Re: Detweiler abuse again

-----BEGIN PGP SIGNED MESSAGE-----


hughes@ah.com (Eric Hughes):

> The automatic broadcast property of Usenet is profoundly broken for
> the long run, since there is no upper bound on the amount of resources
> required.  More immediately, this property also requires a 100%

One can only reach the conclusion that Usenet is broken if one assumes
that the remailers _aren't_. The automatic broadcast property if Usenet
is not a problem if you can always determine the source of a message. This
isn't an argument against anonymity, but just saying it's a little
backwards to say that Usenet has to be redesigned because it doesn't work
with the remailers.

Why not use technology to solve a technological problem? The difficulty 
here is that it is impossible for any one remailer operator to prevent 
someone, say LD, from using the remailer system. The best he can do is stop 
LD from using his site as an entry point. So why not introduce a little 
cooperation among operators? This can be accomplished without collusion of 
the sort that would break anonymity.

Pretty much all the remailer operators are 'punks, right? If a critical 
mass of operators get together and agree to block a standardized set of 
sources and destinations, then that group of operators will have enough 
pull to force the other operators to toe the line. The trick is to block 
messages from remailer _operators_ who refuse to agree to behave as part of 
the community, effectively isolating the wildcats. An isolated remailer is 
useless.

Should be easy enough to work out -- a posted alert PGP signed by any two 
remailer operators is immediately implemented, no questions asked. Remailer 
scripts should include blocking by source, destination, or _content_, as in 
posts on a certain subject to a certain newsgroup. This would allow 
blocking of a nutcase using encrypted hops to post to Usenet without having 
to collude and blow his anonymity. Just say "Sorry, due to abuse of the 
remailers, we're not going to forward messages about the creatures from 
Uranus using microwave mind-control any more". This is a complicated idea 
in a general case, but scanning for subject lines, for instance, could be 
implemented as easily as scanning for destinations.

What we have now is a bunch of single remailers. It's a very small step to 
create a cooperative group of remailers, and it would provide avenues for 
solutions to a lot of the potential problems. This is not perfect, but it's 
better.


tytso@ATHENA.MIT.EDU (Theodore Ts'o):

> Lance is, unfortunately, pointing out some huge, gaping holes in the
> current architecture of the Cypherpunks remailers.  It would be good if

LD is smart enough to know that you _chain_ remailers for anonymity. I 
think he wanted us to know it was him, and wanted to see whether or not Hal 
would blow his anonymity when it came down to it.


                                -- Will



-----BEGIN PGP SIGNATURE-----
Version: 2.3

iQCVAgUBLWCOLPfv4TpIg2PxAQHOCgP9E2Q4R6ngHIeIv/IPePhcFqJgDaA8B4OO
CDS0akeyVXZXMB5b5nCGY2Q0b52LcSHnzUlJ0N/o1COjVNLADNOlcF2k9BcBYUuC
cqSWy1fJlx4lwd3P2kMgtk8v+pLHlVLJ4riopp2RXgLVfsesw8aJWOdSBf3bA7ft
cBxNJhcI9t8=
=BycG
-----END PGP SIGNATURE-----

"W. Kinney" <kinney@bogart.Colorado.EDU>  writes:
>
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> One can only reach the conclusion that Usenet is broken if one assumes
> that the remailers _aren't_. The automatic broadcast property if Usenet
> is not a problem if you can always determine the source of a message. This
> isn't an argument against anonymity, but just saying it's a little
> backwards to say that Usenet has to be redesigned because it doesn't work
> with the remailers.

  The real problem is the same sort of problem that one has to face in all
  public spaces.  If an individual is allowed to speak, they may be abusive.
  If they are not allowed to speak, the state is being abusive.  Usenet is
  a public space.  Sure, people have attempted to moderate parts of it, but
  all they've really done is split off from the public space to form private
  spaces which have restrictive policies on content.  

> Why not use technology to solve a technological problem? The difficulty 
> here is that it is impossible for any one remailer operator to prevent 
> someone, say LD, from using the remailer system. The best he can do is stop 
> LD from using his site as an entry point. So why not introduce a little 
> cooperation among operators? This can be accomplished without collusion of 
> the sort that would break anonymity.

  Co-operation amongst remailer operators won't solve this problem either.
  If any one site lets Larry use a remailer, then he's free to abuse the
  system.  Like open terminal servers, a few may survive the purge, but
  the abuses tend to consolidate the opinion of the many against the
  idea of the service.

