December 2003 - cypherpunks-legacy

Re: Past one terabit/second on fiber
by jim bell 17 Dec '03

17 Dec '03

At 09:23 PM 5/17/96 -0400, Alan Horowitz wrote: > >> >Now that's progress, don't you think? >> >> Yes, I do! Because these activities don't just happen by themselves, they >> take the place of other activities which were formerly done in their place. >> The trivial example of sending letters has been replaced by email. > > E-mail is cool. E-mail is lovely. I use it enthusiatically. It is >not the same thing as sitting down with a fountain pen and and some fine >stationary. I feel sorry for your significant other if your loveletters >go by e-mail. So you've found one specific instance where you don't think it's appropriate to send email. Big deal! Try again. >Yes, let's get people away from reading books. Hey, there's computer >games to play, burn that library down, will you? Want people to read books? Okay, first put the hurdle in front of them that they must go to the library. (This is particularly a hurdle for children, when not in school, because they can't drive.) Then, if the book(s) they want to read is already checked out, make them wait 1+ months until it returns. Make them come back to the library to get it, and make them return it the same way. See why some people DON'T read books? >Quantity of life is not the same as quality of life. You're misrepresenting form over substance. Information is no more valuable or trustworthy on paper than on electrons. Jim Bell jimbell(a)pacifier.com

1 0

The Crisis with Remailers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:29 PM 5/15/96, jamesd(a)echeque.com wrote: >Some nyms are valuable, most are valueless by design. All remailers >should be valueless by design. The penet.fi remailer design is >unsatisfactory precisely because it penet.fi is valuable, hence a >target. If it gets shut down a lot of people lose their nyms, >causing much inconvenience. I agree with this point, and the similar points made by Hal Finney and by several others. We have far too few remailers, they are too tempting as targets, the use of "mail-to-News" gateways is formally separable from the function as a remailer, and there is generally a stagnation in the deployment of new and varied kinds of remailers and their modes of operation. We used to discuss remailer architecture, topology, functionality, and "ideal behavior" quite a bit a few years ago, but seldom do here on the Cypherpunks list anymore. Various reasons: same old discussions, commercialization of Mixmaster-type remailers (so I hear, and Lance Cottrell can clarify this if this is indeed a factor) may be inhibiting free discussion of planned features, and perhaps the discussion is going on elsewhere (on remailerpunks, or the remailer operator's list). (I'm surprised there have been no "Master's Thesis"-level analyses of remailers and the modeling of them. I had expected by now at least a couple of such studies. Even better, some even more advanced studies. The "theory of remailers" was partly laid out by Chaum in his 1981 "Untraceable E-Mail" short article--at the CSUA site at Berkeley, last I checked--but much has happened since then. A practical analysis is needed. Note: the recent paper on remailers by the SAI researcher and another is _not_ what I meant...that was just put together from Raph's page, other sources, and a few days worth of Web searches, as near as I can tell.] A much richer ecology of remailers is sorely needed. A factor of at least 10 or 20 more (100-300 remailer sites), less reliance on specific sites, an "everyone a remailer" capability (which has many elegant advantages!), more traffic, temporarily instantiated sites, digital postage, greater ease of use (especially with crypto and chaining), and such things as nominal terminal remailers choosing to add their own hops (so as to lessen their own target potential). Having some of these improvements will be a big help. In the past we have discussed many ideas related to this; I sure don't have the energy right now to recapitulate the points made over the years. Cf. my Cyphernomicon for some general features, at least as of mid-94. Also, the archives, if they ever become available again. Yes, things are stagnating at this time. Not because we discuss "off-topic" things (as we sure did in 1992-3, for example!), but for various other reasons. I suspect the enemies of remailers will sense victory and will try to force the remaining remailers to shut down or at the least to severely restrict operations. From a high of perhaps 25 remailers, we may soon be down to less than a dozen. These remaining sites will feel even more pressure. The upcoming War on Intellectual Property Piracy, with opening shots against China already fired, will put even more heat on remailers. (A remailer can't just "block" copyrighted material. It ain't practical. And digital mixes (remailers) should not, obviously, be looking at content of packets mailed. (Only the last, plaintext, message can be looked at if things are done right, but I surmise from comments by remailer operators that a lot of the traffic is not encrypted at all, and that the operators do in fact take a few peeks at what's flowing through their systems....more evidence that we are very far indeed from Chaum's ideal digital mixes.) Yes, a crisis has been brewing for months. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

