- cypherpunks-legacy - lists.cpunks.org

Bellworld.
by Matthew X 01 Jul '02

01 Jul '02

1841 -- Rain of fish, Boston, Massachusetts. David Brin wins,lose's limbs,but wins debate with crabbed beancounter (fun) bobby hett.Why?Because Brinworld is essential to the success of operation soft drill.When sufficient 'net tourettes,'raise sufficient e-cash(2c)then they can kick back and watch on netcast the final minutes of Brin,'live.'The danny pearl video will have nothing on this.You may think this harsh but this jerk is running free while jim bell is in stir.With enemies like Brin and the libertarian Party the State doesnt need friends.PS.grab a dead tree new scientist,22 june for the cyberanarchy editorial and photo story on Havenco.Go Ryan!

1 0

The Hot New Field of Cyberlaw Is Just Hokum, Skeptics Argue
by R. A. Hettinga 30 Jun '02

30 Jun '02

I think, frankly, that the only way to answer the arguments made below is with financial cryptography. Like I've said before, if it's encrypted, and only I (not Bill Gates and I :-)) have the key then it's my property. The same can be said about the abstractions of financial assets represented by bearer "certificates" created with financial cryptography protocols like blind signatures. Otherwise, yes, I do believe that "Cyber"-law is just meat-law by other means. One need only think about the Adult Action case, where an extradited defendant is now rotting in a Kentucky jail for the contents of his California server, or the American who foolishly went home to stand trial for his Antiguan net-gambling business to understand that. Until we have some kind of technological equivalent of the Treaty of Westphalia, sundering once and for all the power of nation-states on the internet in the same way that that treaty broke the power of religion in international relations, we will eventually end up in some kind of Heller/Randian legal singularity where everything, everywhere, will be illegal, all the time. :-). The solution to the legal paradox is not legal, it's physical: Write software, not legislation. Write code instead of Code. Cheers, RAH http://online.wsj.com/article_print/0,,SB1025481262421276800,00.html The Wall Street Journal July 1, 2002 BOOM TOWN By LEE GOMES The Hot New Field of Cyberlaw Is Just Hokum, Skeptics Argue Is there really a cyberspace full of "cybercitizens" who need only be accountable to their own "cyberlaws"? A loose-knit group of law professors is bucking one of the big fads in the legal field by calling that whole idea "cybersilly." Law involving the online world is hot right now. Law schools trying to stay current have courses in it, which tend to be popular with a generation of law students reared on Wired magazine and Napster. Experts in so-called cyberlaw typically have technology-friendly legal views, and are thus frequent guests at the tech world's many conferences. They're also quoted all the time in media accounts of online legal disputes. Cyberskeptic or buff? Write to Lee Gomes at lee.gomes(a)wsj.com1 There is, though, a much less well-known but equally determined group of legal experts -- let's call them the "cyberskeptics" -- who are deeply troubled by just about everything about this trend. The skeptics start by questioning the very existence of cyberspace, which they say is no more real than a "phone space" involving all the people on the telephone at a given time. They go on to argue that something happening online shouldn't be treated any differently by the law than if it occurred on Main Street. You can usually find the skeptics in law journals rather than at tech conferences. Orin S. Kerr, of George Washington University Law School, for example, is wary of courts looking at Internet legal issues from the perspective of users, who may indeed think of themselves as cavorting about in cyberspace. A more productive approach, he says, might be to look at what is happening in the real world, where one usually simply finds a group of computers connected to each other and passing along data. Timothy Wu, a professor at the University of Virginia School of Law, writes that there is no single Internet, but instead, many different Internet applications that all need to be discussed differently. Jack Goldsmith, of the University of Chicago law school, defends a decision two years ago by a French judge who said that Yahoo couldn't sell Nazi memorabilia in France, which bans the material. Netizens pounced on the ruling as an affront to their brave new digital world. But Prof. Goldsmith says that Yahoo, since it has a subsidiary in France, should no more be immune to French laws than General Motors is. More importantly, he says, the French judge went through with the ruling only after determining that it was feasible, through various screening technologies, for Yahoo to prevent its French visitors from seeing the ads but still display them to others. While the skeptics emphasize different points, they all have as a core principle a rejection of the notion of "Internet exceptionalism," or the idea that the Internet is a new, unique thing that requires its own special laws. "The steam engine ... probably transformed American law, but the 'law of the steam engine' never existed," writes Joseph H. Sommer, counsel at the Federal Reserve Bank of New York, in a law review article called "Against Cyberlaw." He also fretted that the cyberbuffs are afflicted with "insufficient perspective, disdain for history, unnecessary futurology and technophilia." The skeptics have no particular beef with computer and Internet technology. Most, in fact, are avid users. They just think that it shouldn't be pandered to. And they certainly deride the ideas behind the "Declaration of Independence of Cyberspace," which is posted on many Web sites and poses a "hands off" challenge to government. The dispute between the buffs and the skeptics doesn't have the usual left-right overlay to it. The skeptics tend to be Republican but come from both sides of the spectrum. A better question, perhaps, involves the politics of the cyberspacians -- not their defenders in law schools as much as the cyberactivists themselves. Many observers assume them to be politically progressive, beyond their obvious libertarianism. But are they really? Prof. Wu thinks not, calling them deeply technocratic and elitist despite their populist rhetoric. And most of the activists continue to see the Internet as a utopian ideal -- despite the fact that many progressives are beginning to worry that the Web is really just a very efficient way for companies to move white-collar U.S. jobs overseas. Prof. Goldsmith says that most law professors are becoming increasingly wary of the legal claims being made for cyberspace. But what about his students? Well, he concedes, they're another matter. Many of them, with the passion of youth, are still enthralled with the whole idea of a separate universe, one they can call their own. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: maximize best case, worst case, or average case? (TCPA)
by lynn.wheeler＠firstdata.com 30 Jun '02

