July 2018 - cypherpunks-legacy

U.S. spy agencies ... email for cybersecurity
by William Allen Simpson 06 Jul '18

06 Jul '18

Somebody needs to give them a clue-by-four. The private sector already has the "Internet address where an email ... originated"; it's already in the Received lines. We don't need to be informed about it, we already inform each other about it. And it's already delivered "at network speed." It is my understanding the Dept of Homeland Security already cooperates in sharing government intrusion information. We certainly don't need a "U.S. spy agency" MITM to "protect the private sector." Moreover, the US is the source of most spam and malware, so the NSA isn't really going to be much help. And the US is the source of the only known cyber attacks on other country's infrastructure, so it's not likely much help there, either. Unless they expect retaliation? === http://in.reuters.com/article/2012/07/10/net-us-usa-security-cyber-idINBRE8… U.S. spy agencies say won't read Americans' email for cybersecurity 8:48pm EDT By Tabassum Zakaria and David Alexander WASHINGTON (Reuters) - The head of the U.S. spy agency that eavesdrops on electronic communications overseas sought on Monday to reassure Americans that the National Security Agency would not read their personal email if a new cybersecurity law was enacted to allow private companies to share information with the government. ... But to help protect the private sector, he said it was important that the intelligence agency be able to inform them about the type of malicious software and other cyber intrusions it is seeing and hear from companies about what they see breaching the protective measures on their computer networks. "It doesn't require the government to read their mail or your mail to do that. It requires them, the Internet service provider or that company, to tell us that that type of event is going on at this time. And it has to be at network speed if you're going to stop it," Alexander said. He said the information the government was seeking was the Internet address where an email containing malicious software originated and where it traveled to, not the content of the email. ... But the U.S. government is also concerned about the possibility of a cyber attack from adversaries on critical infrastructure such as the power grid or transportation systems. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[IP] Surveillance Camera Rights - Glenn Reynolds Op-Ed - Watching the Watchers - Popular Mechanics
by David Farber 06 Jul '18

06 Jul '18

________________________________________ From: Shannon McElyea [shannonm(a)gmail.com] Sent: Monday, December 17, 2007 8:10 PM To: David Farber; Dewayne Hendricks Subject: FW: Surveillance Camera Rights - Glenn Reynolds Op-Ed - Watching the Watchers - Popular Mechanics http://www.popularmechanics.com/technology/military_law/4237005.html Watching the Watchers: Why Surveillance Is a Two-Way Street If governments and businesses can keep an eye on us in public spaces, we ought to be able to look back. By Glenn Harlan Reynolds Published in the January 2008 issue. Suddenly, cameras are everywhere. As this month's cover story<http://www.popularmechanics.com/technology/military_law/4236865.html> notes, the recent boom in video monitoringbby both the state and businessesbmeans we're all being watched. It's like something out of George Orwell's 1984. Except that, unlike Orwell's protagonist Winston Smith, we can watch backband plenty of people are doing just that. Which makes a difference. The widespread installation of recording devices is not all bad: ATM cameras helped prove that Duke students accused of rape couldn't have committed the crime. And we all sympathize with the goals of preventing terrorism and crime, though it is not proven that security cameras accomplish this. Nonetheless, the trend toward constant surveillance is troubling. And even if the public became concerned enough to pass laws limiting the practice, it's not clear how well those laws would work. Government officials and private companies too often ignore privacy laws. (In a notorious recent case, Hewlett-Packard executives were caught spying on the phone records of reporters covering the company.) Besides, the technology of surveillance is becoming so advancedbbiologists are now attaching tiny cameras to crows' tail feathers to observe the birds' tool use in the wildbthat in reality there's not much we can do to ensure privacy anyway. Maybe that doesn't matter. Privacy is a recent phenomB-enon. For most of human history, people lived in small tribes or villages where everyone knew everyone else's business. Ubiquitous surveillance may be just a case of the past as prologue. There's a difference, though. In the old days, ordinary people didn't have much privacy, but neither did big shots. By contrast, today's government officials and big corporations often want to watch us, but they don't want to be watched in return. Shopping malls are full of security cameras, but many have signs at the entrance telling customers that no photography or video recording is allowed. Police cars have dashboard cameras, cities and counties are posting red-light and speed-limit cameras, and it seems that the dream of many government officials is to put every public space under 24-hour video watch. But try shooting photos or video of police or B-other public officials as they go about their business and you might find yourself in wrist restraints. In recent months such cases have been piling up. Brian Kelly of Carlisle, Pa., was a passenger in his friend's car when the police pulled the vehicle over for speeding. When Kelly began videotaping, he was arrested and charged with violating a state wiretap statute and thrown in jail overnight. Charges were dropped when the district attorney recognized that recording police in public isn't much like wiretapping. In addition, the DA said that the police had no expectation of privacy when they themselves were recording the incident. Michael Gannon, of Nashua, N.H., faced similar charges when he used a front-door security camera to record what he considered to be overly aggressive behavior by a detective. The charges against Gannon were dropped. That's the eventual outcome in most such cases, though sometimes photographs and video are lost in the process. Of course, it's understandable that police might be skittish. Ever since the Rodney King case, police have known that video imagesbwhether recorded by citizens or by the authorities themselvesbcan provoke controversy. With video technology spreading so rapidly, such images are coming to light more often. In October 2007, an elite unit of the Chicago Police Department was disbanded after video emerged of its members shaking down barroom customers. A policeman in Puerto Rico is under FBI investigation because videobuploaded to YouTubebapparently shows him executing an unarmed man. And a Baltimore woman recently won a $180,000 false arrest and imprisonment lawsuit based on police videotape evidence that confirmed a different but similarly dressed woman was the one buying drugs. Supporters of widespread surveillance often argue, "If you're obeying the law, you have nothing to fear." Why shouldn't the same go for police officers? The cases above all involve accusations of extreme misconduct or errors on the part of police. Let's hope those are rare. Far more common, I suspect, are cases where the existence of a video record helps protect honest cops from false charges. The "don't Tase me, bro" case became a YouTube sensation after footage emerged of University of Florida police using a Taser on an obstreperous student. But ultimately that same footage was instrumental in clearing the officers of charges of wrongdoing. Under the law, citizens have no right not to be photographed in public places. So why should people who make their living on the taxpayers' dime enjoy greater freedom from public scrutiny than the taxpayers themselves? Civil liberties groups have begun supporting the trend toward a video-enabled populace. The Eastern Missouri chapter of the American Civil Liberties Union sends out volunteers with cameras, though they have faced police hostility at times. Over the long haul, such efforts may be superfluous. The widespread availability of digital cameras and video-capable cellphones means that ubiquitous surveillance on the part of the little guys is moving, if anything, even faster than ubiquitous surveillance on the part of the big boys. And distribution tools like YouTube make it easier to get the footage to a large audience. I think that's a good thing. Today's pervasive surveillance may seem like something out of 1984, but access to technology has become a lot more democratic since Orwell's time. Big Brother had a network of security cameras, but could that oppressive regime have survived a network of cellphones? ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: nym-0.2 released (fwd)
by cyphrpunk 06 Jul '18

