December 2003 - cypherpunks-legacy

Re: cyphernomicon FTP site?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:18 PM 12/19/95, Vinod Valloppillil wrote: >Anyone know where I can FTP a full copy of the cyphernomicon? It would help if you said what you'd tried. For example, have you tried ftp.netcom.com in the directory pub/tc/tcmay? There you will find several versions, including compressed versions. This can be hard to access, due to crowding, but can eventually be gotten to. It has also been placed at other locations, according to reports here. Check the archives. Personally, I hear that even the author prefers the HTML version at http://www.oberlin.edu/~brchkind/cyphernomicon/. Anybody who plans to download the entire linear file and then print it out must be missing a bits in his shift register. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

(fwd) Economics of Digital Money. (part 2)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 19 Dec 1995 13:42:20 +0700 (GMT+0700) From: Patiwat Panurach <pati(a)ipied.tu.ac.th> To: ecash(a)digicash.com Subject: Economics of Digital Money. (part 2) MIME-Version: 1.0 Sender: owner-ecash(a)digicash.com Precedence: bulk Reply-To: ecash(a)digicash.com The Economics of Digital Commerce: An analysis of Digital Cash, ElectronicFund Transfers, and eCash (the second part wasn't included for some reason) The advantages of Electronic Checking over paper checks include Savings of time. The instantaneous updating of account balances allows all the financial players a greater deal of financial flexibility. There is no clearing period for transactions to be finished. This allows large cost reductions and more opportunities in cases of large-sum arbitration, and allows even pedestrian players to have a great deal of financial freedom. Also considerable is the savings in time. Checks no longer have to be cashed and purchased at bank branches. Reduction in paper handling costs2. Universities are not overwhelmed with paper checks at the beginning of each term; banks aren't faced with unmanageable lines of people at every payday; governments don't need large check printing and mailing facilities; fewer trees are sacrificed. No bounced checks. Being simultaneous, the receiving of the certification and the debiting and crediting of the accounts assures that no certification can be made without having funds to back it up. This could be done through an automatic check of account status before the certification is issued. This is similar to the checking of the credit limit before credit card transactions are finalized. Flexibility. Electronic checking is an extremely broad and generic field. It is used, in some form or the other, worldwide. Nearly all types of transactions can be conducted by using electronic checking. Electronic checking bypasses the physical weaknesses of physical checks. But it is still, in its essence, a check. A critical weakness of this is privacy. All transactions must pass through the banking system3. Furthermore, the banking system is obligated to document the details of every transaction that passes through it. What is to prevent the bank from selling or leaking such information to others? This precludes a possible infraction of personal civil liberties. Such was the case of Winai La-onsuwan, the man who was formally known as the monk Yantra. His illicit adventures in an Australian brothel were documented via American Express receipts4, and such evidence was critical in defrocking him. An even more frightening scenario would be if governments would demand access or control over the electronic checking, or over electronic checking records. What would permit them from instantly forbidding, say, a pregnant woman from buying cigarettes? Electronic checking systems could conceivably be a tool of "Big Brother" in gaining control over individual lives. As payment systems using electronic checking become more pervasive, is it necessary sacrifice the privacy and undocumentability of Cash? Many feel5 that cash also has a role as an electronic payments system. Such a "digital cash" (as it is called by many adherents) would have to have the essential characteristics6 of cash from the consumers perspective: Anonymity. The buyer pays the seller. Nobody, except the seller knows the identity of the buyer or the details of the transaction. In cases were the buyer uses a sufficiently sophisticated pseudonym system, not even the seller knows the identity of the buyer. Besides those of the 2 agents, there is no record of the transaction taking place. The certification of payment is the payment. There is no transfer between accounts that banks could analyze to discern the exact flow of funds. Liquidity. Digital Cash must potentially be accepted by all concerned economic agents as a method of payments. For example, in the Global Internet, the largest meta-network in existence, this would involve a significant proportion of internet merchants accepting a digital cash, if it is to be more than an ìelectronic play-moneyî. In many pilot projects, there must be a large threshold of affiliated merchants that are willing to participate in accepting digital payment for the system to be successful. On the institutional side, digital cash holds many advantages over existing fiat money (cash). These mainly involve the physical weaknesses of cash. First, Cash is highly risky to robbers. Cash must be kept in secure vaults and be guarded by security guards. The more cash is held, the greater the potential risk is. Secondly, cash has high transport costs. Because physical mass is proportional with the amount of cash held, large amounts of cash are difficult to store. It has been estimated that money handling costs of transporting cash in