- cypherpunks-legacy - lists.cpunks.org

Re: Black Cryptoanarchy (KKK, monopolies, contract killing)
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 12:36 PM 9/9/94 -0700, Doug Cutrell wrote: >I am trying to understand the arguments for these points of view... I >consider myself to be extremely "liberal" in my political philosophy, and I >have a lot of respect for the arguments of libertarians. But I am >continually pulled back to the "test case" issue of racist employment >practices. This is the case where the argument is most difficult for me to >buy. Cypherpunks is becoming "horrors" libernet. The only legitimate hook for this issue is the fact that many would oppose crypto anarchy (if they knew it existed) because it makes things like anti-discrimination laws possible. To avoid too much damage to the list, I will try and restrain myself to two observations on the subject of laws against racial discrimination (which libertarians do oppose): 1) Laws are enforced by threat of (or by actual) violence. Supporters of outlawing racial discrimination are in the position of arguing that non-violent social disagreements (the decision by someone not to deal with someone else on *bad* grounds) should be "solved" by sending armed men out to punish the person deciding to refuse to hire -- say -- whites. And of course to kill him if he resists his punishment. I would rather see deadly force limited to situations in which there has at least been a breach of the peace of some kind. 2) I have never met a person (and don't believe that there ever has been a person) who has not discriminated on all of the "prohibited" bases frequently. Has there ever been anyone who selected -- say -- their friends and lovers *purely* using random selection. Never discriminating on the basis of race, creed, color, sex, age, alienage, previous condition of servitude, marital status, sexual or affectional preference, handicap, etc. It would be hard to imagine someone who didn't use these prohibited classifications in their personal sexual lives. I observe little use of RNGs (see -- a cypherpunks technical reference after all) in social intercourse. Since it is legal (and indeed considered OK) to discriminate on all these grounds in our personal lives, libertarians believe that discrimination should at least be legal. Freedom of Choice in *everything*. DCF ************************************************************************* ATMs, Contracting Out, Digital Switching, Downsizing, EDI, Fax, Fedex, Home Workers, Internet, Just In Time, Leasing, Mail Receiving, Phone Cards, Quants, Securitization, Temping, Voice Mail.

1 0

Re: Title VII v. Liberty
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

At 1:40 PM 9/9/94, Perry E. Metzger wrote: >Actually, as I recall these have mostly been marketing studies. For >whatever reason (perhaps the same "oppressed group syndrome" that >tends to make several other minorities work harder) gay men tend to be >higher up on the income scale. No, I can't find a reference in a >second -- but if you insist I'll dig one up. Those knowing my opinions If you happen across one, I'd like to see it, but don't go out of your way >closely enough will know that I loathe fundamentalist christians and >that I'm quite rabbid in attacking discrimination against homosexuals. I have at least a rough sketch of your political views in mind, Perry. I wasn't trying to attack you - I was trying to correct something that is a very common misconception. Just happens to be on a rather charged topic. Assuming it was a marketing survey, this makes a lot more sense. They are going to look places where people selling things have a good chance to sell, which tends not to be the blue collar sections (where due to violence and educational differences, people are also much more likely to be closeted, and results are skewed anyway) Also note that income brackets are, to my experience, extremely variant among gays depending on location, race and (here's the biggest, it seems) sex. >Let me note that Jews and Asians are not protected groups under Title >10 -- there are no affirmative action laws for us, and there *is* >discrimination against them -- sometimes even very violent >discrimination. Somehow, however, they have managed to do just fine in >society. Although I believe this is an apples/oranges situation on a number of grounds (no comments on discussing fruit, please :), I see your point. I still strongly disagree that such legislation isn't nessessary, but that's neither here nor there... >Perry -j -- "Blah Blah Blah" ___________________________________________________________________ Jamie Lawrence <jamiel(a)sybase.com>

