December 2003 - cypherpunks-legacy

Why is hacktic going down?
by David Rosoff 17 Dec '03

17 Dec '03

Does anyone know the reasons for the shutting down of the hacktic remailer? And also, are the other remailers at utopia.hacktic.nl going down with the remailer at remailer(a)utopia.hacktic.nl? Thanks David

1 0

Senator, your public key please?
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was running around the hill all morning and I thought I would drop in on Leahy to see what his key signing policies were. I gave Leahy a buzz to see if I could catch him in person but unfortunately it's a busy day on the hill and he sent me off to Beryl Howell instead. Ms. Howell is Senior Counsel for the minority staff of the Antitrust Subcommittee and handles all of Leahy's encryption gofering. I'd dealt with her on a limited basis once before, and I got a good 10 minutes to discuss some issues before she had to run off elsewhere. The issues she brought up were interesting. Firstly, Leahy wasn't advised to issue a public key, it was entirely his idea. No staff suggestion there. Secondly, the Ethics Committee was very interested in the issue. As of now they have ruled that "exchanging" PGP signatures is an "exchange in kind" and an ethics violation. Ms. Howell expressed exasperation over this lunacy, but put it much this way: "No, you guys don't understand what the issues are here, but I don't have 3 hours to explain it all to you either." Apparently the ethics committee is concerned that a signature from Leahy's key will constitute some sort of endorsement and the "you sign mine and I'll sign yours" looks like influence peddling. Part of the problem was that several politically oriented groups approached Leahy's office and descended like vultures on a carcass, all of them wanting to certify his key. No signing from Senator's keys for the time being. She said the ethics committee went so far as to prohibit them from soliciting signatures from others as well. Her conservative (and reasonable) interpretation was that she couldn't hand over a fingerprint of the key for signing purposes. As things stand now Ms. Howell intends to try and educate some of the key Ethics members over the August break and have a decent signing policy after the break itself. Welcome to the hill. Those of you who haven't might want to check out the May 2, 1996 version of the Promotion of Commerce on-line in the Digital Era (Pro-Code) bill. Nice choice snippet: The current strength of encryption the U.S. government will allow out of the country is so week that, according to a January 1996 study conducted by world-renowned cryptographers, a pedestrian hacker can crack the codes in a matter of hours. A foreign intelligence agency can crack the current 40-bit codes in seconds. Also: "Encryption expert Matt Blaze, in a recent letter to me, noted that current U.S. regulations governing the use and export of encryption are having a "deleterious effect... on our country's ability to develop a reliable and trustworthy information infrastructure." See: http://www.senate.gov/~leahy/ For some reason http:/www.leahy.senate.gov/ is also listed. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Autodocument signed iQCVAwUBMZtRLWqgui0rHO4JAQHRywQAgClfWZTLDCusKaAlefg53DShaCII6+vF O4X9a6vCZDWtIE0Nu7Nx/75K6zDo7AdjfqfYcAdLq4WW4F0FBH7u55+MYKUjDJ3X YFuxk9aPQSJzkgITK4EzGfHNswONkybuhAGo/6mcvJ8E2QW5rxUKRFxh7BLo7fmV CrEpvhzsycU= =uWRd -----END PGP SIGNATURE----- --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

2 3

NOISE.SYS Info Distribution List
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

I've set up a distribution list for NOISE.SYS. If you want to receive periodic announcements about new versions, bugs, related utilities, etc., reply to <wlkngowl(a)unix.asb.com> with the subject "add noise.sys-list" (NOISE.SYS is a crypto-quality RNG device for MS-DOS, similar to the random.c implementation for Linux. The latest version is 0.5.6-Beta.) Rob (aka "Deranged Mutant")

1 0

[NOISE] Hackers soundtrack
by Simon Spero 17 Dec '03

17 Dec '03

Update on an old thread... Apparently it was released last week in England, so it may be available in some import racks. Simon