06 Jul '18

On 9/30/05, Jason Holt <jason(a)lunkwill.org> wrote: > http://www.lunkwill.org/src/nym/ > ... > My proposal for using this to enable tor users to play at Wikipedia is as > follows: > > 1. Install a token server on a public IP. The token server can optionally be > provided Wikipedia's blocked-IP list and refuse to issue tokens to offending > IPs. Tor users use their real IP to obtain a blinded token. > > 2. Install a CA as a hidden service. Tor users use their unblinded tokens to > obtain a client certificate, which they install in their browser. > > 3. Install a wikipedia-gateway SSL web proxy (optionally also a hidden service) > which checks client certs and communicates a client identifier to MediaWiki, > which MediaWiki will use in place of the REMOTE_ADDR (client IP address) for > connections from the proxy. When a user misbehaves, Wikipedia admins block the > client identifier just as they would have blocked an offending IP address. All these degrees of indirection look good on paper but are problematic in practice. Each link in this chain has to trust all the others. Whether the token server issues tokens freely, or the CA issues certificates freely, or the gateway proxy creates client identifiers freely, any of these can destroy the security properties of the system. Hence it makes sense for all of them to be run by a single entity. There can of course be multiple independent such pseudonym services, each with its own policies. In particular it is not clear that the use of a CA and a client certificate buys you anything. Why not skip that step and allow the gateway proxy simply to use tokens as user identifiers? Misbehaving users get their tokens blacklisted. There are two problems with providing client identifiers to Wikipedia. The first is as discussed elsewhere, that making persistent pseudonyms such as client identifiers (rather than pure certifications of complaint-freeness) available to end services like Wikipedia hurts privacy and is vulnerable to future exposure due to the lack of forward secrecy. The second is that the necessary changes to the Wikipedia software are probably more extensive than they might sound. Wikipedia tags each ("anonymous") edit with the IP address from which it came. This information is displayed on the history page and is used widely throughout the site. Changing Wikipedia to use some other kind of identifier is likely to have far-reaching ramifications. Unless you can provide this "client idenfier" as a sort of virtual IP (fits in 32 bits) which you don't mind being displayed everywhere on the site (see objection 1), it is going to be expensive to implement on the wiki side. The simpler solution is to have the gateway proxy not be a hidden service but to be a public service on the net which has its own exit IP addresses. It would be a sort of "virtual ISP" which helps anonymous users to gain the rights and privileges of the identified, including putting their reputations at risk if they misbehave. This solution works out of the box for Wikipedia and other wikis, for blog comments, and for any other HTTP service which is subject to abuse by anonymous users. I suggest that you adapt your software to this usage model, which is more general and probably easier to implement. CP ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: Anonymity questions
by Michael Holstein 06 Jul '18

06 Jul '18

I've thought about this too (and the BGP routing thing I hadn't heard, but I was aware that ATT, et.al. were being NSA-friendly by routing international calls through US-based switches) -- but if they do it for voice, they do it for data, since to AT&T, it's all really data anyway. So how about this as a proposed solution: Rather than encrypt individual TCP streams, allow the TOR nodes (or at least the intermediates) to do GRE or IPSEC, and then route multiple streams (each themselves encrypted) inside a seperately encrypted tunnel. This would make it impossible (er...more difficult) for someone to match traffic entering with traffic exiting (assuming sufficient padding and whatnot to keep traffic fairly constant). Unless you can pick a large "burst" out of the other chatter, you'd make it signifigantly harder to trackback on an individual stream. Sort of like a mesh-network of opportunistically created VPNs -- creating an encrypted "cloud". I think this is sort of what the Freedom network tried to do commercially a few years ago. Another advantage of this might be the ability to actually use BGP tables to assist in routing, since at this point, you'd have created an encrypted "overlay internet". Those tables could then be manipulated with control traffic inside the cloud to deal with ensuring traffic is routed through multiple countries (or around certian ones). The other advantage of a GRE/IPsec approach would be the ability to carry any type of traffic, not just TCP. Thoughts? Michael Holstein CISSP GCIA Cleveland State University ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] Surveillance Camera Rights - Glenn Reynolds Op-Ed - Watching the Watchers - Popular Mechanics
by David Farber 06 Jul '18

