December 2003 - cypherpunks-legacy

Re: subscribe
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Sean Roach wrote: > ... > Something to consider. If anyone of the distributed remailers is removed > from a ring, the messages that need to travel across that ring can no longer > do that. This makes the loop only as strong as its most at risk remailer. > The star approach has already been seen in action, the trouble here is a > single choke point. > Full interconnectability is only feasible in a small net, but I would advise > this at first. Check for the x-loop to see if another one got it first. If > none, add one and send it on down the line. > A disjointed mess, if the remailers are given first access to the list, > could work quite well as long as that x-loop remained to point to who sent > the message, and the x-loop contained an unalterable message number, and the > remailers could eliminate duplications, probably based on message number. > This should work as the net grows and would only be as weak as the strongest > two connected remailers. > Sounds like the internet. > I'd suggest a simplier solution: to connect each server with a couple, or maybe three, other servers. This scheme is rather robust, does not consume too much CPU time and bandwidth, and is easy to implement. - Igor.

1 0

Re: Private property rights on cypherpunks (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

While I'm not entirely unsympathetic with the notion that "information should be free," your statements below are rather incoherent. For purposes of analysis, let's talk about a story I report and write myself. Depending on the article and travel involved, I may have spent hundreds of dollars working on it. I am unwilling to donate those efforts to the "public domain" every time; I may later want to sell the article to recoup my costs. Think property rights. (Of course, I admit the need for broad fair use rights as well.) "De facto public domain" is an idea that deserves to die. Now. -Declan On Wed, 12 Feb 1997, Jim Choate wrote: > > Forwarded message: > > > Date: Wed, 12 Feb 1997 22:58:42 -0500 (EST) > > From: Declan McCullagh <declan(a)pathfinder.com> > > Subject: Private property rights on cypherpunks > > > I forward articles to cypherpunks that are copyrighted by my employers, or > > magazines like Playboy and Wired for which I write freelance pieces. > > > > I like to think these articles have some value. I will not forward any of > > them, nor would I be able to, if they magically became "public domain." > > > > "De facto public domain" is an idea that deserves to die. Now. > > Really? Do you have a priori permission from your publisher, who owns those > stories, to distribute them elsewhere? > > If not please explain why I or any other person should be a willing > acomplice? You could also still post them anonymously. You could also > simply include a 'fair use' proviso somewhere. > > In such a case it would be in your publishers best interest to require a > copyright notice. In that case there is no confusion about who owns those > rights. Especialy when you consider the traffic is global which means your > 'implied copyright' here don't mean squat there. I suspect just about > every place that recognizes a copyright recognizes an explicit one. > > Instead of "De facto public domain should die" how about, > > "Implied a priori contracts should die now" > > Lord a mighty, haven't you heard? Information wants to be free. Let the > thing go. If you really think your words are something that will someday win > a Nobel or make Mr. Bill look like a pauper note it explicitly. However, > it would seem to me that implicit copyright works against the axiomatic > crypto-icon. > > > Jim Choate > CyberTects > ravage(a)ssz.com > >

1 0

Re: anonymity and e-cash
by Sean Roach 17 Dec '03

17 Dec '03

At 04:59 PM 2/12/97 -0800, Hal Finney wrote: >From: tcmay(a)got.net (Tim May) >> You missed a very good talk by Ian Goldberg of UC Berkeley at the Saturday >> Cypherpunks meeting at Stanford, where Ian talked for more than an hour on >> just this issue. (He also talked for an hour on his crack of the RSA >> challenge using 250 workstations...this was also a good talk.) > >I wish I could have heard that, it sounds good... > >A simple idea we have discussed for full anonymity uses the idea of >exchanging coins at the bank. You make an anonymous connection to >the bank, supply some ecash you have received along with some blinded >new ecash. The bank verifies that the ecash is good and signs your >blinded ecash, sending it back to you. You unblind it and have good, >fresh smelling ecash which you can keep, spend, or later deposit in >your account. > >If the merchant performs this exchange operation on-line as soon as >he receives ecash, then his anonynmity is protected. The customer is >protected too, by the blinding he used when he withdrew the ecash earlier. >So both sides remain anonymous. > >It sounds like Ian may have worked out details of a system where third >parties do these exchanges. Banks may be reluctant to allow them for >liability reasons, and the market, abhoring the vacuum, will supply >intermediaries who perform exchanges for a fee. > >Resolving the various forms of cheating is the hard part. When Lee asks >about a signed receipt, it is hard to understand what is the point if the >seller is fully anonymous! A signed receipt from a freshly-minted key >is not of much use to anyone. > >If the participants are using persistant pseudonyms then whatever >reputation capital they have can be put on the line when cheating happens, >although it still may be hard to tell who cheated whom. Did the customer >pass bad cash and claim it was good, or did the merchant deposit good >cash and claim it was bad? > >The same thing could happen every day at the supermarket, of course. >A customer insists they paid $20 but got change for a $10. If dozens of >customers say the same thing has happened to them, we start to mistrust >the market, while if several businesses say this particular customer >has made the same claim to them, we blame the customer. Here is another idea. The merchant and customer agree on a price, with the merchant knowing that the "bank" will take a cut for their services. The merchant and customer both LOG IN to the bank seperately, each type in their agreed upon price and cut & paste in the services rendered information. If they match, the bank makes the necessary transaction between the accounts, e-cash stash, etc. The bank also supplies both parties with a clear signed receipt. The bank can now no longer alter the receipt, as the merchant and customer both have a copy. And the customer and merchant can not alter the receipt, because then it would fail the test on the signature. If a receipt for a transaction number were used, then the only threat would be the same one that exists for remailer operators. This could be negated by daisy-chaining banks in a similair manner. If each bank took a cut of non-customers of $.0002 or .02% of the transaction, whichever was greater, then a suitable system could be set up. Another idea that has been festering. If we could get a CPA involved in this forum, I would be willing to have h[im/er] sign my key, (which is seldom used, mostly because this is the only place I use e-mail), for that reasonable fee that CPA's can charge. I know that it is not a standard, or even legally recognized, post for CPA's, but I think that enough people would trust them. This would take care of some of the "newly minted" key problems. Since getting someone who is trusted to sign your key is a recognized method of getting people to believe you are who you say you are. Just an idea. Actually two, one half thought out, one that has been bugging me.

