above 11th grade... Pardon me if this isn't quite what some people seem to have in mind, but this just looks like electronic version of filling out forms in triplicate. -Matt (panzer(a)dhp.com) "That which can never be enforced should not be prohibited."

3 2

Millions Said Paid to CIA Spy
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

AP 02/23 00:31 EST Millions Said Paid To CIA Spy Copyright 1994. The Associated Press. All Rights Reserved. WASHINGTON (AP) -- The KGB develops a mole in the top ranks of the CIA, state secrets are spilled, double agents are fingered, million- dollar payoffs are made, and FBI agents skulk through a suspect's household trash to find clues. And that's just the opening chapter in one of the biggest espionage cases in CIA history. The Justice Department on Tuesday charged Aldrich Hazen Ames and his wife, Rosario, with conspiracy to commit espionage. Ames, a 31- year CIA veteran and former senior Soviet counterintelligence officer, is accused of selling U.S. national security secrets to Moscow for eight years starting in 1985. A federal magistrate ordered the Ameses held without bail until a hearing on Friday. If convicted on the conspiracy charge, they could face life in prison. Neither of them spoke to reporters when they left the magistrate's office. President Clinton called the case a "very serious" breach of U.S. national security. Sources familiar with Ames' CIA career said he compromised more than one Soviet double agent, including a KGB counterintelligence investigations officer -- code named GTPROLOGUE -- who was feeding information to the CIA. Ames had access to vast amounts of classified information at the CIA. And because during at least part of his long CIA career he specialized in recruiting Soviet officials and intelligence officers as spies, he would have been able to disclose to the Soviets the identities of CIA agents inside the Soviet Union. The Justice Department wrote in an affidavit released Tuesday that Ames, 52, began spying for the Soviets in 1985 at a time when he was the chief of the Soviet Counterintelligence Branch in the CIA's Soviet-East European Division. He is accused of continuing his espionage until his arrest on Monday. Ames' wife, Rosario, 41, is a part-time student at Georgetown University. The affidavit said she was a paid informant for the CIA from about April-December 1983 while serving as a cultural attache in Mexico City. Ames met her while working for the CIA in Mexico City from 1981-83. They were married in 1985. They have a young son. William Rhoads, who lives across the street from the Ames home in a well-to-do section of suburban Arlington, Va., told reporters Tuesday that they seemed an unexceptional couple who appeared to have income beyond Ames' government job. Indeed, the Ameses spent money at an extraordinary clip, yet they apparently raised few if any suspicions by paying cash for the $540,000 Arlington home in 1989 when he was transferred to Washington from a CIA post in Rome. His CIA job paid $69,000 a year. Court documents said they also spent $99,000 on improvements to the house through July 1993 and $7,000 on furniture in the first four months they owned the house. They also spent $25,000 toward the purchase of a Jaguar automobile in January 1992, $19,500 on a new 1989 Honda, $165,000 on stocks and securities from 1985-93, and put an average of more than $500 a month on credit cards over that eight-year period. The court documents also said that from 1986 through 1993, the Ameses transferred by wire -- mostly from Credit Suisse bank accounts in Switzerland -- more than $1 million to their Dominion Bank of Virginia accounts. They deposited an additional $487,100 in cash in various local accounts from 1985-93. "This investigation has determined that none of this $1,538,685, consisting of the wire and cash deposits, was derived from any salary checks of the CIA payable to Aldrich Ames," the affidavit said. The couple also own two condominium apartments and a farm in Colombia, the records said, and large sums of money were sent to Colombia by Ames to maintain those holdings. The Colombia connection figures prominently in the Ames case. Besides the fact that Rosario Ames was born in Colombia and was working in the Colombian Embassy when she met Aldrich Ames, he also apparently met Soviet contacts there at least once. The affidavit said U.S. investigators believe Ames received a cash payment from the Russian foreign intelligence service during a meeting in Bogota in November 1993.

1 0