- cypherpunks-legacy - lists.cpunks.org

RE: Real-time surveillance of the police
by crawford＠scruznet.com 17 Dec '03

17 Dec '03

Sandy Sandfort <sandfort(a)crl.com> writes: > Michael also argued that it might be more easily sold to private > security firms for legal liability reasons. This argument is > even more persuasive for police officers. Cities routinely pay > astronomical settlements, or fight expensive law suits, arising > out of alleged incidents of police misconduct. Frivolous > lawsuits would be quickly thrown out of court. Rogue cops would > be identified and thrown off the force. Works for me. Works for me, too, and one would think that it would work for cities, but experience shows that individual cops can rack up millions of dollars in legal settlement costs and still remain on the force. I heard some figure - this is quite vague, but hey, it's midnight - that a small handfull of cops in San Francisco had cost the City tens of millions, with individual cops repeatedly causing lawsuits, without getting fired. Why? Police unions. Settling out of court without assigning blame. City politics. Mayors that are former police chiefs. A clueless populace. Promises to do better next time. Now, I heartily agree with you that the police should be more closely monitored, and certainly cities have ample reason to avail themselves of this, but most cities do not even avail themselves of citizen police review commissions, because of the resistance the police have to it. In Santa Cruz, a proposal to allow an independent citizen panel to review police internal affairs investigations faced threats of lawsuits from the police union, and took _years_ to adopt. The commission we got has considerably less authority than was originally proposed. This is in a city reknowned throughout the nation for its leftist politics. If the People's Republic of Santa Cruz couldn't get a review board with real authority implemented, I doubt you'll convince the LAPD to put radio beacons on their thumping arms. Much as I think they should. Sandy continues: > Even with all these arguments in favor of wiring, I have a > sneaking suspicion the cops will not want it. Why? Though few > police would admit it publicly, my conjecture ... Well, my knowledge is that at least one cop wouldn't go for it - the cop we caught jacking off to a magazine of ill repute, parked in his patrol car on Yerba Buena Island in San Francisco Bay. Those rhythmic wrist-movements would show an unmistakable frequency signature back at home base. He sure drove off quick. Didn't even say hello. I say, > Yes, that's right - keep surveillance cameras going on _yourself_. If > you're not doing anything illegal, you've got nothing to fear from taping > everything you do. tcmay(a)netcom.com (Timothy C. May) replies: > This scenario is a likely way that "position escrow" will evolve, from > a voluntary escrowing (incl. timestamping, etc.). "Those with nothing > to hide" will agree to escrow their movements...this will exculpate > them in suspected crimes, etc. A slippery slope. I reflected on this a bit, and decided that if one were to implement "personal surveillance", a decent solution would be to encrypt the tapes. Use DAT tape instead of a VCR, and save MPEG's or QuickTime movies that have been encrypted with IDEA. The idea here is protection _from_ the police, to demonstrate that an officer misbehaved in the vicinity of my car, rather than to provide a record for use by the government. Needless to say, I wouldn't advertise that I actually had such a thing until I pulled the tapes out in a deposition, or sent them, decrypted, to the TV news. Again, I'm not saying such surveillance should be imposed, supplied or encouraged by the authorities, but that one might find some benefit in installing it oneself. Cheerio, Michael D. Crawford crawford(a)scruznet.com <- Please note change of address. crawford(a)maxwell.ucsc.edu <- Finger me here for PGP Public Key.