06 Jul '18

________________________________________ From: Shannon McElyea [shannonm(a)gmail.com] Sent: Monday, December 17, 2007 8:10 PM To: David Farber; Dewayne Hendricks Subject: FW: Surveillance Camera Rights - Glenn Reynolds Op-Ed - Watching the Watchers - Popular Mechanics http://www.popularmechanics.com/technology/military_law/4237005.html Watching the Watchers: Why Surveillance Is a Two-Way Street If governments and businesses can keep an eye on us in public spaces, we ought to be able to look back. By Glenn Harlan Reynolds Published in the January 2008 issue. Suddenly, cameras are everywhere. As this month's cover story<http://www.popularmechanics.com/technology/military_law/4236865.html> notes, the recent boom in video monitoringbby both the state and businessesbmeans we're all being watched. It's like something out of George Orwell's 1984. Except that, unlike Orwell's protagonist Winston Smith, we can watch backband plenty of people are doing just that. Which makes a difference. The widespread installation of recording devices is not all bad: ATM cameras helped prove that Duke students accused of rape couldn't have committed the crime. And we all sympathize with the goals of preventing terrorism and crime, though it is not proven that security cameras accomplish this. Nonetheless, the trend toward constant surveillance is troubling. And even if the public became concerned enough to pass laws limiting the practice, it's not clear how well those laws would work. Government officials and private companies too often ignore privacy laws. (In a notorious recent case, Hewlett-Packard executives were caught spying on the phone records of reporters covering the company.) Besides, the technology of surveillance is becoming so advancedbbiologists are now attaching tiny cameras to crows' tail feathers to observe the birds' tool use in the wildbthat in reality there's not much we can do to ensure privacy anyway. Maybe that doesn't matter. Privacy is a recent phenomB-enon. For most of human history, people lived in small tribes or villages where everyone knew everyone else's business. Ubiquitous surveillance may be just a case of the past as prologue. There's a difference, though. In the old days, ordinary people didn't have much privacy, but neither did big shots. By contrast, today's government officials and big corporations often want to watch us, but they don't want to be watched in return. Shopping malls are full of security cameras, but many have signs at the entrance telling customers that no photography or video recording is allowed. Police cars have dashboard cameras, cities and counties are posting red-light and speed-limit cameras, and it seems that the dream of many government officials is to put every public space under 24-hour video watch. But try shooting photos or video of police or B-other public officials as they go about their business and you might find yourself in wrist restraints. In recent months such cases have been piling up. Brian Kelly of Carlisle, Pa., was a passenger in his friend's car when the police pulled the vehicle over for speeding. When Kelly began videotaping, he was arrested and charged with violating a state wiretap statute and thrown in jail overnight. Charges were dropped when the district attorney recognized that recording police in public isn't much like wiretapping. In addition, the DA said that the police had no expectation of privacy when they themselves were recording the incident. Michael Gannon, of Nashua, N.H., faced similar charges when he used a front-door security camera to record what he considered to be overly aggressive behavior by a detective. The charges against Gannon were dropped. That's the eventual outcome in most such cases, though sometimes photographs and video are lost in the process. Of course, it's understandable that police might be skittish. Ever since the Rodney King case, police have known that video imagesbwhether recorded by citizens or by the authorities themselvesbcan provoke controversy. With video technology spreading so rapidly, such images are coming to light more often. In October 2007, an elite unit of the Chicago Police Department was disbanded after video emerged of its members shaking down barroom customers. A policeman in Puerto Rico is under FBI investigation because videobuploaded to YouTubebapparently shows him executing an unarmed man. And a Baltimore woman recently won a $180,000 false arrest and imprisonment lawsuit based on police videotape evidence that confirmed a different but similarly dressed woman was the one buying drugs. Supporters of widespread surveillance often argue, "If you're obeying the law, you have nothing to fear." Why shouldn't the same go for police officers? The cases above all involve accusations of extreme misconduct or errors on the part of police. Let's hope those are rare. Far more common, I suspect, are cases where the existence of a video record helps protect honest cops from false charges. The "don't Tase me, bro" case became a YouTube sensation after footage emerged of University of Florida police using a Taser on an obstreperous student. But ultimately that same footage was instrumental in clearing the officers of charges of wrongdoing. Under the law, citizens have no right not to be photographed in public places. So why should people who make their living on the taxpayers' dime enjoy greater freedom from public scrutiny than the taxpayers themselves? Civil liberties groups have begun supporting the trend toward a video-enabled populace. The Eastern Missouri chapter of the American Civil Liberties Union sends out volunteers with cameras, though they have faced police hostility at times. Over the long haul, such efforts may be superfluous. The widespread availability of digital cameras and video-capable cellphones means that ubiquitous surveillance on the part of the little guys is moving, if anything, even faster than ubiquitous surveillance on the part of the big boys. And distribution tools like YouTube make it easier to get the footage to a large audience. I think that's a good thing. Today's pervasive surveillance may seem like something out of 1984, but access to technology has become a lot more democratic since Orwell's time. Big Brother had a network of security cameras, but could that oppressive regime have survived a network of cellphones? ------------------------------------------- Archives: http://v2.listbox.com/member/archive/247/=now RSS Feed: http://v2.listbox.com/member/archive/rss/247/ Powered by Listbox: http://www.listbox.com ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: [liberationtech] Not another Haystack right?
by Evgeny Morozov 06 Jul '18