10 15

HUGE denial of service attack against any ecash customer!!!
by Robert Hettinga 17 Dec '03

17 Dec '03

Ian Goldberg seems to be on a roll. First he figured out how to find out how anyone can determine anyone else's ecash mint balances, and now he does this. The man's a genius. If you don't believe it, ask me, I'll tell you. ;-). Cheers, Bob Hettinga --- begin forwarded text To: ecash(a)digicash.com Path: not-for-mail From: iang(a)cs.berkeley.edu (Ian Goldberg) Newsgroups: isaac.lists.ecash Subject: HUGE denial of service attack against any ecash customer!!! Date: 15 May 1996 16:09:29 -0700 Organization: ISAAC Group, UC Berkeley Lines: 42 Sender: owner-ecash(a)digicash.com Precedence: bulk -----BEGIN PGP SIGNED MESSAGE----- (Again Cc:'d to ecash-feedback, hoping for a security prize. I wonder who's keeping track... Also Cc:'d to cypherpunks, for fun...) So I had some more free time... (Dave cringes when I say that.) Here's a cute one: Give me an account number, and I can prevent it from being used until an arbitrary time in the future (of my choosing). How? Simple. Send a deposit message with 0 coins (well, any message will work, I think, but this is one of the simplest messages there is) with a timestamp of some future time. Messages stamped prior to that (such as everything coming from the actual user for that account, until the time comes) will be politely discarded. (Actually, I think the last reply to a withdrawal request is continually resent, but I'm not exactly sure of this.) In any case, the actual user will be unable to withdraw money from his mint until the time sent in the denial-of-service message. (Unless he forward-dates his computer's clock, or something...) I've tested this against myself and Sameer (with his cooperation, of course). Anyone else want to be locked out for an hour? (Actually, I could pretty effectively lock out _everyone_ for an arbitrarily long time, it seems...) - Ian "Right. I want the sources to the client and the server released. Now." :-) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZpj3kZRiTErSPb1AQF0SAQAmOEZJTg0v3utWFodDXZ4iv4xa7I+QbNQ Nlsbkug8dtkdf+Jboe+vBtrs5IWSSff8bWntGwfODckct26NwzpVM9bUIXohVoRQ jOkRT9a8m/X00jUAoFOTq5O5Rz87a3Uw8MGFugP5Y4DCk+UqnTA70cuozyOCgb8m 8oke89V9Q0E= =ARMe -----END PGP SIGNATURE----- --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

re: SEVERE undercapacity, we need more remailers
by attila 17 Dec '03

17 Dec '03

Addressed to: Black Unicorn <unicorn(a)schloss.li> Cypherpunks <cypherpunks(a)toad.com> ** Reply to note from Black Unicorn <unicorn(a)schloss.li> 05/15/96 6:29pm -0400 = I would really like to see a remailer that is somehow blinded. = on a message basis --it is not really possible if the logs are maintained or the fed are already monitoring the stream --which is probable if they are after something --and it will increase geometically if we get Bubba again. there are a number of very sophisticated ways to play the game, but each requires a real "Web of Silence" --what makes your counterpart reliable? where do we establish that "Web of Trust" which everyone bandies about. who are the two plants for our current chain? or is this just another case of sowing dissension by the feds? I only know two or three at most of the players on the remailers at all --and that is a passing knowledge, not acquaintance. = I don't know enough about how mail paths are generatered, but is it = impossible to conceal the origin of remailer postings? = impossible to conceal each orientation, but I have been playing with several easy techniques which are sufficiently obfuscatory that the Feds will not have the horsepower to break them unless someone provides them with the methodology --that in itself violates how we (cp) have always insisted on 'post it' and get on with the attempted destruction. even if they break the methodology, they gain very little v. the technique. = Postings made to remailernym(a)alpha.c2.org would be spit out = somewhere but = without accountability? = sure, possible if you wish to play the game with a "Web of silence." = Impossible? Would do wonders defeating traffic analysis. = no, not impoosible. just who wants to be responsible for something the NSA assholes can not own --and compromise? they get down right shitty when they kick your door down in the middle of the night as take your carcass away --if nothing else works, off to Springfield you go --without charges --lest we forget the crippled president or Hustler magazine --that is what they did to him _before_ they convicted him, _and_ after. = I'd consider running a remailer, but after listening to the response to = the anonymous poster a while back, it sounds like there are few if any = simple options which do not require major time and effort to setup and = run. = you can run it out of your client account on an IAP --there's nothing special about it in a simplified form. I could support a remailer point if I could manage to get the necessary "Web of Silence" counterparts --one them preferable foreign. BTW, it does not need to be complex to add another level of confusion. usually the best offensives are the simplest. == = Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com = is this subtle, crass, or just not? -- Overseeing first-rate programmers is a managerial challenge roughly comparable to herding cats.