30 Jun '02

"security modules" are also inside the swipe & pin-entry boxes that you see at check-out counters. effectively both smartcards and dongles are forms of hardware tokens .... the issue would be whether a smartcard form factor might be utilized in a copy protection scheme similar to TCPA paradigm .... a single hardware chip that you register for all you applications .... or in the dongle paradigm .... you get a different smartcard for each application (with the downside of the floppy copy protection scenario where a user with a half dozen active copy protected applications all wanted "their" smartcard crammed into the same smartcard reader simultaneously). many of the current chipcards .... i believe are used in the magnetic stripe "swipe" mode for authenticating specific transactions .... most of the rest are used for password substitute at login type events. Many of the chipcards following the straight payment card model result in end-user having large number of different institutional tokens (similar to the floppy copy protect paradigm). Following the institutional-specific and/or application-specific token paradigm starts to become difficult to manage as the number of tokens increase and the probability that multiple are required simultaneously increases. That eventually leads into some sort of person-centric or device-centric paradigm .... not so much an issue of the form factor (floppy, chipcard, dongle, etc) .... but an issue of whether there are potentially large numbers of institutional/application specific objects or small numbers of person/device specific objects. So a simple issue is the trade-off between the institutional/application specific objects .... which seem to have some amount of acceptance (payment cards, chip cards, various "dongle" forms, etc) but in many instances can scale poorly ... especially if multiple different such objects have to be available concurrently .... vis-a-vis switching to a person/device specific object paradigm (chipcard, dongles, etc, potentially exactly same formfactor but different paradigm) ryan(a)havenco.com on 6/30/2002 12:39 pm wrote: I think dongles (and non-copyable floppies) have been around since the early 80s at least...maybe the 70s. Tamper-resistant CPU modules have been around since the ATM network, I believe, in the form of PIN processors stored inside safes) The fundamental difference between a "dongle" and a full "trusted module" containing the critical application code is that with a dongle, you can just patch the application to skip over the checks (although they can be repeated, and relatively arcane). If the whole application, or at least the non-cloneable parts of the application, exist in a sealed module, the rest of the application can't be patched to just skip over this code. Another option for this is a client server or oracle model where the really sensitive pieces (say, a magic algorithm for finding oil from GIS data, or a good natural language processor) are stored on vendor-controlled hardware centrally located, with only the UI executing on the end user's machine. What I'd really like is a design which accomplishes the "good" parts of TCPA, ensuring that when code claims to be executing in a certain form, it really is, and providing a way to guarantee this remotely -- without making it easy to implement restrictions on content copying. It would be nice to have the good parts of TCPA, and given the resistance to DRM, if security and TCPA have their fates bound, they'll probably both die an extended and painful death. I suppose the real difference between a crypto-specific module and a general purpose module is how much of the UI is within the trusted platform envelope. If the module is only used for handling cryptographic keys, as an addition to an insecure general purpose CPU, with no user I/O, it seems unlikely to be useful for DRM. If the entire machine is inside the envelope, it seems obviously useful for DRM, and DRM would likely be the dominant application. If only