December 2003 - cypherpunks-legacy

Re: do NOT escrow communications keys (Re: What's really in PGP 5.5?)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >About the only example of email in transit being considered storage >was a USENET article years ago by someone who considered it a kewl >hack that he had some games or something else which was in breach of >policy in his account and rumor went around that the admin was having >a purge. He tarred, gzipped & uuencoded the lot and emailed it to >himself down a _long_ ! fowarding path. It came back to him around 3 >days later after the purge. That's the kind of thing I mean when I >say you don't consider email storage. Sometimes you can use this trick to get around storage limitations at your ISP. Often mail in the spool file doesn't get added up for the disk quota. When you hit your limit, just e-mail yourself a bunch of megabyte messages. Sysadmins tend not to like this. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND5t8JaWtjSmRH/5AQFf9wf/TQMiQH4wJXO3Xx/borwAobWIlKQCGmVQ BnflPYg5pDvHOc+vppprb/f5HLZ78p1WaOY9l7vc+aJ97NC346UQAzS8kGyr6WP7 YmHmWRx576CV8EsLWjMZFYB6fZXvvMQd6VGUPC9IKC9Zum2BV1GCUSxGIHFpwNDp ElfqFFlFdVqfh30XEi2e/XK7UKh6bzYMHgfHTEjv+FqV1grXpGlwDHQfWvPMv4s8 ZEO8XM7Sh6DOXEMnrZkKJ0dl9cW8FjphEeYbkePV9oPVuCqC8HF6gzFfGLtWMK6E nj7iuv1QoQPagk4nwogHRUjhuuFg0aDcHieDR7T1HivFReB5fZIHYQ== =HCXe -----END PGP SIGNATURE-----

2 1

Why Corporate Message Recovery isn't Key Escrow
by Jon Callas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A number of people have asserted that the Corporate Message Recovery feature is key escrow. From where I sit, the difference is easy to see. My definition of "key escrow" is that another person or organization keeps a copy of the user's secret key. Here's an example, based on actual customers who use key escrow to manage their data: This corporation uses PGP for a number of things. Email, engineering plans, CAD drawings, and so on. They've done so at least since the days when we were Viacrypt, and I believe they even used PGP 2.x. When an employee arrives at this company, they create a key pair for the new employee, hand it to them on a floppy, keeping a duplicate floppy with the keypair on it, which they toss into a safe. Literally. This is key escrow. They do this because they can't afford to lose their files and messages. Their policies require them to keep the secret keys, as if they were the same as keys to offices or file cabinets. I don't know about you, but I'm appalled. Nonetheless, they're our customers. In spite of inheriting them, we have a responsibility as businesspeople to at least listen to their concerns. - From our standpoint, the issue gets even touchier. They don't like what they're doing, and they want us to give them a better way to manage their data. Does anyone really believe that only moral response is to flinch and turn away? I'd like to be in a situation where I didn't have to deal with this. Wanna trade positions? I'll sit over there and cluck my tongue about how adding an extra recipient weakens security while you figure out how to help these folks out of the mess they're in. While you're at it, I'll pen a few lines about how giving clean needles to addicts undermines society, and handing out condoms encourages kids to have sex. Trust me, it's less nerve-wracking than what we have to do to solve this problem, which involves running through hypothetical scenario after hypothetical scenario, balancing the user's privacy against the organizations property rights, the privacy and property rights of one organization against that of another, and so on. Corporate Message Recovery isn't key escrow for a number of reasons. First, it doesn't involve keeping a copy the end-user's secret key. I hope that's obvious now. Second, the system behaves very differently. With a key escrow system, there is a superb McGuffin (which is what Alfred Hitchcock called the crux of a mystery, like the falcon in The Maltese Falcon) - it's the safe. Break into the safe, or lend its contents out, and all Hell breaks loose. Whoever has those keys (which easily fit on a single Zip disk) has the company at its mercy. They can decrypt or sign anything they care to. There is a great thriller to be written here. It isn't so with a CMRK. The worst possible way to use the feature is to have a single, company-wide CMRK. If that gets lost, the thriller you can write isn't nearly as interesting. Yup, you can steal any of the plans, read all the mail, and so on. That's bad. It's deplorable, actually. But it isn't a difference that makes no difference. At least there isn't a gang of keys out there that can sign anything with anyone's ID. This is not the only way to use Corporate Message Recovery, it's just the worst way. Remember, it's just a notation in the self-signature that states, "When you encrypt to me, encrypt to X." That's any X. You can have a different CMRK for every department, every workgroup, or even every user. A sophisticated policy might be that every user sets their supervisor's key to be their CMRK. Another is that everyone in Department X sets their office mate, or lab partner, or other person. You can have anything that suits your group, from Recovery Central, to Recovery Hierarchy, to Recovery Buddy System. The significant improvement that PGP's web of trust has over a traditional hierarchical system is that you can set up a top-down system for validity, but you don't have to (and in our opinion, shouldn't). Analogously, the significant improvement that Corporate Message Recovery has over key escrow is that you can tailor a recovery system to your needs (including and especially deciding it's not for you). Jon -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBND6j8H35wubxKSepEQI58gCfQuiMZCyfe7cD1F2nNgFtluQqGXMAoJUh yHFMApAlDjzwRTCspBi7p9t3 =a2Zo -----END PGP SIGNATURE----- ----- Jon Callas jon(a)pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA)