the US amount to over 60 billion US$ a year7. Lastly, the advent of high- quality color copiers and counterfeiting methods8 make government stores of cash insecure. It has been rumored that the United States Government waged economic warfare against Iraq during the Persian Gulf War by flooding the country with expertly counterfeited cash9. Digital Cash could conceivably have many forms. These might include: Prepaid Cards. Buyers could buy prepaid cards that will be accepted by special sellers. For example, phone cards act as surrogates for coins in the payment of public phones. The weakness of phone cards as digital cash is in the liquidity of the medium: no one would accept a 100 Baht phone card for the payment of a meal. Electronic road toll payment systems also suffer from the same weakness. Recent pilot projects conducted in Australia by VISA show more promise. Prepaid and rechargeable cards are accepted at the point-of-sale of a variety of merchants. Furthermore, to increase the systemís acceptability, the cost of point of sale terminals is subsidized by VISA. It is now possible to pay for a beer at the bar and a hotel bill with the same card10. Proposals for incorporating cash functions into multipurpose ìsmart cardsî have been announced by the EMV (Europay, Mastercard, Visa) consortium11. This would allow many functions like SIMM, ATM, encryption/decryption, and digital cash to be fitted onto a single card. Purely Electronic Systems. Purely electronic digital cash would be devoid of physical form. This would make it useful for network and internetwork transactions where the buyer and seller are physically apart. The payment would take place by electronically deduction of digital cash from the buyer and sending it to the seller. The actual transfer of digital is usually encrypted so that only the intended recipient (the seller) could make use of the cash. However, methods of anonymity and security must be in place, as to not turn fully electronic systems into electronic checkings systems. In all its forms, digital cash is not always cash. If, say, a financial institution were to issue the digital cash, the creation of digital cash could simply be considered a withdrawal from that financial institution. Similarly, the financial institution would be obliged to credit user accounts for deposits of digital cash. The digital cash would not have to have any real funds to back it, other than any legal reserve limit for the original deposits. Digital cash could just be considered as ìcashî on calculations of money supply. M1= 1+ Currency/Deposits X MB LRR+ (Currency/Deposits) + (Excess reserves/Deposits) when Currency encapsulates cash, coins, and digital cash. Withdrawing digital cash reduces the amount of deposits that the financial institution could use to extend loans, thus reducing any dynamic effects money creation effects upon M1. If, on the other hand, a non-financial firm were to issue digital cash, it would simply be a purchase of 1 unit of digital-cash with 1 unit of physical-cash. It could only be backed up by the willingness of merchants in accepting digital cash as a unit of payments. This second type of digital cash is inherently riskier for the consumer than the former. It is actually more analogous with ìcouponsî than with ìcashî. Furthermore, redeeming paper cash for privately issued digital cash does not effect any transformation upon the monetary conditions of the economy. Buying this type of digital cash does not affect the money creation process; there is no decrease in the economyís loan creation capacity. After considering the conceptual and theoretical aspects of electronic checking and cash, it is now time to look at a real world example of electronic payments: eCash is an open standard12 electronic payments system developed by the Digicash Company and currently the being implemented by the Mark Twain Bank of Missouri, USA. Conceptually, eCash is a type of ìdigital cashî, offering high levels of privacy and security. Its current implementation by the Mark Twain Bank is not exclusive - any bank licensing Digicashís eCash protocol could become an intermediary in the eCash scheme. To undertake transactions13, both buyer and seller would have to have deposits in the ìWorldCurrency Accessî accounts of the Mark Twain Bank. ìWorldCurrency Accessî accounts are claimed to be conventional money market accounts14; however, they do not pay interest nor have a fixed maturity period but are insured by the FDIC. The buyer must instruct the Mark Twain Bank to transfer funds from his ìWorldCurrency Accessî account into his ìeCash Mintî. This Mint is a personal buffer account. Funds in the Mint are no longer deposits of the bank, and they are not insured. At any time, the buyer can order his computer to remotely interface with his Mint and withdraw funds from the Mint into the buyers hard disk drive on the buyers personal computer. The format of the funds is now completely electronic: a series of zeros and ones that is cryptographically secure and unique. It might be useful to consider the funds in the Mint and in the buyers hard disk as being electronic in an ìelectronic walletî. To make the payment, the buyer encrypts the appropriate amount of eCash with a suitably secure encryption protocol15 and sends the eCash to the seller. The eCash can be sent to the seller by any data communications medium, e.g., email, ftp, shttp. Ironically, eCash can even be saved onto a disk, and the disk sent to the seller. Or it can be printed out onto paper, and the printed copy sent to the seller. The seller receives the eCash and after decryptizing it, stores it into his computer. This can then be sent to the Mint, and transferred into the sellerís ìWorldCurrency Accessî