06 Jul '18

I was intrigued by two issues on this thread: 1) Brian Conley's question about why BBG's support to Tor does not seem to undermine Tor. 2) Jillian York's statement that the Berkman Center has only received funding for research, which, pushed one step further, means that research of circumvention tools is somehow inconsequential to the broader debate about USG's support of such tools. To Brian's question: I'm also very intrigued by this. The common explanation that I heard many times is that Tor was conceived as a tool for protecting one's online anonymity , not for circumventing government censorship; the latter was something that users discovered and embraced on their own. While I found this explanation plausible in the past, I'm no longer sure I can buy it without some further evidence. Were Tor's developers really that narrow-minded as not to understand that the tool can also be used for circumventing censorship? We are talking some of the smartest guys out there - and they couldn't anticipate it? Something here doesn't compute. Or was the anonymity talk just a strategic rhetorical device to deflect attention from the intended use? I haven't read all the relevant mailing lists and am just articulating common wisdom so it would be good if some people who have been involved with Tor for a long time would comment. Secondly, there is another common explanation for Tor's resilience: the fact that instead of going after a particular country, they try to be comprehensive and guard against any threats to users' online anonymity regardless of their location (this is obviously my understanding - please correct if I don't get it right). By this logic, tools that take USG funding and go after a particular country (as, say, Haystack did) make themselves vulnerable to certain conspiracy theories. But this argument, too, doesn't convince me anymore now that Iran has been going after Tor quite systematically and the Tor team have been modifying their product to ensure it works there. My question is: for how long can Tor continue being seen as neutral and not targeting country X if so much of their resources is spent on making sure their tool works in country X? As for Jillian's assertion that research of circumvention tools is somehow conceptually and ethically different from tool-building or training, well, allow me to disagree. One doesn't need to get in bed with Foucault to grasp that a detailed study of circumvention tools - e.g. ranking of their security features and their choice of tools that they won't study or speculate upon (hello, Haystack!) - is not only performative but is also intricately implicated in the *production *of those very tools (and I'm using the word production here rather loosely). Are we really naive enough to believe that a "Tool X, as certified by Harvard University" is the same as a "Tool X, as certified by The State University of Ubeki-beki-beki-beki-stan-stan"? I'd venture that, all things being equal, a tool that is funded by USG and endorsed by Harvard is likely to be less suspicious (to local users) than a tool that is funded by USG and not endorsed by anyone. (There are, exceptions, of course). So I'd rather not spare the well-meaning researchers the scrutiny deserve Please note that this is not some meta-point about the ethics of taking (and offering) USG money to activists and NGOs; my views on this quite complex. It's simply an expression of my continued besument at some folks at the Berkman Center who keep pretending that none of this matters and that "they are only here to help". Evgeny On Tue, Nov 29, 2011 at 5:05 PM, Brian Conley <brianc(a)smallworldnews.tv>wrote: > Also, GV is avowedly opposed to taking USG funding, as it's been related > to me recently by Ivan Sigal, their Executive Director. I believe they have > always been opposed to it, including funding via a pass through or as a > subcontractor or subgrant receiver. My understanding is that this is > primarily due to the attitude about USG funding in the Middle East, whereas > GV *does* receive funding from other organizations connected to governments > other than the United States. > > Brian > > > On Tue, Nov 29, 2011 at 3:58 PM, Jillian C. York <jilliancyork(a)gmail.com>wrote: > >> Katrin, >> >> First off, while this debate may not be pertinent *to this thread*(admittedly, I only brought it up because I misunderstood Brian's >> comments), I do think it's a useful discussion to have, as many tool >> developers don't seem to think about the impact of their funding on users. >> >> Now, facts: I've been publicly critical of USG (and specifically, >> State/DRL) funding since I worked at Berkman, so I'm not sure what kind of >> "gotcha" you're trying to pull here. Berkman incubated Global Voices (but >> did not receive USG funding for it, nor has GV ever received USG money to >> my knowledge), and Berkman received USG funding for *research*. I don't >> see what either of those facts have to do with USG funding of *tools* *or >> trainings*, both of which have direct impact on individuals (whereas >> research does not, though of course impact may be indirect). >> >> To be clear, I'm not wholly opposed to USG funding. There are obvious >> pluses and minuses, but speaking narrowly, if we take circumvention as a >> singular example, it's extremely clear that USG has in the past and perhaps >> continues to fund tools that are not vetted, not secure, and not safe. Add >> to that the fact that some folks in MENA, and likely elsewhere, don't trust >> the USG, tool developers would be well-advised to tread with caution. >> >> You may think this debate is off the mark, and again, it is clearly not >> relevant to the original thread (and for that I apologize). But given that >> it's at the top of the list for discussion at *every single Arab >> blogging-type event I've ever been to*, I don't think you're in a place >> to call it irrelevant. >> >> Best, >> Jillian >> >> >> On Tue, Nov 29, 2011 at 3:02 PM, Katrin Verclas <katrin(a)mobileactive.org>wrote: >> >>> Eh, Jillian - it's not that your former employer, the Berkman Center, >>> ever received USG funding or supported a bloggers network...oh wait... >>> >>> I think this debate is really off the mark, unhelpful and needlessly >>> ideologically narrow as well as playing into all sorts of conspiracy >>> theories. In the end, the ethics, quality of the work and the transparent >>> conduct and legitimacy of the organization and any local partners speaks >>> far louder than where the funding comes from. And yes, speaking as a USG >>> grantee who treads very carefully to make sure that our work and conduct >>> speaks for itself in the end. >>> >>> Now, go ahead and beat on me as y'all are want to do ... :) >>> >>> Katrin >>> >>> On Nov 29, 2011, at 2:16 PM, Jillian C. York wrote: >>> >>> > I'm desperately curious as to why anyone thinks that USG funding makes >>> something somehow more valid in the eyes of the tool's recipients/users. >>> "Viability" perhaps, but validity? Surely you don't believe that. >>> > >>> > On Tue, Nov 29, 2011 at 10:53 AM, Michael Rogers <m--(a)gmx.com> wrote: >>> > Hi Brian, >>> > >>> > Thanks for the questions - answers below. >>> > >>> > On 29/11/11 18:22, Brian Conley wrote: >>> > > 1. what are some use-cases you see for Briar? That is not clear from >>> > > your site, other than "Briar is a secure news and discussion >>> > > system designed to be used by journalists, activists and civil >>> society >>> > > groups in authoritarian countries. " >>> > > >>> > > How would they use it? What would they do with it? What are their >>> goals, >>> > > and for what reasons would they choose Briar over, say, secret >>> Facebook >>> > > groups run over TOR and HTTPS (there may be lots of problems with >>> that >>> > > example, its just an example that I think activists are likely to >>> > > utilize, and I know of at least one case where a "secret facebook >>> group" >>> > > has been used to coordinate actions in an Arab country, though I >>> doubt >>> > > they were using any additional security in most cases) >>> > >>> > I hope people will use Briar for anything they currently use blogs, >>> > mailing lists, Facebook groups and private emails for. But since it's >>> > inconvenient to adopt new tools, I'd imagine its main appeal will be to >>> > users who feel they're at risk of surveillance or censorship. >>> > >>> > When compared to Facebook, the advantages of Briar would include: >>> > * Messages can be posted anonymously or pseudonymously >>> > * Facebook and its partners don't have access to private messages >>> > * Users in the same country don't need to "climb the wall" to >>> > communicate with each other >>> > >>> > Of course, there are disadvantages too - not least of which is that >>> > Facebook can be accessed from any computer with a browser. >>> > >>> > > With regard to its use by journalists especially, how will sources be >>> > > able to be identified? Although you may not want people to know that >>> > > Brian Joel Conley who lives in Portland OR, etc said X, Y, and Z, a >>> > > journalist will need to know that X, Y, and Z were all said by the >>> same >>> > > source, among other needs. >>> > >>> > If someone needs to prove that two or more messages come from the same >>> > source, she can sign those messages with a pseudonym. The pseudonym >>> > doesn't need to be connected to her real identity in any way, and she >>> > can use multiple pseudonyms without anyone, including her trusted >>> > contacts, being certain that those pseudonyms belong to her. >>> > >>> > If someone needs to confirm that a pseudonym belongs to a specific >>> > individual, she has to meet that individual face-to-face. Briar has >>> > nothing equivalent to PGP's web of trust that could be used to attest >>> > that "key X belongs to person Y according to person Z". >>> > >>> > > 2. who is funding your project? Are you being public about this? If >>> not, >>> > > it raises some concerns for the validity and viability of the >>> project, >>> > > though it may also be understandable given the subject matter. If >>> it's >>> > > not being funded by the Broadcast Board of Governors already, and >>> you're >>> > > willing to consider USG funding, let me know and I'm happy to put >>> you in >>> > > touch with some folks who may be able to assist. >>> > >>> > Thanks, that would be fantastic! The project has previously been funded >>> > by the Small Media Initiative but isn't currently receiving any >>> funding. >>> > If we do, we'll be transparent about it. >>> > >>> > Cheers, >>> > Michael >>> > _______________________________________________ >>> > liberationtech mailing list >>> > liberationtech(a)lists.stanford.edu >>> > >>> > Should you need to change your subscription options, please go to: >>> > >>> > https://mailman.stanford.edu/mailman/listinfo/liberationtech >>> > >>> > If you would like to receive a daily digest, click "yes" (once you >>> click above) next to "would you like to receive list mail batched in a >>> daily digest?" >>> > >>> > You will need the user name and password you receive from the list >>> moderator in monthly reminders. >>> > >>> > Should you need immediate assistance, please contact the list >>> moderator. >>> > >>> > Please don't forget to follow us on >>> http://twitter.com/#!/Liberationtech >>> > >>> > >>> > >>> > -- >>> > jilliancyork.com | @jilliancyork | tel: +1-857-891-4244 | google >>> voice: +1-415-562-JILL >>> > >>> > >>> > >>> > _______________________________________________ >>> > liberationtech mailing list >>> > liberationtech(a)lists.stanford.edu >>> > >>> > Should you need to change your subscription options, please go to: >>> > >>> > https://mailman.stanford.edu/mailman/listinfo/liberationtech >>> > >>> > If you would like to receive a daily digest, click "yes" (once you >>> click above) next to "would you like to receive list mail batched in a >>> daily digest?" >>> > >>> > You will need the user name and password you receive from the list >>> moderator in monthly reminders. >>> > >>> > Should you need immediate assistance, please contact the list >>> moderator. >>> > >>> > Please don't forget to follow us on >>> http://twitter.com/#!/Liberationtech >>> >>> >>> Katrin Verclas >>> MobileActive.org >>> katrin(a)mobileactive.org >>> >>> skype/twitter: katrinskaya >>> (347) 281-7191 >>> >>> Check out the new Mobile Media Toolkit at >>> http://mobilemediatoolkit.org. To "Making Media Mobile!" >>> >>> A global network of people using mobile technology for social impact >>> http://mobileactive.org >>> >>> >> >> >> -- >> jilliancyork.com | @jilliancyork | tel: +1-857-891-4244 | google voice: >> +1-415-562-JILL >> >> >> >> >> _______________________________________________ >> liberationtech mailing list >> liberationtech(a)lists.stanford.edu >> >> Should you need to change your subscription options, please go to: >> >> https://mailman.stanford.edu/mailman/listinfo/liberationtech >> >> If you would like to receive a daily digest, click "yes" (once you click >> above) next to "would you like to receive list mail batched in a daily >> digest?" >> >> You will need the user name and password you receive from the list >> moderator in monthly reminders. >> >> Should you need immediate assistance, please contact the list moderator. >> >> Please don't forget to follow us on http://twitter.com/#!/Liberationtech >> > > > > -- > > > > Brian Conley > > Director, Small World News > > http://smallworldnews.tv > > m: 646.285.2046 > > Skype: brianjoelconley > > > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click > above) next to "would you like to receive list mail batched in a daily > digest?" > > You will need the user name and password you receive from the list > moderator in monthly reminders. > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech > _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: nym-0.2 released (fwd)
by cyphrpunk 06 Jul '18