1 0

Re: Globe and Mail Article On Forged Posting
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Mark Terka writes: > Ok, here is the text of the story about the "Forged Bob Rae Posting" from > the Toronto Globe and Mail. An examination of the story only indicates how > far our journalists and politicians have to go in understanding the Internet! Indeed. Let's examine some of the apparent misconceptions.... [quoted text from here to the end is from Rusk & Mittelstaedt of the Globe & Mail] > A furious Mr. Rae criticized Mr. Harris outside the legislature, > accusing him of leading to the "Americanization of Canadian > politics" through the use of "dirty tricks. (ouch :) [...] > Ont.general is a computer bulletin board on which Internet users > discuss life and public issues in the province, said Larry Sherman, > president of Internet Seminars of Woodbridge. > A message can be removed from the board only by whoever posted it, No, anyone with a moderately flexible newsreader and a little bit of knowledge about news control message syntax can cancel someone else's article. Tying this in to the discussion about using a newsgroup as a message pool, notice that news articles are far easier to wipe out than mail messages. This is potentially a major vulnerability of any such system, given current news software. Widespread unauthorized cancellations (other than for spam) are greatly frowned upon, though, so a concerted attack would probably set up a major clash of powers on the net. [...] > The source of the message was an account that provides a service > that allows people anonymous access to the Internet, she said. mail forwarding =/= net access > Mr. Sherman said it is very easy to post a false message on a > bulletin board and to make it appear that it came from a computer > different from the one that sent it. True, but that's a claim about forgery, not remailing; this is a worrisome confusion of terms reminiscent of the hacker/cracker problem. > By going through a California bulletin board, "obviously someone > has gone way out of their way to send that in," Mr. Sherman > added. One hopes that Internet Seminars pres. Sherman isn't responsible for the absurd implication I infer from this: sending mail via a geographically distant site requires going out of one's way. Is there some more sensible interpretation ? It seems obvious that someone posting an article purporting to emanate from the Canadian PM would try to transmit it with some level of indirection. [...] > Last months, the Tories played pranks at an NDP convention > sending in a camera crew that shot pictures ridiculing Mr. Rae, > including a doctored video sequence that seemed to give the Premier > a stutter. The picture were broadcast as dinner-time entertainment > at a Conservative convention the same weekend. Who's learning slimy politics from whom ? - - -L. Futplex McCarthy; PGP key by finger or server "We've got computers, we're tapping phone lines; I know that that ain't allowed" --Talking Heads - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLuwUnmf7YYibNzjpAQHqQAP+LPVNyr0dFCMDlSmF9GiLzK6ODmCgpopC Pke/Qk9esB+vWA5bPpxtbD1Z61rCGJgvZU++g1+vovmbcSzduoQMauEKKoX5+V9m oGEcfyvu1KqnsVL83jN6YHTMANs/DxHCPVf8jWusJOgQJ+LzZN9xPxlcKDBRFiS1 wyBTHvaOlaQ= =Lism - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwV9yoZzwIn1bdtAQHkUAF/QCXYBhzma2Y8rrT+hWnIeZYkjlNzi+8s Nf3pPrzjc34nCOsxcwz9aJ9AjhPvWJEV =wOms -----END PGP SIGNATURE-----

1 0

Crypto Declaration of Independance
by nobody＠jpunix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a proposal for you all. I have started work on a Crypto Declaration of Independence, based on the famous American work which represents Independence. With the incoming batch of Congress and the new year approaching, I think that it's time we assert what we believe in. We need to let people know what we stand for, and why we think it's a good idea. And with the (quasi)-recent passage of the DigiTel proposal and Freeh's comments about banning encryption, we need to wake people up. However, asserting this to ourselves again would be akin to holding a one-person conference. We have rehashed these points amongst ourselves many times. Therefore, I propose that we spend some time revising this work, based off the writing I will post if there is support for this idea, then sign it, and email, fax and mail it to our respective news agencies, government officials and interest groups. However, without your support, this endeavor would be fruitless. Before I post the "beta version"/first draft of the CDoI (for lack of a better term), I want to know if you (the C'punks) will support it and help me. Overall, I'm looking for answers to four questions: 1) Will you support and help this endeavor. 2) A target date for sending it out. First idea which came to mind: Jan 1st, 1995 3) A list of groups/people which should receive it. Government officials, news agencies, HOTtired, CPSR, EFF, ACLU, etc and along with #3: 4) Ways for bringing it to people's attention. I intend to keep myself anonymous during this process, so please contact me by leaving a message on this list, or mailing everything within these cutmarks to remailer(a)jpunix.com: -- CUTMARK ( do not include )-- :: Encrypted: PGP - -----BEGIN PGP MESSAGE----- Version: 2.6.2 hIwD/nqSW1QDQfUBA/wI+tSk7CWd5u2dMywjv6oLosg3nm5ki/p8HhOg7VXHDk0S 6MpptLzWzUtkvL+EZEBS7NHORSTNRbo0K/Uvqgl0Rqaqig5Wx6i2VKve3ky9/Kbm I72casRMcyoBka+cOtKdU5JBVXF/YDWmCb3usnvAu0oDZGxBstTaTPgpJzMiV6YA AACTszK/wRKedt58GVDLQs7gNNUUyIxbKtUQNQGss2sbM7AZE0kaQ7B6Z1VXJy0t NKYzUQfk5LEJ1ko9ZbvDSgAWzTnZbmyfSszrpHpRN7ehFhgRCVf4YToMQa5eSOAg CHxmBMq01kDqIntHXZpWquU31+rfpPNNAT9pFHiYAj7biIRA3LWIRwvmy30j+QEv DaMODrdo =xtpD - -----END PGP MESSAGE----- < please put your message to me here> -- CUTMARK ( do not include ) -- I hope you will support me, and I will welcome any and all comments and criticism. Asynchronous -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLuq6yFG1rORFKstdAQH54wP/SaiMFKwz2UzjMdnhVK1HiBW2qSNs6NWC 5ENgEHod+n4ngfsx+miYMzmzDq2GmJ/KbvfMQjDFZiIcsirT2JPcu/YuvLG9AJvy GbO4pY0n/Mky8m1V66OxTxnVjb5CaGpRvbxrOKzAMx7CQMBGRfbdlHpPjtLWfpLf l0xwy9yoCVU= =Loxi -----END PGP SIGNATURE-----