account. The net result is a decrease in the buyerís funds and an increase in the sellerís. eCash is private: although the Mark Twain Bank will have records for each eCash withdrawal and deposit16, it is impossible (mathematically impossible17, not just computationally difficult or improbable) to trace any subsequent uses of that eCash. If the userís hard disk drive should ìcrashî, the eCash is lost forever18. But although eCash is purely electronic, and can easily be copied, it is impossible (again, mathematically impossible, by the explicit design of the eCash protocol specification) to use any eCash twice19. Given its nature, eCash must be considered to be cash from the monetary standpoint. eCash withdrawals from the userís account are leakages from the money creation process, in the same way that cash withdrawals are. If a userís WorldCurrency Access account had $100 in it, and $50 was withdrawn as eCash, only $50 (minus any legal reserve limit and excess reserve) could be lent out to others. Conversely, a $50 eCash deposit would give the Mark Twain Bank $50 (again, minus any legal reserve limit and excess reserves) to lend out. Now let us examine some common tendencies of all types of electronic payment. First is the long term trend to increase velocity of money flow in the economy. As the growth of the credit card industry (actually a subset of electronic funds transfer) has shown us, increased convenience of payment is a large factor in increasing the number of payments made. As electronic payments become more widespread for the consumer, we might expect a similar long term trends of increased price level and output through velocity. Also, the disembodiment of cash also tends to give illusions as to its value. Transforming money from bills in your wallet into charged electrons in you hard disk is probably a greater abstractative leap than the transformation from gold coins to fiat currency. As another evolutionary step in the development of money, we might expect consumers to reexamine there conceptions of money, cash, and value. Another significant impact has stemmed out of research into the root of interest gaps in the money market. Citicorp has claimed that around 2/5 of the interest charged on a consumer finance loan is in branch delivery and management costs. This cost could be reduced substantially with increased adoption of electronic means of payments. It has been estimated that the interest differentials in the money market could be drastically reduced with adoption. After examining these three electronic payments systems and there impacts, it should be noted that no single system is ìbestî. Which system is adopted depends largely on the needs of the transaction and the agents. On the consumerís side, survey data20 shows that the single most important factor is wide acceptance of the system. Thus it may be that any system, whether it is formally standardized and secured or not, could gain market dominance and remain in that position by virtue of its ad-hoc standard. Sellers would use it because most customers use it; customers would use it because most sellers use it. The main channel for competition would not be in price of the system, but in gaining exclusive rights to the point of sale of a large number of merchants. This environment would make electronic payments widely available in a relatively short time span, but is not exactly conductive to diversity or technological advancement. This would be analogous with the entrenched tri- opoly of Visa, Mastercard, and American Express in the credit card market. An alternative to this situation might be the wide adoption of an open standard electronic payment system. In this case, any intermediary would jointly adopt an inter-operatable system, whereby the client of one system could transparently conduct transactions with any other seller whoís intermediary uses the same system. This would be similar to the openness and competition in Thailand's ATM system, where the 2 main ATM consortiums (ATM Pool and BankNet) support an open system. The holder of a Bangkok Bank ATM card can withdraw money from, say, a Thai Farmers Bank ATM. Such an open electronic payment system would have several advantages over a proprietary electronic payment system. Choice. Users could be given better choice and services. Since there could be several intermediaries vying for the same open market, they would have to use a policy of differentiation. Such a structure would bring about a monopolistic competition type market, the "market" being the market for open-standard electronic payments. Hopefully, this differentiation would be for the benefit of users. Policy. Government policy implementation would be less ambiguous. Generally, the fewer heterogeneous systems there are to regulate, the more effective government policy would be on each system. This is because each system would need a specific interpretation of the applicable laws. Since in most nations, the legislative process can't enact new laws with high speed, the "applicable laws" tend to be arcane and controversial. Combined with the constrained capacity of the state, this might cause an ambiguous period of years before systems can be finalized. The ambiguity during this period can kill of enthusiasm for new systems, leading confused agents to return to conventional paper methods of payment. It could also lead to market distortions, as misguided governments could give anti- competition concessions to single firms. Simplicity. Open standard electronic payments systems would provide a consistency in payments from the users side. It is a general design principle in computer-human interaction engineering that consistent interfaces are synonymous with the efficiency of the