a limited user IO is included in the envelope, sufficient for user authentication and keying, and to allow the user to load initially-trusted code onto the general purpose CPU, but where the user can fully use whatever general purpose code on the general purpose CPU, even uncertified code, with the certified module, it's not really useful for DRM, but still useful for the non-DRM security applications which are the alleged purpose behind TCPA. (given that text piracy doesn't seem to be a serious commercial concern, simply keeping video and audio playback and network communications outside the TCPA envelope entirely is good enough, in practice...this way, both authentication and keying can be done in text mode, and document distribution control, privacy of records, etc. can be accomplished, provided there is ALSO the ability to do arbitrary text processing and computing outside the trusted envelope, .) If it's the user's own data being protected, you don't need to worry about the user intentionally circumventing the protections. Any design which removes control from the 'superuser' of the machine is fundamentally about protecting someone other than the user. This, I think, is the difference between TCPA and smartcards. Notice which one has in its short lifetime attracted far more enmity :) Quoting lynn.wheeler(a)firstdata.com <lynn.wheeler(a)firstdata.com>: > > > I remember looking at possibility at adding tamper resisistent hardware > chip to PCs back in 83 or 84 time frame (aka the TCPA idea for PCs is going > on at least 20 years old now). It was the first time I ran into embedding > chip in a metal case that would create electrical discharge frying the chip > if the container was breached. > > Remember when applications came with their own copy-protection floppy > disks? .... it was possible to build up a library of such disks .... > requiring all sorts of remove, search, insert ... when switching from one > application to another. They eventually disappeared ... but imagine if they > had survived into the multitasking era .... when it would have been > necessary to have multiple different copy protection floppy disks crammed > into the same drive at the same time. The chip was suppose to provide an > analog to the CPU serial number used for licensing software on mainframes > .... dating at least from the original IBM 370s (store cpuid hardware > instruction). > > Some of the higher-end applications still do that with some form of dongle > (originally in the serial port) that comes with the application .... it > doesn't quite have the downside of trying to cram multiple floppies into > the same drive concurrently; the serial port dongles allow for them to be > inline cascaded ... and in theory still be able to use the serial port for > other use at the same time. > > i believe that there is some statistic some place about the UK and the US > are really great .... that in those two countries the copyright piracy is > estimated to only be 50 percent. -- Ryan Lackey [RL7618 RL5931-RIPE] ryan(a)havenco.com CTO and Co-founder, HavenCo Ltd. +44 7970 633 277 the free world just milliseconds away http://www.havenco.com/ OpenPGP 4096: B8B8 3D95 F940 9760 C64B DE90 07AD BE07 D2E0 301F --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

2 1

RE:
by yongdong＠earthlink.net 30 Jun '02

30 Jun '02

<HTML> These teens are so incredibly luscious your monitor will start smoking. Best of all NO CREDIT CARD NEEDED! <A HREF="http://rd.yahoo.com/dir/?http://www.evolveporn.com/abc123">Click Here</A> To be removed from further mailings <A HREF="mailto:browneyedqt28@aol.com">Click Here</A></HTML> Below is the result of your feedback form. It was submitted by hung (yongdong(a)earthlink.net) on Sunday, June 30, 2002 at 07:53:06 --------------------------------------------------------------------------- x: i ---------------------------------------------------------------------------

1 0

Re: maximize best case, worst case, or average case? (TCPA)
by Ryan Lackey 30 Jun '02

