December 2003 - cypherpunks-legacy

NOISE.SYS Info Distribution List
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

I've set up a distribution list for NOISE.SYS. If you want to receive periodic announcements about new versions, bugs, related utilities, etc., reply to <wlkngowl(a)unix.asb.com> with the subject "add noise.sys-list" (NOISE.SYS is a crypto-quality RNG device for MS-DOS, similar to the random.c implementation for Linux. The latest version is 0.5.6-Beta.) Rob (aka "Deranged Mutant")

1 0

[NOISE] Hackers soundtrack
by Simon Spero 17 Dec '03

17 Dec '03

Update on an old thread... Apparently it was released last week in England, so it may be available in some import racks. Simon

2 1

Why the Poor are Mostly Deserving of their Fate
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:18 AM 5/17/96, snow wrote: >On Wed, 15 May 1996, Jim McCoy wrote: >> There are two kinds of libertarians, those who hate the poor and those who >> don't. I always seem to meet the former, I am beginning to suspect the >> latter don't exist. By the way, I certainly don't "hate the poor," as a class. More on this in a bit, but I certainly was not raised in a wealthy family, and I started my working career living in a tiny (and I do mean tiny) studio apartment in Santa Clara, CA. > Hi Mr. McCoy, My name is Petro, and I _am_ a poor libertarian >(well, sort of a libertarian, I tend to think they are a little short >sighted, and a little to authoritarian to me) Many of us ARE poor. We may >not _like_ being poor, and some of us are working to get out of that >situation, but most of us don't "hate" the poor. We (well, I) hate people >with their hands out. This is everyone from poor people who _won't_ try to >get out of their situation, to Multi-billion dollar corporations that >recieve government grants for over seas advertising to old people who >didn't plan for their "golden years" and expect us to provide the gold. Agreed. I was a libertarian (and a Libertarian, I guess, as I voted for the first LP candidate, John Hospers, in 1972) even when I was poor, in college. (No car, and I declined to attend MIT or Stanford, both of whom had accepted me, as their costs would've been an unduly-large burden on my parents.) Once working and ensconced in my tiny little studio apartment, I worked my butt off, working 10 hour days, 6 days a week, and sometimes some 16 hour days (no overtime). I made it a point to save as much as I could, foregoing various immediate gratifications that many in my cohort were partaking of. By the time I'd been working for 6-8 years, things really started to pay off, financially and professionally. I put the money I'd saved into small companies I thought would do well...companies like Sun, Apple, Genentech, and, of course, my own company, Intel. By the time I'd worked there for 12 years, I'd accumulated enough in savings and investments to never work again. So I bailed out and have lived the last 10 years doing as I please. (Still sounds good to me.) My point? Some of it was luck, some of it was hard work, some of it was my native abilities. But I saw some of my fellow engineers fail to invest, fail to save...and they are mostly still working. And of course I saw many in the "larger community" who spent their paychecks, who saw their earnings go up their nose (remember, this was the 1970s and 80s), and who found as many ways as they could to avoid hard work. An important point is this: it wasn't all "luck." At least not in the sense of luck at a roulette wheel. In fact, nearly all of my cohorts who worked hard and invested wisely really did well. (And people starting out can do just as well, perhaps even faster than my cohort did...look at the 3-10x increases in stock prices in less than 2 years of so many companies!) The effects are obvious: some of those who failed to study, prepare, work, save, and invest are now seeking to use "democracy" to take away the assets of those who did all these things. Many of them talk about "privilege" and claim that "white males" got all the benefits, conveniently ignoring that the same benefits were available to any of the Asians, women, or, indeed, coloreds, who similarly studied, prepared, worked, saved, and invested. Some of them now claim that we libertarians "hate the poor," that we lack "compassion." I'm tempted to say "Fuck them," but that would be rude. Instead, I'll say that those who think "the poor" are being victimized by "the rich" should take a close look at how wealth is actually created. It is only partly "luck" that is responsible for success. I look at the vast number of new markets and new fortunes that have been created since I stopped working, and I am more convinced than ever that anyone who is willing to work in a field which is in demand and who keeps up with developments, works hard, shows initiative, etc., will do extremely well. Sadly, about 60% of the adult population of the U.S. doesn't think this way, doesn't have "the culture of success," and instead looks to the government to give them benefits, handouts, and jobs. These people are headed for the scrap heap. Strong crypto builds walls against this unruly mob. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Reputations