> Pretty much all the remailer operators are 'punks, right? If a critical 
> mass of operators get together and agree to block a standardized set of 
> sources and destinations, then that group of operators will have enough 
> pull to force the other operators to toe the line. The trick is to block 
> messages from remailer _operators_ who refuse to agree to behave as part of 
> the community, effectively isolating the wildcats. An isolated remailer is 
> useless.

  First of all, I'd like to see remailer servers running on a well-known
  port.  That way, anyone could stick up a remailer, provided they had
  access to a C compiler.  There would be no cabal of remailer operators, 
  because everyone would have the possiblity of being a remailer.  Also,
  an isolated remailer isn't useless.  It doesn't provide perfect anonymity,
  especially since it may be doing logging.  But, remember, when the entire
  chain is as strong as it's strongest link, the chain doesn't necessarily
  need to be more than one link long.

> Should be easy enough to work out -- a posted alert PGP signed by any two 
> remailer operators is immediately implemented, no questions asked. Remailer 
> scripts should include blocking by source, destination, or _content_, as in 
> posts on a certain subject to a certain newsgroup. This would allow 
> blocking of a nutcase using encrypted hops to post to Usenet without having 
> to collude and blow his anonymity. Just say "Sorry, due to abuse of the 
> remailers, we're not going to forward messages about the creatures from 
> Uranus using microwave mind-control any more". This is a complicated idea 
> in a general case, but scanning for subject lines, for instance, could be 
> implemented as easily as scanning for destinations.

  So then you end up with a situation where the potential abusers are writing
  subject lines which don't match the contents.  In general, you're going to
  have a hard time trying to prevent certain subjects from getting out,
  especially if you plan on automating this function.

> What we have now is a bunch of single remailers. It's a very small step to 
> create a cooperative group of remailers, and it would provide avenues for 
> solutions to a lot of the potential problems. This is not perfect, but it's 
> better.

  Actually, I don't believe that it's better.  I think that the base
  functionality of remailers should be standardized, so that they can 
  all interoperate, but I don't think that forcing the operators into
  a cabal is at all helpfull.

> tytso@ATHENA.MIT.EDU (Theodore Ts'o):
> 
> > Lance is, unfortunately, pointing out some huge, gaping holes in the
> > current architecture of the Cypherpunks remailers.  It would be good if
> 
> LD is smart enough to know that you _chain_ remailers for anonymity. I 
> think he wanted us to know it was him, and wanted to see whether or not Hal 
> would blow his anonymity when it came down to it.

  I think you're right.  He wanted to know if Hal could be trusted to not
  give in when the "abuse" became unbearable.  Hal, apparently, couldn't.

  I understand that Hal has to do what he feels is right.  However, if all
  remailer operators are going to cave when faced with an "abuser" who they
  don't agree with, then there will be no anonymity for anyone.

  What ever happened to "I hate what you say, but I will fight to the death
  for your right to say it?"

  How long will it be before we get to the point where certain "contents" are
  considered off-limits?  

  Everyone needs to be able to run a remailer.  How else will you be able to
  trust the remailer operator?

 Jon Boone | PSC Networking | boone@psc.edu | (412) 268-6959 | PGP Key # B75699
 PGP Public Key fingerprint =  23 59 EC 91 47 A6 E3 92  9E A8 96 6A D9 27 C9 6C

>  Usenet is
>  a public space.  Sure, people have attempted to moderate parts of it, but
>  all they've really done is split off from the public space to form private
>  spaces which have restrictive policies on content.  

Any forum which captures the desirable qualities of a public space
will therefore have to restrict content in some way.  The trick is not
to restrict content too much, and to make sure the restrictions cut
broadly across opinion boundaries.

>  First of all, I'd like to see remailer servers running on a well-known
>  port.  That way, anyone could stick up a remailer, provided they had
>  access to a C compiler.  

The problem with a well known port is that it restricts remailers to
one per machine.  Then in fact only one person per machine could set
up a remailer.  This does make a difference, because the sysadmin is
not the only one technically able to monitor the remailer; its
operator is also able.

A pseudonymous service, like a pseudonymous person, should not need to
be linked to any particular machine except during an actual
transaction.  If I have a pseudonym, I can post from anywhere and my
identity is communicated by a signature.  Likewise should a
pseudonymous service be able to hop from machine to machine.

The techniques of location-independent computing, developed for radio
links, can be applied here.

What we need is a name service which has public keys as identities and
which can map virtual and pseudonymous services to various
combinations of IP address, port number, and protocols.  In the
decentralized spirit, this name service should not have a root.
Someone Saturday mentioned that there was a paper from some Plan 9
folk about rootlessness; pointers will be welcome.