1 0

Re: Why does the state still stand:
by jim bell 17 Dec '03

17 Dec '03

At 12:34 PM 5/15/96 +0000, Jean-Francois Avon wrote: >On 15 May 96 at 0:45, Ed Carp wrote: > >> The problem, however, is twofold - (1) the government will >> play mind games on the rest of the population to make you look like >> a terrorist, or whatever turns the populace against you, > >Well, first of all, we should find how much of the population >*really* believe in what govt says. There is a difference between >the politically correct opinion that Joe & Jane Public give to a >poll interviewer and what they really think. > >Second, you suppose that Joe & Jane Public really like and approve what >they understand from what the medias say. I think that Ed Carp recognizes that these caveats were somewhat valid based on a pre-Internet era, when control of news and information was relatively centralized in newspapers and TV networks. Then, you were told what to think (although it wasn't quite phrased this way) and few people got an alternative story. But as you correctly point out, it is getting harder to pull the wool over the eyes of the public when they can get alternative information. >And finally third, this system does not work according to the will >of a majority. It wouldn't take too many peoples who believe that the >medias and their perceived lack of integrity is widely responsible >for the way the world goes right now, to have a substantial prize put >on the head of the medias. >Therefore, any journalist with two+ working neurons will realize >that sticking to the most objective facts available would be the best >way to build a great reputation while sticking to govt propaganda >would be a great way to attract a prize on his head. I don't think anybody in the media is going to have the guts to stick with the government as it sinks into the depths, torpedoed by its own technological inventions. The big names can just resign and keep their wealth; the small fish have no long-term credibility or hope to achieve the levels of their predecessors. >So, to see how AP will make the system evolve, you have to assess >the communication capabilities of govt vs the individual. This is >central to AP and the nature of actual govts. This is *why* the >internet is *so* dangerous to any govts that seek to either retain or >increase their power, even if it actually touches only but a tiny >portion of world population. > >For the first time in the history of humanity, we have a peer to >peer communication capability and an individual-to-world broadcasting >capability that is not controllable in practice by any other entity >(such as law, high finance, etc) > > >The explains fully why the various govts what to find a way to >enforce internet laws, breakable crypto schemes and non-anonymous >protocols. I expect that few government workers have any idea how dangerous the net is going to be to them in the next few years. The various proposals we've been seeing, such as Clipper and others, are probably the product of a very few strategists who began worrying in the early 1990's about the fate of centralized government systems. It will be interesting, someday, to talk to these people who monitor us, and ask them when they thought their position was hopeless. >JFA >PLEASE NOTE: THIS POST DOES NOT MEAN THAT I ENDORSE MR. BELL'S >SYSTEM. MY RATIONNAL CONCLUSIONS ABOUT IT'S INTERNAL MECHANICS >AND IT'S INTRINSIC LOGICS DOES NOT MEAN THAT I LIKE NOR ENDORSE >THE SYSTEM. I SIMPLY CONCLUDED THAT IT IS IMPOSSIBLE TO PREVENT >THE SYSTEM FROM BEING IMPLEMENTED. IMO, IT IS UNAVOIDABLE. I understand your...uh...caution. But as scary as it may be to "us," it's going to be even more terrifying to those it is likely to eliminate. Sort of the difference between two parachute jumps: With and without a parachute! Jim Bell jimbell(a)pacifier.com