06 Jul '18

On 9/30/05, Jason Holt <jason(a)lunkwill.org> wrote: > http://www.lunkwill.org/src/nym/ > ... > My proposal for using this to enable tor users to play at Wikipedia is as > follows: > > 1. Install a token server on a public IP. The token server can optionally be > provided Wikipedia's blocked-IP list and refuse to issue tokens to offending > IPs. Tor users use their real IP to obtain a blinded token. > > 2. Install a CA as a hidden service. Tor users use their unblinded tokens to > obtain a client certificate, which they install in their browser. > > 3. Install a wikipedia-gateway SSL web proxy (optionally also a hidden service) > which checks client certs and communicates a client identifier to MediaWiki, > which MediaWiki will use in place of the REMOTE_ADDR (client IP address) for > connections from the proxy. When a user misbehaves, Wikipedia admins block the > client identifier just as they would have blocked an offending IP address. All these degrees of indirection look good on paper but are problematic in practice. Each link in this chain has to trust all the others. Whether the token server issues tokens freely, or the CA issues certificates freely, or the gateway proxy creates client identifiers freely, any of these can destroy the security properties of the system. Hence it makes sense for all of them to be run by a single entity. There can of course be multiple independent such pseudonym services, each with its own policies. In particular it is not clear that the use of a CA and a client certificate buys you anything. Why not skip that step and allow the gateway proxy simply to use tokens as user identifiers? Misbehaving users get their tokens blacklisted. There are two problems with providing client identifiers to Wikipedia. The first is as discussed elsewhere, that making persistent pseudonyms such as client identifiers (rather than pure certifications of complaint-freeness) available to end services like Wikipedia hurts privacy and is vulnerable to future exposure due to the lack of forward secrecy. The second is that the necessary changes to the Wikipedia software are probably more extensive than they might sound. Wikipedia tags each ("anonymous") edit with the IP address from which it came. This information is displayed on the history page and is used widely throughout the site. Changing Wikipedia to use some other kind of identifier is likely to have far-reaching ramifications. Unless you can provide this "client idenfier" as a sort of virtual IP (fits in 32 bits) which you don't mind being displayed everywhere on the site (see objection 1), it is going to be expensive to implement on the wiki side. The simpler solution is to have the gateway proxy not be a hidden service but to be a public service on the net which has its own exit IP addresses. It would be a sort of "virtual ISP" which helps anonymous users to gain the rights and privileges of the identified, including putting their reputations at risk if they misbehave. This solution works out of the box for Wikipedia and other wikis, for blog comments, and for any other HTTP service which is subject to abuse by anonymous users. I suggest that you adapt your software to this usage model, which is more general and probably easier to implement. CP ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.leitl.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: Anonymity questions
by Michael Holstein 06 Jul '18

