December 2003 - cypherpunks-legacy

Re: Hardening lists against spam attacks
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 2:32 PM 12/31/1996, Timothy C. May wrote: >At 1:04 PM -0800 12/31/96, Peter Hendrickson wrote: >>At 11:47 AM 12/31/1996, Lucky Green wrote: >>>At 10:25 AM 12/31/96 -0800, Peter Hendrickson wrote: >>>> The easiest and fastest solution is to set up toad.com to charge a >>>> dollar per message. (Proceeds to be spent by John Gilmore as he >>>> sees fit.) >>>> We can then leverage off the existing e-cash infrastructure which >>>> already provides blinding software for free on all major platforms. >>> I am not sure that this proposal would work. Some of the spammers on this >>> list are rather dedicated. They might gladly pay a dollar per message. >> Let's try it and see how it goes. If it doesn't work, we can try >> a more complicated scheme. (I volunteer to modify Majordomo to >> make this happen. We could have this feature in the near future.) > "Let's try it and see how it goes" is often a dangerous step. It could kill > the list as we know it; exactly what fraction of current subscribers do you > think will arrange for digital cash accounts, will arrange their mailing > software to use this, will bother with PGP, etc.? It's not always bad to take a few chances. I've noticed that there is a lot of negativity in the cypherpunks scene. (I am not without sin in this department. ;-) It would be more exciting to try out a few ideas. I would much rather be trying lots of things and throwing out the bad ones. This should lead to better technology. This not only benefits the cypherpunks list, it benefits everybody using the Net, which is (I think) one of our goals. It short circuits poorly intentioned authoritarian schemes to dictate what may or may not be sent to a mailing list. (For example, people often propose to make spam illegal. Most readers of this list will recognize the camel's nose.) > Now maybe this is a Good Thing, to drive out the slackers and those without > good tools integrating PGP into their mailers, etc., but maybe it is not a > Good Thing. It could be a mistake, but I think the only way we will find out is to try it. Unlike the interesting token scheme, this is easy to deploy and it doesn't provide an insurmountable barrier to dissent. You can still put up a dollar to say "This is a drag! Let's get rid of it!" But if your token gets pulled by an abusive token administrator, it's harder to get the word out. (Not impossible, though.) Keep in mind that the worst case is that people will have to ask their e-cash endowed friends for a few ASCII tokens to prepend to their posts to the list. That is not very tough to arrange. >> I have seen a lot of complaints about "too much noise". That is >> not a problem. The problem is too little signal. I can extract >> the signal - unless it isn't there. > My sentiments exactly. But I fail to see how collecting a dollar per post, > or whatever the fee is ultimately set at, increases the number of good > posts (not the percentage, the S/N, the _number_, which is what we both > agree is the important thing). > Explanation? One thing it does for sure is to eliminate attacks where somebody sends thousands of messages to toad.com and overloads its capacity to forward them. It also means that bigger faster hardware can be purchased if the load gets too high, or to compensate somebody to wrangle majordomo. I suspect it will also promote high quality posting. Certainly, "me too" posts and "unsubscrive" posts will be greatly attenuated. And, people who post reams of drivel and invective can only do so at the expense of financing the monthly cypherpunks food bash. This doesn't mean they will stop, but it does mean that we can chown down on hundreds of pounds of guacamole at their expense. As for other people, I think if it isn't worth a dollar to you to post a message, it probably isn't worth it for the rest of us to read it. Without any real evidence, my feeling is that if somebody has to pay a dollar to post a message, they will give it more thought and write it more carefully. This is sort of like expecting children to use proper grammar, forms, and excellent handwriting in preparing a report. The result is that greater care and thought is devoted to the ideas in the report itself. I don't believe that people making valuable contributions have any trouble at all coughing up a dollar to do so. Very few people post more than 10 messages a month. $10/month isn't much of a burden. If this does turn out to be a problem, when readers see a post they like they should send the person a buck to encourage more good work. This is a very effective way of saying "I really enjoyed what you had to say." And, nothing stops frequent posters from asking for money on the list to continue their fine work. In a sense, this is a fully abstracted version of the token scheme. Peter Hendrickson ph(a)netcom.com