1 0

Procmail during the transition, anyone?
by Michael Froomkin - U.Miami School of Law 17 Dec '03

17 Dec '03

At various stages in the transition, we will be getting multiple copies of the same messages as the are re- cross- whatever-posted to lists, newsgroups and anything else handy. Anyone have a procmail script that will show me just ONE copy of messages, even if the headers are not identical (e.g. one looped, another was forwarded, etc.)? I have yet to find a good guide to procmail coding. My file is long, and inefficient, and a pain to maintain...and I'm too busy to learn it right. == The above may have been dictated via Dragon Dictate 2.52 voice recognition. Please be alert for unintentional word substitutions. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: Transmission of Crypto material and ITAR
by Rick Hornbeck 17 Dec '03

17 Dec '03

Unless someone in the U.S. is willing to go to the effort of capturing all of the packets that comprise the crypto software package as they pass through various MCI, Sprint, etc. networks (which is probably illegal in itself, in most cases), on their way from the UK to your site in Australia and then reassembling them in the U.S. into something that is in violation of the export regulations, what difference does the path of the individual packets make? At 01:15 PM 2/13/97 -0800, you wrote: >Dear All, > >I have a question regarding the impossible enforcement of ITAR/EAR: >Naturally I cannot download crypto software from the US, but most of these >sites have mirrors in other countries, such as the UK for PGP, and sweden >and finland for lots of things. > >However, with the way that information is routed throughout the internet >from these sites, whenever I, in Australia, request packets containing this >data from the UK etc, it invariably passes through the US from coast to >coast! Therefore, if ITAR/EAR tries to govern that, aren't they really >trying to enforce something totally unenforcable? Surely they cannot expect >all gateways operated by, say, Sprint and MCI to packet sniff 'n' search? > >Can anyone tell me what the ruling is with regards to this? > >Yours Sincerely, > >Benjamin Grosman > >---------------------------------------------------------------- > Benjamin Grosman - Programmer, Magna Data Internet Solutions > Quidquid latine dictum sit, altum viditur. > [Whatever is said in Latin sounds profound.] >---------------------------------------------------------------- > > > >

1 0

Re: subscribe
by Sean Roach 17 Dec '03

17 Dec '03

At 08:48 PM 2/12/97 -0600, Igor Chudov wrote: >Jim Choate wrote: >> >> >> Hi Igor, >> >> > I will not impact me negatively. I do, however, suggest very strongly >> > that hosts should be subscribed to each other thgrough another mechanism >> > and not majordomo, in order to prevent mail loops, header rewriting and such. >> >> Suggestions? What I had in mind was that any messages that get sent on >> cpunks(a)ssz.com get sent over to algebra. One mechanism I would like to play >> with is a 'linked list' of remailers. Remailer A sends only to B and >> receives only from C... >> >> >> A >> ^ v >> C < B > >> Then to stop loops B deletes all outgoing mail from B. Since email can be >> forwarded from many sites the search must traverse the entire forward chain >> killing the message if B appears as a source. I suspect a simple procmail sort >> can accomplish this. My next step is to brush up on my procmail. I hope to >> have something in a couple of days that will allow you to subscribe >> cpunks@algebra to cpunks@ssz and both ends will be filtering. > >Here's how I do it (it is pretty close to your proposal): > >1) I delete duplicate messages (by looking up the database of >message-IDs) right away >2) I bounce all incoming messages to several other list servers >3) I pipe the article to majordomo for distribution. > >Note that majordomo changes headers and I wuold like to feed >other servers with UNCHANGED articles. ... >> Another nice advantage of this architecture is that 'rings' of remailers can >> be interconnected by simply sending output to more than one site. Might even >> be a good stability rule, "Never have a remailer send to more than 1 machine >> in its 'own' ring". I see no limit other than resources that would limit the >> number of rings an individual remailer might be in. > >A very good point. > ... Something to consider. If anyone of the distributed remailers is removed from a ring, the messages that need to travel across that ring can no longer do that. This makes the loop only as strong as its most at risk remailer. The star approach has already been seen in action, the trouble here is a single choke point. Full interconnectability is only feasible in a small net, but I would advise this at first. Check for the x-loop to see if another one got it first. If none, add one and send it on down the line. A disjointed mess, if the remailers are given first access to the list, could work quite well as long as that x-loop remained to point to who sent the message, and the x-loop contained an unalterable message number, and the remailers could eliminate duplications, probably based on message number. This should work as the net grows and would only be as weak as the strongest two connected remailers. Sounds like the internet.

