Let the Snake Oil Flow

There have been several purveyors of (potential) snake oil here.
Predictably, critics have been drawn into "trying to break" these allegedly
strong systems. Some of the purveyors are even saying things like
[paraphrased, but with charming misspellings emulated]:

"See, even the smarty-pants Cyphurpunks are unabble to brake ouir system!
Our virtuel one-time pad, which converts 10 randumly picked bits into 1000
or 10,000 or even a bazillion!, by our patented processo of "entropy
enhancemate," has defeated even immacarthy and metzger. Our system rulez!"

And so it goes....

Predictably, others are asking/expecting "the Cypherpunks" to break their
systems. Just as predictably, many of us are patiently (and impatiently)
explaining that breakages cost money and resources. And so the "developers"
gleefully respond that this proves the "Cyperpunks" [sic] are helpless
before their software.

Well, it seems to me that letting some real snake oil out there could be a
Good Thing. Being the Neo-Calvinist Darwinist that I am, I set that anyone
who puts valuable information into "PowerPads" and "Stream-of-Consciousness
Ciphers" pretty much deserves what he or she gets. I am not losing any
sleep that Snake Oil Enterprises is hyping a conceptually flawed system.

A few highly publicized failures could be educational, and ultimately help
to strengthen the Net. You don't get better bridges without some
highly-visible bridge collapses. Raises consumer awareness of what good
design really is.

Personally, I'm much more worried about the behind-the-scenes goings on
with key escrow, the pressures being applied to Netscape, Lotus, Microsoft,
TIS, etc., than I am in Yet Another Clueless Crypto Product (tm).

--Tim May

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^756839 - 1  | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

All valid points, but when the likes of Nathaniel Borenstein &
his cohorts use the failures of snake oil to discredit all
cryptography, then we have a problem. (Not to say that Netscape is
selling snake oil... but I figure that FV would capitalize on a snake
oil failure to further their anti-cryptography agenda just as they
have used the Netscape RNG bug)

-- 
Sameer Parekh					Voice:   510-601-9777x3
Community ConneXion, Inc.			FAX:     510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.org/ (or login as "guest")		sameer@c2.org

Mark Allyn writes:
 > Please pass along this to anyone you know who has an email account! We
 > need to have everyone take part in this protest!

Sophomoric idiocy.  I can think of few actions that would marginalize
the on-line community more than for a bunch of geeks to mailbomb the
"white house".  Some poor sysadmin will be stuck dealing with his
filled-up mailbox, and that's it.  Is anybody so seriously delusional
that they imagine poor Bill Clinton having to work his way through all
the mail with elm?

Sheesh.

______c_____________________________________________________________________
Mike M Nally * Tiv^H^H^H IBM * Austin TX    * I want more, I want more,
       m5@tivoli.com * m101@io.com          * I want more, I want more ...
      <URL:http://www.io.com/~m101>         *_______________________________

But if the sysadmin at the white house gets so busy and has to charge
overtime, then it comes to the boss's attention and then the boss 
would know what is up. The boss would not see the individual email
messages, but he would get the gist.

I happen to be a sysadmin for a zillion servers and groups
of machines on a big huge corporate 
network. I have had to deal with full email buffers. When I spend
overtime fixing them, Gordon, my manager demands to know why. I will
honestly tell him what is happening. If it was because of a protest, 
I would tell him. Knowing him, he would probably want to look at
a sample of the emails.

Mark

Hello:

Please pass along this to anyone you know who has an email account! We
need to have everyone take part in this protest!

Mark


>From silber Thu Feb 22 20:56:33 1996
Received: (from silber@localhost) by mark.allyn.com (8.7/8.7) id UAA00520 for allyn; Thu, 22 Feb 1996 20:56:20 -0800 (PST)
Date: Thu, 22 Feb 1996 20:56:20 -0800 (PST)
From: Andy Silber <silber>
Message-Id: <199602230456.UAA00520@mark.allyn.com>
>From: Scott Bell <SBell@r2mail.r2.com>
>To: "Barry D. Ballard" <bballard@tonto.den.csci.csc.com>,
Status: RO

