- cypherpunks-legacy - lists.cpunks.org

Re: Transitive trust
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"sunder(a)dorsai.dorsai.org" "Ray Arachelian" 10-MAY-1996 16:37:22.44 >But it is - it's a pain in the ass, but you can always revoke your own >key and generate a new one, then sign everyone's keys whom you've signed >as trusted, EXCEPT the one you wish to revoke. Well... that has the problem that all the signatures on your old key won't transfer, so far as I know. Now, this may have the good effect of decreasing the effective reputation of anyone who goofs and needs to revoke a signature (and of causing people to check more carefully when first signing)... but it's also a motivation not to check carefully _after_ the first time (you might need to revoke it). This balance is also present about other reasons to revoke a key - on the one hand, someone who frequently revokes keys may not be keeping up with them very well, and thus should not be trusted. On the other hand, it may be someone who changes them on a regular basis for security (a reason to keep a master key to sign your key with & vice-versa, then get signatures on it) or someone who is keeping a sharp eye out for violations and will revoke a key whenever they suspect a problem. -Allen

1 0

Re: Transitive trust and MLM
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"eli+(a)GS160.SP.CS.CMU.EDU" 10-MAY-1996 17:48:49.87 >Each signature has an /a priori/ probability p of correctly indicating >validity, but these probilities are not independent at all: this key >isn't valid, period. If one certifying signature is incorrect, all >others on the same key must be, and vice versa -- about as correlated >as they come. The different paths going through those different signatures will be correlated/non-independent, yes.... but that isn't the problem unless you're considering multiple paths (in a more complicated version). >To limit transitivity, constrain the path length. This limits key >reachability too, but I think we agree that it's essential in the real >world. (It should also make the math simpler!) The model generalizes >to non-binary conceptions of trust, but I don't think these can >rehabilitate transitivity. Hmm, there are some possible approaches, >though. IIRC, there have been some sociological studies showing that _everyone_ is linked through 6 or so people. Now, there's the question of whether you _need_ to be linked to _everyone_ - just everyone with whom you want to do business (e.g., excluding authoritarian types doing a sting). It does come back to the elite vs masses distinction; I see nothing wrong (and am in favor of) separation of the elite from the masses. -Allen

1 0

Re: Edited Edupage, 9 May 1996
by jim bell 17 Dec '03

17 Dec '03

At 10:08 PM 5/9/96 EDT, E. ALLEN SMITH wrote: >From: IN%"educom(a)elanor.oit.unc.edu" 9-MAY-1996 22:01:14.77 > >>REGIONAL BELLS WANT RATE HIKES FOR WIRING SCHOOLS >>The United States Telephone Association would like to raise the average U.S. >>monthly phone bill by about $10 over the next five years to pay for wiring >>schools and libraries with new lines for phones and computers, and to >>subsidize poor and rural customers. The proposal assumes an $11 billion >>cost for wiring schools and libraries, with local phone companies paying >>about a third to a half of that. The rest would come from a surcharge on >>other services, such as cellular. "No single industry should be held >>responsible for fulfilling this major goal," says USTA's president. "Each >>has a role and should make a significant contribution to the national >>education technology mandate." (Investor's Business Daily 8 May 96 A7) > > The "subsidize poor and rural customers" line makes me glad I don't >have a phone line. As might be expected, the math on this just doesn't seem to work out. If we assume that the average school has 500 students, and 1/2 of the telephone-using households have at least one kid in school (on average) then 1000 telephone households at $120 extra per year, or $120,000 per school, is available to wire it. That's a HELL of a lot of wire!!! And that's just for a single year. Why not just teach a few high school students wiring, pay them 2x the minimum wage, and give them a good summer job doing the wiring? As for subsidizing rural customers... Why not just install a cellular telephone site in an area that's too dispersed for efficient wireline telephones? And most of these people are probably already in an area served by cellular. Jim Bell jimbell(a)pacifier.com

1 0

Open Group issues first new Internet security standards
by Lou Zirko 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Fri May 10 18:35:00 1996 Story at: http://www.infoworld.com/cgi-bin/displayStory.pl?960510.opengroup.htm Lou Zirko Lou Zirko (502)383-2175 Zystems lzirko(a)isdn.net "We're all bozos on this bus" - Nick Danger, Third Eye -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMZPS9BKvccEAmlQ9AQF11Af+ICe2kFCFVo7oxTD6q5BTikFxlITSNwrS q88PturM07k788l0CgHEXR+GV4dyNB24Xgi2ZViyfOPeTHuKtVmpdr9w3T46Lo8d ixtuKWqpjY4W8n39LU8WlR6ULja43Qb9jPCal2AcXJALAdm/D72NVrr4ATwItYOI KeibIIevzTj68Un1/sEmlEQik1sqmMdNvEr4M3ePBnEhvbgjl7gk8T/XBPVjHMes 0e/gLtTbQ5WzuzC/rmpyoMBR20KUp83wSq5F1OtNTv33rmwhF08ZJdH/InO+L006 oLOVdeqBh/eB3ae2dpV3aApQMa3QNpHTgL9D1sokfoXdMZYt+MxJgg== =IfyX -----END PGP SIGNATURE-----