06 Jul '18

I've thought about this too (and the BGP routing thing I hadn't heard, but I was aware that ATT, et.al. were being NSA-friendly by routing international calls through US-based switches) -- but if they do it for voice, they do it for data, since to AT&T, it's all really data anyway. So how about this as a proposed solution: Rather than encrypt individual TCP streams, allow the TOR nodes (or at least the intermediates) to do GRE or IPSEC, and then route multiple streams (each themselves encrypted) inside a seperately encrypted tunnel. This would make it impossible (er...more difficult) for someone to match traffic entering with traffic exiting (assuming sufficient padding and whatnot to keep traffic fairly constant). Unless you can pick a large "burst" out of the other chatter, you'd make it signifigantly harder to trackback on an individual stream. Sort of like a mesh-network of opportunistically created VPNs -- creating an encrypted "cloud". I think this is sort of what the Freedom network tried to do commercially a few years ago. Another advantage of this might be the ability to actually use BGP tables to assist in routing, since at this point, you'd have created an encrypted "overlay internet". Those tables could then be manipulated with control traffic inside the cloud to deal with ensuring traffic is routed through multiple countries (or around certian ones). The other advantage of a GRE/IPsec approach would be the ability to carry any type of traffic, not just TCP. Thoughts? Michael Holstein CISSP GCIA Cleveland State University ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [liberationtech] Not another Haystack right?
by Evgeny Morozov 06 Jul '18

