- cypherpunks-legacy - lists.cpunks.org

Insecurity in WWW oriented security
by Tim Scanlon 17 Dec '03

17 Dec '03

I wanted to share an experience with folks on the list that points to the relavince of what c'punks have been doing looking at the Web encryption & security issues like we have. I was approached by a headhunter yesterday who wanted me to do the security for a hospital connected to the net. Straightforward stuff one would think. My inital reaction was fairly positive, and I responded that I didn't think I would have much trouble with the task as long as they had a resonable setup internaly etc. etc. (I'm not a big beliver in hard & crunchy -> soft & chewey when your accounting or other critical data is part of what can be chewed up...) Well at that point it got interesting. He told me that said client was asking as a part of their requirments that they be able to do "Secure transactions using HTML & Netscape". My reaction was somwehere allong the lines of "What do they mean by `secure transactions'!! Are they aware that the state of encryption for WWW is really poor at best right now? I told him that I thought this might not be such a hot idea, and that my interest in this whole thing would hinge totaly upon exactly what sorts of transactions they wanted to do using web servers and the like. And that depending on the answer to that, I would or would not be intrested in the whole thing. The reason for my hesitation? I don't want blood on my hands over a setup that is by definition currently in a state of very poor security. And right now I have no idea if they want to transfer MasterCard's or MRI's. But I do know that depending on what it is they're planning, it might not be a place *I* want to be. Besides being damned frightening, this points to a trend in network evolution. Organizations are planning these sorts of moves and utilizations of the technology with little thought to the possible consequences of it. And if the FBI ends up busting some psyco in the future for tampering with the transactions of MRI data, x-rays, or any of a million other possibilities, I seriously doubt that Loius Freeh will be stepping forward to remind us all of the need for robust security. Instead, it is far more likely that he would argue that it was another example of the need for increased monitoring of the internet and controls on cryptographic solutions. I found aspects of the whole conversation, juxtaposed with what has been going on lately with the list chilling to say the least. Tim Scanlon ________________________________________________________________ tfs(a)vampire.science.gmu.edu (NeXTmail, MIME) Tim Scanlon George Mason University (PGP key avail.) Public Affairs I speak for myself, but often claim demonic possession

2 1

Re: Cypherpunks Press release
by tcmay＠got.net 17 Dec '03

17 Dec '03

I guess you all know how much I hate this "who will be our spokesman?" thread, but my opinion has been explicitly asked, so I will again comment. Hopefully, adding a few new points. At 6:55 AM 9/26/95, Craig Hubley wrote: >Damn fine idea, but how do a bunch of (p)anarchists choose a mouthpiece ? >Should we assign someone to be 'our' lawyer ? > >I'd volunteer to be 'spokespunk', I've certainly been interviewed for TV and >print enough, and know how to handle and present myself to the press, but if >this is considered an 'honor' rather than a 'pain in the ass and potential >legal lightning rod' then I'd like to suggest someone with a longer pedigree >who has been writing more code lately take it on. Tim ? I've turned down several recent chances for interviews, for these reasons: 1. I feel the people doing the work should be interviewed, not just someone who has some visibility (whatever mine might be). If PGP is the issue, then they should talk to those working on PGP. If anonymous remailers are the issue, etc. If, by some chance, they are interested in things I have directly worked on or written extensively about, then maybe they should interview me. (Although for other reasons I refused to have my name attached to the cover story in "Information Week" about "Internet Theft," BlackNet, etc.) 2. Location, location, location! The media foci are Washington, New York, and San Francisco, at least for our area of interest. Occasional forays into Austin, Miami, L.A., etc. This is where the taped interviews are done. Several "crews" recently in SF wanted "sound bites" and "video bites" from people like me. I refused, pointing out the wastefullness of my time in driving 100 miles over mountain roads to SF, fighting parking problems, waiting around, and ending up with a 7.89 second clip of me saying something scripted. (In February I stupidly agreed to travel to LA for a filming of a BBC show about encryption. Left at dawn, drove to San Jose, flew to LA, took shuttle to Hollywood, waited around for several hours while crew finished taping Alvin and Heidi Toffler, set up my laptop, was interviewed by show's producer, agreed at her repeated prodding to say "I am a Cypherpunk." Got back to my house at midnight. Guess what they used? The stupid line "I am a Cypherpunk" and maybe about 20 seconds of other random comments. This is what we face, as other high tech shows I see have the same disjointed, out-of-context flavor.) The point? These "journalists" are tuned to looking for catchy quotes, all the more so on video than in print. Text journalists can handle complex themes much better than video reporters can, for many and oft-discussed reasons. (Even more disgusting than this was a more recent appearance of a BBC film crew at a Cypherpunks meeting. They wanted to "stage" the news, to have the meeting discuss a 2-year-old topic, because that's what their script called for. I got up and left, as did several other people. I haven't seen this BBC show, but I gather from a URL that this is the one that has "performance art" examples of crypto....) Any "spokesman" needs to be easily accessible when they need a "filler quote," or a "reaction quote." However: 3. THERE IS NO SPOKESMAN, THERE IS NO CENTRAL OFFICE, THERE IS NO BOARD OF DIRECTORS! With no organization, no office, no coordination, we cannot "feed the media machine" the way it expects to be fed. Nor can we "elect" such folks. I didn't help start this list--not that this gives me more moral sway--in order that J. Random Volunteer will start speaking for "our beliefs" or will start explaining "our goals" and "our plans." Far better that journalists like Steven Levy and John Markoff subsribe to the list, or to condensations by people like Eric Blossom, and then deal directly with the experts in some area. Thus, on the latest Netscape flaw, they would contact Ray Cromwell directly, not deal with the press releases written by J. Random Volunteer. Anarchy is part of our charm. More importantly, part of our theme. Face it, we don't have a press office, we don't have staffing, and--most importantly--there is no one out there who speaks for me. A spokesman for the Cypherpunks is an oxymoron. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

