Detweiler abuse again

My maxim for cases like Hal's monitoring of his remailer:

	Strengthen all parties.

Therefore, we have two problems to solve.  The user of the remailer
got his anonymity blown, and the usenet groups got abused.

A. User anonymity

It has become very clear to me that the opponent model of universal
network monitoring is not the first model that we should be deploying
for.  This is the worst case, and the worst case is the hardest to
solve.  

The opponent here was logging by the service provider, and the
technique was logging.  We should ensure that we can defend against
this opponent and this technique.

Any email-based entry point into an anonymous messaging system will
contain an identity-based address.  Yet an IP-based entry point will
only reveal the host.  The lesson:

	Remailers ought to run server daemons.

This has the happy side-effect of removing default email logging.  It
also will allow for IP forwarders to have some reason for use and
development.

B. usenet abuse

The automatic broadcast property of Usenet is profoundly broken for
the long run, since there is no upper bound on the amount of resources
required.  More immediately, this property also requires a 100%
completely distributed salience filter in all the posters for
newsgroup topicality to hold, that is, everybody has to stay on topic,
no exceptions.  Please.

The feedback mechanism of bitching and moaning to sysadmins does not
scale, however, especially when nodes spring up dedicated to
technologically-enforced freedom of speech, nodes which completely
ignore any particularities of content.

In the long run, Usenet will have to move to some method of
distributed moderation before widespread distribution.  Since salience
is determined by humans, humans will have to read messages before
transmission.  The scale of distribution may be wide.  One path of
development in support of remailers, therefore, has nothing to do with
remailers as such but rather with the re-creation of the public forum
which is suitable for anonymity.

In the short run, anonymous mail should not be posted to newsgroups by
parties unwilling to take the heat, both external flames and internal
guilt.  The operators of remailers who don't wish this should acquire
lists of known mail-to-news gateways and then filter.  The rest of the
operators may wish to install their own gateways in the remailer as
Eric Hollander has done.

Eric

Date: Mon, 14 Feb 94 20:56:31 -0800
   From: hughes@ah.com (Eric Hughes)

   B. usenet abuse

   The automatic broadcast property of Usenet is profoundly broken for
   the long run, since there is no upper bound on the amount of resources
   required.  More immediately, this property also requires a 100%
   completely distributed salience filter in all the posters for
   newsgroup topicality to hold, that is, everybody has to stay on topic,
   no exceptions.  Please.

I've tried this argument before, but people weren't willing to believe
it back then.  Maybe people will listen now.  Reread the above paragraph,
and then read the following:

"This practice of people wandering about outside without bullet-proof
vests is profoundly broken for the long run.  This property also
requires a 100% completely distributed responsibility of citizens not to
go on a shooting spree."

Yes, computer systems should be made more secure.  I am quite sure that
Usenet will never be made secure; it is much more likely that someone
will create a new, better system which might eventually replace Usenet,
but the fundamental model of Usenet requires its insecurities, and
that's not going to change without massive, global software upgrades all
over the Usenet.  That's not going to happen any time soon.  In the
meantime, there's a certain thing known as community responsibility,
which rabid individualists may or may not choose to recognize.

   In the long run, Usenet will have to move to some method of
   distributed moderation before widespread distribution.  Since salience
   is determined by humans, humans will have to read messages before
   transmission.  The scale of distribution may be wide.  One path of
   development in support of remailers, therefore, has nothing to do with
   remailers as such but rather with the re-creation of the public forum
   which is suitable for anonymity.

In the long run, someone will have to come up with a replacement for
Usenet, that's actually *secure*.  And while they're at it, they can fix
some other long-standing deficiencies with Usenet, as well.

   In the short run, anonymous mail should not be posted to newsgroups by
   parties unwilling to take the heat, both external flames and internal
   guilt.  The operators of remailers who don't wish this should acquire
   lists of known mail-to-news gateways and then filter.  The rest of the
   operators may wish to install their own gateways in the remailer as
   Eric Hollander has done.

In the short run, there's such a thing as net.responsibility (for those
remailer operators capable of feeling internal guilt on this issue).
And if that's not enough, there's the kiddy porn issue --- that's
probably the easiest way to shut a remailer down.  

