December 2003 - cypherpunks-legacy

Re: is there no end to AP & Creative Wiretap Arguments?
by jim bell 17 Dec '03

17 Dec '03

At 03:47 AM 10/12/96 +0000, attila wrote: > after months of patient explanations to Jim Bell and > sympathizers, going over the same points in 31 flavours, > the same arguments of what I would call "respectable" anarchy > (well stated by Tim May) rather than the "world at war" anarchy of > Jim Bell -- where are we?!? > > I read Jim's first "manifesto" at least 18 months ago; and, the > "refined manifsto" less than a month ago. I have yet to see an > application of civilization which brings AP society up to even the > level of Tombstone AZ just prior to the OK Corral. Be careful about the Wild West analogies. Current theory is that contrary to what Hollywood cooked up for our movie-viewing pleasure, it was a rather peaceful place most of the time. If anything, the reason that certain incidents (OK Corral) were so memorable is that they were, likewise, rare. > > Jim's theories all hinge on betting pools which supposedly can > be run like the lottery where the poor can share a ticket > (egalitarian, of course), anonyminity (which as an argument is > appropriate, but what for in a selfish immoral act?), and a > justice is served attitude, even if there are mistakes. I would be far more worried about "mistakes" if I hadn't already thought through it, and concluded that abuse and misuse and errors would be strongly deterred by the very structure of the AP system. It will most easily attack who coerce the most people, for example politicians, bureaucrats, and some government employees in general, precisely because the cost will be shared among hundreds or thousands. It will also fairly easily get rid of "common criminals," since most people have been a victim of crime at some point in their lives and would be willing to pay to prevent this in the future. However, using AP to attack undeserving people will be difficult precisely because it would be rather expensive, since the cost will presumably not be shared. True, it isn't any kind of centralized coercive control, but it is a excellent form of control, somewhat analogous to the "invisible hand" concept of free markets. The problem is, it's difficult for some people to comprehend the kind of distributed-control that free markets represent. > the whole concept of AP does not even support the concept of > "justice is expeditiously served!" it is a resort to the manners > of dogs and monkeys sitting at the same table --a spiteful, > arrogant player can move the betting pools to assassinate anyone. There is a powerful limitation as to how much one individual can manipulate the system, as I've previously described... And besides, the problem you describe already exists: Gang-related murders are an example. AP would eliminate the gangs, at least to the extent that they are a threat to others. > In other words, are we planning to use James Caan as the lead > runner in "Roller Ball" --except this time we're playing with a > "live" society for which we hold in common the utmost contempt? > > are we trying to return to the bread and circus mentality of > Rome on its deathbed and slide to subjecation by Attila the Hun > who was actually stopped from sacking Rome after the Pope so > impressed him with his regal robes.... deciding tribute from an > established dictatorship was more reliable? --and less costly?!? > > has anyone seen a single social moral fiber in Jim's often > passionate arguments for AP, I'm afraid yours is a vastly distorted question. Let's go back to the beginning, shall we? I've claimed that AP will: 1. Eliminate war and militaries. 2. Eliminate government and taxes. 3. Eliminate dictatorships and political tyranny. 4. Drastically reduce crime and the costs of crime. Add all this up, and presume that I think it's a good thing (I do) and how can you claim that this is not "a single social moral fiber"? Sure, you could claim that AP won't do these things, or not all of them, or not very well. I happen to believe it will. Even if you're partly right, at most you have a challenge to my judgment, not my morality or sincerity. > or even in the "results" in a society > which will never breed another leader: religious, secular, or even > political? What, exactly, is wrong with a society without leaders? Do we NEED leaders? I understand that people have probably gotten so used to the concept of having leaders around that its hard to imagine the alternative, but you're going to have to do better than this to support the existence of leaders. > does AP permit anything except slaves and drones which can > just as easily be replaced by robots? maybe noone will miss news > reports (as 'canned' as they are), This may sound odd, but what is there wasn't any news to report? Maybe that's exaggerating things a bit, there will always be weather and the occasional accident and other events. But watch the news for a while, and notice what a large fraction of it is government-related, politics-related, war-related, coercion-related, etc. > or movies which entertain or provoke? It's unclear why you think AP will prevent this? > or ice cream sundaes at the soda fountain? likewise... > ...and the disappearance of grocers, and doctors, and dentists > bringing forth a new age of subsistence farming and hunting for > the lucky few who might live to a readjusted live expectancy point > of 30 yrs, burning books and computer printouts for cooking and > warmth. Is this line of argumentation a throwback to the "we've got to have a dictator! How else will society operate?" > > why have books or knowledge when there is noone willing to > accept the responsibility of educating your children, the instructor > waiting for the parent of Dumb Suzy to avenge her failing grade? If it's a private, non-coerced school, why should this happen? > sacrificing 55,000 men and frying the brains of another > 1.5 million solely to fatten the industrial war machine? using > John Foster Dulles' "domino theory" to justify the carnage... BTW, in an AP society Vietnam couldn't ever happen, for at least a dozen reasons. > to bad I was still of an era which said 'you will serve if called' > and so stupid to take almost six years to get out. Would you > serve a country today which is rotten to the core? No, I won't. But I will be happy to help eliminate that rot. > "Assassination Politics" is nothing more than a childish game > which 'legalizes' killing anyone you wish. are AP's proponents so > naive they believe the bookies will not have any public person > assassinated by rigging the pools for their own profit? remember, > law enforcement ceased with the return of 'law of the jungle' > anarchy. "Laws" will no longer be enforced, it's true. However, legitimate interests will be defended and intiation of force will be punished. Jim Bell jimbell(a)pacifier.com