7 6

Re: SSL search attack
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 07:25 9/1/95, Daniel R. Oelke wrote: >> >> I see nothing wrong with the concept of being allocated an initial chunk >> and having the scan software attempt to ACK it when 50% of it has been >> searched. A successful ACK would allow the releasing of a new chunk (in >> response) equal in size to the returned chunk. A failure of the Server to >> accept the ACK would trigger a retry at set intervals (such as 75% and 100% >> or 60/70/80/90/100%) until the Server responds. Thus the scanner is always >> in possession of a Full Sized Chuck to scan (so long as the Server accepts >> an ACK before the 100% done mark) and temporary failures will not stop the >> process of a scanner as currently happens. >> > >The only way this can work is if the server is told it is a 50%/75%/etc >size ACK, and then latter the server is ACKed for the full 100%. > >Why? Because what happens if the client dies immediately after doing >the ACK - maybe only 51% of that space has been searched, yet >the server has already seen an ACK for it. I thought that the ACK gives starting location and number of segments. If I get 500 segments and ACK at the 50% point I am sending an ACK for the Starting Point and 250 Segments (the unprocessed part would then ACK Start+250 for 250 when done) Just as of I had only gotten 250 in the first place and was also given the next 250 Segment Chunk (ie: I was "Next Requester" after my original allocation of 250). >IMO - a % ACK is to much complexity and extra work on the server, >which is already having trouble keeping up. No - It is the same load if you allow the first request to be twice the size of the subsequent requests. If you ask people to request 30 minutes worth of segments, there is no difference in load (if the Server responds to each ACK when first attempted) if they start each run with a 1 hour chunk (ie: 2X Chunk) and check in every 30 min to ACK a Chunk (and to get the one to be worked on in a half an hour [and when you are 30 minutes away from your shut down time, just ACK and do not request another chunk]) and just getting a X sized chunk at your initial connection. In the 2X method, you still have a X sized Chunk to work on for the next 30 Minutes if the Server is ignoring your ACK attempt (and when that Chunk has been scanned you return both and get two more). This is hitting the Server once every 30 minutes and NOT pounding away at it until you get an ACK through (and more get more work) since you have no need for another chunk immediately (as you would with the X sized Chunk every 30 minutes method) and thus have no need to retry on a connect failure.