6 10

1110: Home-Based Email Processors Required....
by emailprofits＠mail3.c-flash.net 17 Dec '03

17 Dec '03

Earn $14.95 for every email you process for us. GUARANTEED! Dear Sir/Madam, This announcement concerns an online employment opportunity currently available with our company. If the idea of earning an excellent income using your home or office computer appeals to you, then please review this brief article. If you find this article of no benefit to you, we apologize for our intrusion. To be removed, hit reply with 'remove' in the subject. ================================================= Home-Based Email Processors Needed Immediately!! ================================================= Please be assured that this is NOT an invitation to participate in an illegal chain letter scheme. Neither is this an invitation to join a network/multi-level marketing program. We are offering a unique, legitimate home-based employment opportunity. As an Email processor for our company, you'll work out of your home or office using our exclusive FREE, "no-catch" turnkey software package. There's NO personal selling involved. There's NO sending out bulk email. We are in the Software Distribution and Publishing business. Our products have worldwide appeal. In order to expand our business globally in the shortest possible time, we need home-based Email processors all across North America, Europe, Australia and Asia RIGHT NOW!! Our EXCLUSIVE turnkey software package is all you need to do your daily duties. The work can be done full or part time. Your earnings is based on the hours you put in to the work. By devoting few hours a week, you'll be able to add handsomely to your present income. With a full time effort, your income may even exceed your expectations. If you are interested in this position, and would like to find out more about the pay structure, and the duties involved, please link to: http://204.137.223.80/master/email.html OR http://www3.c-flash.net/~emailprofits/email.html If you're having difficulties connecting, you may request a detailed information report and an application form by hitting REPLY with "MORE INFO" in the subject line. Thank you for your attention. Sincerely, Angie Steele Global Marketing Services