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:09 PM 5/15/96, Steve Reid wrote: >Another problem with reputations is that people are stuck until they get a >good one. A bad rep can always start over. In fact, a person/company can >look perfectly nice, but use a different identity for dirty work. Sure. And they do this today (use cut-outs or subcontractors to limit reputational damage or liability). >Naturally, you'd only trust dealings that involve a "nice" identity. Not necessarily. Many people play the numbers, implicitly trusting the Mafia to pay off on bets they win. (Many don't think the Mafia has a very "nice" identity, but your mileage may vary.) In fact, nearly all of the alleged problems with anonymous systems, especially the issues of defections, trust, expectation of payoff, etc., have parallels in other "extra-legal" situations. For example, the Mafia and other extra-legal or criminal operations. Do they sometimes defect (welsh)? Sure. Do they sometimes screw over the little guy? Sure. Do people trust them just enough to keep dealing with them voluntarily? Sure. (Before anyone mentions it, there are of course cases where people are forced to deal with criminal gangs nonvoluntarily, such as with shakedowns, hijackings of trucks, etc. But a large fraction of the dealings with the Mafia, Jamaican gangs, Russian mob, etc., are for market reasons, where a market need for drugs, girls, cheap cigarettes, gambling, loans, etc., is being filled by players who are outside the normal legal marketplace.) >Problem is, young people who are just starting out have a no-reputation >identity, and would be treated the same as the no-reputation identities >that are used for screwing people over. Sure, newcomers always have it rough. Whether the newcomer is Nancy the Nym, or Eustace T. Collins, III, Esq., just starting out in a law firm, the newcomer has little positive reputation. (It varies, and the degree may mean something, just as Nancy the Nym may have some reputation capital to show.) I mentioned "postive reputation." There is a real cost in throwing out, say, 30 years of accumulated reputation capital, and this will not be done lightly by many. Thus, in a given transaction, a lot may be at stake. (I don't mean for this brief article to be an essay on the many fascinating issues surrounding reputation and reputation capital. Cf. my Cyphernomicon for much more on this topic.) >Reputations could be very hard to create, and very easy to destroy. As in real life. People can destroy their reputations by being careless. (I disagree with your implied point that the opinions of others can easily destroy a reputation. In real life, it usually takes a lot more than just bad-mouthing. Even in nym-space, the same is apparently true.) >Well-known good reputations would be powerful and fairly hard to destroy, >so it's possible that the big reputations might try to crush little >reputations in an effort to gain some sort of reputation monopoly. Maybe. Implausible as a central problem, but all things will likely happen. This happens occasionally in the real world, as when a Big Reputation (e.g., Bill Clinton) belittles and marginalizes a Small Reputation (e.g., Paula Jones). There's a vast amount of stuff to think about with reputations. I applaud Steve for doing some thinking, but I don't think he's yet uncovered anything especially unique or worrisome. As a last point, see especially the role of anonymous escrow agents. A number of years ago the example I usually used was "Ace Escrow--You Slay, We Pay," to illustrate that an anonymous escrow holder (holding untraceable e-cash deposited by the purchaser of a murder contract) could pay off a murderer who presented certain evidence, all without any of the parties having any idea whatsover whom the other parties were. The problem is then one of whether the escrow company will simply pocket the money and not pay off. First, it can be set up (I think) that the e-cash is uncashable by the escrow company...but I'm not sure this is needed. A better solution is to rely on the basic nature of escrow or bonding services: their reputation capital is much more valuable to them than anything to be gained by defecting and burning their clients. Except if they are about to retire anyway...as with the bonded courier who defects to Rio de Janeiro with a bag of diamonds....the trick is to spread the escrow money around to multiple escrow agents, and to rely on "escrow testing services" which periodically ping or test the services.... There are many issues here. I'm not advocating murder markets, just noting that they provide an easy to understand and fairly "pure" example. If it can be done with murders for hire, it can be done with nearly anything. A few years ago, many valuable ideas were contributed in this area by Dave Ross, Phil Salin, Dean Tribble, Hal Finney, and Robin Hanson. You might search for their articles. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Why does the state still stand:
by Hal 17 Dec '03