1 0

Are remailers designed to be knocked down?
by abostick＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Scientology wars are spilling over into alt.usenet.kooks again, and Keith Henson had this odd thing to say. I thought Cypherpunk discussion of Keith's thesis would be interesting. hkhenson(a)netcom.com (Keith Henson) wrote: > henry (henri(a)netcom.com) wrote: > : if the remailers are merely toys, capable of being knocked > : down like dominoes by some fringe-cult of psychopathic dimwits, > : it's better to find that out now than wait for a situation > : where someone's life or death could be determined by the > : security of remailer-chaining and encryption against a > : determined opponent. > > Ah, but the remailers are *designed* to be knocked down. The > are not expected to last if they are being used for serious > causes. But the package for doing another one and getting it > hooked into the network is easy to install--even in a user > act. Knocking out a remailer will usually halt the effort to > get back at the person/persons who were spilling the beans. > Social factors involved here. If any of you would like to > help, offer to run a remailer for a while. Consider it a > temporary civic duty. Keith Henson > > Alan Bostick | "The thing is, I've got rhythm but I don't have mailto:abostick@netcom.com | music, so I guess I could ask for a few more news:alt.grelb | things." (overheard) http://www.alumni.caltech.edu/~abostick -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMZNwT+VevBgtmhnpAQGY2gMAsH/PpktUfimgjZ6zz/48hhAp0wra6BKb FhwYMB5NAsmeMwz2dqv+ZCvO7LID1tM7ez1rjHOVvC7aSQPSe1mF8ShaxYdSVtcP ZqHhC145IiAZ715FZzHzjoCjfD0yHK/s =aa0n -----END PGP SIGNATURE-----

2 1

Re: PGP, Inc.
by timd＠consensus.com 17 Dec '03

17 Dec '03

At 11:10 PM 5/9/96, E. ALLEN SMITH wrote: >From: IN%"shamrock(a)netcom.com" 9-MAY-1996 23:02:01.67 > >>At 19:37 5/9/96, E. ALLEN SMITH wrote: >>> I can see some fascinating legal questions with what, exactly, a >>>VeriSign certificate obligates the company for. Digital signature laws should >>>get interesting - any application of this to the Utah one? > >>VeriSign is going to offer four levels of certs. The first requires only >>uniqueness. For the other three levels, VeriSign will require more and >>better assurances of the correctness of True Name stated on the cert. I >>don't know what form these assurances are supposed to take. > > The first level, in other words, is less of a certification than a PGP >key with self-signature and signature from one other person. It doesn't have >_any_ effort to verify that the email address stated on it is the actual email >address of that nym. Or am I misinterpreting you? The only effort they make is that when using the email-based CA, it mails the certificate to the address within, so it's not trivial to get a cert for an address that you don't have access to. (I'm not saying it's impossible, or even hard, just that it requires some skill and effort). - Tim Tim Dierks -- timd(a)consensus.com -- www.consensus.com Head of Thing-u-ma-jig Engineering, Consensus Development

3 2

RE: self-ratings vs. market ratings
by Blanc Weber 17 Dec '03

17 Dec '03

Not an extremely important point, but I just re-read my earlier message and realized that my sentence below didn't exactly state what I meant: "I myself don't pay much attention to ratings, as my own measures of things & people tend to be quite different from most, and therefore not very useful for my purposes." I meant that the the *ratings* would not be very useful for my purposes (at least, not the ratings as I've heard proposed so far.) I probably wouldn't have the same values or concerns of those who feel the need to apply them; I wouldn't judge the material by the same standards (raters are looking principally to create a means to censor material, and I myself am not concerned about passive text&graphics. When Java applets begin to coerce cybersurfers into complicity, I'll start worrying about it.) One more word about automating ratings: The more automated that filtering becomes, so that the viewer (be it an adult or a child) requires less and less personal involvement in evaluating what is appropriate (or even interesting) for themselves, the more weak & piddly (ignorant & psychologically dependent) those people could become, falling into the habit of having others - or an automatic robocop - do their content-filtering for them. Not a good system to introduce into a dynamic world-order. Like all automatic things, it can encourage intellectual lassitude. Like all tools, this one can also be misemployed. But, of course, surfers can make a cultural decision: sex&violence? or namby-pamby? :>) .. Blanc One voice among many.