Eric

hughes@ah.com (Eric Hughes)  writes:
>
> Any forum which captures the desirable qualities of a public space
> will therefore have to restrict content in some way.  The trick is not
> to restrict content too much, and to make sure the restrictions cut
> broadly across opinion boundaries.

  Agreed.

> >  First of all, I'd like to see remailer servers running on a well-known
> >  port.  That way, anyone could stick up a remailer, provided they had
> >  access to a C compiler.  
> 
> The problem with a well known port is that it restricts remailers to
> one per machine.  Then in fact only one person per machine could set
> up a remailer.  This does make a difference, because the sysadmin is
> not the only one technically able to monitor the remailer; its
> operator is also able.

  Yes, that is a problem.   

> A pseudonymous service, like a pseudonymous person, should not need to
> be linked to any particular machine except during an actual
> transaction.  If I have a pseudonym, I can post from anywhere and my
> identity is communicated by a signature.  Likewise should a
> pseudonymous service be able to hop from machine to machine.
> 
> The techniques of location-independent computing, developed for radio
> links, can be applied here.
> 
> What we need is a name service which has public keys as identities and
> which can map virtual and pseudonymous services to various
> combinations of IP address, port number, and protocols.  In the
> decentralized spirit, this name service should not have a root.
> Someone Saturday mentioned that there was a paper from some Plan 9
> folk about rootlessness; pointers will be welcome.

  Actually, the Mobile IP working group of the IETF is busy defining a 
  system of proxy agents which will accept packets for mobile machines
  and then forward them on to the proper destination.  Something like
  this would be useful for anonymous remailers.  

  Imagine a scheme whereby a "core" of these agents were available on well
  known ports of established machines.  When you start up your remailer,
  it registers with the core agents and does it delivery.  It can then 
  move to another machine.  A lack of a "keepalive" packet every n seconds
  would indicate that the remailer had gone down and it would be purged from
  the records.  

 Jon Boone | PSC Networking | boone@psc.edu | (412) 268-6959 | PGP Key # B75699
 PGP Public Key fingerprint =  23 59 EC 91 47 A6 E3 92  9E A8 96 6A D9 27 C9 6C

Summary:  Use (anonymous) certificates to fix Usenet, and mailing lists.

  I think this message is interesting to the readers of cypherpunks
because it describes the a decentralized, crypto supported, solution
to the problems of e-speach in e-public places.

  If a message is found on a usenet group, a mailing list, or any
other 'e-public' space for that matter, one is tempted to assume that
its content is apropriate for the space, and interesting.  But who
certified that?  On moderated lists, the moderator(s) did, and things
usualy go a little more smoothly.  On unmoderated lists, only the
author.

  Were there a way to attach signed judgements to posted articles (as
articles naturally), you could program your mail reader to skip
articles which aren't judged highly enough by your favorite judges.
Then, the flames would die away -- few people would judge them
interesting enough.

  The incentive for the reader is to improve their judgment of judges,
and so spend more time reading good stuff (neural net learning
anyone?).  The incentive for the judges is to earn 'reps' or money
(how to sell judgements?).  The incentive for the poster is to be
heard (improving their 'rep'), and so if no (important, in the
poster's opinion) judges like their stuff, they will feel an incentive
to improve their posts.

  Naturally the anarchist in me feels that any person shoud be able to
act as reader, poster, or judge at any time.

  What Usenet, this, and other lists lack are digital reputations.  I
belive it is a 'real world' problem which is aproaching the size of
the 'private email' problem.  I am going to abandon the private IP
stuff for a little while, and see if I can hack up a pseudonymous
certificate system ala Chaum from the bones of magic money.

j'
--
		   O I am Jay Prime Positive jpp@markv.com
1250 bit fingerprint B06229 = B8 95 E0 AF 9A A2 CD A5  89 C9 F0 FE B4 3A 2C 3F
 524 bit fingerprint 2A915D = 8A 7C B9 F2 D5 46 4D ED  66 23 F1 71 DE FF 51 48
Public keys via `finger jpp@markv.com', or via email to pgp-public-keys@io.com
Your feedback is welcome directly or via my symbol JPP on hex@sea.east.sun.com

Resist the Clipper Chip, write "I oppose Clipper" to Clipper.petition@cpsr.org

>The trick is to block 
>messages from remailer _operators_ who refuse to agree to behave as part of 
>the community, effectively isolating the wildcats. An isolated remailer is 
>useless.

