"Gnusaic"? Why not a Gnu-Style Web Browser?

I'm pretty happy with Netscape 1.1N, but John Gilmore's point about NCSA
Mosaic gives me a thought:

At 6:44 AM GMT 9/21/95, John Gilmore wrote:

>>   I realize that some cypherpunks think that we should make all of
>> our code publicly available.  In an ideal world that would be great,
>> but we live in a world with politicians, crooks, lawyers, stockholders,
>> etc...  Don't expect to see us posting our entire security
>> library source code to cypherpunks.
>
>Naah.  I think NCSA should've made Mosaic publicly available, because
>they wrote it with our tax dollars.  And I hold it against them that
>they started the trend of "zero-cost personal-use binaries but no
>commercial use" that many Net users still confuse with Real Free
>Software (free as in freedom).  But Netscape owns its code, it can do
>whatever it wants with it.

Why not a Gnu-style Web browser? I don't know if the original Mosaic can be
used and added to, but I can imagine something like this could be done.

Web browsers are becoming, for many of us, our de facto interfaces to the
Net, not just the Web. A project to make a truly freely distributable Web
browser and Web server (the other part of the puzzle) could be interesting.
Strong crypto could be added by volunteers working in their specialties,
and the "Web proxie" could be put in with robustness (D-H forward secrecy,
for example).

I'll stop now, as I've never been a Gnu customer (except for Emacs), and so
I'm not really in a position to comment and speculate on Gnu.

For all I know, Stallman and others have already thought of this and are
working on it.

--Tim May


Notice: With 1000 people on the Cypherpunks list, and many on other lists I
am on, nearly every article I write generates at least one question,
request for more information, dispute with my choice of words, etc. I have
been trying to respond to these, usually privately, but the burden has
become too much, and I no longer plan to respond to trivial or ephemeral
points. If you don't hear from me, this is why. Some requests for pointers
to information will still be handled, but I advise people to learn how to
use the archives and/or search tools.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
Corralitos, CA              | knowledge, reputations, information markets,
Higher Power: 2^756839      | black markets, collapse of governments.
"National borders are just speed bumps on the information superhighway."

"free" access to source code and "free" source code w/ free binaries 
are too often confused. in and of itself, GNU or Stahlman are not 
providing free software for whatever use.  GNU allows free distribution, 
but not free commercialization --a good idea except critical maintenance 
is at the time-available consideration of the author.

   Sun permits access (well, relatively free) access to their source code 
for the Java Series and is actively promoting open porting. personally, I 
like Java/Hot Java.

   as to a GNU-like product, I concur with TCM -it needs to be done 
before the commerical interests, politicians, NSA, and assorted crooks 
control the means whereby we communicate, and the browser, IMHO, has 
improved our communication and access to information by many orders of 
magnitude. Now, if any of the non-Gates browsers could fully support 
multi-use/multi-view mail, news, and info browse at the same time....

   I have the code for Mosaic, Java, etc. --they are not trivial. and 
don't forget VGML.

=====================  ORIGINAL MESSAGE  =============================

On Thu, 21 Sep 1995, Timothy C. May wrote:

> 
> I'm pretty happy with Netscape 1.1N, but John Gilmore's point about NCSA
> Mosaic gives me a thought:
> 
>
   [snip]
> 
> Why not a Gnu-style Web browser? I don't know if the original Mosaic can be
> used and added to, but I can imagine something like this could be done.
> 
> Web browsers are becoming, for many of us, our de facto interfaces to the
> Net, not just the Web. A project to make a truly freely distributable Web
> browser and Web server (the other part of the puzzle) could be interesting.
> Strong crypto could be added by volunteers working in their specialties,
> and the "Web proxie" could be put in with robustness (D-H forward secrecy,
> for example).
>
   amen!
> 
> I'll stop now, as I've never been a Gnu customer (except for Emacs), and so
> I'm not really in a position to comment and speculate on Gnu.
> 
> For all I know, Stallman and others have already thought of this and are
> working on it.
> 
> --Tim May
>

In servalan.mailinglist.cypherpunks Tim May writes:
>Why not a Gnu-style Web browser? I don't know if the original Mosaic can be
>used and added to, but I can imagine something like this could be done.