1 0

Re: Why does the state still stand:
by Hal 17 Dec '03

17 Dec '03

From: "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> > I did not > include offshore.com.ai in Anguilla due to its high cost; I consider anything > over 25$ a month to be impractical. > > _Country/Area_ _Name_ _Email_ > Anguilla Cable & Wireless webmaster(a)candw.com.ai > [...] Thanks very much for making this list. However I would not be so quick to reject http://offshore.com.ai. It is run by long-time Cypherpunk Vince Cate, apparently specifically for the kinds of purposes we are discussing. His project was discussed in a recent issue of Wired, I think the May issue. (I have no contact with Cate, and have never met him as far as I can recall.) For doing something like running a remailer which will post material which is illegal and/or copyrighted in the U.S., you are going to need a service which can stand up to pressure. Presumably some monetary incentive is going to be a necessity. Of course by this standard $25 a month is pretty inconsequential. One issue is whether these banking-secrecy countries like Anguilla are followers of the Berne convention or other international copyright regulations. Banking secrecy and software piracy don't necessarily go hand in hand. I hear a lot about copyright violations in China but not in the Caribbean. So actually it isn't clear that this country is the right location for a remailer that can post arbitrary material. As for the costs to the remailer operator, he simply passes those on to his customers. I think in the long run onshore remailers will be forced to take measures to restrict copyright-violating posts. So if your choice is between paying nothing and not getting your whistle-blowing message posted, or paying $10 and getting it out on the nets, then hopefully it is worth that much to you. We have discussed for-pay remailers and the consensus has been that no one would use them when others run for free. However now I think the false premise is being exposed, that free remailers simply will not be able to run in the current mode for much longer. Once a single remailer operator has been fined thousands of dollars because somebody posted some copyrighted message, I don't think you will find many people eager to sign up as operators. So this dream of a volatile collection of remailers popping up and going away just doesn't work in my view. Why would anyone offer a service knowing that he was exposing himself to liability like this? It would be just a game of Russian roulette, waiting to see whether it is your remailer which gets the bullet in the form of a post which violates the copyright of someone with deep pockets. Hal

3 2

Re: crosspost re remailers
by Benjamin Brochet 17 Dec '03

17 Dec '03

WHO IS THE MODERATOR OF THIS LIST ? I've been victim of a spoofing from a german.... he suscribed me to 2200 mailing list... also I'd to be unsuscribed from your list ! --------------------------------------------------- IBB Software - Benjamin Brochet - Solutions InternetI I Creation - Hebergement - Consulting - Formations I I I I http://www.bb-soft.com - ftp.bb-soft.com I I info(a)bb-soft.com I ---------------------------------------------------