Heck, you don't even need to involve the Usenet.  Just simply send a
uuencoded GIF file containing kiddy porn through a remailer chain, and
point it at president@whitehouse.gov.  Then sit back and wait for the
last remailer in the chain to receive a visit from the secret service
agents....

Lance is, unfortunately, pointing out some huge, gaping holes in the
current architecture of the Cypherpunks remailers.  It would be good if
they were fixed ASAP.

						- Ted

It's February, and time for the Second Annual Hughes v. Ts'o "Imminent
Death of Usenet Predicted" Debate.

For those of you not around this time last year (that's most of you),
Ted and I did this already.

>"This practice of people wandering about outside without bullet-proof
>vests is profoundly broken for the long run.  This property also
>requires a 100% completely distributed responsibility of citizens not to
>go on a shooting spree."

I could take this analogy seriously if I thought that posting
off-topic to usenet were as serious as death.

Let's try equating speech to speech, OK?

How about the disruptive homeless barging into conversations on the
street?  They are, like it or not, already anonymous insofar as many
social relationships go.  One can't really shun them as a technique of
peer pressure, that's adding one insult to, well, years of insult.

If the street were usenet, there would be no way to escape the
disruption.  Usenet is completely open to all who wish to speak, with
no exceptions.  In the end, if complaining doesn't work, there is no
recourse but to leave usenet.

Cypherpunks is a mailing list.

>In the
>meantime, there's a certain thing known as community responsibility,
>which rabid individualists may or may not choose to recognize.

[...]

>In the short run, there's such a thing as net.responsibility (for those
>remailer operators capable of feeling internal guilt on this issue).

A summary: I advised that only those should post who can to take the
heat.  One barrier to that is feeling guilt.

Ted is trying to instill guilt.  The reference to "rabid
individualists" is an implicit threat of societal rejection of a
madman embodied as a free speaker.  And "net.responsibility" refers to
whatever guilt you already have.  Ted says "there's such a thing" to
those who do not perceive it in themselves, and who may let the act of
looking for it become the act of creating it.

Let me be clear.  I think that instilling guilt sucks.  I don't want
it around me.

I desire the public forum.  I desire anonymous speech.  I desire
pseudonymous persons.  Usenet does not allow these simultaneously,
therefore it is broken for me.  Therefore I desire usenet as it is
constituted now to die, and as much as I desire that, I also desire a
new public forum to exist.

Questions of timing therefore resolve into questions of tactics.  We
are making sure that anonymity is part of usenet; that will break it
sooner or later.

>Lance is, unfortunately, pointing out some huge, gaping holes in the
>current architecture of the Cypherpunks remailers.  It would be good if
>they were fixed ASAP.

Unfortunately??

LD is out *best adman*.

The holes are not in anonymity, but in the forum.  We should be fixing
the forum to allow technologically-strengthened anonymity.

Eric

Date: Tue, 15 Feb 94 07:47:29 -0800
   From: hughes@ah.com (Eric Hughes)

   I desire the public forum.  I desire anonymous speech.  I desire
   pseudonymous persons.  Usenet does not allow these simultaneously,
   therefore it is broken for me.  Therefore I desire usenet as it is
   constituted now to die...

I admire your honesty; a lot of cypherpunks weren't willing to say this
the last time we had this flame war.

I desire that Usenet live for now, because even though it does not
provide simulatneously the features of public forum and anonymous
speach, it does solve the public forum problem relatively well, and as
such, is providing a certain amount of societal good to the world.

If we want both, then we should design and implement a system that has
both.  It doesn't necessarily follow that it's all constructive to tear
down an institution that does what it was designed to do well, and but 
unfortunately doesn't happen meet your new requirements.  Build the new
and better system first, before trying to tear down the old one.

						- Ted

>   Therefore I desire usenet as it is
>   constituted now to die...

>I admire your honesty; a lot of cypherpunks weren't willing to say this
>the last time we had this flame war.

I think, however, that a new system will still be called "Usenet" and
still be considered usenet and will be built on top of the existing
usenet.  I left this out before in order to make my point clearer.