system. Survey data21 has shown that simplicity is the second most important aspect that is looked for in an electronic payments system. Thus the consistency of an open standard would contribute to its wide adoption. Despite the advantages of open standard electronic payments systems, it is also likely that a variety of standards could simultaneously gain market acceptance. This would not be through conventional price competition, but rather by seeking niches in the market. For example, it is highly likely that some form of electronic cash system will gain a market niche due to its strong point of unquestionable privacy. Besides the easily targetable markets of "socially deviant" products like pornography (one of the most popular products of the Global Internet) or weapons design (the users of which tend to be very paranoid), it would also gain acceptance from users who are uneasy with the fact that each and every one of there transactions would be documented by the banking system. Fear of such information getting into the hands of the few (or the hands of the state) will most probably cause users to move to a more private system. Such concerns for privacy and fear of powerful corporations have crystallized into the cypherpunk and cyberpunk movements, small but vocal special interest groups who are often listened to by governments22. Other niches might include government subsidized ones for the payment of various state benefits. The United States Department of Nutrition has already implemented an advanced ìVirtual Food Stampî system in New York City23. Groceries with a large portion of low-income customers are required to install electronic payment systems at the point of sale. Customers can buy there groceries without using cash, there being an automatic transfer of funds from their food stamp account to the groceries account. This system reduces long lines at government offices, eliminates the black market in redeeming food stamps for cash, and significantly reduces the shuffling of paper of all parties. This system is used by 500,000 people and is favored over the old system by 94% of them. Like any new technology, it would be impractical to think of the status of electronic payments as clearly defined. Although the technology has existed for decades to implement many systems, they have just begun to permeate into the everyday consumerís lives. The number of merchants accepting eCash numbers less than a hundred. Card based electronic cash systems have only been implemented in pilot projects in a handful of cities over the globe. Never the less, the trends of modern commerce, driven by the weaknesses of traditional payments systems, point to the eventual rise of electronic payments. It is just a matter or time and spirit. Footnotes 1 from J. C. Wood and D. S. Smith ìElectronic Transfer of Government Benifitsî Federal Reserve Bulletin V.77 N.4 April 1991 2 D. Gleason as quoted by S. Levy ìE-Money (That's what I want)î Wired V.2 N.12 as archived in http://www.hotwired.com/wired/2.12/features/ emoney.html on the internet 3 via Regulation E implementing the Electronic Funds Transfer Act of 1979 (15 U.S.C. 1693) as quoted in J. C. Wood and D. S. Smith, op. cit. 4 from the news group soc.culture.thai 5 As can be seen from the atmosphere of various sites on the internet. Most explicit is the cypherpunks mailing list at cypherpunks(a)toad.com 6 These characteristics, and the mathematical theories that underpin them were developed over several years in the cypherpunks mailing list and the future culture mailing list at futurec(a)uafsysb.uark.edu 7 S. Levy op. cit. 8 S. Levy op. cit. 9 heard from the future culture mailing list, op. cit. 10 S. Levy ìThe End of Money?î Time 6 Nov 1995 P.38-44 11 announced in the cypherpunks mailing list 12 details of the protocol and messaging system were publicized in the internet at http://www.digicash.com/ecash/protpublish.html 13 described in the eCash/Mark Twain Bank FAQ at http://www.marktwain.com/digifaq.html and the eCash FAQ at http://www.digicash.com/ecash/faq.html 14 This is claimed in the eCash/Mark Twain Bank FAQ. But the same document also states that WorldCurrency Access accounts do not earn interest and have no fixed time periods. 15 PGP public key encryption is a highly popular defacto standard due to its high security and its zero price. 16 This is to conform with conventional banking laws concerning the documentation of transactions. 17 D. Chaum ìShowing credentials without identification: transferring signatures between unconditionally unlikely pseudonymsî (Springer-Verlig, Berlin) p.946-64 (Conference: Advances in Cryptology-AUSCRYPT '90 International Conference on Cryptology. Proceedings, Sydney 8-11 January 1990) 18 Just another incentive to backup data 19 the eCash protocol specification at http://www.digicash.com/ecash/ protpublish.html 20 from the internet money survey conducted by the Management School at Imperial College. Archived at http://www.tu.ac.th/thammasat/pati/money.survey.results 21 See fn. 20 22 The Electronic Frontier Foundation has had close links with the Clinton Administration. The Cypherpunks mailing list catalyzed public protest that eventually brought down the government supported Clipper Chip 23 See J. C. Wood and D. S. Smith, op. cit. ------------------------------------------------------------------------------- Patiwat Panurach Whatever you can do, or dream you can, begin it. eMAIL: pati(a)ipied.tu.ac.th Boldness has genius, power and magic in it. m/18 junior Fac of Economics -Johann W.Von Goethe ------------------------------------------------------------------------------- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Mailbox soft limit exceeded
by Interserv Operations 17 Dec '03