But an community of isolated remailers could get larger than the
cooperating set.

And coercing wildcats is, well, like herding cats.

Eric

> But an community of isolated remailers could get larger than the
> cooperating set.

No problem -- just add them to the killfile.  Sure, new `rogue'
remailers could slip by, but so can any fool with a telnet 25.
Participating remailers would have some assurance that they're
not sending material from someone in the source killfile.  Non-
participators wouldn't, and could take the moral high-ground
all they like.

> Eric

   Eli   ebrandt@jarthur.claremont.edu

>> But an community of isolated remailers could get larger than the
>> cooperating set.

>No problem -- just add them to the killfile.  

A set of remailers isolated from a restriction cooperative is a fully
operative set of remailers.  Adding them to the killfile doesn't
prevent these remailers from directly posting and directly mailing.

Eric

Eric Hughes wrote:

> A set of remailers isolated from a restriction cooperative is a fully
> operative set of remailers.  Adding them to the killfile doesn't
> prevent these remailers from directly posting and directly mailing.

Are there any killfiles for mail around? I mean like scripts for killing 
selected 'from's in Mail,Elm or, hopefully, Pine?

>Are there any killfiles for mail around? I mean like scripts for killing 
>selected 'from's in Mail,Elm or, hopefully, Pine?

There may be killfiles for certain mail readers, but I would prefer a
solution which filters the mail before it gets to my mail reader.  On
Unix, such filters can be installed as pipes in the .forward file.
One such filter is called procmail.

I just started using procmail, and it's great.  I'm now getting all my
mailing lists in separate mailboxes; this separation improves both my
regular mail and my mailing lists.  Try it.

ftp://ftp.informatik.rwth-aachen.de/pub/packages/procmail

Eric

Procmail is one filtering package.  You can also use 'filter' which comes 
as part of the elm package.  Promail has a few more features, but is much 
more difficult to write rules for, IMHO.

____        Robert A. Hayden          <=> hayden@krypton.mankato.msus.edu
\  /__          -=-=-=-=-             <=>          -=-=-=-=-
 \/  /   Finger for Geek Code Info    <=> In the United States, they
   \/  Finger for PGP 2.3a Public Key <=> first came for us in Colorado...
-=-=-=-=-=-=-=-
(GEEK CODE 1.0.1)  GAT d- -p+(---) c++(++++) l++ u++ e+/* m++(*)@ s-/++
		       n-(---) h+(*) f+ g+ w++ t++ r++ y+(*)

W. Kinney writes:

> One can only reach the conclusion that Usenet is broken if one assumes
> that the remailers _aren't_. The automatic broadcast property if Usenet
> is not a problem if you can always determine the source of a message. This
> isn't an argument against anonymity, but just saying it's a little
> backwards to say that Usenet has to be redesigned because it doesn't work
> with the remailers.

It's broken in the larger sense that Eric mentioned: costs are not
incurred by posters. This is not just a problem with remailers, but
with the growing numbers of "Make.Money.Fast" and "Allah is Coming!"
sorts of posts. Think about it.

> Why not use technology to solve a technological problem? The difficulty 
> here is that it is impossible for any one remailer operator to prevent 
> someone, say LD, from using the remailer system. The best he can do is stop 
> LD from using his site as an entry point. So why not introduce a little 
> cooperation among operators? This can be accomplished without collusion of 
> the sort that would break anonymity.

Well, this blocking is what Hal is doing, and he proposed that others
do the same, so I don't get your "alternative."

> Pretty much all the remailer operators are 'punks, right? If a critical 
> mass of operators get together and agree to block a standardized set of 
> sources and destinations, then that group of operators will have enough 
> pull to force the other operators to toe the line. The trick is to block 
> messages from remailer _operators_ who refuse to agree to behave as part of 
> the community, effectively isolating the wildcats. An isolated remailer is 
> useless.

Not this easy. To see this, imagine the following scenario:

Alice chooses not to block Detweiler (for example). Bob, Charles,
Dorothy, decide to block Detweiler. Alice receives a message from
Detweiler, strips off the headers in the normal way, passes the
*encrypted* body (remember that many remailers support PGP and that
this is in fact the preferred mode, long term) to Bob, who has
absolutely no idea the body message he sees (encrypted further....) is
a message from Detweiler. Bob does the header stripping and remailing
to Charles, and so on. Eventually, Zeke sends the message on to its
final destination. 

