"Cypherpunks Write Code" as a Putdown

At 5:25 PM 7/20/95, Patrick J. LoPresti wrote:

>                            If it is ever feasible to
>do what you suggest, someone will do it; your musings will have no
>effect on that.  If you want to make a difference, try writing some
>code yourself...

I want to comment on this latest version of the "Cypherpunks write code"
universal putdown.

It's become common for debates on what is possible, what is likely, and
what should be done for someone to "trump" the argument with the mantra of
"Cypherpunks write code."

In my posting on why I think Netscape and related operating environments
represent the likeliest targets for widespread crypto use (the "big win" I
used in my title), I did not whine that others ought to write code for me.
I said that this is where users were going in massive numbers.

Take it or leave it, as an analysis, but the "try writing some code" is a
meaningless insult.

The world is made up of bridge designers, legal experts, authors, chip
designers, and on and on. Not just programmers.

The line "Cypherpunks write code"--which is sometimes treated here with a
reverence its origins do not support--was a reference to our view that
technology, meaning actual deployment, was more important and interesting
than yet more gabbing about liberty and privacy.

And what is "writing code"? Is it only Perl and C? Or does defining what a
remailer needs to do count as writing code? (Attendees at the first
Cypherpunks meeting, almost 3 years ago, can confirm that I was the one who
spend about two hours describing Chaum's mix work, and running the
"remailer experiment"...we debated how a remailer could actually work, and
Eric Hughes took on the task of writing the first one.)

The "BlackNet" experiment I ran actually worked...the keys worked, the
mechanisms worked, and the experiment has been used by many as an actual
concrete illustration of how untraceable information markets will develop.
An actual demonstration is worth more than mere speculation, and this was
an actual demonstration. I call this "writing code," albeit not C code.

(My actual code writing, in real computer languages, is oriented toward
Mathematica, on my Mac, and Smalltalk Agents. Not all programming is
oriented toward writing Unix tools, and I think the narrow interpretation
of "Cypherpunks write code" to mean this is misleading.)

In any case, even the ur-crypto hacker Zimmermann is writing very little
actual code in PGP these days...does this mean he should "try writing some
code" instead of doing what he apparently does best?

In short, the insulting tone of many Cypherpunks these days is saddening.

I plan to continue to speak my mind, to point out what I think are the more
important routes to a desirable future, and to criticize what I think are
dead ends and ghettoized approaches.

--Tim May

..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,
tcmay@sensemedia.net   | anonymous networks, digital pseudonyms, zero
408-728-0152           | knowledge, reputations, information markets,
Corralitos, CA         | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
"National borders are just speed bumps on the information superhighway."

Timothy C. May writes:
> In my posting on why I think Netscape and related operating environments
> represent the likeliest targets for widespread crypto use (the "big win" I
> used in my title), I did not whine that others ought to write code for me.
> I said that this is where users were going in massive numbers.
> 
> Take it or leave it, as an analysis, but the "try writing some code" is a
> meaningless insult.

Some of us have spent the last several days not getting sleep and
going to meetings here in Stockholm -- defining security standards,
talking to Microsoft people about IPSP integration into Win '95 and
Windows NT, recruiting people to work on the project we have to make
sure that the IETF meeting in Dallas in a few months will have IPSP
security. We hope to have the whole infrastructure of the internet
encrypted within a year or two. I believe that between IPSP for the
links and MOSS (and SHTTP using MOSS for document security) we should
have the whole thing wrapped up in a couple of years. Problems still
to solve include security for the internet's routing protocols,
protection against denial of service attacks, etc.

Remailers and the like are still worthwhile areas for effort, of
course, but I think of those of applications of the secure
infrastructure.

Those people who would rather work than talk are invited to start
reading the internet drafts (some of which are soon to be RFCs) and
help out with the effort. I suspect that a big push from about 25
people could manage to implment just about everything we want and then
we could go on and live the rest of our lives.

There is a lot of real hard work to do in the next year or two and I
invite members of the community to quit waiting for the CryptoRapture
in which the X-Ists bring down the cypher systems of the future, and
help us actually do the job so that we'll see this stuff in our
lifetime.

Perry

On Fri, 21 Jul 1995, Perry E. Metzger wrote:

> sure that the IETF meeting in Dallas in a few months will have IPSP

When and where will this be in Dallas?
--
Ed Carp, N7EKG    			Ed.Carp@linux.org, ecarp@netcom.com
801/534-8857 voicemail			801/460-1883 digital pager
Finger ecarp@netcom.com for PGP 2.5 public key		an88744@anon.penet.fi

Q.	What's the trouble with writing an MS-DOS program to emulate Clinton?
A.	Figuring out what to do with the other 639K of memory.