17 Dec '03

Your mailbox has exceeded the soft size limit of 8MB. Mail will continue to be delivered to your mailbox until it reaches the hard size limit of 15MB. please removed unecessary messages from you mailbox. Additionally, if you're using CompuServe/Spry AirMail you may choose the local inbox option which will download the mail from your remote inbox to your local system inbox before allowing you to read it. PLEASE NOTE: Use of the local inbox option will preclude accessing the downloaded mail messages except from the system on which the messages were downloaded. -- Interserv Network Operations Center Postmaster(a)interserv.com 2001 6th Ave. Suite 3025B noc(a)interserv.net Seattle, WA. 95121 CompuServe/Internet Division

1 0

Re: cyphernomicon FTP site?
by jim bell 17 Dec '03

17 Dec '03

At 04:18 PM 12/19/95 -0500, you wrote: >Anyone know where I can FTP a full copy of the cyphernomicon? > >------------------------------+----------------------------------------------- >Vinod Valloppillil | LibertarianismTelecommunicationsFreeMarketEnvi >Engineering/Wharton | ronmentalismTechnologyCryptographyElectronicCa >University of Pennsylvania | shInteractiveTelevisionEconomicsPhilosophyDigi >vvallopp(a)eniac.seas.upenn.edu | talPrivacyAnarchoCapitalismRuggedIndividualism >------------------------------+----------------------------------------------- I'm interested in this too. I really HATE those silly HTML documents that can't (or, at least, I haven't yet figured out how) be downloaded in one swell foop.

2 1

Bit Commitment Query
by Robbie Gates 17 Dec '03

17 Dec '03

I am confused about bit commitment via one way hashing as described in Schneier (1st ed, p 73) h is a one way hash function. This description from Schneier, except that variables are changed so i don't need subscripts: 1. Alice has a bit b she wants to commit to. She picks random bit strings R and S, and sends Bob h(R,S,b),R 2. To verify commitment, she tells Bob S and b so he can verify the hash. What i don't get is Schneier's claim: ``If Alice didn't send Bob R, then she could change the value of S and then the value of the bit. The fact that Bob already knows R prevents her from doing this.'' Can someone explain exactly how Alice cheats if Bob doesn't know R. I can't see how she can alter R and S and b at all without being able to produce hash collisions. In essence, why doesn't the following work: 1. Alice has a bit b. She picks a random bit string R and sends Bob h(R,b) 2. To verify, she tells Bob R and b. Assuming Bob knows b is a single bit, how does Alice cheat without needing to produce hash collisions for h. thanks in advance for any help, - robbie -- ---------------------------------------------------------------------- robbie gates | it's not a religion, it's just a technique. apprentice algebraist | it's just a way of making you speak. pgp key available | - "destination", the church.