3 4

extra dashes in PGP-related blocks?
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

When people have been posting their public keys, or encrypted address blocks, to various lists I'm on, all of the "-----BEGIN whatever..." lines seem to have a "- " preppended to them. So, for instance, they look like: - -----BEGIN PGP MESSAGE----- Version: 2.6.2 [stuff] - -----END PGP MESSAGE----- I'm guessing if I really sent a block like that to a remailer, the remailer would hork because of the prepended "- "s. I know that sometimes people's public keys they've posted to a list look like that, and when I try to add them to PGP, it horks, and I've got to go into a text editor and remove the "- ", and then add it to my keyring. Does anyone know what it is that's putting in these "- "s, why it's putting them in, and how to stop it?

4 8

Re: alt.anonymous.messages propagation
by cactus＠seabsd.hks.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- L. McCarthy <lmccarth(a)ducie.cs.umass.edu> wrote: >Hmmm, does MIT get alt.anonymous at least ? I understand alt.anonymous was >created to serve a purpose similar to that of alt.privacy.anon-server, but >at the moment it's a de facto equivalent of alt.anonymous.messages. >alt.anonymous is somewhat better propagated than a.a.m, from what I've heard. Nope, no alt.anonymous. 'Leastaways, not off the servers that the turist accounts use. And since I configured news on the machine, I'd love to hear if there are MIT servers that have a larger set than life.ai's. >You should request one or both groups from the MIT news admins. If users there >want to read the group, they'll likely be quite happy to carry it. Alas, I am but a turist at MIT, though one who helps maintain the turist machine. I'll be looking at getting a real newsfeed from elsewhere, but asking the MIT newsadmins for favors isn't in the cards. If anybody here has a bit of a stronger standing on campus, their asking would be way cool. >I'm a fairly well-known regular in alt.config, and I believe I can probably >recruit some prominent news admins to send booster newgroup messages for >alt.anonymous.messages. Apart from that, it's a matter of people asking their >local news admins to pick up the group if they aren't already carrying it. That would be a most excellent thing to do, regardless of how it affects my situation. - -- Todd Masco | It's difficult to be loud about keeping your enumerated cactus(a)hks.net | rights when you're busy exercising your unenumerated ones. cactus(a)bb.com | http://www.hks.net/~cactus/cactus.html - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLuwLBSoZzwIn1bdtAQHxqgGA3WuDp+3/5A8pqGNpFc5UqAVJafaSL7je bUpZDrHpYMXycfCUPAgh+HpxJpCTLWU1 =c8Gt -----END PGP SIGNATURE-----

2 1

[cpunks] Re: public accounts / PGP / passphrases
by tim werner 17 Dec '03

17 Dec '03

>Date: Mon, 5 Dec 1994 05:24:12 -0500 >From: "L. McCarthy" <lmccarth(a)ducie.cs.umass.edu> >...The only solution I can imagine is to keep >a notebook computer running Linux at work, and dial in to the DECstation >five feet away from my desk at work. I've no idea how to convince the tech >staff here to add a dedicated phone line to my lab for this purpose. Any >better suggestions on using PGP safely during the workday ? Well, for one thing you don't need a phone line in your scenario. You can probably just connect the serial port of your laptop to one of the decstation serial ports, using a null-modem cable (pins 2 and 3 swapped; 4 jumpered to 5; 6, 8, and 20 jumpered to each other; and 7 passed through, or something like that) But I agree that the idea of buying a laptop so you can use PGP at work is odious. There must be a better way. tw