1 0

Why Corporate Message Recovery isn't GAK
by Jon Callas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 There are two things I will discuss in this missive: (1) The assertion that Corporate Message Recovery is "just like Clipper" and why this is not true. (2) The fear a number of people have expressed that Corporate Message Recovery (CMR) could be used by the US government to slide in GAK. I think we're agreed that CMR isn't itself GAK and I'll talk some about why it isn't with (1). CMR isn't like Clipper: * Clipper was a 64-bit key. CMR symmetric keys are full-strength keys (128 bits or more), backed with a full-strength public key. * Clipper's key was set in hardware by the manufacturer, and users were required to use it. A CMR key is a software-enabled key, no user is ever required to use it. There are cases in which a user might "volunteer" to use a CMR because they work for someone who requires it, but that's a problem we'll address with the PGP Secure Resume Server which allows headhunters to securely and anonymously find people who've made bad career decisions. As a corollary of of the previous paragraph, there's no reasonable guarantee with a Clipper device that you haven't been black-bagged with an insecure key. Using a CMR may be unwise, but at least you knowingly did it to yourself. * A CMR key can be revoked, reissued, or changed. You can periodically change it as a matter of policy. You can even stop using it. Clipper's was, again, set in hardware, with no option of not using it. * The Clipper symmetric algorithm was secret; CMR keys use publicly available algorithms. * With Clipper, there was always a concern that an outside agency had the keys. This is true with a number of other systems (the so-called key recovery systems), and is the reason that a number of them are lumped together with the term GAK. Note that the user-organization creates a CMR key, and the end-user enables it. If any government gets access to this key, it is because either (1) they solved the Discrete Logarithm Problem, (2) they broke the public CMR key, (3) they black-bagged your CMR key, or (4) they are using a subpoena, warrant, or discovery to get the key. We're working on a way around (1), we can't do anything about (2) or (3), but these are fine reasons not to use CMR! If you're beset by (4), you need lawyers, not cryptographers. * With Clipper, there was a central repository of all the keys. With CMR, there is not. I discussed that in detail in my message, "Why Corporate Message Recovery isn't Key Escrow." I have noticed that a number of people have the tacit assumption that business people and corporations are in cahoots with the FBI, waiting to hand over everyone's secret key. As in all parts of life, there are many, many businesspeople and corporate execs who are not particularly moral. But I don't think that their immorality takes this form. If we could examine the dark, secret thoughts of a corporate scumwaffle -- the ones that he *really* hopes don't hit the papers -- I sincerely doubt that, "Oh, Louis, I love it when you rummage my drawers" is among them. Now then, the next topic is the fear that CMR will be used in some insidious government plot to slip in GAK everywhere. I worry about this, too. But I don't think it's feasible that CMR can be a stalking horse for GAK. If the government wants to GAK-enable all PGP, they'll have to have a plan similar to this: (1) Buy PGP, Inc. Since our worth is less than the black portion of the Federal Budget, this is not impossible. Would that it were otherwise. Heck, we're probably worth less than the black portion of New Zealand's budget. (2) Fire all the current development staff. This isn't very hard. All the new bosses have to do is round us up in a meeting and announce, "The next version of PGP will have a 40-bit export option." We'll say, "Not while *we're* working for the company!" They'll say, "Fine with us." Keep your eye on the secure resume server for clues of this event. (3) Hire a new staff. This is one of the places that the plan might fall apart. We have such a hard time finding anyone who's qualified to work for us that we have reqs we can't seem to fill. I suppose, though, that they'll be able to find some people willing to relocate from Maryland. (4) Stop the OpenPGP process in the IETF. Some people think that we did this as part of our Evil Plan to Take Over the World by Giving Away Software (hey, it almost worked for Netscape). Other people think it's part of our Evil Plan to Take Over Crypto by Using Unpatented Algorithms. I can neither confirm nor deny these, but I *will* tell you that it's part of our Sniveling Plan To Convince the Feds They Can't Kill PGP by Killing Us, which the source code books also fall into. If OpenPGP succeeds, then anyone can build an interoperable version of PGP, not just us, Highware, Systemics, etc. (5) Wait until bitrot makes all those existing copies of PGP stop working. I could make a few catty remarks about how quickly existing software stops working on new releases of OSes, but you've probably thought of them yourself. There are also a few details left, like shutting down all those international FTP sites, but hey, they're the government, they're omnipotent. Jon - ----- Jon Callas jon(a)pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBND6mO335wubxKSepEQKpgQCeNxWHHjIucyzRrQV429PKM0sTykAAnjiz byD3SzToLdfkGq+mIyUHji6M =r8nx -----END PGP SIGNATURE----- ----- Jon Callas jon(a)pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA)

2 1

Re: FCPUNX:The Sovereign Individual - ignorant authors
by James A. Donald 17 Dec '03