3 2

Would you be interested in this?
by JohnnyDaven＠aol.com 17 Dec '03

17 Dec '03

Our mutual friend, JamesB(a)aol.com said this might be something you would be interested in. You can save a substantial amount of money on your next Florida Vacation and receive an adult pass to Universal Studios. If you are interested please visit the web page at: http://www.o-c-s.com/getaway Or for more information via Auto Responder, send an E-Mail message to: getaway(a)o-c-s.com Best wishes, John

1 0

constitutionlity of mandatory GAK
by Hal Abelson 17 Dec '03

17 Dec '03

Given the current discussion of possibile GAK legislation, you may want to check out the session from last March's Computers, Freedom, and Privacy Conference on outlawing non-escrowed encryption. We invented a manadatory GAK law "Cryptography Control Act of 1995" and debated its constitutionality in a mock "Supreme Court" hearing before a panel of real fedreral judges. The briefs and the oral arguments (available on the Web in RealAudio format) are an excellent source on questions of whether mandatory GAK would be constitutional. The text of the web page is attached below. The actual page has links an extensive set of documents. By the way, watch for the announcement for CFP97, which will be held March 11-14 in Burlingame, CA. -- Hal Abelson ****************************** Text from the Web page: http://swissnet.ai.mit.edu/~switz/cfp96/plenary-court.html CFP96 Plenary Session Before the Court: Can the US Government Criminalize Unauthorized Encryption? Presented on Thursday, March 28, 1:30-3:30 PM * Report on the session from the CFP96 Newsletter * Recording of the oral arguments (in RealAudio format) Advocates for the Government: Mark Rasch Mark Jackowski Advocates for the Defense: Andrew Good Phil Dubois Federal Judges: Hon. Sandra Lynch Hon. Susan Bucklew Hon. William Castagna Hon. Nancy Gertner Hon. William C. Young Shadow Panel: Judith McMorrow Charles Nesson Maureen O'Rourke Majority Opinion: Michael Froomkin Dissenting Opinion: Christine Axsmith Bench memo: Alyssa Harvey Brief writers (appellant): Jeffrey Hermes Chris Kelly Brief writers (respondent): Bob Kluge Dan Zelenko Scott Faga Organizer: Andrew Grosso Looming over the controversies surrounding the Digital Telephony Legislation, the Clipper Chip proposal, and the criminal investigation of PGP, is the shadow of perhaps the most critical issue of them all: Will Americans be prohibited from ensuring the privacy of their communications, including preserving those communications against government intrusion? Will strong, non-escrowed encryption be outlawed, and those who use it subjected to criminal prosecution? CFP96, in co-sponsorship with the American Bar Association, Criminal Justice Section, presented a moot Court highlighting this question. The format was that of a Supreme Court argument, where former federal prosecutors argued against noted civil liberties lawyers before a panel of five federal judges. A second panel, comprised of regional law school professors, served as a shadow court and rendered a written judgment on the case. The issue being tested was whether an individual, who has successfully used outlawed encryption to hide his conversations while the target of a criminal investigation, can be prosecuted and convicted for use of unauthorized encryption under the (fictional) "Cryptography Control Act of 1995". The background for this session assumed that the defendant's conviction was upheld 2-1 in an appeals court decision, whose majority opinion and dissenting opinion set forth the central Constitutonal arguments for upholding, or overturning, the prohibition of unauthorized encryption. At the CFP session, the Court reviewed the decision and the shadow court overturned it, rendering a majority opinion and a concurring opinion. Documents available The appeals decision * Overview * Opinion for the Court filed by Circuit Judge Mitchell. * Concurring statement filed by Circuit Judge Froomkin. * Dissent filed by Circuit Judge Axsmith. The review before the Court * Brief for the Appellant * Brief for the Respondent * Bench memo * Recording of the oral arguments (in RealAudio format) * Majority Opinion by Justices McMorrow and O'Rourke * Concurring Opinion by Justice Nesson Session participants Arguing on behalf of the government were former federal prosecutor Mark Rasch, and Mark Jackowski, Assistant US Attorney from Tampa, Florida. Mr. Rasch is a former Trial Attorney with the Department of Justice Fraud Section, in Washington, D.C, where he prosecuted the Robert T. Morris case. Mr. Rasch (Mark_Rasch(a)cpqm.saic.com) is currently Legal Counsel for the S.A.I.C. Corporation, headquartered in