- cypherpunks-legacy - lists.cpunks.org

Governing an information society - 4/4
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Real crime on cyberspace? The analogy to violence of action, such as murder, is violence of data, the fabric of cyberspace. This may have many forms: belief or opinions, knowledge, information and data crime. Violence of belief (thoughtcrime) - while some people feel that to discuss rape is to perform it, and discussing crimes is subject to a range of conspiracy and riot-control laws worldwide, this really can't be a crime in any free society. Then there is the knowledge crime - theft of intellectual property. This is in my view the single biggest issue in an information economy, but it can be addressed by a combination of encryption technologies, to prevent 'unauthorised' access, and the decentralized, non-governmental civil system discussed previously.Intellectual property can in any case not be treated quite as land and bonds are, and there are practical and moral issues involved in just what it is, which I may talk about in the future. Information crime - 'unauthorised' access of other information such as mail, unreleased memoirs etc, is basically an issue of privacy and can only be practically addressed through technology. Data crime - 'cracking', 'phreaking' etc usually reflect a total lack of responsibility on the part of _administrators_. "Officer, I left my wallet on the kerb 10 minutes ago, and now it's gone!" Better security and greater awareness will prevent most of it. If you do happen to catch a cracker, go through the same old _civil_ system. It is not really practical for a central Thought Police to actually find data criminals, without huge and non-specific violations of privacy. And data criminals don't need to be put in jail, they are probably the most affected by 'cyberdeath' - disconnection, digicash accounts cancelled, reputations muddied. I wouldn't want to do that to _anyone_ actually ;^) A thread I started months ago ('Cyberspace is by nature crime free' / 'Crime and punishment in cyberspace') led to similar Tim May-ist conclusion - let the police (and the minimalist government) attend to murders in brickspace, we cybercitizens will look after ourselves. Concluded. Rishab ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1

Digital cash market
by Jim Hart 17 Dec '03

17 Dec '03

L. Todd Masco: > The american people keep claiming in polls that they want better privacy > protection, but the fact is that most aren't willing to do anything > about it: it's just a preference, not a solid imperative. Most customers want more privacy, but when you think about it, there is not a whole hell of a lot they can do about it right now. If they want to get the status and flexibility of a credit card, they need to give up their privacy. Nobody has tried to give them a private alternative. For that matter, no one has shown people at a gut level, as a good ad could do, what the consequences of loss of privacy are. At this point Duncan Frissel will regail us with some wonderful scheme, understandable only to lawyers, that can be used to get credit cards under aliases, perfectly legal if you use a doubly nested corporate structure going through Aruba and the Caymans, and the IRS and FBI don't decide to get to get you on some technicality Duncan failed to mention. I won't comment on why most consumers have neglected that option. What I'm talking about is a digital cash system that is as easy for the consumer as an identified debit card. We can do that with today's technology. The traffic level on this list is proof that there are plenty of people who care about privacy. The surprisingly large number of folks who actually do go to Frissell style lengths is proof that there are plenty of peope who care about privacy. Once we have learned what the problems and solutions are, we are willing to go to a significant amount of effort or inconvenience to get it. The real problem is, these polls are not well publicized, are geared towards political rather than business solutions, and haven't sunk through to the people in the product R&D and marketing departments. Exacerbating this, some organizations (such as American Express) make a lot of money off their free treasure trove of transaction information, and are using lots of FUD to keep privacy enhanced alternatives off the market. A dramatic, Apple-style ad portraying Visa and MasterCard as Big Brother may be what is needed to get over the apathy hurdle. There are plenty of credit card privacy horror stories we could publicize. Think of what could be accomplished these days with an infomercial. But this takes at least one excited organization with marketing clout to do it. Meanwhile, smart card based digital cash trials, supported by a large bank, are going on in Britain. There are major markets for both customers and vendors that don't have access to the credit card system, as well as customers who care about privacy. This is not a fringe technology; its possibilities just haven't sunk in yet. Jim Hart hart(a)chaos.bsu.edu