>        NED_PUEV <NED_PUEV@HP-Loveland-om2.om.hp.com>,
>        Radar <radar@itouch.net>,
>        Denise HP TechSupport <sdm@hpuerca.atl.hp.com>,
>        sgajar <sgajar@crosslink.net>
>Subject: FW: FWD>Bill O Rights
>Date: Wed, 21 Feb 96 14:27:43 PST
>Encoding: 120 TEXT
>X-Mailer: Microsoft Mail V3.0
>Status:
>
>
>
> ----------
>From: Dave Behrns
>To: MIS Mail Group
>Subject: FW: FWD>Bill O Rights
>Date: Wednesday, February 21, 1996 2:10PM
>
>
>
>>>To whoever may read this,
>>>
>>>This is not a typical letter, in that by passing it on to as
>>>many people as you can, you are taking part in what may yet become the
>>>world's biggest practical joke. The U.S. Government has rece ntly
>>>passed an act which enforces censorship on the internet. A group of
>>>internet users has now come together to kick back at this oppression,
>>>and have a bit of fun at the same time. >The aim of this exercise is
>>>to re-establish the United States as "The land of the Free", not a
>>>fascist state where freedom of speech and thought are curtailed.
>>>Communist Russia fell as a result of s uch limits being placed upon
>>>the minds of the general populus. On receiving this letter, please
>>>pass it on to as many friends or E-mail lists as you can. We predict
>>>that if everybody copies the lette r to 5 other addresses, by February
>>>29th 1996, this letter should have reached in excess of 2 million
>>>people. That's when the fun begins........ >On February 29th, please
>>>send the message:
>>>
>>>Dear Mr. President,
>>>Do you remember this:
>>>
>>>And afterwards enclose the pre-typed copy of the Bill of rights. By
>>>sending the letter on the date above, you will contribute to either
>>>one huge petition for freedom, or else lead to a crash of the
>>>whitehouse server.Send all letters to: >President@Whitehouse.gov
>>>
>>>Remember that solidarity is the key to success !!!!!
>>>
>>>
>>>---------------------------------------------------
>>>
>>>THE BILL OF RIGHTS
>>>
>>>Amendment I
>>>
>>>Congress shall make no law respecting an establishment of religion, or
>>>prohibiting the free exercise thereof; or abridging the freedom of
>>>speech, or of the press; or the right of the people peaceably to
>>>assemble, and to petition the government for a redress of grievances.
>>>
>>>Amendment II
>>>
>>>A well regulated militia, being necessary to the security of a free
>>>state, the right of the people to keep and bear arms, shall not be
>>>infringed.
>>>
>>>Amendment III
>>>
>>>No soldier shall, in time of peace be quartered in any house, without
>>>the consent of the owner, nor in time of war, but in a manner to be
>>>prescribed by law.
>>>
>>>Amendment IV
>>>
>>>The right of the people to be secure in their persons, houses,
>>>papers, and
>>>effects, against unreasonable searches and seizures, shall not be
>>>violated, and no warrants shall issue, but upon probable cause,
>>>supported by oath or affirmation, and particularly describing the
>>>place to be searched, and the persons or things to be seized.
>>>
>>>Amendment V
>>>
>>>No person shall be held to answer for a capital, or otherwise
>>>infamous
>>>crime, unless on a presentment or indictment of a grand jury, except
>>>in cases arising in the land or naval forces, or in the militia, when
>>>in actual service in time of war or public danger; nor shall any
>>>person be subject for the same offense to be twice put in jeopardy of
>>>life or limb; nor shall be compelled in any criminal case to be a
>>>witness against himself, nor be deprived of life, liberty, or
>>>property, without due process of law; nor shall private property be
>>>taken for public use, without just compensation.
>>>
>>>Amendment VI
>>>
>>>In all criminal prosecutions, the accused shall enjoy the right to a
>>>speedy and public trial, by an impartial jury of the state and
>>>district wherein the crime shall have been committed, which district
>>>shall have been previously ascertained by law, and to be informed of
>>>the nature and cause of the accusation; to be confronted with the
>>>witnesses against him; to have compulsory process for obtaining
>>>witnesses in his favor, and to have the assistance of counsel for his
>>>defense.
>>>
>>>Amendment VII
>>>
>>>In suits at common law, where the value in controversy shall exceed
>>>twenty dollars, the right of trial by jury shall be preserved, and no
>>>fact tried by a jury, shall be otherwise reexamined in any court of
>>>the United States, than according to the rules of the common law.
>>>
>>>Amendment VIII
>>>
>>>Excessive bail shall not be required, nor excessive fines imposed, nor
>>>cruel and unusual punishments inflicted.
>>>
>>>Amendment IX
>>>
>>>The enumeration in the Constitution, of certain rights, shall not be
>>>construed to deny or disparage others retained by the people.
>>>
>>>Amendment X
>>>
>>>The powers not delegated to the United States by the Constitution, nor
>>>prohibited by it to the states, are reserved to the states
>>>respectively, or to the people.
>>
>>
>>
>