Perry writes:
> I believe that between IPSP for the
> links and MOSS (and SHTTP using MOSS for document security) we should
> have the whole thing wrapped up in a couple of years. Problems still
> to solve include security for the internet's routing protocols,
> protection against denial of service attacks, etc.

Could someone say a bit more about the perceived difficulties associated
with secure network routing protocols ?  TIA.

I am not at all optimistic about defeating DoS attacks....

[...]
> Those people who would rather work than talk are invited to start
> reading the internet drafts (some of which are soon to be RFCs) and
> help out with the effort. I suspect that a big push from about 25
> people could manage to implment just about everything we want and then
> we could go on and live the rest of our lives.
> 
> There is a lot of real hard work to do in the next year or two and I
> invite members of the community to quit waiting for the CryptoRapture
> in which the X-Ists bring down the cypher systems of the future, and
> help us actually do the job so that we'll see this stuff in our
> lifetime.

(just felt this was worth quoting)

-Futplex <futplex@pseudonym.com>

> 
> Perry writes:
> > I believe that between IPSP for the
> > links and MOSS (and SHTTP using MOSS for document security) we should
> > have the whole thing wrapped up in a couple of years. Problems still
> > to solve include security for the internet's routing protocols,
> > protection against denial of service attacks, etc.
> 
> Could someone say a bit more about the perceived difficulties associated
> with secure network routing protocols ?  TIA.
> 
> I am not at all optimistic about defeating DoS attacks....

  It seems to me that many of these attacks can be defeated by anti-spam
routines (with exponential time buildup) and economic mechanisms. That is,
you pay "credits", which can possibly be based on real money, for each
access. When you use them up, you must contact the service to request more.
Coupled with authentication, this makes DoS tough because you must request
more credits for your ID, however, if you use them up quicker than
average, you must justify why you need them again so soon.

  Anti-spam routines have been successful on IRC and MUDS against DoS. Each
"request" is measured against the time since the last request. If the time
is less than the delay, the request is denied (and with exponential
buildup, you double the delay so that even "needling" attacks where
a DoS attack finds your delay and transmits just under that, has trouble)
If the resource is disk space, or network memory buffers, or whatever, you
impose similar timing sensitive constraints.
 
  This covers most spam based DoS. 

-Ray

By the way, I'm very disappointed that this sort of topic doesn't come
up here more often. I perceive that it may be because lots of people
on this list are cyphergroupies and not actually tuned in to the
technical issues of securing every-day communication.

Futplex writes:
> Could someone say a bit more about the perceived difficulties associated
> with secure network routing protocols ?  TIA.
                                           ^^^^????

> I am not at all optimistic about defeating DoS attacks....

The people building the new routing protocols (BGP, OSPF, etc) have
included cryptographic security provisions in them that will work
regardless of whether IPSEC is available. Some of these have to be
hand configured but thats not actually a problem since peering in many
of these systems has to be hand configured in the first place. I had a
long talk with the Area Director for routing and such in the bar at
the last IETF meeting and he gave me the impression the routing people
are acutely aware of the problem and hope to assure that it disappears
with time.

Given cryptographic security on the routing packets, denial of service
attacks directed against routing become hard. Photuris has built in
protection against denial of service against it, by the way.

With luck, we will be down to dealing with very crude denial of
service attacks like packet flooding and hopefully we can come up with
reasonable mechanisms to stop them in the ordinary case.

Perry

PS Again, I strongly encourage people to get involved in the efforts
to secure the internet with IPSEC, MOSS and similar things. WE NEED YOU!

-----BEGIN PGP SIGNED MESSAGE-----

I have already explained my comments in another thread, but I figure I
should respond to this anyway.

>>>>> "tcmay" == Timothy C May <tcmay@sensemedia.net> writes:

 tcmay> At 5:25 PM 7/20/95, Patrick J. LoPresti wrote:
 >> If it is ever feasible to do what you suggest, someone will do it;
 >> your musings will have no effect on that.  If you want to make a
 >> difference, try writing some code yourself...

 tcmay> In my posting on why I think Netscape and related operating
 tcmay> environments represent the likeliest targets for widespread
 tcmay> crypto use (the "big win" I used in my title), I did not whine
 tcmay> that others ought to write code for me.  I said that this is
 tcmay> where users were going in massive numbers.