1 0

Re: Hack Microsoft?
by todd＠lgt.com 17 Dec '03

17 Dec '03

Ray scribes: > Microsoft recently got C2-security status approved for Windows NT by >the National Computer Security Center, a division of the NSA. They >are supposed to put systems through "laborious testing and review" before >they approve C2. Not so laborious, the brunt of C1 and C2 testing is accomplished by a test suites that do topical levels only. The issue is that there is a NCSC engineer watching it happen. Hence if oit passes it is "blessed". As per the orange book itself, C2 is about the lowest level of "Secure" that you can get. In fact if Microsoft had gone to the trouble of a B1 or B2 rating this would have been impressive but since most systems analysts have not been familiarized with the levels of system accounting and access control/logging that represents the various levels of "Orange Book" Rating it is somewhat superfluous. >So, if one can find bugs in NT's security, one can >toss a little more egg on the NSA's face and the sham that part of >their activies to *help* to secure american computers. A simple >violation of NT's C2 status would be to demostrate a flaw in it's >memory protection implementation. >Personally, I think NT is >*riddled* with bugs waiting to be discovered. Hell, even the >NT "service pack" is included in the C2 status, which I bet >has plenty of holes. No Doubt; NT should be easily hacked in the upcomming months by any number of mortals let alone the gods themselves. What UNIX has that NT doesn't (which makes it more vuknerable to attack) is 20 more years of evolution, More copies, everybody knows it (at least in our group)... As per NT's orange book C2 Rating... C2 is about the lowest level of Secure that you can get. In fact I personally am unimpressed, rather it is a box on an RFQ that gets checked Very few people run C anything sites in reality. If Microsoft had gone to the trouble of a B1 or B2 rating this would have been cool but since most system's analysts have not been familiarized with the levels of system accounting and access control/logging that represents the various levels of "Orange Book" Rating it is somewhat superfluous. This is especially true since the Folks at the FRB and FDIC/FSLIC orgaizations are more likely to require B2 or the like on the National Standards for "blessed" commerce Engines (I wonder what the FSTC has to say about this?). Seems to me like the "Evil Empire" is just puffing it's chest for a very very small market... IMHO - Military sites passing real classified data usually are not run on anything as low as C2. If you want a secure os, look at the Harris Computer Corp's B1-Certified version of ES/MP UNIX (they call it CX/SX). FOUO - For Official Use Only sites often run C1/C2 based OS's for Audit training but are usually not part of the Trusted Computing Base and as such not real threats. Still the most common problem is human not the OS. Not the actual OS itself,. > > If Cypherpunks can find flaws that the NSA can't, or won't divulge, >what does that say about their so-called COMSEC ability. Not necessarily on the NSA, you have to start somewhere and they do a good job as far as NIST and NCSC efforts are concerned. If you can do better then you have a good career in commercial cracking or will have lots of time on your hands (Federal Food is the Pits, and the golf course is gone from Lompoc!). > >-Ray > > > > Regards, T. S. Glassey Chief Technologist Looking Glass Technologies todd(a)lgt.com -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB1AwUBMFu5E6gNRnWhagU5AQHI+gL+Mwpcd3lAWd8FF06qcG6rnLhIYveHW71a XC7xh1T0uu8qnYX31yMp17OG28jWpKUbWec1IM9/eXOi+gInA7rKICWczV8zo9Z0 0puxjRRN7yO4KfRb3cPpk+r0p6pDg01Y =bTYb -----END PGP SIGNATURE-----

1 0

Re: VISA Electronic Purse
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>Gosh, how many Real Men are going to carry an electronic "purse?" > >Probably the same number of Real Women that are going to carry an >electronic "wallet". > >Eric Most women I know carry a "wallet" in their "purse".