1 0

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by jim bell 17 Dec '03

17 Dec '03

At 04:28 PM 10/13/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >It is unpublished, but he kindly allowed to me describe it in a paper I >wrote that discussed whether a bank would ever want to take the risk of >allowing bank accounts where it did not know the identity of the customer. Why should that be a problem? It's the customer's money, isn't it? It's not like the bank is making a loan. It's the customer who should be worried...about the bank's identity. Remember "plausible denial." Shouldn't we believe that if a bank cannot know its customer, likewise it isn't responsible for who that customer is? A bank's legitimate interests should not include acting as enforcer for the government, so any system that prevents this from happening is helpful. And I don't think that a bank can ever be embarrassed (assuming bank accounts are anonymous) by it being revealed that some particular bad guy kept his money there, any more than other cash-based (anonymous) businesses are embarrassed if it is revealed that some bad guy used their services. Jim Bell jimbell(a)pacifier.com

4 6

Re: [STEGO] Enigma
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Timmy C[ocksucker] May is a phoney and a fraud.

1 0

Re: -No Subject-
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

Why not just make flute or netscape your shell instead of program manager? (Shell= line in system.ini) Ryan ---------- Previous Message ---------- To: cypherpunks cc: From: kpieckie @ Harding.edu (Compton) @ smtp Date: 10/11/96 11:12:03 PM Subject: -No Subject- Due to the high volume of mail from this list, I rarely get to read every message that comes through here. Thus, I ask a reply be sent to kpieckie(a)harding.edu directly rather than through the list. Please forgive the interruption if this message is slightly off-topic. The library here at Harding University is attempting to set up some internet computers that run Netscape only and do not allow access to anything else on the computers. We use a scripting program called Flute that hides the Program Manager (WFW 3.11) and reloads Netscape when it is nuked with Alt-F4. Another program removes the ability to use any of the netscape pulldown menus less help. The problem is the keyboard. If a user hit's Alt-F4 after Progman has loaded but before the Flute script executes, Flute is terminated and the user has access to the computer. Are there any programs that will disable Alt-F4 and Control-Esc in Windows? Where can they be attained? Freeware is preferable, shareware is fine, trial period is required for commercial products. Thanks. Kevin kpieckie(a)harding.edu

1 0

Re: BAY AREA CYPHERPUNKS SATURDAY 10/12 TRESSIDER HALL STANFORD
by Tom Lojewski 17 Dec '03

17 Dec '03

How do I get off this list? >X-Sender: erchiu(a)diablo.cisco.com >Date: Fri, 11 Oct 1996 11:54:43 -0700 >To: Bill Stewart <stewarts(a)ix.netcom.com> >From: Eric Chiu <erchiu(a)cisco.com> >Subject: Re: BAY AREA CYPHERPUNKS SATURDAY 10/12 TRESSIDER HALL STANFORD >Cc: cypherpunks(a)toad.com >Sender: owner-cypherpunks(a)toad.com > >At 01:06 AM 10/11/96 -0700, you wrote: >>There will be a San Francisco Bay Area Cypherpunks meeting on Saturday 10/12 >>at Stanford University. The meeting location will be the tables outside >>Tressider Hall, where we've met for several previous meetings. >>The canonical time is noon for lunch and milling around, and 1pm >>for organized program. > >Bill - > >What time is the meeting? >Eric Chiu >IS-Finance and Adminstration >Tel: 408-527-1665 >Pager: 415-424-7282 > > > --------------------------------------------------------- Tom Lojewski - ProNet Consulting - lojewski(a)earthlink.net

