December 2003 - cypherpunks-legacy

unsescribe
by HardWorkingStudent 17 Dec '03

17 Dec '03

unsescribe razz(a)eden.rutgers.edu unsuscribe razz(a)eden.rutgers.edu

2 1

Re: Freedom and security
by angels＠wavenet.com 17 Dec '03

17 Dec '03

Jim Ray wrote > Freedom is already diminishing at an alarming pace. >That is why cypherpunks spread crypto, and why Libertarians like >me rant. Freedom does not increase through more laws. Nor does freedom increase through less laws or no laws. Freedom increases as respect and care for one another increases. Meanwhile, since we do not live in utopia, all societies at a certain level of economic development and of a certain size of population require law and law enforcement to protect citizens from predators. The Internet is beyond the stage of small communities exercising informal social controls (peer pressure). It's now a major industrial city and will develop law, law enforcement and government, whether anyone likes it or not, not least because the Community will always respond to crime by trying to protect itself. And the crime is already here. The idea that the Internet is not controlled is IMHO one of the biggest myths around. It's like a large group of people are still living in some far-off utopian rural paradise. Does anyone really doubt the extent of State control and power across the Net? My point is that this is inevitable. The Internet is a mirror of the rest of the world, not a new form of society, and I fail to understand why anyone should be surprised that that is the case. >.... laws only breed more laws, which always lead to >less freedom. I disagree with this statement. I do not believe that laws breed more laws nor that laws lead to less freedom. I believe bad laws compromise freedom (eg CDA) while good laws protect freedom. >>I don't believe that security is the enemy of >>freedom. I believe that freedom needs security in order to exist at all. > >Good. Join us in spreading cryptography around, and security will >bloom (along with freedom). Cryptography enhances and protects privacy, which does not inevitably lead to greater security. Security for the sender, yes, in that no one else can read the message, but security for the Community? Doesnt that depend what the message said? The technology itself is neutral. Child pornographers encrypt their hard drives so that law enforcement cannot gather crime evidence - that is certainly a state of greater security for the pornographer, but it does not improve our Community, and as child pornography increases, the law is by definition broken more and more, and so the Community becomes less free than before. And that's not the tyranny of government but the tryanny of criminals. I do in fact support cryptography for personal security, not least because I can ensure that my messages are authenticated. CyberAngels PGP public key will be up on our new website opening very soon. I've had enough of people forging my email. ********************************************************* Colin Gabriel Hatcher - CyberAngels Director angels(a)wavenet.com "Two people may disagree, but that does not mean that one of them is evil" *********************************************************

5 5

Re: ITARs and the Export of Classes and Methods
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:49 AM 4/30/96 -0700, Timothy C. May wrote: >An interesting situation for the ITARs, if they try to restrict bignum >classes, for example. A class-based system, if done correctly (in whatever >language, e.g., C++ or Java), should have _most_ of the hard crypto work >already implemented in classes and methods (for bignums, modular >exponentiation, etc.), with the final crypto program much more easily >implemented and exported. Certain languages, e.g. Smalltalk, and I believe lisp and scheme, have bignums as a built-in type. (Or more specifically, their integer types are limited in size only by available memory.) I believe these languages are freely exportable. Your problem stays here in the good ol' USA. You can't implement RSA directly in these languages (I assume RSA in perl has the same problem), because of the patent restrictions. Yet another reason to buy a T-shirt. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Re: Why I dislike Java. (was Re: "Scruffies" vs. "Neats")
by Hal 17 Dec '03

17 Dec '03

From: "Perry E. Metzger" <perry(a)piermont.com> > > The Web is the universal marketplace these days. Being unable to use > the web is the equivalent of being unable to use the phone. I have > research analysts at large trading houses begging for > Netscape. Unfortunately, these people have a need for top notch > security, because vast amounts of money are at stake. > [...] > Unfortunately, when the same machine runs Netscape so the > trader can read the UUNet/MFS merger press release and also has the > big shiny red "trade!" button on some application, you get nervous. Aren't you holding Java to a higher standard than ordinary applications? If your traders run any software at all on their machines there is the risk of harm. The Netscape binary itself could be hacked to do bad things. Likewise with any other software they run. Wouldn't it be safer to run a Java applet than a typical program from the net? At least applets run in an environment which is designed to restrict the harm they can do. In OS's like Windows 95 there are no such restrictions on programs. Take a specific example: Mixmaster. This is a client for the remailer network. It is reasonably well suited to being implemented as a Java applet given the current restrictions on the language. If you had a choice between downloading and running the client as a program on your PC, versus loading and running it as an applet, which would you prefer? Or if you would do neither, how would you go about acquiring this functionality? Would you forego it forever, or would there come a time, say if no one else reported problems, that you would be willing to run one or the other? What I am really trying to get at is how you balance the risks that come automatically when you interact with the net against the benefits you get by doing so. You have chosen a certain point on the risk-reward continuum, one for which Java applets are apparently on the too-risky side. So I am wondering what principles you use to decide where a proposed application falls. Hal