1 0

RE: Does your software?
by agermain＠cmp.com 17 Dec '03

17 Dec '03

I have unsubscribed from this mailing list. Please remove my name from your personal address lists. Thanks. ahg3 ---------- From: Peter Wayner[SMTP:pcw@access.digex.net] Sent: Tuesday, October 24, 1995 2:33 PM To: Dr. Frederick B. Cohen Cc: cypherpunks Subject: Re: Does your software? >My get-only server is available in source form, is 80 lines long and >thus easily understood, has been shown to meet security properties, is >now in the process of being mathematically proven to meet those >properties, and is published in a refereed journal which can be used to >confirm its contents in detail. Hence, I do provide secure distribution >through purely physical means. > Uh, proofs only go so far. There was one Cornell CS professor who was a real devotee of "proving" your programs correct. He even published one of his proofs in a "refereed" journal. Big whoop. It still had an error. Proofs can help identify flaws, but they can never rule out all flaws. That's why their name is so bogus. I wouldn't be surprised if you could prove that the Finger daemon, which is sort of like a really low-level GET-ONLY HTTP server, is also safe. In fact, your math proving ability could probably even prove the pre-Robert Morris finger daemon is safe and secure. If programmers don't think of preventing finger requests longer that 512 bytes then why should the head-in-the-clouds program provers? - Peter >-- >-> See: Info-Sec Heaven at URL http://all.net >Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236 P.S. "FC" is your log in and "FC is found inscribed in the writings of the Unabomber. Coincidence? on't speak officially, were to be torn apart and the ulterior motives speculated upon, I'd either shut up on this list or get off it completely. (Recall that we had Marc Andreessen on this list last December--for whatever reasons, and there are likely several, he left. I recall many attacks on his company. He perhaps figured "What the hell do I need this for?") Legitimate, scientific analysis is commendable. The brute force attack on Netscape was great, and even better was the random seed attack. But many of the attacks are less solid: "How can you people at Digital Datawhack produce such crap? The assumptions you make in the Flogisticon module are disgusting, another example of security through obscenity." (What I think this piling on is likely to accomplish is to push company list subscribers here to just shut up. They see that the more is said by folks from Netscape, as the best current example, the more fireworks and insults ensue. The less that is said the better. This is not a good situation.) I'm not arguing for "niceness," just that some of the edge be taken off the attacks. The "bounties" that are being offered in press releases have the danger of inviting premature announcement of results. And of discouraging companies from actively participating in this list and discussing what might be done to improve security. Just my views. No doubt some will think I'm a shill for some company. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Black Cryptoanarchy (KKK, monopolies, contract killings)
by John Young 17 Dec '03