That is not all you said; you also suggested that existing interfaces
for "Tin, Pine, Elm, Joe, Emacs, etc." were a waste of time.

 tcmay> Take it or leave it, as an analysis, but the "try writing some
 tcmay> code" is a meaningless insult.

I have apologized for the insulting tone, but I do not feel the
comment was meaningless.  If you are going to criticize my development
efforts, I think it is fair for me to ask, "And what have *you* done?"

The point being, of course, that the criticism itself is unwarranted;
not to make a meaningless insult.

 tcmay> In short, the insulting tone of many Cypherpunks these days is
 tcmay> saddening.

It was a specific response to an insult of my (and others') work.
Again, I apologize.

 tcmay> I plan to continue to speak my mind, to point out what I think
 tcmay> are the more important routes to a desirable future, and to
 tcmay> criticize what I think are dead ends and ghettoized
 tcmay> approaches.

I would hope you would keep the forward-looking vision while ditching
the critical tone.  Those "ghettoized approaches" are the best we have
at present, and they are responsible for the widespread use of PGP,
such as it is.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Processed by Mailcrypt 3.3beta, an Emacs/PGP interface

iQCVAwUBMA7MWnr7ES8bepftAQHgRQP+O60BcHGWSiUETnePX9DrzDKOBfA7VNPB
900twzEO+o21RVBGMePn3zCc2Z70ejsKmgndH/EN74SWt9Ot03BWyWzIFj67BVua
GhWhuyeBXTBGe3ZzfKFTmNUqKNQocj5UxD6CDj/2O5powYjYLCzKBHZTI3UGyE57
MjBY/YclZRw=
=FPXO
-----END PGP SIGNATURE-----

Tim May writes:
> Take it or leave it, as an analysis, but the "try writing some code" is a
> meaningless insult.
[more good comments elided]

Agreed. I concur with Tim's further comments, which I've omitted, on the
meaning of "Cypherpunks write code".  It's clear that the qualifications for
being a critic (in the constructive sense) of activity XYZ differ from the
requirements for doing XYZ, in the general case. This is the old "Oh, if
you're so smart, let's see you do it better" from elementary school. Absurd.

One of the primary sources of this dispute is, I think, the fact that c'punks
have widely divergent target markets in mind. I was rather surprised to
observe this at the last Bay Area physical meeting. Sandy moderated a
prognostication session on the future of cryptoanarchy, etc. Towards the end, 
he asked each person to offer his/her definition of "victory" in the
cryptoanarchic program. Some people were adamant that privacy would need to be
widely protected across society for them to consider the project a success.
Others essentially asserted that they'd be content with what I'll call "the
cypherpunk community" enjoying free access to privacy-preserving tools. 

The various *n*x crypto tools go a long way toward satisfying one market, yet
don't appear to help much with another market. So they constitute a "big win"
for some c'punks, while remaining largely irrelevant for others.

It would behoove c'punks on
all sides not to take umbrage at others' embracing different goals. It
would be great to hear persuasive arguments as to why "we" should adopt your
plan, but "we" are under no obligation to be convinced, or to place any
particular value on the achievement of aims we don't share with you.

The significant segregation of software developers and
software users onto different platforms makes the disunity of purpose much
more of an issue than it would be otherwise. A conscious effort must be 
exerted to ensure that tools developed for the cognoscenti ;) have a
chance to run on the machines owned by the rest of the multiverse. For my
money, this is the best feature of platform-independent languages, etc. 
Ideally, Java and such will afford me the opportunity to write code for, say,
the Macintosh, which could compete with native code, without my having to
break down and use a Mac (gag).

On a related note, this summer I've broken down and found myself developing
software in Tcl under VMS. (I'm typing this on a VAXstation 4000 VLC.) Bob
Snyder has recommended exmh here before, a highly MIME- and PGP-aware mailer
for *n*x which is apparently built with Tcl/Tk. Apart from the discussions
of possibly using Safe-Tcl for remailers, I haven't seen much talk of using
Tcl/Tk for crypto apps here. Can anyone point me in the direction of work on
this front, or towards reasons why Tcl/Tk seems like a poor choice ?  I'm
still pretty new to Tcl.

-L. Futplex McCarthy <lmccarth@cs.umass.edu>
"Want to put your secret files where no-one will ever be able to access them ?
 Try ftp://ftp.netcom.com/pub/"