1 0

CONTROL FREAKS
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Where do I begin? Jim Choate has now retreated into subjectivism rather than Come on, Jim, you've been arguing that totalitarians can ignore economics. Answer my questions. How long did the "Thousand Year Reich" last? What totalitarian states can you name that have had any legs at all? There are none. I take it you don't take the comparison between the Roman circuses where prisoners and other misfits (ie Christians) were fed to the lions and and the Tutonic cirucses of the 30's and 40's (ie prison or relocation camps) where the criminal and other misfits (ie Jewish) were fed to the masochistic 'system' as comparable? The Warsaw Ghetto was not a form of 'circus' then? No, of course not. The Roman circuses were public spectacles. They were a form of entertainment (like professional sports today). Their propose was to distract the populace, not to eliminate enemies of the state. That's what Crucifixion and other types of execution were for. Often, the participants were pros, free men who did it for gold and glory. Hell, Rome wasn't even a totalitarian state. Where do you get these ideas? The Nazis were another matter, but they still didn't make the cut. Show me your successful totalitarian states. 'They' are the persons with money and influence and have also made it in their best interest to sustain the status quo. Just take a look at the Federal Reserve and how they manage the money in this country. Take a look at the special interest political groups who make it their job to get law-makers to look at it 'their' way. I've looked. I repeat, who are "they"? You know, like some names. They can't be too powerful, since social/cultural/legal non-compliance is a growth industry. God, what the hell are you so afraid of? Just exactly whose reality are we talking about ruling here?... people do not analyze their choices the same way you analyze some physical problem like building a bridge.... But that's the point. Economics *is* like building a bridge. You can't spend money you don't have. You can't create wealth by printing money. There are rules, and no amount of subjectivism or Roadrunner logic will exempt totalitarian states from them. But if you disagree, please prove me wrong by naming the states that have "created their own reality." I bet you can't. When I alluded that "they" weren't spending *my* money you wrote: I can assure you that the folks out there will spend their money if it is clear that they will make more of it in the long run. While it is true that public monies are the easiest to spend because of its anonymity it is not the only resource that is there. Consider under-the-table bribes and such. I give up, I don't have a clue what you're taking about. Do you? If so, please elucidate. Apparently, my comment about *structuring your life* so that you could ignore the control freaks went right over your head at the speed of light. FLAME ALERT: All Cypherpunks who disdain flamish exchanges should tune out now. I'm feeling peevish today and this sort of mindless drivel pisses me off. I have decided, therefore, to amuse myself by fucking with Mr. Choate's head for the remainder of this post. I am afraid [we know that, the question is why you are afraid?] that if you ignore a control freak you build the perfect environ [I'm sure you don't mean "environ," a verb. Perhaps "environment" or "environs" would be more suitable. Sloppy thinking; sloppy language.] for their growth. We are not talking about roses [now you've gotten SOMETHING right] here but rather ideas, a decidedly different animal. [Neither roses nor ideas are animals, Mr. Choate. Can you say mixed metaphor?] Ideas can grow long after the original thinker is gone. [Yes, but what has that got to do with our discussion. Focus, Mr. Choate.] To ignore rather than [to?] confront and expose [them?] is the best way possible [possible is redundundundant, Mr. Choate] to get what you don't want. [Interesting use of the negative in your sentence construction, but you never addressed my thesis, to wit: it is possible to structure your life so that you can ignore would-be controllers. There is no substitute for critical thinking, Mr. Choate.] Love and kisses, S a n d y "Who promises to go back on his medication tomorrow." ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