2 1

on web standards: sent to Markoff
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

here's a quickie rant about software standards sent to Markoff, precipitated by his recent column on Berners Lee & the Web. please help kill the urban legend I refer to in this letter. ------- Forwarded Message Subject: tim berners lee etc. Date: Wed, 20 Dec 95 00:39:44 -0800 From: "Vladimir Z. Nuri" <vznuri(a)netcom.com> I read your recent article on Tim Berners Lee. there is a misconception in the article that annoys me and that I have seen you/others repeat elsewhere. the following myth is: COMPANIES SET STANDARDS. this is not really true. in the short term, companies can set whatever "standards" they like. but in the long term, the *market* decides what standards are acceptable. an example of this was IBM: they set various standards until the market decided that the "standards" they were setting were not acceptable. they became their own worst enemy. no amount of shovelling their ideas down consumer's throats via million dollar ad campaigns or sales pressure changed the basic reality of what the market wanted. even though "microchannel" may have been technically superior, consumers consistently decided the proprietary price of the architecture was not worth the extra economic burden to obtain it. you and others are continually reiterating and reinforcing this myth in regards to web software in your writing. you talk about various companies as if they could somehow seize various standards for their own and exclude other companies (Netscape's supposed proprietary web "standards" are an example). this is fallacious for the reason I outlined above. the market may not tolerate this exclusivity, and particularly in the area of computer software and hardware this has been shown emphatically so. furthermore, the idea that companies can legislate their own web standards is particularly ludicrous. it is true that netscape has added their own "extensions" that their own browser understands and other browsers initially do not. but nothing prevents other companies from immediately incorporating these "enhancements" so that they are recognized by their own software. in fact this is trivial to do so in many cases (e.g. one of these so-called "enhancements" is blinking text in web pages). so the idea that a single web company can somehow monkeywrench the standards process by introducing new ideas is absurd and completely ignorant of reality. in fact this rapid "standard" fluctation is the heart of innovation. it is true that the web standard is fluctuating very rapidly right now, but that is not evidence of companies trying to seize the standard for their own: instead it is the chief sign of dynamic and rapid innovation. I urge you to read Bill Gate's recent book. he addresses this continual myth that people yammer about, namely the idea that individual companies can set exclusive or proprietary standards. a company standard is in fact a sort of temporary whirlpool in time: it will exist only so long as the forces surrounding it support it. a single company can temporarily create an illusion that their standards are the only ones available, but the market may eventually decide that their standard is not appropriate. Microsoft would crumble in a short amount of time if they failed to deliver what the market demands, and Gates reiterates this theme. it is tempting to think of Microsoft or Netscape as large behemoths that "drive the market". this is true in the short term but in truth over the long term the market drives these companies, and they lose market share if they become irrelevant. it is useful to look at one company as a focus of market forces, not the determinant of them. in my opinion the idea that various companies are in control of the market is not only erroneous but highly dangerous. it leads to the view that the government has to step in to promote "fair competition" or "legislate standards". these approaches are usually total failures because they completely neglect the true nature of the innovation of ideas, something that is expressed quite tangibly and viscerally in software development, but this simple point various people still utterly fail to grasp. its quite dramatic to write about single companies such as Microsoft or Netscape as if they have tremendous power and influence over the industry. various companies have found however that this influence is highly fleeting if they are not in tune with market currents. companies are subservient to the market, not vice versa. please strive to recognize this basic fact in your future writing. p.s. I am willing to work this into a letter to the editor if you are willing to publish it.

4 6

Re: FH radios
by jim bell 17 Dec '03

17 Dec '03

At 05:06 PM 12/25/95 -0500, you wrote: > There is certainly little additional cost to building a >trully secure digital cordless phone given the dense ASIC technology >that is standard in this kind of product - but someone has to >persuade the manufacturers that there is a real need and find a way >to allow them to export the product. > > Dave Emery N1PRE Is there actually a restriction on the export of really-fast frequency-hopping radios, even those (like cordless phones) which have no clear military value?