17 Dec '03

From: "E. ALLEN SMITH" <EALLENSMITH(a)ocelot.Rutgers.EDU> > I did not > include offshore.com.ai in Anguilla due to its high cost; I consider anything > over 25$ a month to be impractical. > > _Country/Area_ _Name_ _Email_ > Anguilla Cable & Wireless webmaster(a)candw.com.ai > [...] Thanks very much for making this list. However I would not be so quick to reject http://offshore.com.ai. It is run by long-time Cypherpunk Vince Cate, apparently specifically for the kinds of purposes we are discussing. His project was discussed in a recent issue of Wired, I think the May issue. (I have no contact with Cate, and have never met him as far as I can recall.) For doing something like running a remailer which will post material which is illegal and/or copyrighted in the U.S., you are going to need a service which can stand up to pressure. Presumably some monetary incentive is going to be a necessity. Of course by this standard $25 a month is pretty inconsequential. One issue is whether these banking-secrecy countries like Anguilla are followers of the Berne convention or other international copyright regulations. Banking secrecy and software piracy don't necessarily go hand in hand. I hear a lot about copyright violations in China but not in the Caribbean. So actually it isn't clear that this country is the right location for a remailer that can post arbitrary material. As for the costs to the remailer operator, he simply passes those on to his customers. I think in the long run onshore remailers will be forced to take measures to restrict copyright-violating posts. So if your choice is between paying nothing and not getting your whistle-blowing message posted, or paying $10 and getting it out on the nets, then hopefully it is worth that much to you. We have discussed for-pay remailers and the consensus has been that no one would use them when others run for free. However now I think the false premise is being exposed, that free remailers simply will not be able to run in the current mode for much longer. Once a single remailer operator has been fined thousands of dollars because somebody posted some copyrighted message, I don't think you will find many people eager to sign up as operators. So this dream of a volatile collection of remailers popping up and going away just doesn't work in my view. Why would anyone offer a service knowing that he was exposing himself to liability like this? It would be just a game of Russian roulette, waiting to see whether it is your remailer which gets the bullet in the form of a post which violates the copyright of someone with deep pockets. Hal

3 2

The Twilight of the Remailers?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:59 PM 5/21/96, Alex Strasheim wrote: >I'm closing my mixmaster, nsa(a)omaha.com, on the 4th of June. > >There wasn't an incident that triggered this, but Hal's post about the FBI >sort of spooked me, as have the lawsuits. I don't have a lot of assets >myself, but I do have partners. My lawyer tells me that there's no >reliable way to separate my personal net activities from those of the >company my parnters and I own, and that I could even be exposing my >parnters to personal liability. > >I can't speak for anyone else, but for me the problem with running a >remailer is that it's an inherently altruistic enterprise. That in itself >wouldn't be so bad, but the liability makes the extent of the altruism >open ended. If I knew that the worst case scenario would be $1k or even a >$5k personal loss I could do it, but an open ended liability that's shared >by my partners is unacceptable. > >I'm sorry for the inconvenience this will cause. Between Hacktic going down, Hal's comments that he may shut down his two sites, and this, plus others who are more quietly making plans to shut down, I think the thread title "The Remailer Crisis" is more apt than ever. As to potential liability, it is very likely to be vastly more than the examples Alex cites, of $1K or "even a $5k personal loss." Lawyers don't get out of bed in the morning for such insignificant sums. Keith Henson has been a friend of mine for the past dozen years (and I actually met him first in 1976), and he has kept me informed of his fight with the CoS. He's being sued for $100,000 by the CoS. (And they asked him a lot of questions about remailers, and who runs them. He didn't tell them much.) I can't say whether they are likely to win their suit, or what the judgment might be. But make no mistake about it, if the CoS wins and Keith is ordered to pay.... It's one reason I won't run a remailer that can ever be traced back to me. (I also don't have a box on the Net and don't really trust running remailers on machines someone else has root to. And I'm not a Unix person. And....) I figure that there are some, such as Detweiler, maybe government types, maybe others, who would make efforts to "take me down." Posting some child porn through my site to a Usenet group and then alerting the media would pretty much do it. (Or if binaries are not allowed, posting solicitations. Or if Usenet posting is not allowed...well, there are still ways...) "The Twilight of the Remailers"? Ironically, "copyright violation" and "clam secrets" were not even on the list of "the Four Horsemen of the Infocalypse" that we thought would really put remailers under some extreme pressure. If the Scienotologists can shut down many of the remailers, imagine what the Horsemen will do! --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 5