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)xs4all.nl> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"myriad"} = "<remailer(a)myriad.pc.cc.cmu.edu> cpunk pgp hash latent cut ek"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 12 Dec 94 6:00:01 PST remailer email address history latency uptime ----------------------------------------------------------------------- xs4all remailer(a)xs4all.nl ***+*-+***** 9:24 99.99% usura usura(a)xs4all.nl ***-*-++**** 10:38 99.99% alumni hal(a)alumni.caltech.edu +*+**+**+*** 7:33 99.99% penet anon(a)anon.penet.fi ++**+******* 29:39 99.99% c2 remail(a)c2.org +++-_--+++-+ 58:05 99.99% flame tomaz(a)flame.sinet.org +*++******+- 14:55 99.98% nately remailer(a)nately.ucsd.edu ++++++++++++ 32:43 99.98% portal hfinney(a)shell.portal.com ************ 4:17 99.97% jpunix remailer(a)jpunix.com +*++***** +- 14:42 99.96% myriad remailer(a)myriad.pc.cc.cmu.edu **+********* 5:32 99.94% vox remail(a)vox.xs4all.nl ---------..- 14:16:12 99.99% rahul homer(a)rahul.net *********** 5:06 99.88% bsu-cs nowhere(a)bsu-cs.bsu.edu *+-***-**++ 22:31 99.82% mix mixmaster(a)nately.ucsd.edu -+-+-++**+++ 32:50 99.80% ideath remailer(a)ideath.goldenbear.com ******-*++ 29:24 99.82% desert remail(a)desert.xs4all.nl -------.--- 10:57:50 99.99% extropia remail(a)extropia.wimsey.com --+++---.-+ 5:00:06 99.68% rebma remailer(a)rebma.mn.org *-..-.-*--- 10:34:53 99.71% soda remailer(a)csua.berkeley.edu .-......_. 11:45:06 96.63% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

remailer list
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

What's the ftp site where I can obtain the latest copy of the list of remailers? Thanks, -RH- --------------------------------------------------------------------------------- Reuben Halper I'm not growing up, I'm just burnin' out." Montclair High - Green Day - Montclair, NJ E-mail: fhalper(a)pilot.njin.net PGP 2.6ui Public Key available upon request ---------------------------------------------------------------------------------

1 0

Re: Misunderstanding of Remail Headers
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 2:13 AM 12/12/94, L. McCarthy wrote: >Hal writes: >> There was also a misperception that my remailer was an official effort >> endorsed by Portal (again, despite the disclaimers). Note that it was >> they who were contacted, not me (yet). This might suggest that it will >> not be possible to cleanly separate the remailer operators and service >> providers when problems like this arise. Both may end up being hassled >> (time will tell whether I am). > >This is all too familiar to me. Although I still haven't heard the official >line on the shutdown of Underdog following the Scythe spam, at least some >people locally (including, crucially, my advisor) received the impression that >I had forged (and authored !) the offending news articles in spite of the >disclaimer headers. Maybe the remailers should put bogus "From:" lines in, to avoid this? Make it "From: nobody", or "From: Anonymous", or even something odd like "From: AnonUser!hfinney(a)shell.portal.com". Put in some other lines telling the actual address of the remailer, as well as a complaints-to: address. Maybe "Sender: hfinney(a)shell.portal.com", or "Remailer:hfinney@shell.portal.com". The "From:" line seems to be confusing people. The author of the article quoted from the Globe & Mail appearantly didn't even understand the disclaimer. The article was worded in such a way to make it seem the disclaimer was saying that Bob Rae didn't really write the message, as opposed to saying that Hal Finney didn't really write the message! Something needs to be done so that even the most internet clueless will understand that the message _isn't_ from Finney or McCarthy or Joe Random RemailerOp, which appearantly isn't clear to many people currently.