1 0

Clinternet?
by Tom Lojewski 17 Dec '03

17 Dec '03

How do I get off this list? >X-Sender: rah(a)tiac.net >Date: Fri, 11 Oct 1996 12:02:04 -0400 >To: cypherpunks(a)toad.com >From: Robert Hettinga <rah(a)shipwright.com> >Subject: Clinternet? >Sender: owner-cypherpunks(a)toad.com > >Hoo boy. > >I had the most amazing whiff of paranoia from the morning news. > >Clinton wants to buy the internet back for $500 million so he can watch us >better? > >Nawwww, 'course not... > >Cheers, >Bob Hettinga > >----------------- >Robert Hettinga (rah(a)shipwright.com) >e$, 44 Farquhar Street, Boston, MA 02131 USA >"The cost of anything is the foregone alternative" -- Walter Johnson >The e$ Home Page: http://www.vmeng.com/rah/ > > > > --------------------------------------------------------- Tom Lojewski - ProNet Consulting - lojewski(a)earthlink.net

2 1

Re: COMMUNITY CONNEXION SUED IN FRIVOLOUS LAWSUIT
by nobody＠replay.com 17 Dec '03

17 Dec '03

The SPA allegedly send sameer(a)c2.net a letter, demanding, among other things, that he "agree to implement monitoring procedures to prevent similar acts of copyright infringement and report those procedures to SPA." Under federal law (Electronic Communications Privacy Act) it is illegal to monitor users' actions unless there is a specific contract between the service provider to allow such monitoring, or a court of law has issued a valid search warrant. If the SPA did in fact send such a letter, what they are doing is illegal. They have alleged that a copyright violation has occured. If that were true and they had evidence to support that claim, then under federal law, they could have asked a judge to issue a search warrant to seize the infringing material and stop its distrubution, and/or they could have subpoenaed information about the alleged infringers from C2NET. But, because they did not have any evidence of a copyright violation, they could not get a search warrant. Consequently, they have attempted an illegal search, in violation of the ECPA. They threatened the CEO of C2NET with legal action if he did not assist them with their unlawful scheme. He rightfully refused, and now they are carrying out their threatened harassment against him. The lawsuit filed by SPA mentions no specific cases of copyright infringement, because, in all likelihood, there never were any. The SPA is merely going on a fishing expedition. The SPA should not be suing Sameer - Sameer and his users should be suing the SPA.

1 0

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by Hal Finney 17 Dec '03

17 Dec '03

The "blinded identities" problem is one of the oldest that we have discussed here (although not much recently, of course!). It is basically similar to what cryptographers call "blinded credentials" and is closely related to electronic cash, as Michael Froomkin's example from Stefan Brands points out. I posted an idea a few years ago for how to use the technique to solve the related problem of remailer abuse. A simple way to approximate what you want is to use a standard blinded signature exactly as is done with David Chaum's DigiCash. The customer comes to you and presents some proof of identity. This may be in person via standard paper documents, or on-line via some cryptographic credential as you suggested. You make a list of all of your customers, and make sure that this customer is new, someone you haven't seen before. Now you simply give him a blinded cryptographic signature, of exactly the same form as the blinded coins given out by DigiCash. He unblinds it, and he is left with a signed credential from you, but one which is unlinkable to his identity. When he interacts with you, he displays this credential as proof that he is a customer in good standing. If he violates the terms of your contract, you disable the credential (add it to a list of bad credentials). He can't use this one any more, and he can't get a new one because he is on the list of people who already got their credential. This simple solution suffers from several problems, some of which are endemic to this class of solutions and others which can be addressed with fancier crypto. Among the fundamental problems we have first that verifying identity reliably is difficult to impossible. If people are motivated badly enough, they can forge whatever documents they need. Then they keep signing up with new identities like the kids who use AOL throwaway accounts. Second, if the customer ever loses his credential, he is screwed. He comes to you with some sob story about how his disk crashed and his dog ate his backups, but you have no way of knowing if he actually lost his credential, or if he is an abuser who got his credential cancelled. Another problem is that groups of users can share credentials, so that some hacker club can get a bunch, one for each of them, and then they can all abuse your ISP, getting credentials cancelled, but able to keep going as long as one is left. Problems which can be fixed include that credentials could be stolen, like phone card numbers, so an innocent person gets his credential cancelled and then we are back to the second problem above. You can mostly solve this by having him create a key when he first registers with his credential and require all his interactions to be protected by this key. There are also more elaborate solutions where he wouldn't actually send his credential over, but use zero knowledge techniques to prove that he had one. Unfortunately David Chaum has a pretty good set of patents covering blind signatures, so for a commercial venture you'd probably have to look into the legal situation. I can send you a list of Chaum's patents in the area if you want it. (I had it on my web page but my ISP quit so I need to get a new page going.) Some of the other practical issues are also mentioned in Michael Froomkin's article, like waiting a while after you get your credential before you use it. Hal