Reston, Virginia, specializing in computer security matters. Mr. Jackowski became an AUSA in 1984, and concentrated in prosecuting very complex narcotic importation organizations. He tried the BCCI case, a six month trial which took place in Tampa in 1990. He also indicted Panama's General Noriega. He is currently with the Independent Counsel's Office investigating HUD Secretary Henry Cisneros. Representing the defendant were two prominent attorneys in the area of cyber liberties, Andrew Good (agood(a)world.std.com / (617) 523-5933) and Phil Dubois (dubois(a)dubois.com / (303) 444-3885). Andrew Good of Silverglate & Good specializes in criminal defense and civil liberties law. He is currently a member of the ABA Task Force on Technology and Law Enforcement, and was co-counsel for David LaMacchia and for Steve Jackson Games, Inc. Mr. Dubois is a solo practitioner in Denver Colorado; among his clients is Phil Zimmermann, author of PGP. The panel judging the arguments was comprised of federal appellate and district court judges: * The Honorable Sandra Lynch serves on the United States Court of Appeals for the First Circuit, and sits in Boston, Massachusetts. She was appointed to the bench by President Clinton. * The Honorable Susan Bucklew is a United States District Court Judge for the Middle District of Florida, sitting in Tampa. She was appointed to the bench in 1994 after having served a Circuit Court Judge for the State of Florida. * The Honorable William J. Castagna is a Senior District Court Judge U.S. District Court Judge for the Middle District of Florida, sitting in Tampa. He was appointed ot the bench in 1979. * The Honorable Nancy Gertner is a United States District Judge for the District of Massachusetts, in Boston, Massachusetts. She was appointed by President Clinton. * The Honorable William C. Younga is United States District Judge for the District of Massachusetts, in Boston, Massachusetts. He also serves as an adjunct professor at Harvard Law School. A second panel, made up of regional law school professors, served as a shadow court and rendered a judgment on the case. * Judith McMorrow (McMorrow(a)hermes.bc.edu) is Associate Professor of Law at Boston College. She has served as a law clerk for the former Chief Judge of the United States Supreme Court, Warren Burger. She earned her J.D. from the University of Notre Dame Law School, and has a B.A. from Kalamazoo University. * Maureen O'Rourke (MO1(a)acs.bu.edu) is Associate Professor of Law at Boston University. She holds Bachelors' degree in accounting and computer science from Marist College, and a J.D. from Yale Law School. * Charles Nesson is Professor of Law at Harvard Law School. Contact: nesson(a)hulaw1.harvard.edu / 617 495-4609 * The shadow court rendered a Majority Opinion and a Concurring Opinion. Michael Froomkin (Appeals Court Majority Opinion) is an Associate Professor of Law at the University of Miami, in Florida, a position he has held since 1992. He has served as a law clerk for both the Hon. Steven F. Williams of the U.S. Court of Appeals for the D.C. Circuit, and Chief Judge John F. Grady, of the U.S. District Court for the Northern District of Illinois. He earned his law degree from Yale University, holds a M.Phil. degree from Cambridge University, and earned a B.A. from Yale with a double major of economics and history. Among his recent writings is, "The Metaphor is the Key: Cryptography, the Clipper Chip and the Constitution", which was published in 1995 in the University of Pennsylvania Law Review. Contact: Froomkin(a)law.miami.edu / (305) 284-4285 Christine Axsmith (Appeals Court Dissenting Opinion) is a Computer Security Consultant with the Orkand Corporation, in Washington, D.C., and is currently assigned to the Office of Consular Affairs of the United States State Department. She received her J.D. from Catholic University, and holds a B.S. Degree in Computer Science from Drexel University. Contact: axsmith(a)dockmaster.ncsc.mil Alysssa Harvey (Bench memo) is a student at Georgetown University Law School. Jeffrey Hermes and Chris Kelly (Brief for the Appellant) are students at Harvard Law School. The brief for the Government was prepared by Bob Kluge and Dan Zelenko (American Univeristy School of Law) and Scott Faga (George Mason University School of Law). Andrew Grosso (Organizer) is currently in private practice in Washington, D.C. From 1983 to 1994, he served as an Assistant U.S. Attorney in Tampa, Florida, and Boston, Massachusetts. He earned his J.D. from the University of Notre Dame Law School, and holds M.S. degrees from Rensselaer Polytechnic Institute in both physics and computer science. Contact: agrosso(a)acm.org / (202) 663-9041