2 1

Why the Poor are Mostly Deserving of their Fate
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:18 AM 5/17/96, snow wrote: >On Wed, 15 May 1996, Jim McCoy wrote: >> There are two kinds of libertarians, those who hate the poor and those who >> don't. I always seem to meet the former, I am beginning to suspect the >> latter don't exist. By the way, I certainly don't "hate the poor," as a class. More on this in a bit, but I certainly was not raised in a wealthy family, and I started my working career living in a tiny (and I do mean tiny) studio apartment in Santa Clara, CA. > Hi Mr. McCoy, My name is Petro, and I _am_ a poor libertarian >(well, sort of a libertarian, I tend to think they are a little short >sighted, and a little to authoritarian to me) Many of us ARE poor. We may >not _like_ being poor, and some of us are working to get out of that >situation, but most of us don't "hate" the poor. We (well, I) hate people >with their hands out. This is everyone from poor people who _won't_ try to >get out of their situation, to Multi-billion dollar corporations that >recieve government grants for over seas advertising to old people who >didn't plan for their "golden years" and expect us to provide the gold. Agreed. I was a libertarian (and a Libertarian, I guess, as I voted for the first LP candidate, John Hospers, in 1972) even when I was poor, in college. (No car, and I declined to attend MIT or Stanford, both of whom had accepted me, as their costs would've been an unduly-large burden on my parents.) Once working and ensconced in my tiny little studio apartment, I worked my butt off, working 10 hour days, 6 days a week, and sometimes some 16 hour days (no overtime). I made it a point to save as much as I could, foregoing various immediate gratifications that many in my cohort were partaking of. By the time I'd been working for 6-8 years, things really started to pay off, financially and professionally. I put the money I'd saved into small companies I thought would do well...companies like Sun, Apple, Genentech, and, of course, my own company, Intel. By the time I'd worked there for 12 years, I'd accumulated enough in savings and investments to never work again. So I bailed out and have lived the last 10 years doing as I please. (Still sounds good to me.) My point? Some of it was luck, some of it was hard work, some of it was my native abilities. But I saw some of my fellow engineers fail to invest, fail to save...and they are mostly still working. And of course I saw many in the "larger community" who spent their paychecks, who saw their earnings go up their nose (remember, this was the 1970s and 80s), and who found as many ways as they could to avoid hard work. An important point is this: it wasn't all "luck." At least not in the sense of luck at a roulette wheel. In fact, nearly all of my cohorts who worked hard and invested wisely really did well. (And people starting out can do just as well, perhaps even faster than my cohort did...look at the 3-10x increases in stock prices in less than 2 years of so many companies!) The effects are obvious: some of those who failed to study, prepare, work, save, and invest are now seeking to use "democracy" to take away the assets of those who did all these things. Many of them talk about "privilege" and claim that "white males" got all the benefits, conveniently ignoring that the same benefits were available to any of the Asians, women, or, indeed, coloreds, who similarly studied, prepared, worked, saved, and invested. Some of them now claim that we libertarians "hate the poor," that we lack "compassion." I'm tempted to say "Fuck them," but that would be rude. Instead, I'll say that those who think "the poor" are being victimized by "the rich" should take a close look at how wealth is actually created. It is only partly "luck" that is responsible for success. I look at the vast number of new markets and new fortunes that have been created since I stopped working, and I am more convinced than ever that anyone who is willing to work in a field which is in demand and who keeps up with developments, works hard, shows initiative, etc., will do extremely well. Sadly, about 60% of the adult population of the U.S. doesn't think this way, doesn't have "the culture of success," and instead looks to the government to give them benefits, handouts, and jobs. These people are headed for the scrap heap. Strong crypto builds walls against this unruly mob. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Reputations