help!
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I'm having problems posting to the cypherpunks list. I was hoping you might be able to help me. could you post this? thanks-- Subject: beta test volunteers wanted I am in the process of starting beta tests on some server-based email filtering software. I need some volunteers to help debug the system. I'll have to ask you to commit to an informal, temporary nondisclosure agreement. If you are interested, please send me mail. Thanks-- vznuri(a)netcom.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Social punishment 2/3: communication societies
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Social punishment 2/3: communication societies If one examines the use of social punishment, one sees that that it is strongest in the smallest of units (a family - 'if you do that again, we won't talk to you') and while best seen as a way of keeping order in small villages or tribes, is gradually replaced by more formal legal systems, with some form of judiciary, police and prison as populations gather in towns and cities. Social punishment also works best with non-lethal 'crimes' rather than murder and rape, presumably more common in cities than in villages (or cyberspace). It has been argued that cities need formal legal systems due to the complex situations created by a large, concentrated population. More people means more people who don't know (and therefore trust) each other, and leads to more crime. Taboo and other social punishment can't work because the people are not as strongly bound together as in a smaller community. This may be partially true. I would say, however, that the primary reason that social punishment works in a village is that it is a _communication society_. People depend on each other (rather than on faceless municipal corporations or public utilities) for most activities. Most of all, they depend on each other to _talk_ - for social interaction. Social interaction is a far more important component of life in a village than in a big city. It is because of this greater need for communication, rather than the size of the population, that ostracization is so effective. Cyberspace is also a communication society. While McLuhan's Global Village has become extremely cliched, in this aspect cyberspace does resemble a village. People on the Net may not be dependent on each other for food and clothing, but they are for almost anything else concerned with a cyber life. There is thankfully no Internet Municipal Corporation that takes care of all roads (net connections), supplies (of information and public keys), and order (through centralized credentials or certification). Most would be repelled at the thought of such a thing. Cyberspace is full of vibrant communities that do little else but talk. Social interaction is at a higher level than at any time in history. The 'crimes' committed in cyberspace are non-lethal and primarily violations of protocol. Like the other communication society, the tribe or village, cyberspace is well suited to a system of social punishment. It's not as if taboos and ostracization don't already exist in cyberspace, to keep people within the few unwritten rules that exist at present. Flames, newbies, kill files etc. As a variety of activities take place in cyberspace, from digital cash transfers to elections to escrow, the number of rules will grow, but there is no reason why the system of punishment cannot be equally effective. No, I'm not saying that you can solve electronic fraud by putting a name in your kill file. More recent technologies - cancelbots, reputation systems (in concept if not in fact) - can make social punishment in cyberspace highly practical. And in cyberspace, if noone reads your posts, you're dead. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Lame security software
by jamiel＠sybase.com 17 Dec '03

17 Dec '03

In showing a co-worker why a lot of the cryptographic software out there is really bad to use, I found one of the worst examples I've ever run across, and I'm in a sharing mood today. For those Mac users out there, get ahold of Norton Partition, which ships with Norton Utilities 2.0. I was demoing the only way it should be counted on for anything, and then not much, by setting up a non-automounting DES encrypted soft partition. I chose the password 'cheesetoast', and explained why this was a bad choice, etc. Well, upon mounting the disk to demo something else, I misstyped 'cheeseto " (that last character is a space), and whad do you know, it mounted. I suspect it checks a hash of the first eight characters, tossing the rest, but don't have time to check and see if that is the case. Happy ending - My coworker then asked "What is that PGP think again?" -j -- "Blah Blah Blah" ___________________________________________________________________ Jamie Lawrence <jamiel(a)sybase.com>