1 0

Re: Edited Edupage, 9 May 1996
by Clay.Olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 1:32 PM 5/15/96, Jim McCoy wrote: >There are two kinds of libertarians, those who hate the poor and those who >don't. I always seem to meet the former, I am beginning to suspect the >latter don't exist. I think there is a great deal of misunderstanding here. I can speak for no one other than myself, but I don't "hate the poor", nor do I feel no compassion towards misfortunate people. However, I have to be realistic - I approach problems analytically, not emotionally. My emotions tell me that spending more money is a good thing. My reason tells me that we have "been there, done that" and it DOESN'T WORK. After spending more than a trillion $$ on the "War on Poverty" we are worse off than we were before. Can anyone point to ANY evidence that this money was well spent? If not, then why should we spend more? It is time to look for new solutions. At 9:09 AM 5/15/96, Doug Hughes wrote: >Where is somebody making less than $5000/year going to move to? >(Answer: somewhere rural and poor). Or, if you prefer, they can >move into tax-payer subsidized housing? (I'd prefer not, thanks) Why wouldn't your income change when you move? In my area, you can make over $6/hour working at McDonalds ($12K/year). I know several people who work two jobs. I know of families (almost all immigrants BTW) that work their tails off running small businesses. It isn't about education, it is about hard work. Of course hard-work can help to get a good education. also Doug Hughes: >environment, lack of education, lack of money, lots of factors. Nobody >is holding a gun to anybody's head saying "Don't Read". But improving >literacy is a goal that needs to be undertaken. Do you not agree that >low literacy is a bad thing and needs to be taken care of? If not, why >not? Naturally, you can't force someone to read who doesn't want to. >But, why, given a good learning environment and an inspiring teacher >would you not want to? So how do we go about makeing education better? More money doesn't work, having a net connection probably won't help, even having more computers doesn't make a substantial difference. It all comes down to the fact that people need to be responsible for their own actions. Nowadays, you can grow up illiterate, and expect to get food stamps, free housing, welfare, etc, the cash equivalent of which approaches $20K/year in many places. Or you can become a capitalist and make big $$ selling "illegal substances". These "consequences" are the result of people with good intentions, thinking with their emotions instead of their minds. Maybe it is time to become callous and see how that works. Can things get much worse? Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

1 0

SMTP Server for sending to anonymous remailers?
by Anonymous User 17 Dec '03

17 Dec '03

Does anyone know of an anonymous remailer that has an SMTP server (hopefully unlogged) that I can specify in a special variant of the "sendmail.cf" sendmail configuration file for sending mail to anonymous servers? I use a PPP connection, and right now I'm using my ISP's default server and I don't like the idea of logs being kept, even though the messages themselves are chained/encrypted. Maybe I'm "paranoid", but if I wasn't, I probably wouldn't bother with PGP, C'punk remailers, etc. <g>

3 2

Re: SEVERE undercapacity, we need more remailer servers FAST
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hfinney(a)shell.portal.com" "Hal" 15-MAY-1996 19:23:06.71 >Maybe the operators can try to plead that they are like "common carriers" >and should not be blamed for what people post. Still it is going to take >deep pockets at best to prevail in this dispute, and it isn't even clear >that the remailer will win. Maybe the lawyers on the list could comment >on legal liability of a remailer used to repeatedly post copyrighted >material, whether Scientology scriptures or Microsoft Word binaries. I >don't see how it can happen. Part of this problem may be solved through the proper decisions on the liability of ISPs for material on them. The concept would seem to be extensible. If a country has A. good laws on the subject and B. a pretty good court system - e.g., one in which it's difficult to sue and easy to defend - that country would seem to be suitable for setting up a remailer front end. Other remailers can just be used for chaining, and can't be proven to have carried a message (even unknowingly) without defeat of the remailer system via traffic analysis. (A reason for remailer operators to run automatic mailing scripts, BTW.) >This was the basis for my suggestion that remailers may have to stop >supporting posting of messages, and instead be used for private mail >between consenting individuals. Granted, this would probably eliminate >99% of non-cover remailer traffic. But I would argue that as long as the >core functionality is there of letting people communicate with each other >anonymously and consensually, we would still offer an important service. In other words, a remailer that would only forward mail to someone if the email address in question gave consent? Mailing lists and mail-to-news gateways can still be signed up by their operators under such a system, and it's possible the remailer might be charged along with the operator if copyrighted material was posted. >Encryption hides the contents of the messages you send from >eavesdroppers. But they can still see who you are communicating with. >Remailers extend privacy protection beyond "what you say" to "who you say >it to". When used with pseudonym servers and some of the extensions we >have discussed here over the years (maildrops, etc.), they can allow the >anonymous two-way communication that is needed for real privacy. How much use is a pseudonym if you can't practically use it for building reputation capital? It's hard to do that when you can't send to anyone but individuals, instead of to publically available sources. One idea would be bonded pseudonyms. If you put up an adequate bond to the remailer front end operator (to A. pay fines and B. cover any legal fees), then you get to send to public fora. This would also be profitable for the remailer operator, if he/she got to keep the interest (assuming deposit into some investment). -Allen

1 0