Re: The Crisis with Remailers
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 11:58 1996-05-22 +0200, bryce(a)digicash.com wrote: >Matts, _floating_ point numbers are _not_ useful >if you want to handle a number with a lot of precision, nor >indeed, if you want to be able to _know_ the precision! If you >have a number that represents money, you want to know the >precision! As I said yesterday, there are in fact people dealing with billions in all major currencies that keep their money in 64 bit floats. The precision is far better than anything you can do in 32 bit integers. Trust me, this is a fact and can easily be proven. >I shall try to refrain from taking umbrage at your comment that >DigiCash is "not real". The "get real" was a pun on floats. Many languages, such as Pascal, calls them real numbers. Sorry I forgot the smiley. >Also that DigiCash doesn't "do" currency. What could you possibly >mean by that? In my client (2.1.5a MT) there is no way to do currency conversion. If I go to a FIM or DEM merchant I can't buy anything in the store. This will probably change in the near future when a new client is released, and then we'll have the question of how to represent these currencies in one wallet. What do you think will happen if you have a one italian lira coin and you try to deposit it with Mark Twain's USD account? With integer math it won't be pretty. >For further reading on floating point and other representations >of numbers in computing, I recommend any good introductory >university text on mathematical computing. Sorry I don't have >mine handy or I'd give you a specific reference. Maybe you should start looking for it. You'll need it when the lira arrives... Regards, Matts

