Detweiler abuse again
My maxim for cases like Hal's monitoring of his remailer: Strengthen all parties. Therefore, we have two problems to solve. The user of the remailer got his anonymity blown, and the usenet groups got abused. A. User anonymity It has become very clear to me that the opponent model of universal network monitoring is not the first model that we should be deploying for. This is the worst case, and the worst case is the hardest to solve. The opponent here was logging by the service provider, and the technique was logging. We should ensure that we can defend against this opponent and this technique. Any email-based entry point into an anonymous messaging system will contain an identity-based address. Yet an IP-based entry point will only reveal the host. The lesson: Remailers ought to run server daemons. This has the happy side-effect of removing default email logging. It also will allow for IP forwarders to have some reason for use and development. B. usenet abuse The automatic broadcast property of Usenet is profoundly broken for the long run, since there is no upper bound on the amount of resources required. More immediately, this property also requires a 100% completely distributed salience filter in all the posters for newsgroup topicality to hold, that is, everybody has to stay on topic, no exceptions. Please. The feedback mechanism of bitching and moaning to sysadmins does not scale, however, especially when nodes spring up dedicated to technologically-enforced freedom of speech, nodes which completely ignore any particularities of content. In the long run, Usenet will have to move to some method of distributed moderation before widespread distribution. Since salience is determined by humans, humans will have to read messages before transmission. The scale of distribution may be wide. One path of development in support of remailers, therefore, has nothing to do with remailers as such but rather with the re-creation of the public forum which is suitable for anonymity. In the short run, anonymous mail should not be posted to newsgroups by parties unwilling to take the heat, both external flames and internal guilt. The operators of remailers who don't wish this should acquire lists of known mail-to-news gateways and then filter. The rest of the operators may wish to install their own gateways in the remailer as Eric Hollander has done. Eric
Date: Mon, 14 Feb 94 20:56:31 -0800 From: hughes@ah.com (Eric Hughes) B. usenet abuse The automatic broadcast property of Usenet is profoundly broken for the long run, since there is no upper bound on the amount of resources required. More immediately, this property also requires a 100% completely distributed salience filter in all the posters for newsgroup topicality to hold, that is, everybody has to stay on topic, no exceptions. Please. I've tried this argument before, but people weren't willing to believe it back then. Maybe people will listen now. Reread the above paragraph, and then read the following: "This practice of people wandering about outside without bullet-proof vests is profoundly broken for the long run. This property also requires a 100% completely distributed responsibility of citizens not to go on a shooting spree." Yes, computer systems should be made more secure. I am quite sure that Usenet will never be made secure; it is much more likely that someone will create a new, better system which might eventually replace Usenet, but the fundamental model of Usenet requires its insecurities, and that's not going to change without massive, global software upgrades all over the Usenet. That's not going to happen any time soon. In the meantime, there's a certain thing known as community responsibility, which rabid individualists may or may not choose to recognize. In the long run, Usenet will have to move to some method of distributed moderation before widespread distribution. Since salience is determined by humans, humans will have to read messages before transmission. The scale of distribution may be wide. One path of development in support of remailers, therefore, has nothing to do with remailers as such but rather with the re-creation of the public forum which is suitable for anonymity. In the long run, someone will have to come up with a replacement for Usenet, that's actually *secure*. And while they're at it, they can fix some other long-standing deficiencies with Usenet, as well. In the short run, anonymous mail should not be posted to newsgroups by parties unwilling to take the heat, both external flames and internal guilt. The operators of remailers who don't wish this should acquire lists of known mail-to-news gateways and then filter. The rest of the operators may wish to install their own gateways in the remailer as Eric Hollander has done. In the short run, there's such a thing as net.responsibility (for those remailer operators capable of feeling internal guilt on this issue). And if that's not enough, there's the kiddy porn issue --- that's probably the easiest way to shut a remailer down. Heck, you don't even need to involve the Usenet. Just simply send a uuencoded GIF file containing kiddy porn through a remailer chain, and point it at president@whitehouse.gov. Then sit back and wait for the last remailer in the chain to receive a visit from the secret service agents.... Lance is, unfortunately, pointing out some huge, gaping holes in the current architecture of the Cypherpunks remailers. It would be good if they were fixed ASAP. - Ted
It's February, and time for the Second Annual Hughes v. Ts'o "Imminent Death of Usenet Predicted" Debate. For those of you not around this time last year (that's most of you), Ted and I did this already.
"This practice of people wandering about outside without bullet-proof vests is profoundly broken for the long run. This property also requires a 100% completely distributed responsibility of citizens not to go on a shooting spree."
I could take this analogy seriously if I thought that posting off-topic to usenet were as serious as death. Let's try equating speech to speech, OK? How about the disruptive homeless barging into conversations on the street? They are, like it or not, already anonymous insofar as many social relationships go. One can't really shun them as a technique of peer pressure, that's adding one insult to, well, years of insult. If the street were usenet, there would be no way to escape the disruption. Usenet is completely open to all who wish to speak, with no exceptions. In the end, if complaining doesn't work, there is no recourse but to leave usenet. Cypherpunks is a mailing list.
In the meantime, there's a certain thing known as community responsibility, which rabid individualists may or may not choose to recognize.
[...]
In the short run, there's such a thing as net.responsibility (for those remailer operators capable of feeling internal guilt on this issue).