>I desire that Usenet live for now, because even though it does not
>provide simulatneously the features of public forum and anonymous
>speach, it does solve the public forum problem relatively well, and as
>such, is providing a certain amount of societal good to the world.

If usenet as it is now must die, that's no reason to make that death
occur this week.

There is also no reason not to continue to press on the existing
system with anonymity.

The pressures for better salience and for the asking of fewer FAQ's is
already here, and has very little to do with anonymity.  Persistent
and anonymous disrupters do far less harm that the aggregate
blatherings of ten thousand eighteen-year-olds.  The net effect of
both is to increase the noise.

The problem is that one loud person is clearly to _blame_ for that
noise, but a single innocent question is not, even though both
contribute to the problem.  Anonymity removes the path through which
the disrupter can be shamed into submission.  The would-be shamer
subsequently feels frustration at the inability to induce guilt in
someone who ... should.

Thus does anonymity sharpen the debate about the quality of usenet.
It is now particular individuals who are the problem, not the system
as a whole.  The frustrated desire to blame creates a separation in
analysis where none need be.  People get so worked up about bad people
that they forget about the bad system.

>Build the new
>and better system first, before trying to tear down the old one.

Yet my argument seeks to show that the problem is already here, and
that the presence of anonymity changes the nature of the debate about
the problem much more that it changes the nature or even the scale of
the problem.

>If we want both, then we should design and implement a system that has
>both.  

One can do this by building on top of newsgroup moderation, which is
the internal mechanism already present to capture salience.  Every
newsgroup should have moderation.  Whether the moderator is one
person, a group of people, or a program is an open issue.

I have a starting point of discussion.

Let the moderator of each newsgroup be a mailing list address.  The
members of this mailing list are the moderators of the group.  All
postings to a newsgroup go first to this moderation list.

The moderators then read news with software which rates the news
articles for inclusion.  (This could be a modified newsreader, for
example.)  After each article was read, a mail message is sent back
the mailing list address (or a parallel one) with the rating.

Some voting algorithm determines inclusion.  This voting algorithm
need not require all the moderators to make a rating before
transmission.  When an article is sent out, an indication of the
results of the voting system is included in the header, allowing
end-user filtering on moderation.

Three basic issues determine the exact character of a newsgroup of
this type.  (And each newsgroup should be able to be different.)

1. What is the nature of the moderation group?
  a. Is the size bounded or unbounded?
  b. Is membership self-selected or constrained?
  c. Is there a limit to tenure?

2. What is the nature of the rating?
  a. Size of the rating space
    1) yes/no/abstain
    2) 1-10
    3) Is there veto?
  b. Rating by category.

3. What is the voting algorithm?
  a. Any moderator may approve (result is the name of that moderator)
  b. Any N moderators may approve (result are these names)
  c. First majority with minimum (used in statistical signifance experiments)
  d. Voting window and percentage minimum, possibly with quorum

As a first and easiest starting point, one might choose the following
characteristics for experimentation:

  -- moderation participation is unlimited.  Membership may be restricted if
     many bad moderation decisions are made.
  -- yes/abstain
  -- any moderator may approve
 
The point of this kind of system is that the existing usenet
distribution mechanism can be lifted intact.  Likewise can the bulk of
the readers of news continue mostly unchanged, only unsubscribing and
resubscribing.

The existing unmoderated groups will continue to be a sewer.  Fine.
New groups with distributed moderation can be created.  If these are
successful old groups can be moved over to this method.

Two main pieces of new software are needed for this scheme:

1. A change in newsreaders/mail agents to send off ratings.

2. A mail server to implement the moderation
  a. the initial mailing list 
  b. the voting algorithm 
  c. the actual posting

None of this software is particularly difficult in concept.

Eric

>  Just simply send a uuencoded GIF file containing kiddy porn through
>a remailer chain, and point it at president@whitehouse.gov.  Then sit
>back and wait for the last remailer in the chain to receive a visit
>from the secret service agents....

In analogy with the way that these prosecutions are working now,
they'd be arresting the president and not arresting the equivalent to
the post office.

Eric