cypherpunks coding challenge
A couple of people have complained of the huge efforts put into breaking keys, and of the small efforts invested in cypherpunks code writing of late. Perhaps there is something to this challenge stuff, in terms of getting contributors, neatly tabulating results, working up enthusiasm etc. So... how about a code writing challenge, an award for the best cypherpunk project every month. (No monetary prize, just vote on list to decide most significant project). Perhaps a list of how many lines of code. A hall of fame if you like: % wc -l `find . -name \*.h -print -o -name \*.c -print` Eric Young SSL-eay 101,721 lines PGP Inc pgp30 (?) lines Phil Zimmermann & co pgp263 34,891 lines Peter Gutmann cryptlib200 34,845 lines Tatu Ylonen ssh-1.2.20 33,650 lines Wei Dai crypto++ 2.1 32,831 lines Ian Goldberg Lucre 0.9.0 20,283 lines Colin Plumb bnlib 20,148 lines Matt Blaze & co cryptolib-1.1 19,908 lines Pr0duct Cipher PGPTools 13,062 lines Pr0duct Cipher Magic Money 15,026 lines Ben Laurie Apache-SSL patch 957 lines etc. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`
At 2:38 AM -0700 6/22/97, Adam Back wrote:
A couple of people have complained of the huge efforts put into breaking keys, and of the small efforts invested in cypherpunks code writing of late.
Perhaps there is something to this challenge stuff, in terms of getting contributors, neatly tabulating results, working up enthusiasm etc.
So... how about a code writing challenge, an award for the best cypherpunk project every month. (No monetary prize, just vote on list to decide most significant project).
Perhaps a list of how many lines of code. A hall of fame if you like:
% wc -l `find . -name \*.h -print -o -name \*.c -print`
Eric Young SSL-eay 101,721 lines PGP Inc pgp30 (?) lines Phil Zimmermann & co pgp263 34,891 lines ....
Not to be tedious about this, but why would "lines of code" be an interesting metric? I'm reminded of a cartoon showing a Russian factory winning the "greatest tonnage of screws produced," with a crane lifting a massive, 100 meter long screw above the factory. The dangers of the wrong metric. I think we need a few major innovations more than some number of lines of code. --Tim May (No, I'm not a programmer. But I've done a few "hacks" which were interesting and useful, I think. Taking readily available stuff, "BlackNet" made the concrete point that data havens and anonymous markets already are possible. Number of lines of code written: zero. The task is to combine some of the existing tools into new things. Raw lines of code is not necessarily useful.) There's something wrong when I'm a felon under an increasing number of laws. Only one response to the key grabbers is warranted: "Death to Tyrants!" ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1398269 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."
Tim May <tcmay@got.net> writes:
At 2:38 AM -0700 6/22/97, Adam Back wrote:
So... how about a code writing challenge, an award for the best cypherpunk project every month. (No monetary prize, just vote on list to decide most significant project).
Perhaps a list of how many lines of code. A hall of fame if you like:
% wc -l `find . -name \*.h -print -o -name \*.c -print`
Eric Young SSL-eay 101,721 lines PGP Inc pgp30 (?) lines Phil Zimmermann & co pgp263 34,891 lines ....
Not to be tedious about this, but why would "lines of code" be an interesting metric?
I'm reminded of a cartoon showing a Russian factory winning the "greatest tonnage of screws produced," with a crane lifting a massive, 100 meter long screw above the factory. The dangers of the wrong metric.
I think we need a few major innovations more than some number of lines of code.
Well, personally I'm not that bothered about line counts (good code tends to be smaller than sprawling badly written redundant stuff, anyhow). But what I am bothered about is that not that much in the way of cypherpunks apps are getting written, and that PGP Inc, aren't going to write them for us, because they won't sell to fortune 100 mega-corps.
(No, I'm not a programmer. But I've done a few "hacks" which were interesting and useful, I think. Taking readily available stuff, "BlackNet" made the concrete point that data havens and anonymous markets already are possible. Number of lines of code written: zero. The task is to combine some of the existing tools into new things. Raw lines of code is not necessarily useful.)
