"Children's Letters to Benificent Stalin"

Uu> URBANA -- A University of Illinois student has been arrested for
 Uu> threatening the life of President Clinton, U.S. Attorney Frances Hulin
 Uu> announced today.
 Uu> Christopher James Reincke, 18, of Townsend Hall, Urbana,
 Uu> allegedly sent an electronic mail message to the White House on Dec. 4
 Uu> threatening Clinton, Hulin stated in a press release.

About all this proves is that whitehouse.gov reads their e-mail after
all, bless their little cotton socks, but one has to use a bit of heavy
rhetoric to get any attention.

As has been mentioned in another forum, there are Federal laws that
require immediate and vigorous investigation of any threat made on the
life of the president, serious or not.  I am curious as to the
practicability of using this (not personally, mind you) as a "barium
test" of encryption and remailer security.

"Barium" is the old British intelligence term for inserting a dummy
message inside normal "secure" communications channels as a check.  The
content of this message would be so explosive that if the opposition had
compromised the communications system, a certain, observable reaction
would be forthcoming.

To my knowledge, no serious barium testing has been done of either the
remailers or PGP, among other "secure" privacy measures.  The Sacramento
child-molestation case seems to indicate that if PGP was compromised by
law enforcement assets (to FBI level in that particular case) this fact
would not be revealed for a purpose as politically-insignificant as
breaking up a child molestation ring.

>To my knowledge, no serious barium testing has been done of either the
>remailers or PGP, among other "secure" privacy measures.  

And a good thing too for the remailers, since they're not secure yet.
This is not a problem, however.  There are two often overlooked
aspects of crypto deployment that the current remailers satisfy
nicely:

1) People have to get in the habit of using security tools.
2) The non-cryptographic software infrastructure has to support security tools.

For practical purposes, these two aspects are more important than the
actual security of the systems created, because the best system is
worthless if it goes unused.

The remailers work sufficiently well to satisfy these two criteria,
well enough to support transparent encryption and remailing in the
mail user agents, e.g. elm, rmail.  Unfortunately, progress along
these lines has been slow.  The problem is not primarily technical,
however.  The way I see it, this is yet another manifestation of one
of the really bad social values in the Unix and Internet community.

Namely, that integration and ease-of-use just aren't cool.  Value and
respect are accorded to those endeavors which require high levels of
abstractional difficulty or complex optimizations, not to the person
who rights an auto-installation routine.  There is something of a
contempt for the person who's installing software if they can't just
tweak the Makefile or some configuration headers a bit.  Very few
programs don't take some greater or lesser skill as a programmer in
order to get working.

And Unix-lovers wonder why more people don't use Unix.

This hierarchy of value mimics society at large, where design
engineers are accorded much more respect that manufacturing engineers.
A design engineer creates a nice product and gives it to someone lower
on the chain to figure out how to make.  This is changing somewhat,
but the placement of design over manufacture is still firmly in place.

Let me praise Sameer Parekh here for writing an auto-install script
for the current remailer.  His work is not finished, but it's better
than nothing.

Also let me critique the ease of use of some of the other crypto
applications we have.

As far as interface goes, PGP sucks.  I've been trying to get a good
system running on MSDOS to read my encrypted mail more easily.  When
PGP gets an error, watch out, and don't expect predictable behavior.
PGP doesn't have enough separation of function to determine what the
problem is in an automated fashion.

Installation of Secure Drive requires, to my knowledge, futzing with
disk partition tables in order to use it on an existing harddisk.
More programmer skills.  The makers of this and similar efforts should
find some code for a disk defragmenter and write a program to
automatically create a partition, safely moving the existing
information out of the way or over to the other partition.

The remailers, and regular encryption of email, for that matter, are
going to remain mostly unused until these capabilities are integrated
into the average mail user agent, and then become part of the standard
distributions for these packages.

And lastly, for those that might want to call me a hypocrite, remember
that I'm working on packaging digital money into a business, the
necessary and inevitable ease-of-use packaging for this technology.

Eric