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:09 PM 5/15/96, Steve Reid wrote: >Another problem with reputations is that people are stuck until they get a >good one. A bad rep can always start over. In fact, a person/company can >look perfectly nice, but use a different identity for dirty work. Sure. And they do this today (use cut-outs or subcontractors to limit reputational damage or liability). >Naturally, you'd only trust dealings that involve a "nice" identity. Not necessarily. Many people play the numbers, implicitly trusting the Mafia to pay off on bets they win. (Many don't think the Mafia has a very "nice" identity, but your mileage may vary.) In fact, nearly all of the alleged problems with anonymous systems, especially the issues of defections, trust, expectation of payoff, etc., have parallels in other "extra-legal" situations. For example, the Mafia and other extra-legal or criminal operations. Do they sometimes defect (welsh)? Sure. Do they sometimes screw over the little guy? Sure. Do people trust them just enough to keep dealing with them voluntarily? Sure. (Before anyone mentions it, there are of course cases where people are forced to deal with criminal gangs nonvoluntarily, such as with shakedowns, hijackings of trucks, etc. But a large fraction of the dealings with the Mafia, Jamaican gangs, Russian mob, etc., are for market reasons, where a market need for drugs, girls, cheap cigarettes, gambling, loans, etc., is being filled by players who are outside the normal legal marketplace.) >Problem is, young people who are just starting out have a no-reputation >identity, and would be treated the same as the no-reputation identities >that are used for screwing people over. Sure, newcomers always have it rough. Whether the newcomer is Nancy the Nym, or Eustace T. Collins, III, Esq., just starting out in a law firm, the newcomer has little positive reputation. (It varies, and the degree may mean something, just as Nancy the Nym may have some reputation capital to show.) I mentioned "postive reputation." There is a real cost in throwing out, say, 30 years of accumulated reputation capital, and this will not be done lightly by many. Thus, in a given transaction, a lot may be at stake. (I don't mean for this brief article to be an essay on the many fascinating issues surrounding reputation and reputation capital. Cf. my Cyphernomicon for much more on this topic.) >Reputations could be very hard to create, and very easy to destroy. As in real life. People can destroy their reputations by being careless. (I disagree with your implied point that the opinions of others can easily destroy a reputation. In real life, it usually takes a lot more than just bad-mouthing. Even in nym-space, the same is apparently true.) >Well-known good reputations would be powerful and fairly hard to destroy, >so it's possible that the big reputations might try to crush little >reputations in an effort to gain some sort of reputation monopoly. Maybe. Implausible as a central problem, but all things will likely happen. This happens occasionally in the real world, as when a Big Reputation (e.g., Bill Clinton) belittles and marginalizes a Small Reputation (e.g., Paula Jones). There's a vast amount of stuff to think about with reputations. I applaud Steve for doing some thinking, but I don't think he's yet uncovered anything especially unique or worrisome. As a last point, see especially the role of anonymous escrow agents. A number of years ago the example I usually used was "Ace Escrow--You Slay, We Pay," to illustrate that an anonymous escrow holder (holding untraceable e-cash deposited by the purchaser of a murder contract) could pay off a murderer who presented certain evidence, all without any of the parties having any idea whatsover whom the other parties were. The problem is then one of whether the escrow company will simply pocket the money and not pay off. First, it can be set up (I think) that the e-cash is uncashable by the escrow company...but I'm not sure this is needed. A better solution is to rely on the basic nature of escrow or bonding services: their reputation capital is much more valuable to them than anything to be gained by defecting and burning their clients. Except if they are about to retire anyway...as with the bonded courier who defects to Rio de Janeiro with a bag of diamonds....the trick is to spread the escrow money around to multiple escrow agents, and to rely on "escrow testing services" which periodically ping or test the services.... There are many issues here. I'm not advocating murder markets, just noting that they provide an easy to understand and fairly "pure" example. If it can be done with murders for hire, it can be done with nearly anything. A few years ago, many valuable ideas were contributed in this area by Dave Ross, Phil Salin, Dean Tribble, Hal Finney, and Robin Hanson. You might search for their articles. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Why does the state still stand:
by Hal 17 Dec '03