2 1

www log stripper
by Jim Hart 17 Dec '03

17 Dec '03

First question: does anybody know the full URL for detailed information on how World Wide Web servers do logging, and the particular kinds of connection and transaction information they can log, and what information they typically do log? (I know the main Mosaic doc URLs but can't find this info). Second question: wev'e heard about installing swIPe in the kernel and using it as an anonymous packet forwarder -- stripping off the original. Has anybody done the analogous thing at the http protocol level for the World Wide Web? That is, set up an httped, the only purpose of which is to forward URL requests with all originating site and username information stripped. I would love to use such a service. I would even pay substantial amounts of "Magic Money" tokens to do so, if somebody writes a convenient user interface to that system. Also, if some folks are serious about taking the lead on either of these projects, I'd be happy to contribute my hacking skills (the typical C/Berkeley Unix & networking, etc.) and do beta testing. Jim Hart hart(a)chaos.bsu.edu

2 1

Re: NSA Spy Machine and DES
by Ian Farquhar 17 Dec '03

17 Dec '03

On Aug 18, 8:13pm, Jim Dixon wrote: >In message <9408190809.ZM4528(a)simple.sydney.sgi.com> Ian Farquhar writes: >>Actually, I would be surprised if the "SIMD" processors were not a huge >>array of reprogrammable FPGA's, quite possibly Xilinx's. The possibilities >>of a large array of these chips, each with local memory, is quite >>interesting. I have personally seen an array of 64 Xilinx chips in a DEC PeRL >>box doing RSA, at speeds similar or better to almost all available custom >>hardware implementations of the cipher. >The delays in getting data on and off the chip are too large and the amount >of space wasted in redundant functions is too great. That is a rather sweeping statement. Want to back this up with some facts and figures from real FPGA implementations? Certainly the early bit-slice designs you mention later on did suffer from these problems, but FPGA's bear little relationship to those rather venerable devices. >You might prototype >it using FPGAs, but even this is unlikely. Why not just buy one of the >existing SIMD processors and simulate your target system? Because the FPGA solution is obviously less flexible, but a hell of a lot faster than software simulation of another architecture. In this application speed will win every time. > People used to build fast processors out of separate chips (bit slices). > They don't do that any more because it's too slow and too expensive if you > are building in volume. But this application is NOT building in volume. And yes, people do still built multichip CPU's: most traditional supercomputing and mainframe vendors for a start. Indeed, I would be surprised if this application didn't design it's own FPGA (for ease of interfacing with the comms network for a start), but I'd argue that a SIMD configuration of reconfigurable FPGA arrays (ie. a fixed array of reconfigurable arrays) would be an awesome system for many problems that the NSA would deal with. Ian.

1 0

Cypherpunk U
by Nick West 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- What are some of the better colleges/universities to study Computer/Network security at? I know MIT is a good one. Any others that aren't quite so hard to get in to that still offer quality programs? -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBM9Eu9MF7aWKjtgVVAQGQUAP+O1255PqXzWGixEcku+kOwxhSpiibilg5 GMnV/6KZ1uWLefyWhyclx0S8yogHhbDyaWs3jpJ32MNQk/hbpliotD3r7oJHgmux pCbv71pwBzPU0z1q5qtaBnU3kEuCQtnVVvYobSJWkcrVAnBMxQVIl4Pd8ccHGdmy kKvoKx5Z3YM= =B3mA -----END PGP SIGNATURE----- Nick West http://members.tripod.com/~NWest/index.html