06 Jul '18

I was intrigued by two issues on this thread: 1) Brian Conley's question about why BBG's support to Tor does not seem to undermine Tor. 2) Jillian York's statement that the Berkman Center has only received funding for research, which, pushed one step further, means that research of circumvention tools is somehow inconsequential to the broader debate about USG's support of such tools. To Brian's question: I'm also very intrigued by this. The common explanation that I heard many times is that Tor was conceived as a tool for protecting one's online anonymity , not for circumventing government censorship; the latter was something that users discovered and embraced on their own. While I found this explanation plausible in the past, I'm no longer sure I can buy it without some further evidence. Were Tor's developers really that narrow-minded as not to understand that the tool can also be used for circumventing censorship? We are talking some of the smartest guys out there - and they couldn't anticipate it? Something here doesn't compute. Or was the anonymity talk just a strategic rhetorical device to deflect attention from the intended use? I haven't read all the relevant mailing lists and am just articulating common wisdom so it would be good if some people who have been involved with Tor for a long time would comment. Secondly, there is another common explanation for Tor's resilience: the fact that instead of going after a particular country, they try to be comprehensive and guard against any threats to users' online anonymity regardless of their location (this is obviously my understanding - please correct if I don't get it right). By this logic, tools that take USG funding and go after a particular country (as, say, Haystack did) make themselves vulnerable to certain conspiracy theories. But this argument, too, doesn't convince me anymore now that Iran has been going after Tor quite systematically and the Tor team have been modifying their product to ensure it works there. My question is: for how long can Tor continue being seen as neutral and not targeting country X if so much of their resources is spent on making sure their tool works in country X? As for Jillian's assertion that research of circumvention tools is somehow conceptually and ethically different from tool-building or training, well, allow me to disagree. One doesn't need to get in bed with Foucault to grasp that a detailed study of circumvention tools - e.g. ranking of their security features and their choice of tools that they won't study or speculate upon (hello, Haystack!) - is not only performative but is also intricately implicated in the *production *of those very tools (and I'm using the word production here rather loosely). Are we really naive enough to believe that a "Tool X, as certified by Harvard University" is the same as a "Tool X, as certified by The State University of Ubeki-beki-beki-beki-stan-stan"? I'd venture that, all things being equal, a tool that is funded by USG and endorsed by Harvard is likely to be less suspicious (to local users) than a tool that is funded by USG and not endorsed by anyone. (There are, exceptions, of course). So I'd rather not spare the well-meaning researchers the scrutiny deserve Please note that this is not some meta-point about the ethics of taking (and offering) USG money to activists and NGOs; my views on this quite complex. It's simply an expression of my continued besument at some folks at the Berkman Center who keep pretending that none of this matters and that "they are only here to help". Evgeny On Tue, Nov 29, 2011 at 5:05 PM, Brian Conley <brianc(a)smallworldnews.tv>wrote: > Also, GV is avowedly opposed to taking USG funding, as it's been related > to me recently by Ivan Sigal, their Executive Director. I believe they have > always been opposed to it, including funding via a pass through or as a > subcontractor or subgrant receiver. My understanding is that this is > primarily due to the attitude about USG funding in the Middle East, whereas > GV *does* receive funding from other organizations connected to governments > other than the United States. > > Brian > > > On Tue, Nov 29, 2011 at 3:58 PM, Jillian C. York <jilliancyork(a)gmail.com>wrote: > >> Katrin, >> >> First off, while this debate may not be pertinent *to this thread*(admittedly, I only brought it up because I misunderstood Brian's >> comments), I do think it's a useful discussion to have, as many tool >> developers don't seem to think about the impact of their funding on users. >> >> Now, facts: I've been publicly critical of USG (and specifically, >> State/DRL) funding since I worked at Berkman, so I'm not sure what kind of >> "gotcha" you're trying to pull here. Berkman incubated Global Voices (but >> did not receive USG funding for it, nor has GV ever received USG money to >> my knowledge), and Berkman received USG funding for *research*. I don't >> see what either of those facts have to do with USG funding of *tools* *or >> trainings*, both of which have direct impact on individuals (whereas >> research does not, though of course impact may be indirect). >> >> To be clear, I'm not wholly opposed to USG funding. There are obvious >> pluses and minuses, but speaking narrowly, if we take circumvention as a >> singular example, it's extremely clear that USG has in the past and perhaps >> continues to fund tools that are not vetted, not secure, and not safe. Add >> to that the fact that some folks in MENA, and likely elsewhere, don't trust >> the USG, tool developers would be well-advised to tread with caution. >> >> You may think this debate is off the mark, and again, it is clearly not >> relevant to the original thread (and for that I apologize). But given that >> it's at the top of the list for discussion at *every single Arab >> blogging-type event I've ever been to*, I don't think you're in a place >> to call it irrelevant. >> >> Best, >> Jillian >> >> >> On Tue, Nov 29, 2011 at 3:02 PM, Katrin Verclas <katrin(a)mobileactive.org>wrote: >> >>> Eh, Jillian - it's not that your former employer, the Berkman Center, >>> ever received USG funding or supported a bloggers network...oh wait... >>> >>> I think this debate is really off the mark, unhelpful and needlessly >>> ideologically narrow as well as playing into all sorts of conspiracy >>> theories. In the end, the ethics, quality of the work and the transparent >>> conduct and legitimacy of the organization and any local partners speaks >>> far louder than where the funding comes from. And yes, speaking as a USG >>> grantee who treads very carefully to make sure that our work and conduct >>> speaks for itself in the end. >>> >>> Now, go ahead and beat on me as y'all are want to do ... :) >>> >>> Katrin >>> >>> On Nov 29, 2011, at 2:16 PM, Jillian C. York wrote: >>> >>> > I'm desperately curious as to why anyone thinks that USG funding makes >>> something somehow more valid in the eyes of the tool's recipients/users. >>> "Viability" perhaps, but validity? Surely you don't believe that. >>> > >>> > On Tue, Nov 29, 2011 at 10:53 AM, Michael Rogers <m--(a)gmx.com> wrote: >>> > Hi Brian, >>> > >>> > Thanks for the questions - answers below. >>> > >>> > On 29/11/11 18:22, Brian Conley wrote: >>> > > 1. what are some use-cases you see for Briar? That is not clear from >>> > > your site, other than "Briar is a secure news and discussion >>> > > system designed to be used by journalists, activists and civil >>> society >>> > > groups in authoritarian countries. " >>> > > >>> > > How would they use it? What would they do with it? What are their >>> goals, >>> > > and for what reasons would they choose Briar over, say, secret >>> Facebook >>> > > groups run over TOR and HTTPS (there may be lots of problems with >>> that >>> > > example, its just an example that I think activists are likely to >>> > > utilize, and I know of at least one case where a "secret facebook >>> group" >>> > > has been used to coordinate actions in an Arab country, though I >>> doubt >>> > > they were using any additional security in most cases) >>> > >>> > I hope people will use Briar for anything they currently use blogs, >>> > mailing lists, Facebook groups and private emails for. But since it's >>> > inconvenient to adopt new tools, I'd imagine its main appeal will be to >>> > users who feel they're at risk of surveillance or censorship. >>> > >>> > When compared to Facebook, the advantages of Briar would include: >>> > * Messages can be posted anonymously or pseudonymously >>> > * Facebook and its partners don't have access to private messages >>> > * Users in the same country don't need to "climb the wall" to >>> > communicate with each other >>> > >>> > Of course, there are disadvantages too - not least of which is that >>> > Facebook can be accessed from any computer with a browser. >>> > >>> > > With regard to its use by journalists especially, how will sources be >>> > > able to be identified? Although you may not want people to know that >>> > > Brian Joel Conley who lives in Portland OR, etc said X, Y, and Z, a >>> > > journalist will need to know that X, Y, and Z were all said by the >>> same >>> > > source, among other needs. >>> > >>> > If someone needs to prove that two or more messages come from the same >>> > source, she can sign those messages with a pseudonym. The pseudonym >>> > doesn't need to be connected to her real identity in any way, and she >>> > can use multiple pseudonyms without anyone, including her trusted >>> > contacts, being certain that those pseudonyms belong to her. >>> > >>> > If someone needs to confirm that a pseudonym belongs to a specific >>> > individual, she has to meet that individual face-to-face. Briar has >>> > nothing equivalent to PGP's web of trust that could be used to attest >>> > that "key X belongs to person Y according to person Z". >>> > >>> > > 2. who is funding your project? Are you being public about this? If >>> not, >>> > > it raises some concerns for the validity and viability of the >>> project, >>> > > though it may also be understandable given the subject matter. If >>> it's >>> > > not being funded by the Broadcast Board of Governors already, and >>> you're >>> > > willing to consider USG funding, let me know and I'm happy to put >>> you in >>> > > touch with some folks who may be able to assist. >>> > >>> > Thanks, that would be fantastic! The project has previously been funded >>> > by the Small Media Initiative but isn't currently receiving any >>> funding. >>> > If we do, we'll be transparent about it. >>> > >>> > Cheers, >>> > Michael >>> > _______________________________________________ >>> > liberationtech mailing list >>> > liberationtech(a)lists.stanford.edu >>> > >>> > Should you need to change your subscription options, please go to: >>> > >>> > https://mailman.stanford.edu/mailman/listinfo/liberationtech >>> > >>> > If you would like to receive a daily digest, click "yes" (once you >>> click above) next to "would you like to receive list mail batched in a >>> daily digest?" >>> > >>> > You will need the user name and password you receive from the list >>> moderator in monthly reminders. >>> > >>> > Should you need immediate assistance, please contact the list >>> moderator. >>> > >>> > Please don't forget to follow us on >>> http://twitter.com/#!/Liberationtech >>> > >>> > >>> > >>> > -- >>> > jilliancyork.com | @jilliancyork | tel: +1-857-891-4244 | google >>> voice: +1-415-562-JILL >>> > >>> > >>> > >>> > _______________________________________________ >>> > liberationtech mailing list >>> > liberationtech(a)lists.stanford.edu >>> > >>> > Should you need to change your subscription options, please go to: >>> > >>> > https://mailman.stanford.edu/mailman/listinfo/liberationtech >>> > >>> > If you would like to receive a daily digest, click "yes" (once you >>> click above) next to "would you like to receive list mail batched in a >>> daily digest?" >>> > >>> > You will need the user name and password you receive from the list >>> moderator in monthly reminders. >>> > >>> > Should you need immediate assistance, please contact the list >>> moderator. >>> > >>> > Please don't forget to follow us on >>> http://twitter.com/#!/Liberationtech >>> >>> >>> Katrin Verclas >>> MobileActive.org >>> katrin(a)mobileactive.org >>> >>> skype/twitter: katrinskaya >>> (347) 281-7191 >>> >>> Check out the new Mobile Media Toolkit at >>> http://mobilemediatoolkit.org. To "Making Media Mobile!" >>> >>> A global network of people using mobile technology for social impact >>> http://mobileactive.org >>> >>> >> >> >> -- >> jilliancyork.com | @jilliancyork | tel: +1-857-891-4244 | google voice: >> +1-415-562-JILL >> >> >> >> >> _______________________________________________ >> liberationtech mailing list >> liberationtech(a)lists.stanford.edu >> >> Should you need to change your subscription options, please go to: >> >> https://mailman.stanford.edu/mailman/listinfo/liberationtech >> >> If you would like to receive a daily digest, click "yes" (once you click >> above) next to "would you like to receive list mail batched in a daily >> digest?" >> >> You will need the user name and password you receive from the list >> moderator in monthly reminders. >> >> Should you need immediate assistance, please contact the list moderator. >> >> Please don't forget to follow us on http://twitter.com/#!/Liberationtech >> > > > > -- > > > > Brian Conley > > Director, Small World News > > http://smallworldnews.tv > > m: 646.285.2046 > > Skype: brianjoelconley > > > _______________________________________________ > liberationtech mailing list > liberationtech(a)lists.stanford.edu > > Should you need to change your subscription options, please go to: > > https://mailman.stanford.edu/mailman/listinfo/liberationtech > > If you would like to receive a daily digest, click "yes" (once you click > above) next to "would you like to receive list mail batched in a daily > digest?" > > You will need the user name and password you receive from the list > moderator in monthly reminders. > > Should you need immediate assistance, please contact the list moderator. > > Please don't forget to follow us on http://twitter.com/#!/Liberationtech > _______________________________________________ liberationtech mailing list liberationtech(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/liberationtech If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. Please don't forget to follow us on http://twitter.com/#!/Liberationtech ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Re: <nettime> The Monetary Future: How Bitcoin Is Being Destroyed
by John Haltiwanger 06 Jul '18