30 Jun '02

I think dongles (and non-copyable floppies) have been around since the early 80s at least...maybe the 70s. Tamper-resistant CPU modules have been around since the ATM network, I believe, in the form of PIN processors stored inside safes) The fundamental difference between a "dongle" and a full "trusted module" containing the critical application code is that with a dongle, you can just patch the application to skip over the checks (although they can be repeated, and relatively arcane). If the whole application, or at least the non-cloneable parts of the application, exist in a sealed module, the rest of the application can't be patched to just skip over this code. Another option for this is a client server or oracle model where the really sensitive pieces (say, a magic algorithm for finding oil from GIS data, or a good natural language processor) are stored on vendor-controlled hardware centrally located, with only the UI executing on the end user's machine. What I'd really like is a design which accomplishes the "good" parts of TCPA, ensuring that when code claims to be executing in a certain form, it really is, and providing a way to guarantee this remotely -- without making it easy to implement restrictions on content copying. It would be nice to have the good parts of TCPA, and given the resistance to DRM, if security and TCPA have their fates bound, they'll probably both die an extended and painful death. I suppose the real difference between a crypto-specific module and a general purpose module is how much of the UI is within the trusted platform envelope. If the module is only used for handling cryptographic keys, as an addition to an insecure general purpose CPU, with no user I/O, it seems unlikely to be useful for DRM. If the entire machine is inside the envelope, it seems obviously useful for DRM, and DRM would likely be the dominant application. If only a limited user IO is included in the envelope, sufficient for user authentication and keying, and to allow the user to load initially-trusted code onto the general purpose CPU, but where the user can fully use whatever general purpose code on the general purpose CPU, even uncertified code, with the certified module, it's not really useful for DRM, but still useful for the non-DRM security applications which are the alleged purpose behind TCPA. (given that text piracy doesn't seem to be a serious commercial concern, simply keeping video and audio playback and network communications outside the TCPA envelope entirely is good enough, in practice...this way, both authentication and keying can be done in text mode, and document distribution control, privacy of records, etc. can be accomplished, provided there is ALSO the ability to do arbitrary text processing and computing outside the trusted envelope, .) If it's the user's own data being protected, you don't need to worry about the user intentionally circumventing the protections. Any design which removes control from the 'superuser' of the machine is fundamentally about protecting someone other than the user. This, I think, is the difference between TCPA and smartcards. Notice which one has in its short lifetime attracted far more enmity :) Quoting lynn.wheeler(a)firstdata.com <lynn.wheeler(a)firstdata.com>: > > > I remember looking at possibility at adding tamper resisistent hardware > chip to PCs back in 83 or 84 time frame (aka the TCPA idea for PCs is going > on at least 20 years old now). It was the first time I ran into embedding > chip in a metal case that would create electrical discharge frying the chip > if the container was breached. > > Remember when applications came with their own copy-protection floppy > disks? .... it was possible to build up a library of such disks .... > requiring all sorts of remove, search, insert ... when switching from one > application to another. They eventually disappeared ... but imagine if they > had survived into the multitasking era .... when it would have been > necessary to have multiple different copy protection floppy disks crammed > into the same drive at the same time. The chip was suppose to provide an > analog to the CPU serial number used for licensing software on mainframes > .... dating at least from the original IBM 370s (store cpuid hardware > instruction). > > Some of the higher-end applications still do that with some form of dongle > (originally in the serial port) that comes with the application .... it > doesn't quite have the downside of trying to cram multiple floppies into > the same drive concurrently; the serial port dongles allow for them to be > inline cascaded ... and in theory still be able to use the serial port for > other use at the same time. > > i believe that there is some statistic some place about the UK and the US > are really great .... that in those two countries the copyright piracy is > estimated to only be 50 percent. -- Ryan Lackey [RL7618 RL5931-RIPE] ryan(a)havenco.com CTO and Co-founder, HavenCo Ltd. +44 7970 633 277 the free world just milliseconds away http://www.havenco.com/ OpenPGP 4096: B8B8 3D95 F940 9760 C64B DE90 07AD BE07 D2E0 301F --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)wasabisystems.com