2 1

Compu$erve, Netscape offering Lotus Notes competitor
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

There is no mention in either of these articles about what encryption protection will be used; it does appear that Netscape Navigator software will be used, which does have some protections (very little for the out-of-US stuff, of course). Jeff? -Allen >Copyright 1996 Nando.net >Copyright 1996 Bloomberg >COLUMBUS, Ohio (May 9, 1996 12:41 p.m. EDT) -- CompuServe Corp. this fall >will offer corporate customers Netscape Communications Corp. software used >to share documents over computer networks. >The move presents another challenge to International Business Machines >Corp.'s Lotus Notes software, whose popularity has declined as companies opt >for cheaper Internet software capable of many of the features Notes offers. >Using Netscape's software, company employees and partners in distant offices >can exchange and work on documents at the same time. Netscape also is >developing audio and video technology that will let employees talk to each >other. [...] >Columbus, Ohio-based CompuServe already offers Lotus Notes and decided to >strike an agreement with Netscape because customers were asking for a >similar, cheaper product. [...] >CompuServe will offer Netscape's server software, used to relay information, >and Internet browsing software. Terms of the marketing and development >agreement weren't disclosed. >Netscape's software is based on technology it acquired with the purchase >last year of Collabra Software Inc. [...] >Copyright 1996 Nando.net >Copyright 1996 Reuter Information Service >COLUMBUS, Ohio (May 9, 1996 12:47 p.m. EDT) - CompuServe Corp. and Netscape >Communications Corp. said Thursday they will jointly create a managed >intranet service that will allow a company's employees to communicate over >in-house computer networks. [...] >Intranets refer to private corporate networks that are designed to make use >of Internet software tools. >Under the strategic partnership, the two firms will offer so-called >groupware, a category of software that allows employees to share >applications and electronic mail. They will manage such networks on behalf >of corporate customers. >Customers will have access to features such as electronic mail, online >discussion groups and document-sharing that allow them to share and >co-develop information in new ways. >The service is slated to be available this fall, using Netscape's Navigator >browser and server software.

2 1

Re: PGP, Inc.
by Dan Weinstein 17 Dec '03

17 Dec '03

On 10 May 96 at 18:12, you wrote: > At 5:48 PM 5/10/96, Dan Weinstein wrote: > >On Fri, 10 May 1996 10:22:24 -0700, timd(a)consensus.com wrote: > >> > >>The only effort they make is that when using the email-based CA, > >>it mails the certificate to the address within, so it's not > >>trivial to get a cert for an address that you don't have access > >>to. (I'm not saying it's impossible, or even hard, just that it > >>requires some skill and effort). > > > >I don't believe this is correct. They send you information after > >you have created the cert verifying that you set it up, but nothing > >requires a response and the key is transfered via http. > > If you'll examine my message, you'll see I was referring to the > email-based S/MIME class 1 CA. > > Best, > - Tim Dierks > > Tim Dierks -- timd(a)consensus.com -- www.consensus.com > Head of Thing-u-ma-jig Engineering, Consensus Development Oops, sorry about that. Dan Weinstein djw(a)vplus.com http://www.vplus.com/~djw PGP public key is available from my Home Page. All opinions expressed above are mine. "I understand by 'freedom of Spirit' something quite definite - the unconditional will to say No, where it is dangerous to say No. Friedrich Nietzsche

1 0

Reminder/details on May 11th SF Bay Area Meeting
by Rich Graves 17 Dec '03

17 Dec '03

Tomorrow, noon, Tresidder patio at Stanford. If you have the bandwidth, you can get a DETAILED look at EXACTLY where we'll sit through http://www-tour.stanford.edu:1081/cgi-bin/campus-click.prl/jmtl Tresidder is at B4; a closeup picture of the benches where we'll sit is at http://www-tour.stanford.edu:1081/cgi-bin/ctour.prl/00075.10/jmtl Different versions of the JPEGs are appropriate for monitors with different gamma settings. (Why yes, as a matter of fact, we *did* have far too much time on our hands.) If people are really nice, we might sneak into my office for Ethernet connectivity and presentation hardware. I suppose it's probably too late to offer to drive people from the PA CalTrain station to campus, but you could page me. If you were counting on the shuttle, sorry, it doesn't run tomorrow. It's about a 25-minute walk. There will also be a "Spring Faire" and a "Powwow" on campus this weekend, so count on a little traffic. Nowhere near as bad as a football game, mind you. Hugh Daniel wrote: >For dinner I will suggest 'Thai City', about a 2 kilometers >south of Page Mill at 4329 El Camino Real. It is on the >Peninsula East side of the road, white building with a purple >stripe around it and some {}`s (really). +1 415 493 0643 Thai City is excellent (and cheap). -rich

1 0