Only at the last stage, in this example, does Zeke realize--if he
bothers to look at the message body, presumably now in plaintext (but
not necessarily)--that the message is a threat, a flame, a "Yahweh is
Coming!" message, or whatever.

Thus, so long as at least *one* remailer is not doing source
screening, and that at least some encryption is used (not all nodes
have to do it, obviously), then source-level screening will not work.

Unless, of course, Alice, Bob, Charles, etc. all agree to "work
backwards" to trace a sender. This dire situation, counter to
everything we want in remailers, would then allow the rest of the
remailers to add _Alice_ to their list of blocked sources. Because she
didn't play ball and didn't block Detweiler. A slow process, and one
that could also be thwarted by, say, Fred, who refuses "on principle"
to keep logs, collude with the other remailers, etc.

No, source-level blocking is a reasonable short term fix for the
present challenge from Detweiler, but is not a long term solution. We
can block Detweiler temporarily, because there are so few remailers,
so little use of chained encryption, etc., but he and others will find
alternatives.

> What we have now is a bunch of single remailers. It's a very small step to 
> create a cooperative group of remailers, and it would provide avenues for 
> solutions to a lot of the potential problems. This is not perfect, but it's 
> better.

I agree here that remailers may organize themselves into
"cooperatives," groups which make common assumpions about what
policies to follow. Thus, in my example, eventually Alice would be
excluded from the group, for not blocking Detweiler in the first
place. But it gets real messy real fast. Does Alice not accept
encrypted messages from "unknown" sources? (For example, it would be
possible for Detweiler to contract with Joe User to have him forward a
single message, then have Sue Foo forward his next message, etc. In
other words, source-blocking fails so long as a remailer accepts
encrypted messages.)

Very long term, when message costs are borne by the sender, this
problem goes away. (Others remain, such as death threats, extortion,
markets for murder, etc., but they're in a different category.)

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power:2**859433 | Public Key: PGP and MailSafe available.

>It's broken in the larger sense that Eric mentioned: costs are not
>incurred by posters. 
[...]
>Very long term, when message costs are borne by the sender, this
>problem goes away.

I really doubt the problem goes away.  Message costs have some
restrictive effect, but they are not a panacea.  (They are a panacea
for supporting remailer services, but that should be obvious.)
Transmission costs are dropping so fast that it is conceivable that
the cost of a broadcast of a three page message to everyone in the
world will be less than a dollar.

Mailbombing might be solved by message costs, and will be a deterrent,
but mailbombing is such a blunt weapon.

As I recently argued, the problem is not individual disrupters but
salience in general.

Usenet is broken because it transmits everything which is sent to it,
without any sort of judgement as to the propriety of the message to
the newsgroups to which it is posted.  Paying for the message does not
solve the problem of newbie questions, or flame wars (low bandwidth
data, high bandwidth emotion; flames are extremely compressible), or
digressions.

Eric

Date: Tue, 15 Feb 94 12:59:55 -0800
   From: hughes@ah.com (Eric Hughes)

   As I recently argued, the problem is not individual disrupters but
   salience in general.

I agree; this is indeed the problem.  And when we try to sell the
moderation software to individual groups, it should be sold as solving
the salience problem --- and that it solves the individual anonymous
disrupter as only side effect.

The way I'd design this service is that the newsgroup would be
moderated, and so postings would be mailed to a central site.  The
moderation group would have to have internet access, and would connect
to the central site using a client program.  The client program would
display the message to the moderator, and then the moderator would have
a chance to give a "thumbs up", "thumbs down", "abstain", or "decide
later" vote.  The software on the central site would send out the
message after the threshold number of moderators had approved the
message, or would kill it after the threshold number of moderators had
given it the thumbs down.  Of course, with something like this you'd
want to make sure authentication was done right --- which in this case,
probably means using a password-based challenge-response authentication
system.

Note that this proposed solution does not solve a lot of problems.  It
does not solve the moderation selection problem.  (The moderation group
can not be left wide open; otherwise a Detweiler could approve his own
postings.)  It does not solve the "forge a faked approved: header"
attack.  Yet for the problems it does solve, it would probably be a good
thing.

						- Ted

P.S.  Wow, a productive, constructive, relatively flame-free discussion
on cypherpunks!  I was beginning to think it wasn't really possible.  :-)

I wish to note at the outset that Ted and I seem to agree on the basic
principles:

1. Use the ability to moderate newsgroups
  a. to restrict posting
  b. to get tendered articles to the moderators
2. Use multiple moderators and some weighting algorithm

>And when we try to sell the
>moderation software to individual groups, it should be sold as solving
>the salience problem

I don't think it's necessary to sell it to existing groups.  Create an
alt group, set up the code, and see if people use it.  How about
alt.talk.crypto?  Surely any measure of moderation would be an
improvement over talk.politics.crypto.  If the alt group is
successful, the software can be moved over to talk.politics.crypto.