17 Dec '03

At 11:12 PM 10/9/97 -0500, Jim Choate wrote: > This chapter deals with various aspects of social issues (eg rise of > national languages) and how they led to the growth of nationalism in > general. Toward the end of the chapter (pp. 265 in the hardback) these > idiots (don't know a better term) actualy have the audactity to claim that > Stephen Jay Gould is a neo-creationist, This appears to me to be an accurate depiction of Stephen Jay Gould's views. He claims that humans are fundamentally different from other animals in this regard, and has frequently been ridiculed on this account. I have read some of his writings, for which he was ridiculed, and the ridicule and contempt appears justified to me. > The author of this section has apparently never read a word that Gould has > written. Gould is known as a leading supporter of Punctuated Equilibria and > its various spawn, I have read a fair bit of Gould. His work on the evolution of non humans is perfectly plausible though controversial. His work on humans is shear crap and is not regarded by the relevant experts in the relevant fields as legitimate science. In his field, he is a innovator. Outside his field, he is a crackpot, similar to the flat earthers and the people who claim that Socrates was black, demonstrating that even trained scientists can degenerate into nuttery when they go beyond their area of expertise. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Fuck You!
by Bianca 17 Dec '03

17 Dec '03

I found your address, despite your subterfuge, and I am going to fuck up both you and your computer system. I don't like fuckwads sending bullshit to my email. Fuck You (& the horse you rode in on)

2 1

Re: CAK as a really bad form of corporate networking
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: >My conclusion is that PGP for Business does very little for real >corporate access in "hit by a truck" situations, as most of these >critical files (fill in the blanks , but thinkof chip design files, >source code for programs , lab notebooks , etc .) are simplyNOT ever >e-mailed. And if they are e -mailed , this is completelya tertiary >issue. One should also ask who is managing the company and why. It is never a good policy to leave important components of the company in the hands of particular people for long periods of time. While people die relatively infrequently, they do often become frustrated or angry and leave the company. For instance, one really has to ask what is going on when a programmer doesn't check in his or her code for six months. And one really has to wonder how useful that code is going to be to anyone. My policy has been to discard half completed work when people leave. It's just cheaper to start anew than to clean up and debug undocumented code which nobody understands. In general, the case where "important documents" have to be retrieved from a departed employee's desk or computer are fairly uncommon. And the case where it is necessary to intercept a departed employee's e-mail is pretty much non-existent. >So who is the real customer for PGP for Business and its form of >plaintext recovery? I am looking forward to hearing the precise mechanisms behind PGP, Inc.'s change in tune. Were some of those investors shills? In terms of governmental expenditures, it would cost nothing to flood PGP with great investment deals. It would probably cost less than Clipper itself. And all of the former troublemakers can be quietly ridden down and finally trained to accept the saddle of good stock deals and contractual obligations. If that was the mechanism, it's pretty slick and to be admired by sportsmen everywhere. It is the sense of Monty Cantsin that a number of readers of the list are downplaying PGP Inc.'s actions because they hold the character of certain people involved with the company in high regard. This is probably an error. Character must be judged by actions. The actions are clear. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBND6DcJaWtjSmRH/5AQEDGwf+Pl0xusD2oBzrqOFkBrV92NHswJJ6VbuQ akNVAaBz+gNnXy2Zt7Pfa09nqibW9qbzd3pbJh8v7djOwtqQSJXN7uZA0JVF2mii oLR5jwh9bpNRSvElaJLRmcGMY3RKighl1rcwfxAjbmJjEI6nSjcaELPNpPCMZEfT cEehlxC5R4f9oikQJc4VNg/MVo89P9ckT9wtbdd4S4ZOFArxHvGlw+bW/hwlpDNE fIZBy8BlJqir+BSZGLkSwOOvuAwozMCQSM/VFj6aDNiNTA3bQ8xHGyaapRci7dVX ZleOrYWsdAt25R9yt79T9Mcu8tKuvbfl245gxHSrOReODG89gOT/vw== =FLvb -----END PGP SIGNATURE-----