3 2

RE: RE: Binding cryptography - a fraud-detectible alternative to
by James A. Donald 17 Dec '03

17 Dec '03

At 11:48 AM 10/13/96 +0000, everheul(a)mail.rijnhaave.nl wrote: >To explain the backround of "binding cryptography" once more; with >respect to (interoperable, worldwide) security in the information >society socities/governments have to achieve two tasks: 1. >stimulating the establishment of a security structure that protects >their citizens, but which does not aid criminals. 2. Coping with the >use of encryption by criminals outside of this framework. Clearly curtains aid criminals. One way of allowing private citizens to have privacy from their neighbors while still enabling legitimate government supervision of citizen units would be to have microphones and observation cameras in every home and shop that can be activated by the government without the citizen units knowledge, thus allowing citizens full curtain enabled privacy without interfering with legitmate government security interests. This will also help the government protect the citizen unit from exposure to dangerous and harmful thoughts and ideas. Present efforts to inclulcate children with a correct outlook on life are often frustrated by subversive, racist, or anti social teachings at home. This measure could help citizen units to ensure that their speech is sensitive to the concerns of minorities and oppressed groups and to current government views. Since many shopkeepers already have such devices in their shop, there is ample precedent for this system. A good start on such a system would be have the existing shop devices run to the police instead of the shopkeeper. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by Bill Stewart 17 Dec '03

17 Dec '03

>> >Steve Shear <azur(a)netcom.com> writes: >> I've been charged with developing an Internet service which needs to assure >> its clients of anonymity. However, we fear some clients may abuse the >> service and we wish to prevent the abusers from re-enrollment if >> terminated for misbehavior. At 04:28 PM 10/13/96 -0400, "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> wrote: >Stefan Brands has a protocol that probably does what you want. .... >http://www.law.miami.edu/~froomkin/articles/oceanno.htm#ENDNOTE286 Looks like a really nice paper on anonymity issues; at 485K, it'll take a little while to read :-) The fundamental difficulty in this problem is that you need some demonstrable proof of uniqueness for human users; if you don't have that, you can't transform it into a unique-but-anonymous identity.* The issues are similar to privacy-protecting voter registration problems. Brands's protocol starts with the user going to the bank with proof of ID, and getting a numerical ID which can be blinded and signed. It's a nice approach; you can do cruder approaches by hashing your universal-citizen-unit-ID-number or whatever, but that can be dictionary-searched by feeding all the possible ID numbers through the hash. For some applications, mapping back to a unique human isn't necessary; if you do something like map back to a bank account which has a high minimum balance for setup, this discourages the type of users who don't want to spend $100 just to send spam. Blinding a Verisign signature isn't enough, though - they support personna certificates without proof of identity. Froomkin also points out a class of attacks that can allow abusers to get around Brands's protocol - a group of users get together and abuse one ID till it gets busted, then abuse the next, etc., until they're all burned. Or you hire a bum off the street to get an account for you. Or whatever. [ * There are non-universal-identifier methods for preventing double-use. Voter registration in many places just depends on identification and affidavit, and is often abused (e.g. Chicago graveyard voters and Nevada absentee ballots), but usually not massively abused. Some third-world countries don't even require registration or literacy - they dip your thumb in ink after you vote, using a kind of ink that won't come off for a couple of days. Attacks against this protocol include better solvents :-) ] # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0