2 1

Social punishment 3/3: reputation systems
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Social punishment 3/3: reputation systems Social punishment works because individuals know that someone has broken rules, and _voluntarily_ cooperate with enforcing the accused's punishment. (Of course part of the reason is the risk of similar punishment for non-cooperation, but a major part, particularly in cybercrimes, is that if an individual could harm someone else, he or she could harm you too.) Social punishment works through reputation. XXX, after breaking rules, is seen to be a 'bad character'. Soon everyone knows XXX as a 'bad character' and behaves accordingly, usually by avoiding contact. Once XXX gets a bad REPUTATION (and this is how _I_ define the term, not as some centrally imposed certificate), in traditional societies it is very difficult for XXX to regain a good one. People _individually_ decide whether a 'bad character' is indeed 'bad' and depending on the stature of the individual and the bad character, may or may not cooperate with any punishment. A priest in traditional society or someone else with impeccable reputation is permitted to interact with even the worst of characters. One problem with such a wildfire reputation system is it can be _too_ effective. Once ostracized, the decentralized system makes it very difficult for someone to rejoin society, to have his/her 'reformation' recognized. The channels in traditional societies include lots of 'good work' and recommendation by 'good citizens' such as the priest etc. The other is a new identity. The most powerful illustration of a reputation system I can think of is Victor Hugo's Les Miserables, where ex-convict Jean Valjean finds himself ostracized by society despite having been released. A priest's kindness is not enough, and he later gains a very good reputation building an industry. The notable thing is that he rejoins society only when he gets a _new identity_ - and later gets back into prison when his old identity is discovered. This is a strong case for universal pseudonymity - BAN TRUE NAMES - which, together with strong voluntary reputation and social punishment systems can form the basis for cyberspatial order. I can't really say as yet how a cyberspace reputation system should be implemented. Old-timers will recognize the distinction between my proposed voluntary reputation and certification - the difference between PGP and central public key directories. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

Reputation credits 1/3
by Adam Shostack 17 Dec '03

17 Dec '03

After Rishab's posts on the uses of digital reputation credentials, I'd like to present some thoughts on how to implement them. Thoughts on creating a Reputation Capital Framework This document is split into three parts: A creating a useful, basic system of service, methods of distribution and implementation of reputation information, and possibilities for extending the system which may make the whole thing unworkably complex, but also may make it much more useful. I am going to begin by not rigorously defining reputation capital. The initial application, IMHO anyway, is magic filtering. The cypherpunks list gets up to 500 messages per week. Right now, I filter based on whose messages I like to read. This is a weak system that requires manual updating. It does not automatically respond when someone who I respect says "I've enjoyed XX's posts." I think that the framework I outline here can do magic filtering well. It also has the ability to evolve into a full fledged system for complex digital reputations in various realms. The simplest system would be where people collect statements of the form "I respect Alice. /s/ Bob." * Alice would collect statements like this, and append them to the bottom of her writings so that people who respected Bob would have a clue that they might be interested in what Alice has to say. A 'web of respect' could easily be formed, with each step away causing some reduction in value. The number would have to be large enough that reputations could spread--ie, that people could get some use out of this beyond an elaborate name for a kill/hotfile. It would also need to be small enough that reputations lines do not extend forever. Eventually, you don't care what Kim thinks of Loius. I would guess that some multiplier between .9 and .05 would work well. People you respect directly get the highest rating, people further away lose some amount of that respect until it trickles down to nothing. * the statement "I respect Alice. /s/ Bob." is analogous to "I find Alice's work interesting, informative, or otherwise worth reading. If someone would like to suggest a name other than reputation credentials for this, I'd be happy to hear it. Note that in this simple system, statements do not have any numerical value attached. Bob can not respect Alice 30% or 99% of the time, he only gets a binary statement. Its an obvious extension to let Bob say "I respect Alice 80% of the time. /s/ Bob." I only point this out because it is not mandatory that a system be constructed this way, and in fact, even a very simple system could be quite useful. With the addition of partial respect, the need for an automatic reduction in value becomes much less clear. If Alice respects Bob 50% of the time, and Bob respects Charlie 50% of the time, then Alice will probably find that a 25% respect rating for Charlie is good enough. (I'm not going to get into possible variations here; things seem to work well using percentages for reputation credentials and negative percentages for disrespect. The numbers are multiplied together, shrinking away to nothing pretty quickly, except in the case of a group of people with a good deal of mutual respect for each other.) Also, if several reputation credentials come in for one entity, they can simply be averaged together. This respect rating is relative; there is no central organization to say that Charlie's Used Cars sells great vehicles 25% of the time, its just what Alice's agents will be able to gauge how interesting Alice might consider someones work to be. Someone she occasionally respects sometimes thinks well of Charlie, so its more likely that she will be interested in what Charlie has to say, at least in comparison to someone Alice has never heard of at all. In this system, it makes sense for Charlie to spend a lot of time making his customers happy at first, and holding on to their endorsements of him, because there is no time limit on the statements, and no way to retract opinions. So, those are two natural enough extensions. Decaying reputations, based on the age of the signature, cause a reputation cred. to eventually become useless. Then there is the matter of retracting, or post-facto changing your statement of a reputation. This is more problematic. Remember right now, Alice, Bob and Charlie are simply collecting these reputation credentials, and storing them themselves. If Bob sends Alice a statement "I no longer respect Alice at all. /s/ Bob, 1 Sept 1994," Alice can simply forget to include it in her list of reputation credentials. If she commits to it through some crytpographically strong protocol based on her actions, she can probably dump it, and do business for some period of time before someone runs through all the work to confirm her reputation is as she presents it, and discovers she is lying based on outdated credentials. A solid system needs to ensure that up to date, complete credentials are available for most people most of the time. In my next message, I'll show several possible designs for systems that could exist in parallel to distribute reputation information, and explain why each would be useful. I'll also sketch out a set of programs to demontstrate how the system could be used.