While I'd never disagree with my good buddy Tim, let me tell
you all about the neatest medial hack since anesthesia, TMS, or
Transcranial Magnetic Stimulation!

	This astounding use of magnetic fields can stimulate or deaden
nerves through the skull!  Its being used right now in research
hospitals to create functional mappings of the human brain!

	An experiment I witnessed involved a volunteer who had his
cold nerves turned off by placing a small probe over his head.  He was
completely unable to feel the cold of an ice cube placed on his bare
skin!

	Snake oil?  No.  Its really out there, and is has real
possibilites.  But how is the lay person to tell?  With a car, you can
see if it turns on.  With a replacement for anesthetics, you can
decide if it works pretty easily.  "Can you tell that I just cut your
arm?"  But with crypto, you need to wade through the excellent, but
quite long, sci.crypt FAQ, if you even find a pointer to it. 

	Altavista comes back with 48000 hits when asked for Crypto.
"Introduction to cryptography" is a more tolerable 100 documents, but
how to know which are good, and which are snake oil?  The reputation
software to help filter is lacking.

	So, I see a value to flaming the snake oil salesmen loudly,
today.  Not that we shouldn't let the market handle the situation, but
part of that market is that crypto enthusiasts (aka cypherpunks) will
flame the snake oil salesmen.  Not that other issues you mention (such
as the behinds the scenes deals) aren't important, but in the face of
no information, we can't discuss that much.


Adam

Timothy C. May wrote:

| Well, it seems to me that letting some real snake oil out there could be a
| Good Thing. Being the Neo-Calvinist Darwinist that I am, I set that anyone
| who puts valuable information into "PowerPads" and "Stream-of-Consciousness
| Ciphers" pretty much deserves what he or she gets. I am not losing any
| sleep that Snake Oil Enterprises is hyping a conceptually flawed system.

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

tcmay@got.net (Timothy C. May) writes:

 > Predictably, others are asking/expecting "the Cypherpunks"
 > to break their systems. Just as predictably, many of us are
 > patiently (and impatiently) explaining that breakages cost
 > money and resources. And so the "developers" gleefully
 > respond that this proves the "Cyperpunks" [sic] are helpless
 > before their software.

Which is patently silly, of course.  Unless some TLA writes me an
obscenely large check, I am unlikely to try and break anything
that hasn't achieved significant market penetration and
widespread use, whether it is an operating system, or an
application which utilizes encryption.

I'm not even interested in breaking the individual building
blocks of such things, such as block ciphers and RNGs, outside of
the context of their use in a specific application.  Unless
something is obviously braindead on delivery, it makes little
sense to attack it in the abstract, and the nicest weaknesses in
systems often depend upon the little details, as the Netscape and
Kerberos folk have discovered.

All of this means that challenges by the snake oil peddlers, and
even well-advertised public floggings of new ciphers, like RC5,
really don't do much to discover design flaws or weaknesses. It's
like the ten people who post "I have invented an unbreakable
cipher" to sci.crypt each week, and when no one cares, proudly
declare victory and go home.

 > A few highly publicized failures could be educational, and
 > ultimately help to strengthen the Net. You don't get better
 > bridges without some highly-visible bridge collapses. Raises
 > consumer awareness of what good design really is.

Yes - one neat hack against Netscape or Microsoft is worth an
infinite number of dull papers in "Cryptologia" as far as public
relations are concerned.

 > Personally, I'm much more worried about the
 > behind-the-scenes goings on with key escrow, the pressures
 > being applied to Netscape, Lotus, Microsoft, TIS, etc., than
 > I am in Yet Another Clueless Crypto Product (tm).

Let a thousand Clueless Crypto Products bloom today. :)

--
     Mike Duvos         $    PGP 2.6 Public Key available     $
     mpd@netcom.com     $    via Finger.                      $