1 0

Re: Hardening lists against spam attacks
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 10:58 PM 12/30/1996, Bill Frantz wrote: > The Christmas attack against this list shows the need to develop lists > which are resistant to attacks. If cyberspace is to become the town square > of the next century, we need to be able to discourage brown shirts attacks > on political gatherings. If lists are to be a major part of the political > life of the community, then they must be resistant to attacks from > knowledgeable, well financed attackers, not just the shits who were the > most recent perps. > [Fine posting token proposal deleted.] The easiest and fastest solution is to set up toad.com to charge a dollar per message. (Proceeds to be spent by John Gilmore as he sees fit.) We can then leverage off the existing e-cash infrastructure which already provides blinding software for free on all major platforms. What I like about this scheme is that well-financed attackers will be welcomed. A spam attack just means that John can buy more sushi! (I volunteer to modify majordomo to accept e-cash if there is enough interest in this proposal.) Peter Hendrickson ph(a)netcom.com

1 0

Re: Hardening lists against spam attacks
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 7:04 AM 12/31/1996, Sandy Sandfort wrote: > There is a simple solution to keeping anonymous posters anonymous > under this or any similar scheme. Volunteers could act as > "gateways" for anonymous posts. Self-selected list members could > announce that they would forward anonymous posts using one of > their own tokens for the purpose. (In the alternative, the > gateway volunteers could be given extra tokens solely for that > purpose.) Would this expose the posters to liability? Unlike an anonymous remailer, they are deciding what to post. In the case of software, criminal liability result. Peter Hendrickson ph(a)netcom.com

2 1

Booms, busts and cranks
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

by Terence Corcoran "ONCE again the holidays and other sources of good cheer, including a growing economy and rising stock markets, have been wrecked by the annual Maclean's/CBC News poll. In this annual national survey, the majority of Canadians express generally sensible views on most issues--less government isn't so bad, a bigger role for the private sector is good, debt reduction hasn't gone far enough, private health care is acceptable, as are multiracial immigration ... ... "An accompanying Maclean's story on the looming expansion of the private sector is mostly an anti-business report that chastises companies for layoffs and mean-spirited bottom-line thinking. The problem, it claims, is the failure to hold companies responsible for anything other than maximizing shareholder value, a popular theme among statists who have run out of state. http://web.theglobeandmail.com/web/cgi-bin/ DisplayPage?SITE=web&KEY=961231.ROBColumn.RCORC

1 0

Re: Hardening lists against spam attacks
by Secret Squirrel 17 Dec '03

17 Dec '03

On Tue, 31 Dec 1996, Hal Finney wrote: > An alternative is to give each subscriber only a small, fixed number of > blinded tokens which he will use for the lifetime of his subscription > to the list. When someone posts anonymously, they use up one of their > tokens. Then, if the message was not abusive, a new blinded token is > created, encrypted with the public key of the good-guy anonymous poster, > and broadcast to subscribers. This way good anonymous posters will get > to keep posting, while abusive ones will shortly run out of anonymous > posting tokens. Oops, ran out of tokens.... UNSUBSCRIBE cypherpunks SUBSCRIBE cypherpunks Lance OK now I'm ready to post more crap!