6 5

No Subject
by Anonymous 17 Dec '03

17 Dec '03

L. Tood Masco: > Perhaps one could generate a privacy crisis by collecting that information > and conducting a mass mailing to every person in the database: "we have > this information on you. So could anybody with $125. Call your congress > critter and complain." This is a wonderful, wonderful idea. The biggest blow to privacy in this decade was when Lotus Markeplace was withdrawn off the market. This ifnromation is already widely distributed. The only effect the withdrawal had was keeping the public in the dark about what infromation is out there in the world about them, and (by inference) how it was obtained. The sad fact is, most of the political action over 'privacy' only has the net effect of keeping people in the dark about what information they are giving out to complete strangers about themselves. Most people don't realize, at either gut level or fully at the intellectual level, just how much personal information they are giving away when they write down their Social Security or other universal ID number on a form. As long as the information is only being swapped between skyscrapers, so that most peple aren't allowed to access it, this ignorance will contininue. People will realize what they are doing when it's sitting in front of their faces on the computer screeen. I also highly recommend using anonymous remailers to post allegedly personal, but in fact widely available, information to the net such as credit card numbers, credit histories, medical data, and the like -- as long as viable alternatives for the victims are available. Timing is critical here; let's be ready to do this but not jump the gun until the alternatives are available. Let's promote real privacy, technology that gives customers real knowledge and choices about what data they give out, rather than the current bankrupt political movement which promotes information theft from ignorant consumers, and the hoarding and monopolisation of information, in the name of 'privacy'.