To summarize the specifics of Ted's proposal:
  1. mail to a central site is accessed by internet client
  2. moderators vote +/-/0/not now
  3. threshold weighting + and -
  4. selection of moderators left open
  5. security of approved header left open

I had thought of using email to distribute articles to the moderator,
but one might just as easily use NNTP.  The modified newsreader could
be pointed at the restricted-to-moderators NNTP site.  NNTP might not
even need extension, if the existing authentication procedures can be
hacked to work.  Votes/ratings can be in the form of articles posted
to a .votes or .ratings group.

The rating method and the particular algorithm for weighting will
take some experimentation.  I proposed the "one yes vote" system
because it is enormously simply to implement and because that's the
way the current system works: each person votes yes to approve their
own post.  Since not everyone will be a moderator, this method already
gets rid of most newbie questions.

If a disruptive moderator gets on board, their name would be attached
to the post.  If it gets bad enough, the bad moderator can be removed.
This removal can happen by popular demand or by the person or
organization which owns the central site for the moderator address.
Unlike usenet, which has no specific point of control, the central
site would have final say.

Later protocols could be developed to get rid of the hazards of single
central sites.  This central site is only for each newsgroup, though,
not the whole system.

I wouldn't worry about forged Approved: headers right now.  That bit
of usenet will take major public key surgery to fix.  I don't think it
will happen until the RSA patents expire.

Eric

Date: Tue, 15 Feb 94 17:11:34 -0800
   From: hughes@ah.com (Eric Hughes)

   To summarize the specifics of Ted's proposal:
     1. mail to a central site is accessed by internet client
     2. moderators vote +/-/0/not now
     3. threshold weighting + and -
     4. selection of moderators left open
     5. security of approved header left open

   I had thought of using email to distribute articles to the moderator,
   but one might just as easily use NNTP.  The modified newsreader could
   be pointed at the restricted-to-moderators NNTP site.  NNTP might not
   even need extension, if the existing authentication procedures can be
   hacked to work.  Votes/ratings can be in the form of articles posted
   to a .votes or .ratings group.

I wouldn't do it that way.  There's too much overhead involved in
talking to the .votes or .ratings group.  I'd instead extend the NNTP
protocol with a "XVOTE" command, which can take the arguments "yes" or
"no"; this way, the server code is much simpler.  The client code won't
be that bad --- it would be pretty easy to modify gnus to do the right
thing.  It will be important to have real authentication to that central
site, though; password stealing is all too common these days.

   Later protocols could be developed to get rid of the hazards of single
   central sites.  This central site is only for each newsgroup, though,
   not the whole system.

I wouldn't worry about the "hazards of the single central server" for
quite a while, precisely because it is only for each newsgroup.  I'd
imagine that the number of people that would be moderating a newsgroup
would be relatively small.

   I wouldn't worry about forged Approved: headers right now.  That bit
   of usenet will take major public key surgery to fix.  I don't think it
   will happen until the RSA patents expire.

Actually, it might not be that hard to fix.  Consider an additional
header line which contains the signature of selected header fields (say,
the message-id, the date, the from field, and the subject).  I doubt
that a news systems would ever verify the signature while they are
accepting mail --- that would slow down the news throughput
unacceptablely throughout the system --- but one can imagine an
"auto-cancellation" system installed on a few key sites that would send
out cancel message for any article a "new moderated group" that didn't
have a valid signature on it.  That way, you don't even need to get the
signature validation software running on all sites; indeed, most sites
wouldn't need to upgrade their software at all, which is a major point.

One problem that hasn't been addressed is the social one: how do people
choose moderators?  The only method we currently have involves
conducting a Usenet vote, which tends to be a long and cumbersome
process.  Any other one, unfortunately, tends to bring up cries of
"Usenet cabal" very quickly.  The one exception is the "anyone can be a
moderator"; but that will only stop the newbie poster --- it won't stop
a determined attacker.



						- Ted

>One problem that hasn't been addressed is the social one: how do people
>choose moderators?  

I'm not convinced this needs to be decided up front.  For the first
such group, whoever hosts the ratings site can decide who gets to
moderate.  A benign autocrat is ideal in this case.