A summary: I advised that only those should post who can to take the heat. One barrier to that is feeling guilt. Ted is trying to instill guilt. The reference to "rabid individualists" is an implicit threat of societal rejection of a madman embodied as a free speaker. And "net.responsibility" refers to whatever guilt you already have. Ted says "there's such a thing" to those who do not perceive it in themselves, and who may let the act of looking for it become the act of creating it. Let me be clear. I think that instilling guilt sucks. I don't want it around me. I desire the public forum. I desire anonymous speech. I desire pseudonymous persons. Usenet does not allow these simultaneously, therefore it is broken for me. Therefore I desire usenet as it is constituted now to die, and as much as I desire that, I also desire a new public forum to exist. Questions of timing therefore resolve into questions of tactics. We are making sure that anonymity is part of usenet; that will break it sooner or later.
Lance is, unfortunately, pointing out some huge, gaping holes in the current architecture of the Cypherpunks remailers. It would be good if they were fixed ASAP.
Unfortunately?? LD is out *best adman*. The holes are not in anonymity, but in the forum. We should be fixing the forum to allow technologically-strengthened anonymity. Eric
Date: Tue, 15 Feb 94 07:47:29 -0800 From: hughes@ah.com (Eric Hughes) I desire the public forum. I desire anonymous speech. I desire pseudonymous persons. Usenet does not allow these simultaneously, therefore it is broken for me. Therefore I desire usenet as it is constituted now to die... I admire your honesty; a lot of cypherpunks weren't willing to say this the last time we had this flame war. I desire that Usenet live for now, because even though it does not provide simulatneously the features of public forum and anonymous speach, it does solve the public forum problem relatively well, and as such, is providing a certain amount of societal good to the world. If we want both, then we should design and implement a system that has both. It doesn't necessarily follow that it's all constructive to tear down an institution that does what it was designed to do well, and but unfortunately doesn't happen meet your new requirements. Build the new and better system first, before trying to tear down the old one. - Ted
Therefore I desire usenet as it is constituted now to die...
I admire your honesty; a lot of cypherpunks weren't willing to say this the last time we had this flame war.
I think, however, that a new system will still be called "Usenet" and still be considered usenet and will be built on top of the existing usenet. I left this out before in order to make my point clearer.
I desire that Usenet live for now, because even though it does not provide simulatneously the features of public forum and anonymous speach, it does solve the public forum problem relatively well, and as such, is providing a certain amount of societal good to the world.
If usenet as it is now must die, that's no reason to make that death occur this week. There is also no reason not to continue to press on the existing system with anonymity. The pressures for better salience and for the asking of fewer FAQ's is already here, and has very little to do with anonymity. Persistent and anonymous disrupters do far less harm that the aggregate blatherings of ten thousand eighteen-year-olds. The net effect of both is to increase the noise. The problem is that one loud person is clearly to _blame_ for that noise, but a single innocent question is not, even though both contribute to the problem. Anonymity removes the path through which the disrupter can be shamed into submission. The would-be shamer subsequently feels frustration at the inability to induce guilt in someone who ... should. Thus does anonymity sharpen the debate about the quality of usenet. It is now particular individuals who are the problem, not the system as a whole. The frustrated desire to blame creates a separation in analysis where none need be. People get so worked up about bad people that they forget about the bad system.
Build the new and better system first, before trying to tear down the old one.
Yet my argument seeks to show that the problem is already here, and that the presence of anonymity changes the nature of the debate about the problem much more that it changes the nature or even the scale of the problem.
If we want both, then we should design and implement a system that has both.
One can do this by building on top of newsgroup moderation, which is the internal mechanism already present to capture salience. Every newsgroup should have moderation. Whether the moderator is one person, a group of people, or a program is an open issue. I have a starting point of discussion. Let the moderator of each newsgroup be a mailing list address. The members of this mailing list are the moderators of the group. All postings to a newsgroup go first to this moderation list. The moderators then read news with software which rates the news articles for inclusion. (This could be a modified newsreader, for example.) After each article was read, a mail message is sent back the mailing list address (or a parallel one) with the rating. Some voting algorithm determines inclusion. This voting algorithm need not require all the moderators to make a rating before transmission. When an article is sent out, an indication of the results of the voting system is included in the header, allowing end-user filtering on moderation. Three basic issues determine the exact character of a newsgroup of this type. (And each newsgroup should be able to be different.) 1. What is the nature of the moderation group? a. Is the size bounded or unbounded? b. Is membership self-selected or constrained? c. Is there a limit to tenure? 2. What is the nature of the rating? a. Size of the rating space 1) yes/no/abstain 2) 1-10 3) Is there veto? b. Rating by category. 3. What is the voting algorithm? a. Any moderator may approve (result is the name of that moderator) b. Any N moderators may approve (result are these names) c. First majority with minimum (used in statistical signifance experiments) d. Voting window and percentage minimum, possibly with quorum As a first and easiest starting point, one might choose the following characteristics for experimentation: -- moderation participation is unlimited. Membership may be restricted if many bad moderation decisions are made. -- yes/abstain -- any moderator may approve The point of this kind of system is that the existing usenet distribution mechanism can be lifted intact. Likewise can the bulk of the readers of news continue mostly unchanged, only unsubscribing and resubscribing. The existing unmoderated groups will continue to be a sewer. Fine. New groups with distributed moderation can be created. If these are successful old groups can be moved over to this method. Two main pieces of new software are needed for this scheme: 1. A change in newsreaders/mail agents to send off ratings. 2. A mail server to implement the moderation a. the initial mailing list b. the voting algorithm c. the actual posting None of this software is particularly difficult in concept. Eric
Just simply send a uuencoded GIF file containing kiddy porn through a remailer chain, and point it at president@whitehouse.gov. Then sit back and wait for the last remailer in the chain to receive a visit from the secret service agents....
In analogy with the way that these prosecutions are working now, they'd be arresting the president and not arresting the equivalent to the post office. Eric
participants (2)
-
hughes@ah.com -
tytso@ATHENA.MIT.EDU