1 0

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:20 PM 8/19/94 -0700, Eric Hughes wrote: >A raw, non-modal "is"?? Digital cash doesn't exist yet, so saying >that it "is" something, is, well, premature. The real question is >"What happens if we set up a digital cash system as a callable bond?" > >And my answer to that is, "You really _want_ the SEC involved?" > I meant "is". Like a triangle, or a limit, or an asymptote, "is". It's okay to be non-modal here. Digital cash has to be issued by someone, who *really should* back it up with real money, and should thus receive real money as collateral for the digicash on the net. Thus, there's a float. Thus it's really a loan with a security (ecash) to prove it, with the collateral in the bank of the issuer earning the issuer interest. Thus it's a bond. And since it has no maturity date, and it's not a perpetuity, then it has an implicit call provision. Thus, it's a callable bond. Example: A CMO is a callable bond, whether it's called one or not. When a tranche's principal comes in, the tranche is "called", and the investors in that tranche are paid off. By the way, most people refer to a callable bond as a series of options, and that's how modern portfolio analysis is done on them... Wittgenstein would laugh. The SEC has nothing to do with the mechanics of a security's behavior. There are some bonds which are illegal here, but not illegal outside the country. They're still bonds. The obligation is held by the issuer, and the issuer keeps the interest, which discounts their price. Also, so what if the SEC is involved, or not? I expect that there has to be a test of the technology, forced by the possibility of competition from overseas (regulatory arbitrage). If the market test is successful, then the SEC will not willfully restrain trade if the market's big enough (the revolving door), and perceived to be benign enough. Frankly, I don't see what the fuss is about, do you? It's just a low-cost settlement mechanism for retail transactions on the internet. ;-). > The issuer gets to > keep the interest accrued on that money while the ecash is in circulation. > >Perhaps in some systems this is so, but not all. The unit of account >must be fixed, but the unit of account may not be constant currency, >but rather currency at a fixed interest rate. Is "unit of account" a formal term here? Could you define it? The problem about not keeping the interest on the float is, who do you pay it to otherwise? If you have a truly anonymous digital cash system, you couldn't find the original purchaser if you tried. If you want to treat this like a settlement problem in securities operations then you have to track each owner's interest share for the time they held the instrument and pay them back. Again impossible. If you pay back the accrued interest on that specific ecash certificate to the person who "walks in the door" with it, is it fair? The solution is, keep the interest, use the money to fund the issuer's operations. If that's not enough, charge exchange fees. A competitive market will sort out who's got the most efficient operations, and thus ecash users get ecash at its most efficient price. It's just like insurance. An insurance underwriter collects premiums, some portion are direct fees for handling the transaction. The remaining premiums are put into a fund which accrues interest (for want of a better term). Some or all of that interest ends up in the insurers pocket, and the rest is held for loss reserve (which may be itself reinsured) so the insured are paid when calamity strikes. It's a living. >Why do you assume that the only source of income for the "underwriter" >is the return on investment from the float? Sure, that's one business >model. Transaction and participation fees can also be levied. It's not really like you're quoting me out of context here, but I really did say further on in the post you're talking about here that exchange fees were how an issuer made up the difference between his cost of operations and the actual return he got on the float... >The issuer has a debt mediated by an instrument, yes. There are, >however, more instruments than bonds available for use. Yes. But probably short term bonds (money markets, t-bills) are safe places to earn higher returns than a demand deposit account. It's all cash management technique, which is pretty straightforward, boring stuff. >Is the debt >secured or unsecured? It's secured by the cash which bought the ecash in the first place, which can be put into secure money instruments of some sort. See the post you're quoting from about durations, total return, etc. If you want the issuer to put it into a demand deposit at, say, Shawmut National here in Boston, and let *them* invest the money in the money market, you can do that. They'll gladly take your money. (This is a good reason for a bank to get into the market, in my opinion, because of this synergy.) But it doesn't take much to manage your own portfolio of cash instruments by yourself. >What happens during bankruptcy of the issuer? This probably won't happen except in cases of fraud. I expect this business to be pretty boring. After all, you're the one with a portfolio of (real) cash to manage. Unwinding a position in the money markets is not really a scary proposition at all. When an ecash bank "fails" if ever, it'll be just like the old days (actually, not so old, really; Continental in Chicago was the last famous big one). The ecash banking community will circle the wagons and honor the unfortunate's ecash. More probably the bank will be quietly merged, and no one will know the difference. >These and similar issues determine the nature of the instrument. The instrument is e-cash. It's backed up by dollars, probably money market instruments, or maybe government bills. There may be "brands" of ecash which may have to charge higher and lower fees, depending on their risk. A rating system could evolve. I bet that the differences between issuers could be pretty marginal after a while. It's as simple and as boring as running IBM's corporate treasury accounts. It's just not that complex. > If you thought that > the ecash duration was 3 days and it stayed out there 3 months, > >It's unlikely that these sorts of figures are not going to be known >shortly after rollout, during which phase the cash management function >for income is much smaller. Agreed. Pardon my hyperbolic example. I just put them out there for illustration. Fees will be higher at first. They might be too high to sustain a market in the long run. There's no way to find out except to try, which was the ultimate point of the post. > > In > theory, if the fees are high, the money may never come back, and stay in > circulation forever. > >I think you may be getting confused here between "on-us" transactions >and a first class currency, which does circulate. Digital cash cannot >"circulate forever". That's why I said "in theory". I thought I qualified that further in the same paragraph. Again my hyperbolic rhetorical style does me in. In the first few pages of finance text books (I read Brealy & Meyers in 1985), they like to talk about British securities called "perpetuities". They are literally perpetual bonds with no expiration date, and a few have no call provisions at all. Whoever holds them keeps getting interest until he sells them. This type of asymptotic behavior was what I meant by "forever". I forgot at the time that digicash grows every time it's exchanged, for instance, and was simply making a point about the behavior of a system at it's extremes. My apologies. By the way, what does "on-us" mean? > >I should note, however, that I agree with the basic point, that the >portfolio management problem for digital cash is not unusual. > >Eric I'll leave this here. I feel better now. Between Eric and Tim, I feel a little like the gopher in the game at Chuck E. Cheese's. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