The lessons of experience will be needed to decide how to do the
second and subsequent groups.  One of the reasons I outlined a broad
framework for distributed moderation is that we really can't tell in
advance what systems will be desirable, and whatever it is, it will
likely vary from group to group.

We will eventually need to figure out a way to have multiple groups
with the same topic but with different moderation techniques.
Fractious bickering will cause schisms, and creating namespace turf to
fight over is counterproductive when there need not be such a problem.

This is one of the reasons I suggested using a separate newsgroup for
rating/voting, to support multiple moderation groups.

On voting for a moderator:

>Any other one, unfortunately, tends to bring up cries of
>"Usenet cabal" very quickly.  

I say fine, let them cry.  It would be impolitic to take over and
monopolize a particular topic, so that if there are complaints about
the moderated group, there's always another place to go.

This is another reason to think about how to do multiple moderation,
which is to say to the whiners "put up or shut up".

Eric

From: tcmay@netcom.com (Timothy C. May)
   Date: Tue, 15 Feb 1994 11:38:54 -0800 (PST)

   It's broken in the larger sense that Eric mentioned: costs are not
   incurred by posters. This is not just a problem with remailers, but
   with the growing numbers of "Make.Money.Fast" and "Allah is Coming!"
   sorts of posts. Think about it.

I've heard this assertion made a large number of times --- that if the
poster had to pay for the cost of a posting, that all of our problems
would go away (or at least a lot of them would).

I'm not convinced they would; perhaps it is time to start exploring this
assumption.  Digital postage solves the problem that it becomes
expensive for someone to flood a mailing list or a newsgroup with 10,000
annoying messages.  But all it does is disenfranchise the poor; the rich
would still be able to make themselves a nuisance.  How do you defend
against someone like Detweiler if he has the resources of a Donald
Trump, or a Bill Gates?

Also, how much do you charge?  For example, Detweiler's Blacknet posting
only went to some 20-odd newsgroups, and yet it was able to do a lot of
damage.  If you charge $1 a message, then for a mere $20, he was able to
cause a lot of damage and consternation on the net.  If you start
charging $10 a message or more, legitimate users will be hurt, since
they will now have to pay this large amount of money.  And in the long
run, it still doesn't work, since Detweiler wasn't even being very
efficient.  For example, he could have sent a GIF image containing kiddy
porn or bondage pictures to soc.women; then the sh*t would have really
hit the fan.  A single message can do quite a lot of damage.

Digital postage alone does not solve the accountability problem.

						- Ted

Ted Ts'o writes:

> I've heard this assertion made a large number of times --- that if the
> poster had to pay for the cost of a posting, that all of our problems
> would go away (or at least a lot of them would).

Some problems will be lessened, some will remain. Nothing is perfect,
but digital postage is certainly a step in the right direction....it
at least makes the process of posting and mailing less "free" than it
currently is. (As to why remailing should _not_ be free, I'll not get
into this political issue here. Suffice it to say that nothing is
completely free--someone pays. Right now, the remailer operators are
eating the costs.)

> I'm not convinced they would; perhaps it is time to start exploring this
> assumption.  Digital postage solves the problem that it becomes
> expensive for someone to flood a mailing list or a newsgroup with 10,000
> annoying messages.  But all it does is disenfranchise the poor; the rich
> would still be able to make themselves a nuisance.  How do you defend
> against someone like Detweiler if he has the resources of a Donald
> Trump, or a Bill Gates?

A "problem" we can't solve. Placing a ad in a newspaper costs 10 bucks
or so, for example. Does this "disenfranchise" the poor? Does the fact
that Bill Gates could probably buy the nation's five largest papers
mean that ads should be free? Paid for by whom? I can't pursue this
topic any further here--it's too political for the list to have to bear.

> Also, how much do you charge?  For example, Detweiler's Blacknet posting
> only went to some 20-odd newsgroups, and yet it was able to do a lot of
> damage.  If you charge $1 a message, then for a mere $20, he was able to
> cause a lot of damage and consternation on the net.  If you start
> charging $10 a message or more, legitimate users will be hurt, since
> they will now have to pay this large amount of money.  And in the long
> run, it still doesn't work, since Detweiler wasn't even being very
> efficient.  For example, he could have sent a GIF image containing kiddy
> porn or bondage pictures to soc.women; then the sh*t would have really
> hit the fan.  A single message can do quite a lot of damage.

Agreed, it doesn't solve all problems. 

And part of the problem lies in Usenet itself, as we have been
discussing. The "broadcast" model, without any form of postage along
the way, means that any message can in principle be sent to thousands
of sites (though dial-in users are of couse not obligated to read
these posts, and hence don't have to incur expenses). 