7 9

Are there laws against remailing messages?
by tcmay＠got.net 17 Dec '03

17 Dec '03

[I've changed the thread title.] At 2:17 PM 5/21/96, Jim Choate wrote: >In pondering the last few days of discussion it occurs to me that a test >might be possible. In short: > >Is it legal for a business to anonymously remail physical mail? ... >I would also like to point out (the obvious I admit) that the founding >fathers apparently embarced anonymous distribution via their 'publius' >handle. It seems to me that a federal prosecutor would have a hard time >claiming there was no precedence for such actions. Such a claim to my way >of thinking would be fundamental in any attempted prosecution for anonymous >remailing. Also, as far as I can find out, there was no persecution of the >newspapers for printing this material anonymously, they apparently were not >held to task for the content. This seems to indicate that English commen law >of that day (and its descendants here today) embraced anonymous speech as >well. Several points: * The Supreme Court formally decided many years ago that leaflets, fliers, articles, handouts, etc., cannot be required to be identified. (Some state had tried to require that leaflets be identifed with the name of the author or distributing group. I don't have the case name handy, but it's pretty famous and is cited in all the books on cyberspace law...I may even have a mention of it by name in the Cyphernomicon.) * This ruling, which is certainly fully consistent with the First Amendment, should of course apply to electronic forms of leaflets, fliers, articles, handouts, etc. Unless, of course, there is an upheld interpretation that the Net is different from print media, which I think it clearly is not. * As to laws against receiving a letter and then resending it to somone else...how could that be a crime? What I receive in my mail is my business. What I do with what I receive in the mail is also my business. Demanding that I process letters or notes to me in certain ways and not in other ways would be interfering with my communications. (Quibblers will likely cite FCC and election campaign laws as a counterexample. Wrongly, I think. Another debate.) * Now if I start doing this remailing on a large-scale basis, various business regulations, tax laws, etc., obviously come into effect. "Remailings Etc." will have to satisfy various regulators, tax collectors, OSHA inspectors, etc...all the things that make it so hard to start a small business in America. However, I can't think of any obvious laws which ban receiving a package or letter, removing the outer addressing, removing the payment, and then resending it. (Not saying there aren't such regulations, though I think they are clearly unconstitutional. The "regulate commerce" language which is frequently cited as justification for meddling in business should not be able to turn a business into a lawbreaker for doing what individuals can do.) In summary, what I receive in my mail, physical or electronic, is for me to do with as I wish. This includes sending it on to another site, commenting on it (*), etc. (* A finesse I thought of a few years ago is this: If remailing is ever banned or if remailers are held liable, use _quotes_. That is, I say: ---- To: foo(a)bar.baz From: Tim-Remailer(a)black.net Subject: Ever seen anything like this? Somebody sent me this: <message> ---- Now, what's a law against remailers going to do? Hold me liable for passing a message on and asking for comment? (Yes, I think this is a pretty transparently cute ploy to circumvent laws about remailings. But it shows, I think, the can of worms that gets opened should such a law ever get passed and then upheld. It would place limits not only on what one could "remail without comment," but on what one could _include_ in one's own messages!) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: The Crisis with Remailers
by loki＠infonex.com 17 Dec '03

17 Dec '03

At 10:36 AM 5/21/96, Adam Shostack wrote: >Lance Cottrell wrote: >| >| An interesting problem with anonymous postage is that it is likely to kill >| cover traffic generators. >| > >Postage is most needed at the point of delivery. > >That is the node that will be taking the heat/paying the lawyers. I'd >operate a remailer if I was never the last node, becuase I don't have >a site that can take the heat/seizure of machines for me. If we pay >those final nodes to do more, than intermediate nodes can still carry >cover traffic for free. > >Adam > >-- >"It is seldom that liberty of any kind is lost all at once." > -Hume This is true. It is also something which would be easy to build into Mixmaster. The Message payload has a much looser format than the rest of the message. The postage could simply be prepended to the subject and destination fields (which are already variable length). Time to actually look at the API :) -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0

Re: Rumor: DSS Broken?
by jim bell 17 Dec '03

17 Dec '03

At 01:05 AM 5/20/96 -0700, Bill Frantz wrote: >At 8:05 PM 5/19/96 -0800, jim bell wrote: >>It should occur to all of us that if the NSA was actually doing the job we >>are vastly over-paying them to do, it is THEY who should be finding, >>exposing, and correcting these kinds of cryptography faults. Has anybody >>ever heard any evidence that the NSA has ever acted in this sort of >>responsible role? > >I was rather impressed by NSA's role in the creation of DES. The >strengthened it against an attack which was not publicly known, and didn't, >in the process, reveal the attack. (See AC2.) Isn't this partly bad, at least? Sure, if DES was a working, operational cryptosystem revealing the attack immediately might be arguably irresponsible. But since it was merely a design, exposing the flaw didn't help the enemy or hurt "us." Had DES been in use, the NSA could merely have stated, publicly, that "We see a flaw in DES, and we will tell you all about it in 5 years. Enclosed is an encrypted description of the problem, encrypted using a single key system with a 128-bit key. Save it for your files. In five (5) years we will publish the key to decrypt that file, and you will then know what we know now." At that point, anybody who then was using DES would have a five year warning to replace it. And the NSA would be unable to change the contents of what they were revealing, because they would only be withholding the key. Also, exposing the flaw in DES could have alerted the developers of other cryptosystems to watch for the same attack on their systems. All in all, I don't think the NSA's near-silence on DES is unambiguously commendable. Jim Bell jimbell(a)pacifier.com

1 0