Um, if you mean "freely distributable, in source form" by "Gnu-style",
I don't think there's much of a shortage of Gnu-style WWW browsers and servers. 
Lynx and Chimera are my two favorite WWW browsers, and both come in source form.
Then there's w3.el, the WWW browser for Emacs.   As for Web servers, you can
get the source code for Plexus or CERN httpd off the net.  Plus, doesn't
Eric Young have someone's httpd already hacked to include SSL-compliant
encryption?

The question becomes why don't the free WWW software people out there now
support crypto?  Maybe they're simply not expert in or interested in crypto,
or maybe they don't want to mess with the ITAR hassles.

On Thu Sep 21 21:59:00 1995: you scribbled...
> 
> In servalan.mailinglist.cypherpunks Tim May writes:
> >Why not a Gnu-style Web browser? I don't know if the original Mosaic can be
> >used and added to, but I can imagine something like this could be done.
> 
> As for Web servers, you can
> get the source code for Plexus or CERN httpd off the net.  Plus, doesn't
> Eric Young have someone's httpd already hacked to include SSL-compliant
> encryption?

Yes.  This has been done.  A set of patches for NCSA's HTTPd (for US 
folks only) can be found at

	http://petrified.cic.net/~altitude/ssl/howto.html

I got the patches from the ssleay gang in AU, but i haven't seen them on
their ftp site yet, so if you're outside the states, it'll be available
rsn (i think...)

> The question becomes why don't the free WWW software people out there now
> support crypto?  Maybe they're simply not expert in or interested in crypto,
> or maybe they don't want to mess with the ITAR hassles. 

Well, I have been trying for the last 3 months to put together a "free"
WWW server to both commercial and non-commercial institutions in the
states (I'm only concerned about people in the states for now because most
of the important issues are moot if you're outside of the states).

The main problems that I've run into are:

   * Crypto is a difficult topic to understand:
       I didn't know anything about crypto when i started.  It's taken me
       this long to start understanding the fundamental concepts and such.
       And i'm still really in the dark about a lot of it.

   * Specific information about crypto, (especially licensing and other
     legal stuff) is difficult to find.
       Since there are so many patents/trade secrets regarding crypto
       libraries/algorithms/protocols, any developer MUST deal with the
       corresponding companies.  That process is long and painful.

   * Money
       There are bound to be legal problems, for example, the RC4
       situation.  According to everything I've heard, it is legal to use
       RC4 because it doesn't have trade secret status anymore.
       Unfortunately, RSA will most likely bring suit to anyone who tries.  

   * ITAR
       'Nuff said.

As for my plan to "provide" a ssl'ized web server, my plan is to put
together a "package" which contains NCSA's HTTPd, SSLeay, and a version of
RSARef.   I would only charge whatever the licensing costs were to me
(There's a minimum $20 cost for the commercial RSARef from Consensus, and
I'm still working on the RC4 licensing).

Oh yeah, one other problem is that companies like RSA are completely
unaccustomed to dealing with people providing "free" products.  For
example, At first, RSA kept asking me for a "Business Plan" so that we
could work out a percentage royalty that I would pay them for RC4
licensing.  They were completely aghast when i said that I wanted to
provide it for free.  The pointed me to RSARef, but i told them that i
wanted to provide it for commercial institutions too, so they asked for
business plan, and the cycle continued....  (I've started working with
them again, so things are progressing for now...).  I know that I don't
really have to go through the RC4 licensing with RSA, but i don't have the
money to buy dinner, let alone go head to head with RSA in court.

anyway, if y'all are interested, more info can be found at
http://petrified.cic.net/~altitude/ssl/ssl.saga.html.  I'd be happy to
answer questions, but seeing the knowledge level on the cp list, i feel
sort of inferior.

Thanx.

...alex...

     Alex Tang  altitude@cic.net   http://petrified.cic.net/~altitude
   CICNet: Unix Support / InfoSystems Services / WebMaster / Programmer
       Viz-It!: Software Developer (Check out http://vizit.cic.net)
  UM-ITD: TaX.500 Developer (Check out http://petrified.cic.net/tax500)