1 0

Re: Excerpt on SPAM from Edupage, 11 February 1997
by jim bell 17 Dec '03

17 Dec '03

At 03:25 PM 2/12/97 -0800, Timothy C. May wrote: >Having said this, the flaw remains that "junk mail" is "free" to the >sender. This is a flaw in the ontology of e-mail, and needs to be fixed. >Digital postage is one approach. I decided long ago (okay, well, many months ago) that the "solution" is to invent a mechanism to allow spammers/advertisers to include a small amount of ecash as a gift with every spam. I figure that if USnail junk-mailers are willing to pay $0.32 for postage and probably $0.50 for production, printing, and labelling costs, all for no guarantees of results, they should even more happy to pay, say, 10 cents to each recipient. At that rate, an average person would probably receive enough "spam" to pay for his Internet account, quite analogous to the way advertiser-supported TV is presented to the public for no explicit charge. Jim Bell jimbell(a)pacifier.com

2 1

[STATS] Cypherpunks-unedited subscriptions
by Dale Thorn 17 Dec '03

17 Dec '03

Total subscribers for cypherpunks-unedited: ------------------------------------------- Tue 14 Jan: 13 Wed 15 Jan: 15 Thu 16 Jan: 13 Fri 17 Jan: 15 Tue 21 Jan: 28 Fri 24 Jan: 30 Mon 27 Jan: 34 Tue 04 Feb: 43 Tue 11 Feb: 62 When Gilmore made his pronouncement that "the subscribers have spoken", only a minority of the "real" subscribers were on the -unedited list. Since the above figures don't include Sandfort's entry, the jump to 62 as of yesterday (despite the discontinuance) easily represents the majority of the active (real) subscribers. Another blood stain on Gilmore's shroud, as it were.

1 0

Re: Recommendation: Creation of "alt.cypherpunks"
by Dale Thorn 17 Dec '03

17 Dec '03

Igor Chudov @ home wrote: > Dr.Dimitri Vulis KOTM wrote: > > "Timothy C. May" <tcmay(a)got.net> writes: > > > At 1:20 PM -0600 2/11/97, Igor Chudov @ home wrote: > > > >If the people decide for creation of a new USENET newsgroup, > > > >we need to think very hard about actually moving it to a different > > > >hierarchy from alt.*. I would propose comp.org.cypherpunks, > > > >comp.cypherpunks, sci.crypt.cypherpunks or something like that. > It is too late to stop alt.cypherpunks, but if I had to make a > prediction again, I would predict that soon posters will BEG to help > them create comp.*.cypherpunks, because of spam and alt.flamage. I would lean toward sci.crypt.cypherpunks myself. Are there any implications in the use of that name as to restrictions, etc.?

1 0

Re: anonymity and e-cash
by Hal Finney 17 Dec '03

17 Dec '03

From: Sean Roach <roach_s(a)alph.swosu.edu> > Here is another idea. > The merchant and customer agree on a price, with the merchant knowing that > the "bank" will take a cut for their services. > The merchant and customer both LOG IN to the bank seperately, each type in > their agreed upon price and cut & paste in the services rendered > information. If they match, the bank makes the necessary transaction > between the accounts, e-cash stash, etc. This provides no anonymity with respect to the bank, right? The bank knows who is paying whom. That's not very valuable IMO. The bank is still a centralized place where all this transaction information exists, a fat target for privacy opponents. I'd say that anonymity to the bank is more important than anonymity to the merchant for this reason. So I think you're going at this backwards. > Another idea that has been festering. If we could get a CPA involved in > this forum, I would be willing to have h[im/er] sign my key, (which is > seldom used, mostly because this is the only place I use e-mail), for that > reasonable fee that CPA's can charge. I know that it is not a standard, or > even legally recognized, post for CPA's, but I think that enough people > would trust them. The big question with identity certificates is what procedures were followed in verifying the identity when the cert was issued. If the CPA publishes some standard method, and his reputation is strong enough that people will trust him to follow it, then it might well be worth money to you to have him sign it. This is the traditional role of the Certification Authority. > This would take care of some of the "newly minted" key problems. Since > getting someone who is trusted to sign your key is a recognized method of > getting people to believe you are who you say you are. It depends on the circumstances where you expect to use your key. Within a small to medium circle of associates there may be some group members who sign keys and are trusted by other members of the group. There is no particular reason for it to be difficult. If you want a signature which will be accepted by everyone in the U.S. you have a harder problem. Hal

1 0