17 Dec '03

Responding to msg by doug(a)OpenMind.com (Doug Cutrell) on Fri, 9 Sep 12:36 PM: Your critique has elicited some of the best responses I've seen here. There is still, indeed, the task of proving that cryptoanarchy is not itself a play for power by those who write and master its cryptographic code. But better to test that in the public arena rather remain hidden and protected like the state secrecy of governmental cryptography. The state will probably fiercely oppose it, not least by stigmatizing cryptoanarchy and impugning its motives by exaggeration and distortion. (It is worth recalling that classical black anarchy, the secret, lethal version as distinguished from open black flag type, is used by despots to justify their ruthless measures. Black anarchists, as agents of despots, mingle with avowed flag-wavers to spy and provoke acts that lead to repressive crackdowns. Black anarchists never announce themselves as such but may freely admit to being "anarchistic" as a wild-eyed subterfuge. Inept provocations sometimes reveal them but the most able are never detected.) I may be helpful to read one writer's view of how cryptoanarchy may be lumped with and targeted like other stigmatized groups whose attributes it may claim: Quotes are from: "Stigma, Notes on the Management of Spoiled Identity", Erving Goffman, Simon and Schuster, 1963. pp. 143-45: DEVIATIONS AND DEVIANCE One such deviation is important here, the kind presented by individuals who are seen as declining voluntarily and openly to accept the social place accorded them, and who act irregularly and somewhat rebelliously in connection with our basic institutions -- the family, the age-grade system, the stereotyped role-division between the sexes, legitimate full-time employment involving maintenance of a single governmentally ratified personal identity, and segregation by class and race. These are the "disaffiliates." Those who take this stand on their own and by themselves might be called eccentrics or "characters." Those whose activity is collective and focused within some building or place (and often upon a special activity) may be called cultists. Those who come together into a sub-community or milieu may be called "social deviants", and their corporate life a deviant community. They constitute a special type, but only one type, of deviator. If there is to be a field of inquiry called "deviance," it is social deviants as here defined that would presumably constitute its core. Prostitutes, drug addicts, delinquents, criminals, jazz musicians, bohemians, gypsies, carnival workers, hobos, winos, show people, full time gamblers, beach dwellers, homosexuals, and the urban unrepentant poor -- these would be included. These are the folk who are considered to be engaged in some kind of collective denial of the social order. They are perceived as failing to use available opportunity for advancement in the various approved runways of society; they show open disrespect for their betters; they lack piety; they represent failures in the motivational schemes of society. Once the core of social deviancy is established, one can proceed to peripheral instances: community-based political radicals who not only vote in a divergent way but spend more time with those of their own kind than is politically necessary; the traveling rich who are not geared into the executive's work week, and spend their time drifting from one summering place to another; expatriates, employed or not, who routinely wander at least a few steps from the PX and the American Express; the ethnic assimilation backsliders who are reared in the two worlds of the parent society and the society of their parents, and resolutely turn away from the conventional routes of mobility open to them, overlaying their public school socialization with what many normals will see as a grotesque costume of religious orthodoxy; the metropolitan unmarried and merely married who disavail themselves of an opportunity to raise a family, and instead support a vague society that is in rebellion, albeit mild and short-lived, against the family system In almost all of these cases, some show of disaffiliation is made, as is also true of eccentrics and cultists, providing in this way a thin line that can be drawn between all of them and deviators on the other side, namely, the quietly disaffiliated--hobbyists who become so devoted to their avocation that only a husk remains for civil attachments, as in the case of some ardent stamp collectors, club tennis players, and sports car buffs. Social deviants, as defined, flaunt their refusal to accept their place and are temporarily tolerated in this gestural rebellion, providing it is restricted within the ecological boundaries of their community. Like ethnic and racial ghettos, these communities constitute a haven of self-defense and a place where the individual deviator can openly take the line that he is at least as good as anyone else. But in addition, social deviants often feel that they are not merely equal to but better than normals, and that the life they lead is better than that lived by the persons they would otherwise be. Social deviants also provide models of being for restless normals, obtaining not only sympathy but also recruits. (Cultists acquire converts too, of course, but the focus is on programs of action not styles of life.) The wise can become fellow-travelers. p. 25: STIGMA AND SOCIAL IDENTlTY Often those with a particular stigma sponsor a publication of some kind [list cypherpunks?] which gives voice to shared feelings, consolidating and stabilizing for the reader his sense of the realness of "his" group and his attachment to it. Here the ideology of the members is formulated -- their complaints, their aspirations, their politics. The names of well-known friends and enemies of the "group" are cited, along with information to confirm the goodness or the badness of these people. Success stories are printed, tales of heroes of assimilation who have penetrated new areas of normal acceptance. Atrocity tales are recorded, recent and historic, of extreme mistreatment by normals. Exemplary moral tales are provided in biographical and autobiographical form illustrating a desirable code of conduct for the stigmatized. The publication also serves as a forum for presenting some division of opinion as to how the situation of the stigmatized person ought best to be handled. Should the individual's failing require special equipment [crypto?], it is here advertised and reviewed. The readership of these publications provides a market for books and pamphlets which present a similar line. It is important to stress that, in America at least, no matter how small and how badly off a particular stigmatized category is, the viewpoint of its members is likely to be given public presentation of some kind. It can thus be said that Americans who are stigmatized tend to live in a literarily-defined world, however uncultured they might be. If they don't read books on the situation of persons like themselves, they at least read magazines and see movies; and where they don't do these, then they listen to local, vocal associates. An intellectually worked-up version of their point of view is thus available to most stigmatized persons End quotes