1 0

reputation credit 2/3
by Adam Shostack 17 Dec '03

17 Dec '03

Design criterion for a reputation service: * Reliable * trustworthy * resistant to dropping unflattering credentials * decentralized * easy to use * easier to automate * needs to support distributions of pseudonyms reputations without providing information about the nym. Designing a solid credential server is not an easy task. There are many requirements that one should meet. The basic server I am considering is designed for Internet as it is today. Mostly academics, researchers and students, operating on a highly insecure internet for mostly personal reasons. There are few large transactions occurring on the net; there is not a lot at stake in the grand scheme of things. OTOH, there is an awful lot at stake; specifications, especially bad ones, tend to live forever. Remember the RISKS piece on trains and horses? Thus the server I present could work well today in conjunction with MPAs, (Mail Processing Agents, such as procmail and filter) with newsreaders, and other similar software in order to handle bright filtering (the next generation of kill & hot files should be based on a distributed idea of whose work is worth reading, and whose is not. After that, the system should expand to cover reputations in various realms, reputations for various characteristics, and other things which I'll talk about in the next message. There are three basic models for sophisticated reputation distribution. The simplest method, of each person handling their own, has too many failure modes to be useful. The sophisticated models are essentially mail, Usenet and server based. I assume all transactions are signed, and encrypted at the users request to provide some amount of security against forgeries and traffic analysis. In a server based system, some set of databases exists to collect reputation certificates. A user (better yet, their agent) asks for a reputation certificate for some entity. The server sends it back. This could be built on the send everything you know model, or the request could be for certificates of people who the requester respects. Such filtering might be better done on local CPU. The system has the advantage of carrying all information in an easily queried format. It also has the advantage of concentrating certifications. Thus you could say things like 'The well regarded spaf' or 'The often ignored Marjorie Simpson,' because the server would collect such data. The next system would be based on Usenet. People would occasionally post their opinions to a newsgroup, and people who respected those people, directly or transitively, would pull in their postings. This system has the advantage of using existing technologies, and propagating widely, probably even past most firewalls. A third system would be based on mail. People would subscribe to lists, or send mail to folks they respect saying 'please put me on your reputations list.' The folks thus honored would then respond by sending out regular lists of who they respect or disrespect. This really requires everyone to run some sort of filtering agent. It has the advantage of allowing people to set up closed lists for propagation, and only distributing information on a demand basis. Note that this mail system is not the only one that could use mail for propagation, it simply uses mail as an automatic and regular carrier of information, while a server system would only do so on request. Both the mail and news systems may fail to provide timely information about new individuals who may have a reputation, but because you never asked for it in mail anywhere, or because articles have expired on your newserver, you can not find it. This is the reason the server system would be useful. Not so much in a filtering context, but instead in a system where reputations are relied on for various semi-real time services. The expandability of the system relies on part on its ability to find arbitrary reputation information quickly and automatically. That is something that a server system does well, but a mail or news system does not. To build a mail system, you would need some sort of decent filter (such as MH filter, procmail, or mailagent) which can run programs based on a set of conditions. You would need a rule which would watch for incoming reputation cred. certificates (which would be signed, maybe encrypted). This would pipe into your assesment