1 0

GAK, CAP, "escrow", "recovery" -- Minitru has us so confused we fight amongst ourselves
by Zooko Journeyman 17 Dec '03

17 Dec '03

The whole goal of the hijacking of the phrase "key escrow" to camoflage GAK was to obscure the difference between voluntary and involuntary participation. Unfortunately, while Clipper and successors have been policy failures, that initial push to conquer important conceptual ground has been a devastating success. Now good guys from both sides of the PGP CAP debate appear to have forgotten this essential distinction. Jon, I started reading your list of ways that PGP CAP differs from USG GAK, and it was about "software versus hardware" or something. Screw that-- is it voluntary or is it not? Of course it is voluntary. PGP, Inc. has no deal with USG or any other agency to the effect that user's secrets will be involuntarily (by threat, force or secrecy) copied. So forget about all those details and make the point-- PGP helps people control their own data, including voluntarily sharing their data with others. This is almost entirely unrelated to GAK. One more time for the slow folks at home (journalists especially, listen up!): Escrow is when you voluntarily choose to share your property with someone else, especially as part of a business contract that you have with that person to the effect that she won't use your property for anything but will merely hold your property in order to give it back to you or to a third party in response to certain events transpiring. The word "escrow", coined sometime in the 16th or early 17th centuries, has held this meaning and only this meaning throughout the intervening centuries. Someone getting access to your secrets against your will, whether by trickery, threat of force, or burglary is not escrow. At least, not until the USG deliberately chose to abuse that word to throw a mask of legitimacy upon its rotten idea of mandatory wiretapping for all digital communication. Damn, but it is frustrating to see such a bare-faced newspeak gambit succeed so brilliantly against otherwise literate people. Everyone should read George Orwell's paper on (ab)use of language in politics. None of the examples he cites are nearly as worthy of Minitru as is this single conceptual hijacking. Regards, Zooko P.S. Of course there are subtleties that I omitted from this rant. It wouldn't be a good rant if I calmly enumerated the various legitimate perspectives now would it? Maybe PGP CAP is a bad idea. Maybe it will lead to GAK. Maybe corporations are a bad idea. Maybe they will lead to governments. But whether or no, use of PGP and PGP features (including escrow features) is voluntary. GAK is not voluntary. GAK is not escrow. Please help me put a stake through the heart of this vile meme.