4 3

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 10:16 AM 8/21/94 -0700, Hal wrote: >I think Eric was referring to simple double-entry bookkeeping. I don't >have his original post in front of me, but I believe the suspension account >was a liability account which represented the digital cash in circulation. >In double-entry bookkeeping, every transaction alters two accounts so that >the books stay in balance. It's not unusual to make up specific accounts >for the particular assets and liabilities of your business. No. I was not referring to the process (double-entry bookkeeping), I was referring to the actual name of the account where the principal is held until it is redeemed. I liked the name, but I was wondering about where he got it from, or whether he invented it himself. If so, how did he arrive at the name "suspension account", etc. >There's something I don't understand about this "immediate and final >clearing" business. In an on-line cash system, the cash itself is not >"cleared" until you send it to the bank and/or have some guarantee from the >bank that it has not been spent before. It seems to me that you could get >the same benefit from a checking account if you called the bank, verified >the funds were available, and electronically cashed the check on-line. Right. My use of "immediate and final" comes from Eric (or maybe Perry). > >In an off-line system, is the cash really cleared immediately? Clearing in this case is when the cash passes from you to me. When I spend that cash with someone else, and they in turn spend it somewhere else, it's really clear, because neither one of us can ever trace where it went. For all intents and purposes, we might as well call the transaction clear at the time of its execution. Thus it's immediate and final. Just like any other cash transaction. >What if it >is double-spent? Is the bank going to guarantee to cover all instances of >multiple spending, in the hope or expectation that it can sue the customer >who did it? What if you're talking about huge sums of money, and the guy >doesn't just double-spend but hundredfold-spends it, then vanishes to Rio? >Are the banks going to cover that? They don't cover bad checks, and I don't >see how they can afford to cover bad cash. Exactly. Though I think it would be worthy of much more than a civil suit. I expect that criminal charges come into play here. The culprit has been identified. Out come the gendarmes, or maybe interpol, since he's gone to Rio. Catching an international criminal and extraditing him is not new technology. You don't even need new law. Just call it (wire?) fraud and leave it at that. People and businesses have insurance against fraud. I expect there will be a whole industry popping up after a while on e-cash loss control and insurance. > >So for both on-line and off-line ecash there appear to me to be problems >with the notion that cash has a unique advantage in providing immediate >clearing of transactions. Except for where the cash has been double-spent, a very special case, indeed, the cash has cleared once it's been spent by the person whom you gave the cash to. It's untraceability clears the transaction. It's immediate. It's final. > >Hal ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Another Denning's view
by blancw＠pylon.com 17 Dec '03

17 Dec '03

>From Pat Farrell, quoting Peter Denning: "..... Now the strength of the country depends not only on its government but on its corporations. . . . . A new policy aligned with the new clearing would be for the National Security Agency to make its expertise available to the private sector, enabling markets to flourish in a worldwide information medium." ................................................................. ..... What an amazing difference between Dennings. What a great idea for the NSA were to become allies and start working for us, instead of for 'them'. The perception of it (NSA) would change in everyone's eyes; even pencil-toting nerds could learn to like them. Blanc

3 2

Governing an information society - 3/4
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

Violence of action requires the protection and violence of action in return. Violence of belief requires the freedom to believe differently. It definitely should not require violence or protection of _action_ in return. Having dispensed with the role of traditional government in the area of social development and civil law :-} what remains is the need for a police force to tackle murders. If I'm murdered (or raped or have my arm minced or whatever), it is physically damaging. I suppose I'd say the same of my house being bombed. I need protection from such things, and the sort of socially accepted protection that won't lead to riots or the law of the jungle. Barricading myself, carrying a Kalashnikov and learning aikido is not enough, not for a civilized society. So I concede the existence of the police. (There is another reason - it is usually practical for the police to trace murderers or arsonists). In cyberspace, there is a 'social upliftment' role. Though initially paid for by various governments, there are a number of organizations that manage to distribute costs efficiently and provide huge service and infrastructure for low rates. There may also be 'civil' suits in cyberspace. Due to digitally signed, undeniable contracts, these should be reduced to only those that involve a breach of contract, rather than a suspicion of invalidity. 'Civil' cases can be sorted out by a cyberjudiciary, and punishment efficiently enforced by a society without any central control. While there have probably been no civil cases on the Net in the traditional sense, there have been situations where the power of distributed control was apparent. For instance, when Richard Depew's ARMM went out and cancelled anon posts on USENET, there was universal outrage. His punishment required no central 'law enforcer' - it was just the threat of posts from his site being cancelled that did it. And this would not have been possible without general, widespread agreement with the 'verdict' - as anyone not enforcing it would risk similar punishment from the large majority. Continued... Rishab ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

2 1