06 Jul '18

On Sat, Oct 27, 2012 at 3:14 PM, Eugen Leitl <eugen(a)leitl.org> wrote: <...> > When I'm trying to form an opinion about something, I try to research it > first. In general I did not care about minting other than a means to > obtain play money to test transactions. I find this curious that so many > are focusing on the most irrelevant aspect of a P2P monetary system, the > distributed mint, and expect a personal, handsome profit from > seigniorage. There's a reason that difficulty is adaptive. The system is > supposed to homeostate so that the rate of production is limited. This is > by design. Limiting the rate of production as an inverse to popularity is an interesting choice, and worth experimenting with. It increases the effects of existing vertical dynamics, however, as those that already have coins and/or mining facilities wield increasing power as those new to the game, eager to participate, have only these vertical actors as recourse to engage in the currency. > > > This is a currency based on scarcity, just like gold or cowry shells. > > > If you intended to become rich by mining, you should have been a year > > > or two sooner to the party. I would like to comment further on the cowry shell concept at a later time, but I want to point out that cowry shells are renewed along life cycles---as a currency it exhibits the notion that an absolute total number of 'credits' is not a healthy concept. That there is a maximum to the number of bitcoins is a major reason why I say that it is inherently flawed. > > you are saying proves my point about the stupidity of building a > > currency on scarcity: it's not going to lead us to anywhere new > > I understand when inventors and patent holders of cryptocurrencies > scoffed at the first cryptocurrency to succeed wildly, by solving the > issue of double spending without resorting to centralism, and hence a > single point of failure. A simple case of sour grapes. > > What is your track record, so far? > > or 'revolutionary'. > > If you figure out a tamper-proof way of measuring underlying economy and > a tamper-proof way of issuing a matching volume without any single point > of failures, feel free to publish. It will make quite a splash, I assure > you. It is interesting how you seem to conflate my right to make critical statements about BitCoin with the amount of success I have had in launching my own currency. > > You have to 'get there first' and 'mine harder/smarter'. What stupid > > advice, "oh you should have been there earlier". > > Look, I just pointed out the problem with where you focus and your > approach. If you think that issuing P2P currency with the intent to make > a personal profit is stupid, I agree. But isn't this exactly what BitCoin does when it gives those with the most capital to put into the system the ability to become (the most successful) mints? Wouldn't that be a significant reason that it has been so 'wildly' successful, namely that there are a finite number of bitcoins and if one approaches with a 'collect them all' attitude then PROFIT. A P2P currency should strive to limit the effects of capital-derived vertical dynamics. This means that joining "two years too late" does not put someone at a significant disadvantage. (And yes, in my opinion, having to purchase BitCoins from someone who 'got there first' in order to engage in the currency is a significant disadvantage). > > > The value of bitcoin is ability to do P2P transactions in real time > > > without requiring a third party, using a naturally deflationary > > > monetary system which however is highly frangible. > > > > > > That by itself is of obvious enough utility. > > > > That is about the only interesting thing about it, yes. But the ability > > to engage in P2P transactions is hardly a result of the means of the > > Why are you so focused on production? The flippant answer would by: why aren't you? I don't see the point in buying into a currency where the actual unit of value reinforces existing vertical dynamics: cash to make a mine, earliness of adoption, hoarding of resources. Let's say that you seem content with a currency that embodies libertarian ideals, and that I am not. > > currency's production, nor is it a feature unique to bitcoin itself. > > As compared to which successful digicash system, exactly? BitCoins successes outside of the Silk Road (a brilliant hack, FWIW) is highly debatable. My point is that P2P currencies in general have these aspects. As you can tell, I only really care about the first one. > > Also "naturally deflationary" in the scope of something that is more > > Deflationary in the sense is that the total amount is limited, and will > be approached asymptotically. > > > hoarded than traded seems like a misnomer to me. Since there are a > > limited > > If you want the currency to be useful, you need to grow the underlying > economy, so people are more incited to spend than to be unable to spend. > > So what kind of business that is accepting BTC are you running, > personally? First I tell you that I do not believe in the currency, and then you ask why I'm not building a business around it? > > number of bitcoins, there is a "natural" tendency to hold on to as many > > of them as possible. That way when the pie is all spoken for, one's > > slices > > Nobody prevents you from designing a P2P cryptocurrency with built-in > demurrage. > > You're hating on an experiment. As I understand the designer was unhappy > with the rate of adoption, it would be indeed been much better if the > minting craze didn't happen. I don't think that flaw needs to be fatal. Nowhere did I say anything about hate. The first respondant, Nick, said he was interested to "read more about the interplay of traditional capitalist power structures and bitcoin." My response is that bitcoin does very little to escape these traditional power structures, as is evidenced by the fact that only the privileged can play, and the more people that are playing the more privileged you have to be to engage. # distributed via <nettime>: no commercial use without permission # <nettime> is a moderated mailing list for net criticism, # collaborative text filtering and cultural politics of the nets # more info: http://mx.kein.org/mailman/listinfo/nettime-l # archive: http://www.nettime.org contact: nettime(a)kein.org ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0