1 0

Attitude and Assumptions
by Jon Callas 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In the course of all the discussion here, I have seen a number of implicit attitudes and assumptions that irritate me. This is a short rant to air my irritation. The first thing that bugs me is what I'm calling Crypto-Correctness. I don't know a single person on cypherpunks who is against privacy, or is against the notion that in the information society, keeping and bearing crypto is an inalienable human right. Politically, I'm a Lockeian, and put privacy up there with Locke's basic trio of life, liberty, and property. As part of this, I fight the stupid notion that because there are bad people out there, rights should be abridged. Crypto is a tool, and nigh any useful tool can be misused. If we let that fact stop us from making tools, we'd be using nerf axes and dressing in bubble wrap. If we let the fact that bad guys are using our stuff bother us too much, we'd be against privacy. Here at PGP, we like to make hay out of the fact Burmese freedom fighters use PGP. A while ago, Tim May sent out something in which he stated that Hamas uses PGP, making the very valid point that one person's freedom fighters are another person's terrorists. He implied that they're not using just to tell each other where the best hummous shops are, and I don't doubt it. I like to say (now that I'm no longer an arms maker) that we are like the Red Cross in that the Red Cross gives medical attention to everyone, regardless of their moral worth; we supply privacy software to everyone, regardless of their moral worth. In the days when crypto was a munition, I used Winchester as a metaphor, complete with Sarah's cute bungalow. In its milder forms, Crypto-Correctness thinks that if a bad guy is using crypto, then it's a mitigating factor on what they're doing. I can see that it might come from not liking tack-on laws like the clause in the present bill that makes using crypto to hide a crime illegal. This is deplorable. But using crypto doesn't make something good. In some of its other forms, it pushes into what I perceive as Crypto-Socialism. We just shrug if suicide bombers or paparazzi are using crypto, but if a property-owner wants to use it, you can just hear the sharp intake of breath. If that property-owner is Big Business, there are howls of indignation. I get the impression that some people think crypto should only be produced by non-profit organizations for the use of non-profit organizations, or those that had the common decency to get their profits illegally. The next thing that bugs me is that the government has us so scared of our shadows that we look askance at anything that might make crypto mass-market. Right now, crypto is rocket science. Many of the people who need it most are only going to understand it after years of acclimatization. The sorts who inhabit the nightmares of tech-support people are going to take at least one more turn of the wheel of Maya to get it. I think a lot of people here think that blade guards on crypto in any form is stark moral evil. You lost your data? Good. Shows you're not worthy. You shouldn't have data anyway. Information is property, and property is theft. In the crypto-anarchist future, after the withering away of the state, you won't need property anyway. I suppose we'll all just eat e-cash. I really believe that this panicked, bunker-mentality fear of anything that might complicate the system with blade guards is doing the cause of freedom a sever disservice. Business people are subjected to a lot of the asinine annoyances and minor evils that government brings, too. If we get them on our side, they will be a powerful ally. I believe that the central thesis of crypto-freedom is that it doesn't matter if a document is on paper or in a text file; it doesn't matter if a conversation is on the phone or in a restaurant. The medium doesn't matter. My papers and effects have the same protection on a disk as on paper itself. We all know that deployment is the key. But real deployment means deploying to people who don't know how their toaster works, too. If we don't solve this problem, we'll get hit with the backlash. Just you wait, once crypto becomes trendy, there will be a Time cover story with some headline like, "How Much Privacy is Enough? Who's Really After You, Anyway?" and in it will be sob stories about how people lost their passphrases, were blackmailed by employees (ask me, I have real-world tales of this), or can't decrypt their backups. Congress will have hearings, and they aren't going to be fun to watch. Is trying to head this eventuality off (yes, I believe it's inevitable) really the work of Satan? The last thing that really, really bugs me is the hostility that's directed towards PGP Inc. because now we're an Inc. The core group of people who are here are the same people they always were, they're just being paid now. I'd love to be independently wealthy and do this for the crypto-anarchist, non-profit joy of it, really I would. But you know, as the great crypto-socialist Balzac said, "behind every great fortune, there is a great crime" so I suppose we must be up to no good. This is a blues riff, so let me tell you how we've paid our dues before I get to the chorus: We published our source code. One of our potential partners said and I quote, "Are you mad?" We stand firm on the issue of No Weak Crypto. A noted GAK proponent asked me at a conference, "Aren't you folks going to do an export version?" I replied, "Sure we are." This person asked, "When?" I said, "The day after the law changes." We put out a freeware product, hoping people will upgrade to the for-pay version. If you're thinking of your own startup, let me give you some investment advice: the crowd who thinks the X-files is a documentary doesn't upgrade to the for-pay version. We started an IETF working group that will take our core technology and put it out for anyone to use. They will own change control. We won't be able to use any patents or intellectual property to enhance our business position. We won't be able upgrade the protocol without a vote. The only thing we offer as a selling point is our superb engineering and our good name. The business version is funding the rest of the ball of wax. Are you afraid we'll make a deal with the devil? I have two comments on that: (1) I work in Silicon Valley. I tell headhunters, "no thank you" every week. I took a pay cut to come here. I can get a 20% raise by going to WebFoo any time I want. My options aren't worth what I would have gotten as a layoff package had I stayed at Apple. If I send out an email message that provides "technical support" to furriners, I could land in jail. I'm here because I care. Ask the people here who left behind Cisco options at 40 if they care. (2) There's one surefire way to make sure we don't make any deals with the devil. Buy the product. Encourage your friends, your mother to buy the product. If you see someone who is using the freeware version, send them a polite message to buy the product. Buy one and send it to your congresscritter. If you don't, what you're saying is, "crypto-freedom is very important to me, as long as I don't have to spend $49 on it." Convince your employer that $119 isn't too much to pay for meta-introducers. Make the crypto market so hot that someone competes with us by being badder than us. Oh, yeah, baby, I got them crypto-startup blues. Jon - ----- Jon Callas jon(a)pgp.com Chief Scientist 555 Twin Dolphin Drive Pretty Good Privacy, Inc. Suite 570 (415) 596-1960 Redwood Shores, CA 94065 Fingerprints: D1EC 3C51 FCB1 67F8 4345 4A04 7DF9 C2E6 F129 27A9 (DSS) 665B 797F 37D1 C240 53AC 6D87 3A60 4628 (RSA) -----BEGIN PGP SIGNATURE----- Version: PGP for Business Security 5.5 iQA/AwUBND7PCH35wubxKSepEQKD9QCgwPoRbXSHyueb9U4fLztaQkAKLlQAoNdC kX1gOsFsBZ6YDtC9AX5X/VU9 =IiAC -----END PGP SIGNATURE-----