program, which would keep track of how you relate to each of the various people who send you reputations cred. certificates. It would turn all the information into a database. On any high volume forum, you could filter incoming mail into a set of filters which react based on the numeric scores given to a person by your assesment program. Anyone whose carries enough reputation credits to pass your filter goes into one box, everyone else goes into another. (Clearly, you can be more selective, set up several boxes, or whatever else you want.) The tough part of making this system work is in the generation of reputations credits. Hal mentioned that the Extropians built a system based on buying and selling of reputations on a market. I don't see these reputation credits as being something tangible. You can't carry your reputation credit with you; they exist as a result of your participation in a web of respect. I don't care that Homer Simpson is a well respected authority in rec.drink.brewing; his worlds and mine rarely cross. He can't pick up his reputation credit and plop down in cypherpunks, expecting to be well respected; none of us know him. Or maybe someone does, in which case, they can (automatically) tell us what they think. Becuase reputation credit is not fungible, and because it propogates itself, buying and selling it may be confusing. If someone well respected gets an additional unit of reputation, then all the people who he/she respects will also gain slightly. I expect that a system based on giving away reputation credits would work well. If you respect too many people too mcuh, your value as a link in peoples chain will decrease, and people will start disrepecting you, becuase you disturb their filter. Eventually, if you keep it up, the value of your reputation credit will drop close to zero, as no one cares about what you have to say anymore. This may fail if someone with interesthing things to say decides to disrupt the system. I'm not sure why someone with interesting things to say would think it was worthwhile to disrupt the system, but I don't like designing things on expect and oughts. Perhaps a system could be implemented that would allow you to give reputation credit in 'transferable' and 'non-transferable' forms, so you could respect what someone had to say, but pay no attention to their opinions of people. I hope, but don't know if I can expect, that a system like this would get its initial momentum from people who want to be able to use it for their own smart filtering. If the system were well designed (easy to change how much reputation credit you give someone), then making a change in your filtering would be as simple as saying "slander tcmay(a)netcom.com +50" (slander is the working name I've been using to describe the program to enter reputations, good or bad. It came from thinking of this as a Usenet based system.) If the system could build up some initial momentum from people using it for personal filtering, then it would probably accelerate from there. As more people use the system, it becomes more useful to use it, accelerating its growth. Its growth hopefully, is not constrained by the underdesign of servers, since each person serves themselves. As the software becomes more useful, it is easy to build and design alterate systems of spreading reputations because the system is decentralized. If I decide I want to build a system where each person whose first name begins with a vowel gets an extra 5% added to their reputation, and then add 10% to my perception of the reputation credits of any one who three people I give more than 75% reputation credit to, then I can implement that in my local assesment program without disturbing everyone who relies on my server. (Admittedly, the people who currently pay attention to who I gvie rep cred to may no longer do so, after strange credits start coming out, but thats a seperate problem.)

1 0

Re: Crypto Anarchist Manifesto
by jburrell＠crl.com 17 Dec '03

17 Dec '03

>And is it possible to obtain a copy of your 1988 "Crypto Anarchist Manifesto."? >Sounds like fun. FTP Site? I found it on soda.csua.berkeley.edu last night. I don't think it was there before. Look for it in /pub/cypherpunks/rants/. -- Jason Burrell <jburrell(a)crl.com> Finger for PGP public key. There is no such thing as limited censorship. If you want your freedom, fight now. Don't wait until you've lost it.

2 1