I fully agree that no single price for a "stamp" could wipe out the
problem. Even setting the price at $100 would be insufficient for a
determined disruptor to find the juiciest exmaple of child porn and
then pay the $100 to have it remailed to a site or newsgroup which
would almost certainly guarantee massive repercussions. This could be
child porn, pet torture (recall the "Kitty in a Blender" posts on
rec.pets a year or so back), detailed military secrets, personal
dossiers on a leading government official, whatever.


> Digital postage alone does not solve the accountability problem.

No one has claimed this. All that has been claimed is that it raises
the costs of flooding a bit. A step in the right direction.

Long range, Usenet will likely be restructured in some way so that
users choose what they wish to receive.

Actually, I think the "volume" arguements--that Detweiler consumed too
much volume--are wrong-headed. His posts added infinitesimally to the
hundreds of megabytes a day flowing throught the system. I looked at
the newsgroups Hal mentioned that the BlackNet piece went out to, and
the posts were lost in the noise. Granted, they were "off subject,"
but so are a lot of posts.

I'm not minimizing the downsides, just pointing out that the angry
reactions were more likely related to the subject material itself and
the total irrelevance to the "diabetes" and "frg" groups than to the
slight increase in volume the posts caused.

--Tim May


-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power:2**859433 | Public Key: PGP and MailSafe available.

From: tcmay@netcom.com (Timothy C. May)
   Date: Tue, 15 Feb 1994 13:25:11 -0800 (PST)

   And part of the problem lies in Usenet itself, as we have been
   discussing. The "broadcast" model, without any form of postage along
   the way, means that any message can in principle be sent to thousands
   of sites (though dial-in users are of couse not obligated to read
   these posts, and hence don't have to incur expenses). 

   Long range, Usenet will likely be restructured in some way so that
   users choose what they wish to receive.

OK, well, at least I understand how digital postage would work,
technically.  But it sounds like we all agree that it's not enough.

If we assume that Usenet is "broken", how do we fix it?  Considering how
many users there are (which must be at least one or two orders of
magnitude more than there are of the thousands of news sites), how do
you efficiently get articles only to the users who want them, and no
others.  And heck, how do you even have the users *describe* which
postings they want?  In some ways, rec.pets.birds is a rough description
of what they want, by common consensus.  The problem is that there's no
enforcement on it, so anyone can become Detweilered.

And if you do have to send your filter out across the network, there are
obvious privacy implications as well --- it's one of the reasons why
Usenet's flooding algorithm is somewhat useful.  Users at MIT can read
alt.sex.bondage without needing to send their identity out on the global
network (and we *DON'T* keep logs on our news server!).

For this reason, ``your long range solution'' has a lot of very tough
technical challenges hiding behind it!!!

Instead of just hearing people say that "Usenet is broken", I'd love to
hear about some suggestions about how to re-architect it, at a real
technical level.  "Cypherpunks write code" --- well, it sounds like
there's a really big and interesting problem here.

						- Ted

C'punks,

On Tue, 15 Feb 1994, Theodore Ts'o wrote:

> I'm not convinced they would; perhaps it is time to start exploring this
> assumption.  Digital postage solves the problem that it becomes
> expensive for someone to flood a mailing list or a newsgroup with 10,000
> annoying messages.  But all it does is disenfranchise the poor; the rich
> would still be able to make themselves a nuisance.  How do you defend
> against someone like Detweiler if he has the resources of a Donald
> Trump, or a Bill Gates?
> 
Ever notice how few mail bombs we get from Trump or Gates?  Maybe the 
rich are rich because they've learned self-restraint.  Bet you dollars to 
donuts that LD doesn't have a pot to pee in or a window to throw it out.


 S a n d y

P.S.  Oops!  Broke my own pledge, sort of.  Okay, I'll climb back on the 
wagon.

> [Usenet] is broken in the larger sense that Eric mentioned: costs
> are not incurred by posters. This is not just a problem with
> remailers, but with the growing numbers of "Make.Money.Fast" and
> "Allah is Coming!" sorts of posts. Think about it.

Be carefull of what you wish for,  we have plenty of systems where
the costs for information are incured by the ones that produce and
diseminate it.  I for one will fight long and hard to insure that
usenet stays free and does not sink into the same myopic sluge pit
that corporate press wades through.

It's very importaint that usenet be free for anyone to post.  It's
also becoming nessesary to have good noise filters on the readers
end.


brad