17 Dec '03

From: "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> > I did not > include offshore.com.ai in Anguilla due to its high cost; I consider anything > over 25$ a month to be impractical. > > _Country/Area_ _Name_ _Email_ > Anguilla Cable & Wireless webmaster(a)candw.com.ai > [...] Thanks very much for making this list. However I would not be so quick to reject http://offshore.com.ai. It is run by long-time Cypherpunk Vince Cate, apparently specifically for the kinds of purposes we are discussing. His project was discussed in a recent issue of Wired, I think the May issue. (I have no contact with Cate, and have never met him as far as I can recall.) For doing something like running a remailer which will post material which is illegal and/or copyrighted in the U.S., you are going to need a service which can stand up to pressure. Presumably some monetary incentive is going to be a necessity. Of course by this standard $25 a month is pretty inconsequential. One issue is whether these banking-secrecy countries like Anguilla are followers of the Berne convention or other international copyright regulations. Banking secrecy and software piracy don't necessarily go hand in hand. I hear a lot about copyright violations in China but not in the Caribbean. So actually it isn't clear that this country is the right location for a remailer that can post arbitrary material. As for the costs to the remailer operator, he simply passes those on to his customers. I think in the long run onshore remailers will be forced to take measures to restrict copyright-violating posts. So if your choice is between paying nothing and not getting your whistle-blowing message posted, or paying $10 and getting it out on the nets, then hopefully it is worth that much to you. We have discussed for-pay remailers and the consensus has been that no one would use them when others run for free. However now I think the false premise is being exposed, that free remailers simply will not be able to run in the current mode for much longer. Once a single remailer operator has been fined thousands of dollars because somebody posted some copyrighted message, I don't think you will find many people eager to sign up as operators. So this dream of a volatile collection of remailers popping up and going away just doesn't work in my view. Why would anyone offer a service knowing that he was exposing himself to liability like this? It would be just a game of Russian roulette, waiting to see whether it is your remailer which gets the bullet in the form of a post which violates the copyright of someone with deep pockets. Hal

3 2

Re: Instant Remailers
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

Someone said: > >It is possible for someone to operate an anonymous remailer anonymously. > >Just get a UNIX shell account under a fake name, pay with cash, and set up > >the remailing software. The identity of the operator of such a remailer > >would be difficult, if not impossible, to discover. Then someone else said: > (Doesn't Sameer's system offer such accounts? Couldn't there be dozens of > remailers based at c2.org? Of the 16 Type-1 remailers listed in one of > Raph's recent reports, only 2 were at c2.org.) This happened. Remember robo(a)c2.org? Whatever happened to it? (Anyone ever figure out who the real operator was?)

1 0

Re: The Crisis with Remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"loki(a)infonex.com" 18-MAY-1996 20:02:12.04 >I was invited to the digicash API design meeting precisely to make sure it >could be used in remailers. It will not be using the current API. The >problem is that Mixmaster requires exact knowledge of the size of every >object in the message, to maintain constant message size. I could set aside >room for one, two, three coins, but there is no guarantee that the payment >will be made with only that many coins. The current API is going to be high >level. It will does not allow the program to know anything about the >internals of the payment. I need to be able to specify payment of amount X >using no more than N coins. As soon as I have that level of control, you >will see postage in Mixmaster. Good. I can see doing a limited postage now, actually, with relatively simple modifications - the postage goes to the initial remailer front end and to the remailer that sends out the message to something other than another remailer. -Allen

1 0

Re: Remailers & what they get out of it...
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"ravage(a)ssz.com" "Jim Choate" 18-MAY-1996 09:43:06.96 >As long as the remailer is run a 'grins & giggles' affair you are right. There is the increase in reputation capital in _some_ quarters possible through running a remailer. (On the other hand, in authoritarian quarters, it would tend to decrease one's reputation capital...) >To me the biggest problem with the crypto work right now is that not enough >professionals are involved. If more remailers and such were initiated as >a business there would be legal avenues to explore. Also, in this vain is >the apparent lack of support for commercial ventures by developers of such >apps as MixMaster (whose license explicity prohibits commercial use). It prohibits commercial use? That's silly. Is it a holdover from when the idea was to turn Mixmaster into a company? >And for the record, yes, we expect to charge real $$$ for access. Our >current plan is $10/month for each account. Money orders prefered. We have >at this point pondered e-cash methods but it doesn't seem popular enough >at this juncture. How would you be doing this? Only remailing from accounts that have paid up, or what? -Allen

1 0