1 0

TCPA/MS
by Dave Howe 30 Jun '02

30 Jun '02

Phil Youngblood posted the following to the securecomp server - thought it might interest people here, given the recent discussion of M$'s DRM stuff... -------------------------------------------------- This from the Eula for the latest Windows Media Player patch. * Digital Rights Management (Security). You agree that in order to protect the integrity of content and software protected by digital rights management ("Secure Content"), Microsoft may provide security related updates to the OS Components that will be automatically downloaded onto your computer. These security related updates may disable your ability to copy and/or play Secure Content and use other software on your computer. If we provide such a security update, we will use reasonable efforts to post notices on a web site explaining the update.

1 0

videotaping = liar & cheat?
by Major Variola (ret) 30 Jun '02

30 Jun '02

At 08:16 PM 6/29/02 +0200, Anonymous wrote: >When an artist releases a song or some other creative product to the >world, they typically put some conditions on it. If you want to listen >to and enjoy the song, you are obligated to agree to those conditions. >If you can't accept the conditions, you shouldn't take the creative work. > >The artist is under no obligation to release their work. It is like a >gift to the world. They are free to put whatever conditions they like >on that gift, and you are free to accept them or not. > >If you take the gift, you are agreeing to the conditions. If you then >violate the stated conditions, such as by sharing the song with others, >you are breaking your agreement. You become a liar and a cheat. First, What's your point? This list does not require that participants agree with anyone else's sense of ethics. This list often considers the effect of tech on civilization, but you are not required to endorse (or recognize, or scorn) civilization. This list often discusses certain ethics by themselves, but nothing is taken for granted, and the timid/naif may be a little frightened by this. Second, it is quite clear, even to contract-law/laissez-faire types like myself, that some DRM-interested companies are attempting to use the law to remove some rights from consumers (about gadgets and bits and RF). Many of us have a maniacally dim view of such manipulation. Third, if you don't get understand why some people are driven to understand technology, you should probably go back to your TV. > When someone makes you an offer and you don't find the terms >acceptable, you simply refuse. You don't take advantage by taking what >they provide and refusing to do your part. And you don't sue someone for what users of their product do.

1 0

Re: Ross's TCPA paper
by Barney Wolff 30 Jun '02

30 Jun '02

Do you really mean that if I'm a business, you can force me to deal with you even though you refuse to supply your real name? Not acceptable. I won't give up the right NOT to do business with anonymous customers, or anyone else with whom I choose not to do business. The point about DRM, if I understand it, is that you could disclose your information to me for certain purposes without my being able to make use of it in ways you have not agreed to. At least in theory. But this debate appears largely to ignore differences in the number of bits involved. To violate your privacy I can always take a picture of my screen with an old camera, or just read it into a tape-recorder. I can't do that effectively with your new DVD without significant loss of quality. I don't see any technical solution that would enable Alice to reveal something to Bob that Bob could not then reveal to Eve. If that's true, then DRM must stand on its own dubious merits. On Wed, Jun 26, 2002 at 10:01:00AM -0700, bear wrote: > ... > > Privacy without DRM means being able to keep and > do whatever you want with the records your business > creates -- but not being able to force someone to > use their real name or linkable identity information > to do business with you if that person wants that > information to remain private. -- Barney Wolff I never met a computer I didn't like.

3 5

Re: Uplifting Brin
by R. A. Hettinga 30 Jun '02

30 Jun '02

--- begin forwarded text

1 0

FREE Adult Passes
by seung-wo＠hotmail.com 30 Jun '02

30 Jun '02

<HTML> I found this site that has the ultimate XXX pics that are FREE! They change every 60 minutes with totally NEW PICs. This site is so awesome I had to tell you! <A HREF="http://rd.yahoo.com/dir/?http://www.evolveporn.com/123blue">Click Here</A> To be removed from further mailings <A HREF="mailto:browneyedqt28@aol.com">Click Here</A></HTML> Below is the result of your feedback form. It was submitted by hugh (seung-wo(a)hotmail.com) on Sunday, June 30, 2002 at 06:49:13 --------------------------------------------------------------------------- x: i ---------------------------------------------------------------------------

1 0