1 0

Re: Hardening lists against spam attacks
by Lucky Green 17 Dec '03

17 Dec '03

At 10:25 AM 12/31/96 -0800, Peter Hendrickson wrote: >The easiest and fastest solution is to set up toad.com to charge a >dollar per message. (Proceeds to be spent by John Gilmore as he >sees fit.) > >We can then leverage off the existing e-cash infrastructure which >already provides blinding software for free on all major platforms. I am not sure that this proposal would work. Some of the spammers on this list are rather dedicated. They might gladly pay a dollar per message. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

3 2

[IMPORTANT] ElGamal
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Tim Mayonnaise's abysmal grammar, atrocious spelling and feeble responses clearly identify him as a product of the American education system. \0/ \0/\ \ / / \0/ \0/ \0/\ \ / /\0/ \0/ Tim Mayonnaise | / /) | (\ | | / /) | (\ \ | / \__/\__/0\__/0\__/0\__/ \__/ \__/\__/0\__/0\__/0\__/\__/ \

1 0

Re: Hardening lists against spam attacks
by Hal Finney 17 Dec '03

17 Dec '03

From: "Mark M." <markm(a)voicenet.com> > On Tue, 31 Dec 1996, Igor Chudov @ home wrote: > > > Send a number of unique tokens to each subscriber each day. > [...] > > If tokens are used improperly (to post off-topic materials) the > > offending subscriber is denied any further tokens. > > > > The problem of this scheme is (besides its cost) that anonymous users > > will not be truly anonymous. > > I think this problem can be solved by blind signing the tokens. A user > generates a random number, multiplies it by the blinding factor, then sending > it to a token server which would append a timestamp and sign the blinded > token. All signature requests should be signed with a PGP key. The server > response would be encrypted with the user's public key. A person's PGP key > would be sent along with the subscription request and then saved by the list > software. This is an interesting idea, however it will be possible for someone with a respectable public persona to continue getting tokens indefinately for posting abusive anonymous messages. There is no way to link the anonymous tokens with the ones which were issued to good subscribers. An alternative is to give each subscriber only a small, fixed number of blinded tokens which he will use for the lifetime of his subscription to the list. When someone posts anonymously, they use up one of their tokens. Then, if the message was not abusive, a new blinded token is created, encrypted with the public key of the good-guy anonymous poster, and broadcast to subscribers. This way good anonymous posters will get to keep posting, while abusive ones will shortly run out of anonymous posting tokens. The big problem with schemes like this is the difficulty of defining "good" posts in an acceptable way. Some list members are hard-line freedom-of-speechers and don't want to see any limitations on list postings. Others would probably classify 80% of the messages on the list at times as grounds for termination of posting privileges. Everyone will have their own thresholds. There is also the administrative problem of who will judge the posts. This could take a large commitment of time. I'm sure many of us have gotten behind in our list reading from time to time and it can be intimidating to return from a trip to find hundreds of messages waiting. Imagine how it would be if you were supposed to be reading them and looking for bad messages. We might also want to consider the paradoxical possibility that if we remove the junk, the list will die! At least now we are constantly reminded that the cypherpunks list exists. Other lists like the cryptography and coderpunks can sometimes go for quite a while without any posts at all. On CP you have the sense of a dynamic community where you can hope for a response to your posts, more so than on a list which is silent for days at a time. Hal

5 4