6 5

Re: FCPUNX:The Sovereign Individual - ignorant authors (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Fri, 10 Oct 1997 15:28:31 -0700 (PDT) > From: "James A. Donald" <jamesd(a)echeque.com> > Subject: Re: FCPUNX:The Sovereign Individual - ignorant authors > At 11:12 PM 10/9/97 -0500, Jim Choate wrote: > > This chapter deals with various aspects of social issues (eg rise of > > national languages) and how they led to the growth of nationalism in > > general. Toward the end of the chapter (pp. 265 in the hardback) these > > idiots (don't know a better term) actualy have the audactity to claim that > > Stephen Jay Gould is a neo-creationist, > > This appears to me to be an accurate depiction of Stephen Jay Gould's > views. He claims that humans are fundamentally different from other > animals in this regard, and has frequently been ridiculed on this account. > > I have read some of his writings, for which he was ridiculed, and the > ridicule and contempt appears justified to me. Well apparently you didn't comprehend what he was saying any better than the authors of the book or your experts. However, I have no intention of bringing this discussion onto the list past this responce. If you, or anybody else, would like to see Gould's refutation of this claim in his own words then refer to: Scientist Confront Creationism ed. L.R. Godfrey ISBN 0-393-30154-0 Chpt. 8. Darwin's Untimely Burial - Again! pp. 139 This volume is a collection of articles by 15 of the top evolutionary theorist (not all biologist) in the field. Worth the $7.95 this little book costs. You might also want to read "The Mismeasure of Man" (again). > I have read a fair bit of Gould. His work on the evolution of non humans is > perfectly plausible though controversial. > > His work on humans is shear crap and is not regarded by the relevant experts > in the relevant fields as legitimate science. [rhetorical questions, please don't send responces] So your premise is that the evolutionary processes which form non-humans are not the same forces acting on humans? You seriously mis-understand not only Gould but modern evolutionary theory in toto. Sounds like you and not Gould have embraced neo-creationism. What relevant experts? THE relevent expert in evolutionary biology is Ernst Meyr. Are you claiming that Meyr doesn't know what he is talking about? Gould's premise, supported by Meyr and most other evolutionary biologist, is that the human being is in fact a radicaly different animal than all others. Not because of some magical force of transcendance but rather a easily understand mechanism. The increase of cerebral capacity in concert with exo-cerebral capacity (ie memory outside the brain), abstract thinking, and language provide humans the tools to escape the purely evolutionary process. Gould's claim, and what pisses so many people off, is that man has reached a point where the major force in future development is NOT evolutionary processes. It is quite similar to what happens when you have 10 computers sitting in a room and what happens when those 10 computers are networked and given large hard-drives. You don't get evolution, you get revolution. [that's as close to relevancy to this list as I can manage] ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http:// www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

1 0