2 1

Reputation capital: FIBS case study
by lwp＠conch.aa.msen.com 17 Dec '03

17 Dec '03

I am currently engaging in a reputation adjustment of a certain player on FIBS, the First Internet Backgammon Server (see my homepage). Reputation is important on FIBS, and I thought it might be informative to examine the ways it can work in the [more-or-less] real world. FIBS allows various levels of nymity, and various modes of reputation. Each player picks a pseudonym as his FIBS name. These can range from the crypticly anonymous nym, to some variant of the player's real name. The server will also disclose the FQDN from which the nym is connected, or was most recently connected. If she wants, the player may include any information, typically such as an email address, in an "address" field in her player profile. Or something cute, or nothing. Players may also choose to have a web page listed under their nym, on a page full of such listings. Players may participate in the newsgroup (rec.games.backgammon), identifying themselves in their posts by any or all or none of {their FIBS nym, their real name, their email address}. Reputation has several components on FIBS. Of course, personal experience with another nym is hugely significant, when it exists. When that is absent, or not conclusive, there are other sources of reputation which may be consulted. The server reports two numbers for each player, representing distinct reputation criteria: the "rating" is a weighted score representing the won/less record; the "experience" is a count representing how many games this player has played. Before I mention other reputation indices, I want to amplify on these two. When negotiating with another player about possibly starting a new match, and about the length in points of the potential match, most players will think about various aspects of the reputation of the prospective opponent. Depending on the circumstances, the difference in ratings may be decisive, in straightforward ways, for evaluating an invitation. Of particular relevance to past discussion on cypherpunks, the experience number is usually very important also. Those with a high experience level, and perhaps a name that you recall having seen before, are trusted more than nyms with little investment in their reputations. Experience matters a lot, because one of the key strategies is to avoid becoming involved with unpleasant or dishonest players. If someone has a huge experience number, you can be fairly sure that you would have heard about it if they are somehow undesirable. As FIBS is an open server, operating without charge to the users, we get a wide variety of newcomers every day. Some persist, and become better known, and others lose interest and don't return. Most are [more-or-less] agreeable and [more-or-less] ethical; however some nyms will exhibit certain recurring problem behaviors, and quickly begin to accrue negative reputation. On common problem is the use of profanity or the advocacy of various forms of bigotry, in "shout"ed comments or private messages, and the closely related hounding of players with female-sounding nyms by unwanted come-ons. This behavior is generally countered with "shout"ed and "tell"ed replies, and with the "gag <name>" command which kills your copy of any further remarks from that user. The negative reputation resulting from this behavior is pretty much instantaneous and self-documenting, with reinforcement from anyone who is enraged enough to remember and to heckle the offender at a later login. Some of us are more sensitive about this than others, so the offensiveness is just another variable in reputation, not always the decisive one. The thorniest problem in our reputation economy continues to be the case of the player who drops out of a match when clearly losing, to avoid the decrement of his rating number (based on match results only, not on individual games). Such players follow a strategy of playing winning matches to completion, which increases their rating, but bailing out of losing matches before they end. When a match is interrupted, the server remembers it, and the two players can resume later, by mutual agreement. Almost all players are ethical enough to resume even losing matches, and eventually to complete them. The problem folks are the ones who ignore or refuse requests to resume. Avoiding such players is a key strategy for serious FIBS regulars. One indicator here can be a complex function of the rating and experience numbers: a player with fairly low experience but an unexpectedly high rating is one of two things -- either a very strong player, or else a match dropper. (Or else very lucky, but we prefer to think of that as strength of play.) The best defense we have found against the match dropper is complaining in the newsgroup. I just posted a warning in the newsgroup about a new match dropper which I had the misfortune of playing against. I accepted an invitation from him last Saturday, to play a 3 point match. I looked over his info before I accepted, and decided to give him a chance: no email address, experience = 57, and rating showing slightly more wins than losses, from a site at a college in Britain. I won the first game for 2 points, and was pretty clearly winning the next game, which would make me win the match. When "dorion" rolled a game-losing double five, he immediately dropped his connection to FIBS. The server saved the match, and I waited around for awhile to see if he would come back. He didn't. Now at this point, I'm not yet ready to start in on his reputation. After all, we all have host problems, and phone problems, and personal problems. It's still possible that he and I will meet later, and finish the match. (I'm skeptical, because the timing of it is just too convenient, but I hold my tongue). Finally Tuesday, I was hanging on FIBS when dorion returned. I asked politely if we could finish, but dorion immediately logged out without replying. I stayed connected to FIBS, while I did some other work on other VC-s. Before long, dorion was back, my little watchdog macro beeped for me, and I again politely asked him to resume. Instead of replying, he started a fresh match vs. a brand new player, experience equal zero. I started watching their match, where I asked again if we could resume sometime. While I wasn't getting an answer, I looked into the new player's information: connected from exactly the same site as dorion! This of course, is a warning sign of the other common form of ratings cheating -- creating two nyms for one person, and playing against oneself, with one nym always winning and the other always losing. Well, again I got no reply to my requests, and both nyms suddenly disconnected without finishing their match. At this point, I set about trashing dorion's reputation. I posted a (PGP signed) article to the newsgroup setting forth the facts. When I came back on today, there was one followup from another player who had a similar experience with dorion. When I signed onto FIBS, I got a "tell" from a trusted, veteran nym saying that dorion and his alter-ego nym BatesMotel had just been on, and played a couple of one-sided and not at all credible matches vs. each other. I checked their ratings/experience and followed up to my own article with a definite advisory against playing against either nym. Now, despite many elaborate proposals over the years, discussed at length in the newsgroup, there is no automated mechanism for dealing with this sort of negative reputation. I have a personal "don't-play" list I keep up to date, as do many others. My complaint surely got dorion and BatesMotel into many such personal lists, and neither nym is likely to last on FIBS. I'm not really asking for suggestions here or anything. It's likely that most of them have already been debated to death on r.g.b. I just wanted to show you a case of reputation markets in action. :::::::::::::::::::::::::::::::::::::: Thank you VERY much! You'll be :: Lou Poppler <lwp(a)mail.msen.com> :: getting a Handsome Simulfax Copy :: http://www.msen.com/~lwp/ :: of your OWN words in the mail :::::::::::::::::::::::::::::::::::::: soon (and My Reply).