1 0

RE: Netscape the Big Win
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>>>> "pfarrell" == Pat Farrell <pfarrell(a)netcom.com> writes: pfarrell> Why are all-in-one programs so preferable to using the pfarrell> windowing capabilities that are built into every X-window, pfarrell> Mac or Windows system? pfarrell> Why not use the best mail client, another best webcrawler, pfarrell> and yet another news reader? The problem is that existing operating environments do not, in general, provide good facilities for the kind of tight integration you really want. Besides, there is nothing wrong with a monolithic application, as long as it provides a sufficiently rich extension language. Take Emacs, for example. Emacs is a monolithic application, but I use different Lisp packages to read news, handle mail, and develop software. (I occasionally even just edit text.) Moreover, I have co-authored a Lisp package to hook PGP functions into *every* Emacs mail and news package, without ever talking to the authors of those packages. In general, any package can be written to seamlessly integrate with any other. In addition, all of these packages work without modification on every variant of Unix, on VMS, on Windows NT, and sometimes even on DOS. I can write in beautiful (and safe) Lisp, and let the Emacs maintainers worry about the idiosynchracies of each operating system. The problem with Netscape currently is that all of their packages are *built in* by Netscape Communications. That is why they have no mail handler, and why their news reader sucks, and why it is impossible for any of us to fix these things or add a PGP front end. Java looks somewhat promising; with it, perhaps Netscape can become a platform-independent system for writing packages to manipulate and display hypertext. It would be like an Emacs for hypertext, but with a crufty extension syntax and no source code. And a user base 1000 times as large... pfarrell> Microsoft has been preaching the use of OLE and component pfarrell> programs as its development vision for 2+ years, Macs have pfarrell> been popular for ten years, why is the trend still towards pfarrell> adding every possible bell and whistle to single programs? These approaches suffer for two reasons. First, it's a pain to incorporate the same basic display code into every package. Second, it's a pain to rewrite the same basic display code for every window system. (Especially when "every window system" means Microsoft, Macintosh, and X.) Other subsystems than display have similar problems (networking comes to mind), but I think display is the major pain in the groin. What Netscape could do is provide the engine for hypertext display, with a sufficiently rich and simple extension language that it would be easy to write new modules. Someone would probably write a decent news reader. Someone else would write a mail handling package. Someone else would write a PGP interface. And so on. Netscape would need to provide other functions across platforms, like TCP sockets, but that isn't impossible: Emacs has done all of this (save graphical display) for over a decade. Gosh, we might find ourselves using 1980 technology by the year 2000. I don't know enough about Netscape's plans for using Java to know whether any of this is likely to happen. I'm not even sure I want to see it happen. But it would be interesting. Cheers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3beta, an Emacs/PGP interface iQCVAwUBMA6aLHr7ES8bepftAQEIVgP9G8p4lV1+Uc+6cpLZW4hMF+k7CYYp2Jp6 xh0qZXW0Sd7STPn+sP/fGPvErauGTlDiyIoW5bTJ9srITtFN8U1Yr7QollQZPqUa 5Rhbu7LjFTmixpdo0wiDTuUiRObnoE4Pj+/27EiamEqG160TjGiHDyCodh/eyFWS 8+R/yT5RCPw= =pja4 -----END PGP SIGNATURE-----

2 1

Re: AIDS testing and privacy
by doug＠OpenMind.com 17 Dec '03

17 Dec '03

Tim May writes on the subject of racist hiring practices: >(It's also part of Libertarianism 101 that such a company would not >likely do well in this day and age. Before you cite America's racist >past, read up on who it was that enforced segregation. Hint: not the >corporations. Ditto for South Africa (the "other" RSA), where the >Apartheid Laws came into being because companies were looking to hire >blacks and coloreds to fill job position, and the whites didn't like >that much.) I'm not sure I buy this argument... who is it that "enforces" discrimination based on sexual orientation, today? If sexual orientation is a matter of status, rather than choice, then this form of discrimination is analogous to racism. Would you suggest that employers that refuse to hire homosexuals are simply bowing to the pressures of society at large? Unlike Apartheid, there are no laws that *enforce* discrimination based on sexual orientation (at least in the USA). In a fundamental situation of conflict between two entities, I agree that "anything goes", in the spirit of voluntary interactions between two entities. In the case of a conflict between a small number of large, powerful entities (corporate employers) and a vast number of small, powerless entities (the employment pool), I don't see how you can argue that this vast horde should not team up and utilize whatever means to achieve an advantage over the few in power. Today and in the future, "power" may reside increasingly in economic positioning. Thus, the power of the many individuals vs. the power of the few corporate entities may derive largely from their collective voice in the social conventions of society at large, which ultimately derives power from the tax base of the society at large. As long as these social conventions (and the tax base that empowers them) is in place, I see nothing wrong with the "voluntary interaction between individuals" which consists of banding together to pass, and enforce, laws in favor of the goals of these individuals. This is the basis of democracy. Along a similar vein, Blanc Weber writes: >... just remember in the real world no one is required >to be kind. If some hospital or company makes a decision to >deny service for whatever reason they justify to themselves, >it's their call as long as they are not owned by the State. In the real world, the voting public is not required to be kind to the hospital or the company, either. If a large political block can put into place structures (laws and enforcement) which effectively provide coercion against such denials of service, this is fair play as well. Doug ___________________________________________________________________ Doug Cutrell General Partner doug(a)OpenMind.com Open Mind, Santa Cruz ===================================================================

3 2

No Subject
by Anonymous 17 Dec '03

17 Dec '03

On Wed, 27 Apr 94 08:45:30 EDT, perry(a)bacon.imsi.com (Perry E. Metzger) writes - > "Mycotronics. We make fascism affordable." Perry, While I agree with your sentiment, it's "Mykotronx." - spooge

2 1