2 1

Re: Clarification of my remarks about Netscape
by Kipp E.B. Hickman 17 Dec '03

17 Dec '03

In article <9412111620.AA41983(a)eldamar.walker.org>, you write: > Several people have asked me to clarify my recent comments about Netscape. > I am more than happy to oblige. > > First of all, let me begin by saying that I am a biased observer, and that > all of this is my personal opinion. My annoyance with Netscape is also closer > to the surface this week than it normally is, due to a variety of factors > (including having just returned from the San Jose IETF meeting). My initial > comment, and the ones that follow in this message, are thus more frank than is > my usual style on, say, public Usenet newsgroups. > > That being said, here are some of the data that has gone into my impressions > of Netscape so far. > > (1) Netscape plays very fast and loose with HTML. Rather than participating > in the existing standardization efforts, they have indiscriminately added > "extensions" to it that are not supported by any other client software, > and which in some cases go directly against HTML's markup-oriented > structure. This only adds more confusion to an already muddy area, > delays the prospects for a standard HTML specification, and divides the > WWW into "WWW Classic" and "Netscape-compatible". Personally, as a > strong proponent of universal interoperability, I find this reprehensible. > There is no need to bypass existing efforts just to add cosmetic value to > your own software. This has nothing to do with security... > (2) The Netscape Secure Sockets proposal has an extremely poor security model. > It is not an end-to-end security model, but rather relies on transport > level security, which is in my view dangerously inadequate for reasons > which should be obvious to most of the folks on this list. Clearly I'm an idiot. Explain it to me. And while you are at it, why don't you email me your comments on the spec? I put my email address in there for that very reason. Jeesh. > It is also > tied directly to the RSA certification hierarchy. Now, for those of us > who have X.509 certificates rooted in the RSA Commercial Certification > authority, that's fine, but it also means that any other WWW client that > wishes to interoperate with Netscape's "secure servers" must license > TIPEM from RSA Data Security, and consequently pay RSA's rather high > royalties, unless the software is free (in which case RSAREF can be used). > This serves as a direct barrier to competition from other commercial > vendors. This is not all bad--I happen to like RSADSI's products and > technology--but promoting a transport-level security system instead of > an end-to-end one is to my mind simply irresponsible. This is an outright lie. We don't use TIPEM. You could build a conformant SSL implementation using RSAREF and the freeware IDEA cipher code. As for a barrier to competition. So what else is new? We all have barriers to overcome before we can compete. Should we get rid of TCP/IP as a barrier to using the web? > There has been no peer review of Netscape's security model--it was simply > implemented by fiat, without regard for the IETF standards process. I > find that this leaves a very bad taste in my mouth. I also heard similar > sentiments from a wide variety of other attendees at the IETF, including > members of the IP Security working group, people who attended the Secure > HTTP BOF, and others. This leads me to believe that it's not just a > matter of me leaping to wild conclusions. You are somewhat right here. In fact, this was done because we are a company interested in surviving long enough to withstand the eventual attack by microsoft. Instead of waiting several years before anything was agreed upon and ending up with a kitchen sink protocol as all others these days do, we took a simpler approach. And instead of hiding in a closet with it, we brought it out to light. As a result we received critical review from some decent members of the crypto community, including: Martin Abadi Mike Burrows Alan Schiffman Matt Robshaw Burt Kaliski to name a few. As for the IETF standards process, we are pushing the document into the RFC process. > (3) Netscape is viewed as a "loose cannon" by most of the other commercial > players in the WWW arena, mainly because they have introduced a fair > amount of FUD into the HTML standardization effort, while simultaneously > promoting themselves as being standards-based. Members of Apple's > "Cyberdog" project and Microsoft's web projects, who *are* trying to > contribute to the standards process, had particularly excoriating things > to say in this regard. This is a matter of opinion. However, I believe that our opinions don't matter in the long run because of the 800 pound gorilla Microsoft. They will push something out, it will be proprietary, and they will name the tune and ask us to play along. Now we can either just sit back in our current comfy cozy standards based processes and languish for a few years, and then SIGH and say "Gee wasn't that fun, too bad microsoft shoved yet another piece of excrement down our throats" or we can be "loose cannons", get something out there, try it out and see what happens. The market will decide one way or the other. > Now, as I said, I am biased and my comments about Netscape are strictly my > person opinions. I will be perfectly willing to revise these opinions as I > receive more data. For example, if Netscape takes a more active part in > the standards process, works with RSA to secure wider availability of the > underlying technology required by their proposals, and generally demonstrates > a willingness to play nicely with other children, that would be great, and > I'll just as strongly defend them as I am panning them now. > > However, in my view, they have not shown a good initial track record. > Only time will tell. > > > Amanda Walker > InterCon Systems Corporation > > --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html -- --------------------------------------------------------------------- Kipp E.B. Hickman Netscape Communications Corp. kipp(a)mcom.com http://www.mcom.com/people/kipp/index.html

8 23