Indeed. I was going to include a line count of your cyphernomicon, but I appear to have mislaid my gzipped copy. The part about a cypherpunks award for most significant project of the month was the meat of the post. I speculate that a web page with tabulated wish lists (from list discussion), where these are ticked off as done, etc might be some encouragement. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`
-----BEGIN PGP SIGNED MESSAGE----- In <199706220938.KAA06436@server.test.net>, on 06/22/97 at 10:38 AM, Adam Back <aba@dcs.ex.ac.uk> said:
A couple of people have complained of the huge efforts put into breaking keys, and of the small efforts invested in cypherpunks code writing of late.
Perhaps there is something to this challenge stuff, in terms of getting contributors, neatly tabulating results, working up enthusiasm etc.
So... how about a code writing challenge, an award for the best cypherpunk project every month. (No monetary prize, just vote on list to decide most significant project).
Well I haven't done alot in the area of writting crypto algoritims I have done quite a bit of work in the area of crypto implementations (mostly in the PGP - E-Mail Integration). I have also been working on improving performance of PGP when working with large keyrings (primary & secondary indexing, multiple keyring lookups, public key caching, real time key retreival from BAL servers). - -- - --------------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. OS/2 PGP 2.6.3a at: http://www.amaranth.com/~whgiii/pgpmr2.html - --------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: 2.6.3a Charset: cp850 Comment: Registered_User_E-Secure_v1.1b1_ES000000 iQCVAwUBM61b+o9Co1n+aLhhAQEaswP/VqevtYSH4/dnNtKwP5KGABp+6MgwUZTF grnEgYUM8j1QGWCjEUX8FqzoJGD6PCFgFQ36uwzE3K/+/sCHbIY9wYeha47bjDok DSCTWxdztbclBLldQRzIXpbx4varCZ5xTm5inzrNVAypDdrCWIPNvtlgflq+6+aI UCxr1QB5cJo= =duot -----END PGP SIGNATURE-----
Perhaps a list of how many lines of code. A hall of fame if you like: % wc -l `find . -name \*.h -print -o -name \*.c -print` Eric Young SSL-eay 101,721 lines PGP Inc pgp30 (?) lines Phil Zimmermann & co pgp263 34,891 lines
Not to be tedious about this, but why would "lines of code" be an interesting metric?
Yeah - I was thinking of the following entries: Adam Back RSAperl 4 lines Adam Back et al. RSAperl 2 lines I don't think anybody's made a T-Shirt with SSLeay on it yet :-) (Though actually SSLeay has been very useful to a lot of the world's free cryptography, and has prompted the US spooks to pressure the Australian spooks into restricting crypto exports, just as they've pressured the NZs into restricting them for Peter Gutman, and have been trying to work on the Irish...) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list or news, please Cc: me on replies. Thanks.)
(cc'd to a couple of people who's name is mentioned in second half) Bill Stewart <stewarts@ix.netcom.com> writes:
Tim May <tcmay@got.net> writes:
Not to be tedious about this, but why would "lines of code" be an interesting metric?
Yeah - I was thinking of the following entries: Adam Back RSAperl 4 lines Adam Back et al. RSAperl 2 lines
I don't think anybody's made a T-Shirt with SSLeay on it yet :-)
:-)
(Though actually SSLeay has been very useful to a lot of the world's free cryptography, and has prompted the US spooks to pressure the Australian spooks into restricting crypto exports, just as they've pressured the NZs into restricting them for Peter Gutman, and have been trying to work on the Irish...)