4 3

Re: [Rant] Flame threads and factual accuracy
by jim bell 17 Dec '03

17 Dec '03

At 07:30 AM 12/25/95 -0500, you (Fred Cohen) wrote: >With rights come responsibilities. If you want the right of free speech, you >have to use it responsibly - otherwise, you will lose the right - and quite >possible lose it for me as well. This commentary is pure bullshit. If it were possible to quantify it throughout history, I strongly suspect that the vast majority of instances where "free speech" was LOST (or was never had in the first place) occurred NOT because of some objectively agreed-upon ABUSE (irresponsible use) of that free speech, but in fact merely because those in power WANTED there to be no free speech. In short, "losing the right" had NOTHING to to with abuse. (Though admittedly, that might be a common excuse given...in lieu of the truth!) Fred, you richly deserve your bad reputation.

1 0

Re: Misconfigured Web Servers
by David Klur 17 Dec '03

17 Dec '03

Re: the "trick" below... an even more effective search is the following... http://www.altavista.digital.com/cgi-bin/query?pg=aq&what=web&q=url%3A etc%2Fpasswd&r=&d0=&d1=&Submit.x=51&Submit.y=14 which searches all URLs that contain etc/passwd See for yourself! David Klur _____________________________ Reply Separator _________________________________ Subject: BoS: Misconfigured Web Servers Author: nobody(a)mail.uu.net at Internet-USA Date: 12/26/95 3:57 PM Everyone, A friend of mine showed me a nasty little "trick" over the weekend. He went to a Web Search server (http://www.altavista.digital.com/) and did a search on the following keywords - root: 0:0 sync: bin: daemon: You get the idea. He copied out several encrypted root passwords from passwd files, launched CrackerJack and a 1/2 MB word file and had a root password in under 30 minutes. All without accessing the site's server, just the index on a web search server! Well, the first thing I did was check my site and it's ok. The second thing I did was check my ISP for my home account, and it's okay. But by trying various combinations of common accounts on web searches, dozens of passwd files were found. It seems that a large number of locations who use httpd and ftpd on the same server often copy the regular passwd file to ftp/etc or ftp-users/etc for ftp user access. A few sites have left the root password in the file, and many contain user accounts' passwords. The problems I see here are as follows: 1. You can get the passwd file in some cases by simply pointing your URL to http://target.com/ftp/etc/passwd or http://target.com/ftp-users/etc/passwd. Not good. Anon ftp can't get it but a web browser can. Many passwd files are shadowed but you can see some legit account names. Yes, I realize that this may be a dummy file but hey, not always the case. 2. Some sites do not have the passwd file world readable, but the entire passwd file stills exists indexed on the web search server. I don't know about you, but I don't think I'd want my passwd file indexed and searchable on a world accessible web server. 3. A ton of etc/group files turned up as well. The guy that showed me this found it funny, but I find it disturbing. Are there that many sites that are that poorly configured? Mark_W_Loveless(a)smtp.bnr.com

3 2