6 6

Re: Why I Pay Too Much in Taxes
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frissell(a)panix.com" "Duncan Frissell" 5-MAY-1996 08:56:32.33 >Even though the population of those who regularly violate federal tax laws >is smaller (20 million?) the records show that even for this population the >odds of being convicted are approximately the odds of being nurdered. However, are you controlling for level of income? The IRS is a lot more worried about TCMay committing tax fraud than they are about me committing tax fraud; my income taxes are a lot closer to 0 than his. -Allen

1 0

Re: Why I Pay Too Much in Taxes
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"frissell(a)panix.com" "Duncan Frissell" 6-MAY-1996 16:04:24.96 >Actually, as a percentage of income, tax evasion is probably more prevalent >among the poor than the rich. Because they are less exposed. Studies of >spending show that the poorest 20% of Americans spend twice their reported >income. Quite. The poor can get away with this for multiple reasons, including being on more of a cash-based economy. But the largest reason is probably that the IRS doesn't care nearly as much about each individual at the low end of the income ladder as they do about any evasion involving a lot of money. Now, the low end tax evasion probably costs the government a lot more than the rich does... but it's also a lot harder to pursue. -Allen

1 0

Re: Why Leahy is No Friend of Ours
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"attila(a)primenet.com" "attila" 5-MAY-1996 21:36:54.93 > how many _truly_ "populist" presidents have we elected? Given the numbers of times that a democracy has done more harm than good to civil liberties (Prohibition, the election of Islamic Fundamentalists in Algeria, etcetera), we don't _want_ a "populist"/demagogue president. We want someone in charge (to whatever degree that someone has to be in charge) who will respect civil liberties. The masses aren't going to elect such a person; they prefer protection to liberty and always will. > "They that give up essential liberty to obtain a little > temporary safety deserve neither liberty nor safety." > --Ben Franklin (Historical Review of PA -1759) > > and, the bottom line is: > > "It is not the function of our Government to keep the citizen > from falling into error; > it is the function of the citizen to keep the Government > from falling into error." > --Robert H. Jackson (1892-1954), U.S. Judge Quite. -Allen

1 0

Re: Why I Pay Too Much in Taxes
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jk(a)stallion.ee" "=?ISO-8859-1?Q?J=FCri_Kaljundi?=" 5-MAY-1996 11:47:15.29 >Here in Estonia there was a proposal made in the parliament to remove >taxation on corporate income (right now there is a proportional corporate >income tax of 26%), which should bring more foreign investments into >Estonia and also make Estonian economy develop faster. Estonia I think is >one of few countries where there is a possibility of accepting this kind >of law. Of course European countries, USA and different international >financial organisations are very against this kind of law. This law would >apply both to companies and to self-employed private persons (farmers for >example). Let me guess the reason for the objection... it would make siting an offshore-type company in Estonia to avoid taxes possible. -Allen

1 0

Re: Kid Gloves or Megaphones
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jamesd(a)echeque.com" 5-MAY-1996 14:18:14.34 >>From: Lucky Green >>>It is true that the issuer is unable to discover that double blinding is >>>being used. The real problem with the protocol is that it requires >>>payor/payee collusion, which may make it difficult to execute. >At 07:58 PM 5/4/96 EDT, E. ALLEN SMITH wrote: >> Can the payee discover that the payor isn't colluding before the bank >>can figure out who the payee is? >If the payor is not colluding, then the payee will immediately discover >he has not been paid, because the checksums are wrong, and his software >says "bad payment" >If the payor is colluding, then no matter what he reveals to the bank, >the bank cannot discover the payee. Note that with payee anonymity, >the payee does not have to promptly check in his money, so the bank >has no hope of narrowing the search by coincidence in time. >But if the payee is colluding, then the payor can be detected by >coincidence in time. The other messages on this appear to be saying about the same thing, with the exception of this last part. _Except_ for that, the payor/payee collusion part doesn't appear to be a problem on the anonymnity side of things. I would guess that Lucky Green's comment was then that there was an additional complexity for payor and payee. -Allen

1 0

Re: WWW proxies?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 0:30 5/5/96, Lou Poppler wrote: >On Fri, 26 Apr 1996 19:13:06 -0400 (EDT), >Black Unicorn <unicorn(a)schloss.li> wrote: >} >} Has anyone developed such a beast yet? > >I know of two anonymizing web proxies. See: >http://hplyot.obspm.fr:6661/ and: >http://anonymizer.cs.cmu.edu:8080/ > >I think both sites offer source for what they are doing. >I've used the Observatory de Paris site a few times as http_proxy. >Last I checked, the Carnegie-Mellon site only serves requests from >*.cmu.edu clients. Of course these sites are in an ideal position to log their user's every move. With so many users making all their http requests through a single site, the commercial value of the information that could be gained by logging traffic at the site is tremendous. Only when a network of anonymizing sites is connected through something like PipeNet and the users are either PipeNet nodes themselves, or at least randomly use various PipeNet nodes for their http connections, does the security of the user increase. With only one hop, IMHO, the potential risk outweighs the potential benefit. I'd advise against using such single-hop http anonymizers. YMMV. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

4 3