Could you elaborate on these. I caught Peter Gutmann's comments on the hassles a company he did some work for were having with the NZ spooks. (The spooks intercepted their mailed disk, plus some other cloak and dagger spookish stuff). Is this still going on, was it ever resolved? Can the next version of cryptlib be exported legally? Or are we relying on Peters bravery? I remember vaguely some announcments about Australia. Has Eric said anything on this, has anything been enforced, is it legal to export SSLeay from down under? Ireland is new to me. What's their problem? Who's exporting things to attract spook export attention over there? (There are quite a lot of high tech companies over there, it's a sort of Euro silicon valley, mostly due to tax breaks, 10% corporation tax, etc). Btw, the UK has it's own problems also. You can export whatever you want in `intangible form', but to post something in a tangible form, such as perhaps a CD (or a perl-rsa T-shirt?) you need permission from DTI in consultation with GCHQ. There are several forms of license you can get depending on what GCHQ think of your product and of you politically. These vary between getting a license to export pretty much anywhere except embargoed countries (Iraq, China, etc) without further hassle, to having to ask for export permission on a case by case basis, going down to permission for repeat exports to the same customer. The heuristic by which permission is handed out is nearly impossible to extract from the beaurocrats/spooks. (Give us protocols, and a customer, and we'll tell you.) I have it unofficially from the hosses mouth that if you make use of the intangible export loophole, that it might "reduce" your chances of getting permission to export tangibly. I thought Ireland was similar, being based on European legislation, though perhaps with less of an axe to grind than GCHQ, being as GCHQ (CESG) are the authors of the euro GAK, (CASM/Cloud Cover/Royal Holloway TTP scheme) and the TTP paper which caused a fuss last month. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`
There is a tendency I think to be drawn into spooks, civil servants, and polticians requests for off the record comments on how politics really works. (The politics of favours, the politics of spooks wishing to intimidate people into censoring themselves to operating according to unwritten laws (laws which don't exist, but which the spooks wish did, and so pretend do exist)). I think: if they said it, hold them to it. Ignore off the cuff requests, if they have the force of law behind them (it boils down to a threat to kill you, or imprison you if you disagree), that they should also get you to behave nicely and keep quiet your experience of the way they work in practice sucks, there's too much of it in politics in general, it belongs on a bill-board not in quiet off the record moments after crypto-conferences. Of course this might have the effect that spooks don't want to talk to you, or are more careful what they say, but who cares. Also... some clarification on the UK export situation, which I talked about in my last post in this thread: One concern about some of this stuff, is that often people are representing some company when interacting with spooks, where they would be covered by an NDA with the company. Well OK. There are still remailers to explain the situation without giving enough detail to identify yourself. Sometimes there are no NDAs. The export situation has slightly conflicting parties, the DTI (civil servants, Dept. of Trade & Industry) and GCHQ. DTI say you can export intangibly, but gave a whole list of reasons why a "responsible" company surely would not want to do anything disreputable, like have different views of export controls from the government, here from: http://www.dcs.ex.ac.uk/~aba/ukexport/dti-let.txt : 9. Hard to see what practical advantage there is to exporters in : exporting technology by intangible means because they could get : licences anyway if no concerns about the export itself. : : 10. And if concerns are sufficient for a licence to be refused, what : reputable exporter would wish to export it by any means? CESG/GCHQ seem less keen to admit the intangible export loop hole exists, preferring to pretend it doesn't exist until pressed. The DTI at least has contingency plans for this (from same letter): : 4. Government is aware of the potential for abuse of the spirit of : export controls. If it appears HMG's export control policies are being : undermined, then further action may have to be considered. As I said in the previous post: the GCHQ off-the-record low down on this is that if you export stuff intangibly (which the DTI at least will admit reluctantly that you can do), then they will deny your tangible export requests. If you are a business, this might cause you to think carefully about using the intangible export loop-hole. Or perhaps about discussing too much the way this works with journalists or otherwise embarrassing them. Which is of course what they want: an unwritten law which they have power to decide as they wish. Wouldn't it be fun if people in government/spookdom actually participated in open discussions such as this? (People like say Nigel Hickson, who got roasted at the LSE crypto conference recently on the DTI/GCHQ/government infamous TTP paper, his boss David Hendon slunk off early to avoid facing the music during open question time). (David Hendon not to be confused with David Henson, the ex-spook now in some governmental Euro gakkers group) But they aren't going to participate because they operate best in half-light, they hate harsh bright lights of open discourse. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`
participants (4)
-
Adam Back -
Bill Stewart -
Tim May -
William H. Geiger III